Twitter's IPO Filing: Assessing Risks

When a company prepares to go public, it must share with potential investors the risks it faces. So it's interesting to read the initial public offering document, known as an S-1, that Twitter filed with the U.S. Securities and Exchange Commission.

See Also: Webinar | Prisma Access Browser: Boosting Security for Browser-Based Work

Among the factors that the social media company says could influence its financial health are: user concerns related to privacy and communication, safety, security or other factors; the inability to combat spam or other hostile or inappropriate usage on Twitter's platform; system failures resulting in the inaccessibility of the company's products and services; and breaches of security or privacy, and the costs associated with remediating any such breaches.

Back in February, Twitter disclosed that it had been attacked by unknown third parties who accessed the company's systems and viewed limited information on about 250,000 users [see: Twitter, Washington Post Report Cyber-Attacks].

In March 2011, a Federal Trade Commission investigation prompted by two separate incidents where unauthorized intruders obtained administrative passwords of certain Twitter employees led to the company establishing an information security program, its IPO filing notes.

Privacy, Trust Concerns

Twitter says its future success rests in its ability to:

• Process, store, protect and use personal data in compliance with governmental regulations, contractual obligations and other obligations related to privacy and security;
• Continue to earn and preserve users' trust, including with respect to their private personal information; and
• Defend against litigation, regulatory, intellectual property, privacy or other claims.

"You should consider our business and prospects in light of the risks and challenges we encounter or may encounter in this developing and rapidly evolving market," the company notes.

The company also makes reference to insider threats that could cause substantial harm. "Additionally, outside parties may attempt to fraudulently induce employees, users or advertisers to disclose sensitive information in order to gain access to our data or users' or advertisers' data or accounts," it says.

If Twitter accounts used by users and advertisers are compromised, "[it] may damage their reputations and brands as well as ours," the company adds.

Security Planning

In January 2012, the company acquired Dasient Inc., which provided Internet security services to protect advertising networks from malicious ads, according to the IPO filing.

But Twitter acknowledges that cyberthreats and exploits will continue to evolve. "We may be unable to anticipate these techniques or to implement adequate preventative measures," it notes.

And the company acknowledges that a major breach could hurt its reputation.

"If an actual or perceived breach of our security occurs, the market perception of the effectiveness of our security measures could be harmed, we could lose users and advertisers and we may incur significant legal and financial exposure, including legal claims and regulatory fines and penalties."

Substantial Revelations

After reviewing the IPO filing, it's clear that Twitter, indeed, faces substantial privacy and security risks - and that's something the investor community should take into consideration. But the risks Twitter outlines are comparable to those facing many other organizations.

Twitter deserves credit for including extensive information about these risks in its IPO filing. But let's hope the company is truly committed to briefing its constituents on an ongoing basis about all the information risks it faces and all the countermeasures it's taking. And let's hope other social media companies make a similar commitment.

What do you think of Twitter's self-assessment of its security risks? We invite you to comment in the space below.