Twitter is secretly holding onto deleted direct messages
Twitter says it doesn't keep hold of private messages for more than 30 days after an account is deactivated
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.Twitter seems to be secretly keeping hold of direct messages between users long after they were deleted, a security researcher has discovered.
Delhi-based researcher Karan Saini discovered long-ago deleted messages when he downloaded an archive of his data from Twitter, including messages sent to accounts that have since been deactivated.
"DMs are never 'deleted' – rather only witheld from appearing in the UI," Saini wrote on Twitter. "The archive geature lets you view these DMs, as well as any others with now suspended, or deactivated users."
In a follow-up tweet, he added: "I submitted the report for this to Twitter in January of 2018, and at the time, the team accepted the residual implications of the issue."
The issue raises serious privacy concerns for Twitter users, though Mr Saini noted that it is not a security flaw, rather a "functional bug".
Twitter's privacy policy states that anyone who deactivates their account will have their data deleted after a 30-day grace period.
"For up to 30 days after deactivation it is still possible to restore your Twitter account if it was accidentally or wrongfully deactivated," the policy states.
Twitter's terms state that log data – which includes information like IP address, browser type and operating system – is kept for a maximum of 18 months, though this does not encompass private data like direct messages.
A Twitter spokesperson was not immediately available for comment.
A statement provided to TechCrunch, who first reported the story, said the firm was "looking into this further to ensure we have considered the entire scope of the issue."
Join our commenting forum
Join thought-provoking conversations, follow other Independent readers and see their replies
Comments