Musk’s Twitter May Have Violated Consumer Agency Rule, Experts Say

Just two weeks after Elon Musk took over Twitter, the company may have already violated its consent agreement with the Federal Trade Commission (FTC), legal experts said.

If proven, the breach could lead to significant personal liability for Musk, increasing the risks he faces from stumbling into a quagmire of business and content moderation headaches, most of which are self-inflicted.

The potential breach stems from a reporting obligation that Twitter must comply with whenever the company undergoes a change in structure, including mergers and sales.

Under Twitter’s latest FTC consent order, implemented this year, Twitter must submit a sworn notice of compliance to the regulator within 14 days of any changes.

The compliance notice is intended to advise the FTC of major changes to the company, as well as a commitment that it will continue to comply with the order, according to David Vladeck, a former senior FTC official and Georgetown University law professor.

Musk’s deal with Twitter closed on Thursday, October 27, leading some legal experts to question on Thursday whether Twitter had made the proper filings in light of the company’s mass layoffs and the exodus of senior executives. . Among those who resigned were the chief privacy officer and chief information security officer, who were supposed to be involved in the company’s compliance reporting.

“Good luck to the poor bastards dealing with this,” tweeted Riana Pfefferkorn, a researcher at the Stanford Internet Observatory.

The FTC declined to comment on whether Twitter has issued any compliance notices since Musk took over the company. Twitter, which has laid off a substantial portion of its public relations team, did not immediately respond to a request for comment.

Alex Spiro, Musk’s attorney, told CNN on Thursday that “we are in ongoing dialogue with the FTC and will work closely with the agency to ensure we are in compliance.”

There are other more substantive regulatory obligations that have also been questioned. They include requirements for Twitter to produce written privacy assessments of any new “product, service or practice” – or when Twitter updates such things – that could affect user data or put it at risk.

The dizzying pace of product changes at Twitter since the Musk acquisition, combined with the company’s greatly reduced headcount, has raised questions about whether Twitter is following the rules it has agreed to.

“Chaos is something the FTC is going to be concerned about,” Vladeck said, “because there were serious shortcomings that led to the consent order in the first place, and the FTC is going to want to make sure they’re doing what they’re supposed to be doing.”

Internal concerns about Twitter’s compliance obligations were reflected in a Slack message seen by CNN earlier this week, in which an employee warned colleagues that Musk could seek to assign responsibility for certifying FTC compliance to individual engineers at the company.

“This will pose a huge amount of personal, professional and legal risk to engineers,” the official wrote, adding that the new risks created by Musk could be “extremely detrimental to the longevity of Twitter as a platform.”

Matt Blaze, a professor of computer science and law at Georgetown University, urged Twitter employees to seek professional legal advice “before signing anything or making any statement to regulators.”

“This is a bus you DON’T want to be thrown on,” Blaze tweeted.

The FTC’s consent orders have the force of law and any violations, if proven, could involve significant penalties, including fines, restrictions on how Twitter can run its business, and even potential sanctions on individual executives.

The company’s latest consent agreement was announced this spring following allegations by the FTC that Twitter misused user account security information, such as phone numbers and email addresses, for advertising purposes. The resulting consent order expanded on a 2011 consent agreement that Twitter signed with the FTC committing the company to maintain a robust cybersecurity program.

This summer, former Twitter security chief Peiter “Mudge” Zatko claimed that Twitter was failing to meet those obligations in an explosive whistleblower disclosure reported by CNN and the Washington Post. (Twitter previously rejected Zatko’s claims, saying that security and privacy have “long been the top priorities of the entire company.”)

These allegations, which predate Musk’s inauguration, may have already put Twitter at risk for billions of dollars in potential FTC fines, legal experts said.

Now, the latest allegations of Twitter breaches could mean that even more money is at stake, as well as possible individual liability from Musk himself. Any alleged infringement would have to be proved first, and the FTC would need to decide whether to enforce it, Vladeck said. But under those circumstances, he said, “I think it’s likely that Musk will be named” in a future consent order. “After all, he made it clear that he and he alone are making important decisions.”

The FTC has increasingly signaled that it could seek to personally hold individual executives accountable if they are found responsible for a company’s violations, naming them on future orders and imposing mandatory requirements on their future conduct, even if they leave the company. (Last month, the FTC showed its willingness to move forward by imposing sanctions on the CEO of alcohol delivery service Drizly.)

Foreshadowing such a move, FTC Chair Lina Khan told US lawmakers that former Twitter CEO Parag Agrawal could “absolutely” be held personally liable in connection with Zatko’s allegations, if proven.

The FTC has not confirmed whether it is investigating Zatko’s allegations, but on Thursday it issued a rare statement saying the agency is watching the current situation closely. As news of the executive departures unfolded, the agency said it is “following recent developments on Twitter with deep concern.”

“No CEO or company is above the law, and companies must follow our consent decrees,” the FTC said. “Our revised consent order gives us new tools to ensure compliance and we are prepared to use them.”