Trump’s Twitter deactivation triggers scrutiny

Bloomberg

The fact that US President Donald Trump’s Twitter account was deactivated by a rogue employee has raised questions about how much access and control Twitter Inc.’s workforce has over an individual user’s account.
Trump’s personal page was shut down for about 11 minutes on Thursday evening by a customer support employee who was leaving the company.
Though Twitter has controls to prevent employees from making tweets from user accounts, the incident suggests that the employee still had some access to accounts and the ability to make changes without much oversight or the need for approval.
“At a high level, this implies a level of complacency, that organisations generally are perhaps trying to convince themselves they have technology risk managed,” said Yvette Connor, chief risk officer at Focal Point Data Risk, which consults with boards and executives on technology security. “In Twitter’s case, the reputational risk that they face is that the information that’s under their care, custody and control is not really under their care, custody and control.”
The person responsible for deactivating the account may also not have been a full-time employee but a contractor, according to a report from The New York Times, which didn’t cite its sources.
“We have learned that this was done by a Twitter customer support employee who did this on the employee’s last day,” the company tweeted, after citing inadvertent “human error” in an earlier post.
Twitter said in its posts that it was investigating and taking steps to prevent a recurrence of the incident but didn’t give specifics. The company declined to comment beyond the tweets.
This incident highlights the need for companies, especially those with a lot of data, to bulk up their monitoring capabilities and keep track of which employees have administrative control and access to information, Connor said.
Consumer technology companies in particular collect and store a tremendous trove of customer information and don’t always strictly control employee access, a point privacy advocates have often highlighted. Uber Technologies Inc. faced backlash after it was revealed that employees could find and track customers’ rides.
With an accurate system constantly keeping track of activity and controls, “Twitter would have known in 30 seconds—in 15 seconds—that the account of the president had been turned off,” Connor said. Twitter has mistakenly frozen accounts in the past. In 2016, CEO Jack Dorsey was locked out of his own for a few minutes. Dorsey said in a tweet that the suspension was “an internal mistake.” Users can also deactivate their own accounts.