In Our Inbox: Hundreds Of Confidential Twitter Documents

http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-of-confidential-twitter-documents/

by vaksel • 17 years ago

68 76 17 years ago

techcrunch.com

jcapote• 17 years ago

It's official: micheal arrington is the perez hilton of the tech world.

But seriously, how is this in any way legal? I almost can't believe it, it seems like a hoax...

vaksel2• 17 years ago

it may be somewhat unethical, but its legal. If you couldn't write about anything "confidential" the news companies would be out of business.

greyman• 17 years ago

Yes, this is what Michael is pointing out and he is somewhat right. Otherwise, if something negative leaks out of the company, they might just call it confidential and nobody could publish it...

barrkel2• 17 years ago

Why doesn't it count as trafficking in stolen property? The documents weren't leaked, they were stolen. They are not "confidential", they are stolen property.

jonursenbach• 17 years ago

Welcome to 2009, that's been official for a while now.

bdmac97• 17 years ago

I'm strongly of the opinion that they shouldn't post them... Just seems like bad karma at the least or a potential legal problem at the worst.

vaksel2• 17 years ago

Posting this is in techcrunch's best interests. It'll get them a ton of traffic. I'm sure they'll milk it for a 5-6 posts. Then a few weeks down the road, someone will do the same thing to them, and they'll do another 2-3 posts with outrage that their privacy and confidential information was violated.

I'm sure they'll keep all the juicy stuff hidden. Since they are working with twitter on what they will/won't release. Although its kinda stupid, considering the stuff will show up on other websites

nreece• 17 years ago

  If we only posted things that companies gave us permission to post
  this would be a press release site and none of you would be here.
  News is stuff someone doesn’t want you to write.
  The rest is advertising.

-- Michael Arrington

http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-o...

esonica3• 17 years ago

I wonder if he would see it as "news" if someone posted all of TechCrunch's private internal documents?

flipbrad2• 17 years ago

This is what's profoundly wrong with this Arrington character. What an awful, tabloid approach to defining news. New reporting is, quite simply, doing the legwork to bring stories to your attention. They might not have come to your attention for any number of reasons - distance from the source (too many nodes between you and it for it to get carried to your ears by your social network), original source too small/obscure, information not meme/viral enough (too complex? takeaways not clear? relevance to you is difference to relevance of all the potential, necessary carrier nodes it would take to reach you), you need your information filtered because you're too plugged in; privacy / legal status of the source is just one reason why you might not get information.

Whether a news outlet should carry that last set of info to your ears or not is up for debate; but to see his role as binary - advertising/PR newswire vs. broadcaster of leaked private information... well, how sad.

He's not alone of course. Tabloids have been operating on basically just that model for eons. With the occasional fabrication when they can't get enough leaks to fill the inches.

nostrademons2• 17 years ago

I weakly agree with you, but consider a few counterexamples. Were Bernstein and Woodward wrong to publish information they received from Deep Throat about Watergate? If someone were to leak confidential info on the Bush administration's role in Guantanamo Bay, should the press publish that? How about Microsoft's Halloween memo? Was that fair game?

There's a line somewhere. Twitter's financial position somehow seems different than Watergate. I'm kinda curious where you think the line is. It's not a universal "journalists should never publish confidential information", because in many cases, it's very important for the public to know.

blasdel• 17 years ago

Now that we know who Deep Throat was, Woodward and Bernstein are no longer quite the shining example of capital-J Journalism that they remain in the field's hagiography.

They were spoon-fed all their information by the acting head of the FBI -- the free press didn't oust Nixon, the powers that be did.

Don't forget that the anonymous sources are steering the story, and that their agenda is often more interesting than the actual information.

psawaya2• 17 years ago

It's very different from Watergate! The Watergate scandal involved the U.S. government, which is accountable to its citizens, and this is about a privately held company, accountable only to itself and its investors. Also, the Deep Throat information helped reveal a major violation of federal law. This kind of information (according to TC themselves) would only be useful to Twitter's competitors.

With that said, I still can't help but be curious. It'll be interesting to see how all of this plays out, and if some of the documents do end up released to the public, I'll probably cave and check up on the juicy tech gossip.

TomOfTTB3• 17 years ago

I’ve been going over this in my mind and this is what I’ve come up with.

On one hand you can look at it as a straight theft. If a person steals a bunch of computers and then sells them to a computer shop for 25% of the retail price the shop owner is guilty of a crime (selling stolen goods) even if he had no part in the initial theft. In that case I’d say it’s immoral on Techcrunch’s part. Because while the digital copies of files don’t have monetary value like physical computers they have intellectual property value that could do significant damage to Twitter and in doing so cause the company to lose large sums of money.

ON THE OTHER HAND, most of the great scandals both in Government and in Corporate America have been revealed by whistle blowers who essentially stole documents and passed them on to reporters. So there’s a precedent where stealing documents can actually be a very moral thing.

In the end I think it boils down to what the documents reveal. In the case of whistle blowers they're still stealing something but we forgive the theft because it’s done to protect society from a greater harm. The good out weighs the bad. So if these documents reveal some kind of malfeasants on Twitter’s part I could see publishing them as being justified. If not I think you’re probably right and this is an immoral act on Techcrunch’s part.

randomtask3• 17 years ago

In other words, because in the case of Techcrunch the end doesn't justify the means it's immoral?

rwolf• 17 years ago

I think I could agree with airing a companies' dirty laundry if it was dirty enough.

Techcrunch would have mentioned it if they found anything that was more than vaguely interesting, so I feel confident saying that they don't have anything big enough to justify this violation of privacy. Techcrunch is dirtying it's name for private information that is not even newsworthy.

cdibona• 17 years ago

I'm with you. That said, can you picture Arington going to jail to protect his source? Cause this is about Journalism, right? Right?

staunch• 17 years ago

He did offer to pay for a lawyer for a "whistle blower" source, not so long ago.

notaddicted• 17 years ago

  The guy (”Hacker Croll”) who claims to have accessed 
  hundreds of confidential corporate and personal documents of 
  Twitter and Twitter employees, is releasing those documents 
  publicly

The hacker is releasing the documents publicly. TechCrunch is commenting on public information. They didn't cause the breech, twitter did, and they aren't acting as an exclusive disseminator of information, they just acted the fastest.

batasrki• 17 years ago

If there was no interest from TechCrunch or other "news" sites about this information, the dude would not have his 15 minutes of fame. Arrington's decision to pass on stolen documents is at best highly unethical and at worst criminal.

It's unfortunate that TechCrunch has been blinded with greed and famewhoring enough to not see this.

esonica3• 17 years ago

Wouldnt the unethical thing be sitting there reading through a bunch of documents you know were illegally obtained? Then following it up by basically bragging about it..

TechCrunch is not what it used to be :(

guicifuentes• 17 years ago

I'm not a lawyer but this says it's going to publish entire documents which supposedly are private, what it's illegal. This is just marketing and not true (the entire thing).

So do they hacked the entire computer network of Twitter offices just for the shake of sending the documents to Michael Arrington?

Are you serious?

omouse• 17 years ago

If you were following the story you could see the computer criminal, some script kiddie, guessed some passwords and got into the Yahoo Email or Google Apps accounts of some Twitter employees. Typical of script kiddie computer criminals, they were seeking fame which means seeing their handle/nickname plastered all over the Internet.

sriramk• 17 years ago

The scary part is that TechCrunch isn't the only place these documents will land up at. Other recipients of these documents won't be so scrupulous about not posting sensitive information. I imagine Twitter is going through a lot of hassle around resetting security codes, reaching out to interview candidates, employees taking measures to protect identity theft, etc. Just a nightmare.

The other scary scenario is that this "hacker croll" has more documents which he hasn't shared yet. When the original HL2 code was stolen from Valve, Gabe Newell was contacted later with additional documents (which lead to that person getting arrested)

tdedecko• 17 years ago

Initially, I was shocked that they would post the stolen information. Eventually I realized that this is going to be publicly available regardless of whether Techcrunch posts it or not. The information would be released elsewhere. As a news site, they are unable to ignore its existence.

Techcrunch has discussed this with Twitter. They have also decided not to release private information. From this I can say that they are being fair about this.

This does suck for Twitter. Though, it does bring to light the potential dangers of using a web service to host your confidential documents.

"the original security hole seems to be Google, via Google Apps for your Domain. Some passwords were guessed and things started to fall apart from there. Most (or all) of these documents were downloaded from Google’s servers."

esonica3• 17 years ago

I would argue it brings to light the dangers of not having secure passwords, this applies to local networks and servers, not just web services.

HoneyAndSilicon• 17 years ago

If you consider the sentence "Some passwords were guessed and..." in the above [ http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-o... ] ( guessed! ) doesn't that say something's seriously wrong with some basic operational practices by core staff (i.e., weak passwords on core business accounts - which just happen to be Google accounts)?

jacquesm• 17 years ago

If you store your corporate documents on other peoples servers you deserve what you get. What were they thinking ?

Confidential stuff should not leave the building, let alone be uploaded to 3rd party data centers. Keep in mind that just about anybody with sysadmin privileges at the company hosting your data also has access to all those documents.

As does anybody on the wire between you and the host during up or download.

Now let's hope somebody posts some of techcrunchs' internal and confidential documents. What goes around comes around.

ntoshev• 17 years ago

Arrington says the vulnerability was in Google Apps for Your Domain, although the original article about the hack says otherwise:

http://www.pcworld.com/businesscenter/article/164182/hacker_...

  Hacker Croll claimed to have accessed Goldman's Twitter
  password by first gaining access to his Yahoo account. 
  "One of the admins has a yahoo account, i've reset the
  password by answering to the secret question. Then, in
  the mailbox, i have found her [sic] twitter password," 
  Hacker Croll said Wednesday in a posting to an online
  discussion forum. "I've used social engineering only, 
  no exploit, no xss vulnerability, no backdoor, no sql
  injection."

I wonder why the hacker would send the documents to Techchrunch. He could have uploaded them somewhere and then submitted the link to Reddit.

ErrantX• 17 years ago

> wonder why the hacker would send the documents to Techchrunch

The inference I got was they paid for them. BUT I stress that is only what I picked up - not seen anything concrete. Could explain it though.

bigbang• 17 years ago

> although the original article about the hack says otherwise

This article is from May 1. The same hacker has hacked again (unfortunately thru social engineering again)

trickjarrett5• 17 years ago

I wondered the same thing. It's not like TC is going to publicize his hacker handle to get him credit. Seems like a disgruntled employee or user or spammer trying to stir up bad press for them.

sobriquet• 17 years ago

ruh roh..

I know TC said names of people who interviewed for "senior level positions" are included... wonder if the lower level positions are somewhere in there too.

Anybody interview and don't want their current employer to find out?

nostrademons2• 17 years ago

Eh, I interviewed, but it was before I joined my current employer. Unless the interviews are date-stamped or you've been at your job for longer than Twitter's been funded, I don't really see much of a problem.

rwebb• 17 years ago

jerk

sho• 17 years ago

If further proof was needed that secret question "backup passwords" are a really, really bad idea, this is it. Exactly the same way Sarah Palin's account was "hacked".

People, and companies, have to take more responsibility for their own security. They can't just say "it wasn't my fault, Yahoo has that feature!" - they need to active dump yahoo, and anyone else offering these ludicrous backdoors which defeat the point of even having a password.

radu_floricica• 17 years ago

I'd rather live in a world where I have to guard my private info then in one where I send info to news outlets only to have them self-censor it. Newspapers have a pretty clear job, and outside yelling fire in a theater I support them doing it.

Of course, checking the validity and relevance of what they publish is necessary, but that's a different discussion.

ananthrk• 17 years ago

TC's response to reactions on this issue

http://www.techcrunch.com/2009/07/15/our-reaction-to-your-re...

DanielBMarkham• 17 years ago

I refuse to click this link and give TechCrunch my pageview.

This is really simple. Act in a manner that you would like everybody else in the world to act like.

Aside from that comment, I'm not joining this circus.

trickjarrett5• 17 years ago

This is what news organizations do though. Fox, CBS, NBC, if they receive documents they would publish them too. Why is TechCrunch different?

joezydeco2• 17 years ago

Sigh. Didn't we just go through this with the lawsuit involving Apple and the Apple blogs?

http://www.nytimes.com/2005/03/12/technology/12blog.html?_r=...

"[The ruling]... focused on the notion that the published information included trade secrets and was essentially stolen property."

TrevorJ2• 17 years ago

Yes, other news outlets may do this, but you don't get the smarmy "Heehee, look what we got our hands on, heeheehee." smug crap from the New york times. TC is trying to have the best of both worlds here and generate pageviews while still trying to appear like they are on the moral high ground.

eli3• 17 years ago

Oh really? And exactly how do you know what documents they haven't published, eh?

"Minimizing harm" is one of the basic precepts of journalism, and journalists withold documents all the time for a variety of very good reasons.

erlanger2• 17 years ago

VOTE WITH YOUR FEET! MOVE ON UP!

Give me a break, your page view doesn't mean a thing.

justlearning• 17 years ago

please don't use upper case for emphasis, use asterisk

(guidelines: http://ycombinator.com/newsguidelines.html)

woodsier• 17 years ago

I wish I could downmod submissions. Fuck TechCrunch. It's tabloid crap.

Ardit202• 17 years ago

Wow, If I was Twitter, I'd feel raped.

Ardit202• 17 years ago

Well, when someone rapes you they penetrate your most intimate parts without your consent. I do not think there is anything more intimate for a company than their revenue data, plans and projections. So down vote all you like, however technically my analogy is correct.

TweedHeads• 17 years ago

Next time it won't be a spit, it will be a punch in the face.

jeremymims• 17 years ago

Wow. This debate is incredible.

First, I love using twitter and I think the guys that built it are great. They've created a product that means so much to people that many members on this site are willing to stand on shaky ground saying these documents shouldn't be published simply because they belong to a company they like. Internal documents are leaked all the time. For instance, Arrington reported that Microsoft's new search engine would be called Bing long before Microsoft announced this fact. How many of you chase Apple rumors before a keynote? This is all leaked information. Where's the outrage?

The standard for the press publishing information isn't malfeasance. Twitter need not have done anything wrong for the press to publish information that is of interest to its readers.

Arrington has drawn a line that companies are different than private citizens (who he feels should have some expectation of privacy). He is not releasing personal information that may hurt someone's career, merely information about twitter's potential future tv projects, business models, and projections.

The fact is he has gone about this in an extremely ethical way, acting as both reporter and ombudsman. He has censored portions which might do someone harm and has no doubt agreed to censor certain bits of information on behalf of twitter. However, he will publish as much of the information that is relevant and interesting as he can. In my opinion, this strikes a good balance.

psranga• 17 years ago

He talks about not crossing an ethical line and then says he's going to post the documents!

To posters drawing a comparison to newspapers like NYTimes, Wikileaks etc: ask yourself what public interest is served by these documents being made public (afaik none). And then ask yourself what public interest was served by the leakers of the Pentagon Papers.

dfj225• 17 years ago

All I can think of is Cryptonomicon and how much work Epiphyte(2) put into securing their IP and company plans. Of course this is fiction, but it made sense to me that the main value in a startup is in their ideas/IP so this should be protected to a great extent.

Apparently, Twitter didn't take this approach.

In Our Inbox: Hundreds Of Confidential Twitter Documents

Related Stories