Securing TikTok with Roland Cloutier, Global Chief Security Officer at TikTok

(Intro Narrator at 00:00:02) Hello, my friends. Today, Joel is talking to Roland, the Global Chief Security Officer at TikTok, and they discuss what it takes to secure one of the world's largest entertainment platforms, why Roland prioritizes mission-driven talent spanning engineering, security, safety, and privacy, and the various techniques TikTok employs to protect its diverse user base. All of this right here, right now on the Modern CTO Podcast.

(Joel Beasley at 00:00:38) Here we go. This is the Modern CTO Podcast. So how did you, you know, in Florida, in this area that's typically somewhat of a small town—I mean, they're all kind of like small towns—but how did you end up working with TikTok?

(Roland at 00:01:00) Oh, how I worked with TikTok is an entirely different story. So I've been the chief security officer of ADP for the last ten years, and my dream job came open. A friend of mine, another major multinational, the chief security position was open. It was like my dream job. When I started interviewing for it, I realized it was not my dream job.

(Roland at 00:01:25) And it just so happens that the same recruiters were recruiting for the TikTok job that had been open a while, and they had asked me, "Hey, what would you like to do?" And I told them about my focus on advanced technology, my focus on doing things for the greater good and high-paced environments. And they go, "How about TikTok?" I said, "Say what?"

(Roland at 00:01:49) So that was almost a five and a half, six month journey in working with TikTok and talking about what they wanted and what I wanted to do or could do, and it culminated with an incredible opportunity to meet their CEO. That changed my whole perspective. And I had a great meeting, and I can touch on a couple of those things in conversations. So yeah, but that's how I got to TikTok, and now it's been almost two years.

(Joel Beasley at 00:02:20) Is the CEO the founder?

(Roland at 00:02:22) He is, yeah. Oh yeah. Danny Ring.

(Joel Beasley at 00:02:24) Danny Ring.

(Roland at 00:02:24) We couldn't arrange a time to sit down. He's a sit-down type of guy. You'd pass him a thousand times on the street. You wouldn't know that he's one of the smartest technical human beings in the world. And he flew down, and what was supposed to be a ninety-minute meeting turned into three and a half hours of us going back and forth, talking about what-ifs, different types of technology.

(Roland at 00:02:46) How do you enable that type of global capability in the security, risk, and privacy realm? It was just an amazing conversation. It really was. So that's how I got here, and it's just been nonstop since.

(Joel Beasley at 00:03:02) That's so cool. What's your actual title?

(Roland at 00:03:05) Chief Security Officer, Global Chief Security Officer. Nice.

(Joel Beasley at 00:03:09) And so you were in the Air Force. Were you doing security in the Air Force?

(Roland at 00:03:12) Yeah, the other side of it. It was combat security police and specialty in anti-terrorism.

(Joel Beasley at 00:03:17) That sounds really cool.

(Roland at 00:03:19) It's not a bad gig. I got some really great years of training that are usable in different ways.

(Joel Beasley at 00:03:27) What's the difference from—I mean, TikTok is such an enormous scale. Everybody knows what TikTok is. And I even knew what TikTok is, even though I had never used it. When I found out that you were gonna come on the show, I was like, that is so awesome. TikTok's like huge.

(Joel Beasley at 00:03:42) Everybody knows what TikTok is. And then I thought, I've never—I don't know what TikTok is. Like, I know the brand. They did an excellent job with the brand, but I just don't know what it is. So I sat down that night with my wife, and I was like, "You have to show me how to use TikTok," because a couple times before she was doing some weird stuff with a video, and I'm like, "What are you doing?"

(Joel Beasley at 00:04:00) She's like, "Don't worry. Just stand there. It's a TikTok." And I'm like, "I don't know what you're doing." And so then at first, you know, because I was brand new account, just started scrolling through it, I was like, "What is this?" And I was really confused. And then she was telling me—I was like, "I don't like it. I don't like it." And she goes, "No, no, no.

(Joel Beasley at 00:04:20) You have to go find stuff that you're interested in." And I said, "Okay," so I found some science TikToks, where they do science experiments or interesting—dude, it is so cool. I love it.

(Roland at 00:04:33) So everyone's feed is different. That's the beautiful thing of the algorithm. It provides you a path to the people and things you wanna connect to, and then you can decide whether you wanna see it or not. And based on that is how it helps you develop those connections and being able to consume things that are specific to you.

(Roland at 00:04:56) And that's really, I think, the beauty behind it. You have two sides of TikTok. You have the people that create to be their authentic self, to deliver what makes them happy, to show themselves to the world. And then you have the people who wanna consume it and enjoy communities—global communities across the platform—that are of like mind, so to speak. It makes them happy. It makes them smile.

(Roland at 00:05:24) I mean, so my feed—I was a former canine handler, so my feed is full of an awful lot of canine stuff. I'm the father of two young adult women. One's out of college, one's still in university. They hate my dad jokes. I freaking think I'm hilarious, right?

(Roland at 00:05:45) And so my feed's full of that. And my wife and I enjoy messing with our kids, so our feeds are full of parents having fun messing with their kids. So it's just whatever makes you smile.

(Roland at 00:06:00) So it's a fun place to work.

(Joel Beasley at 00:06:03) I just learned two new things. I'm gonna find some dad joke channels and parents messing with kids stuff. I'm excited.

(Roland at 00:06:10) Oh, and search for the dad help desks. Those are hilarious.

(Joel Beasley at 00:06:17) I love being a dad. You know, I'm only four years into it, almost five, but the pass you get with dad jokes is quite possibly the most underrated part of being a father.

(Roland at 00:06:28) So true. Here at TikTok, we actually have an internal group of—we have our own enterprise technology, and there's a group on it called Dad Jokes. And you could get lost in that for hours. It's so damn funny.

(Joel Beasley at 00:06:47) I love it. I love it. Well, I'm glad I know you now. Now I'm gonna message you all my TikTok stuff. So I was really curious, though—chief security, like Global Security Officer—is that everything from the desk of the engineers' devices to the servers?

(Joel Beasley at 00:07:05) Is that everything security, or is it just in a specific area?

(Roland at 00:07:09) Oh, it's everything. So think of it as business operations protection. So our focus is the protection of the totality of the company—the technology, the platforms, the hosting environments that make up the products. And so our global security programs encompass both security, risk, and privacy operations. So we have everything from data defense to our cyber intelligence units to our threat management teams to our incident response teams, our new fusion centers we're building out, which we're super stoked about, all the way through to our privacy and data protection organization that focuses specifically on privacy controls.

(Roland at 00:07:56) And then, of course, risk management and our trust and assurance team. So these are hundreds of practitioners around the globe solely focused on the principle priority that our company has, which is the security, safety, and trust of the platform.

(Joel Beasley at 00:08:12) I love it. And you just sparked an idea, a thought. So my sister-in-law has two boys that are late elementary going into middle school, so they have phones now, right?

(Joel Beasley at 00:08:25) And they have Instagram, and they're really into gaming. And I was hanging out with her, and I saw her doing something on her phone. I'm like, "What are you doing?" She goes, "Oh, I log into my son's Instagram so I have their profiles on my phone so I go in and check on them." And I was like, "That is so interesting."

(Joel Beasley at 00:08:41) And so I started doing some research, you know, as a parent, because I don't have to deal with it today, but you don't want the kids banging on the keyboard and hitting the wrong site or anything.

(Roland at 00:08:49) Yeah.

(Joel Beasley at 00:08:49) So it is so much more advanced than when I was a kid. It was just the wild west, but now you can do amazing privacy controls at the routers. Like, Disney makes a router. All these other companies have these crazy child protect—privacy and stuff. And I didn't see that Instagram had it.

(Joel Beasley at 00:09:06) Do you guys have things like that?

(Roland at 00:09:08) Oh yeah. I mean, there's so many layers here at TikTok in our trust, security, safety, and privacy controls. One of my favorites is family pairing. So, you know, it's interesting you asked about that. Our family pairing capability allows a parent to pair their account with their child and help control what they can see, do, manage who they connect with, you know, depending on age. Because if you're younger, if you use our platform, you can't connect with anyone.

(Roland at 00:09:42) But the whole idea is to put in these sets of layered controls that involve the parents or adults in a child's life that give family capabilities to enjoy the platform together in a safe and secure manner. But that's on top of all the other work that our trust and safety organization does. You know, Joe, we remove—I gotta say it's ninety-three or ninety-four percent—of all violative videos, right? Things we don't want on platform.

(Roland at 00:10:15) We have strong user and community guidelines on our platforms that are constantly enhanced, and we use outside third-party groups to help us develop them. Literally, ninety-three, ninety-four percent of those get removed before the video even hits platform. So when someone creates a video and they go to push it to platform, it goes through an introspection. And at that point, either voice, video, lyrics, and/or words within the video itself are inspected. And if it's not appropriate for platform, it'll be removed.

(Roland at 00:10:47) And so there's so many of these types of things. Q2 2021, just in Q2 alone, eighty-two million videos we removed. You know, it's amazing the speed at which the technology moves, but our capabilities have kept up with it. So it's fun to be part of an organization that's so focused on that.

(Joel Beasley at 00:11:11) Yeah. And you're right, because I sat down for an hour last night to go through it again. And right when I opened it up, it said it had a little dialogue that said the community standards have been recently updated. You know, "Click here to view them." Of course, I didn't.

(Joel Beasley at 00:11:26) I just clicked "Okay" so I can get to my science memes and stuff.

(Roland at 00:11:30) But I mean, you know, I probably come at it from the same place as you, where I dig into technology. I get rid of that. Keep going. I wanna read. I wanna get into the tech itself. But I think it's important. I think it's important for people to focus on what the technology can do for them and how they can engage the technology and use it as a responsible person of the online community. I think it's up to people to be able to understand what controls, what protection they have over their own information. I mean, there are things within our platform that allow people to define the privacy they have, define who they share things with, define, understand what data they have. You know, I mean, all of these things are available to users.

(Roland at 00:12:13) So tongue in cheek, I get it. But I think it's important for folks to go look at that stuff.

(Joel Beasley at 00:12:19) Samsung—I had to buy this new TV, right? And when I was registering it or setting it up, first of all, it made me install an app and go through this infinite amount of steps I wasn't too happy about. But one of the things that I had to check the box on in order to proceed with the setup is confirming that I understand that they have this voice ad recognition system, and I couldn't opt out of it. I'm gonna search later because this was just last night.

(Joel Beasley at 00:12:46) So I'm gonna search later to see if I can opt out of it after it's all set up, but it wouldn't let me complete the setup process unless I accepted the terms that they're gonna listen to my voice and provide me suggestions with products about that. I've seen that in a couple other apps and trends, not specific to TikTok. Like, how do you see that as a technological human being living in the world?

(Roland at 00:13:09) So I see choice as a really important thing. I see notification and being transparent about what you're providing, what you're not providing, which capabilities are and are not. I don't know the specific technology, so I don't really wanna pontificate on it specifically. But I think what's important from a technology point of view, into our earlier conversation, is it's important to put things out there—what our technologies are capable of and not—and then give the choice into the hands of the individual. If you want to engage in a specific technology and that requires a certain level of privacy or agreement to how your information will or will not be used, you should have that choice.

(Roland at 00:13:54) That is really, again, I think why we're leaning in regionally as a company, why we're leaning in to advanced data protection laws around the globe and curating our product to ensure that it matches those. You know, it's about how the world works and how technology works within that world. You know, a lot of people think there's a peanut butter spread—one law should be able to cover the world—and that's just not real. Different cultures, different requirements, different consumer protection requirements.

(Roland at 00:14:27) Those are going to happen in different parts of the world. So making products that enable that type of capability, that ensure that level of choice, is, I think, things that we should be focusing on—not just as an executive technologist within a technology company, but also as a user that I like to geek out on these things as well. I'm a bit of a techno nerd when it comes to trying new technologies. And it's important for me to understand what my level of risk is or not when it comes to certain technologies.

(Joel Beasley at 00:15:00) Yeah. It's like investing, right? You get to pick your risk level. Or you get to—I like it when it's very optional. I love that there was a positive trend in the tech world where, you know, back when things first started, all of these things were happening and just blanket agreements. And then some companies started to stand out by saying, "Hey, we're gonna be super transparent, and that's the platform we're gonna run on."

(Joel Beasley at 00:15:22) And then they started presenting things to you, and you could turn things on and off and see your—and I love the fact that that became a trend in our field.

(Roland at 00:15:30) I do too. One of the reasons I love being here is the continuation and the focus. And we get up every day, and one of our ethos is user-centric focus. And so, what would the user want? What does the user need? What is expected in those regions we operate?

(Roland at 00:15:49) And being able to continually evolve our product on a daily basis sometimes to achieve that—first time in my career that I've been able to do that, and I'm really super excited.

(Joel Beasley at 00:16:01) I have no experience with cross-regional customizations of technology in a social context. Does the TikTok app operate differently in different regions?

(Roland at 00:16:14) It does, from everything from our data defense to access assurance. It's all on the back end. How does it work? What can be offered from a services perspective within the platform in different regions? Generally, the platform as a whole is an integrated singular platform that allows the sharing of videos, you to have private or public videos, you to engage with whoever you want around the world.

(Roland at 00:16:38) But as we think about the things on the back end that we have to make sure that are protected, secure, private, choices that we give, depending on where you register your application or your residence location, all of those are important in how we provide the service out to the consumer.

(Joel Beasley at 00:16:56) How do you do incentive alignment within your team? Or what does your team even look like?

(Roland at 00:17:02) It's a good question. So we have a broad set of remits, right? Security is simply mission critical here. That is how we focus on it. And by the way, I come from critical infrastructure defense. That is kind of my whole background. And now I'm in the coolest technology company ever. But it's because our focus when we started this is really on, it's part of the critical infrastructure of the organization. So obviously, data is important, right? Users on TikTok, almost a billion MAUs now or over a billion MAUs now. People around the globe sit on our platform, and they trust us with that data, so we take it very seriously.

(Roland at 00:17:46) So data defense and access assurance is absolutely critical to us. Also from a safety perspective, we have the entirety of the safety organization that's focused on people of all ages, teens to grandparents. This is important. For instance, next month, our financial crimes team that focuses on keeping bad stuff off platform, fraud, things like that, are engaging in anti-fraud education programs for the public, for the elderly, with our partnerships with public entities. Because around Valentine's Day, people target elderlies for these Valentine's Day scams. And so we get involved in things like that. We've talked to the multiple teams previously, but it's set up in a primary team that does cyber defensive operations. One does that, that looks at over the threat horizons, and then does, modifies our monitoring and control capabilities, defend against that, and respond to incidents. We have what we call a converged security group that includes digital crimes, financial crimes, the people that are focused on our workforce to ensure that they're safe around the globe.

(Roland at 00:18:57) And then we have a team that is constantly evaluating risks. So what are the risks we have to focus on? This is a fast moving world, a fast moving business. And so we constantly reevaluate our risk criteria and really focus on the things that are most important to the community we serve and our business. So that's at a very high level, but that's kind of the mission space of the teams that I get to work with every day.

(Joel Beasley at 00:19:27) Yeah. And you need it too. I read an article, and I don't know if it's true, but I think it is that TikTok surpassed Google as one of the most visited websites in the world. Is that true?

(Roland at 00:19:38) You know, I saw that somewhere too. I don't, I'm a security guy.

(Joel Beasley at 00:19:43) So I don't confirm or deny it.

(Roland at 00:19:44) I don't know. I just know that we have a lot of people that are on the platform that we're going to continue to make these commitments to of providing a safe, enjoyable, and happy place. I mean, the funniest thing when I, you know, I'm so used to critical infrastructure defense and cybercrime and this, then I come to a place where people are writing articles about the last sunniest corner of the internet. I'm like, cool. I get to wake up every day and protect the last sunniest corner of the internet. What more do you want in a job, right?

(Joel Beasley at 00:20:14) Right. What's an MAU? You said that earlier. I didn't know what that was.

(Roland at 00:20:18) Monthly average users. It's an industry term. It's monthly average users, daily average users. It's how technology is measured. It's just one of the key metrics.

(Joel Beasley at 00:20:31) Got it. Got it. You need high quality people on your team. You guys are protecting a huge empire. When you're talking with, obviously, you have on your direct reports, these are heads of these essential mini organizations, right? And how, when you're looking for these types of people to bring on your team, specifically your direct reports, what is, if you had to boil it down to one, maybe two traits, you know, when you're interviewing, what are the things that stand out to you when you're like, this is one of those special people I need to have them on my team?

(Roland at 00:21:02) Mission centric. They have to be execution oriented, mission centric individuals that understand this space and want to be in the fight every day. When I was in law enforcement and federal law enforcement, someone had once given me a t-shirt that showed a police officer on the back of a garbage can, a garbage truck, and it says, "Some days this feels like my job." And in this world, when you're the 911 for the business, you're the 911 for the consumers on your platform, and you're dealing with people trying to attack, people trying to do fraud schemes, people trying, you know, all of this stuff, you deal with that. You have to have people on your team that want to do that. I love stopping bad guys. I love creating technology that stops organized crime or state-sponsored issues or whatever it's going to be. And you want people that want to be in the fight. So if you ask me the one trait I would select over all of them, it's a mission centric person.

(Joel Beasley at 00:22:04) I love it. And how, I saw that you guys have several thousand employees, right? And when I was on the platform, I didn't see any ads. How do you guys make money?

(Roland at 00:22:15) So that is all part of how people advertise on platform in different types of ways, how content is provided to those that want it and receive it. There are some e-commerce parts of our platform around the globe. And there's some different interesting ways that, as content creators are compensated, that it's all part of a model that creates that. But a lot of it is through our ads management. And it's not in your face, and it's user based. And so it's an easy, that's why people don't understand it, because they just don't see it.

(Joel Beasley at 00:22:58) And I was in the science one too. And if it knows that I'm interested in that and I'm searching through that, it would only show me science relevant ones or ones that are targeted to those types of people. And that's really interesting. I like it personally. I like it when I don't really know that they're, I don't like annoying ads and I don't like irrelevant ads. So when things are just there, and there's some little indicator or whatnot, that's some of my favorite. Because when you can scroll through it and the ad and the companies are making ads that are interesting enough to not be annoying as ads, that tends to be the art, right? And for us, we do these emails out, right, to market sponsorships and stuff for the podcast. And I started, you know, I was really bored one day and my kids were just playing Frozen non-stop, all day, the movie. So I just said, you know what? I'm not writing a boring one. I'm just not going to write the normal ad today. And so I just wrote this one called, "Do You Wanna Build a Podcast?" And I was like, Olaf agrees that we're the best. And I just went with, you know, mentioned Sven and just all this silly stuff out there.

(Joel Beasley at 00:24:06) And I got the best responses that I've ever got from any email marketing campaign. And it's because it wasn't the same junk, like, "Can I have a meeting on your calendar?" You know? It was something that was interesting. And so I really value creators. I'm curious. You said something. Do you guys support creators making money on your platform? Because typically, for us, we're on different platforms. We have to go get our own advertisers and such. Do you guys, how do you interface with the creators in that?

(Roland at 00:24:34) Oh, people make a living as creators on the platform. Really? Oh, some of the stories you should go research, and I get, again, this is one of those happy places, where you see a young mom who wasn't satisfied, maybe a young single mom who wasn't satisfied with the job she was doing to support her young kids, had a passion for doing soap. So created a soap line, and then went on and did marketing, and did how she made it, how it smells, you know, what you can use it for, and got hundreds of thousands of followers, and is now, has her own soap company that's making a lot more money than she did. We have people that, some of the top music that came out last year that hit the billboards came from creators that are on platform. I mean, the interesting thing, it doesn't matter what your skill is, what your passion is, or what your joy is. You can put it out there. And the more that it connects with people, the more money you can make based on how people engage you. So it's really, really interesting to see the community that has just taken off here.

(Joel Beasley at 00:25:48) I want to plug your book if that's okay. Is it for sale?

(Roland at 00:25:51) Yes. Yes. I would hope so.

(Joel Beasley at 00:25:54) What's the title of it?

(Roland at 00:25:55) "How to Become a Next Generation Chief Security Executive."

(Joel Beasley at 00:25:59) Nice. And if I were to read one chapter of that book, which chapter should it be?

(Roland at 00:26:03) I think one of my favorite chapters is on the chapter of convergence and why that's important. And in the security space, you know, typically you have a CISO side of the house and a corporate security director side of the house and risk management side of the house. I think the focus in the future of enterprise defense and security is really around the concept of the totality of security, how we make decisions, how we drive controls, how we evaluate risk. And it's hard to do that and have a discussion with the CEO at the same time while he has four or five different security or risk practitioners coming to them. So there's a whole section on convergence that's focused on why it's important to have holistic security business leaders.

(Roland at 00:26:54) That's why we kind of named the book the way we did. The focus on the business and the consolidation of security practices to have a singular picture for the company, to make fast, informed, educated decisions, and to be able to execute across a broad set of security capabilities to fight whatever needs to be fought. And whether it's a fraud issue, a cyber issue, an intrusion issue, a workforce protection issue, whatever it may be, how do you do that, make decisions fast, and understand the impact to the company? That's what convergence is all about.

(Joel Beasley at 00:27:29) Excellent. Well, we'll put a link to the book in the show notes so people can click and buy it. One last question for you. The best piece of leadership advice that you've ever received?

(Roland at 00:27:39) Lead from in front. I mean, I come from the military. I was trained in leadership in the military. Best leaders I've ever followed, you know, led from the front. And they engage with the people who do the work. The closer you are to the work, the closer you understand the mission space and what your people are going through, the better leader you're going to be. So lead from in front.

(Joel Beasley at 00:28:07) Thank you so much for listening. And if you found this episode useful, please share it with a friend or colleague who you think would get value from it. And if you have topics that you would like to hear discussed on the podcast, either add me on LinkedIn, or send me an email, [email protected]. Every time I get an email or LinkedIn message, it absolutely makes my day and inspires me to keep going.