FTC smacks Twitter for privacy lapses

By Julianne Pepitone, staff reporter


NEW YORK (CNNMoney.com) -- Twitter agreed to settle charges that it "deceived customers" and failed to protect their personal information, the Federal Trade Commission said Thursday.

The FTC's complaint against Twitter said "serious lapses" in the service's data security allowed hackers to obtain administrative control of the site multiple times between January and May 2009.

The FTC has brought charges against companies 30 times over faulty data security, but this marked the first such case against a social network.

In January 2009, a hacker used an automated password-guessing tool to submit thousands attempts at Twitter's login page. The hacker eventually obtained the site's administrative password, which was "a weak, lowercase, common dictionary word."

Hackers were then able to access tweets that users had set to private. They also sent fake tweets from nine accounts, including those of President Obama and Fox News.

During a second security breach in April 2009, a hacker was able to access a Twitter employee's personal e-mail account and found two passwords similar to the employee's Twitter administrative password. The hacker was able to use those passwords to guess the employee's Twitter password.

"Put simply, we were the victim of an attack and user accounts were improperly accessed," Alexander Macgillivray, Twitter's general counsel, said in a prepared statement.

Macgillivray said that within hours of the January breach, Twitter closed the security hole, notified affected account holders and posted a statement on its blog post. After the April breach, Twitter cut off the hacker's administrative access within 18 minutes and "quickly notified affected users."

The FTC said Twitter was vulnerable to these attacks because it "failed to take reasonable steps to prevent unauthorized control of its system," including requiring employees to use a hard-to-guess password and suspending administrative accounts after several unsuccessful login attempts.

Under the terms of the settlement, Twitter "will be barred for 20 years from misleading consumers" about its protection of private data. The company will also have to maintain an information security program that a third-party observer will assess every other year for 10 years.

"When a company promises consumers that their personal information is secure, it must live up to that promise," David Vladeck, director of the FTC's Bureau of Consumer Protection, said in a statement.

"Consumers who use social networking sites may choose to share some information with others," Vladeck added, "but they still have a right to expect that their personal information will be kept private and secure."

Twitter has suffered through other embarrassing glitches. In May, thousands of people took advantage of a vulnerability that let users "force" others to become their followers. Twitter quickly patched the glitch, but it had to temporarily take down its "follow" counts to do it.

The FTC smackdown comes at the end of a stretch in which Twitter has been battling its most publicized growing pains to date.

Hammered by World Cup traffic and battling issues with its network infrastructure, Twitter has suffered serious downtime almost every day this month. On Thursday, the site had several of its automated feeds disabled as it worked on stability issues.  To top of page

Frontline troops push for solar energy
The U.S. Marines are testing renewable energy technologies like solar to reduce costs and casualties associated with fossil fuels. Play
25 Best Places to find rich singles
Looking for Mr. or Ms. Moneybags? Hunt down the perfect mate in these wealthy cities, which are brimming with unattached professionals. More
Fun festivals: Twins to mustard to pirates!
You'll see double in Twinsburg, Ohio, and Ketchup lovers should beware in Middleton, WI. Here's some of the best and strangest town festivals. Play
Index Last Change % Change
Dow 16,790.51 112.61 0.68%
Nasdaq 4,473.30 20.51 0.46%
S&P 500 1,961.94 11.12 0.57%
Treasuries 2.27 -0.01 -0.26%
Data as of 3:02pm ET
Company Price Change % Change
Ford Motor Co 13.79 -0.61 -4.24%
Microsoft Corp 45.97 0.95 2.11%
Apple Inc 104.92 0.09 0.08%
Bank of America Corp... 16.65 0.05 0.30%
Yahoo! Inc 43.52 0.92 2.16%
Data as of 2:47pm ET

Sections

Honda CEO, Chairman and 11 other executives take pay cuts after company hit by recall failures. More

With oil and gas prices falling, some in Washington are questioning whether it makes sense to hold 106 days worth of supply in storage. More

Many AT&T U-Verse customers across the country woke up to an emergency alert on their TVs. More

Using technology developed for the military and implemented in Iraq, schools have installed alarm systems that detect gunfire. More

Big purchases often come with big expectations. So it's no wonder that in a recent survey 80% of homebuyers said they regretted at least one thing about their home. Here are ways to improve those odds. More

Most stock quote data provided by BATS. Market indices are shown in real time, except for the DJIA, which is delayed by two minutes. All times are ET. Disclaimer.

Morningstar: © 2014 Morningstar, Inc. All Rights Reserved.

Factset: FactSet Research Systems Inc. 2014. All rights reserved.

Chicago Mercantile Association: Certain market data is the property of Chicago Mercantile Exchange Inc. and its licensors. All rights reserved.

Dow Jones: The Dow Jones branded indices are proprietary to and are calculated, distributed and marketed by DJI Opco, a subsidiary of S&P Dow Jones Indices LLC and have been licensed for use to S&P Opco, LLC and CNN. Standard & Poor's and S&P are registered trademarks of Standard & Poor’s Financial Services LLC and Dow Jones is a registered trademark of Dow Jones Trademark Holdings LLC. All content of the Dow Jones branded indices © S&P Dow Jones Indices LLC 2014 and/or its affiliates.