Twitter’s cybersecurity and privacy lapses echo worldwide

SAN FRANCISCO — From fire departments to governments, from school districts to corporations, from local utilities to grassroots organizers around the world, Twitter at its best is a tool to get a message out quickly, efficiently, directly.

It’s also a constant risk-and-reward calculation.

A recent bombshell whistleblower report from Twitter’s former head of security alleges that the social media company has been negligently lax on cybersecurity and privacy protections for its users for years. While worrisome for anyone on Twitter, the revelations could be especially concerning for those who use it to reach constituencies, get news out about emergencies and for political dissidents and activists in the crosshairs of hackers or their own governments.

“We tend to look at these companies as large, well-resourced entities who know what they’re doing — but you realize that a lot of their actions are ad hoc and reactive, driven by crises,” said Prateek Waghre, policy director at the Internet Freedom Foundation, a digital rights nonprofit in India. “Essentially, they’re often held together by cello tape or chewing gum.”

Peiter “Mudge” Zatko, who served as Twitter’s security chief until he was fired early this year, filed the complaints last month with federal U.S. authorities, alleging that the company misled regulators about its poor cybersecurity defenses and its negligence in attempting to root out fake accounts that spread disinformation. Among Zatko’s most serious accusations is that Twitter violated the terms of a 2011 FTC settlement by falsely claiming that it had put stronger measures in place to protect the security and privacy of its users.

Waghre said the allegations in the complaint about India — that Twitter knowingly allowed the Indian government to place its agents on the company payroll where they had “direct unsupervised access to the company’s systems and user data” — were particularly worrisome. He also pointed to an incident earlier this month where a former Twitter employee was found guilty of passing along sensitive user data to royal family members in Saudi Arabia in exchange for bribes.

The consequences of privacy and security lapses can range from inconvenience and embarrassment — such as when an Indiana State Police account was hacked and tweeted “poo-poo head” earlier this year — to much worse. In October 2021, a Saudi humanitarian aid worker was sentenced to 20 years in prison because of an anonymous, satirical Twitter account that the kingdom says he ran. It’s possible that the case is linked with the men accused of spying on behalf of the kingdom while working at Twitter.

As an advocate for dissidents and others detained in Saudi Arabia, Bethany Al-Haidari has been concerned for years about Twitter’s user privacy safeguards. The new whistleblower allegations make her all the more worried.

“Given what we know about how social media is used around the world, that is incredibly problematic,” said Al-Haidari, who works for The Freedom Initiative, a U.S.-based human rights group. The possibility of hackers or governments exploiting the alleged cybersecurity lapses at Twitter to get users’ identities, private messages or other personal information “is quite disturbing to me,” she said.

Chinese-Australian artist and activist Badiucao, who regularly publishes art that criticizes the Chinese Communist Party, expressed concern about the whistleblower’s allegations, noting that many users provide their phone numbers and emails to Twitter.

“Once that personal information is leaked, it could be used to trace your identity,” he said. Badiucao said he regularly receives death threats and propaganda from what appears to be bot or spam accounts.

But the artist plans to keep using Twitter, saying it’s probably the best option Chinese-speaking activists and artists have for a “shelter for free speech.”

Twitter says the whistleblower claims present a “false narrative” about the company and its privacy and data security practices, and that the claims lack context. “Security and privacy have long been company-wide priorities at Twitter and will continue to be,” the company said in a statement.

Despite the heightened concerns sparked by Zatko’s claims, none of the groups The Associated Press spoke to this week plan to stop using Twitter. Security experts say while the whistleblower’s claims are alarming, there’s no reason for individual users to delete their accounts.

High-profile Twitter users and world governments may be at greater risk than average users, experts say. In 2020, for instance, Twitter suffered an embarrassing hack by a teenager who accessed the accounts of then-President Barack Obama, Joe Biden, Mike Bloomberg and a number of tech billionaires including Tesla CEO Elon Musk and Amazon founder Jeff Bezos. Musk is currently embroiled in a battle with Twitter as he tries to back out of a $44 billion deal to buy the company.

Yet another security incident raised alarms for Jennifer Grygiel, a Syracuse University communications professor who follows Twitter closely. In 2017, a Twitter customer support worker deactivated then-President Donald Trump’s account for a few minutes during their last day on the job. While the account was restored quickly, Grygiel said, the incident showed how vulnerable Twitter was when it comes to governments, heads of state and military branches that use the platform.

“Am I surprised and shocked by the whistleblower’s allegations? I’m not,” said Trav Robertson, chair of the South Carolina Democratic Party, which uses Twitter to communicate with about 18,700 followers. But he argues that it’s especially important for people not to assume that “the constant attacks on our emails, our databases, our Twitter accounts, our Facebooks” are the new normal. “When we become desensitized to it, we fail to be proactive,” he said.

At the City of Denver’s fire department, public information officer JD Chism acknowledges concern over security issues. But the department has to weight that risk against the way Twitter has become integral to communicating emergencies to the public. The department’s Twitter feed hosts real-time updates on fires and consequent road closures and injuries, alongside retweets from other agencies warning of dangers such as flash floods.

For now, the department will keep using Twitter as it always has, Chism said, “It’s good for taking care of people, and that’s what we are here for.”

Associated Press Writers Krutika Pathi in New Delhi; Jesse Bedayn in Denver; Jennifer Peltz in New York; James Pollard in South Carolina; Zen Soo in Hong Kong; Margaret Stafford in Kansas City; Russ Bynum in Savannah, Georgia; Jay Reeves in Birmingham, Alabama; Amy Taxin in Orange County, California; Rebecca Santana in New Orleans; Jonathan Mattise in Nashville, Tennessee; and Michael Goldberg in Jackson, Mississippi, contributed to this story.