Struggling to keep the promise
TikTok executives have publicly promised to voluntarily protect U.S. user data and invited engineers and third parties to certify that the app’s algorithms distribute content without interference from China, where parent company ByteDance is based. So far, TikTok has struggled to deliver on those promises.
TikTok has publicly pledged to voluntarily protect US user data. Photo: Bloomberg News
The independent unit, codenamed Project Texas, was created by TikTok to monitor U.S. content and data recommendations on its app. Managers sometimes directed employees to share data with colleagues in other parts of the company and with ByteDance employees without going through official channels, according to current and former TikTok employees and internal documents seen by The Wall Street Journal. That data sometimes included personal information such as users’ emails, dates of birth and IP addresses.
Meanwhile, ByteDance employees in China update TikTok’s algorithm so frequently that Project Texas employees struggle to test every change and worry that they won’t catch problems if they do.
TikTok has promised to provide employees at Project Texas with laptops and software owned by its own unit rather than ByteDance, but for many of them, new devices have been slow to arrive. Some employees worry that ByteDance-owned equipment and tools are not secure.
TikTok's struggles within the Project Texas unit illustrate the challenge the company faces in protecting American data on a global social media app.
Project Texas leaders have promised change. In a memo seen by the Wall Street Journal in December, Project Texas bosses told employees they planned to roll out new tools for sharing data and communicating with colleagues. They also reminded employees of the rules around data sharing.
A TikTok spokesperson said the app’s US algorithm is hosted with its US partner, Oracle. It is trained on US user data and overseen by staff in a unit formally called TikTok US Data Security, or USDS. “Over the past year, we took the unprecedented step of granting Oracle full access to our source code and algorithms,” the TikTok spokesperson said.
The data handling issues are the latest concern for TikTok employees, some of whom worry the social media giant isn’t honoring its commitment to protecting American users. TikTok employees have previously raised complaints about TikTok tracking users who viewed gay content and a series of executives moving from ByteDance’s headquarters in Beijing to top positions at TikTok in the U.S.
Project Texas - a challenging project
TikTok launched Project Texas to appease US lawmakers concerned about its ties to the Chinese government and build trust with the app's more than 150 million US users.
TikTok has been in talks for several years with an executive-level committee called the Committee on Foreign Investment in the United States over whether the app can stay in the country, but has yet to reach an agreement. TikTok has repeatedly said it does not share data with the Chinese government.
Project Texas is a challenging undertaking: TikTok must separate US user data from the rest of the company so that US content and data recommendations remain out of Beijing’s reach. US data will only leave the unit in rare cases and in aggregated form.
The office of ByteDance, TikTok's parent company, in Beijing, China. Photo: WSJ
TikTok has embarked on a campaign to introduce the plan to lawmakers, civil society organizations, and users. The company has released a video about Project Texas, featuring animated images and catchy music aimed at young people.
TikTok CEO Shou Zi Chew also touted the plan during a congressional hearing in March 2023. “The bottom line is that this is American data, stored by an American company on American soil, overseen by American employees,” Chew said. More recently, amid legal victories and lobbying from TikTok’s U.S. supporters, pressure on the company from Washington has eased.
TikTok began work on Project Texas in early 2021 and had stopped collecting U.S. user data by early 2023. In the months leading up to Chew’s testimony in Washington, TikTok enforced strict separation between the unit, which has about 2,000 employees, and the rest of TikTok.
Project Texas employees are only allowed to share user data outside the unit if the data is aggregated and critical to the operation of the TikTok app, and they cannot save user data to their own computers.
This put many of the Texas Project staff in a difficult position: they relied on tools that only worked with data they could download to their computers. Without the ability to save data, they couldn't do their jobs.
Some employees raised these concerns with their managers, according to people familiar with the conversations. The employees worried that if they paused their work, the company would put them on performance improvement plans. But continuing to work would violate the rules.
Tighten data security further
TikTok's app operates worldwide, except in China, where ByteDance offers a different version of TikTok. The algorithm that powers TikTok is developed by ByteDance in Beijing.
TikTok executives have said internally that they sometimes need to share protected U.S. data with ByteDance to help train algorithms or with employees outside Project Texas, according to people familiar with the unit. Meanwhile, Project Texas employees who review TikTok’s software are instructed to examine TikTok’s code for signs of Chinese interference before allowing updates.
TikTok CEO Shou Zi Chew introduced Project Texas during a hearing before the US Congress in March 2023. Photo: AFP
Project Texas workers soon found a mountain of code waiting for them to review each morning. Under pressure to move quickly, employees found the task impossible without additional staff, according to people familiar with the unit. Meanwhile, TikTok’s algorithm was incorporating more and more updates that the Project Texas team had not yet reviewed.
TikTok said Texas-based Oracle — the inspiration for the unit’s name — monitors all data leaving Project Texas and also examines every line of code in the app’s algorithms for suspicious changes. But Oracle does not monitor data that employees share with each other over TikTok’s internal messaging tools, according to people familiar with the data sharing.
In a December memo to employees, Project Texas managers said they planned to launch a special version of ByteDance’s internal messaging system for employees only, which they hoped would mean ByteDance would not be able to access Project Texas data.
Nguyen Khanh (according to Wall Street Journal)
Source
Comment (0)