The Channel Wire

July 16, 2009

Will Twitter sue TechCrunch and other Web sites that published some of the company's confidential information? Twitter executives aren't quite coming out and saying so, but in a published response to a reported hacking of Twitter employees' Gmail accounts and what certain sites, like TechCrunch, did with those confidential documents, it's hard to ignore the suggestion of legal action.

"We are in touch with our legal counsel about what this theft means for Twitter and anyone who accepts and subsequently shares or publishes these stolen documents," wrote Twitter co-founder Evan Williams in a Wednesday blog post titled "Twitter, Even More Open Than We Wanted." "We're not sure yet exactly what the implications are for folks who choose to get involved at this point but when we learn more and are able to share more, we will."

Twitter on Wednesday confirmed that a hacker named "Hacker Croll" successfully accessed the Gmail accounts of a Twitter administrator and Williams' wife on two occasions going back to April. According to reports, Hacker Croll used information contained in those e-mail accounts to get at Twitter company documents stored in Google Apps, Google's cloud-based suite of business and personal use applications. The hacker then passed those documents along to TechCrunch and other tech news sites; TechCrunch founder Michael Arrington reported receiving an e-mail file containing 310 confidential Twitter documents, at least one of which TechCrunch has already published.

In his blog post, Williams said he doesn't blame Google for the security breach and that he and other Twitter employees would continue to use Google and Google Apps.

"This attack had nothing to do with any vulnerability in Google Apps, which we continue to use," he said. "This is more about Twitter being in enough of a spotlight that folks who work here can become targets."

He also said that while the documents "were never meant for public communication," the ones that were stolen don't contain much in the way of critical internal information.

"As Peter Kafka put it, this is 'akin to having your underwear drawer rifled: Embarrassing, but no one's really going to be surprised about what's in there,' " Williams said. "That is an apt analogy."

The hacked Gmail accounts of Twitter employes do raise questions about security in the cloud -- one of the biggest roadblocks to widespread adoption of the model. ChannelWeb's Damon Poeter on Wednesday evening received a response from Google, which was asked about password strength and security for Google Apps.

"We handle password recovery differently for our Google Apps customers. There is no password recovery process for individual Google Apps users. Instead, users must communicate directly with their domain administrator to initiate password changes on their individual accounts," wrote Macduff Hughes, an engineering director at Google.