Australian governments are beginning to ban the social-media application TikTok on official phones.
This week, the federal, Victorian, South Australian and ACT governments all announced prohibitions on the popular app, responding to fears it may facilitate Chinese espionage.
Australia is the last of the Five Eyes intelligence allies to do this — Britain, Canada, New Zealand and the United States all moved first.
But while the app will largely vanish from government-owned phones, it's less clear whether Australia's 2 million public-sector employees should uninstall TikTok from their personal devices.
'No restrictions for individuals'
TikTok has become extremely popular in a short period of time.
In Australia, it has almost as many regular users as Meta-owned giants Facebook and Instagram.
However, Australia's intelligence agencies now say the app "poses significant security and privacy risks".
The public version of their advice does not name China, but it says TikTok's key risks include "extensive collection of user data and exposure to extrajudicial directions from a foreign government".
In response, the federal Attorney-General's Department has restricted the use of TikTok on Commonwealth-owned phones.
But it says it's still OK to use the platform through a web browser.
The department also says there are "no restrictions on what individuals can have on their own personal devices".
Nonetheless, government security policies contain many warnings for staff — some specific to TikTok and some to all social media.
What are the security risks for staff?
The Australian Signals Directorate (ASD), which is the nation's main cybersecurity agency, says most social-media businesses collect far more data from mobile phones than users realise.
Messaging and social-media apps are "a common way for an adversary to gather information on individuals", the ASD says.
"Even seemingly benign posts, messages, photos or videos can be used to develop detailed profiles of individuals.
"This information could be used in extortion or social-engineering campaigns aimed at eliciting sensitive information, or influencing individuals to compromise organisations' activities or systems."
The main threat is that criminals, or an enemy state, might learn that a user has access to protected government information.
ASD's information security manual suggests that public servants conceal details of their job and workplace from others.
They should also avoid sharing information that will allow "an adversary to develop a detailed understanding of their lifestyle and interests", the manual says.
Freedoms, obligations and some tips
Public servants' use of social media has long been a source of tension, usually over questions of free speech.
Government staff are allowed to express personal views online, as long as they don't undermine public confidence in their ability to be professional and impartial.
However, public servants also have a obligation to minimise national-security risks — and the ASD advises them to take the following precautions if they want to keep using TikTok:
- Don't use TikTok on a phone that can access any official (workplace) information
- If a phone has TikTok on it, keep it away from sensitive conversations and information
- Remove metadata (such as location information) from photos and videos before uploading them to TikTok
The ASD also suggests public servants follow these broader rules for all social media, including near-ubiquitous platforms like Facebook:
- Use an alias rather than your full name when creating an account
- Don't use a work email address; create a new email account solely for social media
- Make the social media account private (accessible only to "friends")
- Restrict the amount of personal information you publish, such as details of where you live and work
- Use lock screens on any devices that have access to social media
