Engadget reports that some Twitter users have already received notifications. The emails warn “your Twitter account is one of a small group of accounts that may have been targeted by state-sponsored actors” looking for personal details including email addresses and phone numbers.
Twitter notes it has “no evidence” that the perpetrators accessed account details but says it is “actively investigating” the cases of people who receive these notices. Affected users are given advice on protecting their identity online, including using the secure Tor browser to access the Internet.
It is unknown which country was behind the attacks. Users who have received emails from Twitter include activists and security specialists but there is no visible link between victims.
Motherboard spoke to several users who have received warnings but failed to find any correlation. All of the known targets received emails at the same time, between 17:15 and 17:16 EST on December 11.
One of the affected users, @coldhak, is the Twitter account of a Canadian non-profit dedicated to furthering privacy, security and freedom of speech. It told Motherboard it may have been targeted because it runs Tor relay servers — servers that help to provide the anonymity functions of the Tor browser by bouncing requests around the world — and one of its founding directors is a contractor for the Tor project. It is unable to establish an exact cause though.
Twitter’s warnings come a couple of months after Facebook launched a similar feature. Facebook now notifies its users if it detects their government is monitoring them. It has not disclosed how it collects its data for fear of its methods becoming compromised.
Google also offers similar protection from state-sponsored attacks. At least three major Internet companies are now helping their users defend themselves against the malicious actions of governments worldwide but it remains unclear how prevalent the problem is becoming.
There is currently no evidence that a government has been able to steal data from Facebook, Twitter or Google but the companies seem confident that somebody is trying to do so. Twitter’s warnings this week are the first the company is known to have issued. It hasn’t made any formal statement on the matter and has no defined policy for dealing with state-sponsored cyber-attacks.
