The Riverside Press-Enterprise
Lawyer calms staff fearing Twitter may have FTC lapses
Layoff of firm’s security personnel leads workers to worry they would go to jail for breaking decree
After losing thousands of employees and top compliance officials at Twitter, Elon Musk’s deputies are racing to contain heightened concerns that staff will be held liable for security lapses.
Musk’s lawyer Alex Spiro, who is guiding the legal team following the billionaire’s acquisition, sought to reassure employees that they would not go to jail if the company is found in violation of a Federal Trade Commission consent decree, according to a message viewed by Bloomberg.
“I understand that there have been employees at Twitter who do not even work on the FTC matter commenting that they could go to jail if we were not in compliance — that is simply not how this works,” the Quinn Emanuel Urquhart & Sullivan LLP lawyer wrote. “It is the company’s obligation. It is the company’s burden. It is the company’s liability.”
An information security team at Twitter that oversaw sharing of user data with advertisers and research partners was laid off after the takeover, a move that triggered internal concerns about vulnerability to security threats and potential violations of FTC rules, according to two people familiar with the matter.
The layoffs, which started Nov. 3 and affected 50% of all Twitter employees, have contributed to a chaotic atmosphere within the company and were followed this week by the resignations of senior executives, including Chief Information Security Officer Lea Kissner, Chief Privacy Officer Damien Kieran and Chief Compliance Officer Marianne Fogarty.
Spiro said Twitter had spoken to the FTC and has its first compliance check upcoming.
“The legal department is handling it,” he said in his note.
The move to scrap the six-person information security team was combined with layoffs of at least a dozen other employees working on security, privacy and compliance issues at the company, the people said. The full size of those teams wasn’t immediately available.
The layoffs and departures are particularly noteworthy at a company that is under an FTC consent decree in which it agreed to better protect users’ personal data and also has to submit to regular audits of its privacy and data security systems. Twitter has been sharply criticized by former employees for security lapses, and in May was subject to a $130 million fine as part of a settlement with the FTC and Department of Justice over data privacy.
The information security team was focused on third-party risk management and was responsible for providing security assurances to advertisers that work with Twitter and share data with the company, according to the two people familiar with the matter, who spoke on condition of anonymity as they aren’t authorized to discuss the situation publicly.
The team also monitored Twitter’s sharing of user data with dozens of commercial partners and research organizations, some of whom have access to a programming interface that can be used to view sensitive non-public information about Twitter users, such as location data, IP addresses and unique device identification codes, the people said.
“The people at Twitter doing the checks on that access are simply not there anymore,” one of the people said, adding that the privacy and security of user data has been put at risk as a result.
The work carried out by the laid off information security team was partly intended to ensure compliance with a consent decree issued by the FTC in March 2011, according to the people. The decree, effective until 2042, ordered that Twitter must establish and maintain “a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of non-public consumer information.” Violations can result in large fines.