The US Commerce Department published an online-security rule on Friday, aiming to provide a solid legal basis for its future moves against foreign-based apps, such as TikTok, that could threaten the country’s security interests.

The Biden administration likely still needs new legislation to further strengthen its legal position before taking any dramatic action against TikTok, such as banning it outright in the US.

Since lawmakers in Congress have been at odds over that issue, and any new administration could have different priorities, the new rule is truly just a first step.    

Security risks and apps

The regulatory action highlights a continued concern for the US government around mainly Chinese-based apps, such as TikTok, which is owned by Beijing-based ByteDance, that are widely used by US citizens.

The final rule amends the Securing the Information and Communications Technology Supply Chain (ICTS) regulations, which implemented a prior executive order, E.O. 14034.

The amendments provide additional criteria that the Secretary of Commerce may consider when determining whether ICTS transactions involving connected software applications present “undue or unacceptable risks.”

For example, instead of regulating entities that are “subject to coercion” by a foreign adversary, the new rule focuses on the “operation, management, maintenance, or service” of connected software applications by persons or entities “owned by, controlled by, or subject to the jurisdiction or direction of foreign adversaries.”

The final rule also adds definitions for “end-point computing devices” and “via the internet” to clarify the definition of connected software applications provided in a prior executive order.

It also specifically provides that the Commerce Secretary can evaluate not just classes of, but individual ICTS transactions, since such reviews may indicate or uncover concerns about more than the single transaction being reviewed.

TikTok bans

The White House told federal agencies back in February that they had 30 days to delete the TikTok app from government devices.

In March, a House committee voted to advance legislation that would allow President Biden to ban TikTok from all devices nationwide. The US military has banned it from the government-issued devices its members use for three years now.

That same month, TikTok’s chief executive was grilled about the app’s relationship to its parent company and China’s potential influence over the platform in almost five hours of testimony in Congress. CEO Shou Zi Chew flatly denied that ByteDance controls its operations in any way.

Lawmakers and regulators in the US, Canada, the UK, the EU, and Australia (among others) have increasingly expressed concern that TikTok and its parent company may put sensitive user data, like location information, into the hands of the Chinese government. They have all banned the app from official devices.

They have pointed to laws that allow the Chinese government to secretly demand data from Chinese companies and citizens for intelligence-gathering operations.

They are also worried that China could use TikTok’s user-generated content to institute misinformation campaigns. 

A growing number of US states have banned the app on government-issued devices, and come colleges have banned the app from its Wi-Fi networks.

Lawmakers and regulators, such as those in the US, Canada, the UK, the EU, and Australia, have increasingly expressed concern that TikTok may put sensitive user data, like location information, into the hands of the Chinese government.

In a bold move that is being challenged in court, Governor Greg Gianforte of Montana signed a bill to ban TikTok from operating in that state, the first outright state ban in the country.

Some legislators in Congress, such as Democrats in the House, Reps Alexandria Ocasio-Cortez and Jamaal Bowman and Republican Senator Rand Paul, oppose efforts to ban the app, saying it is illegal censorship, and that no interpretation of the First Amendment gives Congress or states the right to ban it.