In Our Inbox: Hundreds Of Confidential Twitter Documents | Hacker News Reader

In Our Inbox: Hundreds Of Confidential Twitter Documents

techcrunch.com

68 pointsvaksel76 comments

I'm strongly of the opinion that they shouldn't post them... Just seems like bad karma at the least or a potential legal problem at the worst.

Posting this is in techcrunch's best interests. It'll get them a ton of traffic. I'm sure they'll milk it for a 5-6 posts. Then a few weeks down the road, someone will do the same thing to them, and they'll do another 2-3 posts with outrage that their privacy and confidential information was violated.

I'm sure they'll keep all the juicy stuff hidden. Since they are working with twitter on what they will/won't release. Although its kinda stupid, considering the stuff will show up on other websites

  If we only posted things that companies gave us permission to post
  this would be a press release site and none of you would be here.
  News is stuff someone doesn’t want you to write.
  The rest is advertising.

-- Michael Arrington

http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-o...

I wonder if he would see it as "news" if someone posted all of TechCrunch's private internal documents?

He actually replied in the comments to something just like this. He said "no" of course :)

The question he was asked was actually whether he would want someone to publish TC's documents. The answer is obviously no. However, that's completely separate from whether he would consider it news. It's news whether or not you want it to be.

This is what's profoundly wrong with this Arrington character. What an awful, tabloid approach to defining news. New reporting is, quite simply, doing the legwork to bring stories to your attention. They might not have come to your attention for any number of reasons - distance from the source (too many nodes between you and it for it to get carried to your ears by your social network), original source too small/obscure, information not meme/viral enough (too complex? takeaways not clear? relevance to you is difference to relevance of all the potential, necessary carrier nodes it would take to reach you), you need your information filtered because you're too plugged in; privacy / legal status of the source is just one reason why you might not get information.

Whether a news outlet should carry that last set of info to your ears or not is up for debate; but to see his role as binary - advertising/PR newswire vs. broadcaster of leaked private information... well, how sad.

He's not alone of course. Tabloids have been operating on basically just that model for eons. With the occasional fabrication when they can't get enough leaks to fill the inches.

Don't forget genuine analysis, especially in the sense of placing things in context, historically speaking.

That's something that's hugely missing from the "tech reporting" (ha) of today. Almost no one considers the things that came before.

For example, I saw no one else comparing Google Wave to OpenDoc... or even remarking on the old command-line tool, talk/ytalk. Both of which are extremely relevant to Wave as a product.

Shame.

....because it sounds kind of boring....and it's not news....it's analysis. Different.

Is a newspaper full of what's new, or is it news because it's in the paper?

Most of the front-page articles on HN are not news, they are recycled anti-business school puff pieces. And yet, this is Hacker News.

If Google releases a product that looks suspiciously like Apple's failed OpenDoc initiative from, oh, 12 years ago, that's news. If they're focusing on a communication medium style that totally existed before, but which was largely abandoned because it was incredibly annoying, that's news, too. Those who don't learn, doomed repeat, etc., etc.

You sir are right. I should of course trust the officials and you as to wether or not I should know something. Those people didn't get to be official without obviously having the utmost concern for my well-being, and without wanting me to be fully informed of the important stuff. Who do I think I am, wanting to know something that someone else deems improper for me to know?

I weakly agree with you, but consider a few counterexamples. Were Bernstein and Woodward wrong to publish information they received from Deep Throat about Watergate? If someone were to leak confidential info on the Bush administration's role in Guantanamo Bay, should the press publish that? How about Microsoft's Halloween memo? Was that fair game?

There's a line somewhere. Twitter's financial position somehow seems different than Watergate. I'm kinda curious where you think the line is. It's not a universal "journalists should never publish confidential information", because in many cases, it's very important for the public to know.

Now that we know who Deep Throat was, Woodward and Bernstein are no longer quite the shining example of capital-J Journalism that they remain in the field's hagiography.

They were spoon-fed all their information by the acting head of the FBI -- the free press didn't oust Nixon, the powers that be did.

Don't forget that the anonymous sources are steering the story, and that their agenda is often more interesting than the actual information.

It's very different from Watergate! The Watergate scandal involved the U.S. government, which is accountable to its citizens, and this is about a privately held company, accountable only to itself and its investors. Also, the Deep Throat information helped reveal a major violation of federal law. This kind of information (according to TC themselves) would only be useful to Twitter's competitors.

With that said, I still can't help but be curious. It'll be interesting to see how all of this plays out, and if some of the documents do end up released to the public, I'll probably cave and check up on the juicy tech gossip.

> a privately held company, accountable only to itself and its investors.

Well, no. Companies are also accountable to their customers and to society. If they were dumping large amounts of toxics into rivers, that's something society has a stake in and where the company is accountable to it.

If Twitter were to sell access to protected updates, that's something their users need to know. If they were doing so illegally, that's something that society must know.

It all depends on the information that will be revealed whether or not it's ethical. I'm inclined to not give an "unethical" verdict too quickly. TC is at least caring about individual persons that may be damaged by the revealing of some information.

Have you paid Twitter money lately? Then you're not a customer...

Govt comparisons fail -- this is Twitter. Dumping toxic waste comparisons fail -- this is Twitter.

Likelihood that Twitter is organized enough to sell access to private messages, or any actual saleable product? Extremely low.

I agree with you about the customers needing to know about Twitter selling private data, but the TC article mentioned nothing about any nefarious going on inside of Twitter. I'm sure they'd be more than happy to be a whistleblower, but in this case, publishing those docs would amount only to gossip. And that's why this is a totally different situation from Watergate.

I’ve been going over this in my mind and this is what I’ve come up with.

On one hand you can look at it as a straight theft. If a person steals a bunch of computers and then sells them to a computer shop for 25% of the retail price the shop owner is guilty of a crime (selling stolen goods) even if he had no part in the initial theft. In that case I’d say it’s immoral on Techcrunch’s part. Because while the digital copies of files don’t have monetary value like physical computers they have intellectual property value that could do significant damage to Twitter and in doing so cause the company to lose large sums of money.

ON THE OTHER HAND, most of the great scandals both in Government and in Corporate America have been revealed by whistle blowers who essentially stole documents and passed them on to reporters. So there’s a precedent where stealing documents can actually be a very moral thing.

In the end I think it boils down to what the documents reveal. In the case of whistle blowers they're still stealing something but we forgive the theft because it’s done to protect society from a greater harm. The good out weighs the bad. So if these documents reveal some kind of malfeasants on Twitter’s part I could see publishing them as being justified. If not I think you’re probably right and this is an immoral act on Techcrunch’s part.

In other words, because in the case of Techcrunch the end doesn't justify the means it's immoral?

I wouldn’t say “ends justify the means” is accurate here. Morality’s a tricky bag no matter how you slice it but one thing most ethical systems have in common is a belief that harming others to benefit yourself is wrong. So, for example, if you’re my boss and someone offers to pay you a million dollars to fire me even though I’m a good worker that would be wrong. Even though you would gain far more than I would lose. Because you’re causing harm to me in order to benefit yourself.

What I was saying is that it’s justified if the benefit is to society. This is based on two principles that are pretty much accepted across the board as far as ethical systems go. One, you are part of society and there’s nothing immoral about defending yourself against harm. Two, societal benefits are in the macro so even if a company is only causing a little harm per person the amount of harm prevented adds up.

So in my eyes and in the eyes of most ethical systems publishing these documents wouldn't be justified even if Techcrunch gains more than Twitter loses. Unless there's information in those documents that would benefit society as a whole (or if Twitter was causing great harm to someone else and it would be stopped by revealing the documents)

It would seem to me that you are effectively treating society as this single entity and saying that so long as an action benefits that entity then it is moral even if the action itself would be considered immoral in another scenario.

However society is not a single entity, but rather a collection of individuals that can be affected by an event in different and often opposing ways. To some it may be beneficial, but to others not so. Sure the group that benefits may be in the majority, but to ignore the minority group and declare that to "society" the outcome was good is to ignore the different views and interests that make up a society.

"Public good" is not so naively defined, and the grandparent made this explicit by reference to the multiplier effect of public harms.

When making moral judgments you have to treat society as a single entity. Either that or choose to simply not make the judgments at all. Because there are just too many people in society to calculate the exact amount of good or bad a decision will be to them.

Accordingly, you can only really use "it's good for society" if there's a clear benefit. Exposing a chemical company that dumps waste into a town's water supply is a clear benefit. As is making false financial statements in order to inflate your stock to the point where millions will eventually lose their savings. These are clear cases where a whistle blowers in justified.

But yes, as far as what's a clear case there is some judgment involved. As my old ethics teacher used to say Morality isn't a math equation it's an essay question.

It's a public policy exemption. A greater good call by a grateful society would not punish TC for its crime/immorality if it deemed the leak to be of sufficient value to public interest. That's a risk the publisher/whistleblower takes but it's only a risk if there's an enforcement/judgment process in place, or else TC faces no such risk and can publish anything it damn well likes without having to estimate the value to the public interest of its actions. Which, quite frankly, is what they frequently failed to do in the past.Their judgement is suspect, to me at least, even if they've never been punished.

"TC faces no such risk and can publish anything it damn well likes without having to estimate the value to the public interest of its actions"

Isn't that a consequence of free speech?

I think I could agree with airing a companies' dirty laundry if it was dirty enough.

Techcrunch would have mentioned it if they found anything that was more than vaguely interesting, so I feel confident saying that they don't have anything big enough to justify this violation of privacy. Techcrunch is dirtying it's name for private information that is not even newsworthy.

I'm with you. That said, can you picture Arington going to jail to protect his source? Cause this is about Journalism, right? Right?

He did offer to pay for a lawyer for a "whistle blower" source, not so long ago.

  The guy (”Hacker Croll”) who claims to have accessed 
  hundreds of confidential corporate and personal documents of 
  Twitter and Twitter employees, is releasing those documents 
  publicly

The hacker is releasing the documents publicly. TechCrunch is commenting on public information. They didn't cause the breech, twitter did, and they aren't acting as an exclusive disseminator of information, they just acted the fastest.

If there was no interest from TechCrunch or other "news" sites about this information, the dude would not have his 15 minutes of fame. Arrington's decision to pass on stolen documents is at best highly unethical and at worst criminal.

It's unfortunate that TechCrunch has been blinded with greed and famewhoring enough to not see this.

It's official: micheal arrington is the perez hilton of the tech world.

But seriously, how is this in any way legal? I almost can't believe it, it seems like a hoax...

it may be somewhat unethical, but its legal. If you couldn't write about anything "confidential" the news companies would be out of business.

Yes, this is what Michael is pointing out and he is somewhat right. Otherwise, if something negative leaks out of the company, they might just call it confidential and nobody could publish it...

Why doesn't it count as trafficking in stolen property? The documents weren't leaked, they were stolen. They are not "confidential", they are stolen property.

There's no difference between "leaked" and "stolen". Leaked documents are just those stolen by an employee.

Welcome to 2009, that's been official for a while now.

Initially, I was shocked that they would post the stolen information. Eventually I realized that this is going to be publicly available regardless of whether Techcrunch posts it or not. The information would be released elsewhere. As a news site, they are unable to ignore its existence.

Techcrunch has discussed this with Twitter. They have also decided not to release private information. From this I can say that they are being fair about this.

This does suck for Twitter. Though, it does bring to light the potential dangers of using a web service to host your confidential documents.

"the original security hole seems to be Google, via Google Apps for your Domain. Some passwords were guessed and things started to fall apart from there. Most (or all) of these documents were downloaded from Google’s servers."

I would argue it brings to light the dangers of not having secure passwords, this applies to local networks and servers, not just web services.

If you consider the sentence "Some passwords were guessed and..." in the above [ http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-o... ] ( guessed! ) doesn't that say something's seriously wrong with some basic operational practices by core staff (i.e., weak passwords on core business accounts - which just happen to be Google accounts)?

I'd rather live in a world where I have to guard my private info then in one where I send info to news outlets only to have them self-censor it. Newspapers have a pretty clear job, and outside yelling fire in a theater I support them doing it.

Of course, checking the validity and relevance of what they publish is necessary, but that's a different discussion.

Wouldnt the unethical thing be sitting there reading through a bunch of documents you know were illegally obtained? Then following it up by basically bragging about it..

TechCrunch is not what it used to be :(

I refuse to click this link and give TechCrunch my pageview.

This is really simple. Act in a manner that you would like everybody else in the world to act like.

Aside from that comment, I'm not joining this circus.

This is what news organizations do though. Fox, CBS, NBC, if they receive documents they would publish them too. Why is TechCrunch different?

Sigh. Didn't we just go through this with the lawsuit involving Apple and the Apple blogs?

http://www.nytimes.com/2005/03/12/technology/12blog.html?_r=...

"[The ruling]... focused on the notion that the published information included trade secrets and was essentially stolen property."

That was a ruling that said Apple could track down the leaker. It didn't say the documents couldn't be published.

Oh, I see. I guess my interpretation of "stolen property" is different from yours. Sorry.

Yes, other news outlets may do this, but you don't get the smarmy "Heehee, look what we got our hands on, heeheehee." smug crap from the New york times. TC is trying to have the best of both worlds here and generate pageviews while still trying to appear like they are on the moral high ground.

Your issue is with their "hey look what we got" post and not with the fact that they are posting it?

That's my direct answer to the previous poster who used the "but other media outlets do this as well" argument. I'm not sure if I espouse TC posting the info, but I definitely think they are a lot more smug about it than mainstream media allows themselves to be.

Oh really? And exactly how do you know what documents they haven't published, eh?

"Minimizing harm" is one of the basic precepts of journalism, and journalists withold documents all the time for a variety of very good reasons.

"Minimize harm" except for the public good. Watergate, WMDs in Iraq, etc. These are all worthy topics where the general good trump the protection of individuals. These are news.

I have no disillusions that this is not real news. Twitter internal memos are not headline news. But how much of TechCrunch really is? Sure we get some headlines about upcoming features in Apple or Microsoft or Google. But in the big scale of things, it's never going to replace CNN, Reuters or BBC.

Arrington wrote that they are not posting ones that are tabloid-esque in their nature to embarass. So he is attempting to manage the damage while still doing what he does - generate revenue by utilizing what information he is given.

I don't know what files they withheld. My point is that, had the hacker sent this to a real news agency rather than TC, they would have published docs too.

And I wager the discussion on the forums would be more centered around the content rather than the fact that TC dared publish papers.

Lastly, my main thing is this: How is publishing this information different than beating the other sites to news about Apple's big announcement the next day? The information was acquired from an unauthorized source (as most leaks are.)

My point is that, had the hacker sent this to a real news agency rather than TC, they would have published docs too.

And my point is, I'm not so sure you're right. Unless there's actually something newsworthy contained in the documents, I think only the sleaziest news outlets would publish any details at all beyond perhaps the fact that there had been a break-in.

For example, http://www.nytimes.com/1996/12/02/business/who-me-print-a-le...

You're correct, not every news outlet would publish them. But I believe more would than wouldn't. Especially in these times of dwindling cash flow, the desire to bring eyes in will bend even the resolute.

VOTE WITH YOUR FEET! MOVE ON UP!

Give me a break, your page view doesn't mean a thing.

please don't use upper case for emphasis, use asterisk

(guidelines: http://ycombinator.com/newsguidelines.html)

That was in imitation of protest banners. I believe it's the first time I've used such formatting.

I wish I could downmod submissions. Fuck TechCrunch. It's tabloid crap.

He talks about not crossing an ethical line and then says he's going to post the documents!

To posters drawing a comparison to newspapers like NYTimes, Wikileaks etc: ask yourself what public interest is served by these documents being made public (afaik none). And then ask yourself what public interest was served by the leakers of the Pentagon Papers.

The scary part is that TechCrunch isn't the only place these documents will land up at. Other recipients of these documents won't be so scrupulous about not posting sensitive information. I imagine Twitter is going through a lot of hassle around resetting security codes, reaching out to interview candidates, employees taking measures to protect identity theft, etc. Just a nightmare.

The other scary scenario is that this "hacker croll" has more documents which he hasn't shared yet. When the original HL2 code was stolen from Valve, Gabe Newell was contacted later with additional documents (which lead to that person getting arrested)

Wow. This debate is incredible.

First, I love using twitter and I think the guys that built it are great. They've created a product that means so much to people that many members on this site are willing to stand on shaky ground saying these documents shouldn't be published simply because they belong to a company they like. Internal documents are leaked all the time. For instance, Arrington reported that Microsoft's new search engine would be called Bing long before Microsoft announced this fact. How many of you chase Apple rumors before a keynote? This is all leaked information. Where's the outrage?

The standard for the press publishing information isn't malfeasance. Twitter need not have done anything wrong for the press to publish information that is of interest to its readers.

Arrington has drawn a line that companies are different than private citizens (who he feels should have some expectation of privacy). He is not releasing personal information that may hurt someone's career, merely information about twitter's potential future tv projects, business models, and projections.

The fact is he has gone about this in an extremely ethical way, acting as both reporter and ombudsman. He has censored portions which might do someone harm and has no doubt agreed to censor certain bits of information on behalf of twitter. However, he will publish as much of the information that is relevant and interesting as he can. In my opinion, this strikes a good balance.

If you store your corporate documents on other peoples servers you deserve what you get. What were they thinking ?

Confidential stuff should not leave the building, let alone be uploaded to 3rd party data centers. Keep in mind that just about anybody with sysadmin privileges at the company hosting your data also has access to all those documents.

As does anybody on the wire between you and the host during up or download.

Now let's hope somebody posts some of techcrunchs' internal and confidential documents. What goes around comes around.

Arrington says the vulnerability was in Google Apps for Your Domain, although the original article about the hack says otherwise:

http://www.pcworld.com/businesscenter/article/164182/hacker_...

  Hacker Croll claimed to have accessed Goldman's Twitter
  password by first gaining access to his Yahoo account. 
  "One of the admins has a yahoo account, i've reset the
  password by answering to the secret question. Then, in
  the mailbox, i have found her [sic] twitter password," 
  Hacker Croll said Wednesday in a posting to an online
  discussion forum. "I've used social engineering only, 
  no exploit, no xss vulnerability, no backdoor, no sql
  injection."

I wonder why the hacker would send the documents to Techchrunch. He could have uploaded them somewhere and then submitted the link to Reddit.

> wonder why the hacker would send the documents to Techchrunch

The inference I got was they paid for them. BUT I stress that is only what I picked up - not seen anything concrete. Could explain it though.

> although the original article about the hack says otherwise

This article is from May 1. The same hacker has hacked again (unfortunately thru social engineering again)

I wondered the same thing. It's not like TC is going to publicize his hacker handle to get him credit. Seems like a disgruntled employee or user or spammer trying to stir up bad press for them.

TC's response to reactions on this issue

http://www.techcrunch.com/2009/07/15/our-reaction-to-your-re...

All I can think of is Cryptonomicon and how much work Epiphyte(2) put into securing their IP and company plans. Of course this is fiction, but it made sense to me that the main value in a startup is in their ideas/IP so this should be protected to a great extent.

Apparently, Twitter didn't take this approach.

ruh roh..

I know TC said names of people who interviewed for "senior level positions" are included... wonder if the lower level positions are somewhere in there too.

Anybody interview and don't want their current employer to find out?

Eh, I interviewed, but it was before I joined my current employer. Unless the interviews are date-stamped or you've been at your job for longer than Twitter's been funded, I don't really see much of a problem.

If further proof was needed that secret question "backup passwords" are a really, really bad idea, this is it. Exactly the same way Sarah Palin's account was "hacked".

People, and companies, have to take more responsibility for their own security. They can't just say "it wasn't my fault, Yahoo has that feature!" - they need to active dump yahoo, and anyone else offering these ludicrous backdoors which defeat the point of even having a password.

Next time it won't be a spit, it will be a punch in the face.

Wow, If I was Twitter, I'd feel raped.

Well, when someone rapes you they penetrate your most intimate parts without your consent. I do not think there is anything more intimate for a company than their revenue data, plans and projections. So down vote all you like, however technically my analogy is correct.

jerk

I'm not a lawyer but this says it's going to publish entire documents which supposedly are private, what it's illegal. This is just marketing and not true (the entire thing).

So do they hacked the entire computer network of Twitter offices just for the shake of sending the documents to Michael Arrington?

Are you serious?

If you were following the story you could see the computer criminal, some script kiddie, guessed some passwords and got into the Yahoo Email or Google Apps accounts of some Twitter employees. Typical of script kiddie computer criminals, they were seeking fame which means seeing their handle/nickname plastered all over the Internet.

Reply on news.ycombinator.com