The Battle for TikTok and the CFIUS

Under pressure from the U.S. government, TikTok is now facing the music with the possibility of a nationwide ban if it defies a government order to sell to an American company, unless the popular social media app can convince a high-powered panel that its data security restructuring plan sufficiently guards against national security concerns.

At the heart of this social media business and national security drama is the increasingly tense relations between the U.S. and China. The video-sharing platform with 150 million U.S. users is best known for quick snippets of viral dance routines and has been under scrutiny for years by federal authorities who say that its Chinese parent company, ByteDance, could share sensitive user data with the Chinese government, or push propaganda and misinformation on its behalf. Having already banned the shipment of certain technologies to China, and recently passing new legislation banning the app on government devices, lawmakers want to pursue a nationwide ban on the app if the tech firm can't be sold to an American buyer.

Enter: The Committee on Foreign Investment in the United States. The little-known but potentially potent government agency known as CFIUS is tasked with investigating corporate deals for national security concerns and holds power to force the company to change.

Why is CFIUS scrutinizing TikTok? For at least two years, the U.S. government has tried to force TikTok ownership to divest from its Chinese parent company, ByteDance, though CFIUS' review of the social media app goes back at least to 2019. Former Treasury Secretary Steve Mnuchin confirmed in 2020 that CFIUS was reviewing whether then-President Donald Trump could ban TikTok in the U.S. Its members agreed that TikTok cannot operate in the U.S. in its current form because it "risks sending back information on 100 million Americans," Mnuchin said at the time.

As geopolitical tensions between China and the U.S. have soared in recent months, TikTok CEO Shou Zi Chew testified last week before the House Energy and Commerce Committee. He was grilled about online safety and user privacy in a hostile hearing that did little to ease lawmakers' concerns. Chew was repeatedly questioned about the Chinese Communist Party's influence on ByteDance but deflected. "TikTok is not available in mainland China, and today we're headquartered in Los Angeles and Singapore, but I'm not saying that the founders of ByteDance are not Chinese, nor am I saying that we don't make use of Chinese employees, just like many other companies around the world," he added. "We do use their expertise on some engineering projects."

Treasury Secretary Janet Yellen oversees CFIUS, a committee made up of members from the State, Justice, Energy and Commerce Departments among others, which investigates national security risks from foreign investments in American firms. The committee screens business deals between U.S. firms and foreign investors and can block sales or force parties to change the terms of an agreement for the purpose of protecting national security.

The committee's powers were significantly expanded in 2018 through an act of Congress called the Foreign Investment Risk Review Modernization Act, known as FIRRMA. In September, President Joe Biden issued an executive order that expands the factors that the committee should consider when reviewing deals - such as how the deal impacts the U.S. supply chain or risks to Americans' sensitive personal data.

Defying CFIUS' orders to sell ultimately could mean doing business with the company may violate the law. That would suck the life out of its business operations, such as banking, payroll, advertising, and app store services. But the company said it's already mitigating national security concerns with a $1.5 billion mitigation plan called Project Texas that would route all U.S. user data to servers owned and maintained by the U.S. software giant Oracle. "When that process is complete, all protected U.S. data will be under the protection of U.S. law and under the control of the U.S.-led security team. Under this structure, there is no way for the Chinese government to access it or compel access to it," Chew said.

While CFIUS can adopt such mitigation agreements, it's not clear if the committee will accept TikTok's proposed alternative, said Anupam Chander, a Georgetown University technology law professor. If CFIUS rejects TikTok's preferred solution, Chander said the federal agency should have an obligation to explain how it finds that plan to be insufficient given that it amounts to an enormous restructuring of the company. "TikTok proposes lots of well-paid, third-party auditors that would be doing this kind of routine monitoring," Chander said. "This is an expensive proposition for TikTok but by no means would I treat this as window dressing."

Though Chew last week also insisted that the company was not interested in a sale, TikTok has considered it before. TikTok had advanced negotiations with Microsoft after the company was put against the wall by the Trump administration in 2020, facing either an outright ban and CFIUS' divestment order. Microsoft said TikTok ultimately rejected their offer, and though TikTok later said it would sell to Oracle and Walmart, it doesn't appear that Project Texas amounts to a sale, Chander said.

Should TikTok agree to a sale in the future, not only would CFIUS have to approve that transaction, but the Chinese government - which has said it won't support forced divestment - could also intervene.

So what's next? Leaders in the U.S., European Union, Canada, New Zealand, Norway and Taiwan have also banned TikTok on government-issued devices and at least two countries have banned TikTok outright. Afghanistan's Taliban leadership last year banned it on the grounds of protecting young people from "being misled," while India imposed a nationwide ban on TikTok and dozens of other Chinese apps in 2020 over privacy and security concerns. The ban came shortly after a clash between Indian and Chinese troops at a disputed Himalayan border killed 20 Indian soldiers and injured dozens.

Historically, CFIUS has focused on things like shipping and manufacturing when reviewing transactions for national security concerns, but it signaled deeper interest in popular social media when it ordered the dating app Grindr to divest in 2019, Chander said. The function of CFIUS was also in the spotlight last year after billionaire Elon Musk bought Twitter, plunging the microblogging platform into chaos. Yellen waffled on whether or not CFIUS would or could review that sale, given Musk's investments in China as well as significant Saudi interest.