The rise of TikTok as an OSINT tool

TikTok is an iOS and Android media app centred around creating, sharing and discovering short-form videos. It’s owned by parent company, Bytedance, which originally launched an app called Douyin in mainland China in September 2016. TikTok is the international version of Douyin and was launched outside of the Chinese market after merging with another social media service called Musical.ly in 2018.

Since then, TikTok has rapidly gained popularity across the globe, surpassing 3 billion downloads in 2021, including more than 130 million app downloads in the United States alone. It’s currently the seventh largest social media platform but is particularly popular with the Gen Z age – the term that refers to the generation born between 1997 and 2012.

Data Source

TikTok users spend an average of 95 minutes per day scrolling through the platform and has one of the most engaged audiences, beating other social media networks including Twitter and Snapshot in terms of monthly active users.

Data Source

So what makes TikTok so addictive? Firstly, the app’s algorithm – unlike other social media – serves content to users by analysing their behaviour and data signals rather than being dictated by who users choose to follow. This means that a user doesn’t have to follow a single other account and they will still see a curated feed of videos every time they log in, based on their interests and activity. 

Short-form video is at the core of the app’s content, with the average video length between 21 and 34 seconds, providing frequent bursts of entertainment. The app also auto-plays the next video, so viewers are continually ‘nudged’ into watching video after video involuntarily. 

Before we get into the use of TikTok as an OSINT tool, we should acknowledge that there have been concerns about TikTok’s data privacy for some time now, with some US officials stating that the astronomical success of the app is a ‘threat to national security’.

Despite being a separate application from its Chinese counterpart, Douyin, and having separate servers, the principal worry for lawmakers is that TikTok is still Chinese-owned and ByteDance reportedly has close ties with the Chinese Communist Party. There is therefore a fear that user data could end up in the wrong hands, particularly after a BuzzFeed News report from June 2022 leaked audio recordings of an internal TikTok meeting where it was revealed that several China-based employees maintain full access to overseas data. 

TikTok has strenuously denied claims that they mishandle user data, with their CEO addressing the issue in a letter to US senators claiming that ByteDance employees in China still have access to international user data but with “robust cybersecurity controls and authorization approval” overseen by a US-based security team. 

Most recently, ProtonMail, an encrypted email service, released a report in July 2022 that reviewed the data collection and privacy policies as well as past security vulnerabilities to conclude that the video sharing app is “a grave privacy threat that likely shares data with the Chinese government.” The Swiss-based company warned TikTok users of mass data collection and recommended that they approach the app with extreme caution. 

Countries including India, Bangladesh and Indonesia have already banned the use of TikTok and the UK Government recently closed their TikTok account amidst the renewed data concerns, following in the footsteps of other government agencies across the world who have imposed bans on accessing the platform. There is now increasing pressure on the Biden administration to address the privacy concerns more seriously as the app – now surpassing Google as the most visited website on the internet – continues to grow.

With over 60% of TikTok users falling within the Gen Z demographic, which is currently the largest generation on earth, the app’s audience is synonymous with documenting a lot of what they see and do on social media. TikTok’s success is partly credited to the fact it allows anyone to become a content creator and over 83% of all users on the app have created and shared a video.  

From an OSINT perspective, the platform is a treasure trove of information. 

And as an open-source intelligence provider, speed and accuracy are crucial to our clients. We need to ensure that they are always receiving the most up-to-date and reliable information available. This is why we’re constantly evolving the way we collect information, particularly as social media becomes more and more fragmented. 

We’ve used TikTok to discover protests at workplaces, such as the strike at an Amazon fulfilment centre in the UK. Workers went on strike in the facility’s canteen to denounce the lack of a pay rise. TikTok was also the first place we found mention of recent protests against Uber in Italy and employees of Starbucks staging a walkout in response to a colleague being fired for participating in a union.

The employee strike that took place at an Amazon facility in the UK during which footage was shared across TikTok. [Image source: Intelligence Fusion]

Regularly, the actions of environmental activist groups in the UK are documented by TikTok users, particularly the road blockades and traffic disruption caused by Insulate Britain and associated campaigners. Whilst we’re often aware of demonstrations and the intentions of protestors ahead of the protest actually taking place, TikTok can provide additional insight into what’s happening on the ground as the incident is unfolding. This allows us to keep our clients informed as situations develop too, especially if protests begin to escalate and therefore have a bigger potential impact on their operations.

An example of the results when searching using the ‘protest’ hashtag on TikTok. [Image Source: TikTok]

Aside from demonstrations and social unrest, criminal activity including active shootings, robberies, police chases and drug raids are often documented by witnesses on TikTok. Again, because the first instinct of a large portion of the app’s audience is to reach for their phone in many circumstances, we can access real-time footage of all kinds of events that can impact our clients.

Social media has played a key role in providing situational awareness to millions of people since the Russia-Ukraine war – it is even being dubbed the “first TikTok war”. And whilst it’s not new for conflict and unrest to be played out on social media, developments in features such as live streaming combined with the fact that over 61% of people in Ukraine own a smartphone, first-hand accounts of what is happening on the ground is more accessible than previous wars. 

Even in the lead-up to the invasion, we were using TikTok as part of our wider monitoring of the troop build-up around the Ukrainian border which was shared by ordinary citizens of Ukraine. By the 9th March 2022, less than two weeks since the war began, videos on TikTok featuring the hashtag “#ukraine” had already collectively gained more than 26.8 billion views. The conflict was more popular in terms of content engagement on TikTok than on any other platform.

Intelligence Fusion’s current coverage of the Russia-Ukraine conflict, supported by footage and information often identified on TikTok. Particularly the military movement and troop build-up immediately before the invasion. [Source: Intelligence Fusion]

One of the issues with using TikTok for intelligence gathering is the inability to accurately geolocate videos, however, there are still ways in which analysts can identify where the video was filmed without location tagging. 

Firstly, looking at the hashtags used in the video caption can sometimes have some distinguishing information such as a city, town or region to help narrow down your search. Simply checking the comments section may also provide you with further details, there may be other users who recognise the area by passing comments on the video. 

For us, we’ll also use Imagery Intelligence (IMINT) to help us geolocate the incident. IMINT is an intelligence gathering discipline whereby imagery is analysed to identify information. It’s unlikely that a video will be uploaded to TikTok without any distinguishing features, and our analysts will use those characteristics to pinpoint a specific location. 

Often, there’ll be multiple people filming the same incident too, so our team may be able to find alternative angles to support their investigation and further narrow down their search.

According to the Wall Street Journal, 40% of 18-24-year-olds now use TikTok to find answers and information which could be worrying given the app’s reputation as a source of disinformation. 

TikTok’s audience is drawn to the fact that just about anyone can go viral on the app, regardless of follower count, so they’re incentivised to keep their accounts public. This means that there’s a great deal of publicly available content, but the use of pseudonyms is still popular with users particularly when it comes to those posting about events such as the Russia-Ukraine conflict. 

Since the invasion on the 24th February 2022, TikTok users have fallen victim to serious misinformation including footage of past conflicts being recycled and even fake live streams of users pretending to be on the ground in Ukraine amidst the conflict. 

Because of the speed at which users consume content on the platform and jump from video to video means that there’s very little context. Researchers believe that TikTok hasn’t done enough to filter out the fake news and have accused the platform of disregarding the spread of false information in favour of keeping users active on the app. 

Given the low level of moderation from TikTok’s team, the app is also the ideal place for people to spread misinformation beyond the Russia-Ukraine conflict, such as political conflict. TikTok has pledged to do better at labelling disinformation on the platform, but as with all social media and unfortunately inconsistent use of misinformation policies, you should carefully assess each video and its claims when using TikTok as an OSINT tool.

Despite the controversy surrounding the platform, the sheer volume of users sharing content via the app every day means that security professionals overlooking TikTok as an important OSINT source could risk missing significant threats to their people, assets and reputations. 

However, one thing that stands out about using TikTok for OSINT collection is how susceptible it is to disinformation and how quickly it can spread across the platform to billions of people. To use TikTok as an OSINT tool and benefit from it in the context of corporate security there is an unquestionable need to have a team of analysts ensuring the accuracy of footage. 

Our growing Operations Team works round-the-clock to verify and geolocate over 18,000 security incidents every month. Monitoring thousands of global data sources including TikTok and Telegram, we can save your team time and resource by delivering reliable, actionable alerts in near-real-time.

To find out more about our intelligence solutions and how we’re supporting some of the world’s largest organisations to secure their business, speak to a member of our team today.

Let’s talk