Cybersecurity experts respond to Executive Order banning TikTok on government devices

RALEIGH, N.C. (WTVD) -- Cybersecurity experts are weighing on Thursday's announcement from Governor Cooper, in which he signed an Executive Order prohibiting the use of TikTok and WeChat on government-issued social media devices.

"Not surprising. We've heard this for quite some time now. We've heard this not only at the federal level, but also at the state level, a number of states taking this kind of action. And honestly this is something that has been in the news for quite a while. The (Trump) administration talked about it quite a bit," explained Dr. Jimmie Lenz, who serves as Master of Engineering in Cybersecurity at the Pratt School of Engineering at Duke.

"I think it's a fantastic step forward in the right direction. I see no value or importance or purpose to have that application on a government device. I also find concern around non-federal organizations or corporations that may have secrets or intellectual property," said Craig Petronella, CEO of Raleigh-based Petronella Technology Group. "I think that they should adopt similar policies, procedures and controls to prohibit. There's just no reason in my opinion why an employee should be using that app in a commercial environment."

TikTok is owned by ByteDance while WeChat is owned by Tencent, both of which are Chinese companies. Government officials and security analysts have expressed worries over the ability of Chinese government officials to access and use data collected through the apps.

"How many people actually read the update before they click 'accept'? You don't actually know sometimes what's going on. But I think social media sites, in particular like TikTok, are actually a little bit different because just the nature of those you're giving access to your camera and you're giving access to your microphone," added Lenz. Think - even if I don't have to turn on the camera, if I could remotely access a microphone of a government employee or maybe it's a bank employee and listen in on confidential meetings. That could do a lot of harm."

"Because they are an adversary, we don't know what they could be doing with the data," added Laura Rodgers, Director of Cybersecurity Practice at NC State.

Thursday's Executive Order was welcomed with bipartisan support and came about two weeks after Republican lawmakers Rep. Jason Saine and Rep. Jon Hardister co-wrote a letter to Governor Cooper, urging him to take this action.

"It stands to reason the Chinese government could use TikTok as an avenue to access information on a device. If you're talking about a government device which has information which should be kept private, that's when you have a problem," Hardister said.

Hardister applauded the Governor's move, though added the onus is now on legislators to advance the measures.

"The legislature in concert with the Governor, with cybersecurity experts, will have to examine ways to enact laws and statutes to create a permanent solution. And we have to stay on top of it. We have to make sure we have a cybersecurity task force," said Hardister.

The Executive Order will have no impact on privately held devices, and Hardister added there's no interest in pursuing legislation to that effect.

Despite security concerns, TikTok has become increasingly popular amongst teens and young adults. An August 2022 report from Pew Research found that 2/3 of 13-17 year olds said they used the app, a figure higher than any other social media app or website besides YouTube. Globally, the app boasts more than a billion active monthly users.

"TikTok is not a necessity. It's not food, it's not water, it's not shelter, it's not clothing. It isn't a necessity. So why take that risk? That's what I've told my family," Rodgers said.

Lenz disputed the notion that data for youth is not valuable, pointing to long-term implications.

"Younger people do have a lot of information that is very valuable, and as they become older, they carry the same phone with them, you're going to have those compounded," said Lenz.

"Most parents don't understand the depth of reaching capabilities of the application as far as privacy is concerned, and not just for TikTok either. There could be other apps that are being used that have similar capabilities. I think the concern specifically with TikTok is the reach and it's outside of the United States, there's not a lot of control or regulatory compliance to restrict or place restriction," said Petronella.

Besides data collection, there are also content considerations, specifically the ability to manipulate algorithms regarding what content is made available to users. It's a point previously brought up by FBI Director Christopher Wray, who delivered remarks to that effect during an event last month at the University of Michigan.

"If any government or any company honestly can influence something in a somewhat covert way, I think that's something to be worried about," Lenz said.

In a statement to ABC11, a TikTok spokesperson highlighted its work in addressing security concerns, writing:

"We're disappointed that so many states are jumping on the political bandwagon to enact policies that will do nothing to advance cybersecurity in their states and are based on unfounded falsehoods about TikTok. TikTok is loved by millions of Americans, and it is unfortunate that the many state agencies, offices, universities, student groups, and sports teams in those states will no longer be able to use TikTok to build communities and share information.

We are continuing to work with the federal government to finalize a solution that will meaningfully address any security concerns that have been raised at the federal and state level. These plans have been developed under the oversight of our country's top national security agencies-plans that we are well underway in implementing-to further secure our platform in the United States, and we will continue to brief lawmakers on them."