7 ms·

In Our Inbox: Hundreds Of Confidential Twitter Documents

68 points by vaksel 17y ago

jcapote 17y ago
It's official: micheal arrington is the perez hilton of the tech world. But seriously, how is this in any way legal? I almost can't believe it, it seems like a hoax...
- vaksel 17y ago
  it may be somewhat unethical, but its legal. If you couldn't write about anything "confidential" the news companies would be out of business.
  - greyman 17y ago
    Yes, this is what Michael is pointing out and he is somewhat right. Otherwise, if something negative leaks out of the company, they might just call it confidential and nobody could publish it...
  - barrkel 17y ago
    Why doesn't it count as trafficking in stolen property? The documents weren't leaked, they were stolen. They are not "confidential", they are stolen property.
    - lacker 17y ago
      There's no difference between "leaked" and "stolen". Leaked documents are just those stolen by an employee.
- jonursenbach 17y ago
  Welcome to 2009, that's been official for a while now.
bdmac97 17y ago
I'm strongly of the opinion that they shouldn't post them... Just seems like bad karma at the least or a potential legal problem at the worst.
- vaksel 17y ago
  Posting this is in techcrunch's best interests. It'll get them a ton of traffic. I'm sure they'll milk it for a 5-6 posts. Then a few weeks down the road, someone will do the same thing to them, and they'll do another 2-3 posts with outrage that their privacy and confidential information was violated. I'm sure they'll keep all the juicy stuff hidden. Since they are working with twitter on what they will/won't release. Although its kinda stupid, considering the stuff will show up on other websites
- nreece 17y ago
  If we only posted things that companies gave us permission to post this would be a press release site and none of you would be here. News is stuff someone doesn’t want you to write. The rest is advertising. -- Michael Arrington http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-of-confidential-twitter-documents/#comment-2857013 http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-o...
  - esonica 17y ago
    I wonder if he would see it as "news" if someone posted all of TechCrunch's private internal documents?
    - dpcan 17y ago
      He actually replied in the comments to something just like this. He said "no" of course :)
      - tyler 17y ago
        The question he was asked was actually whether he would want someone to publish TC's documents. The answer is obviously no. However, that's completely separate from whether he would consider it news. It's news whether or not you want it to be.
esonica 17y ago
Wouldnt the unethical thing be sitting there reading through a bunch of documents you know were illegally obtained? Then following it up by basically bragging about it.. TechCrunch is not what it used to be :(
guicifuentes 17y ago
I'm not a lawyer but this says it's going to publish entire documents which supposedly are private, what it's illegal. This is just marketing and not true (the entire thing). So do they hacked the entire computer network of Twitter offices just for the shake of sending the documents to Michael Arrington? Are you serious?
- omouse 17y ago
  If you were following the story you could see the computer criminal, some script kiddie, guessed some passwords and got into the Yahoo Email or Google Apps accounts of some Twitter employees. Typical of script kiddie computer criminals, they were seeking fame which means seeing their handle/nickname plastered all over the Internet.
sriramk 17y ago
The scary part is that TechCrunch isn't the only place these documents will land up at. Other recipients of these documents won't be so scrupulous about not posting sensitive information. I imagine Twitter is going through a lot of hassle around resetting security codes, reaching out to interview candidates, employees taking measures to protect identity theft, etc. Just a nightmare. The other scary scenario is that this "hacker croll" has more documents which he hasn't shared yet. When the original HL2 code was stolen from Valve, Gabe Newell was contacted later with additional documents (which lead to that person getting arrested)
tdedecko 17y ago
Initially, I was shocked that they would post the stolen information. Eventually I realized that this is going to be publicly available regardless of whether Techcrunch posts it or not. The information would be released elsewhere. As a news site, they are unable to ignore its existence. Techcrunch has discussed this with Twitter. They have also decided not to release private information. From this I can say that they are being fair about this. This does suck for Twitter. Though, it does bring to light the potential dangers of using a web service to host your confidential documents. "the original security hole seems to be Google, via Google Apps for your Domain. Some passwords were guessed and things started to fall apart from there. Most (or all) of these documents were downloaded from Google’s servers."
- esonica 17y ago
  I would argue it brings to light the dangers of not having secure passwords, this applies to local networks and servers, not just web services.
- HoneyAndSilicon 17y ago
  If you consider the sentence "Some passwords were guessed and..." in the above [ http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-of-confidential-twitter-documents/#comment-2856905 http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-o... ] ( guessed! ) doesn't that say something's seriously wrong with some basic operational practices by core staff (i.e., weak passwords on core business accounts - which just happen to be Google accounts)?
deleted 17y ago
[deleted]
jacquesm 17y ago
If you store your corporate documents on other peoples servers you deserve what you get. What were they thinking ? Confidential stuff should not leave the building, let alone be uploaded to 3rd party data centers. Keep in mind that just about anybody with sysadmin privileges at the company hosting your data also has access to all those documents. As does anybody on the wire between you and the host during up or download. Now let's hope somebody posts some of techcrunchs' internal and confidential documents. What goes around comes around.
- ntoshev 17y ago
  Arrington says the vulnerability was in Google Apps for Your Domain, although the original article about the hack says otherwise: http://www.pcworld.com/businesscenter/article/164182/hacker_i_broke_into_twitter.html http://www.pcworld.com/businesscenter/article/164182/hacker_... Hacker Croll claimed to have accessed Goldman's Twitter password by first gaining access to his Yahoo account. "One of the admins has a yahoo account, i've reset the password by answering to the secret question. Then, in the mailbox, i have found her [sic] twitter password," Hacker Croll said Wednesday in a posting to an online discussion forum. "I've used social engineering only, no exploit, no xss vulnerability, no backdoor, no sql injection." I wonder why the hacker would send the documents to Techchrunch. He could have uploaded them somewhere and then submitted the link to Reddit.
  - ErrantX 17y ago
    > wonder why the hacker would send the documents to Techchrunch The inference I got was they paid for them. BUT I stress that is only what I picked up - not seen anything concrete. Could explain it though.
  - bigbang 17y ago
    > although the original article about the hack says otherwise This article is from May 1. The same hacker has hacked again (unfortunately thru social engineering again)
  - trickjarrett 17y ago
    I wondered the same thing. It's not like TC is going to publicize his hacker handle to get him credit. Seems like a disgruntled employee or user or spammer trying to stir up bad press for them.
sobriquet 17y ago
ruh roh.. I know TC said names of people who interviewed for "senior level positions" are included... wonder if the lower level positions are somewhere in there too. Anybody interview and don't want their current employer to find out?
- nostrademons 17y ago
  Eh, I interviewed, but it was before I joined my current employer. Unless the interviews are date-stamped or you've been at your job for longer than Twitter's been funded, I don't really see much of a problem.
rwebb 17y ago
jerk
sho 17y ago
If further proof was needed that secret question "backup passwords" are a really, really bad idea, this is it. Exactly the same way Sarah Palin's account was "hacked". People, and companies, have to take more responsibility for their own security. They can't just say "it wasn't my fault, Yahoo has that feature!" - they need to active dump yahoo, and anyone else offering these ludicrous backdoors which defeat the point of even having a password.
radu_floricica 17y ago
I'd rather live in a world where I have to guard my private info then in one where I send info to news outlets only to have them self-censor it. Newspapers have a pretty clear job, and outside yelling fire in a theater I support them doing it. Of course, checking the validity and relevance of what they publish is necessary, but that's a different discussion.
ananthrk 17y ago
TC's response to reactions on this issue http://www.techcrunch.com/2009/07/15/our-reaction-to-your-reactions-on-the-twitter-confidential-documents-post/ http://www.techcrunch.com/2009/07/15/our-reaction-to-your-re...
DanielBMarkham 17y ago
I refuse to click this link and give TechCrunch my pageview. This is really simple. Act in a manner that you would like everybody else in the world to act like. Aside from that comment, I'm not joining this circus.
- deleted 17y ago
  [deleted]
- trickjarrett 17y ago
  This is what news organizations do though. Fox, CBS, NBC, if they receive documents they would publish them too. Why is TechCrunch different?
  - joezydeco 17y ago
    Sigh. Didn't we just go through this with the lawsuit involving Apple and the Apple blogs? http://www.nytimes.com/2005/03/12/technology/12blog.html?_r=1 http://www.nytimes.com/2005/03/12/technology/12blog.html?_r=... "[The ruling]... focused on the notion that the published information included trade secrets and was essentially stolen property."
    - eli 17y ago
      That was a ruling that said Apple could track down the leaker. It didn't say the documents couldn't be published.
      - joezydeco 17y ago
        Oh, I see. I guess my interpretation of "stolen property" is different from yours. Sorry.
  - TrevorJ 17y ago
    Yes, other news outlets may do this, but you don't get the smarmy "Heehee, look what we got our hands on, heeheehee." smug crap from the New york times. TC is trying to have the best of both worlds here and generate pageviews while still trying to appear like they are on the moral high ground.
Ardit20 17y ago
Wow, If I was Twitter, I'd feel raped.
- Ardit20 17y ago
  Well, when someone rapes you they penetrate your most intimate parts without your consent. I do not think there is anything more intimate for a company than their revenue data, plans and projections. So down vote all you like, however technically my analogy is correct.
TweedHeads 17y ago
Next time it won't be a spit, it will be a punch in the face.
jeremymims 17y ago
Wow. This debate is incredible. First, I love using twitter and I think the guys that built it are great. They've created a product that means so much to people that many members on this site are willing to stand on shaky ground saying these documents shouldn't be published simply because they belong to a company they like. Internal documents are leaked all the time. For instance, Arrington reported that Microsoft's new search engine would be called Bing long before Microsoft announced this fact. How many of you chase Apple rumors before a keynote? This is all leaked information. Where's the outrage? The standard for the press publishing information isn't malfeasance. Twitter need not have done anything wrong for the press to publish information that is of interest to its readers. Arrington has drawn a line that companies are different than private citizens (who he feels should have some expectation of privacy). He is not releasing personal information that may hurt someone's career, merely information about twitter's potential future tv projects, business models, and projections. The fact is he has gone about this in an extremely ethical way, acting as both reporter and ombudsman. He has censored portions which might do someone harm and has no doubt agreed to censor certain bits of information on behalf of twitter. However, he will publish as much of the information that is relevant and interesting as he can. In my opinion, this strikes a good balance.
psranga 17y ago
He talks about not crossing an ethical line and then says he's going to post the documents! To posters drawing a comparison to newspapers like NYTimes, Wikileaks etc: ask yourself what public interest is served by these documents being made public (afaik none). And then ask yourself what public interest was served by the leakers of the Pentagon Papers.
dfj225 17y ago
All I can think of is Cryptonomicon and how much work Epiphyte(2) put into securing their IP and company plans. Of course this is fiction, but it made sense to me that the main value in a startup is in their ideas/IP so this should be protected to a great extent. Apparently, Twitter didn't take this approach.

68 points by vaksel 17y ago

It's official: micheal arrington is the perez hilton of the tech world. But seriously, how is this in any way legal? I almost can't believe it, it seems like a hoax...

vaksel 17y ago
it may be somewhat unethical, but its legal. If you couldn't write about anything "confidential" the news companies would be out of business.
- greyman 17y ago
  Yes, this is what Michael is pointing out and he is somewhat right. Otherwise, if something negative leaks out of the company, they might just call it confidential and nobody could publish it...
- barrkel 17y ago
  Why doesn't it count as trafficking in stolen property? The documents weren't leaked, they were stolen. They are not "confidential", they are stolen property.
  - lacker 17y ago
    There's no difference between "leaked" and "stolen". Leaked documents are just those stolen by an employee.
jonursenbach 17y ago
Welcome to 2009, that's been official for a while now.

bdmac97 17y ago

I'm strongly of the opinion that they shouldn't post them... Just seems like bad karma at the least or a potential legal problem at the worst.

vaksel 17y ago
Posting this is in techcrunch's best interests. It'll get them a ton of traffic. I'm sure they'll milk it for a 5-6 posts. Then a few weeks down the road, someone will do the same thing to them, and they'll do another 2-3 posts with outrage that their privacy and confidential information was violated. I'm sure they'll keep all the juicy stuff hidden. Since they are working with twitter on what they will/won't release. Although its kinda stupid, considering the stuff will show up on other websites
nreece 17y ago
If we only posted things that companies gave us permission to post this would be a press release site and none of you would be here. News is stuff someone doesn’t want you to write. The rest is advertising. -- Michael Arrington http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-of-confidential-twitter-documents/#comment-2857013 http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-o...
- esonica 17y ago
  I wonder if he would see it as "news" if someone posted all of TechCrunch's private internal documents?
  - dpcan 17y ago
    He actually replied in the comments to something just like this. He said "no" of course :)
    - tyler 17y ago
      The question he was asked was actually whether he would want someone to publish TC's documents. The answer is obviously no. However, that's completely separate from whether he would consider it news. It's news whether or not you want it to be.

esonica 17y ago

Wouldnt the unethical thing be sitting there reading through a bunch of documents you know were illegally obtained? Then following it up by basically bragging about it.. TechCrunch is not what it used to be :(

guicifuentes 17y ago

I'm not a lawyer but this says it's going to publish entire documents which supposedly are private, what it's illegal. This is just marketing and not true (the entire thing). So do they hacked the entire computer network of Twitter offices just for the shake of sending the documents to Michael Arrington? Are you serious?

omouse 17y ago
If you were following the story you could see the computer criminal, some script kiddie, guessed some passwords and got into the Yahoo Email or Google Apps accounts of some Twitter employees. Typical of script kiddie computer criminals, they were seeking fame which means seeing their handle/nickname plastered all over the Internet.

sriramk 17y ago

The scary part is that TechCrunch isn't the only place these documents will land up at. Other recipients of these documents won't be so scrupulous about not posting sensitive information. I imagine Twitter is going through a lot of hassle around resetting security codes, reaching out to interview candidates, employees taking measures to protect identity theft, etc. Just a nightmare. The other scary scenario is that this "hacker croll" has more documents which he hasn't shared yet. When the original HL2 code was stolen from Valve, Gabe Newell was contacted later with additional documents (which lead to that person getting arrested)

tdedecko 17y ago

Initially, I was shocked that they would post the stolen information. Eventually I realized that this is going to be publicly available regardless of whether Techcrunch posts it or not. The information would be released elsewhere. As a news site, they are unable to ignore its existence. Techcrunch has discussed this with Twitter. They have also decided not to release private information. From this I can say that they are being fair about this. This does suck for Twitter. Though, it does bring to light the potential dangers of using a web service to host your confidential documents. "the original security hole seems to be Google, via Google Apps for your Domain. Some passwords were guessed and things started to fall apart from there. Most (or all) of these documents were downloaded from Google’s servers."

esonica 17y ago
I would argue it brings to light the dangers of not having secure passwords, this applies to local networks and servers, not just web services.
HoneyAndSilicon 17y ago
If you consider the sentence "Some passwords were guessed and..." in the above [ http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-of-confidential-twitter-documents/#comment-2856905 http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-o... ] ( guessed! ) doesn't that say something's seriously wrong with some basic operational practices by core staff (i.e., weak passwords on core business accounts - which just happen to be Google accounts)?

deleted 17y ago

[deleted]

jacquesm 17y ago

If you store your corporate documents on other peoples servers you deserve what you get. What were they thinking ? Confidential stuff should not leave the building, let alone be uploaded to 3rd party data centers. Keep in mind that just about anybody with sysadmin privileges at the company hosting your data also has access to all those documents. As does anybody on the wire between you and the host during up or download. Now let's hope somebody posts some of techcrunchs' internal and confidential documents. What goes around comes around.

ntoshev 17y ago
Arrington says the vulnerability was in Google Apps for Your Domain, although the original article about the hack says otherwise: http://www.pcworld.com/businesscenter/article/164182/hacker_i_broke_into_twitter.html http://www.pcworld.com/businesscenter/article/164182/hacker_... Hacker Croll claimed to have accessed Goldman's Twitter password by first gaining access to his Yahoo account. "One of the admins has a yahoo account, i've reset the password by answering to the secret question. Then, in the mailbox, i have found her [sic] twitter password," Hacker Croll said Wednesday in a posting to an online discussion forum. "I've used social engineering only, no exploit, no xss vulnerability, no backdoor, no sql injection." I wonder why the hacker would send the documents to Techchrunch. He could have uploaded them somewhere and then submitted the link to Reddit.
- ErrantX 17y ago
  > wonder why the hacker would send the documents to Techchrunch The inference I got was they paid for them. BUT I stress that is only what I picked up - not seen anything concrete. Could explain it though.
- bigbang 17y ago
  > although the original article about the hack says otherwise This article is from May 1. The same hacker has hacked again (unfortunately thru social engineering again)
- trickjarrett 17y ago
  I wondered the same thing. It's not like TC is going to publicize his hacker handle to get him credit. Seems like a disgruntled employee or user or spammer trying to stir up bad press for them.

sobriquet 17y ago

ruh roh.. I know TC said names of people who interviewed for "senior level positions" are included... wonder if the lower level positions are somewhere in there too. Anybody interview and don't want their current employer to find out?

nostrademons 17y ago
Eh, I interviewed, but it was before I joined my current employer. Unless the interviews are date-stamped or you've been at your job for longer than Twitter's been funded, I don't really see much of a problem.

rwebb 17y ago

jerk

sho 17y ago

If further proof was needed that secret question "backup passwords" are a really, really bad idea, this is it. Exactly the same way Sarah Palin's account was "hacked". People, and companies, have to take more responsibility for their own security. They can't just say "it wasn't my fault, Yahoo has that feature!" - they need to active dump yahoo, and anyone else offering these ludicrous backdoors which defeat the point of even having a password.

radu_floricica 17y ago

I'd rather live in a world where I have to guard my private info then in one where I send info to news outlets only to have them self-censor it. Newspapers have a pretty clear job, and outside yelling fire in a theater I support them doing it. Of course, checking the validity and relevance of what they publish is necessary, but that's a different discussion.

ananthrk 17y ago

TC's response to reactions on this issue http://www.techcrunch.com/2009/07/15/our-reaction-to-your-reactions-on-the-twitter-confidential-documents-post/ http://www.techcrunch.com/2009/07/15/our-reaction-to-your-re...

DanielBMarkham 17y ago

I refuse to click this link and give TechCrunch my pageview. This is really simple. Act in a manner that you would like everybody else in the world to act like. Aside from that comment, I'm not joining this circus.

deleted 17y ago
[deleted]
trickjarrett 17y ago
This is what news organizations do though. Fox, CBS, NBC, if they receive documents they would publish them too. Why is TechCrunch different?
- joezydeco 17y ago
  Sigh. Didn't we just go through this with the lawsuit involving Apple and the Apple blogs? http://www.nytimes.com/2005/03/12/technology/12blog.html?_r=1 http://www.nytimes.com/2005/03/12/technology/12blog.html?_r=... "[The ruling]... focused on the notion that the published information included trade secrets and was essentially stolen property."
  - eli 17y ago
    That was a ruling that said Apple could track down the leaker. It didn't say the documents couldn't be published.
    - joezydeco 17y ago
      Oh, I see. I guess my interpretation of "stolen property" is different from yours. Sorry.
- TrevorJ 17y ago
  Yes, other news outlets may do this, but you don't get the smarmy "Heehee, look what we got our hands on, heeheehee." smug crap from the New york times. TC is trying to have the best of both worlds here and generate pageviews while still trying to appear like they are on the moral high ground.

Ardit20 17y ago

Wow, If I was Twitter, I'd feel raped.

Ardit20 17y ago
Well, when someone rapes you they penetrate your most intimate parts without your consent. I do not think there is anything more intimate for a company than their revenue data, plans and projections. So down vote all you like, however technically my analogy is correct.

TweedHeads 17y ago

Next time it won't be a spit, it will be a punch in the face.

jeremymims 17y ago

Wow. This debate is incredible. First, I love using twitter and I think the guys that built it are great. They've created a product that means so much to people that many members on this site are willing to stand on shaky ground saying these documents shouldn't be published simply because they belong to a company they like. Internal documents are leaked all the time. For instance, Arrington reported that Microsoft's new search engine would be called Bing long before Microsoft announced this fact. How many of you chase Apple rumors before a keynote? This is all leaked information. Where's the outrage? The standard for the press publishing information isn't malfeasance. Twitter need not have done anything wrong for the press to publish information that is of interest to its readers. Arrington has drawn a line that companies are different than private citizens (who he feels should have some expectation of privacy). He is not releasing personal information that may hurt someone's career, merely information about twitter's potential future tv projects, business models, and projections. The fact is he has gone about this in an extremely ethical way, acting as both reporter and ombudsman. He has censored portions which might do someone harm and has no doubt agreed to censor certain bits of information on behalf of twitter. However, he will publish as much of the information that is relevant and interesting as he can. In my opinion, this strikes a good balance.

psranga 17y ago

He talks about not crossing an ethical line and then says he's going to post the documents! To posters drawing a comparison to newspapers like NYTimes, Wikileaks etc: ask yourself what public interest is served by these documents being made public (afaik none). And then ask yourself what public interest was served by the leakers of the Pentagon Papers.

dfj225 17y ago

All I can think of is Cryptonomicon and how much work Epiphyte(2) put into securing their IP and company plans. Of course this is fiction, but it made sense to me that the main value in a startup is in their ideas/IP so this should be protected to a great extent. Apparently, Twitter didn't take this approach.