Musk's Twitter takeover raises more questions than answers about data privacy

The $44 billion purchase of Twitter by the world's richest person, Elon Musk, has immediately launched speculation about the future of content moderation, hate speech and subscription models on the social media platform.

But users who hear Musk's plans for turning Twitter into an "everything app" have one concern top of mind – data privacy.

The company has a history of missteps when it comes to guarding user data

What's been exposed in past security breaches includes tweets, likes andemail addresses and phone numbers tied to Twitter user names, which aren't always someone's real name.

'FREED' BIRD: Day 1 of Elon Musk's Twitter and the social media platform's path forward

But if Twitter begins collecting more data, including payment info in order to charge users for services and offer commerce options, experts say the company will need to build up trust that it won't misplace or misuse that data.

"I think that the biggest jump here is if people are gonna trust Twitter enough to give them more data knowing that they've had missteps with the data that they have right now," said global data privacy expert and technologist Debbie Reynolds. "And if people like it enough to want to pay for things."

Privacy experts point to a few promising signs, including the fact that Musk has been critical of Twitter in the past for not using end-to-end encryption to protect direct messages.

"I think it's fair to say there's a lot of people who are looking very closely to see what's going to happen," said James Lee, COO of the non-profit Identity Theft Resource Center.

A history of Twitter's data privacy issues

Before Musk took over the company last week, Twitter had a trust problem, Reynolds said.

Earlier this year, Twitter was fined $150 million for misusing user data over a period of six years.

According to the Federal Trade Commission, Twitter prompted users to provide their telephone numbers and or email addresses for security purposes. Users were told the information would be used to enable multi-factor authentication to better secure who could log on to their accounts, as well as to help with account recovery.

In addition to using the phone numbers and email addresses for those purposes, Twitter also used the information to show people targeted ads, the FTC said.

"Just how persuasive was Twitter’s security pitch? During the time period covered by the complaint, more than 140 million users gave Twitter their email addresses or phone numbers for security purposes," the agency said in a release announcing the fine.

In July, a cybersecurity breach exposed the email addresses and phone numbers of 5.4 million Twitter profiles. At that time, Twitter recommended anyone trying to stay anonymous should not link a publicly known phone number or email to their Twitter account.

ZATKO: Twitter whistleblower brings critiques to Congress

"Historically there's been a number of concerns," Lee said. "A lot of them were focused on internal controls. Who has access within Twitter to the information about users?"

And after whistleblower Peiter Zatko filed a complaint exposing what he said was lax security that could make the company’s data vulnerable to foreign infiltration, he revealed more details about the level of access Twitter employees had to user data in testimony before the Senate Judiciary Committee in September.

“Thousands of Twitter employees can access user data they don’t need access to do their jobs. And if foreign assets work for Twitter, those foreign assets can also access the data,” he said during that testimony. “An employee could take over the accounts of all of the senators in this room.”

If that's accurate, Lee said it's a demonstration of poor cyber hygiene on Twitter's part.

"If you don't need to have access, you shouldn't have access," he said. "And even if you do need to have access, it needs to be strictly monitored and it needs to be ... only those pieces of data that you really need to do your job."

Given these missteps in the past, it could be a hard sell for Musk to begin asking users to turn over even more data, which Reynolds said seems likely given his profit goals.

"In order to make it more profitable to people who buy Twitter ads, they're going to have to collect more data about individuals," she said. "It remains to be seen if people trust Twitter enough to give them more information."

What personal data does Twitter collect?

Twitter doesn't collect as much personal identifiable information as other social media sites, Lee said, but that doesn't mean its data isn't valuable to criminals.

"The information they do have can be very valuable to cyber thieves and it can be very harmful to the individuals that their data gets out."

That includes the harm caused by revealing the identity of anonymous users, he said.

While many users only use the app to follow public figures, retweet and occasionally tweet thoughts of their own publicly, there are others for whom losing anonymity on the site could be dangerous, Lee said.

"There are people who rely on Twitter in journalism, in public policy and in other areas where you know if you want to do harm to those people, you can get a lot of information about them. And be able to advance that goal of either physically or you know virtually doing harm," he said.

WHISTLEBLOWER: Twitter negligent on cybersecurity

Twitter has made some strides in recent years to improve data privacy.

"They've added some new privacy controls ... now you can use an authenticator app, as opposed to the more traditional multi-factor authentication," Lee said. "That is far more secure. So they are doing some things to help people who want to lock down their accounts and protect their personal information."

Musk and others have criticized Twitter's lack of use of end-to-end encryption.

That capability means communications like direct messages can only be seen by the sender and recipient, without employees of the platform being able to see.

Apps like Signal, WhatsApp, Telegram, Instagram and Facebook Messenger use this type of encryption either by default or if a user turns on the feature.

U.S. Sen. Ron Wyden, (D-OR) has been a vocal critic of Twitter's lack of privacy controls, tweeting on the day of the sale, "If the U.S. had a privacy law with teeth, or if Twitter encrypted DMs like I urged years ago, Americans wouldn’t be left wondering what today’s sale means for their private information. The protection of Americans’ privacy must be a condition of any sale."

What could change under Musk?

Musk appears to have grand ambitions for Twitter, tweeting in October, "Buying Twitter is an accelerant to creating X, the everything app."

He was referring to his vision of creating an app called X that combines messaging, video, payments and commerce among other functions.

Musk has also said he'll implement a monthly fee for people to keep their blue checkmark which signifies their account has been verified. Since Twitter has been completely free to users, this would be the first time the company would be collecting financial information like a bank account number.

Adding features and fees to the app will undoubtedly require users to share more data than what Twitter currently collects, Reynolds said. And that data will be valuable to advertisers who Musk wishes to court.

VERIFIED FOR A PRICE: Elon Musk says Twitter to start charging $8 per month for blue check mark verification

DID ELON MUSK FIRE EVERYONE AT TWITTER?: Ned Segal, Parag Agrawal get the ax. What to know

"Musk really wants to monetize. He really wants to use Twitter as a way to create more money for advertisers and more money from advertisers," she said.

Because of that, Reynolds said she doesn't see a scenario in which Musk would nefariously use data about, say, a competing electric vehicle company.

"He really wants to show that Twitter can be more of a revenue generator ... try to court people saying, 'Hey, come over to Twitter. We have a lot of data on people that we can share with you so that you can advertise'"

Lee said Musk's company Tesla is known for its strict approaches to cybersecurity, which could bode well for tools he could bring to Twitter.

"Because of what Tesla does and how they do it, they do have good expertise in cyber security. So the ability to draw on some of that experience and that talent will be helpful to Twitter," he said.

What security changes will Elon Musk's Twitter put in place?

It may not be obvious to outsiders if and when Twitter makes any changes to its security procedures, Lee said, because cybersecurity experts don't typically talk about their tools and policies publicly.

"If they undergo a process to improve, particularly again those internal controls to make sure that ... internal access is restricted in ways it hasn't been historically. That's a good start," Lee said. "And then we'll just have to see what happens with the rest of that in terms of other, more traditional privacy issues."

While it remains to be seen exactly what new Twitter will do in the data privacy space, Lee said there's one surefire way users can protect themselves from misuse of their data: "Just don't tweet it in the first place."

"At the end of the day, the real risk, the largest risk is what you're actually putting on those platforms," Lee said. "People tend to overshare and then they're surprised when somehow their information is compromised or misused."

Dropping Twitter doesn't delete data they've already collected on you, Lee said, but going through the steps to delete old tweets or lockdown your privacy settings can only help if you're concerned about misuse of your data.

"I'm not seeing people say oh like quit Twitter right now. They're just waiting and seeing what's gonna happen," Reynolds said. "This trust problem just doesn't go away just because you have a new owner."

In fact, given Musk's at times unpredictable behavior – including firing off Tweets that have landed him in trouble with the Securities and Exchange Commission – experts say they just cannot predict with any level of certainty what is to come for Twitter.

"We're just sitting on the edge of our seats to see what's gonna happen," Lee said.

Follow Katie Wedell on Twitter: @KatieWedell and Facebook: facebook.com/ByKatieWedell

This article originally appeared on USA TODAY: Twitter's history of data privacy missteps has caused a trust problem