TikTok admitted to spying on journalists to track business leaks

TikTok and its parent firm ByteDance discovered that workers had exploited their credentials to monitor journalists in an attempt to prevent information breaches.

Forbes reported (paywalled) on Thursday, December 22 that ByteDance’s internal inquiry revealed that staff examined the IP addresses and user data of Forbes journalists to see if they were in the general vicinity of a ByteDance employee — a potential information breach.

As a consequence of the probe, ByteDance dismissed Chris Lepitak, its top internal auditor, and China-based executive Song Ye, who Lepitak reported to and who reports directly to ByteDance CEO Rubo Liang, resigned.

Liang said in an internal email obtained with Forbes that he was “extremely upset” when he was notified of the issue, stating that “The public trust that we have spent enormous efforts creating will be greatly eroded by the wrongdoing of a few employees…. I hope this circumstance will teach us all a lesson.”

The Guardian reported on December 23, citing an email from Andersen, that the surveillance targeted, among others, Emily Baker-White, a former BuzzFeed writer who now works for Forbes, and Cristina Criddle of the Financial Times. Although the attempts were unsuccessful, at least four employees from the United States and China had unauthorized access to the material.

In October, Forbes reported on these spying techniques. ByteDance and TikTok did not dispute the spying when asked for comment, but they tweeted that “TikTok has never been utilized to ‘target’ any US government officials, activists, public figures, or journalists.”

They also stated that “TikTok could not track US users in the manner proposed by the article.”

Liang later stated in an internal email that TikTok had been utilized as Forbes had previously reported.

Forbes’ chief content officer, Randall Lane, called ByteDance’s action “a frontal assault on the concept of a free press and its crucial role in a functioning democracy.”

While this is not the first instance of a tech company using its resources to spy on journalists – Uber was previously in hot water after former executive Josh Mohrer tracked a journalist using Uber’s internal “God View” tool without her consent – what distinguishes the ByteDance-TikTok issue is that TikTok told lawmakers in June 2022 that access to certain data of US users would be limited to authorized personnel, in accordance with protocols being developed with the Department of Homeland Security

ByteDance’s announcement may increase the pressure on TikTok, which is partially prohibited on computers used by government employees in 19 US states, and reduce the app’s visibility among privacy-conscious users.