Government TikTok Bans and Cyber Threats

All right, TGIF. You know what time it is. It's time for In Case You Missed It. Today we're gonna be talking about government TikTok bans and emerging cybersecurity threats. And, you know, Joe, I don't know if we have a TikTok account that we should start to look at putting things on, or if it's gonna be blocked by the US government. We're gonna dive into all of that today. And as we were talking about who best to break down this conversation, One name rose to the top. Dan Lorman, nationally recognized cybersecurity thought leader, author of Cyber Mayday and The Day After, contributor to Government Technology magazine through his Lorman on Cybersecurity, and the Center for Digital Government Senior Fellow, is back to talk about the impacts of TikTok and what agencies should think of it. Dan, thanks so much for carving some time out.

Hey, Dustin, it's great to be back with you and Joe again, and really looking forward to the conversation today.

All right, we got some hard questions for you today, but let's start first with the news at hand. TikTok has been front and center all over the news, even some recent developments today and definitely in the crosshairs of the federal government. And now some states are also enacting their own rules and blocks on it. What's happening with TikTok?

Yeah, there's so much going on. And, you know, we can talk about the states and it has been growing list of bans. I lost count at like 26, 27 states that had banned it. But the real kind of hot off the press news we were just talking about a few minutes before we went live is just earlier this week, a bipartisan group of senators, really 12 senators, 6 Republicans, 6 Democrats, released what's called the RESTRICT Act, which is Restricting the Emergence of Security Threats and Risk Information and Communications Technology Act, which I know it's a mouthful, but it really is a watershed moment. And we'll walk through what that means. But Really, it's the goal is to give the power to the Commerce Department Secretary to go through a series of steps to block or to ban basically apps and/or different types of technologies. And, you know, from certain countries, and we'll name the countries in a few minutes, but basically saying there could be a threat to the United States. And most people are taking it as a TikTok bill. A similar bill was passed by the Republicans on a party-line vote the week before, but this had bipartisan support. The White House has come out in support of it. So I think a lot of people believe this could really happen and give the ability for the federal government to literally block TikTok nationwide, which would be huge, unprecedented.

And we talked about this on our prep here. how much this topic evolved from when we first put it on the agenda, kind of looking at just the state response. And now we've seen this federal response to it here in the last couple of days. But what is really the underlying risks that these agencies are trying to mitigate with TikTok?

Yeah, I think the big fear overall the states were facing this, and also now the feds are saying the same thing, is fear that that basically TikTok, the company, or in the case of other apps, but mainly focused on TikTok right now, could grab all that personal data, all that information about you, not just really kind of the sky's the limit of not just who you are, where you are, when you're online, where you're at, all this data they've accumulated, so many people, and the numbers are pretty astounding. 100 million Americans spend Basically, I saw something along the lines of 90 minutes a day on TikTok, which is pretty astounding when you think about how much time that is. But the idea that they could have that data and they could share that with the Chinese government, a lot of that is sensitive data. And so when these state bans have really not focused much on your teenage kids, but I mean, basically state-owned devices, devices that are running on networks at universities and anything state-funded, state networks. And the main focus of that was protecting data, protecting sensitive data that could be on those devices, on those smartphones, on those laptops, whatever it might be. The goal was really around that. And there was a law that was passed in China back in 2017 that basically in theory, at least, they said they wouldn't do this, but they haven't formally said that. TikTok's parent company, ByteDance, if pressured, would have to give over that data to the Chinese government. So I think that's one of the big fears, is that that sensitive data that's on all these devices and all that information about you and what you do and where you go and what you look at could all be handed over to the Chinese government.

Yeah, I think what's interesting, you talked about some of the proposed bipartisan legislation on this. I mean, this is an issue that's wider than just TikTok. So love to get your thoughts. I mean, is this something that's going to have an impact on other international applications that are, you know, starting to gain consumer attention in the US? Is this, uh, just because of the TikTok ties to China?

Yeah, it's a great question. And, and I think, you know, uh, what I really found fascinating, um, I was watching CNBC on Tuesday morning. I, I work out every morning on the treadmill and I'm flipping through the stations, you know, CNBC and Weather Channel and CNN and, you know, sports ESPN and getting the updates. Uh, but, um, and Senator Warner was talking about this bill, bipartisan. He's one of the co-sponsors with, um, Republican, uh, Thune, um, from South Dakota, John Thune. And, um, he really said that the goal here is, is, you know, again, to give the Commerce Department, um, wide discretion to identify, mitigate perceived risks stemming from technology produced by companies with ties to foreign adversaries in 6 countries, and that is China, Russia, Iran, North Korea, Cuba, and Venezuela. So those 6 countries are listed specifically. So other countries, if it's from UK or something that might— somebody deems a threat from a UK company, they're not on the list, right? So that would not be So this is from those countries. And the thing I found fascinating, Dustin, was he was really kind of talking about it in a long line of— he considered a long line or a line of other threats to US national security. Like many listeners out there may know about the Huawei banning network equipment from Huawei, Kaspersky, not buying Kaspersky antivirus. I actually cover Kaspersky in my annual blog on predictions because Kaspersky is very big on cybersecurity all around the world, but they've been banned in a lot of Western countries. They've been banned in the United States to use their software and equipment in the US. So they're kind of saying, we did it with Kaspersky, we did it with Huawei, now we're doing this potentially with TikTok. But I think what I really find interesting about this is to say it's not just about TikTok. They're trying to try and pull that back and say, Because if you just ban TikTok, in theory, you could change the name and call it TikTok 2 or something, then I'm not banned anymore or something. I mean, that obviously wouldn't happen that simply, but you understand my point. Or somebody else creates a lookalike thing that does the same thing from China and does the same kind of a thing, although it doesn't have that user buy-in, that huge installed base. But the idea here is it's not just supposed to be TikTok and there could be others. I don't know of anything approaching TikTok size scale and user base right now, but certainly there could be others coming down the pike.

Using TikTok as the example, it's clearly an app that people have maybe obviously on their government-owned devices, but also on their personal devices as well. What advice would you have for government agencies that are going down that path of saying, hey, you can't have it on a government device, But what advice should they have maybe when it comes to their use of TikTok on their personal devices as well?

Yeah.

And again, I think, Joe, that's a really good example of where the— stay tuned because this could change nationally. It could be banned for everybody in the United States. We're going to have a lot of unhappy teenagers. In fact, it's funny watching a lot of different shows and trying to get different opinions in the last couple of weeks around this. Some people actually— I just want to throw this in here. Actually believe they just want to give the White House the authority to negotiate this with China and that it won't be banned. I mean, will it be banned? There's actually 2 camps out there. Even with this law, if this law passes, if it passes the Senate and the House and the president signs it, goes into effect, it's up to banning. I mean, that would be like the last step, that there are steps they can take leading up to it. So my point is it may or may not actually get banned. I want to make that very clear. Even if the law passes, Commerce Department still has to act. But whether it's TikTok or other things, I mean, I think this is really extending the debate we've had for really probably more than a decade around BYOD, bring your own device to work. I'd first say advice to state and local governments, have you looked at— well, first of all, some local governments, some universities may not even have this. Do you have an acceptable use policy? I'm assuming you do. You know, it's kind of required, but some people may not. Has it been updated? Has it been refreshed? Does it address social media? What's allowed? What's not allowed? And again, you know, it's on a personal device versus a state-owned device or a city-owned device. You know, you might have different policies in there, but is there, you know, a secure area on that device? How is data separated? Those kinds of things. So, I mean, start with, you know, updating your acceptable use policy. There's some really good model policies out there. I know, you know, a number of different organizations have put out, MS-ISAC and others, you know, some model acceptable use policies. Different states, you look at your partners and see what do they allow, what do they not allow. I think updating that would certainly be the first step. But taking a good look at the protections and the security you have around those smartphones, do you have protections around those apps in the first place? And what protections are they? Do they need to be updated? I mean, those are good places to start.

So kind of looking at the landscape, I know there's like the looming conversation, as you mentioned, on the federal government and whether or not they're going to step in. But as you mentioned at the beginning, states—

Oh, we lost him.

Well, where Dustin was going—

There we go. I'm back. So states are banning it. You've got, you know, maybe I invoked too many buzzwords and got blocked by the apps themselves. But, you know, you've got states banning it. You've got, you know, some other agencies that are banning it as well. What are you seeing at the city level? I mean, is this something that's popping up on the policy radar of cities? Are they looking at, you know, enacting their own bans? Is this something they should even be thinking about, or should they just wait for the federal government?

Yeah, I think, you know, if you haven't already done it, I mean, my honest advice, I mean, certainly you should be thinking about it, but I mean, As far as doing actions, I foresee, and this is kind of unprecedented, guys. I mean, the federal action on TikTok. I mean, obviously we have seen Huawei, we have seen Kaspersky. So yeah, but I mean, on a social media app like this, it is so popular and is used by so many millions of Americans. I mean, I think most cities probably should wait and see what happens here. I think the feds are moving pretty quickly. I think there's a laundry list, and when we talk at the end about where people can go to get more information, there's a laundry list of university systems that have banned this, oftentimes in conjunction with state law, right? Because the states have banned it and they're getting money, and so they're following the state guidance. I was looking for some cities that have gone alone on this, independent of a state mandate or a state ban. And, you know, it's certainly— they're probably out there. I, you know, I'm not familiar with any that are right now in that decision-making tree. I foresee the time coming where they do need to take a look at this, especially if you're thinking about, you know, what if the feds don't ban TikTok? And, or they say, you know, I know that they want protections in place or assurances, or maybe the data is going to be housed in, you know, in Texas or something and not Singapore, somewhere where it's under US domain. I mean, could there be a deal cut? I still think that's possible. And that's certainly some people who believe that this is just giving leverage to the White House to negotiate with TikTok and with China over this kind of a thing. So the bottom line is, I do think states and cities, all of them are going to really be facing this, the ones that haven't taken action. I think I foresee over the next few months that people are going to kind of sit back and see what happens here. Probably by the summer timeframe, you're going to have something go one way or another with the federal legislation moving and/or steps by the Commerce Department to ban TikTok. I foresee this taking a few more months, but certainly I think states do need to be looking at it if you haven't done that yet. And cities, same thing, especially if you've got a lot of— if you're LA County, they're bigger than some states, right? If you got a lot of users, you need to be thinking about this and what your acceptable use policy is.

You have to think, you mentioned earlier a bunch of angry teenagers, but you have to wonder what banning TikTok might mean to the youth vote coming up on elections and the impact that that might have. Yeah, good point.

I think it's interesting too how this dialogue, I just throw this in here as an aside. People say, well, why? Beyond this, obviously, there's data concerns, there's privacy concerns, there's issues around sensitive data getting in the wrong hands and knowing all that about Americans. I think there's a whole nother camp, which is where some of the divisions are even in America, like how bad is this for us? And there's a lot of people that write about that TikTok is addictive and it's short videos that are fun and people like them. But the ByteDance app in China is very, very different. It's much more educational. You're learning about science and you're learning about math. And it's like, it's a very, very different environment. And they don't even allow the version of TikTok we have in America to be used in China. So it's kind of interesting to see, you know, kind of what we get or what the West is getting versus what is being used in China. So there is a whole nother discussion, which is maybe a whole nother debate, if you will, about, you know, is it good for you or not to even use TikTok? even if it's not banned? And that's a whole nother set of questions. But I think that does open up a can of worms. If you start going down that road, then what other apps should be banned? And is it just about what's good for you, what's not good for you? Again, I think there's challenges if people start arguing over those points.

Well, I think now that you've kind of opened it up a little bit, I mean, do you think that states and localities should be thinking more broadly about social media data use privacy in general beyond TikTok? We've certainly seen a lot of conversation over the last few months around Twitter and it's with Elon Musk at the helm, and that's changed some perspectives of that platform. But what do you think about it more broadly?

I mean, the simple answer is, of course. I mean, and I think there's a debate, there's a lot of debates out there. They, you know, without getting into politics, I try and, you know, as you guys know, I'm a cybersecurity guy and cybersecurity tends to be bipartisan. And nobody wants to get hacked, right? Nobody wants your data stolen. So when you start getting into which states left-right divide, conservative Republicans or liberal Democrats or whatever, and their views on some of these topics, you're gonna get a whole range of different opinions around Twitter, around even the use of different types of apps that are out there and free speech. the views on free speech, the views on— there's a bill that was just released in Florida that the governor says he's not even for, about what people will have to report if they even blog and those kinds of things. So, I mean, I think clearly this is an issue that, sad to say it, the lawyers will get involved in it, right? I mean, you've got lots of lawyers and there's different opinions from different perspectives, political perspectives. different perspectives of the elected leadership in different states and different cities and counties. So absolutely, social media is very, very important. It certainly affects elections. It affects how people campaign. It certainly is also something I'll tell you in the cybersecurity world, we say right and left, is that whenever there's hacktivism is one of the big trends for our predictions this year. And as there are different types of social disruptions, different types of protests and different types of march on the Capitol for whatever reason, inevitably those things are going to be amplified by social media. So people want to get the word out. We have 25 people, we're marching on the Capitol, and then they want to get their word out to people, whatever the number is. So whatever the topic is, people are trying to amplify So I know it's something that, you know, it could be a good thing. I mean, obviously it's free speech. We have a free platform, but then balancing that with, okay, protections and when does it become hate speech and those kinds of discussions, you know, we'll leave that for others and another day. But I certainly think that we're not— we're gonna be talking about social media and next generation social media for the next decade because this question is not going away.

Yeah, it's definitely a great area. And so, you know, we saw like the RESTRICT Act that was, you know, put forth, as you mentioned. But, you know, do you see the federal government playing an increasingly important role here as you think about just data management, privacy, and some of these, you know, policy rules? You know, you've got in the European Union GDPR, and there's very concrete data protection and privacy laws. Does the federal government have a role to kind of do that here?

I think, I think they do. And I think it's going to continue to grow. I mean, it'll be interesting to see how far they can go in a, you know, split Congress with Republicans in the House and the Democrats, of course, controlling the Senate, White House being a Democrat, you know, Biden administration. Yeah, it's, you know, just look at in the last 2 weeks, you've got— we just had a big blog on this. We'll put my blog website up there. You can read about the new national strategy released by the Biden administration. And there's a lot of discussion in there around regulation, around obviously critical infrastructure. And we already have some regulations about reporting of incidents and things with things like banks and financial institutions, energy, transportation. Obviously, you can expect that in rail and also airports and things like that. planes. But going into more sectors, talking about more regulation, more reporting, more controls that are expected, and then more— a lot of discussion in there around liability and the role that businesses have to play in this. In there, they say quite a few times that it's going to be a big challenge to get there, but it's not fair for the end user and small companies or small governments to have to defend themselves against nation states. And so more of this responsibility needs to be borne by the federal government, but also more of it needs to be borne by big tech companies. And so they're talking about liability, tort reform, cyber insurance reform, a whole series of recommendations in there that I think will shift the landscape over the next few years. Will all of that get implemented? Probably not. Some of that's going to require some acts of Congress. Will some of that stall? I'm sure it will. Some of it will absolutely happen by either executive order or by rules. So I foresee definitely more of a federal role in all of this over the coming years.

So we've all been focused on TikTok. The media is focusing in and centering on TikTok. But are there other nation-state threats that may not be as viral or as attention-getting as TikTok that state and local agencies should be aware of?

You know, you guys, I have to let the audience know, you told me that question in advance, and I, I don't think there's anything on the horizon that I see. I'm gonna give you kind of a paradoxical answer to this. Um, I, I don't see anything on the horizon like TikTok. I mean, this is the 10-ton gorilla, and this is the one that everyone's talking about, the one that all of our kids, you know, use, um, the ones that, that's so popular out there, and everyone is thinking, please don't ban this. Um, you know, Dad, why are they doing this? It's gonna make all those security guys more like the Dr. No, right? Back to the answer, you know, the answer is no, what was the question? And this is gonna be TikTok now. So, um, you know, I, I don't see anything like that. What I do— what I will say, Joe, to answer you, is I do think there will be something coming down the, you know, pike. I mean, there will be others, and I think that's really really wise for this bipartisan legislation that's coming out is saying it's not just about one app or even, you know, 3 or 4. There's going to be others. There will be other things that come out. And the view is this, you know, if it's coming from one of these 6 nations, we have the process now to ban that. So I can't name any others. I saw a couple that I won't even want to name them because I just don't think they're even On a scale from 1 to 10, if TikTok's a 10, it's like a 2. I mean, is this really— there's nothing even in the same league right now that I'm seeing. But again, technology that comes from different locations, I think, will be a challenge. And certainly, I think this is going to be also interesting, Joe, to see how this plays in the whole relationship with China, with Russia, and the United States and what's going on. Who knows what's going to happen with over the next 12 months or 24 months with cyberattacks and different things with those nations. So, I mean, I think as this escalates, hopefully it doesn't escalate. Hopefully we get it resolved. But if it escalates, there could be more tension and there could be more examples that come forward.

So outside of our audience mirroring your morning treadmill news aggregation exercise, what's the best way for them to keep up with this you know, developing and kind of constantly developing situation and, you know, more importantly, how their peers are responding to it.

Yeah, they gotta listen to Dustin and Joe. You guys cover all the hot news in case you missed it. Keep coming back here on Friday afternoons Eastern time at 3 o'clock. Yeah, so it's, you know, it's funny. This is not one that's easily like we have ransomware, you know, go to a website, nomoreransomware.com, and unless There's not a, you know, goherefortiktok.com yet. So there's a business opportunity for somebody, you know, but there's a number of different, um, you know, right here at, you know, govtech.com and my blog, you guys will show that. But, you know, we're going to keep covering, we're going to keep covering this. Um, honestly, that if you want hot off the press news, um, I would really, you know, you type and talk about the simplest way, guys, is probably not very sophisticated, but TikTok bans a Google search. and click on the news button and you're going to get the latest because this is pretty hot. It's breaking, it's changing literally daily. Each and every day there's something new coming out. It's getting a lot of business coverage. It's also getting a lot of coverage from the CNNs of the world and Fox News and those kinds of organizations as well. So it is an ongoing— there's not any one place you can go to to get the latest on this topic. But except for listening to you guys, unless you know something, Dustin and Joe, I'd love to know if you've got one website that's kind of keeping everybody up to date on this. But, you know, Google News is as good as anything right now.

Yeah, you know, GovTech will continue covering it, and we'll have to figure out a way to get a webcam on you in the morning. We can follow your routine.

I think you're right. I mean, it's moving, it's moving quickly. I mean, from when we started, what we thought we'd be talking about to where we found ourselves today, it evolved just there. But Dan, we thank you again for coming on and continually sharing your expertise with our audience. As we look forward to next week, we will have a couple guests on to talk about the Center for Digital Government's latest piece of work on cloud and everything as a service best practices procurement guide. So join us next Friday. Until then, have a great day. Have a wonderful weekend.