Hacker News Reader

Comment by nextstep | Hacker News Reader

Can you explain how this is a spy tool and how Youtube, Instagram, Facebook, etc. are not? I haven't really used TikTok. How does it collect data beyond the videos I've watched?

View on HN

Chinese domestic companies are legally obligated to provide a direct data pipeline from their databases to the Ministry of State Security. It's a real law that exists. Basically imagine what the NSA implemented with the PRISM program revealed by Snowden but formally codified into law and with active participation/engineering efforts required by the corporations.

Is it particularly different from https://en.wikipedia.org/wiki/CLOUD_Act ?

Yes

https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-...

It's more like being perpetually subject to a National Security Letter (NSL) warrant issued by a US FISA court, a fairly rare occurrence and specifically targeted, but for blanket database replication and as the widespread legal default for every company in China.

The main difference is that HN is mainly visited by American users, not affected by CLOUD act.

The CLOUD Act affects all US companies.

For what it's worth, non-american citizens on non-american soil have no legal protection against the same. And big ad monopolies are not in the business of pissing off the security state.

I don't see how, for instance, with a Austrian customer of a Belgian data center operator, the Belgian data center operator does not have a legal obligation to form a secure database pipeline connection and replicate everything directly into the NSA.

Obviously whatever signals intelligence gathering method or data copying the NSA might be doing in Western Europe could very well exist, but it's not a defined requirement for that theoretical Belgian ISP.

Correct, a Belgian isp would have vastly fewer reasons to comply with polite requests from CIA/NSA than a US-based FAANG.

They are working on a deal with US, all data for US citizens will be kept in US[1].

And some info about it from them directly:

"As we recently shared with members of Congress, we are working toward a new system in which access to U.S. user data by anyone outside of USDS will be limited by, and subject to, robust data access protocols with monitoring and oversight mechanisms by Oracle."[2]

1. https://arstechnica.com/tech-policy/2022/09/tiktok-can-keep-...

2. https://newsroom.tiktok.com/en-us/our-approach-to-keeping-us...

EDIT: downvotes for sharing latest additional data from official sources about the topic without any private opinions? This trend is dangerous for healthy discussion.

doesn't mean their office and staff in china don't remotely have access to the data or the ability to replicate it.

I think it's addressed in sources I've linked, there is a whole section describing who have access to data of US citizens. Additionally I don't think US administration will just let them do it (share whatever they want with China), if a deal will be made then US citizens will control who is and how that data is accessed outside US through Oracle, otherwise they would just be banned as national security threat.

Actually the data was already stored in the US as required by US law. The deal with Oracle is to guarantee the access is limited.

One is controlled by an authoritarian government, the others are private (publicly traded) corporations in a democratic country.

as someone living outside the US I can tell you that to us you're all the same.

That's your personal opinion. You don't speak for the ~7.7B people not in the US.

As is your opinion that it isn't

I didn't claim to speak for billions of people.

"You don't speak for the ~7.7B people not in the US."

"You don't speak for me"

One of those comments is speaking for a lot more people

No it isn't, both are correct statements of fact.

Where did you get "you don't speak for me"?

It's "I can tell you that to us you're all the same" vs "You don't speak for the ~7.7B people not in the US."

One person is trying to speak for 7.7B and the other is advising against that.

>Where did you get "you don't speak for me"?

It was an example of how to state unambiguously who was/was not being spoken for to contrast with the other statement. Maybe because I put it in quotes led you to think I was quoting someone, but it looked odd without to me.

you are making the same implicit claim and arguing insignificant semantics.

Ironically, there's laws restricting US Gov access to data in the US, but no such restrictions on hacking foreign networks.

you're entitled to your opinion, but for those of us living inside the US, they are not at all the same

When the police start knocking on my door inviting me to have tea because of something I posted on twitter I'll take your comment seriously(https://chinadigitaltimes.net/2021/10/translation-spilling-t...).

Our free speech and privacy protections are not only stronger than China's, they're arguably stronger than Europe's too. There are some trade offs of course since Europe has GDPR and the right to be forgotten.

https://www.nytimes.com/2022/09/23/technology/germany-intern...

https://www.thetimes.co.uk/article/police-arresting-nine-peo...

The reason China's situation is worse is because Europeans and Americans can and do protest this. It is not normalized and accepted. If you feel that America goes too far in how it exports its perceived brand of authoritarian, you should know that China is just getting started: https://www.washingtontimes.com/news/2022/oct/3/report-detai...

But they took part in illegal surveillance programmes in the past.

>illegal

Exactly. What's illegal here is perfectly fine in China. Let's not equate the two.

US government may get data from US companies but at least it takes a warrant. Chinese government straight up owns the servers.

Did anyone have any consequences for the illegal behavior, including perjuring themselves before Congress regarding the matter?

Then why would they stop after it was declared illegal?

Yeah the Church Committee in the 70s really reformed the "intelligence community." They learned their lesson and never violated peoples civil rights ever again. And there's so much oversight now!

> US government may get data from US companies but at least it takes a warrant.

On December 16, 2005, The New York Times reported that the Bush administration had been conducting surveillance against U.S. citizens without specific approval from the FISA court for each case since 2002.

In 2011, the Obama administration secretly won permission from the Foreign Intelligence Surveillance Court to reverse restrictions on the National Security Agency's use of intercepted phone calls and e-mails, permitting the agency to search deliberately for Americans' communications in its massive databases.

https://en.wikipedia.org/wiki/United_States_Foreign_Intellig...

It seems to use the same bag of tricks Facebook/LinkedIn/etc. use to track things you do "off-app": tracking code in share widgets, injecting JS into the in-app browser, tracking cookies[1].

If ByteDance ever releases an Onavo style VPN app, people are going to lose their minds.

[1] https://www.wired.co.uk/article/tiktok-data-privacy

They're exactly the same.

Reply on news.ycombinator.com