UNITED STATES OF AMERICA

FEDERAL TRADE COMMISSION

WASHINGTON, D.C. 20580

Office of the Secretary

March 2, 2011

Lee Thomason, Esq.

Spalding & Thomason, Law Office

106 North 4th Street

P.O. Box 745

Bardstown, KY 40004

Re: In the Matter of Twitter, Inc., File No. 092 3093, Docket No. C-4316

Dear Mr. Thomason:

Thank you for your comment on the Federal Trade Commission’s consent agreement in

the above-entitled proceeding. The Commission has placed your comment on the public record

pursuant to Rule 4.9(b)(6)(ii) of the Commission’s Rules of Practice, 16 C.F.R. § 4.9(b)(6)(ii),

and has given it serious consideration. 

Your comment raises several concerns about the order. First, you state that the

provisions of the order are inconsistent with the Commission’s press release announcing the

consent agreement because the release mentions specific data security measures that are not

expressly included in the order (e.g., the requirement that employees use hard-to-guess

passwords). In response, the Commission notes that the portion of the press release to which

your comment refers summarizes the Commission’s complaint allegations in this case, not the

terms of the order. The Commission’s complaint alleges that Twitter failed to take the specific

measures mentioned in the press release to prevent unauthorized administrative control of its

system, and that these failures, taken together, constituted a failure to provide reasonable and

appropriate security for users’ nonpublic information. Thus, the complaint alleges that Twitter’s

statement to consumers that it maintained reasonable security was deceptive. To remedy this

alleged deception, the order requires that Twitter implement a comprehensive information

security program that is reasonably designed to protect its users’ nonpublic information. The

order does not prescribe the specific measures Twitter must take. Instead, the order requires

Twitter to implement safeguards appropriate to its size and complexity, the nature and scope of

its activities, and the sensitivity of the consumer information it collects, all of which may change

over time. 

Your comment also suggests that the breaches described in the Commission’s complaint

resulted from consumers’ practices with respect to their Twitter account passwords and were

“reasonably avoidable,” thereby depriving the Commission of authority, under Section 5(n) of

the FTC Act, to take action in this matter. In response, the Commission notes that the breaches

described in the complaint resulted from Twitter’s practices concerning administrative control of
See, e.g., In re Life is good, Inc., 2008 FTC LEXIS 46 (Apr. 16, 2008) (consent order); 1

In re Guidance Software, Inc., 2007 FTC LEXIS 35 (Mar. 30, 2007) (consent order); In re Petco

Animal Supplies, Inc., 139 F.T.C. 102 (2005) (consent order); In re MTS Inc., 137 F.T.C. 444

(2004) (consent order); In re Guess?, Inc., 2003 FTC LEXIS 123 (July 30, 2003) (consent

order); In re Microsoft Corp., 134 F.T.C. 109 (2002) (consent order). With respect to the

consent orders cited on page two of your comment (In re CardSystems Solutions, Inc., 2005 FTC

LEXIS 176 (Sept. 5, 2006) (consent order), In re CVS Caremark Corp., 2009 FTC LEXIS 136

(June 18, 2009) (consent order), and In re The TJX Cos., 2008 FTC LEXIS 75 (July 29, 2008)

(consent order)), the Commission notes that these respondent companies were not financial

institutions subject to the requirements of the Safeguards Rule, as your comment states. The

Commission’s complaint in each of these cases alleged violations of Section 5 of the FTC Act

only.

its system, including its weak employee password policies, and thus were not reasonably

avoidable by consumers. 

In addition, your comment questions whether the Commission has authority over

“websites, or over website operation protocols, or the data protection measures used by website

and social network operators.” The Commission notes that its jurisdiction under Section 5 of the

FTC Act extends to unfair and deceptive acts and practices in or affecting “commerce,” which is

defined to include commerce among the states and with foreign nations. 15 U.S.C. §§ 44, 45(a). 

A service provided by a United States company that enables the passage of messages over the

internet from one state to another, such as Twitter’s, is in or affecting commerce under the FTC

Act, and thus is subject to Section 5 of the Act and the FTC’s enforcement of its prohibitions.

Further, your comment expresses concern that the order constitutes an attempt to impose

on social network operators the requirements of the Commission’s Standards for Safeguarding

Customer Information Rule (“Safeguards Rule”), 16 C.F.R. Part 314, issued pursuant to the

Gramm-Leach-Bliley Act, which applies only to “financial institutions.” Your comment

suggests that imposition of safeguards requirements on non-financial institutions constitutes de

facto rulemaking by the Commission that fails to comply with the Administrative Procedure Act

and exceeds the Commission’s authority. Your comment also suggests that it is inappropriate to

impose such obligations on social networking companies, which you contend maintain less

sensitive data than financial institutions. 

In response, the Commission notes that the order is designed to remedy the deceptive

statements that the Commission alleges Twitter made to consumers concerning its information

security practices. Section 5(b) of the FTC Act authorizes the Commission to obtain such relief

for violations of Section 5(a) of the Act, and the Commission believes this relief is appropriate to

address the challenged conduct in this case. The order does not impose requirements on any

entity other than Twitter. Further, the Commission has obtained the same or similar relief in

each of its cases alleging deceptive statements concerning data security practices in violation of

Section 5 of the FTC Act, including many where the company was not a financial institution

subject to the Safeguards Rule. Finally, the Commission notes that, under the terms of the 1

order, the sensitivity of consumer information collected by Twitter is an important factor in
determining the types of safeguards required. This flexible standard requires only that Twitter

implement a program reasonably designed to protect the types of data it actually collects. 

In light of these considerations, the Commission has determined that the public interest

would best be served by issuing the Decision and Order in final form without any modifications. 

The final Decision and Order and other relevant materials are available from the Commission’s

website at http://www.ftc.gov. It helps the Commission’s analysis to hear from a variety of

sources in its work, and it thanks you again for your comment.

By direction of the Commission.

Donald S. Clark

Secretary