IT IS ORDERED that respondent... establish and implement, and thereafter maintain, a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of nonpublic consumer information.

Making sure all private data goes in the vault and the vault is secure shouldn't take more than 1% of an organization the size of Twitter. Even if they're doing it poorly, it shouldn't be more than 10%.

If it really is 5x (> 80% of their engineering budget), I guarantee you they are in violation of the consent decree -- there is no way to vet that many engineers or audit their work!

Any security architecture that requires every single engineer has to do everything exactly right 100% of the time is bound to fail. The order to put in reasonable privacy protections doesn't say "and do it in the most expensive, error prone fashion possible".

What they want is additional work, and technical implementation that the agreements are being enforced in code. It’s a fascinating area for a career, but the tools are not well developed and engineers not trained to code this way. Ends up being like a 40% tax on a lot of peoples work, plus the people who write and operate the verification systems.

It’s probably what the security field should have done years ago, but there were never as expensive of fines as for privacy violations.