Elon Musk owns your Twitter user data and DMs. What does that mean for your privacy?

Elon Musk’s acquisition of Twitter is a done deal. For just $44 billion, he owns what he once called “the de facto town square.” It also apparently owns all of Twitter’s user data.

If you care about digital privacy and are a Twitter user, this may not be good news. Over the years, Twitter has been dogged by privacy and security issues while dragging its feet on implementing potential solutions. The result is that everything you’ve ever done or said on Twitter, public or private — including your direct messages — now belongs to one of the richest men in the world, a man known for being unpredictable, childish and even vindictive. . It is also owned by a man who is said to be planning to get rid of 75 percent of his staff, which could further compromise Twitter’s security. Oops!

There is much we still don’t know, and it may take a long time to find out. Musk’s attorney, Alex Spiro, did not respond to a request for comment, and Twitter isn’t saying much to reassure users. Before the deal closed, the company told Recode it had “nothing to add here at this time” when asked how long it kept user data or how long it would take for a user’s data to be completely erased from Twitter – if ever – if that user will delete their account. She did not immediately respond to a request for comment after the company changed ownership.

I tweet said that it will completely delete a user’s account at their request, but it takes at least 30 days for that to happen. And your DMs can sit on Twitter’s servers for years even after you think you’ve deleted them. So you can go ahead and delete your account if you’re really concerned, but there’s no guarantee that it will also delete some or all of your data.

What we do know is that Twitter’s direct messages are not end-to-end encrypted, despite all US senators to Musk himself calling for the company to do so. This means that Twitter has access to the content of your DMs, which many users would likely consider to be the most sensitive or intimate data the company has about them. And Twitter’s privacy policy is clearly stated that the company “may share, sell or transfer information about you in connection with a merger, acquisition, asset sale or bankruptcy.” Which is what just happened.

We’ve seen other situations where controls over user data were a condition of regulatory approval, such as Google’s merger with Fitbit. The European Union approved that acquisition on the condition that Fitbit user data be technically separated from any Google data used for advertising for at least 10 years. But those terms were announced before the merger went through and were intended to assuage competition concerns. This is not an issue with the Twitter-Musk deal, and no such announcements have yet been made.

Now, Musk will waltz into Twitter headquarters on his first full day (probably holding a sink again), fire up his computer, and immediately start reading all your DMs, watching Tweets of private accounts and collect user phone numbers? Probably not, and whether it happens at all depends on several factors, according to Andy Wu, a professor of business administration at Harvard Business School.

Twitter’s management team must first be ready to meet Musk’s demands. If not, he must replace them. To do so, he would have to go through the board of directors. However, it shouldn’t be too difficult to get them to agree to Musk’s demands. He reportedly fired several of Twitter’s top executives, including CEO Parag Agrawal and Vijaya Gadde, who was head of legal, public policy and trust and security. The new CEO, Bloomberg says, is Musk himself. As for the board, based on the preliminary proxy statement filed with the Securities and Exchange Commission, Musk plans to install his board immediately.

There are also whatever internal controls Twitter has in place — including those it’s supposed to have implemented under approval orders with agencies like the Federal Trade Commission (FTC) — that could hold Musk back. Musk will have to work with Twitter employees to get that data, and they may not be willing to help him read someone’s DMs. It’s hard to imagine Musk making such a request and that request not somehow leaking into the press. And that would certainly be a disaster for a company that Musk paid a lot of money for.

This is especially true for Musk’s the stated plan to make Twitter “the world’s most respected advertising platform” with “advertising that is most relevant to [users’] needs.” You need data to do this. Openly spying on users is a great way to get them to stop providing it—and to invite governments to crack down on your company’s privacy controls.

But when it comes down to it, if Twitter has the data and Musk wants to see it, well…

“I think the takeaway is, he can probably do it,” Wu said. “It wouldn’t make sense to do that. But Musk also does things that don’t make sense.”

Twitter users probably don’t have to worry about their data being leaked to Musk, but their data being leaked to everyone else. Twitter’s track record when it comes to security is already not good, and Musk may lay off employees who are essential to maintaining the protections he has that actually work (Musk has reportedly said he doesn’t plan to lay off that much many people or soon).

In July 2020, Twitter was hacked by a teenager, who gained access to some of the platform’s largest accounts, including Musk’s, and some of those accounts’ DMs. Twitter responded to the hack by hiring famed hacker Peiter “Mudge” Zatko to head its security division in November 2020.

Zatko left the company in January 2022. By September, he was testifying before Congress that Twitter had significant security problems and vulnerabilities and routinely failed to adequately protect its users’ data. In a leaked whistleblower complaint, Zatko alleged that about half of Twitter’s 7,500 employees may have access to any user’s personal information. There were rules against such a thing, but Zatko said they were not enforced. He also alleged that Twitter was not following security protocols as part of his 2011 settlement order with the FTC.

Twitter has largely denied Zatko’s allegations, calling them in a statement a “false narrative” that contains inaccuracies and a lack of context. A spokesman for Zatko said he was not commenting on Twitter.

Jason Goldman, Twitter’s first head of product and a former board member, tweeted Wednesday night that “a not insignificant number of people who worked on this site” were downloading their archives and have stopped DMing anything they wouldn’t want made public somehow. He told Recode that he doesn’t think there will be any “vicious leaks or deletions,” but he thinks the supposedly chaotic period Twitter is going through will mean a lot of turmoil.

“With that comes the increased risk of some big mistakes,” Goldman said in a Signal message.

However, there is one potential bright spot: Musk has expressed an interest in end-to-end encryption of DMs. And that means no one but the sender and receiver can see them, including Musk. Sen. Ron Wyden (D-OR), who has been urging Twitter to encrypt DMs for years, told Recode that he thinks encrypting DMs should be the first thing Musk does with his new company.

He added that while Musk has the right to moderate Twitter as he sees fit, he should also consider that Twitter users and advertisers may not want to have too much to do with a place the platform hates and misinformation. .

“If Musk decides to prosecute celebrities who spread hate and lies, advertisers and users will flee,” Wyden said. “The Internet is littered with failed MAGA platforms that prove that the vast majority of Internet users have no interest in wading through the mud of a site that doesn’t invest in responsible moderation.”

We’ll all soon see what kind of town square Musk thinks Twitter should be. If nothing else, the Twitter-Musk deal should be a good reminder that your data is as private as the company you give it to wants it to be. And as we know now more than ever, that ownership can change.

Update, Oct. 28, 12:40 p.m. ET: This story was originally published on October 27 and has been updated to reflect that Musk now owns Twitter and the subsequent changes in leadership.