Chances are you've been on Tik T.O.K.
Maybe you have the app
and have posted a video.
Maybe a friend sent you a link to watch.
But before you use Tik T.O.K,
did you actually read the pages
and pages of Tik tok's terms
of service and privacy policy?
Cyber security experts say you
are potentially handing over
all of your personal data.
Is there a safe way to use it?
Personally, I would not touch Tik T.O.K.
You've heard it before.
Don't trust Tik T.O.K.
We're looking at Tik T.O.K.
We may be banning Tik T.O.K
in 2020. Then President Trump
threatened to ban the app owned
by Beijing based byte Dance.
And just last month
we collect certain information about the
device you use to access the platform.
Podcaster Joe Rogan read off Tik toks
terms of service and the clip went viral.
App and file names and types.
So all your apps.
And all your file names,
all the things you have
filed away on your phone,
they have access to that.
Is this really what you were agreeing
to when you do what most people do and
quickly scroll through the terms of
service so you can start using the app,
we want to know is what he said true?
Oddly enough,
I don't typically agree with Joe,
but he is absolutely spot on, correct.
As it relates to Tiktok,
it is from my perspective a clear
and present danger in terms of the
amount of data that is collected.
It has elements within its terms
of service that allowed Tik T.O.K.
Share the information collected with
anybody and everybody that they choose to,
up to and including potentially,
agencies within the Chinese government.
Matt Stamper is chief information
security officer for Evotech,
author of data privacy Program Guide,
and serves as a Co chair for the
San Diego chapter of Infragard,
a partnership between the
FBI and the private sector.
Matt Stamper says while you may have
ignored all of the warnings until now,
it's important for you to know what
you're giving Tik T.O.K access to.
Including your geolocation related data,
browsing and search history,
your IP address, mobile carrier,
model of your device,
device system,
and app and file names.
You're
effectively giving them everything
that you have on your phone,
and they can use it for whatever
purposes that they decide.
But is that everything on your phone, or just
the way the terms of services are written
when you're using other applications?
They know your files, they know
your data, you know your contacts,
and, he says, perhaps the most nefarious
data you might be handing over. Is this
keystroke patterns and rhythms?
That's a euphemism for keystroke logging.
There are systems in place that
would allow them to potentially
get information like what keyboard
inputs you're doing or what buttons
and links you are clicking.
Software engineer Felix Kraus recently
shared these images on Twitter,
stating Tik T.O.K,
when opening any website in their app,
injects tracking code that
can monitor all keystrokes,
including passwords and all taps.
This is how a lot of
attacks end up occurring,
where you can guess somebody's.
User name or password by what they're
putting on their phone or how they're
inputting detail into the UI or
the browser or the application.
Some people might not
care. They might think I'm just a
regular individual sitting at home.
I want to post goofy content,
but what is the risk to national
security? It's not just your
information that they're collecting.
They're also using what's in your profile,
your contacts and other
kind of files and data.
And so let's say you know somebody
that works in law enforcement.
National security there's a
risk of things like doxing,
where the identities of people
that work in specialized areas
are effectively conveyed.
Stamper points to this recent cyber
advisory from the House of Representatives
Chief Administrative Officer.
It says Tik T.O.K is a Chinese owned
company and any use of this platform
should be done with that in mind.
It calls the app high risk because
of its terms of service that
state it may collect biometric
identifiers and information,
including face prints and voice prints.
We do not recommend the.
Download or use of this application due
to these security and privacy concerns.
I think until there's
a publicized case where data
taken from Tick Tock ends up
compromising national security,
a lot of people may not listen.
I think there are cases I I don't
know how well publicized they are,
but I think there's there's.
Enough inference and enough risk,
both from a legal perspective as well
as from a functional perspective.
That would suggest that Tik T.O.K
is probably not an application
that should be widely used.
I reached out to Tik T.O.K
through their media inquiry page.
A Tik T.O.K spokesperson emailed me
back and addressed software engineer
Felix Krause's research which states
Tik T.O.K has tracking codes that can
monitor your keystrokes and your logins.
Now, a tick Tock spokesperson told me in
part quote contrary to the report's claims,
we do not collect keystroke or
text inputs through this code which
is solely used for debugging,
troubleshooting and performance monitoring.
The spokesperson also gave me several
links to statements they say refute.
All of the claims and directed
me to their FAQ page,
all of which we've put on
our website cbs.com.
I then asked for a follow up interview
and clarification as to why the
concerning verbiage is still in
their terms of service if they're
not doing anything that cyber
security experts say is concerning.
As of right now, I have not heard back.