The TikTok ban - One Mole Whacked, A Million to go

by Vikram Venkatasubramanian

Friday Jan 17th, 2025

(3 min read)

The Supreme Court today decided it will NOT oppose a ban on TikTok essentially agreeing that the Protecting Americans from Foreign Adversary Controlled Applications Act holds in this case. Two sentences from Justice Neil Gorsuch's concurring statement in the judgement really caught my attention:

"I am persuaded that the law before us seeks to serve a compelling interest: preventing a foreign country, designated by Congress and the President as an adversary of our Nation, from harvesting vast troves of personal information about tens of millions of Americans. The record before us establishes that TikTok mines data both from TikTok users and about millions of others who do not consent to share their information."

Massive face palm moment!!

So, it appears the courts agree that there are huge risks to harvesting 'vast troves of personal information' but how can we be SO myopic in limiting the source of that harm is only from foreign adversaries? How did we have a discussion about privacy and cybersecurity without ending up really addressing EITHER? Here are some compelling arguments to consider that were grossly ignored in this whole discussion around TikTok:

The invention of the camera necessitated redefining what is personal property as defined by the Fifth Amendment and it was argued and upheld that a person's likeness fell under the banner of personal property. We blogged about this some years back!
Our last blog was precisely about the dangers of apps collecting our information and showed evidence of a high volume of apps targeting children engaging in these actions.
The harms to Americans are NOT just from foreign apps or foreign entities. Just this week, the State of Texas sued an American insurance company, AllState, for harvesting Americans data from third party apps like GasBuddy and Life360 to adjust or cancel their policies!! Isn't this harm to Americans?
We published analysis of some of the top downloaded games on the most popular apps stores to show how information was being shared. (see interactive visual below, click on the arrows to see more data)

We published analysis of how data was being shared from the top 10 most popular women's period tracking apps and the number of entities it was being shared with. Isn't this sensitive data that only privileged and authorized people should have access to? (see interactive visual below, click on the arrows to see more data)

And just today, I checked the Kavalan dashboard for my home and was stunned by the number of companies that were looking to track my geo-location! See for yourself!!

‍

The body of evidence is long and the reality is that companies, American and foreign, are looking to collect, use and exploit our data for monetary and other purposes. The damage to us and our wallets is VERY REAL. The national security implications of this are huge. If an American company that collects information about health conditions gets bought by a foreign entity, what then? Would a foreign entity or power not be very interested in knowing if there is a family member of one of our active duty armed forces has a life threatening or sensitive health condition? How is a ban on one app going to stop the collection or sale of such data by another app, device or website? We have whacked one mole. How much time and energy will it take to whack a million moles?

Elevated national consciousness on privacy and cybersecurity

I have said this a million times and will say it again - when it comes to the individual and the home, you CANNOT solve for cybersecurity without solving for privacy. The real solution is to, like many other countries around the world, is to have a national privacy law. What we have today in the US is a patchwork of privacy laws in specific states enforcing various degrees of protection. Enforcement and scope are unclear. We need a national privacy law. This will NOT happen on its own given the sheer size of the data exploitation industry here in the US.

We all need to write and call our Senators and Representatives.
We need transparency and clarity around data collection and use.
We need limits on kinds of data that can be collected.
We need stiffer penalties for violators (not just a dollar amount that they can consider as 'cost of business).
We need mechanisms to enforce our own rights that are easy and immediate.
We need these laws to apply to devices, apps and websites
We now have a US Cyber Trust Mark for cybersecurity of consumer devices. We need this extended to apps and websites.
We need to have the equivalent to the US Cyber Trust Mark for privacy that applies to devices, apps and websites.

There is your check list. Now, let us start writing and calling our representative, shall we?