TikTok admits employees spied on journalists during covert internal investigation

TikTok’s parent company ByteDance has admitted it accessed the data – including the location – of some journalists as part of an internal investigation into the source of separate leaks of user information.

The Chinese company was carrying out an inquiry into how data belonging to US users became accessible in China. As part of the investigation, ByteDance employees tracked multiple journalists covering the company, accessing their locations to see if they had been in the same area as ByteDance employees, the company said.

The journalists included reporters from Forbes, Buzzfeed and the Financial Times among others, according to reports published by the newspapers.

ByteDance admitted “misconduct” and fired Chris Lepitak, its chief internal auditor, who had led the team responsible for the investigation, according to Forbes, which first reported the story.

“The misconduct of certain individuals, who are no longer employed at ByteDance, was an egregious misuse of their authority to obtain access to user data,” TikTok spokesperson Hilary McQuaide was quoted as saying. “This misbehavior is unacceptable, and not in line with our efforts across TikTok to earn the trust of our users.”

“I was deeply disappointed when I was notified of the situation ... and I’m sure you feel the same,” ByteDance CEO Liang Rubo wrote in an internal email. “The public trust that we have spent huge efforts building is going to be significantly undermined by the misconduct of a few individuals ... I believe this situation will serve as a lesson to us all.”

The investigation, internally dubbed Project Raven, began after a series of revelations published by the US media about TikTok data being accessible by employees of the platform’s parent company in China. This led to widespread speculation about the misuse of data by the Chinese government.

TikTok has repeatedly denied that its data can be accessed or misused in China.

However, in order to get to the bottom of the leaks, ByteDance employees accessed the user data of journalists. Two members of staff in the US and two in China gained access to the IP addresses and other personal data of FT journalist Cristina Criddle, the newspaper reported.