DNC issues another warning on TikTok, citing data security risks

The advisory comes as TikTok faces greater scrutiny for its security practices from both U.S. government agencies and corporations.

The Democratic National Committee on Friday reiterated a warning to Democratic campaigns, state parties and committees about the security risks of using the video-sharing app TikTok, which is owned by Chinese tech company ByteDance.

“Because of the amount of data it tracks, we continue to advise campaign staff to refrain from using TikTok on personal devices,” a DNC official told CyberScoop. “[I]f campaigns are using TikTok for campaign work, we recommend they use a separate phone and account.”

The fresh warning, which DNC officials have been making for months, is the latest move by the political party to protect its data from compromise following the Russian hack of the DNC in 2016. It comes as TikTok faces greater scrutiny for its security practices from both U.S. government agencies and corporations. CNN was first to report on the DNC guidance.

The video-sharing app is wildly popular. TikTok has been downloaded more than 2 billion times worldwide, including 165 million times in the U.S., market intelligence firm Sensor Tower said in April. But U.S. government officials have long worried that because it is owned by ByteDance, which has ties to Chinese state organizations, TikTok could be compelled to share sensitive user data with the Chinese government. ByteDance has denied any wrongdoing.

The Pentagon has told military personnel not to use TikTok, and the U.S. government is reportedly conducting a national security review of ByteDance’s acquisition of U.S. social media app Musical.ly. TikTok has said it doesn’t operate in China and that it stores American user data in the U.S. However, a lawsuit filed in federal court in California in December accused TikTok of sending user data to servers in China.

“We are fully committed to protecting our users’ privacy and security,” a TikTok spokesperson said in a statement. “Under the leadership of our American CEO, along with our chief information security officer and head of safety, TikTok’s growing U.S. team works diligently to develop a best-in-class security infrastructure and uphold our community guidelines which prohibit misleading and inauthentic content and accounts. We welcome a dialogue with anyone who has questions about TikTok so that we can ease concerns they may have.”

ByteDance did not respond to a request for comment on the DNC security guidance.

There are signs that corporate America is also taking a closer look at TikTok. On Friday, Amazon personnel sent a memo to employees telling them to delete the app, though an Amazon spokesperson later said the memo was sent in error and there was no change to Amazon’s TikTok policy.

U.S. bank Wells Fargo has told its employees to delete TikTok from their company phones, The Wall Street Journal reported.

The DNC has labeled other products a security risk for their alleged associations with the Chinese government. Before the 2018 midterms, DNC CISO Bob Lord told candidates to avoid products made by Chinese telecom firms Huawei and ZTE. Those firms have also denied any wrongdoing.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure