I'm arguing that Twitter is now critical infrastructure, like banking or power grid, and needs to take security seriously. If they don't do it themselves, they'll get regulation like HIPAA.

Then you need to find someone else to argue with. All I said was that bad security is not criminal currently.