After an internal investigation, TikTok owner ByteDance confirmed today reports this fall that some of its employees are using the popular app to track multiple journalists, including two, in the US. Target of ByteDance employees? Identifying unnamed sources who leaked information to the media about the company’s ties to the Chinese government, according to The New York Times.
Forbes reported that numerous reporters from its own publication were “part of this covert surveillance campaign”. Cristina Criddle, a Buzzfeed reporter and UK-based Financial Times reporter, was also watched, the FT reported. ByteDance employees reportedly accessed the reporters’ TikTok accounts to obtain IP and user data by assessing whether there were any conflicts with pings from known locations of ByteDance employees suspected of leaks. ByteDance confirmed that these tactics had become so commonplace that employees also tracked data from some of the journalists’ aides.
According to Forbes, ByteDance has fired Chris Lepitak, the internal auditor in charge of the company’s Internal Audit and Risk Control department. ByteDance has confirmed that Lepitak’s team is behind the surveillance campaign. In October, Forbes reported that Lepitak was apparently looking for information about “the location and details of the Oracle server, which is at the center of TikTok’s plans to limit foreign access to personal US user data.” This server is key to the Biden administration’s ongoing discussions with TikTok over national security concerns, as the US becomes increasingly wary of China-based ByteDance employees gaining access to data stored in the US.
Forbes obtained access to an internal email from Erich Andersen, TikTok’s General Counsel, confirming that the Lepitak team “abused their authority to gain access to TikTok user data” while tracking journalists.
The FT reported that four employees were involved, and Forbes reported that ByteDance laid off two employees in the US and two in China. ByteDance spokesperson Hilary McQuaide echoed Andersen’s email, saying, “The abuse of certain individuals who are no longer employed at ByteDance was a gruesome abuse of their authority to gain access to user data.”
Ars was unable to immediately reach ByteDance for comment.
Earlier today, Reuters reported that TikTok has begun to offer more concessions to the US, seemingly willing to take any action, but putting itself up for sale to address concerns about China-based employees accessing American user data. Closing the deal will be much more difficult after ByteDance confirms that American journalists and civilians are already being tracked by China-based employees. Currently, some US lawmakers are voting to remove TikTok from government devices, and Congress is considering passing a nationwide ban.