Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Canada bans TikTok on government devices over security risks (theguardian.com)
95 points by matbilodeau on Feb 28, 2023 | hide | past | favorite | 60 comments


So, I completely understand that gov's are concerned about an application on gov. devices being used to profile their staff. There's been plenty written about profiling people based on app. usage.

The bit that somewhat surprises me is the focus on TikTok, other apps are (AFAIK) capable of the exact same thing. Is the expectation that TikTok is the only app that the Chinese government have access to? this seems a bit unlikely.

And of course this doesn't touch on the companies that provide ad networks and other services to mobile applications, who have the ability to pull info from multiple apps at the same time, I've not seen any movement on banning those similarly.


TikTok did use ip tracking of reporters working on a story to try to find whistleblowers. According to TikTok that was a misguided employee who was let go shortly after.

Though they are hardly alone in the 'misguided employees' department. Ebay had a whole scheme where they flew out a security team to harass and stalk a couple that had criticized ebay in a blog post. https://www.npr.org/2022/09/30/1126078948/live-spiders-and-c...

I think Facebook and Uber had their own location tracking scandals as well.


If you’re on TikTok, you’re by default granting camera, microphone, and location permissions. If you’re addicted to TikTok you’re probably opening it up every time you have a few minutes to kill, including in government offices and etc.


No you're not, what? Is this some Android nonsense because I can just deny all of that on iOS. It doesn't even have the option of requesting location permission. If you want to make a Tiktok then yeah it's gonna need the camera and mic but outside of that it has never once triggered the mic or camera indicator while not taking a video.


It's not Android nonsense, it's just nonsense. If you don't post, TikTok requires zero permissions. Further, they only collect data related to how you use the app as per their privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en.


> they only collect data related to how you use the app

Did you read it? Because that is not what it says. That page also explains how they:

* fingerprint your device, and your biometrics, and ID your device even when you don't log in

* collect your location information even if you deny OS permissions

* collect information about your viewing habits

* collect and share information from data brokers

* share information with foreign companies in their corporate group, and comply with all legal requests. (and there's a link for more detail that returns a 404)


That's fairly normal data collection and nothing out of the ordinary at all.


It is. The new part for most westerners is the political jurisdiction that those legal requests are beholden to.


Which I guess is "welcome to how everyone not in the US thinks about the US." So 100% it's a change for us but the rest of the world seems to have acclimated to it fine-ish.


I don't disagree with that sentiment. Although it is more understandable that many outside of the US/CN/RU might use foreign social networks, because they don't have any major domestic alternatives... whereas the US has several direct competitors to TikTok.


What you list is exactly what I am saying. Moreover you are conjecturing by saying "deny OS permissions".

Simply put, an app cannot do something that would require permissions, without it (unless exploiting vulns). Do you perhaps mean IP location? Which is incomplete, can be spoofed, or manipulated.

I agree that no app should probably have this power, but what the original commenter posits, is that TikTok is overreaching. Where "over" is compared to everyone else (including western media). Even, most websites collect this information with or without consent.


Good point. I believe Opera Ltd., the company that develops the Opera web browser, was bought out by a Chinese company a few years ago. I would figure that the amount of browser data that could potentially be exfiltrated would be a major concern as well.


Likely because of a combination of factors: install base + privacy concerns + governance concerns

Missing one of those factors would make something much less of a threat in practice


> The bit that somewhat surprises me is the focus on TikTok, other apps are (AFAIK) capable of the exact same thing. Is the expectation that TikTok is the only app that the Chinese government have access to? this seems a bit unlikely.

I don't think it is just about 'profiling people based on app usage'. I have not seen any other social networking app that does this [0] and after suggesting that ByteDance having no access to US data outside of China, well there's this investigation. [1] [2]

> I've not seen any movement on banning those similarly.

That's because they (Facebook, Instagram, Snap, etc) have instead been fined by the regulators in the hundreds of millions. Don't want a ban? Pay a giant fine for such privacy violations like the rest of the social networking companies have done.

[0] https://futurism.com/tiktok-spy-locations-specific-americans

[1] https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-...

[2] https://www.forbes.com/sites/emilybaker-white/2022/12/22/tik...


Good point, I think most policy makers are not versed in how IT, and software works enough to understand the implications of such things. Tik Tok is an easy target, and gives them a starting point, but overall, the lack of true understanding of technology by our policy makers is quite astounding, and perhaps troubling at the same time.


because china.

There's no other reason besides this. American empire and its vassal states (like canada) are feeling threatened by the rise of the east.


Don’t understand this reasoning at all.

China bans all Western social media tech in the widest way possible for more than a decade and the minute a Western govt enacts a ban on govt devices, folks say this is unfair.


I think a big part of the objection over banning TikTok is that we, in the US, feel we should be able to make our own choices when it comes to social media (and most everything). Banning an app is antithetical to freedom.


TikTok is not banned for the public.

You are still free to use TikTok even if you are a govt employee on your private device.

This is the well known paradox of tolerance.

It is necessary for a free society to ban certain things.

Our govt already mandates a lot.

> Banning an app is antithetical to freedom.

No it isn't. We already ban a ton of stuff. Suddenly, freedom lovers have woken up and are complaining because we banned TikTok on govt. devices.


> TikTok is not banned for the public.

Never said it was -- if you follow the thread you'll see I was replying to someone pointing out that China has banned US social networks. The implication being that true US banning TikTok would only be fair, or something like that.

> We already ban a ton of stuff.

We do... and those bans do limit freedom, by definition. We've accepted that in a lot of cases -- few are arguing that child porn should be anything but banned, for example -- but I doubt we'd accept a government ban or restriction on, say, League of Legends simply because kids spend too much time on it (China places restrictions on time of day and duration).


> Never said it was -- if you follow the thread you'll see I was replying to someone pointing out that China has banned US social networks. The implication being that true US banning TikTok would only be fair, or something like that.

You replied to me. I simply said this is not unfair.

> ban or restriction on, say, League of Legends simply

Stepping away from hypotheticals: A lot of countries have restrictions on what you and you can't do with govt resources. E.g., there are restrictions on what carriers you can use if you fly with govt. funding. Other countries have similar rules. There is nothing wrong or unfair or "freedom limiting" with the US govt banning a likely foreign govt. controlled app from govt. devices.

https://www.gsa.gov/policy-regulations/policy/travel-managem...


Companies like Google and Facebook CHOOSE to not operate in China because they don't want to follow the the laws that Chinese companies are following. They're not banned, they're not allowed to operate unless they comply with local laws. Just like they wouldn't be allowed to operate in Europe if they didn't show a Cookie pop-up. It's not like they're not allowed to operate in China because they're American apps.

The US should make the data collection itself illegal for everyone and be done with it. They're currently walking this weird path where the exact same data collection is fine if it's Americans doing. It's not one set of rules for everyone.


False

https://www.investopedia.com/articles/investing/042915/why-f...

Any source to backup your claim?

> The US should make the data collection itself illegal for everyone and be done with it. They're currently walking this weird path where the exact same data collection is fine if it's Americans doing. It's not one set of rules for everyone.

Data collection is NOT the issue.

Foreign govt interference is the issue. If tomorrow Google were controlled by a hostile foreign govt., they would face the same bans.


But your link (the NYT times) says exactly what I said. They don't comply with local laws, which is why they're not accessible there. Not sure what else to tell you. Even Facebook's official comment is, which can be found if you follow the links you've posted:

“We need to figure out a solution that is in line with our principles and what we want to do, and in line with the laws there, or else it’s not going to happen. Right now, there isn’t an intersection.”

> Foreign govt interference is the issue. If tomorrow Google were controlled by a hostile foreign govt., they would face the same bans.

So it _is_ simply because it's foreign. How long do you think Google would survive in the US if it didn't comply with US requests? It does comply with requests and three letter agencies have access to data (as per Edward Snowden).

If your stance is that it's fine when we do it but not when others do it then that's just what it is.


> But your link (the NYT times) says exactly what I said.

No, it doesn’t. Read again. Was a fair trial held? No. End of story.

CCP does not rule according to laws. The only laws are CCP’s words and now Do’s words.

And you have a false equivalence here. TikTok has CCP board members and is not banned for US citizens.

> So it _is_ simply because it's foreign. How long do you think Google would survive in the US if it didn't comply with US requests? It does comply with requests and three letter agencies have access to data (as per Edward Snowden).

For a while. There would be court cases. Companies refuse US govt requests all the time and fight it in a court of law. A Snowden equivalent in China would be killed and not just a fugitive.


The CCP doesn't allow Facebook on PLA devices either. Because they're not idiots. All superpowers have significant domestic legal power to collect information regarding national security risks (read: competing militaries/governments).


https://www.reuters.com/technology/bytedance-finds-employees...

This is just what's publically announced, because companies have no international recourse against China. They sure as hell won't release info about obtaining profiles of various US officials. The CCP can tell Chinese corps to do whatever it wants them to do. It's not like the US. And to think they haven't leveraged the most effective psy-op and surveillance tool in the world is, honestly, quite naive.


My bigger question is why was this allowed on government devices in the first place? Shouldn't work phones be for work?


Many companies allow or even encourage using work phones privately. That way, they motivate their employees to not just switch the phone off and leave it on the desk locker in the office after finishing work.

This gives them a nice "side effect" of unlimited reachability.

That's the reason I actually power off my work phone after hours.


Well, then, this is the perfect pretext to take back your time and not answer after-hours --you exchange convenience and a little money for autonomy and the gov gets its security back.


Companies and smaller government entities encourage people to BYOD. It's cheaper and gets access to people 24x7.


I would guess the Canadian government employ people to manage social media for various departments. They may use TikTok, both to view content to understand for research or to post in order to promote their services/role/existance. Similarly I might imagine they have Twitter, Facebook, Instagram and other apps which facilitate spreading information.


At that point I would just buy the cheapest iPad and use it only for that. If you need mobile data, setup a hotspot temporarily.


Dumb question as a non expert, but if I'm trying to prevent bad thing from happening on my employees phones, why am I blacklisting "bad" apps instead of whitelisting "good" apps?


It’s to distract from the government’s unwillingness to hold a public inquiry into China’s election meddling.


Yes, I'm sure that's why the European commission did the same [1] a few days ago, why the US House is debating it now [2], and a number of other govt's have been considering it in the last month or two..

[1] https://www.euronews.com/my-europe/2023/02/23/european-commi...

[2] https://thehill.com/policy/technology/3876321-tiktok-ban-mak...

[3] https://thehill.com/policy/technology/3845729-texas-governor... https://statescoop.com/florida-tiktok-ban-desantis-digital-r...


Interesting how they all realized this thread at more or less the same time considering how long TikTok been out. "Influencing our democracy" has also been trending heavily.


It's all rather hilarious. The tiktok story is the 2nd headline on Google news for me. The first being something insane about a CCP official, CSIS, and a fat donation the PM's charity fund??


I don't understand why they're allowed to have any non essential apps, it's as mad as the UK doing national security over zoom and WhatsApp - government devices should be non-stock, vetted and secured devices, with proper MDM.

Is every government really this incompetent??


If the government is concerned about privacy and security risks here I dunno maybe they should pass some legislation that applies to all apps???? This is literally their job.


> “Effective February 28, 2023, the TikTok application will be removed from government-issued mobile devices. Users of these devices will also be blocked from downloading the application in the future. Following a review of TikTok, the Chief Information Officer of Canada determined that it presents an unacceptable level of risk to privacy and security.” [1]

[1] Statement by Minister [The President of the Treasury Board, Mona] Fortier announcing a ban on the use of TikTok on government mobile devices https://www.canada.ca/en/treasury-board-secretariat/news/202...


> Canada has announced it is banning TikTok from all government-issued mobile devices

This is only on work phones


I don't know if the title was updated but that's exactly what I understood from reading the title as it is now


Are there a lot of government-issued personal devices in Canada?



Makes sense also from a productivity perspective. TikTok on your work phone is like having a TV set in your office.


Or a bit like having HN on your development computer?

(brb, just need to start another build...)


Y'all are weird, my team does have a TV in our pod. It's fine. We watch Twitch, one of my coworkers is really into F1 so we have races on, we've had march madness running, sometimes we put on a lo-fi stream.

When you want to be productive outside of work do you still put on the horse blinders? You must be exhausted every day after work from 8hrs of straight forced focus.


My state did the same recently, my university blocks tiktok traffic on any divice connected to the school wifi now.

Kind of came out of nowhere for me, I heard about the security concerns but didnt think they were being taken that seriously.


[flagged]


The department that sets employee phone policy is not the same department that would run an investigation on elections.


This isn’t an excuse for not having a coherent policy on our dealings with China. Either they present a threat to our democracy or they don’t. Run an inquiry and band their data harvesting apps, or don’t.


In the HN spirit, what would be the "strongest plausible interpretation" of why a public inquiry might not be the best solution? I can list a few to start: international relations, protection of sources and methods, unnecessary delay in addressing the issue, risking politicizing the apolitical institution of Elections Canada


None of those balance the harms of loss of trust in government and institutions.


Personally, I trust the relevant government institutions (Elections Canada, CSIS, etc) to know and address it properly. While more information being released would be good, I don't think a public inquiry is the right format.


I don't trust to government to police itself behind closed doors.

Secrecy is not breeding trust and unity.

But please, why isn't a public inquiry the correct format and what is the right format that will balance national security and public trust (just because you trust government, doesn't mean other reasonable people do as well, like me).

So please convince me that we shouldn't investigate this in public after the PM tried to dismiss this claiming it was racism.


> But please, why isn't a public inquiry the correct format and what is the right format that will balance national security and public trust

I already gave you a list of 4 reasons I think a public inquiry is not the best format. You dismissed them out of hand, and without even providing your own reasons why you think it is the best method. Just because you don't trust the public service, doesn't mean other reasonable people don't, like me :)


Tiktok should just be banned outright. I don't know why anyone would trust an algorithm controlled by the CCP, and I don't know why western governments tolerate it.


Facebook, Instagram and Twitter as well. American three letter agencies have access to their data (revealed by Edward Snowden) and the US kills people based on this data[1].

[1] http://abcnews.go.com/blogs/headlines/2014/05/ex-nsa-chief-w...


No, that's a separate issue unrelated to this one.

If biden wants to show you pictures of seahorses on instagram, there really is no practical way to do it. If Xi wants to show you seahorses on tiktok, you'll be seeing them tomorrow.

Its a completely different situation, it bothers me that people try so hard to muddy the waters with whataboutism.


What if an administration didn't want to show us pictures of seahorses, but, say, no anti-war opinions? How hard would they have to try to ensure we all saw stories of our valiant friends and allies in need of our aid against a ruthless, despicable enemy?

How difficult would it be to prevent, suppress, or undermine journalistic scrutiny of a contentious military conflict?

Do we already know?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: