Two days before Christmas, TikTok contacted London-based journalist Cristina Criddle to inform her that four of its employees—two in China and two in the US—had viewed user data from her personal account without her knowledge or consent. Criddle, a Financial Times technology correspondent, described the incident as "really chilling and horrible" and a "personal violation."
TikTok confirmed that members of its internal audit department accessed the IP address of Criddle's device and compared it with staff IP data to identify who was secretly meeting with the press. The company stated the employees "misused their authority" and acted without authorisation. Criddle does not know how long she was tracked, but it occurred last summer, potentially monitoring her location 24/7 during personal time.
Criddle's TikTok account was registered under her cat's name, Buffy, with about 170 followers and 20 videos of the cat over three years. Her real name and profession were not in the bio. TikTok and its parent company, ByteDance, have consistently denied accessing Western user data in China, but the staff responsible for the breach were fired. ByteDance said it "deeply regrets" the incident, calling it a "significant violation" of its code of conduct.
Criddle had been speaking to TikTok staff unhappy with company practices, though TikTok said the data breach failed to identify her sources. The breach may have violated the EU's General Data Protection Regulation (GDPR), which requires active user consent for data use. Cyber-security expert Prof Alan Woodward from Surrey University noted that the tracking "cannot be described as accidental or even incidental," as someone had to extra-dig to link the cat account to Criddle.
Criddle now keeps her TikTok account on a dummy handset at her workplace and has curtailed her own and her cat's social-media use. She emphasised the need for digital safety, adding, "I have to make sure that my sources are aware of the possible challenges to their safety." TikTok remains wildly popular globally with over 3.5 billion downloads, despite facing survival battles in the US and restricted access on official devices in several countries.
