TikTok’s Security Threats Go Beyond the Scope of House Legislation

In a capital where Republicans and Democrats agree on virtually nothing, it was notable when the House overwhelmingly declared on Wednesday that TikTok poses such a grave risk to national security that it must be forced to sell its U.S. operations to a non-Chinese owner.

But that glosses over the deeper TikTok security problem, which the legislation does not fully address. In the four years this battle has gone on, it has become clear that the security threat posed by TikTok has far less to do with who owns it than it does with who writes the code and algorithms that make TikTok tick.

Those algorithms, which guide how TikTok watches its users and feeds them more of what they want, are the magic sauce of an app that 170 million Americans now have on their phones. That’s half the country.

But TikTok doesn’t own those algorithms; they are developed by engineers who work for its Chinese parent company, ByteDance, which assembles the code in great secrecy in its software labs. But China has issued regulations that appear designed to require government review before any of ByteDance’s algorithms could to be licensed to outsiders. Few expect those licenses to be issued — meaning that selling TikTok to an American owner without the underlying code might be like selling a Ferrari without its famed engine.

The bill would require a new, Western-owned TikTok to be cut off from any “operational relationship” with ByteDance, “including any cooperation with respect to the operation of a content recommendation algorithm.” So the new, American-based company would have to develop its own, made-in-America algorithm. Maybe that would work, or maybe it would flop. But a version of TikTok without its classic algorithm might quickly become useless to users and worthless to investors.

And right now, China has no incentive to relent.

The House vote “was a nice symbolic gesture,” James A. Lewis, who leads the cyber research program at the Center for Strategic and International Studies, said on Wednesday. “But the Chinese get a vote, too.”

It is all part of a broader standoff between the world’s two most powerful technology superpowers. The sparring plays out every day, including in President Biden’s refusal to sell China the most advanced computer chips and in China’s objections to a forced sale of one of the most successful consumer apps in history. A spokesman for China’s foreign ministry said on Wednesday that Washington was “resorting to hegemonic moves when one could not succeed in fair competition.”

It is a remarkable problem, one not envisioned when TikTok first released its app in 2016. At that time, Washington was focused on other problems from Beijing. It accused China’s intelligence agencies of cleaning out the Office of Personnel Management, stealing the security clearance files of more than 22 million American government officials and contractors. It was still smarting from the cyber-enabled theft of American chip designs, jet engine technology and the F-35 fighter.

No one was contemplating the possibility that Chinese engineers could design code that seemed to understand the mind-set of American consumers better than Americans did themselves. By the millions, Americans began to put Chinese-designed software, whose innards no one really understood, on their iPhones and Androids, first for dance videos, then for the memes and now for news.

It was the first piece of Chinese-designed consumer software to go wildly viral across the United States. No American firm seemed capable of displacing it. And so it wasn’t long before its ubiquity raised worries about whether the Chinese government could use the data TikTok collected to track the habits and tastes of American citizens. Panicked, state governments across the United States started banning the app from state-owned phones. So did the military.

But officials know they cannot wrest it from ordinary users — which is why the threat of banning TikTok, especially in an election year, is faintly ridiculous. In a fit of remarkable candor, Gina Raimondo, the commerce secretary, told Bloomberg last year that if any democracy thinks it can outright ban the app, “the politician in me thinks you’re going to literally lose every voter under 35, forever.”

The House bill passed on Wednesday holds open the threat of such a ban. But that is probably not its real intent. Rather, it seeks to give the United States leverage to force a sale. And for two years now, the Committee on Foreign Investment in the United States, a secretive body that reviews corporate deals that could jeopardize national security, has quietly been trying to work out an arrangement that would avert a true showdown. So far it has failed — one reason that the bill passed.

In the course of those negotiations, TikTok has proposed to continue U.S. operations — while still fully owned by ByteDance — and have its algorithm inspected and dissected in the United States. It is part of a broader plan TikTok calls Project Texas.

Under Project Texas, all U.S.-origin user data from TikTok would be stored on domestic servers operated by Oracle, the cloud computing company. To build confidence in the independence of its algorithm, TikTok has also proposed that Oracle and a third party will review its source code to make sure it has not been manipulated.

TikTok says much of this plan is already being implemented. But government officials insist that it is hard to know how such inspections would actually work — even for the most experienced experts, reviewing minor changes in code, at high speed, is a complicated proposition. Biden administration officials say it is not like inspecting agricultural goods or counting weapons under an arms treaty. Very subtle changes could alter the news that is delivered, whether it was about a presidential election or Chinese action against Taiwan.

.

TikTok has tried to enshrine that arrangement into a formal agreement to resolve the government’s national security concerns. But that idea met resistance from senior Biden administration officials, starting with Deputy Attorney General Lisa O. Monaco, who felt it was not tight enough to resolve their concerns.

Instead, the Biden administration and lawmakers have pushed for ByteDance to sell TikTok. Senator Mark Warner, the tech-savvy Virginia Democrat who leads the Senate Intelligence Committee and supports the new bill, said that any sale of the app needed to ensure that the “algorithm doesn’t continue to reside in Beijing or it’s replaced by an algorithm that’s totally independent of the algorithm that is in Beijing.” It also needed to protect the security of TikTok’s data, he said.

But in the House, it was hard to figure out what lawmakers were most concerned about: privacy, the potential for disinformation or just the idea that Chinese-developed code was inside Americans’ (largely Chinese-produced) iPhones. All those worries were often jumbled together.

“Foreign adversaries like the Chinese Communist Party pose the greatest national threat of our time,” said Representative Cathy McMorris Rodgers, the Washington Republican who leads the Energy and Commerce Committee, during the Wednesday House debate over the bill. She called TikTok a “valuable propaganda tool for the C.C.P. to exploit.”

TikTok may not have eased that concern in how it lobbied to defeat the House bill. Ms. McMorris Rodgers noted that TikTok had used an alert in its app to push users to contact Congress and urge a “no” vote. Congressional offices were overwhelmed by the calls, some of which staff members believed came from teenagers. To TikTok’s executives, this was democracy in action. To some in Congress, it proved their point.

“This is just a small taste of how the C.C.P. weaponizes applications it controls to manipulate tens of millions of people to further its agenda,” she said.

David McCabe contributed reporting from New York.