Whistleblower cites security flaws

WASHINGTON — The former security chief at Twitter Inc. told Congress on Tuesday that the social platform is plagued by weak cyber defenses that make it vulnerable to exploitation by “teenagers, thieves and spies” and put user privacy at risk.

Peiter Zatko, who was Twitter’s top security official before he was fired in January, appeared Tuesday before the Senate Judiciary Committee to lay out the allegations he lodged against Twitter in July.

Zatko filed a whistleblower complaint with Congress, the Justice Department, the Federal Trade Commission and the Securities and Exchange Commission. Among his most serious accusations is that Twitter violated the terms of a 2011 FTC settlement by falsely claiming that it had put stronger measures in place to protect the security and privacy of its users.

Zatko, known in the hacking community as “Mudge”, said Tuesday that Twitter was notified during his tenure that “there was at least one agent” of a Chinese intelligence service “on the payroll inside Twitter.” He added that Twitter’s executives “chose to mislead its board, shareholders, lawmakers and the public” about its security flaws instead of fixing them.

“I am here today because Twitter leadership is misleading the public, lawmakers, regulators and even its own board of directors,” Zatko said as he began his sworn testimony. “They don’t know what data they have, where it lives and where it came from and so, unsurprisingly, they can’t protect it. It doesn’t matter who has keys if there are no locks.”

Zatko said “Twitter leadership ignored its engineers,” in part because “their executive incentives led them to prioritize profit over security.” Unknown to Twitter users, there’s far more personal information disclosed than they — or sometimes even Twitter itself — realize, he testified.

He said “basic systemic failures” that were brought forward by company engineers were not addressed and that the FTC has been “a little over its head”, and far behind European counterparts, in policing the sort of privacy violations that have occurred at Twitter.

His message echoed one brought to Congress against Facebook last year but unlike that whistleblower, Frances Haugen, Zatko has not brought troves of internal documents to back up his claims.

Many of Zatko’s claims are uncorroborated and appear to have little documentary support. Twitter has called Zatko’s description of events “a false narrative … riddled with inconsistencies and inaccuracies” and lacking important context.

Among the assertions from Zatko that drew attention from lawmakers Tuesday was that Twitter knowingly allowed the government of India to place its agents on the company payroll, where they had access to highly sensitive user data.

Twitter’s lack of ability to log how employees accessed user accounts made it hard for the company to detect when employees were abusing their access, Zatko said.

without Dick Durbin, an Illinois Democrat who heads the Judiciary Committee, said Zatko has detailed flaws “that may pose a direct threat to Twitter’s hundreds of millions of users, as well as to American democracy.”

“Twitter is an immensely powerful platform and can’t afford gaping vulnerabilities,” Durbin said.

Zatko’s claims could also affect Tesla CEO and billionaire Elon Musk’s attempt to back out of his $44 billion deal to acquire the social platform. Musk claims that Twitter has long underreported spam bots on its platform and cites that as a reason to nix the deal he struck in April.

Zatko also accused the company of deception in its handling of automated accounts.

Musk, now using the whistleblower as support, and Twitter are locked in a bitter legal battle, with Twitter having sued Musk to force him to complete the deal. The Delaware judge overseeing the case ruled last week that Musk can include new evidence related to Zatko’s allegations in the high-stakes trial, which is set to start Oct. 17.

without Charles Grassley, the committee’s ranking Republican, said Tuesday that Twitter CEO Parag Agrawal declined to testify at the hearing, citing the ongoing legal proceedings with Musk.

But the hearing is “more important than Twitter’s civil litigation in Delaware,” Grassley said.

Zatko, 51, first gained prominence in the 1990s as a pioneer in the ethical hacking movement and later worked in senior positions at an elite Defense Department research unit and at Google Inc. He joined Twitter in late 2020 at the urging of then-CEO Jack Dorsey.

Twitter shareholders voted Tuesday to approve Musk’s buyout of the company, a formal step in finalizing the disputed deal. The vote took place during a short virtual meeting after brief remarks by Agrawal.

Information for this article was contributed by Marcy Gordon of The Associated Press and David McCabe of The New York Times and staff of The Washington Post.

Leave a Comment