By John Naughton,

an Observer columnist

Last Wednesday, Twitter suffered the biggest hacking attack in its history. A scammer got into its system, probably by hacking the account of someone working in the company, and acquired some of the special privileges that internal staff possess in order to do their work. This enabled the intruder to take over the accounts of some very prominent Twitter users, including Barack Obama, though not – interestingly – Donald Trump, to send out invitations to donate Bitcoin to a particular cryptographic “wallet” that would then return twice the amount donated.

You’d have to be pretty dumb to fall for this, though apparently some people did. In fact, it was just a variation on a known scam-genre. What made it distinctive was the spoofing of accounts of prominent people.

We now know a bit about how this was accomplished, essentially via activating a password-reset process. Twitter says there’s no evidence that most users’ passwords were compromised. It’s less forthcoming about whether the direct messages (DMs) sent by the compromised accounts were accessed. If they were, this might turn out to be a really big deal because, scandalously, DMs are still not encrypted.

Although the scam itself was laughable, the implications – for Twitter and the world – are not. When it launched in 2006, Twitter looked like a rather sweet joke but it has now morphed into a blend of things, both positive and negative: the world’s newswire; a conduit for all kinds of good, bad and indifferent information; a battleground for what the Oxford scholar Philip Howard once called “Lie Machines”; and Donald Trump’s megaphone.

So what happens on Twitter now really matters. In 2013, for example, a hacker took over the Associated Press account and falsely reported that there had been two explosions in the White House and that President Obama had been injured. The stock market briefly dropped like a stone.

One of the things the pandemic has done is to make everyone realise the extent to which the internet – and the services that run on it – has become the critical infrastructure of 21st-century life. A survey of 2,000 Americans conducted last week, for example, found that 77% of those interviewed said “they don’t know what they’d do on a daily basis” without the technology; similar experiences are reported everywhere.

The kinds of lockdown we’ve experienced would have been impossible to manage in the pre-internet age. Take just one example. Last December, Zoom had 10 million daily meeting participants; by last month, that figure had grown to 300 million. Much the same is reported for Microsoft Teams, Google Meet, Cisco’s Webex and other conferencing tools.

There are, however, a couple of major downsides to this massive increase in our dependence on the technology. The first concerns what security specialists call the “attack surface” – the different points where a hacker can try to intrude on, and exploit, an environment. The key to computer security is to reduce the attack surface as much as possible. However, the pandemic has forced us to make it as large as possible.

We now have hundreds of millions of non-technical employees working from home on insecure laptops, using flaky (and often hackable) network connections to ferry sensitive or confidential data to and from their physical workplaces. In other words, the lockdown has created a hacker’s dreamworld – an unimaginable forest of low-hanging fruit.

The result? Cybercrime is one of the fastest-growing businesses. An IBM spokesman was reported the other day as saying the company had seen “a 6,000% increase in Covid-related spam” at the height of the pandemic. A typical example (from US experience): an email dispatched to people who “are desperate for PPP [the US Paycheck Protection Program]. It installs malware into their computers, steals all their information [and] says, ‘If you don’t pay us a ransom we will infect you and your family with Covid-19’.” Hospitals in Europe dealing with coronavirus patients have had ransomware attacks. The FBI is reporting a massive increase in attacks. And so it goes on.

The second, and potentially more lethal, downside of the pandemic comes from the failure of social-media platforms to curb virus-related disinformation. It has become abundantly clear since 2016 that Facebook, Google, YouTube and Twitter are unable to control, effectively, the volume of conspiracy theories, disinformation and other garbage that pollute their privately owned public spaces.

At the root of this incapacity lie two factors. One is the sheer scale of the volume of content that has to be moderated; machine-learning technology can help with this but it is clearly not up to coping with the malign ingenuity of manipulative humans. The other is that the business models of the platforms, which prioritise “user engagement”, militate against more robust editorial control.

Given that, as societies try to recover from the pandemic, an alarming scenario begins to loom. It goes like this: a vaccine is invented and countries embark on massive vaccination programmes. However, conspiracy theorists use social media to oppose the programme and undermine public confidence in the vaccination drive. It will be like the anti-MMR campaign but on steroids.

What we have learned from the coronavirus crisis so far is that the only way to manage it is by coherent, concerted government action to slow the transmission rate. As societies move into a vaccination phase, then an analogous approach will be needed to slow the circulation of misinformation and destructive antisocial memes on social media. Twitter would be much improved by removing the retweet button, for example. Users would still be free to pass on ideas but the process would no longer be frictionless. Similarly, Facebook’s algorithms could be programmed to introduce a delay in the circulation of certain kinds of content. YouTube’s recommender algorithms could be modified to prioritise different factors from those they currently favour. And so on.

Measures such as these will be anathema to the platforms. Tough. In the end, they will have to make choices between their profits and the health of society. If they get it wrong then regulation is the only way forward. And governments will have to remember that to govern is to choose.

The Guardian

More about: #Twitter