For years, TikTok officials have assured U.S. politicians that the personal data of U.S. users of the app is safe on servers in Northern Virginia.

A Forbes magazine report, however, reveals gaps and omissions in security, from discarded flash drives connected to servers to unaccompanied visitors and boxes of hard drives left unattended in hallways.

According to Forbes, these are the consequences of TikTok’s push to increase storage capacity too quickly without proper security measures.

The data centers use, among other things, servers from Inspur, a company the Pentagon says is controlled by the Chinese military. Last month, the Commerce Department added Inspur to its sanctions list.

In response to a detailed list of questions from Forbes, TikTok spokeswoman Maureen Shanahan admitted to using Inspur servers, but stressed that the company has now stopped purchasing from the company.

Insufficient visitor control

Company policy states that visitors, including couriers, salespeople, electricians, and other professionals, must be accompanied by a company employee at all times. But in practice, according to four employees, this is not always the case. “We don’t have time to watch them all,” one of them said.

In addition, photos from 2020 obtained by Forbes from a source show hard drives left unattended in open drawers in the corridors of a data center in Virginia. The details in the photographs show a similar picture with photographs and videos provided by a second, independent source.

Six sources told Forbes they had heard of employees using the servers to mine cryptocurrency. TikTok responded that it would be a violation of its policy.

The revelations come at a critical time for TikTok, which is facing a federal investigation into spying on journalists, and the Biden administration has warned that ByteDance should sell TikTok. Otherwise, he faces a complete ban on use in the United States.

The bipartisan coalition, along with the White House, have raised concerns that the Chinese government is using ByteDance to extract sensitive data about American citizens or influence the political public sphere.

These complaints were recently vehemently dismissed by the company’s CEO Su Zhiqiu, saying his company has spent more than $1.5 billion to provide the most secure way to protect personal data. The company’s “Project Texas” program employs 1,500 people and “locks” its users’ data into the systems of Oracle, an American multinational corporation with which it has a contract to do so. However, Republican committee chair Kathy McMorris Rogers dismissed Su’s assurances as “false,” arguing that “TikTok will say anything to keep it from being banned on American soil.”

According to Forbes