14 ms·
Journalist writes about discovering she’d been surveilled by TikTok
- lazyeye 4y agoWouldn't it be a wonderful thing if advocates for the West could participate in Chinese forums, the way advocates for China flood into discussions like we see here. A quick scan and most of the comments seem to be Chinese talking points in one form or another
- deleted 4y ago[deleted]
- duxup 4y agoI think journalists at this point would be wise to maintain separate devices for journalistic work / journalistic communication, personal life, and research. That's a pain but I think inevitable: >On a practical level, my old device was relegated to being a dummy phone only to be used for accessing TikTok for work. Who knows what other apps on their other device are up to...
- falcolas 4y ago> Who knows what other apps on their other device are up to... Probably the same things. That data's worth a lot of money for advertisers, both corporate and political.
- duxup 4y agoI doubt it. This was a pretty specific case of targeting a specific individual. I doubt all the other apps care.
- falcolas 4y agoRight, we've never heard any news of employees of other social media apps targeting exes, reporters, or celebrities. /s We totally have. EDIT: I worked for Amazon in customer service back in the early naughts. They had an explicit alert set up for most celebrities that would basically get a CS rep fired if they went in and snooped. It was put in place because people went in and snooped. 20 years later, and more information about our lives is entrusted to these sites. It's absolutely happening at all of these companies. If it isn't happening, it's because of new policies and procedures resulting from prior incidents.
- bombcar 4y agoIf I were a TLA for any country of any magnitude (talking something larger than the Vatican) I’d have a number of agents working as CS reps for the various big companies. It’d be worth burning one to get info, and you’d likely not even need to burn if the target wasn’t on the short list of celebrities.
- falcolas 4y agoHigh rewards vs. risk, to be sure. And it's not as if CS reps are not in demand, so any "burned" asset could easily be re-used. It's not as if their reason for being fired would be communicated anywhere.
- duxup 4y agoI doubt all their other apps are doing that. That was what I was responding too. Targeted spying on a specific journalist /= general data collection. There's an important difference.
- wkat4242 4y agoI'm surprised they don't do this already. It's pretty basic opsec.
- duxup 4y ago>I'm surprised they don't do this already. Maybe some true professionals but I'm doubtful most serious journalists really put much effort into it. Here we have an example of a journalist who thankfully learned ... but didn't really know.
- ethbr0 4y agoThe real kernel is that the FT at least has someone on their cyber security team who was able to recommend and implement the change. Journalists shouldn't have to be cyberopsec experts. Journalists absolutely should have access to such expertise.
- duxup 4y ago>Journalists shouldn't have to be cyberopsec experts. I don't know about experts, but I don't think they can afford to think they can just install any old app... open emails, etc.
- ethbr0 4y agoDefining "any old app" is a pretty nuanced decision nowadays.
- xkcd-sucks 4y ago> Journalists shouldn't have to be cyberopsec experts They had better be at proficient in regular opsec if handling sensitive sources, and opsec includes cyber these days no?
- wkat4242 4y ago> Journalists shouldn't have to be cyberopsec experts. I disagree. Especially if they are covering geopolitical or highly monetised industrial topics. They are basically spies working for the public. Spycraft shouldn't be optional for them. Sure, a journalist covering celeb fluff doesn't need it, but one covering China, Russia, big pharma etc are automatically a target. This article is an excellent example.
- archgoon 4y ago[dead]
- pessimizer 4y agoI think journalists at this point should seriously consider living in a different country than they report on, working as anonymously as possible, and utilizing a network of unnamed sources. Aggressive states aren't going to be deterred by your amateur opsec. Your best chance to keep working is not to be noticed as an individual.
- CatWChainsaw 4y agoWhen deepfakes become indistinguishable from reality, seeing events in person will be the only surefire way of verifying reality. The rest of the time you'll depend on trust chains, each link of which can be broken.
- duxup 4y agoI think that would make it difficult to cultivate relationships and result in more problems. Doesn’t seem necessary as far as “more free” countries go, but maybe necessary at some times.
- libraryatnight 4y agoWe barely get adequate perspective when people live in the country, I can't imagine trying to read some reporter talk about what's going on in Arizona as they write from Argentina.
- libraryatnight 4y agoI think that's good advice for everyone. I tell new hires we own your phone when you add any of our accounts to it and recommend using work devices for anything work related if privacy means anything to them. Some listen, some listen later when they get wiped because they clicked a phishing email and IR has decided a purging fire is necessary.
- helij 4y agoHow does adding Slack and Outlook for example makes a company own your phone?
- dragonwriter 4y agoIt doesn’t literally, but many companies have policies that use of comopany accounts on devices is consent to physical inspection of the device, data on the device, and other things as determined necessary by the compnay for legal, security, compliance, or other reasons, making ownership a useful cautionary metaphor.
- m463 4y agoUsed to be when leaving a company (voluntarily or not) if you had some company apps on your (personal) phone they could wipe the device. I personally don't think people should put work apps on their personal phone ever.
- helij 4y agoI am finding it hard understanding how this can be done if you have work email and Slack apps installed on your phone.
- lukeschlather 4y agoOutlook and Slack typically require you to enroll in your company's MDM which gives administrators the ability to remote-wipe your phone. You can see this if you read the fine print when you sign in.
- reaperducer 4y agoI think journalists at this point would be wise to maintain separate devices for journalistic work / journalistic communication, personal life, and research. When I was a journalist back in the early part of this century, the company I worked for issued burner phones and laptops to anyone who left the country. 20 years later, it's probably become standard across the industry, and in more scenarios.
- rvz 4y agoBecause like Facebook, it can do that, just because. It is no better than Facebook and is in fact worse. Given the history of what TikTok has done and also has admitted to violating the privacy of its users [0] [1] [2] [3] in leaks and recordings, it needs to be fined for repeated offenses in the billions of dollars just like Facebook was once fined at. Billion dollar fines for repeated offenses is much better than a outright ban and the regulators are never tired of collecting money from multi-billion dollar companies. [0] https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-tapes-us-user-data-china-bytedance-access https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-... [1] https://edpb.europa.eu/news/national-news/2021/dutch-dpa-tiktok-fined-violating-childrens-privacy_en https://edpb.europa.eu/news/national-news/2021/dutch-dpa-tik... [2] https://www.scmagazine.com/news/privacy/uk-tiktok-16m-fine-childrens-data-privacy-violations https://www.scmagazine.com/news/privacy/uk-tiktok-16m-fine-c... [3] https://fortune.com/2022/12/22/tiktok-data-privacy-blunder-china-bytedance-bans-journalist-accounts/ https://fortune.com/2022/12/22/tiktok-data-privacy-blunder-c...
- 2OEH8eoCRo0 4y agoSpying is collecting information for the government. TikTok works for the Chinese Communist Government.
- glanzwulf 4y agoIt is collecting information but it's not specifically for a government. Facebook and Google also spy on their users. Should we ban them too?
- falcolas 4y agoTo be even more explicit, Facebook and Google collect info which the US government can and does request from them. See: Transparency Reports from both.
- 2OEH8eoCRo0 4y agoCollecting data and complying with a warrant is not the same thing.
- inconceivable 4y ago... so just ban it already. this is getting tiring as we're in the 3rd or 4th year of this nonsense.
- miroljub 4y agoIf you ban all spy apps, the app store would be empty. Heck, as soon as you see the first add in an app, you should know you have been spied on.
- dublinben 4y agoIt wouldn't be empty, it would look like F-Droid, which has thousands of user-respecting apps. https://f-droid.org/en/packages/ https://f-droid.org/en/packages/
- duxup 4y agoI'd argue you just ban apps from countries who wouldn't allow such an app in their region. US social media apps are not allowed in China... seems fair to do the same just on that basis.
- miroljub 4y agoIt's not that easy in the global world. The owner of TikTok is ByteDance, an American company. Would you ban them? Also, Apple produces in China, under the jurisdiction of the CCP. Would you also ban them? Those two examples are obvious, but when you look at the typical international megacorp structure, it becomes quickly much more difficult.
- Entinel 4y agoThey don't want to ban it. They want to be pass an Orwellian surveillance bill and Tiktok is being used as a boogeyman.
- TheRealDunkirk 4y agoIn lieu, they'll take TikTok's subservience in giving them access to the data, as with all the other social media companies. It's the one reason I think my data is SAFER in TikTok than in Facebook. If the NSA had a backdoor into it like all the others, they wouldn't care.
- photochemsyn 4y agoThe Internet has been colonized by spies who work for corporations and governments, but it's been going on for well over a decade, as this article notes: > "By the time ByteDance was founded in Beijing in 2012, Google had been reading our emails over our shoulders, Amazon had been watching us shop, and Twitter and Facebook had been mediating our messages to friends and foes for years. Indeed, Zhang Yiming, the millennial software engineer who set up ByteDance, modeled himself and aspects of his new company on Silicon Valley. Zhang, who briefly worked for Microsoft before going out on his own, was once fond of quoting Steve Jobs and Jack Welch." It would be highly surprising if the ByteDance-Beijing relationship was all that different from the Google/Verizon-Washington relationship (2013): https://www.corpwatch.org/article/verizon-and-google-helped-us-government-spy-reporters https://www.corpwatch.org/article/verizon-and-google-helped-... > "Technology companies willingly provided information to U.S. government agencies to help the Obama administration snoop on reporters from the Associated Press (AP) and Fox news in order to ostensibly crack down on leaks that pose a "threat" to national security."
- b112 4y agoIt would be highly surprising if the ByteDance-Beijing relationship was all that different from the Google/Verizon-Washington relationship (2013): No, no it wouldn't.
- Xeoncross 4y ago> relationship was all that different It's not the relationships of the parties in control that worries me. It's the arrests and abductions of the people that concerns me. Thankfully, posting banned ideas or government critical stuff in the US doesn't involve being arrested by the police and being held for months or years. The CCP is a completely different beast, it has no issues jailing people for speaking the wrong things, forcing it's citizens into reeducation camps, welding them locked into buildings and much worse.
- falcolas 4y ago[flagged]
- MuffinFlavored 4y agoTikTok (and Facebook/Instagram/WhatsApp (if they are really spying on our private WhatsApp conversations) knows I (my IP addresses/my device identifiers/my browser fingerprints) like memes. I don't get the big deal? They know my age and where I live, which is public information via sites indexed by Google for a large percentage of the population. My phone knows where I go due to GPS + cell phone towers. This is published via a "location service" to every app asking for it (and given permission) on my phone. Apple knows what I like because they run the operating system for both my phone and my laptop. Do they have some form of telemetry? Probably. Google knows what I like because I use their browser and they run my Gmail/other services I use from them. Do they have some form of telemetry? Probably. How is this a TikTok problem?
- duxup 4y agoGenerally speaking: How is it not all those companies problems ... including TikTok? Are you just trying to hand wave for TikTok here? As for the article, the situation in the article is very specific to that person.
- MuffinFlavored 4y ago> The story claimed ByteDance employees accessed two reporters’ data through their TikTok accounts. Personal information, including their physical locations, had been used as part of an attempt to find the writers’ sources, after a series of damaging stories about ByteDance They got her location. What else?
- BLKNSLVR 4y agoThis is a TikTok problem because China gets access to the data, not the US. There's some serious mental gymnastics and reality denial required to limit the issues to "TikTok". Someone else won a race, so now they need to tilt the field.
- zodo123 4y agoIt seems odd to me that short of the nuclear option (removing the app from stores), no one has suggested revocation of the device permissions that TikTok is shown to abuse. Following something like this, it feels entirely reasonable for Apple/Google to reply "Submit an update to your app that removes all use of location permissions within 30 days."
- nicce 4y agoThe reason is purely political. U.S. could create privacy laws which were equal to every company but there is no will. Comply with laws or get banned, applying every company.
- laweijfmvo 4y agoNot banned, but sued out of existence (not a meaningless $100m fine). Breaking app store policy gets you banned; breaking US law gets you eliminated. edit: for US companies, at least
- briffle 4y agoagreed, look at the top comment thread, its full of political discussions about why its okay for one country to do something but not the other... The real solution is that we should all have privacy. Encoded in law, with serious penalties. and that no country should be able to do what is described.
- 2OEH8eoCRo0 4y agoHow long do you think such a sweeping privacy law would take to plan, write, and pass? Do you think they'd get it right? What might the fallout of such a law be?
- nicce 4y agoIt will take couple years, but many global companies have already faced that with Europe's GDPR legislation. Only problem with GDPR is, that fines seems to be too low.
- sillysaurusx 4y agoIf you hate tiktok, I get it —- I really do. But please just know that you’re missing out on something wonderful, unique, and delightful; in fact, delightful in ways remarkably similar to the feeling that https://news.ycombinator.com/highlights https://news.ycombinator.com/highlights gives you. There’s a commonality between HN and TikTok that I haven’t yet been able to put into words. They’re both “bookish”. You feel like you’re exploring. Often times I’ll swipe past 6 or 7 memes in about 3 seconds, when something incredible catches my attention. And it’s often incredible in exactly the same way as HN: you feel like you’ve unearthed some fascinating gemstone. (And much like HN, it’s designed for entertainment, so you can waste arbitrary amounts of time if you fall under its spell too long.) I wrote a comment at https://news.ycombinator.com/item?id=34573893 https://news.ycombinator.com/item?id=34573893 showcasing the three lists I was particularly proud of: educational, physics, and math. But I have dozens more. There’s guitar tutorials, handyman repairs, a collection of 18 videos teaching you how to tie all kinds of useful knots, art tutorials, cute animals, hardcore ML discussions, and everything in between. Someday I’ll showcase them properly. (Theoretically you can view them on my TikTok profile, but I doubt it’s presented well: https://www.tiktok.com/@theshawwn https://www.tiktok.com/@theshawwn) Just know that if you stomp TikTok out of existence, it’ll be a real loss. It’ll feel to me like you’d feel if someone burned down HN. And the calls for banning TikTok sound to me how you’d feel if Reddit was urging everybody to ban HN. Now imagine that politicians are seriously considering whether to ban HN. That’s how it feels to read through the comments here about TikTok. The outrage is deserved and understandable, but it’ll be a real loss if it disappears. If this comment coaxes you into trying out TikTok, one tip: use the “not interested” button ruthlessly. (Long press on a video.) The algorithm will dial you in after around 45 minutes, which isn’t so long. The first experience can feel jarring the same way that YouTube in incognito mode looks like a weird dystopian universe filled with people screaming at each other.
- bastardoperator 4y agoI know tiktok is spying on me too, I'm pretty sure at this point they know I love cat memes.
- 1-6 4y agoIt takes a spy to know a spy.
- userforcomment 4y agoI was surprised that when you share a TikTok video on whatsapp/anywhere, it generates unique URL link that can be traces back to your account. This company definitely has "we need more data" culture.
- Taurenking 4y agoInstagram, Twitter and probably a lot of other companies do the same. They need to be able to track links on dark socials
- t-writescode 4y agoTwo things: 1. you can get around that by using the actual TikTok link on the website, not the app 2. It's by design. People who know each other probably like similar things, so it facilitates in the surprisingly effective, accurate and narrow niches that people can find themselves in.
- petee 4y agoTitle is "TikTok spied on me. Why?", though it was originally posted this way, the replacement title isn't better
- boomboomsubban 4y agoThe article seems less about China tracking journalists and more ByteDance employees tracking critics. So like the eBay stalking scandal, except less severe.
- johnea 4y agoBecause, they can...
- gmerc 4y agoFacebooks security teams did the same, as did Uber. Paypal went as far as sending critics dead animals
- throwaway742 4y agoInteresting tidbit about Facebook's security team. https://imgur.com/a/hcrv6We https://imgur.com/a/hcrv6We
- aaron695 4y ago[dead]
- _jcrossley 4y agoCall me crazy, but I’d love to see Apple acquire ByteDance. They’re the only company that I feel the public trusts with privacy, have the same level of cachet, operate globally, and don’t have a social media arm.
- knallfrosch 4y agoWhat's the benefit over banning it?
- _jcrossley 4y agoKeeping TikTok around. It’s actually a very good platform, just needs major damage control on trust and privacy.
- bomewish 4y agoThis was a strange article. Why would a journalist at a major newspaper be so ignorant of appropriate cyber security and privacy practices and install a PRC app on their primary phone? Why would they assume that they _weren't_ being monitored? And why would the company, if they wanted to spy on her, use 'another iphone' rather than just pull the data from the backend? That was the weirdest part.
- _9hey 4y agoThese addictive apps need a warning from the Surgeon General. It's not censorship, just a warning label indicating the well-known and well-studied phenomena around threats to health and personal security.