Social media platforms should be forced by the Canadian government to toughen their privacy practices, an expert told a parliamentary committee looking into illicit data harvesting by apps like China-based TikTok for foreign governments on Monday.
Ottawa banned federal employees in February from using TikTok on government-owned internet-connected devices following a similar ban in the U.S. in December 2022. Ottawa added a ban on using China-based WeChat in October.
“Despite being framed as a national security threat, to date there’s still no public evidence that the Chinese government has spied on Canadians using a backdoor or privileged access to the TikTok app,” Anatoliy Gruzd, Canada Research Chair in Privacy-Preserving Digital Technologies at Toronto Metropolitan University, told the House of Commons Ethics, Privacy and Access to Information Committee.
However, he added, “there are valid concerns regarding the potential for TikTok and other platforms to be exploited by malicious actors for propaganda and radicalization.”
For example, he said, according to a national survey his research lab released last year, half of Canadians reported encountering pro-Kremlin narratives on social media. And in August, Meta — which owns Facebook and WhatsApp — reported a sophisticated influence operation from China that spanned multiple platforms, including Facebook, Twitter, Telegram, and YouTube. The operation tried to impersonate E.U. and U.S. companies, public figures, and institutions, posting content that matched their identity before shifting to negative comments about Uyghur activists and critics of China, he said.
Therefore, Gruzd said, “we must take a comprehensive approach to address these issues by compelling platforms to commit to
— adopting the principles of privacy by design and by default;
— investing in expanding their trust and safety teams by partnering with fact-checking organizations and providing access to credible news content. “Unfortunately,” he said, “some platforms, like Meta and X, are doing the exact opposite;”
— and sharing their data with researchers and journalists. TikTok currently doesn’t provide data access to Canadian researchers but does offer it to those in the U.S. and Europe. “Sadly,” Gruzd said, “TikTok is not alone in this regard. X has recently shut down its free data access for researchers,”
It’s important to shift the focus from the responsibility of internet users to only share personal information online when necessary to one of developing strategies that compel social media companies to implement privacy by design and by default, Grudz said.
“Currently, it’s all too common for platforms to collect more data by default than necessary,” he said.
Parliament shouldn’t ban all Canadians from accessing an app, Gruzd added. That could lead to mistrust of Ottawa, legitimize censorship and create an environment for misinformation to thrive.
Last week, Cherie Henderson, an assistant deputy director of the Communications Security Establishment (CSE), which oversees the protection of federal communications, told the committee about foreign government use of social media. Much of her presentation was reflected in the annual National Cyber Security Threat Assessment released last October.
While Henderson said she worries about foreign interference here from Iran and North Korea, she saved her toughest words for Russia and the People’s Republic of China (PRC).
“Foreign state actors leverage all viable means to carry out their foreign interference activities, and social media platforms are ideal tools,” she said. “The Russian Federation and PRC exploit social media to spread disinformation, leveraging suggestive algorithms to amplify echo chambers and manipulating content for unsuspecting viewers.”
“The PRC uses its unfettered access to harvest data at a scale that outpaces every other country in the world combined, while fiercely protecting their own information. Emerging technologies, such as artificial intelligence, will only further enable their nefarious activities.”
“It is imperative that Canada builds resilience against foreign interference. This includes bolstering awareness of the PRC’s ability to harvest and use Canadians’ information obtained through social media to conduct foreign interference.”
Threat actors like social media platforms because of the data they generate and collect, she noted. Platforms run surveys, correlate data sets and request access to users’ personal data through terms and conditions, enabling access to users’ messages, photo albums and contact lists. Some of this data is benign in isolation, she said. But when collected and correlated on a massive scale it can provide detailed patterns and insights on populations, public opinion and individual networks.
As a result, Henderson said, Canadians should think carefully before sharing personal information on social media apps “especially when it is with foreign-owned companies” whose governments are not our allies.