Business Blog: TikTok’s data problem

Here's more details about the access ByteDance had to U.S. TikTok user data

April 30, 2024

Even with the clock now officially ticking for ByteDance to either sell TikTok or face a ban in the U.S., new evidence continues to surface about the Chinese parent company's failures to keep U.S. user data separate from the rest of the organization.

Tiktok's former lead technical program manager for security engineering went on the record with Fortune, asserting that ByteDance retained control over some of the computer systems used by TikTok employees, according to a new piece published by my colleague Alexandra Sternlicht yesterday. Those internal systems spanned messaging as well as product and tech management software—and they left U.S. user data vulnerable to China-based ByteDance workers.

"There's a front door that everyone is looking at, but the way to access the network is through employees," Ryan told Sternlicht, describing his stint at the company between 2020 and 2022.

The revelations underscore the challenge facing businesses trying to balance geopolitical strictures with the realities of operating a global internet company, in which dispersed teams need to communicate frequently and access common data. TikTok's U.S. Data Security team, which was focused on keeping U.S. user data sequestered, frequently moved data out of that isolated environment by using an internal communications platform called Lark/Feishu that was controlled by ByteDance in China, Ryan and another former TikTok employee told Sternlicht.

While there is no evidence that the Chinese government actually took advantage of this access to spy on Americans, the latest example of the data wall's porous nature bolsters the argument of those who want TikTok banned in the U.S.

There's more:

TikTok has given conflicting timelines for when it completed shifting the version of Lark used by U.S. data security workers to be entirely in the U.S. Asked by The New York Times in May 2023 about the topic, a TikTok spokesperson said U.S. user data was still being moved. When that transfer was complete, messages involving U.S. user data would be hosted on a separate "internal collaboration tool" (alluding to the U.S.-based Lark), the spokesperson said.

But more than a year later, TikTok's policy team gave a different story in a post on X. It said the "secure environment for protected U.S. data," overseen by the U.S. data security team, had been completed in January 2023—months before the Times published its story.

In response to a question by Fortune about the discrepancy, a TikTok spokesperson provided yet another timeline. In this telling, the secure data environment, or servers and data centers, for the U.S.-only version of Lark was completed in January 2023. But Project Texas, the actual isolation of U.S. user data within that infrastructure, is ongoing, the spokesperson said without giving an expected date of completion.

Some of TikTok's other software that is used by employees to do their jobs also leaves the door open to monitoring by ByteDance's China-based workers, Ryan said. That's because these services are mostly hosted in, or accessible from ByteDance and TikTok's internal network, which is largely based in China, says Ryan. In theory, ByteDance workers with certain clearances may be able to see what U.S.-based TikTok employees using these systems are doing. However, Ryan couldn't point to specific instances of U.S. user data being shared across these systems, which included Atlassian's Jira product management software and Asana, used for tracking the status of tasks assigned to workers and for project management.

For its part, a TikTok spokesperson asserted that "This reporting is inaccurate and is clearly driven by anonymous sources with a preconceived agenda." TikTok's user data, the company said, was stored in Virginia and Singapore in 2022, and away from China. It declined to respond to allegations that some of its enterprise systems were hosted in China through at least 2022.

You can read Sternlicht's full story here.

In other news…Fortune yesterday won four National Headliner Awards for our 2023 cover story on OpenAI, our piece about employers’ efforts to help people with substance-abuse problems reintegrate into the workforce, our Jason Blum profile, and our special digital issue that delved into Elon Musk's universe.

See you tomorrow,

Jessica Mathews
Twitter: @jessicakmathews
Email: jessica.mathews@fortune.com
Submit a deal for the Term Sheet newsletter here.

Joe Abrams curated the deals section of today’s newsletter.

VENTURE DEALS

- Inhabitr, a Milpitas, Calif.-based AI-powered furniture procurement, financing, and installment platform for commercial real estate, raised $27 million in Series B funding. Hamilton Ventures led the round and was joined by others.

- Adaptilens, a Boston, Mass.-based developer of an intraocular lens designed to help cataracts patients, raised $17.5 million in Series A funding. Perceptive Xontogeny Venture Funds led the round and was joined by Pillar VC, 380 Cap, and Accanto Partners.

- Locate Bio, a Nottingham, U.K.-based orthobiologics company that builds products for surgeons, raised £9.2 million ($11.5 million) in funding. Mercia Ventures and BGF led the round and were joined by others.

- Holograph, a Los Angeles, Calif.-based omnichain tokenization protocol, raised $11 million. Mechanism Capital and Selini Capital led the round and were joined by Northrock Capital, Arca, Courtside Ventures, and Hartmann Capital.

- Indigitall, a Madrid, Spain-based customer engagement platform, raised €6 million ($6.4 million) in Series A funding from Data Point Capital, GoHub Ventures, Adara Ventures, and others.

PRIVATE EQUITY

- Generate Capital, the Healthcare of Ontario Pension Plan, and HESTA invested $650 million in Pine Gate Renewables, an Asheville, N.C.-based developer and owner of solar and energy storage projects.

- Valtech, a portfolio company of BC Partners, acquired Kin + Carta, a London, U.K. and Chicago, Ill.-based digital transformation consultancy, for £239 million ($300.2 million) in cash.

- Bruin Capital agreed to acquire a majority stake in PlayGreen, the owner of Stadium Grow Lighting and Alva Technology, two natural turf management companies. Financial terms were not disclosed.

- CASE, a portfolio company of AE industrial Partners, acquired CyberKinetics, a Herndon, Va.-based provider of IT infrastructure and other services and solutions designed for federal agencies and commercial clients with compliance mandates. Financial terms were not disclosed.

- Norwest Equity Partners acquired MDC Interior Solutions, a Chicago, Ill.-based commercial interior wall coverings and design solutions company. Financial terms were not disclosed.

Leading with trust & transparency

Register for Fortune's Future of Finance summit

Join financial leaders including Wall Street titans to the next generation of business executives as they explore the industry's moment of transformation and how to innovate with inclusion and empowerment at the forefront.

Apply now

EXITS

- Simply Good Foods agreed to acquire Only What You Need, a New York City-based plant-based protein shake brand, for $280 million in cash from Purchase Capital.

IPOS

- Viking Holdings, a Pembroke, Bermuda-based cruise line, now plans to raise up to $1.3 billion in an offering of 53 million shares priced between $21 and $25 on the New York Stock Exchange. The company posted $4.7 billion in revenue for the year ending December 31, 2023. Viking Capital Limited, Canada Pension Plan Investment Board, and TPG back the company.

- Proficient Auto Logistics, a Jacksonville, Fla.-based provider of auto transportation and logistics services, plans to raise up to $228.8 million in an offering of 14.3 million shares priced between $14 and $16 on the Nasdaq. The company posted $145 million in revenue for the year ending December 31, 2023.

PEOPLE

- Oxx, a London, U.K.-based venture capital firm, promoted Gökçe Ceylan to principal and Reshma Sohoni to the firm's advisory board.