DEFENSE/Experts warn of national security risks from Chinese apps

Taipei, Aug. 12 (CNA) Chinese apps are a potential national security risk because of China's authoritarian political system, according to two experts from the Institute for National Defense and Security Research (INDSR).

"Information security risks are national security risks," said Tzeng Yi-suo (曾怡碩), an associate research fellow at INDSR's Division of Cyber Security and Decision-making Simulation.

"As long as the app is under the jurisdiction of the Chinese government, there will basically be security concerns," he explained.

Tzeng told CNA that commercial companies collect data about app users and then use algorithms to tailor relevant information and marketing.

This is not a problem in a democratic country governed by the rule of law such as Taiwan, the cyber-security expert said, because if the information involves judicial cases, the government will need to go through certain legal procedures to obtain the information.

However, the National Intelligence Law of the People's Republic of China and the Law of the People's Republic of China on Guarding State Secrets empower Chinese government agencies to require platform service providers to hand over users' data "as long as they determine that national security is involved," Tzeng said.

"How the Chinese government obtains the data and what they will do with it is not transparent," the security expert added.

In areas under China's authoritarian control, including Hong Kong and Macau, China "can assert its sovereignty" and "investigate the words and actions of users" through data collected by Chinese apps, said Tzeng.

In places outside of its jurisdiction, "China's authoritarian system" still poses risks to users, according to Lee Jyun-yi (李俊毅), an associate research fellow at INDSR's Division of National Security Research.

Lee cited the U.S. court testimony of former employees of ByteDance, TikTok's parent company, as evidence that "TikTok does indeed transmit users' personal information back to China."

In addition to the security of personal data, Chinese apps such as Douyin and TikTok pose risks relating to the spread of false information, according to Lee.

Lee told CNA that although misleading information is not limited to Chinese apps, popular Western platforms such as Facebook, Instagram and YouTube have adopted new methods to crack down on bot accounts and mark state-funded media.

"TikTok's lack of effort to do so makes it relatively easy for false information to spread," the expert said.

Lee also believes that Chinese apps may "shape users' perceptions" through algorithms.

Up to 40 percent of popular videos come from accounts controlled by the Chinese government, he noted.

"The Chinese government has legislated to require media platforms' algorithm recommendation models to comply with the values of the Chinese Communist Party," the security expert told CNA.

Taking Douyin as an example, Lee said that the platform promotes content that is "beneficial to China" and the Chinese government requires the platform to self-censor.

According to the scholar, this makes it "difficult for short videos that are negative or critical of China to appear or spread, which has a long-term effect in shaping people's perceptions."

The two security experts are not alone in their concerns over Chinese apps such as TikTok.

In March, Taiwan's Minister of Digital Affairs Audrey Tang (唐鳳) said that TikTok had been classified as a "dangerous product." The use of the app is banned in government agencies and on their premises in Taiwan.

In April, U.S. President Joe Biden signed into law a bill titled Protecting Americans from Foreign Adversary Controlled Applications Act which required ByteDance to divest its U.S. assets or face a nationwide ban. The earliest such a ban could go into effect would be Jan. 19, 2025.

India completely banned TikTok in June 2020, while countries including Australia, the United Kingdom, France, the Netherlands, Norway, Belgium, Denmark, Canada and New Zealand have separately imposed rules limiting certain workers from using the app due to cyber-security concerns.