The US Senate has passed a bill that compels TikTok's Chinese owner, ByteDance, to offload the app to a US-based buyer, and president Biden immediately indicated he will sign it into law.
The bill – formally known as the Protecting Americans from Foreign Adversary Controlled Applications Act (PFACAA) – passed 79 votes to 18 on Tuesday US time. The Act was bundled into HR 815 – a law that among other things authorizes military funding to support Ukraine, Israel, and Taiwan.
The Act defines just one source of foreign adversary-controlled applications – anything produced by ByteDance, TikTok, or related entities – but also gives US presidents the power to name more. TikTok earned the designation as it is felt the app allows ByteDance to collect data on US citizens and is used by Beijing to spread information. Chinese social media, by contrast, is largely closed to outsiders.
PFACAA makes it "unlawful for an entity to distribute, maintain, or update (or enable the distribution, maintenance, or updating of)" such apps, and once signed by president Biden will see a 270-day countdown commence. After that time has elapsed – or perhaps after a single 90-day extension – it will be illegal for an adversary-controlled app to appear in US app stores or be hosted by American service providers. The then-illegal app will be forced to hand users "any data maintained by such application with respect to the account of such user, including content (including posts, photos, and videos) and all other account information."
The Act contains an escape clause: a "qualified divestiture" to an entity the US government is satisfied will see the app no longer controlled by a foreign adversary will mean continued operations are allowed.
President Biden on Tuesday promised to sign the law on Wednesday – meaning ByteDance has until January 25th, 2025, to offload its flagship app.
What happens next is unclear. ByteDance's US arm is reportedly considering a legal challenge, while a few potential buyers have expressed interest in acquiring TikTok's stateside operations.
But whether it is possible to disentangle US residents' TikTok accounts from ByteDance's infrastructure is unknown. And given that some US user data is visible to ByteDance workers in China, any buyer would face an enormous and complex project to quarantine TikTok for stateside users.
That's not a bland assertion: The Register has reported on years-old infosec issues that persist in a situation comparable to the divestiture of TikTok – namely the acquisition of Korean messaging app LINE by Yahoo! Japan.
Potential buyers of TikTok's US ops would surely be considering their appetite for the enormous technical effort that lies before them, and the potential for trouble if they are found not to have completely severed the app from ByteDance.
Your correspondent can imagine writing many, many, stories about failures to get that job right.
And also many stories about the impact of this Act on free speech, the open internet, the livelihoods of TikTok creators, implications for US tech companies that – like Oracle – proudly provide infrastructure for the app, and even whether this decision could turn the US election.
The last possibility is on the agenda as likely Republican presidential nominee Donald Trump – who as president tried and failed to ban TikTok – is now blaming the app's demise on Biden. That it hasn't actually happened yet is neither here nor there. ®
Source: The register