Twitter 'leaving us in the dark' over state hacking claims, activists say

When more than 50 political activists from across Europe and North America were told by Twitter in December 2015 that their accounts had been attacked by anonymous “state-sponsored actors”, they had very little to go on.

One of those targeted was Anne Roth, who has been advising the German Left party during the government’s investigation into US surveillance. She is no stranger to these type of attacks, she said, but when threats come from her own government she has a framework for what to do.

“It was a Friday night, almost midnight in Berlin, and no lawyer in sight. I emailed the Electronic Frontier Foundation, because I thought they might still be awake. A few moments later I saw people tweeting about it, and that felt relieving somehow because in that instant I knew it wasn’t about me personally.”

In the two months since, campaigners from EFF and developers from anonymity tool the Tor Project have joined the activists in demanding more information from Twitter. In an open letter published in January, the group asked a detailed list of questions, including whether attackers gained administrative access to Twitter’s servers.

“Why does Twitter suspect that the attacks came from state-sponsored actors? Has Twitter identified any specific state as the source of the attacks? Were these automated brute-force attacks, customized attacks with a human behind them, or something else?,” it demanded.

Twitter has still not responded to the letter, campaigners said.

The notifications are thought to be the first example of Twitter warning its users of state-sponsored attacks, yet the campaigners say the company has not released as much information as Google, who have sent similar warnings to users since 2012. After sending its first batch of notices, Google’s information security team gave an interview to the New York Times, and their VP of engineering published a blog post with more information.

“Twitter should make a public statement explaining their rationale for sending out these warnings, as Google and Facebook did before it,” says Jillian York, a director at EFF, a digital rights campaign group based in San Francisco. York did not receive a warning from Twitter, but has previously received five similar notices from Google.

The original warning sent from Twitter in December recommended users take steps to secure their accounts, suggesting using Tor to connect to the service and EFF’s guide on using social networks anonymously.

“Twitter’s users deserve to know which government has gained access to their account,” says Kate Krauss, spokesperson for the Tor Project, the non-profit that develops the anonymity network. “Twitter’s complete silence on this point is puzzling.”

Sent on or just after 14 December, the notification warned: “As a precaution, we are alerting you that your Twitter account is one of a small group of accounts that may have been targeted by state-sponsored actors. At this time, we have no evidence they obtained your account information, but we’re actively investigating this matter.” The statement said Twitter had no additional information it could share, but said the attackers may have been trying to access users’ IP addresses, email addresses and phone numbers.

The lack of information from Twitter has led to speculation within the group about both the motive and the culprit of the attack. Some suggested that use of Tor could be a common factor, while others suggested the nation state implicated could be anyone from the US or UK, Germany, France, Russia or China.

The group includes members of the French digital rights advocacy group La Quadrature Du Net, the US-based Seattle Privacy Coalition, the international digital rights organization Access Now, developers of the anonymity software Tor and other privacy activists and writers from Canada, Switzerland, Germany and Italy. One of the affected users is an activist tweeting about the war in Donetsk, another a journalist covering the German parliamentary investigation into surveillance by the US National Security Agency.

Anne Roth, one of the 50 activists targeted, has been advising the German Left parliamentary party as part of that investigation and had to gain security clearance for her government job. “It is my job to investigate activities of the ‘five eyes’ and probably not too far fetched to assume that this is of interest to different secret services,” she said. “My partner was arrested with a terrorism charge (in Germany) years ago, and later released, charges dropped. We lived with anti-terror surveillance for years.”

“When I first saw the (email from Twitter), I felt a moment of shock. It felt like ‘oh no – here they come again’,” Roth says. “It felt in that moment like I was personally targeted and that’s scary, especially when you have no idea who’s targeting you.”

Another affected user, German security consultant Jens Kubiezel, observed that around 30 of the affected accounts almost exclusively connect to Twitter through Tor, although 10 users said they never used it. “While the accounts are geographically widely distributed, some of them use Tor to access the web. So there is a chance that really all used the same server,” said Kubiezel. Other activists dismissed the idea that Tor was the common factor, saying that the only common factor was Twitter itself.

Twitter was praised in 2011 when the company contested a Department of Justice gag order accompanying a subpoena for the data of the member of the Icelandic parliament and other Wikileaks volunteers. “Twitter resisted (the subpoenas) in secret, not for PR,” says David Robinson, of the targeted activists. “Though they lost in court, they modelled admirable corporate behavior.”

Twitter has repeatedly declined to comment or to confirm whether it was still investigating the breaches.

A spokesperson pointed to a previous public statement in which the company acknowledged that users accessing the site via Tor may have to navigate anti-spam measures: “Twitter does not block Tor, and many Twitter users rely on the Tor network for the important privacy and security it provides. Occasionally, signups and logins may be asked to phone verify if they exhibit spam-like behavior. This is applicable to all IPs and not just Tor IPs.”

Google has warned users of this type of attack since June 2012, and Facebook since October 2015. Microsoft and Yahoo have announced they will follow suit, although are not known to have issued any warnings yet.