Twitter deleted data potentially crucial to Russia probes
Twitter has deleted tweets and other user data of potentially irreplaceable value to investigators probing Russia’s suspected manipulation of the social media platform during the 2016 election, according to current and former government cybersecurity officials.
Federal investigators now believe Twitter was one of Russia’s most potent weapons in its efforts to promote Donald Trump over Hillary Clinton, the officials say, speaking on the condition of anonymity.
Story Continued Below
By creating and deploying armies of automated bots, fake users, catchy hashtags and bogus ad campaigns, unidentified operatives launched recurring waves of pro-Trump and anti-Clinton story lines via Twitter that were either false or greatly exaggerated, the officials said. Many U.S. investigators believe that their best hope for identifying who was behind these operations, how they collaborated with each other and their suspected links to the Kremlin lies buried within the mountains of data accumulated in recent years by Twitter.
By analyzing Twitter data over time, investigators could establish what one U.S. government cybersecurity consultant described as “pattern of life behavior,” determining when Russian influence operations began, and how they “were trying to nudge the narrative in a certain direction.”
“So if you have access to all this, you can basically see when botnets appeared and disappeared, and how they shaped narrative around certain events,” said the analyst, who could not speak for attribution given company policy.
But a substantial amount of valuable information held by Twitter is lost for good, according to the cybersecurity analysts and other current and former U.S. officials.
One reason is Twitter’s aggressively pro-consumer privacy policies, which generally dictate that once any user revises or deletes their tweets, paid promotions or entire accounts, the company itself must do so as well. Twitter policy requires similar actions by private companies that pay for access to its real-time global data stream and repository of saved data for use in marketing and other commercial analysis.
The other reason is that Russian cyber tradecraft dictates that operatives immediately erase all of their digital breadcrumbs, according to former FBI Executive Assistant Director Robert Anderson and others familiar with Russian influence operations.
Thomas Rid, a Strategic Studies professor at Johns Hopkins University, blamed Twitter for making it easy for Russia and other bad actors to hijack its platform by failing to crack down on suspicious activity, and by then allowing them to cover their tracks simply by hitting the delete key.
“Should bot operators and people who spread hate and abuse have the right to remove content from the public domain? Twitter says yes, and I think it’s a scandal,” said Rid, an expert witness on Russian disinformation campaigns for the Senate intelligence committee’s Russia investigation. “It removes forensic evidence from the public domain, and makes the work of investigators more difficult and maybe impossible.”
“Were Twitter a contractor for the FSB,” the Russian intelligence agency involved in the 2016 campaign to meddle in the U.S. election, Rid said, “they could not have built a more effective disinformation platform.”
Twitter declined to comment on how much relevant data was deleted, whether any of it is potentially retrievable and other questions sent by POLITICO. Instead, spokespeople referred to the fine print of the company’s data retention and privacy policies, which say that, “Once an account has been deactivated, there is a very brief period in which we may be able to access account information, including Tweets.”
“Content deleted by account holders (e.g., Tweets) is generally not available,” the Twitter policy also says.
Several people familiar with Twitter’s ongoing review of Russian activity on its platform said its engineers are trying to ascertain what is available and what is recoverable, in part by trying to find ways of recreating some pockets of particular data that have been permanently deleted.
They also noted that the company has had to walk a tightrope in balancing the interests of privacy activists who are “very concerned about any suggestions that a tech company would hold their data for any period after its deleted,” and law enforcement agencies that want access to potential evidence of wrongdoing. As such, “it’s a little more complicated than giving an X is gone forever by Y date” answer, one Twitter official cautioned.
Cybersecurity analysts, however, said Twitter has aggressively enforced a “permanent deletion” policy across the board, including publicly shaming at least two companies not adhering to it via cease and desist orders.
As a result, “The limitations created by the hostile actors deleting their actions is potentially high impact” for those U.S. investigators on the various Russia investigations, according to a former senior Senate staff official familiar with how Twitter operates. “They may get lucky and Twitter may have some record of it, but in terms of their stated policy, if accounts or tweets were deleted, they’re gone.”