驾照、地址和照片:调查揭示TikTok如何泄露用户隐私_OK阅读网
双语新闻
Bilingual News


双语对照阅读
分级系列阅读
智能辅助阅读
在线英语学习
首页 |  双语新闻 |  双语读物 |  双语名著 | 
[英文] [中文] [双语对照] [双语交替]    []        


驾照、地址和照片:调查揭示TikTok如何泄露用户隐私
Driver’s Licenses, Addresses, Photos: Inside How TikTok Shares User Data

来源:纽约时报    2023-05-25 03:00



        In August 2021, TikTok received a complaint from a British user, who flagged that a man had been “exposing himself and playing with himself” on a livestream she hosted on the video app. She also described past abuse she had experienced.
        2021年8月,TikTok接到一位英国用户的投诉,称在该视频应用上,一名男子在她主持的直播中“裸露身体并自慰”。她还描述了她过去遇到的侵犯行为。
        To address the complaint, TikTok employees shared the incident on an internal messaging and collaboration tool called Lark, according to company documents obtained by The New York Times. The British woman’s personal data — including her photo, country of residence, internet protocol address, device and user IDs — were also posted on the platform, which is similar to Slack and Microsoft Teams.
        《纽约时报》获得的公司文件显示,为了处理投诉,TikTok员工在内部消息和协作工具Lark上分享了这一事件。这位英国女性的个人数据——包括她的照片、居住国、IP地址、设备和用户ID——也被发布在Lark上,该平台类似于Slack和微软Teams。
        Her information was just one piece of TikTok user data shared on Lark, which is used every day by thousands of employees of the app’s Chinese owner, ByteDance, including by those in China. According to the documents obtained by The Times, the driver’s licenses of American users were also accessible on the platform, as were some users’ potentially illegal content, such as child sexual abuse materials. In many cases, the information was available in Lark “groups” — essentially chat rooms of employees — with thousands of members.
        她的信息只是Lark上发布的TikTok用户数据之一,该应用程序由中国的字节跳动所有,其数千名员工每天都在使用这些数据,包括在中国的员工。根据时报获得的文件,该平台还可以看到美国用户的驾照,以及一些用户发布的可能非法的内容,例如儿童性侵内容。在许多情况下,这些信息可以在Lark“群组”中获得,这些拥有数千名成员的群组基本上是员工的聊天室。
        The profusion of user data on Lark alarmed some TikTok employees, especially since ByteDance workers in China and elsewhere could easily see the material, according to internal reports and four current and former employees. Since at least July 2021, several security employees have warned ByteDance and TikTok executives about risks tied to the platform, according to the documents and the current and former workers.
        据内部报告以及四名现任和前任员工称,Lark上大量的用户数据令一些TikTok员工警觉,尤其是字节跳动在中国和其他地方的员工可以轻而易举地看到这些资料。根据该文件以及现任和前任员工的说法,至少从2021年7月开始,多名安全员工已经向字节跳动和TikTok高管警告与该平台相关的风险。
        “Should Beijing-based employees be owners of groups that contain secret” data of users, one TikTok employee asked in an internal report last July.
        一位TikTok员工去年7月在一份内部报告中问道,“北京员工是否应该成为包含用户秘密数据的群组的群主”。
        The user materials on Lark raise questions about TikTok’s data and privacy practices and show how intertwined it is with ByteDance, just as the video app faces mounting scrutiny over its potential security risks and ties to China. Last week, Montana’s governor signed a bill banning TikTok in the state as of Jan. 1. The app has also been prohibited at universities and government agencies and by the military.
        Lark上的用户资料引发人们质疑TikTok的数据和隐私做法,并表明了它与字节跳动的关系是如何交织在一起的,而该视频应用程序因其潜在的安全风险和与中国的关系正面临越来越多的审视。上周,蒙大拿州州长签署了一项法案,将从1月1日起在该州禁止使用TikTok。大学、政府机构和军方也禁止使用该应用程序。
        TikTok has been under pressure for years to cordon off its U.S. operations because of concerns that it might provide data on American users to the Chinese authorities. To continue operating in the United States, TikTok last year submitted a plan to the Biden administration, called Project Texas, laying out how it would store American user information inside the country and wall off the data from ByteDance and TikTok employees outside the United States.
        多年来,由于担心可能会向中国当局提供美国用户的数据,TikTok一直承受着将其美国业务剥离的压力。为了继续在美国运营,TikTok去年向拜登政府提交了一份计划,称作“得克萨斯计划”,阐述了如何将美国用户信息存储在国内,并将在美国境外的字节跳动和TikTok员工数据与这些数据隔离开。
        TikTok has played down the access that its China-based workers have to U.S. user data. In a congressional hearing in March, TikTok’s chief executive, Shou Chew, said that such data was mainly used by engineers in China for “business purposes” and that the company had “rigorous data access protocols” for protecting users. He said much of the user information available to engineers was already public.
        TikTok淡化了其中国员工对美国用户数据的访问权限。在3月的国会听证会上,TikTok的首席执行官周受资表示,这些数据主要被中国的工程师用于“业务目的”,该公司有“严格的数据访问协议”来保护用户。他说,工程师能够看到的大部分用户信息本身就是公开信息。
        The internal reports and communications from Lark appear to contradict Mr. Chew’s statements. Lark data from TikTok was also stored on servers in China as of late last year, the four current and former employees said.
        Lark的内部报告和通讯似乎与周受资的陈述相矛盾。四名现任和前任员工表示,截至去年底,来自TikTok的Lark数据也存储在中国的服务器上。
        The documents seen by The Times included dozens of screenshots of reports, chat messages and employee comments on Lark, as well as video and audio of internal communications, spanning 2019 to 2022.
        时报看到的文件包括2019年至2022年的数十张截图,显示了报告、聊天消息和员工在Lark上的评论,以及内部通讯的视频和音频。
        Alex Haurek, a TikTok spokesman, called the documents seen by The Times “dated” and disputed that they contradicted Mr. Chew’s statements. He said they did not accurately depict “how we handle protected U.S. user data, nor the progress we’ve made under Project Texas.”
        TikTok发言人亚历克斯·豪雷克称时报看到的文件已“过时”,并否认它们与周受资的声明相矛盾。他说,这些文件不能准确描述“我们如何处理受保护的美国用户数据,也没有描述我们在得克萨斯项目下取得的进展”。
        He added that TikTok was in the process of deleting U.S. user data that it collected before June 2022, when it changed the way it handled information about American users and began sending that data to U.S.-based servers owned by a third party rather than those owned by TikTok or ByteDance.
        他还表示,TikTok正在删除它在2022年6月之前收集的美国用户数据,当时它改变了处理美国用户信息的方式,并开始将该数据发送到第三方拥有的美国服务器,而不是通过TikTok或字节跳动拥有的服务器。
        The company didn’t respond to questions about whether Lark data was stored in China. It declined to answer questions about the involvement of China-based employees in creating and sharing TikTok user data in Lark groups, but said many of the chat rooms were “shut down last year after reviewing internal concerns.”
        该公司没有回应有关Lark数据是否存储在中国的问题。它拒绝回答有关中国员工参与在Lark群组中创建和发布TikTok用户数据的问题,但表示许多聊天室“在审查内部问题后已于去年关闭”。
        Alex Stamos, the director of Stanford University’s Internet Observatory and Facebook’s former chief information security officer, said securing user data across an organization was “the hardest technical project” for a social media company’s security team. TikTok’s problems, he added, are compounded by ByteDance’s ownership.
        斯坦福大学互联网观察站主任、前Facebook首席信息安全官亚历克斯·斯塔莫斯表示,保护整个组织的用户数据是社交媒体公司安全团队“最难的技术项目”。他还说,TikTok的问题因字节跳动的所有权而变得更加复杂。
        “Lark shows you that all the back-end processes are overseen by ByteDance,” he said. “TikTok is a thin veneer on ByteDance.”
        “Lark事件向你展示了所有后端流程都由字节跳动负责,”他说。“TikTok只是字节跳动的一层薄薄的外壳。”
        ByteDance introduced Lark in 2017. The tool, which has a Chinese-only equivalent known as Feishu, is used by all ByteDance subsidiaries, including TikTok and its 7,000 U.S. employees. Lark features a chatting platform, videoconferencing, task management and document collaboration features. When Mr. Chew was asked about Lark in the March hearing, he said it was like “any other instant messaging tool” for corporations and compared it to Slack.
        字节跳动于2017年推出了Lark。该工具有一个中文版本“飞书”,字节跳动的所有子公司都在使用该工具,包括TikTok及其7000名美国员工。Lark具有聊天平台、视频会议、任务管理和文档协作功能。当周受资在3月的听证会上被问及Lark时,他说这和各企业所用的“任何其他即时通讯工具”并无不同,并将其与Slack相提并论。
        Lark has been used for handling individual TikTok account issues and sharing documents that contain personally identifiable information since at least 2019, according to the documents obtained by The Times.
        根据时报获得的文件,至少从2019年开始,Lark就被用于处理个人TikTok账户问题,并共享包含个人身份信息的文件。
        In June 2019, a TikTok employee shared an image on Lark of the driver’s license of a Massachusetts woman. The woman had sent TikTok the picture to verify her identity. The image — which included her address, date of birth, photo and driver’s license number — was posted to an internal Lark group with more than 1,100 people that handled the banning and unbanning of accounts.
        2019年6月,一名TikTok员工在Lark上分享了一张马萨诸塞州一名女性的驾照图片。这名女子将该照片发给TikTok是为了验证她的身份。图片中包含她的地址、出生日期、照片和驾照号码,被发布在Lark上一个有1100多人的内部小组中,该小组负责处理账户的封禁和解禁。
        The driver’s license, as well as passports and identification cards of people from countries including Australia and Saudi Arabia, were accessible on Lark as of last year, according to the documents seen by The Times.
        时报看到的文件显示,从去年开始,该驾照以及来自澳大利亚和沙特阿拉伯等国家的人的护照和身份证都可以在Lark上找到。
        Lark also exposed users’ child sexual abuse materials. In one October 2019 conversation, TikTok employees discussed banning some accounts that had shared content of girls over 3 years old who were topless. Workers also posted the images on Lark.
        Lark还曝光了用户的儿童性虐待材料。在2019年10月的一次对话中,TikTok员工讨论了禁止一些分享三岁以上赤裸上身女孩内容的账户。工作人员也在Lark上发布了这些照片。
        Mr. Haurek, the TikTok spokesman, said employees were instructed to never share such content and to report it to a specialized internal child safety team.
        TikTok发言人豪雷克表示,公司指示员工永远不要分享这类内容,并向专门的内部儿童安全团队报告。
        TikTok employees have raised questions about such incidents. In an internal report last July, one worker asked if there were rules for handling user data in Lark. Will Farrell, the interim security officer of TikTok’s U.S. Data Security, which will oversee U.S. user data as part of Project Texas, said, “No policy at time.”
        TikTok的员工对此类事件提出了质疑。在去年7月的一份内部报告中,一名员工询问,在Lark中是否有处理用户数据的规则。TikTok美国数据安全部门的临时安全官威尔·法雷尔说,“目前没有政策。”该部门作为“得克萨斯计划”的一部分将负责监管美国用户数据。
        A senior security engineer at TikTok also said last fall that there could be thousands of Lark groups mishandling user data. In a recording, which The Times obtained, the engineer said TikTok needed to move the data “out of China and run Lark out of Singapore.” TikTok has headquarters in Singapore and Los Angeles.
        去年秋天,TikTok的一名高级安全工程师也表示,可能有数以千计的Lark群组在不当处理用户数据。在时报获得的一段录音中,这名工程师表示,TikTok需要将数据“移出中国,让Lark离开新加坡”。TikTok的总部设在新加坡和洛杉矶。
        Mr. Haurek called the engineer’s comments “inaccurate” and said TikTok reviewed instances where Lark groups were potentially mishandling user data and took steps to address them. He said the company had a new process for handling sensitive content and had put new limits on the size of Lark groups.
        豪雷克称这名工程师的评论“不准确”,并表示TikTok审查了Lark群组可能错误处理用户数据的情况,并采取了措施来解决这些问题。他表示,该公司有一套处理敏感内容的新流程,并对Lark群组的规模设置了新的限制。
        TikTok’s privacy and security division has undergone reorganizations and departures in the past year, which some employees said had slowed down or sidelined privacy and security projects at a critical juncture.
        TikTok的隐私和安全部门在过去一年中经历了重组和人员离职,一些员工表示,这在关键时刻拖慢了隐私和安全项目,甚至导致项目的搁浅。
        Roland Cloutier, a cybersecurity expert and U.S. Air Force veteran, stepped down last year as the head of TikTok’s global security organization, and a portion of his unit was placed on a privacy-focused team led by Yujun Chen, known to colleagues as Woody, a China-based executive who has worked at ByteDance for years, three current and former employees said. Mr. Chen previously focused on software quality assurance.
        三名现任和前任员工表示,网络安全专家、曾在美国空军服役的罗兰·克劳蒂尔去年辞去了TikTok全球安全组织负责人的职务,他所在部门的一部分人加入了由陈玉军(音)领导的一个专注于隐私的团队。同事们管陈玉军叫Woody,他是在字节跳动工作多年的中国高管,之前专注于软件质量保证。
        Mr. Haurek said that Mr. Chen had “deep technical, data and product engineering expertise” and that his team reported to an executive in California. He said that TikTok had multiple teams working on privacy and security, including more than 1,500 workers on its U.S. Data Security team, and that it had spent more than $1.5 billion to carry out Project Texas.
        豪雷克说,陈拥有“深厚的技术、数据和产品工程专业知识”,他的团队向加州的一位高管汇报工作。他说,TikTok有多个团队负责隐私和安全,其中包括其美国数据安全团队的1500多名员工,该公司已经花费了超过15亿美元来开展得克萨斯项目。
        ByteDance and TikTok have not said when Project Texas will be complete. When it is, TikTok said, communications involving U.S. user data will take place on a separate “internal collaboration tool.”
        字节跳动和TikTok都没有说“德克萨斯计划”何时完成。TikTok表示,一旦上线,涉及美国用户数据的通信将在一个单独的“内部协作工具”上进行。
        
        
   返回首页                  

OK阅读网 版权所有(C)2017 | 联系我们