Will We Learn from Twitter’s Collapse?
by Michał “rysiek” Woźniak
Even as we watch in disbelief as Twitter goes down in flames, we continue to put all our digital eggs in the baskets of Google Docs or Microsoft Office 365. We continue to host our services on Amazon AWS, behind CloudFlare. We continue to tie our businesses and public debate and our digital lives to Facebook. Because it’s easier that way. Until it’s not. But by then it’ll be too late.
Almost two years ago I looked at how centralization is a danger to democracy. I focused then on the issue of moderation, on the incentives that make centralized walled gardens unwilling to effectively combat harassment and disinformation, and on their leadership’s complacency in the matter.
A couple of weeks ago a billionaire, whose skin is apparently as thin as his wallet is thick, took over one of the important public squares on-line. It is a good moment to explore and recognize other dangers, in addition to failure to moderate the public debate, such centralized control creates. Twitter’s tumultuous transition to a privately held company became a lens, focusing — at long last — our collective attention on them.
These issues are hardly new or unexpected. Activists and experts had been warning about problems related to centralized control of our daily communication tools for years. But by and large, our warnings went unheeded. Today, as we mourn the communities disrupted and connections lost, and grapple with the fallout, we have to recognize this is about more than just Twitter. And use the opportunity to learn not to make the same mistakes again.
Data
Twitter has long ago become one of the crucial platforms activists and journalists (including those at risk) use to communicate, report on, and debate. For certain powerful entities this was a problem acute enough to engage in concerted efforts towards getting their hands on private information about dissidents who use the site.
Between November 2014 and may 2015, two Twitter employees exfiltrated personal information of users critical of Saudi Arabia and provided them to the regime. Such information could allow owners of the targeted accounts to be identified and potentially persecuted. And in fact, it has — at least in the case of Abdulrahman al-Sadhan, and probably several others.
Musk’s Twitter take-over was partially financed by an investment fund controlled by the Saudi regime. The very same regime that brutally murdered Jamal Khashoggi in its own embassy, and spied on his family and friends. The same people that eight years ago used spies inside Twitter to extract information about dissidents on the platform are now the platform’s co-owners.
Technically, the Saudi government does not get any formal control nor access to the data. But policymakers and activists are rightfully worried that their $1.9bln investment in Musk’s deal might give the Saudis enough leverage to not be stymied by technicalities.
This powerfully illustrates a point made by privacy activists since the early days of the Internet: privacy is contextual, and context changes in unexpected ways. You might “not have anything to hide” from your platform’s trusted operator right now, but what if the platform gets sold in a few years? Who will own it, who will have access to your data? And what will they use it for?
As Maciej Cegłowski presciently put it seven years ago:
Tech companies come and go, not to mention the fact that we share and sell personal data promiscuously.
But information about people retains its power as long as those people are alive, and sometimes as long as their children are alive. No one knows what will become of sites like Twitter in five years or ten. But the data those sites own will retain the power to hurt for decades
Infrastructure
Twitter is not only a service, but also, in many important ways, an infrastructure. People use their Twitter accounts to sign-in to other services. News websites embed tweets directly, often with no fallback. Communities and movements grow around specific hashtags. All of this relies on Twitter functioning correctly, and not changing too much about how its services and infrastructure work.
But there’s a new sheriff in town, and change is the name of the game. Engineers are being fired (and then asked to come back, apparently) or quit in droves, while the CEO takes upon himself to micro-manage how the service works under the hood — with predictable results.
This would be seen as precarious in any tech company, even one where technical underpinnings of the services it provides are well maintained and robust. But Twitter is not such a company. Its former CISO, Peiter “Mudge” Zatko, blew the whistle on (among others) the dangerously shoddy state of its infrastructure. And while statements like “Twitter lacks testing and staging environments” and “~60% of [servers] are running outdated operating systems” might not tell you a lot, anyone who understands how such services work can attest to just how outrageously bad this is.
In other words, an unhinged, micro-managing CEO, who has no understanding of the service’s technical set-up, is firing engineers responsible for running this service on an infrastructure that apparently is ridiculously brittle. No wonder people are getting worried. Techdirt instituted a new policy against embedded tweets. Information security experts are advising users to stop using the “login with Twitter” functionality.
All of this was considered rock-solid a few short weeks ago. Just like all other centralized services we have come to over-rely on. Centralized systems are monocultures, and monocultures are frail.
Trust
Twitter’s infrastructure is not the only brittle thing we need to worry about, though. The other is Chief Twit’s ego. Engineers get fired for criticizing Musk’s decisions, and comedians are suspended for parodying him. Truly the actions of a “free speech absolutist.”
Combined with his reckless attitude towards and complete control over a space of public debate used by over 200 million people, this is truly dangerous. As flawed as it was, Twitter’s perhaps most effective tool against random impersonators was the blue “verified” checkmark. At the very least it provided a chance to notice impersonation. It was important not just to random Twitter users trying to stay informed, but also to activists and people at risk who relied on it to avoid falling prey to malicious phishing attacks.
But Musk decided to roll out the “8-dollar verification”, Twitter Blue, against best internal and external advice. In the ensuing chaos, trust in the blue checkmark was utterly shattered.
While media attention is focused on how some companies lost billions due to $8 impersonators, it might be worth pondering how many people whom we will never hear about got hurt by this. In the past, verified accounts had to be taken over to be used in attacks. That’s considerably more effort than shelling out a few bucks. You can bet malicious actors were ready to go the moment Twitter Blue hit production.
Control
Even as we watch in disbelief as Twitter goes down in flames, we continue to put all our digital eggs in the baskets of Google Docs or Microsoft Office 365. We continue to host our services on Amazon AWS, behind CloudFlare. We continue to tie our businesses and public debate and our digital lives to Facebook. Because it’s easier that way.
Until it’s not. But by then it’ll be too late.
The control giant tech companies have over us is immense and growing by the hour. That control relies on their products being easy to start using, but very difficult to move away from. You can download your Twitter history, but it’s not going to be useful to you in any sense of the word: it’s just a data dump.
Resilience
We can build and use systems that are more privacy-preserving, that cannot be bought and sold outright, that cannot be taken over by oligarchs with out-of-this-world agendas and delicate egos. We can build systems that do not become single points of failure for the society, and in turn do not have single points of control and failure themselves.
Fediverse, perhaps the best social network money can’t buy, tripled its active user base since Musk gave Twitter users that sinking feeling. Briar, the open, decentralized, encrypted, and anonymous IM app, is also gaining a foothold amongst some activists. Nextcloud, an open-source Google Drive alternative that organizations can run themselves, is growing steadily.
We can also build systems that allow people to switch providers without losing contact with their friends and coworkers — e-mail and mobile networks are good, familiar examples of these. The fact that the big social media services, or the huge online productivity providers, do not allow this kind of compatibility is a business decision, rather than a technological necessity.
Choice
Building open, decentralized, privacy-friendly communication tools is considerably more difficult than building centralized, privacy-invading ones. It takes more time and effort. It’s also way more difficult to design them in a user-friendly way — somewhat higher complexity of their UIs is often unavoidable. And, with no data to sell or mine, it’s harder for them to find funding.
And so, platforms like Twitter, Facebook, or TikTok, or providers like Google Docs and Microsoft Office 365 get out there first, gain momentum and funding, and lodge themselves in the centre of our daily conversations, leaving almost no breathing space for better solutions to emerge. They know that once they lock our data in, it’s unlikely we go elsewhere — unless a Musk-sized calamity hits them too.
It is time we recognize that open, decentralized protocols are well worth the extra time and effort that needs to be put into them to make them appealing and useful. And, that centralized, closed services are actively harmful.
This means regulation that discourages walled gardens and bolsters networks of independently run, interoperable services, requiring compatibility between large providers — but done carefully not to hurt the enthusiastic, dedicated open-source developers and experimenters who proved this is possible in the first place. This means public funding for just such developers and experimenters, and for public services based on their work. This also means setting up a presence in decentralized social networks, as European Union and German federal government have already done.
“Never let a good crisis go to waste”, Winston Churchill once said, and it would serve us well to lean into that wisdom today. A centralized, closed, monopolistic platform’s agony is a good opportunity to reconsider our over-reliance on Big Tech walled gardens in general.
The views and opinions expressed on our blog are those of the authors, representing a wide range of viewpoints, and do not necessarily reflect the position of VSquare or our affiliated organisations.
Michał “rysiek” Woźniak (https://mastodon.social/@rysiek ) is the Information Security Officer at ISNIC, the .is DNS registry. He comes from a tech, policy, and activism background. Before joining ISNIC he was the Chief Information Security Officer at OCCRP, and has managed a free-software focused NGO.
He had co-operated with a number of EU-based organisations working in the digital human rights area and participated in severala number of Internet governance meetings. His main policy interests include information security, privacy in the digital age, Internet governance (including censorship, surveillance, Net Neutrality), copyright reform, digital media literacy; rysiek had co-authored the “Net Neutrality Compendium”, and the “Media and Information Competencies Catalogue”.
