In the future, it might be a new mobile game or an algorithm helping students study at home. It could be the latest graphics card or exercise bike, or an app that pairs families with puppies. With fewer and fewer aspects of life going untouched by technology, it could be practically anything. Right now, it's TikTok, with its billions of users worldwide.
US Senator Mark Warner (D-Virginia) wants the United States armed with the ability to take swift action against technology companies suspected of cavorting with foreign governments and spies, to effectively vanish their products from shelves and app stores when the threat they pose gets too big to ignore. His new bill, the Restrict Act, would give that responsibility to the US commerce secretary, charging their office with reviewing and, under certain conditions, banning technologies flagged by US intelligence as a credible threat to US national security. Though the technology's owners and manufacturers would have every right to dispute any outcome in court if the Restrict Act becomes law, it is nevertheless an enormous authority to bestow—one with boundless implications for America's competitors overseas.
The thought that such decisions could be wildly unpopular at home or elicit misgivings from global allies has not escaped Warner. Without sufficient transparency around the process, the government's moves could result in chaos. Warner says the intelligence community should be held to account for the decisions it influences, providing not only to Americans but also the world the information it needs to understand how and why this new power is being used. He knows it may not always be at liberty to do so.
TikTok's ties to China have more or less spooked authorities in several countries, with numerous officials in the US alone claiming to have spoken directly with whistleblowers who offered tales about abuses of personal data. Today, the United Kingdom joined several other nations, including the US, in banning the app across all government devices.
The British, like their American, Belgian, and Canadian counterparts, are fearful that the app may offer Beijing's intelligence agencies the ability to track key officials' movements and intercept the sensitive information they keep. Other countries already have laws to accomplish what Warner is seeking to do. In 2020, for instance, India's ministry of electronics banned TikTok entirely, citing authority intended to safeguard the “safety and sovereignty of Indian cyberspace.”
The Restrict Act's future is unknown, but it's gathered considerable bipartisan support in Congress, and there are very few reasons for America's tech giants to get in the way. To understand more about Warner's position on security, invasive tech, and privacy concerns that hit closer to home, WIRED spoke with the Virginia Democrat this week. Our conversation has been edited for length and clarity.
WIRED: Tell us about the Restrict Act and its purpose.
Mark Warner: Over the past few years, we've seen challenges coming from foreign-based technology. Originally it was Kaspersky, a Russian software company, then it was Huawei, a Chinese telecom provider, and more recently, the discussion has been about this Chinese-owned social media app, TikTok. We seem to have a whack-a-mole approach to foreign-based technology, and I think instead we need a comprehensive rules-based approach that recognizes national security is no longer simply tanks and guns, but is really a question about technology and technology competition. In the case of Kaspersky, it was software that kept getting updated from Moscow, and with Huawei, it was a way for the Communist Party in China to listen in. In the case of TikTok, it's the enormous amounts of data being collected that potentially could end up in China or, given the fact that a hundred million Americans a day are using it an average 90 minutes a day, it could be an enormous propaganda tool. Let me be clear: Because China changed its law in 2016 to make sure that, at the end of the day, every company's ultimate master is the Communist Party of China. It's not the shareholders, it's not the employees, it's sure not the customers. And this is a national security risk.
The Restrict Act says, let's look at six countries that have been designated as potential adversaries—China, Russia, North Korea, Iran, Cuba, and Venezuela—and provide the commerce secretary the tools needed to mitigate, including forcing a company to sell off its assets, up to the point of banning. And I'm glad we have broad bipartisan support and, hopefully, we'll see this bill enacted.
I think a lot of Americans have become skeptical when the government uses “national security” as an explanation. It’s basically a TV trope at this point.
I understand that. It's one of the reasons we've also said in this legislation that the intelligence community needs to declassify as much information as possible to help make the case. For instance, initially with Huawei, we didn't do that, and it took years, and now we're spending taxpayer money to rip out all the Huawei equipment. You've got country after country, including most of our allies saying, “Oh my gosh, there is a problem here,” and now taking it out. In the case of TikTok, this is not just the United States. You've already had Canada act. You've had the EU act, in terms of officials' phones. As matter of fact, Denmark over the weekend urged all its media people to remove TikTok. And India has done an outright ban. So I do think it is incumbent on the [US] government to declassify as much information as possible to help make the case that this is not some illusory threat.
Let's say the Restrict Act passes and, as an example, the CIA or the Federal Elections Commission discovers that a technology poses a threat to an upcoming election. How fast could the government respond under this law?
The goal here is to give the government the ability to move quickly. We do have other tools, but they're not comprehensive. The Federal Communications Commission, for example, under its authorities, found that China Telecom was a threat. But it could only prohibit, kind of, traditional telecom services. It had no ability to prohibit China Telecom's activities in the cloud or services being sold in the United States. The bill would give the government the ability to move quickly, but let me be clear: There are different levels and standards of scrutiny. Communications services, even if it's a foreign-based company—there are First Amendment rights. So what we've done is to try and say, let's make this rules-based. We think that will stand up in court. But also, expand the “communications” definition to include, you know, technologies that touch on artificial intelligence or quantum computing or synthetic biology, so that, if this bill becomes law, we have a framework to address not just the current challenge but future challenges as well.
Under the Restrict Act, would a threat posed by a rogue app endangering people's privacy, for example, be treated differently than a threat posed by foreign espionage?
The gateway here is that it has to be foreign-owned from one of these six countries. But it does not require a direct tie to a foreign spy service versus simply being a foreign-based company. In many of these countries, it's hard to discern that difference.
If a decision is made to crack down on an app or some other piece of technology, is it possible the government might choose not to tell us the reason why?
Well, remember, these apps, or technologies, they still have access to our judicial system. Matter of fact, what we're building on here is a Trump executive order that tried to do this, only it referenced a part of the law that had certain constraints. So we're creating a new set of authorities. Any of these foreign companies will still have access to the courts. And that's why we've said, let's set up a rules-based system that can stand up to judicial scrutiny, one that requires the intelligence community to declassify as much as possible. Now there may be certain things that won't get declassified. That's just the nature of sources and methods, but we think we've tried to strike the right balance here so people can understand why. You know, a few years back when there were efforts to get rid of Huawei, and there was just speculation. And frankly, there was great pushback from allies around the world. But as more of the information became clear, that pushback disappeared. If we'd been quicker on declassifying and making clear where the vulnerabilities and backdoors were, I think a lot of countries around the world would have probably made different telecom choices.
But let's take TikTok for a moment. TikTok is saying, “We’re going to protect American data.” Well, we've had constant reports from both whistleblowers inside of TikTok and others that that doesn't always prove to be the case. I know there's lots of questions around whether we're sure it can be used as a propaganda tool, or whether that's the way it's being used right now. Probably not, right now, but that potential is also something we have to guard against. And this is where some of the tension exists. When you're putting a restriction in place based on the potential of a bad thing happening, it's sometimes harder to make the case. One of the things you have to make clear—and I go back to the Huawei example—it's not like China, at that moment in time, was scanning all the telecom information. But the fact that you could be receiving dozens of updates a day, you could never put in place a full fail-safe system to ensure none of those updates included malicious code or backdoors.
The bill is not likely to be popular among influencers. There are a lot of American content creators on TikTok, and many have managed to devise a revenue stream from their popularity on the app.
Well, let me speak to that. My understanding—and I'm not an expert on influencer reimbursement—is that, actually, YouTube and some of the other platforms are, frankly, more lucrative for influencers. But I don't think this kind of social media app will disappear. I believe in the robustness of the competition system. People doing creative things on video. I'm all for it. It just needs to be done from a trusted source. And I'm not saying the videos themselves are being manipulated, but the types of videos being seen, I think the way that's being manipulated is a real concern. I don't have that concern as much if it's an app coming from a nation-state other than China. I might still have concerns as a father, but that doesn't morph into a national security concern.
Was there a specific event that really motivated you to go ahead with this bill?
Look, I've listened to TikTok's management. I've heard about the firewalls they've tried to build. They did not convince me. There are still constant reports of TikTok being potentially used to follow journalists. You continue to see these things where Chinese engineers are gaining access to American data, even though TikTok management says they're not. At the end of the day, you've got a hundred million Americans using TikTok on average 90 minutes a day. That's a powerful tool.
A former Bush speechwriter wrote about TikTok in The Washington Post recently. He said, "Americans would not tolerate their own government collecting so much sensitive information about them.” Last week, the FBI acknowledged that it had, in the past, purchased US location data rather than get a warrant to obtain it. What do you say to people more worried about their own government tracking them than one thousands of miles overseas?
That concerns me. I think the onus is on the FBI to ensure privacy is protected, and I do have concerns about some of the American-based companies, the Facebooks and Googles of the world. But they also enjoy First Amendment protections, and where I've tried to focus my activities, with regard to American companies, is on things like data portability and interoperability, so if you get tired of Facebook it's easier to transport yourself over to NewCo. Right now, it's really hard for new competitors to come into the space. Or dark patterns, things where there's manipulation. The old thing where apps only allow you to say “yes.” I think precluding dark patterns on American-based social media makes sense, and I've got bipartisan legislation on that. But it hasn't moved. I do think there is a different level of threat when the ultimate recipient, or manipulator, could be an authoritarian regime. I do think that raises the threat. But that doesn't mean there are no obligations on the FBI, and I think there should be obligations on American social media, and I think it's an embarrassment that we don't have a national privacy law.
