There came a point ten years ago when Aynne Kokas realized that she could no longer keep WeChat on her personal phone. She had begun research on what would eventually become her new book, “Trafficking Data: How China is Winning the Battle for Digital Sovereignty,” published this month. 

WeChat is an omnipresent Chinese messaging app, and Kokas, a media studies professor at the University of Virginia, needed it to talk to Chinese sources for her research. But, as Kokas told me, it soon became “a very meta experience.” To have WeChat on her personal phone meant that “you were subjecting yourself to precisely the type of surveillance that you were writing about.”

In the book, Kokas analyzes how Chinese firms and the Chinese government gather data on U.S. citizens for political and commercial gain, putting U.S. national security at risk. China is able to do this, Kokas points out, in part because the U.S. government does not have substantial regulations in place to protect users and their data.

“By tracing how China and the US have shaped the global movement of data, I hope this book empowers citizens around the world to navigate the complex terrain created by Silicon Valley, Washington, and Beijing,” she writes.

I recently spoke with Kokas on the phone. Our conversation has been edited for length and clarity. 

What do “digital sovereignty” and “data trafficking” mean in layman’s terms? 

Digital sovereignty is the idea of control over a country’s digital resources. Digital sovereignty is something that we see in countries that are trying to protect their digital domain from oversight from other countries. The Chinese government has a more expansive vision called cyber sovereignty, which is that any digital space that a country touches should be part of their digital domain.

Data trafficking is the movement of data from one country to another without the consent of users and without their understanding of the implications of their data being moved between national data regimes. For example, if I sign up for TikTok here in the U.S. and I find out that my data has been accessed in another country, that would be data trafficking. 

My favorite line in the book is when you write, “Most people are simply not exciting intelligence targets.” So what are the implications of data trafficking for most Americans in their daily lives? 

People are afraid that they are individually going to be targeted, and there are some scary stories, but ultimately the more interesting data for the Chinese government and for Chinese firms is actually at scale. So while you might not personally be interesting, you plus all of your neighbors, or you plus all of the people in your state, yield really rich insights that can enable the tracking and mapping of a whole society.

And while most people aren’t that interesting, there are specific subgroups that face intensive targeting, like Hong Kong democracy activists, as well as Uyghur and Tibetan activists. 

I also think there are other layers that are significant. One is economic risk. U.S. companies can’t gather data in China the same way that Chinese companies can in the United States, and that creates a fundamental asymmetry in the development of the digital economy in ways that will have long-standing implications for the development of products. At a certain point, it’s not necessarily just about spying or surveillance. It’s about what types of products you can build.

The third issue is national security. These platforms are becoming essential in daily life and the functioning of society. For example, TikTok now functions as a form of critical communications infrastructure. Chinese firms have also become involved in gathering and using health data and agricultural data from the United States. If that breaks down or if the Chinese government decides to pull participation from these firms, which they can do, it leads to a fundamental destabilization of key areas in the U.S. and global economy — areas like communication, health, food production. 

That’s not a risk that I think most people want to take.

Do you think the United States is at fault for not better protecting user data? Or is China more at fault for taking advantage of those weaknesses? 

A lot of China’s ability to go into other countries and propose tech platforms that rapidly gather data builds on the fact that U.S.-based companies have already been there. A great example of this is TikTok being officially based in the Cayman Islands. This is a classic move by U.S. firms to escape U.S. government scrutiny. And TikTok adopted this, so while their headquarters are officially in Beijing, they’re domiciled in the Cayman Islands. The other thing that U.S. firms pioneered was a lack of algorithmic transparency. And that’s at the foundation of a lot of these business models from which many Chinese entrepreneurs learn to grow their businesses.

The first and most important thing the U.S. government should do is pass national data regulations that have actual enforcement requirements in place. But there are significant differences within the U.S. government about what is and is not acceptable in terms of government oversight over corporations, as well as oversight over data. And even if laws are passed, enforcement is still really challenging. 

You present these issues as being contested, but it seems that the U.S. isn’t putting up much of a fight. 

The title should be something like, “China is taking over the digital world, and the U.S. kind of agreed to it.” But people I interviewed in the U.S. government and tech corporations would argue that by not heavily regulating the U.S. digital landscape, U.S. platforms are able to grow and compete with China that way. The other aspect is this resistance to changing U.S. data governance policies because that would be “letting China win” by adopting too many aspects of the Chinese model. I don’t fully agree with that framework. 

You wrote that you felt a sense of urgency while working on the book. Why did you feel that way? 

A lot of people outside China haven’t experienced China’s digital control directly, so they don’t understand the seriousness of what it means for that model to be exported and how difficult it is to put the genie back in the bottle once it’s out.