FTC concludes Twitter didn’t violate data security rules, in spite of Musk's orders

FTC concludes Twitter didn’t violate data security rules, in spite of Musk's orders

The Federal Trade Commission (FTC) concluded Elon Musk ordered Twitter (now X) employees to take actions that would have violated an FTC consent decree regarding consumers’ data privacy and security. The investigation arose from the late 2022 episode informally known as “<a data-i13n="cpos:1;pos:1" href="https://www.engadget.com/jack-dorsey-twitter-files-011249897.html">The Twitter Files[/url],” where Musk ordered staff to let outside writers access internal documents from the company’s systems. However, the FTC says Twitter security veterans “took appropriate measures to protect consumers’ private information,” likely sparing Musk’s company from government repercussions by ignoring his directive.
FTC Chair Lina Khan discussed the conclusions in a <a data-i13n="elm:context_link;elmt:doNotAffiliate;cpos:2;pos:1" class="no-affiliate-link" href="https://www.ftc.gov/system/files/ftc_gov/pdf/letterresponsekhanjordan20240221.pdf" data-original-link="https://www.ftc.gov/system/files/ftc_gov/pdf/letterresponsekhanjordan20240221.pdf">public letter[/url] sent Tuesday to House Judiciary Committee Chair Jim Jordan, as <a data-i13n="elm:context_link;elmt:doNotAffiliate;cpos:3;pos:1" class="no-affiliate-link" href="https://www.washingtonpost.com/technology/2024/02/21/x-twitter-jordan-ftc-musk/" data-original-link="https://www.washingtonpost.com/technology/2024/02/21/x-twitter-jordan-ftc-musk/">reported by[/url] The Washington Post. Jordan and his Republican colleagues have <a data-i13n="elm:context_link;elmt:doNotAffiliate;cpos:4;pos:1" class="no-affiliate-link" href="https://www.pbs.org/newshour/nation/house-republicans-interrogate-ftc-chair-over-big-tech-regulation-harassment-of-twitter" data-original-link="https://www.pbs.org/newshour/nation/house-republicans-interrogate-ftc-chair-over-big-tech-regulation-harassment-of-twitter">tried[/url] to turn the FTC’s investigation into a political wedge issue, framing the inquiry as a free speech violation — perhaps to shore up GOP support from Musk’s legion of rabid supporters. Jordan and his peers previously described the investigation as “attempts to harass, intimidate, and target an American business.”
Khan’s response to Jordan adopts a tone resembling that of a patient teacher explaining the nuance of a complicated situation to a child who insists on seeing simplistic absolutes. “FTC staff efforts to ensure Twitter was in compliance with the Order were appropriate and necessary, especially given Twitter’s history of privacy and security lapses and the fact that it had previously violated the 2011 FTC Order,” Khan wrote.
“When a firm has a history of repeat offenses, the FTC takes particular care to ensure compliance with its orders,” she continued.
In an emailed statement to Engadget, FTC Office of Public Affairs director Douglas Farrar wrote, “When we heard credible public reports of potential violations of protections for Twitter users’ data, we moved swiftly to investigate. The order remains in place and the FTC continues to deploy the order’s tools to protect Twitter users’ data and ensure the company remains in compliance.”
<figure><img src="https://s.yimg.com/os/creatr-uploaded-images/2024-02/726a38c0-d0eb-11ee-bfdf-f0d4bd1f30f6" data-crop-orig-src="https://s.yimg.com/os/creatr-uploaded-images/2024-02/726a38c0-d0eb-11ee-bfdf-f0d4bd1f30f6" style="height:5089px;width:7635px;" alt="UNITED STATES - OCTOBER 24: Rep. Jim Jordan, R-Ohio, is seen outside a House Republican Conference speaker of the House election meeting in Longworth Building on Tuesday, October 24, 2023. (Tom Williams/CQ-Roll Call, Inc via Getty Images)" data-uuid="97dc91af-ad98-3dd5-a009-42d2b87771ac"><figcaption>House Judiciary Chair Jim Jordan (R-OH)</figcaption><div class="photo-credit">Tom Williams via Getty Images</div></figure>
The <a data-i13n="cpos:5;pos:1" href="https://www.engadget.com/the-ftc-is-investigating-elon-musks-handling-of-twitter-blue-and-the-twitter-files-233539305.html">FTC’s investigation stemmed from allegations[/url] that Musk, newly <a data-i13n="cpos:6;pos:1" href="https://www.engadget.com/how-elon-musk-bought-and-took-over-twitter-180045278.html">minted as Twitter’s owner[/url], ordered staff to give outside writers “full access to everything” in late 2022. Had staff obeyed Musk’s directive, the company likely would have violated a settlement with the FTC (originally from 2011 but updated in 2022) requiring the company to tightly restrict access to consumer data.
In November 2022, the FTC <a data-i13n="elm:context_link;elmt:doNotAffiliate;cpos:7;pos:1" class="no-affiliate-link" href="https://www.businessinsider.com/ftc-tracking-elon-musk-twitter-deep-concern-privacy-execs-quit-2022-11" data-original-link="https://www.businessinsider.com/ftc-tracking-elon-musk-twitter-deep-concern-privacy-execs-quit-2022-11">said[/url] publicly it was monitoring Twitter’s developments following Musk’s acquisition with “deep concern.” That followed the resignation of chief information security officer Lea Kissner and other members of the company’s data governance committee. They expressed concerns that Musk’s <a data-i13n="cpos:8;pos:1" href="https://www.engadget.com/twitter-blue-verification-impersonation-disaster-203656712.html">launch of a new account verification system[/url] didn’t give them adequate time to deploy security reviews required by the FTC.
Ultimately, Twitter security veterans ignored Musk’s “full access to everything” order. “Longtime information security employees at Twitter intervened and implemented safeguards to mitigate the risks,” Khan wrote in the letter. “The FTC’s investigation confirmed that staff was right to be concerned, given that Twitter’s new CEO had directed employees to take actions that would have violated the FTC’s Order.”
<figure><img src="https://s.yimg.com/os/creatr-uploaded-images/2024-02/ea259e90-d0eb-11ee-af77-7aee42649e9f" data-crop-orig-src="https://s.yimg.com/os/creatr-uploaded-images/2024-02/ea259e90-d0eb-11ee-af77-7aee42649e9f" style="height:4128px;width:6192px;" alt="NEW YORK, NEW YORK - NOVEMBER 29: Lina Khan, Chairperson of the Federal Trade Commission, speaks onstage during The New York Times Dealbook Summit 2023 at Jazz at Lincoln Center on November 29, 2023 in New York City. (Photo by Slaven Vlasic/Getty Images for The New York Times)" data-uuid="c8dab0db-6dba-352c-a021-a35d0bb75829"><figcaption>FTC Chair Lina Khan</figcaption><div class="photo-credit">Slaven Vlasic via Getty Images</div></figure>
Rather than supplying outside writers with the “full access” Musk wanted them to have, Twitter employees accessed the systems and relayed select information to the group of outsiders. “Ultimately the third-party individuals did not receive direct access to Twitter’s systems, but instead worked with other company employees who accessed the systems on the individuals’ behalf,” Khan wrote.
The FTC says it will continue to monitor X’s adherence to the order. “When we heard credible public reports of potential violations of protections for Twitter users’ data, we moved swiftly to investigate,” FTC spokesman Douglas Farrar said in a statement to The Washington Post. “The order remains in place and the FTC continues to deploy the order’s tools to protect Twitter users’ data and ensure the company remains in compliance.”
Update, February 22, 2024, 1:23 PM ET: This story has been updated to add a statement from an FTC director.This article originally appeared on Engadget at https://www.engadget.com/ftc-concludes-twitter-didnt-violate-data-security-rules-in-spite-of-musks-orders-191917132.html?src=rss

Source: FTC concludes Twitter didn’t violate data security rules, in spite of Musk's orders