4 ms·

Now think about the implications with respect to Twitter DMs that show up in criminal investigations. For instance, consider the Twitter DMs exchanged by Donal

Now think about the implications with respect to Twitter DMs that show up in criminal investigations. For instance, consider the Twitter DMs exchanged by Donald Trump, Jr and WikiLeaks. In that particular case, the communication was acknowledged by the party in question, but imagine the two possibilities thousands of employees being able to act on the part of users opens up: 1. Twitter employees could fabricate a criminal conspiracy by creating messages between multiple Twitter accounts. 2. A criminal conspiracy can now use the "Wasn't me, must have been some random Twitter employees" defense.

bequanna 4y ago
This seems like a huge win for the defense in a case using DMs or Tweets as evidence. It would be quite easy to argue that a highly-politicized org like Twitter _might_ alter tweets or DMs to implicate someone in the opposing party. That’s reasonable doubt that at least some jurors would buy.
- saalweachter 4y ago
  Perfidy could still happen in a tightly controlled system, where only a small number of people could view or modify user data, in a way that requires multiple individuals to sign off on it, and both the access and the modifications were internally logged and audited. But that turns into "there was a sizeable conspiracy to fabricate evidence", as opposed to "a random person out of 2000 got bored, had a grudge, decided to have a laugh, and was acting alone".
- minhazm 4y ago
  Usually these sorts of systems have very detailed logs and those logs are kept for a long time for things like lawsuits. In the hypothetical scenario you're describing the other party would subpoena Twitter and they would corroborate whether or not someone logged as that user or not.
  - robotnikman 4y ago
    From what the article mentions it sounds like Twitter could very well be lacking those detailed logs and checks...
  - jyrkesh 4y ago
    But part of what this article calls out from the whistleblower's POV is that the logging and auditing systems that would be needed to do that don't exist at Twitter. That users can activate God Mode or get into production systems without any logging or accountability
BeFlatXIII 4y ago
> A criminal conspiracy can now use the "Wasn't me, must have been some random Twitter employees" defense. I could see this being billed as a feature of a privacy-forward chat platform. Messages are slipped into conversations without either party having actually sent them and no way to tell whether they were real or not.
- vineyardmike 4y ago
  I’ve heard of similar things to this being discussed… Eg. simple things like tracking-busters where it randomly clicks links in headless chrome to fool the algorithm, p2p vpns where you use a random user’s IP address to randomize who made what request, etc. There is also a school of thought that you should periodically publish private keys for plausible deniability (“was it me, or did someone sign that after I published the key”).
  - BeFlatXIII 4y ago
    Long live deliberate incompetence! Let's fill the world with a cloud of uncertainty.
    - vineyardmike 4y ago
      It’s deliberate plausible deniability.
MuffinFlavored 4y ago
> 1. Twitter employees could fabricate a criminal conspiracy by creating messages between multiple Twitter accounts. Could be thwarted by some kind of "source" database column/field/value that says "this is a tweet made by God mode" Whether Twitter has that field, if it is internal only, and if they would share it with the public/a court of law, I have no clue
- saalweachter 4y ago
  Yeah, at the bare minimum what you want to see is: 1. No employees have direct, immediate access to user accounts or data. 2. Only a small number of employees should ever be able to gain access to user accounts or data, for the purpose of resolving issues directly affecting said accounts or data. 3. Access is only granted to one specific user account at a time, and only for a limited amount of time. 4. Access to a user account requires at least one other person to sign off on the access-grant. 5. Every operation performed upon a user account -- viewing a field, modifying a field -- is logged in a place the people from #2 and #4 do not have access to. 6. Access logs are routinely audited for perfidy. 7. Gaining accesses to user accounts or interacting with them in a way that is not necessary or attempting to circumvent the above process must be a don't-bother-cleaning-out-your-desk-we'll-do-it-for-you offense. With policies in place like that, you reduce the insider risk to user accounts. You need multiple people directly involved in secretly accessing or taking over a user account, and you potentially need dozens of others (the potential auditors) to be complicit. The more people you have involved, the more likely it is someone shuts it down, or at least blows the whistle on it when shit hits the fan. If someone can just get drunk one night, open up a user account, tweet something, then SSH over to the audit server and drop the rows from the access log indicating what they did, and there's no way to even prove something happened, let alone who did it.

bequanna 4y ago

This seems like a huge win for the defense in a case using DMs or Tweets as evidence. It would be quite easy to argue that a highly-politicized org like Twitter _might_ alter tweets or DMs to implicate someone in the opposing party. That’s reasonable doubt that at least some jurors would buy.

saalweachter 4y ago
Perfidy could still happen in a tightly controlled system, where only a small number of people could view or modify user data, in a way that requires multiple individuals to sign off on it, and both the access and the modifications were internally logged and audited. But that turns into "there was a sizeable conspiracy to fabricate evidence", as opposed to "a random person out of 2000 got bored, had a grudge, decided to have a laugh, and was acting alone".
minhazm 4y ago
Usually these sorts of systems have very detailed logs and those logs are kept for a long time for things like lawsuits. In the hypothetical scenario you're describing the other party would subpoena Twitter and they would corroborate whether or not someone logged as that user or not.
- robotnikman 4y ago
  From what the article mentions it sounds like Twitter could very well be lacking those detailed logs and checks...
- jyrkesh 4y ago
  But part of what this article calls out from the whistleblower's POV is that the logging and auditing systems that would be needed to do that don't exist at Twitter. That users can activate God Mode or get into production systems without any logging or accountability

BeFlatXIII 4y ago

> A criminal conspiracy can now use the "Wasn't me, must have been some random Twitter employees" defense. I could see this being billed as a feature of a privacy-forward chat platform. Messages are slipped into conversations without either party having actually sent them and no way to tell whether they were real or not.

vineyardmike 4y ago
I’ve heard of similar things to this being discussed… Eg. simple things like tracking-busters where it randomly clicks links in headless chrome to fool the algorithm, p2p vpns where you use a random user’s IP address to randomize who made what request, etc. There is also a school of thought that you should periodically publish private keys for plausible deniability (“was it me, or did someone sign that after I published the key”).
- BeFlatXIII 4y ago
  Long live deliberate incompetence! Let's fill the world with a cloud of uncertainty.
  - vineyardmike 4y ago
    It’s deliberate plausible deniability.

MuffinFlavored 4y ago

> 1. Twitter employees could fabricate a criminal conspiracy by creating messages between multiple Twitter accounts. Could be thwarted by some kind of "source" database column/field/value that says "this is a tweet made by God mode" Whether Twitter has that field, if it is internal only, and if they would share it with the public/a court of law, I have no clue

saalweachter 4y ago
Yeah, at the bare minimum what you want to see is: 1. No employees have direct, immediate access to user accounts or data. 2. Only a small number of employees should ever be able to gain access to user accounts or data, for the purpose of resolving issues directly affecting said accounts or data. 3. Access is only granted to one specific user account at a time, and only for a limited amount of time. 4. Access to a user account requires at least one other person to sign off on the access-grant. 5. Every operation performed upon a user account -- viewing a field, modifying a field -- is logged in a place the people from #2 and #4 do not have access to. 6. Access logs are routinely audited for perfidy. 7. Gaining accesses to user accounts or interacting with them in a way that is not necessary or attempting to circumvent the above process must be a don't-bother-cleaning-out-your-desk-we'll-do-it-for-you offense. With policies in place like that, you reduce the insider risk to user accounts. You need multiple people directly involved in secretly accessing or taking over a user account, and you potentially need dozens of others (the potential auditors) to be complicit. The more people you have involved, the more likely it is someone shuts it down, or at least blows the whistle on it when shit hits the fan. If someone can just get drunk one night, open up a user account, tweet something, then SSH over to the audit server and drop the rows from the access log indicating what they did, and there's no way to even prove something happened, let alone who did it.