Trump's ban on WeChat and TikTok lacks clarity and will not solve our data security problems
President Trump declared on August 6 that the use of the Chinese mobile phone applications TikTok and WeChat on American soil is a national emergency. His executive orders ban Americans from engaging in an as yet undefined set of transactions with the parent companies of these apps. Rumors have been swirling for weeks that the Trump administration would ban the use of these two prominent Chinese apps in the United States, but these new measures could have far more impact, including extending to usage of these apps outside US borders.
Chinese apps and national security
TikTok and WeChat are two of the most successful Chinese apps. WeChat is a "super app" that has become a necessity for daily life in China, combining messaging, social media, news, transport, payments, and more into one powerful application used by well over a billion people. Attempts to gain users abroad, however, have foundered outside the Chinese diaspora. TikTok is a short video app specially designed for the market outside China. It has become the first Chinese app to take off abroad, with hundreds of millions of users all over the world, thanks to a powerful algorithm. In fact, Chinese authorities banned TikTok from the start because it is not subject to the same censorship and other controls as its domestic counterpart Douyin. Blocking apps is par for the course for China, which has long used its "great firewall" and an extensive censorship apparatus to block foreign apps and websites—like Facebook, Twitter, and Google—and much more.
TikTok expanded into the United States when its owner ByteDance purchased US-based lip-synching app Musical.ly in 2017, which it then merged into TikTok. ByteDance did not clear the purchase with the Committee on Foreign Investment in the United States (CFIUS), the US government body that reviews foreign investments for national security threats. With some justification, Bytedance probably thought that acquiring an app mostly used by teenagers to make lip-synch videos was unlikely to be worth reporting. However, even if it would have sailed through a review back then, its lack of reporting left it vulnerable to forced divestment when security concerns grew over its subsequent growth—its use spreading even to US military recruiters—and revelations about its privacy practices, misinformation, and censorship. The US government has ordered ByteDance to divest TikTok's US business, and Microsoft is now in talks to acquire some of TikTok's businesses.
TikTok's success abroad was bound to run into two major headwinds: a hawkish shift to rethink the US relationship with China, especially with regard to technology and security, and a global awakening of the problems that can come with big tech platforms, such as data privacy, misinformation, and surveillance. These concerns, and probably some protectionism, were behind India's recent move to block a wide variety of Chinese apps. All tech platforms are facing more scrutiny today, but those with Chinese owners pose more complex questions, such as what access the Chinese Communist Party has to sensitive data gathered on foreign users or to what extent it could order apps to extend censorship and misinformation outside its borders. These are thorny questions beyond the scope of this post.1
Trump's executive orders
The executive order issued August 6 sets a 45-day deadline after which "any transaction that is related to WeChat by any person…subject to the jurisdiction of the United States, with Tencent…or any subsidiary" is banned; a second executive order the same day similarly bans ByteDance—and by extension, TikTok. After an initial panic in the online gaming market, where Tencent, the multinational conglomerate that developed WeChat, is one of the world's largest investors, the administration quickly clarified that Tencent investees outside of WeChat are not part of the order. The scope of "transaction" is yet to be defined.
Impact of the executive orders is unclear
Much of the orders' impact and scope remain unclear because they do not cite or appear to fit under pre-existing economic policy tools like export controls and sanctions that have established laws, regulations, definitions, and precedents to provide predictability. Instead, they declare an ad hoc emergency and cite another executive order on securing the information and communications technology supply chain, one that I have criticized as providing overly wide latitude to the executive branch. The orders use language similar to what is used in financial sanctions imposed on regimes like North Korea, banning American companies and citizens from just about any business transactions with the sanctioned entity, and going far beyond the export restrictions placed on entities like the telecommunications giant Huawei that have been put on the "entity list," a blacklist that forbids exports of US goods to entities the United States deems a threat to security or foreign policy.
Both orders will probably force ByteDance and WeChat to be removed from Apple and Google's US app stores, but repercussions are unlikely to end there. Apple and Google's app stores outside the United States might be exempt from action if they are run by non-US subsidiaries, but they would face a serious compliance burden because US citizens would need to be blocked from any "transactions" involving WeChat or Bytedance that fall within the scope of the order. Since the rules as written apply to anyone in the United States and to US citizens or permanent residents everywhere, a Chinese tourist in San Francisco or an American student in Beijing adding money to their WeChat digital wallet could be in legal trouble for violating the order. If the WeChat ban stands, its impact will fall the hardest on those with family in China who rely on WeChat to communicate. Most Western app alternatives are blocked in China, and email and other methods are no substitute for the group chats that have become a staple of life in China.
The executive order on TikTok in a way duplicates a US government order to divest TikTok's US business that ByteDance has already agreed to comply with. The executive order's ban on dealing with ByteDance would seem to complicate rather than facilitate the earlier deal by adding legal risk to the acquiror, which surely will require many transactions with ByteDance into the future to disentangle and settle a multibillion-dollar investment.
Worryingly, the orders signal a US government embrace of a vision for the internet that more resembles Beijing's vision of closed-off cyber sovereignty than the longstanding US tradition of championing an open internet. Any direct security gain from banning Chinese apps must be considered in that context. While the orders are aimed at China today, one of the long-term losers could well end up being US technology companies that today dominate the global market. US bans on foreign apps could provide cover to other countries to spin up their own national security justification to ban what are to them foreign apps—from US companies like Facebook and Google. This possible scenario has led even Mark Zuckerberg, who heads TikTok's main competitor Facebook, to call such a ban "a really bad long-term precedent."
As Samm Sacks, a cybersecurity policy expert at the think tank New America, has persuasively argued, real and pressing security concerns around data and privacy cannot be solved with ad hoc bans on apps based on their parent company's origin. Right now, it is too easy for anyone, even foreign governments, to buy or hack sensitive data on American citizens without harvesting it directly from apps or by buying up companies. Rather, the US government needs its own robust data protection regime to protect citizens' privacy and national security.