A journalist recounts discovering that ByteDance surveilled her in 2022 after reporting on TikTok's staff troubles in London and wonders why she was targeted
The FT's Cristina Criddle on discovering she'd been surveilled by the controversial social media company
Context & Ripple Effects
This is the third chapter of a story that has been building since late 2022: Forbes first reported that ByteDance fired four employees who had accessed data on US TikTok users, including reporters, while hunting the sources of a story (the employee firings), and Semafor then traced the surveillance to an Internal Audit team with wide investigative powers and little oversight, which ByteDance said it would restructure (that audit-team exposé).
Cristina Criddle's account adds the victim's side to that record — she was surveilled in 2022 after reporting on TikTok's staff troubles in London — and it lands against later coverage showing Beijing-based ByteDance has tightened its grip on TikTok over the following two years (the culture-clash interviews), keeping questions about data access and control at the center of TikTok's Western credibility problem.
First-order effects
- Criddle and other reporters covering TikTok from inside its offices now know they were targets of the company's own Internal Audit apparatus, turning source protection into a documented personal risk rather than a hypothetical one.
- ByteDance's promised restructuring of that audit team faces renewed scrutiny: it must show the oversight gap Semafor identified has actually closed, or the firings read as cleanup rather than reform.
Second-order effects
- News organizations covering TikTok will harden their internal practices — assuming communications and devices near the company can be monitored — which raises the cost of reporting on ByteDance and pushes sourcing further underground.
- Each confirmed surveillance case feeds directly into the regulatory and political pressure on TikTok's US and European operations, where data-access controls are already the central trust question.
Third-order effects
- If the pattern holds — internal teams with broad investigative reach, journalists targeted, reforms announced under pressure — platforms' in-house security and audit functions will likely face the same external oversight regimes being built for their consumer data, with journalist surveillance becoming a standard exhibit in those arguments.
The trend: Platform companies are being pushed from self-policed internal investigations toward externally audited data access, with journalist surveillance cases like this one accelerating that shift.