How Saudi Arabia Infiltrated Twitter

https://www.buzzfeednews.com/article/alexkantrowitz/how-saudi-arabia-infiltrated-twitter

by blatherard • 6 years ago

316 90 6 years ago

mc326• 6 years ago

I don’t know why they started the blue checkmark.

It’s not to verify identity. It’s more like imprimatur (anointed by Twitter as whatever). And that is stupid because it’s basically up to the whims of the company and becomes open to abuse internally and externally.

uk_programmer• 6 years ago

IIRC it was originally to verify celebs real accounts. Then they said anyone with more than a certain number of followers and now it seems to be just a status symbol.

goatinaboat2• 6 years ago

It originally was to verify identity. Then they started withdrawing it from controversial figures, as if those people stopped being who they really were overnight. Nowadays it just means “this persons views are endorsed by Twitter staff”.

chrisseaton3• 6 years ago

Nowadays it just means “this persons views are representative of Twitter staff”.

For example both Sanders and Trump have a blue tick. They obviously can’t simultaneously be representative of a majority of Twitter’s staff’s views, can they? And I’d estimate Trump isn’t representative of a substantial number of these west-coast tech workers at all. So that doesn’t seem to hold up.

SpicyLemonZest• 6 years ago

That's surely not true. Lots of people have blue checks even though Twitter staff would never endorse their views - Ben Shapiro, Steven Crowder, Candace Owens, and so on.

chrisseaton3• 6 years ago

It’s not to verify identity.

I think that is precisely the purpose. If you’re looking for Donald Trump’s Twitter profile the idea is the blue tick helps you find the right one rather than a parody.

i_am_nomad• 6 years ago

Except the blue check can be and has been revoked for reasons that have nothing to do with identity.

wpietri4• 6 years ago

The original purpose was definitely to verify identity. Since parody accounts are allowed, it's valuable to be able to tell the real X from a parody X. This was especially true early on in Twitter's history. It was also useful in encouraging famous people to get on Twitter. "Look, if you start you own account, we'll clearly distinguish it for you. No more fakes!" And having famous people on Twitter was hugely valuable to encouraging growth.

Unfortunately, there's a strong correlation between "useful to verify" and "important", so pretty quickly it became a status symbol, especially for marginally notable people. And some people really like status! It's very similar to the problem Wikipedia has, where they daily have to delete a lot of BS biographies from the would-be famous.

This means that the program has been a headache for Twitter for a long time. I know when I worked there in 2017 they announced that they were suspending the program pending a major revamp of how it works. As far as I know nothing came of that; I think they quietly started giving out blue checkmarks again a while back.

Personally, what I'd like to happen is that they make it much broader and roll it up in a "Premium Twitter" feature. I pay them $50/year, they verify that I'm who I say I am, get rid of ads, and throw in a few other features. But I doubt that will happen, as IMHO Twitter is incredibly bad at getting anything done.

mc326• 6 years ago

I agree with your take and suggestions. They probably feel it would dilute the value. As you suggest, they could add “Premium” or “Pro” labels to distinguish people who pay for status. Maybe charge them by audience or reach as well.

raxxorrax• 6 years ago

I guess it was originally intended to get people to reveal their real identities. Especially for celebrities that often had fake accounts with their name.

There are some groups that take it as a warning sign for craziness. Funnily, it often seems they are onto something.

grandridge2• 6 years ago

They bought a huge chunk?

Synaesthesia• 6 years ago

More like, there were Saudi spies within twitter, the company, telling the govt about dissidents.

Shivetya• 6 years ago

so my question is simple, did twitter engage the FBI or an auditing company to verify the rest of the staff who have access to sensitive data?

It would seem to be a concern they would have to follow up on. You can put in all the procedures you want and declare compliance to auditors but it only serves to make paper pushers happy.

Natsu3• 6 years ago

Why is this downvoted? It's true:

https://qz.com/519388/this-saudi-prince-now-owns-more-of-twi...

"Prince Alwaleed Bin Talal Bin Abdulaziz Alsaud, who in 2011 invested $300 million in the social network, now owns 34.9 million shares of Twitter’s common stock, according to a new regulatory filing (pdf)."

That is from 2015, but as far as I know he still owns a huge stake in the company. It would seem relevant when discussing SA's influence on Twitter, but I don't see it mentioned in the article for some reason.

duxup9• 6 years ago

The downvotes are because the "infiltrated twitter" in the story has nothing to do with the investment.

slim• 6 years ago

je was arrested when MBS came to power in 2017

https://www.nytimes.com/2017/11/04/world/middleeast/saudi-ar...

he does not seem to be part of the "saudi intelligence community"

saber6• 6 years ago

Yet another reason why Twitter should be banished to the depths of hell - what a stupid shit-show of a company.

I eagerly anticipate their downfall. Just like I did MySpace. And hopefully someday, Facebook. Fuck these parasites.

tasogare• 6 years ago

It was never really useful anyway as the noise is exponentially more present than few useful tweets.

dang• 6 years ago

OK, but please don't post unsubstantive comments to Hacker News. Maybe you don't owe shit-shows of companies better, but you owe this community better if you're commenting here.

https://news.ycombinator.com/newsguidelines.html

baybal2• 6 years ago

I'd also remind that Twitter is surprisingly leaky for Chinese using it, even for people who can get foreign simcards to register an account.

API leak is one hypothesis, another one is that they got a mole there too.

The same goes to Facebook. A number of FB users got detained in China with no better explanation than MSS getting access to FB's internal information like phone ID and IMSI data in user database.

The most probable explanation people have crafted is following:

1. Using internal or external tips, MSS gets user account info of a person of interest

2. Their mole accesses the user database for info on cookies, IMSI, advertising ID and such

3. MSS than cross-references the data with data on the open market, like IMSI databases sold by mobile advertising companies

4. One way ticket to Heilongjiang is issued the next day, once the identity of the person is confirmed using logs of phone companies or ISPs.

freepor• 6 years ago

LOL @ “a mole.” China has at least a dozen moles inside Twitter. At least a hundred inside Google.

president• 6 years ago

Given that the Chinese government uses coercion (esp. threats to family back home) on foreign workers in the US, every Chinese national working at any company in the US can be a potential mole. Think about that.

"If these contractors can't breach a target, intelligence officers assigned to specific cases come into action. They operate on the ground, near targets, by recruiting company insiders, or even coercing Chinese employees to aide their hacking efforts using blackmail or threats against families living at home." [1]

[1] https://www.zdnet.com/article/fbi-is-investigating-more-than...

j-c-hewitt2• 6 years ago

Why would a serious government not walk through the open door and take what they needed while their agents collect two salaries? It's just a win-win for foreign intelligence. They would be negligent in their duties to NOT infiltrate US companies with open doors and permissive, trusting internal policies about user data.

Then the company can do the liability minimization dance when the FBI comes and points out that they are running a cheap data service for foreign spies. "We, uh, had no idea..."

meowface2• 6 years ago

Absolutely. It's their job to do this.

But what should large tech companies do? Avoid hiring people from certain countries/heritages? Obviously that's not fair and not a good look. Same for putting extra monitoring on them. This is independent of Twitter apparently trying to downplay this and cover it up, which of course is wrong. It just seems like preventing this is really tough unless you state "we won't hire anyone who's lived in, was born in, or whose parents are from China, Iran, Saudi Arabia, or Russia", which is untenable.

komali2• 6 years ago

I remember serious concerns about Australian citizens suddenly being legally required to be spies for the Australian government regardless of where in the world they're working due to a new anti encryption law sometime in 2016. That and Twitter somehow being caught with their pants down regarding user phone numbers and other personal information makes it all the more important that all the engineers and product people on this site make it very clear to management that the systems must be set up in a way that simply doesn't allow people to access that information. It's morally good and it might prevent you from making the papers as a host of a bunch of spies that got your Chinese, Saudi Arabian, or Turkish users assassinated or jailed.

girvo3• 6 years ago

In 2018 those laws were actually passed, and there's a tonne of uncertainty around them (which is probably on purpose). It's had a chilling effect on exporting software from Australia, too, at least for two business I've worked with since, though that seems to be warming again lately for better or worse.

jacques_chester• 6 years ago

regardless of where in the world they're working

I don't think this is correct. The legislation as drafted didn't seem to claim extra-territoriality and courts will basically never interpret legislation as being extra-territorial without an explicit clause.

There's also the point that if you are overseas and refuse to comply with a request by ASIO or whathaveyou, they can't legally arrest you outside of Australia. In theory they'd need to ask for your extradition, but that requires equivalent laws to be in operation in the country you're extraditing from. But you'd be at risk of arrest upon returning to Australia.

That doesn't stop it from being a terrible law. And it also doesn't stop me from not being a lawyer who isn't giving legal advice.

duxup9• 6 years ago

I worked on a support team for a company that that had some major financal institutions as a customer.

We had remote access to their networks at times. My very first day I was amazed how much access I had at will.

One day it was announced that a customer had come to us and demanded everyone had to meet X requirements to be able to work on their networks.

Not long after another financal institution made a similar request.

Some folks inside the company were a bit riled up by the requirements (background checks, some other things). They felt the requirements were absurd.

Considering the access we had I thought they weren't strict enough. As just a lowly support dude hired during the dot com boom because the company needed warm bodies (who could do some independent thinking / troubleshooting) ... I had a lot of access.

I don't know if they were thinking about spying like this, but I'm always amazed how much access people have to data and etc just from a technical support perspective (forget developers...).

Later the company outsourced support to other countries... I'm not even sure you need spies in the US / would know anyone was spying under those circumstances.

Support teams are probabbly a hell of a lot cheaper / easier to infiltrate / they get little / poor management / oversight. I saw tons of strange choices by our outsourced technical support staff, every single time I raised concerns it was discarded by something to the effect of "yeah they suck".

And that doesn't account for all the financial institutions who outsourced their own direct ops teams to other countries ... I'd call them and if they ever were capable of following instructions 9x out of 10 they'd open up the wrong network / modems / etc.

carlmcqueen• 6 years ago

This is a very common answer to these stories on hackernews but this one is from a humble point of view that truly brings home the point.

My side is that I worked for a bank on the brokerage side for ten years in different positions. What always struck me was that my access was very carefully controlled, I was a background checked employee and had to meet with compliance once a year, etc etc.

However when a law firm asked for anything or consultants said they needed more data they just sent massive data dumps to the network admin guy, no questions further asked. At least not at my pay grade.

As I've consulted I ask for only what I need to keep my own risk down but it is always a surprise to my clients I don't want PII I don't need and only the data that my model will help enhance.

duxup9• 6 years ago

Yeah I had a similar experience in terms of security being strong in one place. .. and non existant (as I describe) elsewhere.

Some of our customers did have pretty strong proesses in some places... but then zero when a process changes or something like that.

Lots of: "Oh no we can't do that because <security>".

Ok makes sense. It's a hassle but it is a good policy.

"But you can..."

All sense out the window, everything is undone.

gowld• 6 years ago

I was a background checked employee and had to meet with compliance once a year,

That doesn't protect you from accessing and leaking data.

harry8• 6 years ago

Note the difference:

Senior managers don't need to control the servants' access because they won't take your job, they're lesser beings in the caste system. The control is there for those who might take your job or customers because they are caste equivalents.

At no stage are customers' concerns so much as considered. Control is not of the data, it's the vital control of peers and rivals. If you're not a rival, who cares?

girvo3• 6 years ago

Working with some massive insurance companies to build a technologically interesting product for them to reduce fraud, I was given their entire claims data sets for the previous decade as an outside consultant with zero background checks involved. I even raised that as a scary issue but was told to pipe down haha

mc326• 6 years ago

Companies who offshore also run across this dilemma. This is how companies can lose IP to competitors.

Let’s say an IC designer offshores some work, that company has other clients as well and the off shore company has access to a lot of the R&D of the client company. Lots of things can happen in that situation and does happen.

lkbm• 6 years ago

I worked at a charter school for a while, and had access to the test scores and demographic data (including dob and ssn) not just for our students, but for every public school student in Texas, past and present.

Data security is a myth.

duxup9• 6 years ago

School's in particular are horrible.

The knowledge level on those staff's is often near 0, they operate with wonky budgets (here is a gazillion dollars for ipads... no money to maintain them or the rest fo the systems), and are just making do the best they can.

The IT staff at one complained to me the librarian at one elementary school kept changing things on them. In reality she had a clue and they couldn't even operate rudimentary role based access type system to stop her.

ta999999171• 6 years ago

But it doesn't have to be.

BiteCode_dev• 6 years ago

Currently reading snowden book, "Permanent record". At one point he says that private companies do a huge amount of work for the NSA & Co, and have ridiculous level of access to vast arrays of personal data, which they proceed to give to their employees or subcontractors for processing.

I expect FAANGS to do the same.

chaostheory• 6 years ago

Years ago, the key code to one of the back doors of a very large and well known financial institution in SF was extremely simple and consequetive and 4 digit sequence that everyone including contractors knew. I wonder if they ever fixed it?

onetimemanytime3• 6 years ago

Not being a smart ass but how do background checks work for foreign persons? Say for a former student that came to USA 5 years ago and is 23 years old? Odds are that he will look clean in every way. Even if he's a spy all traces are covered.

My other comment was sent to oblivion because it is politically incorrect, but the reality is that a lot students have loyalties to the old country. Also when you add the family back there and corruption being a normal way of getting things done, these things are bound to happen. I don't suggest to freeze them out, just don't be surprised.

Aachen3• 6 years ago

Your other comment says different things though. I think it's a fair question "how do background checks work for foreign persons" vs "IMO, it's wayyy much easier to corrupt people from second or even third world countries, there corruption is the norm".

nl• 6 years ago

Not being a smart ass but how do background checks work for foreign persons?

Note that there are many different types of background checks, varying from things like "working with children" checks, to financial status checks, to security checks of different kinds.

You are correct - it's very hard for a foreign person to pass some types of these. In some cases that means it's very difficult for them to get one of these jobs.

Aachen3• 6 years ago

My very first day I was amazed how much access I had at will.

Another branch where you might expect security awareness is anti virus companies. I'm a pentester and in smallish companies everyone knows everyone, but nobody knows me, yet most days I can tailgate into the office without question. This morning a lady asked suspiciously "are you looking for someone?" and I just replied that I know where to go, thanks. I walked on and she didn't pursue. Free rein.

I don't have to mention any specific company, this happens everywhere. Helpful, trusting that everything will be alright, clicking links... Vulnerabilities help but they are optional.

dwild• 6 years ago

A few months ago in Quebec we got a big cooperative bank "hacked" that way by an employee that got offered money by some insurance reseller.. He was able to export the data of 4.5 millions persons out and sell it to them. We recently found out that they were offering 40k$ to get it. Sure you could infiltrate them, but seems like even buying the data is quite accessible too.

blaser-waffle• 6 years ago

Is that Desjardins? They got hit November 2019.

BMO and another org in 2018. BMO's security was atrocious, for a while they had you use your 4-digit pin to log into online banking. One of the reasons I ended up switching to Tangerine...

benibela• 6 years ago

After growing up reading BOFH, I believe the admin always controls everything

steven_is_false• 6 years ago

I kinda worry about this.

I wish I could tell people that having that much access raises legal issues for me.

It's not enough to have them sign a contract limiting liability because as a business they have far more lawyers than I do.

When I work on a contract I want to be able to say in court that I couldn't possibly be in any way related to the event of a bug, security breach or data loss because I simply do not have access.

It is genuinely worrying on my part to carry around credentials with that much data. What if my laptop is hacked or stolen? I do not want to be sued (again it doesn't matter if they have a valid case or not, I don't want to deal with legal fees or anything.)

This is what I wish.

Obviously things are far from that.

onetimemanytime3• 6 years ago

People from certain countries are different, they have different values and some loyalties to the old country. IMO, it's wayyy much easier to corrupt people from second or even third world countries, there corruption id the norm.

Money is not an issue for a nation state and then they can fix things for family back home etc etc so they are bound to find people that say yes.

loup-vaillant• 6 years ago

Ali Alzabarah was panicked. His heart raced as he drove home from Twitter’s San Francisco headquarters in the early evening on Dec. 2, 2015.

Ok, how could you possibly know that? That's a pretty good guess, but writing it like it was the start of a novel… fells like read bait, really. Especially given the following:

Alzabarah, Abouammo, and al-Asaker did not respond to requests for comment.

herendin2• 6 years ago

In the same article, the FBI quotes his private messages from his email account that same year.

BryantD• 6 years ago

I was wondering if it was an SRE when the original story came out.

I'd be interested in seeing perspectives on how you avoid this scenario. While you could isolate data access by team in many models, you're still going to have engineers who have access to valuable data. Random access audits? But what about the scenario where your database lives on someone else's hardware?

I guess you could always decide you want to use your cloud providers FedRAMP-compliant offerings.

dgellow• 6 years ago

At 5:17 p.m. he called a handler, identified as Associate-1 in the FBI complaint, who arrived in a white SUV two hours later. Driving around Alzabarah’s neighborhood, the two men called “Foreign Official-l” — al-Asaker, according to the Washington Post — at 7:20 p.m., and again at 7:22 p.m. and 7:31 p.m. They then called Dr. Faisal Al Sudairi, the Saudi consul general in Los Angeles, at 8:30 p.m., 8:38 p.m., and 9:26 p.m. Shortly after midnight, the consul general called Alzabarah back and spoke with him for three minutes.

Slightly off-topic: I feel that gives a good idea of how much information can be extracted from very simple metadata (here timestamp and number called) in that kind of context.

seemslegit• 6 years ago

tldr; With money.

BrandoElFollito• 6 years ago

Shit happens (a spy makes his way to your organization). In large companies, especially such as Twitter, there are processes to handle such cases.

The process does not include firing the employer first thing in the morning. It includes calling the equivalent of the FBI for your country.

The way Twitter failed to handle this case is staggering.

How Saudi Arabia Infiltrated Twitter

Related Stories