Twitter Settles FTC Complaint
June 24, 2010
| 12:05 PM
The FTC announced Thursday that Twitter has settled charges that the social networking service failed to protect consumer privacy by providing inadequate security for user information.
The FTC alleged that Twitter's weak security controls allowed hackers to obtain administrative control of the social networking site and to access its user's accounts. The breach allowed the hackers to send out phony tweets from January through May 2009 pretending to be from on at least one occasion then-President-elect Barack Obama, as well as from Fox News and others. The one phony tweet pretending to be from Obama offered his 150,000 followers a chance to win $500 in free gasoline.
In the complaint, the FTC claimed that contrary to statements on its Web site, Twitter "has engaged in a number of practices that, taken together, failed to provide reasonable and appropriate security to: prevent unauthorized access to nonpublic user information and honor the privacy choices exercised by its users in designating certain tweets as nonpublic."
Using an automated password-guessing tool, the complaint alleged that hackers were able to gain administrative control of Twitter, after guessing the "weak, lower case common dictionary" administrative password used to gain access to Twitter's system. The hacker than used the password to reset numerous passwords, which were then posed on a Web site available to many others, the FTC said.
Under the terms of the settlement, Twitter will be prohibited for 20 years from misleading consumers about the extent to which it "maintains and protects the security, privacy, and confidentiality of nonpublic consumer information, including the measures it takes to prevent authorized access to information and honor the privacy choices made by consumers." The company also must establish and maintain a "comprehensive" security program, which will be assessed by a third party every other year for 10 years, the FTC said.
"When a company promises consumers that their personal information is secure, it must live up to that promise," FTC Bureau of Consumer Protection Director David Vladeck said in a statement.
In a blog post, Twitter noted that it moved quickly to address the security breaches when they occurred and informed its users about the problem. "Even before the agreement, we'd implemented many of the FTC's suggestions and the agreement formalizes our commitment to those security practices," the firm said in the post.
Join the Discussion
The National Journal Group has the right (but not the obligation) to monitor the comments and to remove any materials it deems inappropriate.
Comments powered by Disqus