Published on August 23rd, 2022 📆 | 2012 Views ⚑
0Whistleblower accuses Twitter of cybersecurity negligence
A former head of security at Twitter alleged that the company misled regulators about its cybersecurity defenses, privacy protections and its ability to detect and root out fake accounts, according to a whistleblower complaint filed with U.S. officials.
The revelation could create serious legal and financial problems for the social media platform, which is currently attempting to force Tesla CEO Elon Musk to consummate his $44 billion offer to buy the company.
Peiter Zatko, Twitterâs security chief until he was fired early this year, filed complaints last month with the U.S. Securities and Exchange Commission, the Federal Trade Commission and the Department of Justice. The legal nonprofit Whistleblower Aid, which is working with Zatko, confirmed the authenticity of a redacted copy of the complaint posted online by the Washington Post.
Among Zatkoâs most serious accusations is that Twitter violated the terms of a 2011 FTC settlement by falsely claiming that it had strong security measures in place to protect the security and privacy of its users. Zatko also accuses the company of deceptions involving its handling of âspamâ or fake accounts, an allegation that is at the core of Muskâs attempt to back out of the Twitter takeover.
Shares of Twitter Inc. slid 5.4% Tuesday. Zatko didnât immediately respond to a request for comment Tuesday. But he told the Post he âfelt ethically boundâ to come forward.
Better known by his hacker handle âMudge,â Zatko is a highly respected cybersecurity expert who first gained prominence in the 1990s and later worked in senior positions at the Pentagonâs Defense Advanced Research Agency and Google.
He joined Twitter at the urging of then-CEO Jack Dorsey in late 2020, the same year the company suffered an embarrassing security breach involving hackers who broke into the Twitter accounts of world leaders, celebrities and tech moguls, including Musk, in an attempt to scam their followers out of bitcoin.
Twitter said in a prepared statement Tuesday that Zatko was fired for âineffective leadership and poor performanceâ and said the âallegations and opportunistic timing appear designed to capture attention and inflict harm on Twitter, its customers and its shareholders.â The company called his complaint âa false narrativeâ that is âriddled with inconsistencies and inaccuracies and lacks important context.â
Zatkoâs attorneys, Debra Katz and Alexis Ronickher, said Twitterâs claim about his poor performance is false and that he repeatedly raised concerns about âgrossly inadequate information security systemsâ with top executives and Twitterâs board of directors. The lawyers said that in late 2021, after the board was given âwhitewashedâ information about those security problems, Zatko escalated his concerns, âclashedâ with CEO Parag Agrawal and board member Omid Kordestani and was fired two weeks later.
The 84-page complaint describes a broken corporate culture at Twitter that lacked effective leadership and where Zatko said top executives practiced âdeliberate ignoranceâ of pressing problems. His description of Dorseyâs leadership style is particularly scathing, saying the Twitter founder was âextremely disengagedâ during the last months of his tenure as CEO to the point where he would not even speak during meetings on complex issues facing the company.
Zatko said he heard from colleagues that Dorsey would remain silent for âdays or weeks.â Dorsey announced he was stepping down as Twitter CEO in November 2021.
The disclosure says Twitter offered no monetary incentives for improving security and platform integrity, although the company did offer $10 million bonuses last year for top executives who could generate short-term user growth.
Among Zatkoâs damning accusations of cybersecurity malpractice: Software and security updates were disabled on more than a third of employeesâ computers â unduly exposing them to malware â and it was common for people to install âwhatever software they wanted on their work systems.â Such lapses are typically considered cardinal sins in cybersecurity.
Whistleblower Aid said it is legally precluded from sharing Zatkoâs statement. The same group worked with former Facebook employee Frances Haugen, who testified to Congress last year after leaking internal documents and accusing the social media giant of choosing profit over safety.
A spokesperson for the U.S. Senateâs intelligence committee, Rachel Cohen, said the committee has received Zatkoâs complaint and âis in the process of setting up a meeting to discuss the allegations in further detail. We take this matter seriously.â
Sen. Dick Durbin, an Illinois Democrat, said in a prepared statement that if the claims are accurate, âthey may show dangerous data privacy and security risks for Twitter users around the world.â
Among the most alarming complaints is Zatkoâs allegation that Twitter knowingly allowed the Indian government to place its agents on the company payroll where they had âdirect unsupervised access to the companyâs systems and user data.â
A 2011 FTC complaint noted that Twitterâs systems were full of highly sensitive data that could allow a hostile government to find precise location data for specific users and target them for violence or arrest. Earlier this month, a former Twitter employee was found guilty after a trial in California of passing along sensitive Twitter user data to royal family members in Saudi Arabia in exchange for bribes.
The complaint said Twitter was also heavily reliant on funding by Chinese entities and that there were concerns within Twitter that the company was providing information to those entities that would enable them to learn the identify and sensitive information of Chinese users who secretly use Twitter, which is officially banned in China.
Zatko also describes âdeliberate ignoranceâ by Twitter executives on counting the millions of accounts that are automated âspam botsâ or otherwise have no value to advertisers because there is no person behind them.
Alex Spiro, an attorney representing Musk in his effort to back out of his Twitter acquisition deal, said lawyers have issued a subpoena for Zatko. âWe found his exit and that of other key employees curious in light of what we have been finding,â Spiro wrote in an email Tuesday. Spiro said Zatko and Musk have not been in contact at any time this year.
ââ
AP business writer Tom Krisher contributed to this report.
Copyright 2022 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed without permission.
Gloss