Yes. It is exactly that. [0] [1] [2] [3] [4] [5]

I thought Facebook was worse, but looking at TikTok, it takes the most invasive spyware crown.

At this point if the solution is to outlaw all invasive tracking for all companies, the first thing to do is like how Facebook got a multi-billion dollar fine by the FTC, TikTok (and repeat offenders) must be fined in the tens of billions, if they want to continue operating in the US and to stop them from violating user privacy by their invasive data collection.

[0] https://www.nrk.no/osloogviken/xl/tiktok-doesn_t-show-the-wa...

[1] https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-...

[2] https://techcrunch.com/2021/10/26/tiktok-dodges-questions-ab...

[3] https://techcrunch.com/2021/06/03/tiktok-just-gave-itself-pe...

[4] https://twitter.com/crobertsbmw/status/1427102606753550337

[5] https://krausefx.com/blog/announcing-inappbrowsercom-see-wha...

> I thought Facebook was worse, but looking at TikTok, it takes the most invasive spyware crown.

I think that Facebook is worse, not because of the trackers but because of the very nature of the network. TikTok is mostly one-way. There are content creators and consumers, the latter vastly outnumber the former, also, creators often post content that is staged in some way, they don't really show their "real self". Facebook is a "true" social network, it is more symmetrical and intimate and people produce as much as they consume. TikTok is about showing off to the world, Facebook has that too, but it also a platform where friends can do stuff in "private".

Facebook doesn't even need spyware. People willingly put their entire life online, and for the few who are not on Facebook, their friends who are post enough about them for Facebook to create an accurate shadow profile. TikTok spies on you, but Facebook makes every user a spy working for them.

Can you explain how this is a spy tool and how Youtube, Instagram, Facebook, etc. are not? I haven't really used TikTok. How does it collect data beyond the videos I've watched?

Chinese domestic companies are legally obligated to provide a direct data pipeline from their databases to the Ministry of State Security. It's a real law that exists. Basically imagine what the NSA implemented with the PRISM program revealed by Snowden but formally codified into law and with active participation/engineering efforts required by the corporations.

Is it particularly different from https://en.wikipedia.org/wiki/CLOUD_Act ?

Yes

https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-...

It's more like being perpetually subject to a National Security Letter (NSL) warrant issued by a US FISA court, a fairly rare occurrence and specifically targeted, but for blanket database replication and as the widespread legal default for every company in China.

The main difference is that HN is mainly visited by American users, not affected by CLOUD act.

The CLOUD Act affects all US companies.

For what it's worth, non-american citizens on non-american soil have no legal protection against the same. And big ad monopolies are not in the business of pissing off the security state.

I don't see how, for instance, with a Austrian customer of a Belgian data center operator, the Belgian data center operator does not have a legal obligation to form a secure database pipeline connection and replicate everything directly into the NSA.

Obviously whatever signals intelligence gathering method or data copying the NSA might be doing in Western Europe could very well exist, but it's not a defined requirement for that theoretical Belgian ISP.

Correct, a Belgian isp would have vastly fewer reasons to comply with polite requests from CIA/NSA than a US-based FAANG.

They are working on a deal with US, all data for US citizens will be kept in US[1].

And some info about it from them directly:

"As we recently shared with members of Congress, we are working toward a new system in which access to U.S. user data by anyone outside of USDS will be limited by, and subject to, robust data access protocols with monitoring and oversight mechanisms by Oracle."[2]

1. https://arstechnica.com/tech-policy/2022/09/tiktok-can-keep-...

2. https://newsroom.tiktok.com/en-us/our-approach-to-keeping-us...

EDIT: downvotes for sharing latest additional data from official sources about the topic without any private opinions? This trend is dangerous for healthy discussion.

doesn't mean their office and staff in china don't remotely have access to the data or the ability to replicate it.

I think it's addressed in sources I've linked, there is a whole section describing who have access to data of US citizens. Additionally I don't think US administration will just let them do it (share whatever they want with China), if a deal will be made then US citizens will control who is and how that data is accessed outside US through Oracle, otherwise they would just be banned as national security threat.

Actually the data was already stored in the US as required by US law. The deal with Oracle is to guarantee the access is limited.

One is controlled by an authoritarian government, the others are private (publicly traded) corporations in a democratic country.

as someone living outside the US I can tell you that to us you're all the same.

Ironically, there's laws restricting US Gov access to data in the US, but no such restrictions on hacking foreign networks.

That's your personal opinion. You don't speak for the ~7.7B people not in the US.

As is your opinion that it isn't

I didn't claim to speak for billions of people.

"You don't speak for the ~7.7B people not in the US."

vs

"You don't speak for me"

One of those comments is speaking for a lot more people

Where did you get "you don't speak for me"?

It's "I can tell you that to us you're all the same" vs "You don't speak for the ~7.7B people not in the US."

One person is trying to speak for 7.7B and the other is advising against that.

>Where did you get "you don't speak for me"?

It was an example of how to state unambiguously who was/was not being spoken for to contrast with the other statement. Maybe because I put it in quotes led you to think I was quoting someone, but it looked odd without to me.

No it isn't, both are correct statements of fact.

you are making the same implicit claim and arguing insignificant semantics.

you're entitled to your opinion, but for those of us living inside the US, they are not at all the same

When the police start knocking on my door inviting me to have tea because of something I posted on twitter I'll take your comment seriously(https://chinadigitaltimes.net/2021/10/translation-spilling-t...).

Our free speech and privacy protections are not only stronger than China's, they're arguably stronger than Europe's too. There are some trade offs of course since Europe has GDPR and the right to be forgotten.

https://www.nytimes.com/2022/09/23/technology/germany-intern...

https://www.thetimes.co.uk/article/police-arresting-nine-peo...

The reason China's situation is worse is because Europeans and Americans can and do protest this. It is not normalized and accepted. If you feel that America goes too far in how it exports its perceived brand of authoritarian, you should know that China is just getting started: https://www.washingtontimes.com/news/2022/oct/3/report-detai...

But they took part in illegal surveillance programmes in the past.

>illegal

Exactly. What's illegal here is perfectly fine in China. Let's not equate the two.

US government may get data from US companies but at least it takes a warrant. Chinese government straight up owns the servers.

8 years old, referencing the same unlawful behavior mentioned earlier.

Did anyone have any consequences for the illegal behavior, including perjuring themselves before Congress regarding the matter?

Then why would they stop after it was declared illegal?

Yeah the Church Committee in the 70s really reformed the "intelligence community." They learned their lesson and never violated peoples civil rights ever again. And there's so much oversight now!

> US government may get data from US companies but at least it takes a warrant.

On December 16, 2005, The New York Times reported that the Bush administration had been conducting surveillance against U.S. citizens without specific approval from the FISA court for each case since 2002.

In 2011, the Obama administration secretly won permission from the Foreign Intelligence Surveillance Court to reverse restrictions on the National Security Agency's use of intercepted phone calls and e-mails, permitting the agency to search deliberately for Americans' communications in its massive databases.

https://en.wikipedia.org/wiki/United_States_Foreign_Intellig...

It seems to use the same bag of tricks Facebook/LinkedIn/etc. use to track things you do "off-app": tracking code in share widgets, injecting JS into the in-app browser, tracking cookies[1].

If ByteDance ever releases an Onavo style VPN app, people are going to lose their minds.

[1] https://www.wired.co.uk/article/tiktok-data-privacy

They're exactly the same.

Is this also true for highly-funded, money-losing SV startups focusing on growth. Why or why not?

No one said they aren't. Yet there's always someone in any given thread about a Chinese app jumping to its defense saying "but Silicon Valley."

So should no one speak out against concentration camps, cultural genocide, and mass sterilization in China today because the same things have happened historically in the United States? China being an adversary should have nothing to do with it? If we can't point out such a problem with an app, then the road we're going down is we can't say anything else about China either.

I think all of these apps behave deplorably. But these kinds of comments try to imply that TikTok is uniquely dangerous when it's just more of the same. The solutions offered also often target TikTok specifically - like banning TikTok in the US, or placing some kind of restrictions on how TikTok can operate.

Why is the solution not to make broad data collection illegal?

Edit:

> So should no one speak out against concentration camps, cultural genocide, and mass sterilization in China today because the same things have happened historically in the United States?

Not at all - those things are genuinely awful, but one key difference is that Facebook, Google, and others are still siphoning up people's data today. This isn't something that happened in the past. I think the comparison is quite valid.

> But these kinds of comments try to imply that TikTok is uniquely dangerous when it's just more of the same.

It comes down to what you believe is the lesser of two evil systems of governance. I will not hesitate to criticize the United States, NATO, the central banks, or the IMF, and I have many problems with them; I would still prefer to live under their system as opposed to the kind of world that China proposes. I live in the United States, and to an extent I want the United States to remain stable. Why should I not be concerned that an adversary in both policy and philosophy gets to have as much influence as TikTok over the minds of millions of Americans?

The only way I could see viewing US tech and China tech as equal is if one has no connection to the soil on which they stand, or perhaps if they live outside those two systems. I don't live outside of those systems. I live in the United States. I don't think the future proposed by the United States or any of its tech companies is as bad as what China proposes to bring to the world.

> one key difference is that Facebook, Google, and others are still siphoning up people's data today.

Again, that is a point that no one is disputing. And why emphasize today? As far as I am aware, TikTok doesn't plan to mine data. It already does. Regardless, I can't see how it's defensible to allow an adversary that much influence over our psychology. It's one thing for us to essentially cause our own problems, but it's another to invite problems from nations that would be thrilled for the United States to either be under its complete control or not exist at all.

Based on published information, Tiktok is behaving significantly worse than any other major player in this market.

Just one example: There are no reports of Meta (etc) logging my keystrokes and data OUTSIDE of what I enter into the app/website.

https://news.ycombinator.com/item?id=33049774

What published information? The link you posted is from Consumer Reports which says nothing of the sort.

Speak out all you like.It didn't affect Apple one iota when their factories in China were known for working people to their deaths to churn out more iPhones for the ravenous consumer.

It won't do a damn thing to reduce TikTok's growth either. Nothing will until TT becomes replaced by the next thing.

I don't like companies which business model is spying on people , regardless who their master is. To answer your question(if you really want an answer) , is, hypocrisy, many people have a problem with Alice pointing out that Bob did X thing, when Alice in the first place have also done said X thing. Not justifying anything, or anyone whatsoever, just telling raven how some people might think.

Alice and bob are people who committed those things. A citizen in the US has nothing to do with ww2 Japanese internment camps, slavery, etc so it's not hypocrisy to point out what another country is doing.

If your country do those things, some people might feel is hypocritical, because a citizen of {evil_country} have nothing to do with {crimes}. Just because Alice's country did it long ago, doesn't mean Alice have the higher moral ground over Bob. Again, just pointing out what it is. Don't care, TikTok, Facebook, Snapchat,etc can dissappear tomorrow, and I wouldn't notice.

Edit: Typo

> Yet there's always someone in any given thread about a Chinese app jumping to its defense saying "but Silicon Valley."

The reason there's always someone starting a subthread about it is because Silicon Valley and the United States has, had, and will continue to have all the same incentives and problems for international users. [1]

It's not a very interesting conversation, because it adds nothing that hasn't been said a million times, but neither does another lap around the 'China bad' rhetorical track.

[1] And also domestic users, but they have some means of recourse for it.

Well, I don't agree with OP, but the Chinese government is way more involved with its companies than the US is. Here, ostensibly, there's a court and legal process - versus China, where the government has all data by default.

So, any Chinese tech company is de facto going to have all of its data accessible by the Chinese government, by default.

It's interesting to see you make these claims when you know nothing about the workings of the legal system in China.

By Chinese law all data must be made accessible to the government. Of course, it's also an authoritarian state where the government isn't hamstrung by the legal system in any way.

What legal system?

The legal system in China is whatever the party wants it to be.

it's funny you raise that point right after the abortion decision here

> know nothing about the workings of the legal system in China

Hello, I'm an appsec engineer working on product privacy for a large multinational company. I have a pretty accurate, battle tested, mental model about data privacy w/r/t international verticals. I have worked with our China vertical and also worked on key escrow separation models. You might even be able to figure out which company, based on the above.

It's interesting to see you make these claims about me when you know nothing about me.

> Here, ostensibly, there's a court and legal process

On December 16, 2005, The New York Times reported that the Bush administration had been conducting surveillance against U.S. citizens without specific approval from the FISA court for each case since 2002.

In 2011, the Obama administration secretly won permission from the Foreign Intelligence Surveillance Court to reverse restrictions on the National Security Agency's use of intercepted phone calls and e-mails, permitting the agency to search deliberately for Americans' communications in its massive databases.

https://en.wikipedia.org/wiki/United_States_Foreign_Intellig...

The answer is simple: In the US it's a scandal if the government has open access without a warrant to private citizen data held by companies. In China that's just considered business as usual.

I think this is a common response. But even though the Snowden revelations were a "scandal", nothing bad really happened to the perpetrators. And the FISA court that rubber-stamped the data collection is still operating and still rubber-stamping government surveillance. So, how is it not business as usual in the US? Consider also how law enforcement now has warrantless access to individuals' location data thanks to data brokers and pervasive location tracking in apps[1].

I would really like to see people in North America demand better from their leaders instead of patting ourselves on the back about how at least we're better than China.

[1] https://www.oregonlive.com/business/2022/09/tool-gives-polic...

> even though the Snowden revelations were a "scandal", nothing bad really happened to the perpetrators

This is true, and bad, but consider another difference in this situation:

In the US, companies were able to respond to this revelation by shoring up their security practices, and people exercised their right to openly criticize the government. This is not possible in China.

Security practices? They collaborated with the NSA, CIA, what have you. You are really deluded.

No, it's only a scandal when information about that access leaks.

The US government still has and has always had access to all data about US citizens.

Bizarre that you think that stopped.

It is an espionage organization because it is controlled by an adversarial group which collects and stores detailed individual data. The CIA, NSA, and Google hold the same character.

Yea. Just like Google, Facebook, your phone, …

The fact is that DouYin, the Chinese TikTok, run by the same parent company is making billions of dollars every year, and expects to make more and more every year. It is eating up Alibaba's market share in e-commerce. And before DouYin and TikTok, TouTiao, the other product by ByteDance was making billions every year. 2021 revenue is $58b, I don't think ByteDance is losing money. It is merely accounting.