Minister of Digitalization Sebastian Burdugia announced on Wednesday that the Cyberint Center of the Romanian Intelligence Service (SRI) tested the TikTok app and found that it can provide access to the user’s personal data, the creation of a user profile and access to third-party devices with which the app user interacts online. – environments.

During today’s meeting of the Operational Council on Cyber ​​Security, as an advisory body under the strategic coordination of CSAT, Minister Burduja presented a technical report on the cyber security risks associated with the installation and use of the TikTok application, from which the following elements arose:

• under the Terms of Use, the program is allowed to collect advertising information directly from its own sites by integrating TikTok Advertising-type utilities such as the TikTok Pixel;
• the application can collect a large amount of information about the user’s device, including: Wi-Fi SSID, phone model number, SIM serial number, IMEI, SMS reading, device MAC address, phone number, GPS data, details of other connected accounts on the device , full access to the clipboard (which can create cybersecurity risks because a large number of Password Manager applications use the clipboard);
• the program tracks users even if they have activated the “Do Not Track” option;
• the application automatically collects data such as device model, operating system, keystroke patterns and rhythms, IP, location, tracked content, search history, email content characteristics, gender profile, age, etc.;
• the application reserves the right to share data with government bodies;
• the application collects information about other services and applications that are installed on the device;
• can remotely debug the application, including launching new processes;
• executes commands in the Webview (may cause malware files to be downloaded to the device hosting the application);
• the app has its own built-in browser with Javascript features and any input can be controlled.

Technical report presented by the Minister of Digitalization was developed by the National Cyber ​​Center of the Romanian Intelligence Servicebased on data and information from testing the Tiktok app.

DNSC will recommend institutions and government agencies to remove their TikTok

The Ministry of Digitalization stated within the framework of the Cyber ​​Security Operational Council that there are cyber security risks related to the installation and use of the TikTok application on the service devices of public bodies and institutions, and in addition that an information and educational campaign is necessary for Romanian citizens who use addition.

Within the framework of the COSC, it was decided that each state body, a member of the COSC, in accordance with Art. 8 para. (1) of Law No. 58/2023 on Cyber ​​Security and Defense of Romania, as well as to amend and supplement certain regulatory acts, in order to carry out its own analysis of risks, vulnerabilities and threats to cyber security related to the installation and use of the TikTok application. The analysis period is one week.

Prior to the completion of the analysis and the adoption of some administrative acts, the COSC recommended that the National Cyber ​​Security Directorate issue, based on legal authority, a recommendation to central and local government authorities and institutions to remove and ban the TikTok service devices.

The Ministry of Digital Affairs also recommends that citizens “take a balanced and diligent approach to the use of the TikTok application, taking into account the cyber security risks associated with its use.

“There is no mention of banning the use of the TikTok application by Romanian citizens on personal devices, but we draw attention to the fact that its use may lead to the application accessing the user’s personal data, creating a user profile and accessing third-party devices with which the user of the application interacts in the cyber environment.”, This is stated in the message of the ministry.