With its individualized feed of endless videos featuring carefully choreographed dances, meme challenges, mundane slices of life, and other miscellanea, TikTok would seem to be most dangerous for its addictive hold on users’ attention. But national security experts are concerned about another potential problem with the app, which is owned by Chinese company ByteDance — its ability to collect, store, and possibly even share data about its tens of millions of U.S.-based users.
The fears surrounding the Chinese Communist Party’s ability to obtain and use that information are not new. Former President Donald Trump issued an executive order banning TikTok in 2020, but it stalled in the courts and was eventually rescinded by President Joe Biden. Now, a bipartisan coalition of lawmakers is once again raising the alarm about TikTok as concerns over spying by China have grown, prompting several states and the federal government to prohibit the app’s use on government-issued devices.
Timothy H. Edgar ’97, a former national security and intelligence official and a lecturer at Harvard Law School, advised President Barack Obama ’91 on cybersecurity policy and privacy issues. In an interview with Harvard Law Today, Edgar says that while he doubts the Biden administration will push for a full ban on the app “unless there is a huge scandal,” he believes lawmakers will move to regulate TikTok in some way. But Edgar says it’s important to consider users’ rights to freedom of expression and discusses the national security and civil liberties concerns, the legal challenges a ban would face, and why our treatment of TikTok could impact U.S.-based platforms.
“There are a lot of legitimate concerns, and we will be debating the issue for many years to come,” Edgar predicts.
Harvard Law Today: Before we talk about TikTok specifically, could you set the stage for us on the issue of national security and its relationship to tech?
Timothy H. Edgar: Although these are very new issues for the United States, they’re not new for most of the world. We’ve been the world hub in terms of physical connections to the internet — if you look at a map of the global traffic, it all runs through North America, and especially the U.S. We’ve also been the commercial hub with platforms like Facebook, Google, and Amazon Web Services. Other countries have worried about their data being in the hands of the U.S., especially after Edward Snowden’s revelations about global surveillance by the U.S. National Security Agency. We’re on the receiving end of it now.
TikTok is the latest controversy, but there have been previous controversies about Zoom and its connections to Chinese companies, or WeChat, or Huawei. So, whatever we do with TikTok, I think it’s important for us to understand that we’re setting a precedent, not just for our own national security concerns, but for how we think other countries can and should address their sovereignty concerns when it comes to the internet. We want whatever we do to be something we’re comfortable with other countries doing to us or to potential allies.
HLT: What are the main national security concerns surrounding TikTok?
Edgar: I think there are many valid concerns. The government identified two major ones during the litigation against President Trump’s executive order. One was access to user data of Americans by TikTok and its parent company, ByteDance, and presumably also by the Chinese government, and that includes all sorts of data like location and user communications. It also includes not just public data viewable on TikTok, but all the user data associated with it, such as a person’s phone usage. The other big concern has to do with propaganda that might be subtly or not so subtly pushed by the TikTok platform, or censoring or shadow-banning disfavored content or disfavored views.
“It’s important for us to understand that we’re setting a precedent, not just for our own national security concerns, but for how we think other countries can and should address their sovereignty concerns when it comes to the internet.”
HLT: What are the civil liberties issues we need to consider when deciding what to do about the app?
Edgar: As I said, I think there are serious national security concerns with all sorts of aspects of our cyber infrastructure. But that leads us to ask: What should we do about it?
I think there are many civil liberties concerns with a ban on TikTok. First is obviously freedom of expression. There are 100 million U.S. users on TikTok, some of them important influencers that have made this a big part of their identity and part of their self-expression, and banning it would have a severe impact on them. There is also freedom of communication. TikTok is a platform where people are communicating privately as well as publicly — this would be a direct infringement of the choices of those users.
The second point would be the example we’re setting around the world for internet freedom. Typically, the U.S. government has protested when other countries ban U.S.-based apps or companies. So, if there’s a way to address our concerns about national security short of a ban, I would think that those are good reasons to at least consider that. We don’t want to be in the position of ‘do as we say, not as we do.’
The power to ban TikTok
HLT: How would a full ban work? Can the president unilaterally ban the app, or would Congress have to act?
Edgar: The experience we had from the Trump bans — which were quickly enjoined by the courts — shows us that it’s not so easy for the president to just unilaterally ban TikTok under what is known as the International Emergency Economic Powers Act, or IEEPA. The reason for that is interesting. IEEPA has a very broad set of powers for the president to prohibit transactions because of foreign policy concerns in an emergency. But there are exceptions in that law that almost look like they’re written for TikTok and the internet — but they weren’t. One exception is for personal communications that do not involve a transfer of value. And another one involves information or informational materials, including but not limited to publications, films, posters, artworks, and newswire feeds.
Where did those exceptions come from? During the Cold War days, the U.S. embargo against Cuba was interpreted to include activists and other Americans who were just interested in buying magazines from Cuba, and they couldn’t. They wanted to send messages back and forth to Cuba and the embargo stopped them. Congress thought that this was going too far because of the impact on freedom of expression and added those exceptions to IEEPA.
The courts, when they were considering Trump’s ban, pointed to those exceptions. Of course, Congress could change the law — could change IEEPA — but we’d still be opening up potential constitutional challenges. And you would also have to wonder about the impact on freedom of expression when you limit those exceptions.
“Even if we agree that China is an adversary, that China is a serious cyber threat, and that there are serious issues around TikTok, you want a policy that doesn’t just appear tough — you want one that works.”
HLT: Let’s say that Congress or the president opts for a full ban on the app. What kinds of legal challenges can we expect to see?
Edgar: Without congressional action, I think you’d see that same challenge based on the wording of IEEPA. I think you would probably also see First Amendment challenges, maybe challenges under the Administrative Procedures Act. I think it would be tied up in the courts at a minimum, and those challenges might succeed.
The way I’d look at it is, Trump’s ban was really a sledgehammer. It was, in my opinion at least, designed to make headlines, almost a form of trolling. As long as you get the headlines about trying to ban TikTok, whether you succeed or not, maybe that serves the political goal. And maybe Biden has the same motivation. But if what you’re trying to do is address national security concerns, I think you want an approach that’s more likely to survive a court challenge.
HLT: Is there another way to address this issue short of a full ban?
Edgar: President Biden has been pursuing a more measured approach. There’s a process separate from the IEEPA process involving the Committee on Foreign Investment in the United States, or CFIUS. CFIUS has been around for a long time. For certain sensitive industries, especially those involving defense, there are a set of restrictions on foreign investments. For example, if a foreign company tried to buy a U.S. defense contractor, they might not be allowed to buy it at all. If they were allowed to, they’d have to get the terms of that deal approved by the CFIUS.
ByteDance has been working very hard to address U.S. national security concerns, and has done a lot of lobbying, and part of that is to try to use the CFIUS process. Some of the safeguards they’ve agreed to include a separate independent board — what is sometimes called onshoring or reshoring. They’ve invested around a billion dollars in Texas to try to bring servers and the data infrastructure for TikTok into the U.S. They’ve also set up oversight mechanisms.
Frankly, I’m not necessarily sure all that is enough. But I do think that regulations are more likely to survive in the courts, rather than a flat out ban. Maybe it amounts to the same thing if the approach is so restrictive that the company chooses not to do it. But you have to at least try to show that you can address the concerns in a way other than just by banning it.
HLT: This issue seems to have attracted an unusual level of bipartisan support. Why do you think that is?
Edgar: I think there are two reasons — a substantive reason and a political reason. The substantive reason is that both parties recognize that there’s a serious cybersecurity threat to the U.S. now, and that China is among the most sophisticated adversaries the U.S. faces when it comes to cybersecurity. There have been several hearings in Congress, often bipartisan, that have addressed these issues, and so many members of Congress have had a history of working together on cyber threats.
But there’s also a political issue, which is that the Republicans see a lot of mileage in going after the Biden administration on China. We saw that with the spy balloon criticisms, we’ve seen that with arguments about business interests of the Biden family. In some ways, it’s a political response to the Democrats going after Trump on Russia. Democrats sense that there might be some vulnerability there, and so they want to show that they’re really tough on China. That can be a dangerous dynamic, because even if we agree that China is an adversary, that China is a serious cyber threat, and that there are serious issues around TikTok, you want a policy that doesn’t just appear tough — you want one that works.
Regulating tech and the Golden Rule
HLT: The U.S. has criticized China for blocking American tech companies for national security reasons. Could this be perceived as “retaliation”? Is the situation with TikTok different?
Edgar: China’s arguments for blocking U.S. tech companies look at least superficially quite similar to the U.S. arguments for blocking TikTok. It really comes down to the domination that the U.S. has had over the internet for decades now. What’s different about TikTok is that China and the United States are very different from each other. The relationship that the Chinese state has to its companies is a very different relationship than the relationship the U.S. government has to its companies. For example, President Xi has a whole cyber power committee that’s composed of the CEOs and owners of the major technology companies in China. In the U.S., it would be hard to imagine a committee like that. Certainly, the U.S. government meets with companies in Silicon Valley, but there is far more independence in the U.S. There’s also the rule of law — that U.S. companies have the ability to challenge in court what the government is asking them to do when it comes to things like surveillance.
“We have to keep in mind the Golden Rule: Do unto others as you would have them do unto you. That will help inform what makes sense from a public policy point of view.”
HLT: So, should we treat social media and other online platforms owned by foreign actors differently than those owned by U.S.-based companies?
Edgar: I think the answer is yes. I think it’s a matter of common sense — whether you’re talking about user data or about broader policies across the internet — that when a major company has a platform located outside the United States, it’s going to present different policy issues for the U.S. government than if it’s an American company. Sometimes that will require additional levels of oversight and control, as we’re seeing with TikTok. And that, to me, is fine and makes a great deal of sense.
But two points on that. First, we should really be only adopting controls that we think are justified if they were applied to us in reverse. Whatever controls we adopt, whatever standard we come up with, those ought to be things that if another country did that to Facebook, or Google, or Amazon, we’d say, ‘those controls seem reasonable to us.’
We also should not be blind to the differences between democratic and authoritarian countries in practice. We could design a set of controls on paper for TikTok, and those controls would be subject to court challenges, to the rule of law. You could imagine China or another country looking at those controls, and saying, ‘Well, we’re going do the same thing.’ But are they really going to be the same? If it is an authoritarian country, they may not have the environment in which to make those controls work in a way that doesn’t impact freedom of expression or some of our other values.
As I’ve said, whatever concerns we have towards TikTok or other apps, when we’re thinking about how to draft rules and regulations, I think we have to keep in mind the Golden Rule: Do unto others as you would have them do unto you. That will help inform what makes sense from a public policy point of view.
Want to stay up to date with Harvard Law Today? Sign up for our weekly newsletter.