The US Senate has passed a bill that compels TikTok's Chinese owner ByteDance to either offload the app to a US-approved buyer or face a ban. President Biden has indicated he will sign it into law.

The bill - formally known as the Protecting Americans from Foreign Adversary Controlled Applications Act (PFACAA) - passed 79 votes to 18 in the Senate on Tuesday US time having earlier been rubber-stamped by the House. The act was bundled into HR 815 - a law that among other things authorizes military funding to support Ukraine, Israel, and Taiwan.

The act defines just one source of foreign adversary-controlled applications - namely, anything produced by ByteDance, TikTok, or related entities - though it also gives US presidents the power to name more.

ByteDance and its TikTok unit earned the designation as it is feared the app could ultimately be used by Beijing to manipulate and snoop on Americans and spread misinformation. Chinese social media, by contrast, is largely closed to outsiders.

PFACAA makes it "unlawful for an entity to distribute, maintain, or update (or enable the distribution, maintenance, or updating of)" such apps, and once signed by President Biden will see a 270-day countdown commence. After that time has elapsed - or perhaps after a single 90-day extension - it will be illegal for an adversary-controlled app to appear in US app stores or be hosted by American service providers. The software will be effectively banned in the United States, though that effectiveness has been questioned.

In any case, the then-illegal app will be forced to hand users "any data maintained by such application with respect to the account of such user, including content (including posts, photos, and videos) and all other account information."

The act contains an escape clause: A "qualified divestiture" to an entity the US government is satisfied will see the app no longer controlled by a foreign adversary will mean continued operations are allowed. That is to say, if ByteDance can find an approved buyer for TikTok, the application can avoid being banned.

President Joe Biden on Tuesday promised to approve the law on Wednesday - meaning ByteDance has until January 25, 2025, to offload its flagship Western app.

What happens next is unclear. ByteDance's US arm is reportedly considering a legal challenge, while a few potential buyers have expressed interest in acquiring TikTok's operations.

But whether it is possible to fully disentangle TikTok from ByteDance's infrastructure is unknown. And given that some user data is visible to ByteDance workers in China, any buyer would face quite a project to straighten that all out to Uncle Sam's satisfaction.

That's not a bland assertion: The Register has reported on years-old infosec issues that persist in a situation comparable to the divestiture of TikTok - namely the acquisition of Korean messaging app LINE by Yahoo! Japan.

Potential buyers of TikTok would surely be considering their appetite for the technical effort that lies before them, and the potential for trouble if they are found not to have completely severed the app from ByteDance.

Your correspondent can imagine writing many, many, stories about failures to get that job right.

And also many stories about the impact of this act on free speech, the open internet, the livelihoods of TikTok developers, implications for US tech companies that - like Oracle - proudly provide IT infrastructure for the app, and even whether this decision could turn the US election.

The last possibility is on the agenda as likely Republican presidential nominee Donald Trump - who as president tried and failed to ban TikTok - is now blaming the app's demise on Biden. That it hasn't actually happened yet is neither here nor there. ®

https://www.theregister.com//2024/04/24/us_senate_passes_tiktok_sale_act/