Twitter fined nearly $550,000 in Europe for response to bug that exposed private tweets

The decision stems from a bug that allowed thousands of people's private tweets to be made public between late 2014 and early 2019.

Regulators in Ireland have fined Twitter for failing to report a data breach promptly and not adequately documenting the incident, marking the first time the regulator has penalized a “big tech” company for violations of Europe’s data protection law.

The fine of 450,000 euros, or about $550,000, stems from a bug that allowed thousands of people’s private tweets to be made public between late 2014 and early 2019, when Twitter reported the problem to European authorities. The social media company said it could only identify specific users affected by the breach from September 2017 onward — about 89,000 total over that stretch. The bug only affected users of Twitter’s Android app.

Ireland’s Data Protection Commission issued the decision Tuesday on behalf of the European Union, under the EU’s General Data Protection Regulation (GDPR). Twitter’s European headquarters are in Ireland, as are those of Google, Facebook and several other multibillion-dollar U.S. tech companies, meaning the Irish regulator often takes the lead on this kind of incident.

The DPC called the fine “effective, proportionate and dissuasive measure.” Twitter found out about the breach in December 2018, but did not notify the commission until Jan. 8, 2019 — well beyond the 72-hour window stipulated under GDPR. The commission also said Twitter failed to comply with rules allowing for full documentation of which users were affected and when. GDPR went into effect in May 2018.

Twitter announced the bug publicly on Jan. 17, 2019. Before that patch was issued, if a user of the Android version of the company’s app happened to change the email address associated with their account, the “Protect Your Tweets” feature was inadvertently disabled.

In a statement issued Tuesday to multiple news outlets, the company said it had worked with EU regulators closely on the incident.

“We respect the commission’s decision, which relates to a failure in our incident response process … we have made changes so that all incidents following this have been reported to the commission in a timely fashion,” said Damien Kiernan, Twitter’s chief privacy and global data protection officer, according to the Irish Times.

Twitter has taken steps this year to boost its security credentials, including hiring influential hacker Peiter “Mudge” Zatko as its security chief last month. The company has regularly found itself on the front lines in battling public misinformation about the coronavirus pandemic and the 2020 elections in the U.S.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure