A former Twitter security person, Peiter Zatko, has filed a whistleblower’s complaint with the Securities and Exchange Commission, the Federal Trade Commission and the Justice Department, alleging (amongst other things) that a foreign government had forced Twitter to hire government agents, who had access to internal data, and that a U.S. official had warned the company that one or more of its employees were working on behalf of a foreign intelligence agency.
Given the sensitive political nature of some of the debate on Twitter, it is easy to see why this might be a concern.Yet even without agents of foreign powers on the payroll, Twitter is staffed by human beings and human beings are imperfect. Look at the recent case of a former Twitter employee who was found guilty of accepting bribes in return for providing the identifying information of an account critical of Saudi Arabia as well protected information on other accounts.
Even without corruptible employees, things can still go wrong. Earlier this year Twitter confirmed that it had had a data breach that exposed information on more than five million accounts. The breach was down to a vulnerability that allowed any party without any authentication to obtain the twitter ID (which is almost equal to getting the username of an account) of any user by submitting a phone number/email even if the user had prohibited this action in their privacy settings. In response to this breach, Twitter posted a statement saying that they understand the risks that an incident like this poses and recommend "not adding a publicly known phone number or email address to your Twitter account”. Basically they recommend burner phones and disposable e-mail addresses (kind of like the Apple pseudonymous e-mail addresses).
Wise precautions I suppose, although not everyone has access to a burner phone.As it happens, Twitter is now testing a new profile badge for people who have verified their phone numbers. This could be to signal that an account with such as badge is not a bot, which the company says is one of the ways that helps people find credible info and gives more information about different types of accounts. But is that the best way to test hotness?
Nuclear Options
How much longer are we going to put up with this? Step one: App or website asks for personal information such date of birth, phone number or mother’s maiden name for “security” although none of the information contributes in any way to transaction security. Step two: App or website gets hacked and your personal information is now in the hands of scammers, nation state cyber warriors and perverts. Step three: Rinse and repeat.
Data is not the new oil it is the new plutonium and personal data is the new nuclear waste. Twitter as a nuclear waste containment facility is not a viable business, so they should get out of it.