Sources detail Twitter's struggle to control employee account access: multiple warnings to Dorsey since 2015, bogus help requests used to snoop, and more
- Dorsey, Twitter's board warned repeatedly, ex-employees say — Company says 1,500 staff and contractors can access user data Tweets: @firstadopter Tweets: Tae Kim / @firstadopter : Great story on Twitter's security woes from my @technology colleagues “controls were so porous .. in 2017 and 2018 some contractors made a .. game out of creating bogus help-desk inquiries that allowed them to peek into celebrity accts including Beyonce's” https://www.bloomberg.com/...
Context & Ripple Effects
This reporting lands two days after Reuters detailed that more than 1,000 former staff and contractors could change account settings and ownership as of early 2020 — a figure the company itself now puts at about 1,500 people. The new Bloomberg piece adds history to that headcount: board-level warnings to Dorsey stretching back to 2015, and contractors in 2017-2018 treating help-desk access as a game for peeking at celebrity accounts including Beyonce's.
It also extends the paper trail from the leaked screenshots of Twitter's internal control panel published last week, which showed how few steps separate a support tool from a full account takeover after the July hack.
First-order effects
- Dorsey's own board becomes part of the story — five years of documented warnings turn the breach from an engineering lapse into a governance failure attributed directly to him.
- The 1,500-person access list is now public context for every future incident: any account takeover can plausibly be traced to insider credentials rather than external attack.
Second-order effects
- Critics already using the hack to argue Twitter's engineering and management are weak gain sourced evidence, sharpening pressure on the company's credibility with users and partners.
- Rival platforms with similar broad internal access face the same questions by extension — the story sets a template reporters and regulators can apply elsewhere.
Third-order effects
- If insider-access breadth proves systemic across social platforms, expect regulators to treat who inside a company can touch user data as a compliance surface in its own right, forcing least-privilege controls and audit trails as standard practice.
- Trust and safety work may migrate away from wide human discretion toward narrower, logged tooling — reshaping how platforms staff and govern moderation itself.
The trend: Platform security is shifting from perimeter defense toward governing internal human access to user data, with boards and regulators now auditing who holds the keys.