Top Twitter security officials quit

One current Twitter employee said several other members of the site’s privacy and security unit also had resigned, while another said those remaining were trying to stop a wave of abuse in the company’s expanded paid service, Twitter Blue.

The Federal Trade Commission, which reached its latest consent decree with Twitter in May, said it was “tracking the developments at Twitter with deep concern.”

“No CEO or company is above the law, and companies must follow our consent decrees,” said Douglas Farrar, the FTC’s director of public affairs. “Our revised consent order gives us new tools to ensure compliance, and we are prepared to use them.”

The privacy staffers said they were most concerned by the rapid rollout of new features without the full security reviews that the FTC consent decree requires. They also objected to Musk’s order in an email Wednesday night, his first to the staff since taking control of the company, that all employees had to begin working in the office 40 hours a week, effective Thursday.

Musk’s email did not address Twitter’s long tradition of flexible and remote work. Instead, it cited a dire need to earn money from Twitter Blue. “Without significant subscription revenue, there is a good chance Twitter will not survive the upcoming economic downturn,” Musk warned. “We need roughly half our revenue to be subscriptions.”

Former FTC officials warned that the departures of key privacy and security officials, as well as some of Musk’s proposed changes to Twitter products, opened the company up to serious regulatory peril.

David C. Vladeck, who was director of the FTC’s Bureau of Consumer Protection at the time of Twitter’s first settlement with the agency, said the departures and chaos raise questions about whether “compliance requirements are going to fall through the cracks.”

Vladeck said the penalties could be exponentially higher for Twitter if it is alleged to be in violation of its agreement with the FTC a second time. “There would be some very significant multiple of the last fine,” he said, referring to the May penalty that carried a $150 million fine. “You have to add a decimal point to that.”

Twitter entered into the consent decree with the FTC after allegations that it deceptively used email and phone numbers it said it was collecting for security purposes to target users with advertising. The FTC alleged that this violated a 2011 consent decree it had reached with the company.

The new decree required Twitter to start enhanced privacy and security programs, which were to be audited by a third party. Under that…