Be Careful, Twitter has been storing your ‘deleted’ DMs for years

Techcrunch has revealed that Twitter stores deleted direct and private tweets from users accounts and they have been sticking around long after the user deletes them.

Today, TechCrunch revealed from the hands of security researcher Karan Saini that Twitter hosts on its servers for years the direct (and therefore private) messages that the user has previously deleted. However, it is not just a problem of active accounts, but messages to accounts that have been deleted or suspended are also saved.

The problems associated with Twitter, unlike those suffered by Facebook, tend to have more to do with the lack of control over the behavior of users of the platform than with security breaches or bugs related to privacy.

However, in recent weeks, the company’s position has suffered some setback. First, Twitter recognized that by changing the email address to access the service, some users who used Twitter for Android and had their messages protected from others would have seen how they were checked out without warning or request permission, something serious considering the harassment suffered by some tweeters.

TechCrunch and Saini have proven that even if both parties delete the messages, Jack Dorsey’s social network will keep them on their servers for a long period of time, but neither specify how much.

They also point out that although it is not a security breach, but a functioning bug, it can pose a risk to the privacy of people.

A recurrent case may be that of journalists or opponents of a regime that by clicking on a delete button believe they are deleting messages, so that years later a government requests that information.
It is possible that other companies carry out this type of practices keeping old data, but Twitter picks up very clearly among their conditions that once an account is deactivated, there is a very short period of time in which they can access the information.

These types of cases before did not have much relevance. The companies “fixed” the problem and continued to operate on a regular basis. In general, the action with respect to the LOPD was not too strong in foreign companies.

However, the arrival of the RGPD may pose a threat of a fine of up to 4% of the business activity of the previous year. What needs to be clarified in this case is yes a delete button that does not delete a message from the server is a violation of the normal.