Application Security

Executive Fired From TikTok’s Chinese Owner Says Beijing Had Access to App Data in Termination Suit

Former ByteDance executive said China government officials maintained access to all TikTok data, including information stored in the United States.

TikTok ban in US

A former executive fired from TikTok’s parent company ByteDance made a raft of accusations against the tech giant Friday, including that it stole content from competitors like Instagram and Snapchat, and served as a “propaganda tool” for the Chinese government by suppressing or promoting content favorable to the country’s interests.

The allegations were made in a complaint Friday by Yintao Yu, the head of engineering for ByteDance’s U.S. operations from August 2017 to November 2018, as part of a wrongful termination lawsuit filed earlier this month in San Francisco Superior Court. Yu claims he was fired for disclosing “wrongful conduct” he saw at the company.

In the complaint, Yu alleges the Chinese government monitored ByteDance’s work from within its Beijing headquarters and provided guidance on advancing “core communist values.”

Yu said government officials had the ability to turn off the Chinese version of ByteDance’s apps, and maintained access to all company data, including information stored in the United States.

ByteDance did not immediately respond to a request for comment.

The allegations come as TikTok – one of the most popular social media apps in the U.S. — faces heightened scrutiny in Washington and some states about whether it can keep American data safe from the Chinese government. The Biden administration has threatened to ban the app if its Chinese owners don’t sell their stakes.

Advertisement. Scroll to continue reading.

TikTok maintains it never gave U.S. user data to China’s government and wouldn’t do so if it was asked. In an effort to avoid a ban, it also wants to store U.S. user data on servers operated by the software giant Oracle.

In another attention-grabbing part of the lawsuit, Yu alleges he observed ByteDance promoting content that expressed hatred for Japan on Douyin, the Chinese version of TikTok. At another time, he said the company demoted content that showed support for the protests in Hong Kong while promoting content that expressed criticism of the protests.

Yu said ByteDance developed software that would scrape user content from competitors’ websites without permission. He alleges the company would then repost the content on its own websites – including TikTok – to attract more engagement from users.

Yu said a fellow TikTok executive in charge of the video-sharing app’s algorithm waved off his concerns. At some point, Yu said the company modified the program, but continued to scrape data from U.S. users when they were abroad.

The former executive also alleges the company created fake users to boost its engagement metrics, including by programming them to “like” and “follow” real accounts.

Yu is seeking punitive damage, lost earnings and 220,000 ByteDance shares that had not vested by the time he was fired.

Related Content

Malware & Threats

Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.

Vulnerabilities

The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.

Artificial Intelligence

Xint says a flaw in OpenAI’s compaction process let researchers move reasoning traces between models, potentially making it cheaper to distill a rival AI.

Artificial Intelligence

The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments.

Artificial Intelligence

The DHS said agencies should remove DeepSeek products as well as third-party products and services developed using DeepSeek from their IT systems.

Artificial Intelligence

Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable.

Artificial Intelligence

At least three threat actors have been abusing Cairn for persistent access and financial theft.

Vulnerabilities

Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.

Exit mobile version