The issued subpoena requires X to share information sufficient to identify the person behind the account. This includes names, addresses, telephone numbers, email addresses, account numbers, IP addresses, and any other contact or billing records held by the platform.
Taking TF's reporting at face value, would twitter be able to sufficiently identify a user? Does Twitter have the address, real names, etc. of its users?
Twitter has IP addresses at the very least. HBO will then subpoena the account's ISP. If the account had the checkmark pro plan or whatever it's called, it may have or be able to obtain legal name and address for payment details, or its payment processor (Stripe I think) would.
And all of this falls apart if you use Mullvad, who will be happy to fax HBO lawyers a blank sheet of paper.
> all of this falls apart if you use Mullvad
The only thing that falls apart is the IP address identification, which is only a very small signal for identifying an internet user. X/Twitter undoubtedly has more identity information than just an IP address.
At which point twitter will probably yell at you to "verify" with a phone number or something else tied to your government name. Yes you could probably go get a prepaid SIM for cash (depending on your country, many now ban this though America doesn't) but very few people bother with it. Or they just lock your account and demand your ID which I think they now sometimes do.
You can pay $5 for a verification phone number. It's not hard.
There are so many more ways one could screw up, and you only need to screw up once. For example, does X do browser fingerprinting and did you ever use similar setup to use a more identifiable Twitter account? Are you using unique phrasings or behavioral patterns? These things can be solved to a satisfactory degree, but I don't think "it's not hard" captures it - for an average user it _is_ hard.