X (Twitter) and Internet Crime Investigations

X, formerly known as Twitter, is a public conversation platform used for news, commentary, and direct messaging. Because it is so widely used, X accounts sometimes come up in internet crime investigations. This page gives general background on X and how investigations involving it often happen. X is now part of the same corporate family as xAI, the developer of Grok; see the separate Grok page.

Background and History of X (Twitter)

Twitter launched in 2006 and became known for short public posts called tweets. Elon Musk acquired the company in October 2022, and in 2023 it was rebranded as X. X Corp. was later combined with xAI, and that combined business has since become part of SpaceX, according to public filings and reporting. Records created before the rebrand may still be labeled “Twitter” in legal documents.

X (Twitter) Features and Services

X offers public posts, replies, reposts, Communities, Spaces live audio, video, paid subscriptions, and direct messages. X has introduced encrypted messaging features for some direct messages. X’s rules permit consensual adult content under certain conditions, and X has integrated the Grok AI assistant into the platform, so a single account may generate both social media and AI records.

How People Use X (Twitter)

X is used legitimately by hundreds of millions of people to follow breaking news, share opinions, and take part in public conversation in real time. Journalists, public officials, companies, and customer-service teams use it to communicate directly with the public, and government agencies, weather services, and emergency managers use X to share alerts and updates during storms and other emergencies. Professionals use it to network and follow developments in their fields, and creators and businesses use it to reach audiences. For many users, X is a fast source of information and a platform for civic and professional engagement.

How Many People Use X (Twitter)?

X no longer reports a stand-alone user figure on a regular basis. A 2026 securities filing by SpaceX put monthly active users across X and Grok combined at about 550 million as of March 2026, with about 117 million using Grok features. Pew Research Center’s 2025 survey found that 21% of U.S. adults say they ever use X.

How Investigations Involving X (Twitter) Often Begin

Many investigations involving X (Twitter) do not start with a police officer stumbling onto something. They start with a report. Online providers based in the United States are required by federal law to report apparent child sexual abuse material that they become aware of to the National Center for Missing & Exploited Children (NCMEC), which runs the CyberTipline. NCMEC reviews each report, tries to work out where the user is located, and makes reports available to the appropriate law enforcement agency, often an Internet Crimes Against Children (ICAC) task force or a federal agency such as Homeland Security Investigations or the FBI. For more on what happens after a report is made, see what a CyberTipline report is and what happens next.

NCMEC’s 2025 data lists 816,611 CyberTipline reports from X Corp. As with other platforms, many reports involve hash-matched files, and some involve files exchanged in direct messages. Some X investigations begin when a conversation that started on X moves to another app, and investigators then use records from both services.

What Records X (Twitter) May Have and How Police Request Them

When investigators want records from X (Twitter), they generally have to use legal process. In broad terms, basic account and subscriber information is often requested with a subpoena, more detailed records with a court order, and the content of messages or files with a search warrant, although the exact rules depend on the type of data, the jurisdiction, and the circumstances. Investigators also commonly send a preservation request, which asks the company to hold onto existing records while the legal process is prepared. What a company actually has depends on its products, its retention practices, and the user’s own settings, and those practices change over time.

X publishes guidelines for law enforcement on its help center. In general terms, records can include the email address and phone number on the account, account creation details, IP address logs, and, with a search warrant, the content of posts and direct messages. Subpoena returns from X are often paired with subscriber records from an internet or wireless carrier to identify the person behind an account.

Connecting an X Account to a Person

A record showing that an X (Twitter) account did something is not the same thing as proof that a particular person did it. Investigators typically try to connect an account to a person using things like the email address or phone number used to register, IP addresses from logins, subscriber records from an internet or wireless provider, device identifiers, payment records, and what is found on devices during a search. Each link in that chain can raise questions: shared homes and shared Wi-Fi, devices used by more than one person, VPNs, carrier networks that place many customers behind one IP address, compromised accounts, and gaps in the records. These are the kinds of issues a defense attorney may look at closely, case by case, under current law. The firm discusses this further in how police connect online accounts to a person.

Examples From Reported Cases

The examples below are drawn from public announcements and news reports. They are described generally and without names. Charges are only accusations, and anyone charged is presumed innocent unless proven guilty in court. These summaries are not a prediction of how any other case will turn out.

• In New York in 2026, federal prosecutors charged a man in a criminal complaint that described a chain of attribution: a 2023 CyberTipline report from Twitter (now X) about a direct message, subscriber records from Twitter showing the phone number and IP address used to create the account, records from a wireless carrier connecting that number to the man, and messages on Telegram obtained in a separate investigation. The charges are allegations, and the case had not been resolved when this page was drafted.

Related Articles on InternetCrime.com

• Platform Investigations: all platforms
• Social Media Crimes and Digital Evidence
• What Is a CyberTipline Report?
• How Police Connect Online Accounts to a Person
• Grok and AI Investigations
• Child Pornography Defense
• Distribution Charges

If You Are Under Investigation Involving X (Twitter)

If police have contacted you, if a search warrant has been served, or if you believe an investigation involving an X (Twitter) account may be underway, it is important to get legal advice before taking any action on your own. Attorney Ron Frey generally advises speaking with an attorney before answering questions or agreeing to a search. Whether a person may be required to provide a password or unlock a device depends on the circumstances, the jurisdiction, and any search warrant or court order involved, so that decision should be made with an attorney’s advice (see should I provide my password to the police or FBI?).

You have the right to remain silent. Anyone accused of a crime is presumed innocent unless proven guilty in court. Laws change and vary from state to state and between state and federal court, and the way they apply depends on the specific facts. Please don’t rely on the internet or on AI tools to evaluate your situation. Every case is different, and contacting an attorney is a priority to get tailored advice.

Attorney Ron Frey of The Frey Law Firm, LLC has been practicing law for over two decades and represents people nationally in internet and computer crime investigations and charges. He is a conference speaker and published author.

Attorney Ron Frey Is Available for a Free Initial Confidential Consultation: Call or Text (844) 766-3739. In Florida, call (813) 775-2276. You can also reach the firm through the contact page.

References

• Space Exploration Technologies Corp. (SpaceX), Form S-1 registration statement (SEC, 2026)
• Pew Research Center, “Americans’ Social Media Use 2025” (Nov. 2025)
• NCMEC, “2025 CyberTipline Reports by Electronic Service Providers (ESP)”
• X Help Center, Guidelines for Law Enforcement
• U.S. Attorney’s Office, Southern District of New York, criminal complaint (2026; contains graphic descriptions)
• Wikipedia, “Twitter” (background)

Important: This page provides general information only. It is not legal advice, and it is not a complete or current statement of the law or of any company’s policies. Laws, court decisions, and platform practices change, and their effect depends on the facts of each case and on how courts interpret them. User figures and report counts come from the sources listed and may since have changed. Platform names and logos are trademarks of their owners and are used only to identify the services discussed; The Frey Law Firm, LLC is not affiliated with or endorsed by any of these companies. Please don’t rely on this page, or on any other information online, to make decisions about your situation. Talk with a lawyer. Reading this page or contacting The Frey Law Firm, LLC does not create an attorney-client relationship. Last reviewed: October 26, 2026.