Keylogging Controversy Brings TikTok Back Under US Government Scrutiny
Image from Shutterstock

Keylogging Controversy Brings TikTok Back Under US Government Scrutiny

TikTok, the social app that’s so popular that some are using it as a search engine at this point, remains as vital destination as ever for Pink Sauce connoisseurs. Still, the company’s PR headaches continued this week.

Independent research performed by developer Felix Krause found code injected by the social network’s operating system enabling it to monitor all keyboard inputs and tags, even without hitting “submit,” a process known as “keylogging.”


As Krause explained on his blog, this could potentially include recording sensitive information such as passwords and credit card numbers. And because TikTok comes with an internal browser, this functionally gives the app the ability to monitor its users as they browse around third-party websites and services.

TikTok’s certainly not alone in checking out all of your data as you type. A previous post by Krause focused on tracking code within Meta’s Facebook and Instagram iOS apps, allowing them to potentially follow users within in-app browsers as well. A recent survey of the top 100,000 most popular websites found that 1,844 logged an EU user’s email address without their consent, and 2,950 recorded a U.S. user’s email data in some form. The keylogging protocol has also been used as a way for employers to monitor the activity of remote employees.

Though it certainly sounds sinister, keylogging is not necessary by definition malicious. TikTok claims that the code in question is used for “debugging, troubleshooting, and performance monitoring,” and in a statement, a representative denied that the company even collects specific keystroke or text input data. (The company also pointed out similar code in GitHub that’s used for an alternative purpose than keylogging, as a third party example.)

Still, the very mention of privacy concerns and TikTok in the same sentence is enough to raise some eyebrows in the U.S., where the app–which is owned by the Chinese parent company ByteDance–has always operated under a dark cloud of suspicion. Allegations in 2019 that the app was hoovering up data from underage users and censoring content on behalf of China’s ruling Communist Party led to calls for investigations from high-profile politicians. In December of that year, just as TikTok was taking over as the world’s most downloaded app, the U.S. Department of Defense was recommending that all military personnel delete it from their phones.

In 2020, President Trump signed a series of executive orders banning U.S. companies from doing business with TikTok (as well as the Chinese-owned WeChat app). These orders were later reversed by the Biden administration, which nonetheless urged Americans handling sensitive information to consider the apps a “heightened risk.”

The House of Representatives’ Chief Administrative Officer (CAO) echoed these concerns just this week following the keylogging report, issuing a “cyber advisory” about security on TikTok, noting that, despite its Culver City headquarters, it’s still “a Chinese-owned company.”

So even a U.S. government that was initially inclined to be more TikTok friendly may be having second thoughts.

Subscribe to our newsletter to catch every headline.

Cadence
PG&E Is Seeking EV Owners for Its New Program to Sell Energy Back to the Grid
Photo courtesy of Ford

Pacific Gas and Electric is in the midst of enrolling customers into an ambitious new pilot program that seeks to use electric car vehicles as a means of powering daily life and stabilizing the grid.

The “Vehicle to Everything” pilot envisions a future in which automobiles not only draw their power from the electrical grid but can also strategically add electricity back in when demand is high — and generate some money for their owners along the way.

Read moreShow less
David Shultz

David Shultz reports on clean technology and electric vehicles, among other industries, for dot.LA. His writing has appeared in The Atlantic, Outside, Nautilus and many other publications.

Vinfast's First EVs Have Just 180 Miles of Range but Still Cost Over $55K
Vinfast

Vinfast, the Vietnamese EV company with headquarters in Los Angeles, shipped its first order of vehicles to U.S. soil from Hai Phong, Vietnam on November 25th. The batch of 999 automobiles is due to arrive here in California on Thursday this week.

The VF8 SUVs on board will have the difficult task of convincing American buyers that an unknown, untested Vietnamese manufacturer can deliver on a new technology. And so far, the company appears to be off to a rocky start.

Read moreShow less
David Shultz

David Shultz reports on clean technology and electric vehicles, among other industries, for dot.LA. His writing has appeared in The Atlantic, Outside, Nautilus and many other publications.

RELATEDTRENDING
LA TECH JOBS
interchangeLA