See 1

http://www.ftc.gov/privacy/privacyinitiatives/promises_enf.html (listing data

security consent orders).

 The Commission’s expertise in this area is described in the recent staff report,

2

Protecting Consumer Privacy in an Era of Rapid Change, A Proposed Framework for

Businesses and Policymakers (Dec. 1., 2010), at

http://www.ftc.gov/opa/2010/12/privacyreport.shtm.

UNITED STATES OF AMERICA

FEDERAL TRADE COMMISSION

WASHINGTON, D.C. 20580

Office of the Secretary

March 2, 2011

Mr. Russ Smith

State of New Jersey

Re: In the Matter of Twitter, Inc., File No. 092 3093, Docket No. C-4316

Dear Mr. Smith:

Thank you for your comment on the Federal Trade Commission’s consent agreement in

the above-entitled proceeding. The Commission has placed your comment on the public record

pursuant to Rule 4.9(b)(6)(ii) of the Commission’s Rules of Practice, 16 C.F.R. § 4.9(b)(6)(ii),

and has given it serious consideration. 

Your comment expresses several criticisms of the complaint and order in this proceeding.

First, your comment states that the complaint and order involve “best practices” relating to data

security and the Commission lacks the legal authority to enforce such best practices. In

response, the Commission notes that its complaint against Twitter alleges that Twitter engaged

in deceptive acts or practices, in violation of Section 5(a) of the FTC Act, by falsely representing

to consumers that it used reasonable and appropriate measures to prevent unauthorized access to

users’ nonpublic information and honor users’ privacy choices. The Commission is duly

authorized by Congress to enforce Section 5(a) of the FTC Act, see 15 U.S.C. §§ 45(a)(2), 45(b),

and its action against Twitter is consistent with this authority. 

Your comment also states that Commission staff lack the expertise necessary to

understand data security best practices. In response, the Commission notes that it has expertise

in data security matters through its long-standing enforcement and research activities. The

Commission has, with the support of data security experts, examined numerous commercial data

security vulnerabilities over the past decade and taken action to address them. The Commission 1

has also conducted workshops and prepared reports on a variety of data security issues. The 2

Commission is confident that it has the expertise required to assess the reasonableness of

security measures implemented by Twitter. 
In addition, your comment expresses concern that the Commission’s complaint does not

contain adequate detail regarding the measures necessary for a comprehensive information

security program. The proposed complaint, however, sets forth the basis for the alleged legal

violations and is not intended to prescribe the specific requirements of a reasonable information

security program. The proposed order broadly imposes those requirements and is purposely

flexible; Twitter must establish administrative, technical, and physical safeguards appropriate to

its size and complexity, the nature and scope of its activities, and the sensitivity of the

information it handles. Thus, the order requires Twitter to assess its security needs as its

practices change and respond accordingly, rather than specifying individual security measures

that may become quickly outdated. 

Finally, your comment raises a number of issues that are not related to the complaint and

order in this case, including concerns about the Commission’s coordination with other federal

agencies, the Commission’s own privacy practices, its relationship with TRUSTe, its use of

social media services, and the legal status of privacy policies in general. Because these concerns

do not relate to the merits of the proposed complaint and order, we do not address them here. 

In light of these considerations, the Commission has determined that the public interest

would best be served by issuing the Decision and Order in final form without any modifications. 

The final Decision and Order and other relevant materials are available from the Commission’s

website at http://www.ftc.gov. It helps the Commission’s analysis to hear from a variety of

sources in its work, and it thanks you again for your comment.

By direction of the Commission.

Donald S. Clark

Secretary