What state workers should know about the new TikTok ban on NC-owned phones, computers

For thousands of people who use a phone or computer that is owned by the state of North Carolina, it’s time to stop looking at TikTok. At least on your government-owned device or while you’re at work.

If you use a state-owned mobile phone, tablet or computer, here’s what you need to know about the new policy that started Jan. 26.

Why is TikTok banned now?

Two weeks ago, Gov. Roy Cooper issued Executive Order 276 banning TikTok and WeChat on state-owned devices, citing security threats. North Carolina follows the federal government and dozens of states banning TikTok, a social media app and site featuring short videos that is owned by ByteDance, which is based in China.

Cooper, a Democrat, called them “high-risk applications due to their lack of sufficient privacy controls and connections to countries that sponsor or support cyber-attacks against the United States.”

Jim Weaver, N.C. Department of Information Technology secretary and state chief information officer, called the order essential to the agency’s work to protect the state’s IT systems, data and assets.

DIT spokesperson Nicole Meister noted that any time you download an application, it is gathering data, and that “all it takes it one to be a security threat.”

Is my state agency included?

Maybe. The order only applies to certain state agencies, defined as: “Any agency, department, institution, commission, committee, board, division, bureau, office, unit, officer, or official of the State.”

The legislative and judicial branches of state government are not included.

Is it banned for university employees?

No, the University of North Carolina is not included in the ban.

The policy does not apply to local government entities either, according to DIT, which means community colleges are not included, either. However, the N.C. Community College System itself is a state agency.

Are there any exceptions to the TikTok ban?

According to the order, the only exceptions will be given to law enforcement or for other purposes allowed by DIT. You can apply for an exemption, including submitting a plan for risk mitigation.

When’s the deadline to delete TikTok?

You have 60 days.

What if I never use TikTok or WeChat?

Then you don’t have to do anything. If it’s installed on your phone, uninstall it. You can do this on most phones by pressing on the app icon and selecting “uninstall.” Don’t start using it on your computer, either.

What if I want to use TikTok on my own phone or computer?

You cannot use the state network to access TikTok, WeChat or any additional high-risk technology on your personal device. If you don’t access it on the state network, you can still use it on your personal device.

Who made the new policy?

While Cooper issued the executive order, the policy is from the N.C. Department of Information Technology and Chief Information Officer Jim Weaver, who called the ban essential to the agency’s work to protect the state’s IT systems, data and assets.

How many phones and computers are there?

DIT doesn’t manage all state-issued devices, but does for 14 agencies. Among those, there are 4,400 computers and cell phones.

The agencies in that count include the Governor’s Office, Lieutenant Governor’s Office, Board of Barbers, Commissioner of Banks, Department of Commerce, Department of Natural and Cultural Resources, Department of Administration, Department of Military and Veterans Affairs, Industrial Commission, Office of Administrative Hearings, Office of State Budget and Management, Office of State Human Resources and the Department of Information Technology itself.

The vast majority of those devices overseen by DIT are computers, while 359 are phones.

Thousands of other phones and computers are issued from individual agencies, which have their own IT departments as well.

Will they ban more than TikTok and WeChat?

Maybe. The new policy allows future “high risk applications” to be added to the banned list. That’s defined as “any application, website, or other product that poses an unacceptable level of cybersecurity risk to state data.” That includes applications for which DIT decides “the vendor or manufacturer may participate in activities such as surveillance by government entities, cyber-espionage, or inappropriate collection of the personal information of State Agency Employees.”

Who’s going to enforce the policy?

Your workplace. State agencies will work with DIT to make sure you and your agency follows the policy.

What if I don’t delete TikTok?

Employees who violate the security policy may receive disciplinary action, including being fired.