Twitter whistleblower cites security flaws before Congress
The former security chief at Twitter told Congress that the social media platform is plagued by weak cyber defences that make it vulnerable to exploitation by teenagers, thieves and spies and put the privacy of its users at risk. Peiter Mudge Zatko, a respected cybersecurity expert, appeared before the Senate Judiciary Committee to lay out his allegations Tuesday.
I am here today because Twitter leadership is misleading the public, lawmakers, regulators and even its own board of directors,” Zatko said as he began his sworn testimony.
They dont know what data they have, where it lives and where it came from and so, unsurprisingly, they cant protect it, Zatko said. It doesnt matter who has keys if there are no locks.” Zatko said Twitter leadership ignored its engineers, in part because their executive incentives led them to prioritise profit over security.
One issue that didnt come up in the hearing was the question of whether Twitter is accurately counting its active users, an important metric for its advertisers. Tesla CEO Elon Musk, who is trying to get out of a $44 billion deal to buy Twitter, has argued without evidence that many of Twitters roughly 238 million daily users are fake or malicious accounts, i.e. spam bots. The Delaware judge overseeing the case ruled last week that Musk can include new evidence related to Zatkos allegations in the high-stakes trial, which is set to start Oct. 17.
Separately on Tuesday, Twitters shareholders voted overwhelmingly to approve the deal according to multiple media reports. Shareholders have been voting remotely on the issue for weeks. The vote was largely a formality, particularly given Musks efforts to nullify the deal, although it does clears a legal hurdle to closing the sale.
Zatkos message echoed one brought to Congress against another social media giant last year, but unlike that Facebook whistleblower, Frances Haugen, Zatko hasnt brought troves of internal documents to back up his claims.
Zatko was the head of security for the influential platform until he was fired early this year. He filed a whistleblower complaint in July with Congress, the Justice Department, the Federal Trade Commission and the Securities and Exchange Commission. Among his most serious accusations is that Twitter violated the terms of a 2011 FTC settlement by falsely claiming that it had put stronger measures in place to protect the security and privacy of its users.
Sen. Dick Durbin, an Illinois Democrat who heads the Judiciary Committee, said Zatko has detailed flaws that may pose a direct threat to Twitters hundreds of millions of users as well as to American democracy.
Twitter is an immensely powerful platform and cant afford gaping vulnerabilities, he said.
Unknown to Twitter users, theres far more of their personal information disclosed than they or sometimes even Twitter itself realize, Zatko testified. He said Twitter did not address basic systemic failures brought forward by company engineers.
The FTC has been a little over its head, and far behind European counterparts, in policing the sort of privacy violations that have occurred at Twitter, Zatko said.
Sen. Lindsey Graham, a Republican from South Carolina, said one positive result that could come out of Zatkos findings would be bipartisan legislation to set up a tighter system of regulation of tech platforms.
We need to up our game in this country, he said.
Many of Zatkos claims are uncorroborated and appear to have little documentary support. Twitter has called Zatkos description of events a false narrative … riddled with inconsistencies and inaccuracies and lacking important context.
Among the assertions from Zatko that drew attention from lawmakers Tuesday was that Twitter knowingly allowed the government of India to place its agents on the company payroll, where they had access to highly sensitive data on users. Twitters lack of ability to log how employees accessed user accounts made it hard for the company to detect when employees were abusing their access, Zatko said.
Zatko said he spoke with high confidence about a foreign agent that the government of India placed at Twitter to understand the negotiations between Indias ruling party and Twitter about new social media restrictions and how well those negotiations were going.
Zatko also revealed Tuesday that he was told about a week before his firing that at least one agent from the Chinese intelligence service MSS, or the Ministry of State Security, was on the payroll at Twitter.
He said he was similarly surprised and shocked by an exchange with current Twitter CEO Parag Agrawal about Russia in which Twitters current CEO, who was chief technology officer at the time, asked if it would be possible to punt content moderation and surveillance to the Russian government, since Twitter doesnt really have the ability and tools to do things correctly.
And since they have elections, doesnt that make them a democracy? Zatko recalled Agrawal saying.
Sen. Charles Grassley, the committees ranking Republican, said Tuesday that Agrawal declined to testify at the hearing, citing the ongoing legal proceedings with Musk. But the hearing is more important that Twitters civil litigation in Delaware,” Grassley said. Twitter declined to comment on Grassleys remarks.
In his complaint, Zatko accused Agrawal as well as other senior executives and board members of numerous violations, including making false and misleading statements to users and the FTC about the Twitter platforms security, privacy and integrity.
Zatko, 51, first gained prominence in the 1990s as a pioneer in the ethical hacking movement and later worked in senior positions at an elite Defense Department research unit and at Google. He joined Twitter in late 2020 at the urging of then-CEO Jack Dorsey.
(Except for the headline, this story has not been edited by The Federal staff and is auto-published from a syndicated feed.)
