Twitter in turmoil after month of crisis leads to concerns over leadership
A month of crisis at Twitter has reignited concerns that the company’s parttime chief executive and years of accumulated “technical debt” have left it dangerously vulnerable to malicious attackers and lacking the leadership required to take rapid action or controversial decisions.
In mid-July, Twitter suffered an unprecedented security breach as hackers seized control of the accounts of major public figures and corporations, including Joe Biden, Barack Obama, Elon Musk, Bill Gates and Jeff Bezos.
The attackers, thought to have been initially motivated by seizing control of valuable usernames such as “@Joe”, mainly used their newfound access to promote a bitcoin scam that netted them a little under $200,000.
The outcome was widely seen as good fortune for Twitter; the worstcase scenario, observers noted, could have instead been somewhere on a spectrum from a mass leak of private direct messages to the instigation of a nuclear war. “Access gained through this administrator tool could have caused far greater damage and far wider damage than it did,” Dr Alexi Drew, a research associate at King’s College London, told Vice.
But within the month, it became clear that Twitter had been even luckier than it looked. The hackers had gained access to the company’s back end through an administrator tool intended to allow customer service to help users regain access to accounts to which they had forgotten the password.
In many companies, such as Uber and Facebook, that sort of tool is managed with strict access controls. Only those staff members who need to use the tool for their job can log into the dashboard, and everyone on the list has to go through a regular audit to ensure they still need the access and haven’t abused their rights.
At Twitter, the New York Times reported, the username and password for the admin panel were simply stored in Slack, the company’s internal message board. Anyone with access to that Slack channel could also access those credentials, and use them to reset the password for any other account.
In total, more than 1,000 people could have accessed the credentials, according to a Reuters report, including some who didn’t even work at the company. “If you can get access to the internal administrative tools, or to someone who has them, you can take over anyone’s account virtually anywhere,” said Allison Nixon, chief research officer at information security company Unit 221B. And yet access to the tools was not only unmetered, but was regularly abused.
Less than two years ago, for instance, “Some contractors made a kind of game out of creating bogus helpdesk inquiries that allowed them to peek into celebrity accounts, including Beyonce’s, to track the stars’ personal data,” Bloomberg reported last week.
According to insiders at the company, building real access controls has long been on the to-do list. But like so much at Twitter, work that should have been done as soon as possible has dragged out to take years, and work that would normally take years looks destined never to see the light of day.
As one Silicon Valley insider put it: “An intern project at Facebook is like an entire cross functional team’s multiple sprints at Twitter.” That means, for example, that a seemingly simple feature such as expanding the character count of a tweet from 140 to 280, first publicly discussed in January 2016, can take almost two years to finally launch in November 2017.
According to current and former staff members, there are multiple reasons for the slow progress. Part of it is simply the years of accumulated “technical debt”: work such as rewriting older software which is easy to delay, but slows down more urgent work in the process. Part of it is the company’s relative size in the San Francisco tech scene, which means it struggles to match the salaries paid by peers such as Facebook and Google.
Twitter declined to comment for this piece, but a spokesperson pointed the Guardian to a blogpost from December 2019, in which the company’s product lead, Kayvon Beykpour, said: “Twitter has changed a lot since the first Tweet was sent almost 14 years ago. As was, and still is, common in fastgrowing tech companies, we built new features and services on top of older systems. In some cases, the older systems were never made to support their current uses — that’s technical debt.
“Tackling technical debt is an ongoing challenge for every company, and we’ve been doing it for years.”
But technical debt isn’t the only problem insiders point to. Some look to the top, where chief executive, Jack Dorsey, splits his time between Twitter and Square, the fintech startup he founded in the years between being fired as Twitter’s chief executive in 2008 and his rehiring in 2015.
“Jack doesn’t like to micromanage” is how one current employee charitably put it. But others have described a company where it is rarely clear who has ultimate authority over particular products and areas, and where it’s difficult to find leadership in a crisis.
Joseph Evans, an analyst at Enders Analysis, says that there are “legitimate questions” to be asked about Dorsey’s role, “when you get specific failings around security or the product pipeline. Big tech has always promoted the idea of culture flowing from one or two people at the top. The idea of boy-genius messiahs helped them raise money on the way up, and I think there has to be accountability on the way down.”
Those failings, one former employee speculated, could have been the reason for the five-day delay between a racist rant from grime star Wiley on Friday evening and his eventual removal from the platform on Wednesday morning.
A spokesperson for Campaign Against Antisemitism said: “Not only does Twitter deliberately refuse to remove antisemitic material at times, but even when it does make the right decision, as with Wiley, it takes days and heavy external pressure to do so. Whether because the company has a part-time chief executive or lacks the resources for elementary corporate responsibility, it needs to explain and remedy such dysfunction.”
For Enders’ Evans, there’s a simpler way out: “Twitter needs to focus on the basics,” he says. “Make sure the platform