🎥Twitter whistleblower tells Congress: Your data is at risk

WASHINGTON (AP) — Twitter's former security chief told Congress Tuesday there was “at least one agent” from China's intelligence service on Twitter's payroll and that the company knowingly allowed India to add agents to the company roster as well, potentially giving those nations access to sensitive data about users.

These were some of the troubling revelations from Peiter “Mudge” Zatko, a respected cybersecurity expert and Twitter whistleblower who appeared before the Senate Judiciary Committee to lay out his allegations against the company.

Zatko told lawmakers that the social media platform is plagued by weak cyber defenses that make it vulnerable to exploitation by “teenagers, thieves and spies” and put the privacy of its users at risk.

“I am here today because Twitter leadership is misleading the public, lawmakers, regulators and even its own board of directors," Zatko said as he began his sworn testimony.

“They don’t know what data they have, where it lives and where it came from and so, unsurprisingly, they can’t protect it,” Zatko said. “It doesn’t matter who has keys if there are no locks."

“Twitter leadership ignored its engineers,” he said, in part because “their executive incentives led them to prioritize profit over security.”

In a statement, Twitter said its hiring process is “independent of any foreign influence” and access to data is managed through a host of measures, including background checks, access controls, and monitoring and detection systems and processes.

One issue that didn't come up in the hearing was the question of whether Twitter is accurately counting its active users, an important metric for its advertisers. Tesla CEO Elon Musk, who is trying to get out of a $44 billion deal to buy Twitter, has argued without evidence that many of Twitter’s roughly 238 million daily users are fake or malicious accounts, aka “spam bots.”

The Delaware judge overseeing the case ruled last week that Musk can include new evidence related to Zatko’s allegations in the high-stakes trial, which is set to start Oct. 17. During the hearing, Musk tweeted a popcorn emoji, often used to suggest that one is sitting back in anticipation of unfolding drama.

Separately on Tuesday, Twitter's shareholders voted overwhelmingly to approve the deal, according to multiple media reports. Shareholders have been voting remotely on the issue for weeks. The vote was largely a formality, particularly given Musk's efforts to nullify the deal, although it does clear a legal hurdle to closing the sale.

Zatko's message echoed one brought to Congress against another social media giant last year. But unlike that Facebook whistleblower, Frances Haugen, Zatko hasn't brought troves of internal documents to back up his claims.

Zatko was the head of security for the influential platform until he was fired early this year. He filed a whistleblower complaint in July with Congress, the Justice Department, the Federal Trade Commission and the Securities and Exchange Commission. Among his most serious accusations is that Twitter violated the terms of a 2011 FTC settlement by falsely claiming that it had put stronger measures in place to protect the security and privacy of its users.

Sen. Dick Durbin, an Illinois Democrat who heads the Judiciary Committee, said Zatko has detailed flaws “that may pose a direct threat to Twitter’s hundreds of millions of users as well as to American democracy.”

“Twitter is an immensely powerful platform and can’t afford gaping vulnerabilities,” he said.

Unknown to Twitter users, there’s far more of their personal information disclosed than they — or sometimes even Twitter itself — realize, Zatko testified. He said Twitter did not address “basic systemic failures” brought forward by company engineers.

The FTC has been “a little over its head”, and far behind European counterparts, in policing the sort of privacy violations that have occurred at Twitter, Zatko said.

Sen. Lindsey Graham, a Republican from South Carolina, said one positive result that could come out of Zatko’s findings would be bipartisan legislation to set up a tighter system of regulation of tech platforms.

“We need to up our game in this country,” he said.

Many of Zatko’s claims are uncorroborated and appear to have little documentary support. Twitter has called Zatko’s description of events “a false narrative ... riddled with inconsistencies and inaccuracies” and lacking important context.

Still, Zatko came off as a convincing whistleblower who has “a lot of credibility in this space,” said Ari Lightman, professor of digital media and marketing at Carnegie Mellon University. But he said many of the problems he raised can likely be found at many other digital technology platforms

“They avoid security protocols in a sense of innovating and running really fast,” Lightman said. “We gave digital platforms so much autonomy at the beginning to grow and develop. Now we’re at a point where we’re, ‘Wait a minute ... This has gotten out of hand.’

Among the assertions from Zatko that drew attention from lawmakers Tuesday was that Twitter knowingly allowed the government of India to place its agents on the company payroll, where they had access to highly sensitive data on users. Twitter’s lack of ability to log how employees accessed user accounts made it hard for the company to detect when employees were abusing their access, Zatko said.

Zatko said he spoke with “high confidence” about a foreign agent that the government of India placed at Twitter to “understand the negotiations” between India’s ruling party and Twitter about new social media restrictions and how well those negotiations were going.

Zatko also revealed Tuesday that he was told about a week before his firing that “at least one agent” from the Chinese intelligence service MSS, or the Ministry of State Security, was “on the payroll” at Twitter.

He said he was similarly “surprised and shocked” by an exchange with current Twitter CEO Parag Agrawal about Russia — in which Twitter's current CEO, who was chief technology officer at the time, asked if it would be possible to “punt” content moderation and surveillance to the Russian government, since Twitter doesn't really “have the ability and tools to do things correctly.”

“And since they have elections, doesn’t that make them a democracy?” Zatko recalled Agrawal saying.

Sen. Charles Grassley, the committee's ranking Republican, said Tuesday that Agrawal declined to testify at the hearing, citing the ongoing legal proceedings with Musk. But the hearing is “more important than Twitter’s civil litigation in Delaware," Grassley said. Twitter declined to comment on Grassley's remarks.

In his complaint, Zatko accused Agrawal as well as other senior executives and board members of numerous violations, including making “false and misleading statements to users and the FTC about the Twitter platform’s security, privacy and integrity.”

Zatko, 51, first gained prominence in the 1990s as a pioneer in the ethical hacking movement and later worked in senior positions at an elite Defense Department research unit and at Google. He joined Twitter in late 2020 at the urging of then-CEO Jack Dorsey.

-----

WASHINGTON (AP) — The former security chief at Twitter told Congress that the social media platform is plagued by weak cyber defenses that make it vulnerable to exploitation by “teenagers, thieves and spies” and put the privacy of its users at risk. Peiter “Mudge” Zatko, a respected cybersecurity expert, appeared before the Senate Judiciary Committee to lay out his allegations Tuesday.

“I am here today because Twitter leadership is misleading the public, lawmakers, regulators and even its own board of directors," Zatko said as he began his sworn testimony.

“They don’t know what data they have, where it lives and where it came from and so, unsurprisingly, they can’t protect it,” Zatko said. “It doesn’t matter who has keys if there are no locks."

Zatko said “Twitter leadership ignored its engineers,” in part because “their executive incentives led them to prioritize profit over security.”

His message echoed one brought to Congress against another social media giant last year, but unlike that Facebook whistleblower, Frances Haugen, Zatko hasn't brought troves of internal documents to back up his claims.

Zatko was the head of security for the influential platform until he was fired early this year. He filed a whistleblower complaint in July with Congress, the Justice Department, the Federal Trade Commission and the Securities and Exchange Commission. Among his most serious accusations is that Twitter violated the terms of a 2011 FTC settlement by falsely claiming that it had put stronger measures in place to protect the security and privacy of its users.

Sen. Dick Durbin, an Illinois Democrat who heads the Judiciary Committee, said Zatko has detailed flaws “that may pose a direct threat to Twitter’s hundreds of millions of users as well as to American democracy.”

“Twitter is an immensely powerful platform and can’t afford gaping vulnerabilities,” he said.

Unknown to Twitter users, there’s far more personal information disclosed than they —or sometimes even Twitter itself — realize, Zatko testified. He said “basic systemic failures” that were brought forward by company engineers were not addressed.

The FTC has been “a little over its head”, and far behind European counterparts, in policing the sort of privacy violations that have occurred at Twitter, Zatko said.

Zatko's claims could also affect Tesla billionaire Elon Musk's attempt to back out of his $44 billion deal to acquire the social platform. Musk claims that Twitter has long underreported spam bots on its platform and cites that as a reason to nix the deal he struck in April.

Many of Zatko’s claims are uncorroborated and appear to have little documentary support. Twitter has called Zatko’s description of events “a false narrative ... riddled with inconsistencies and inaccuracies” and lacking important context.

Among the assertions from Zatko that drew attention from lawmakers Tuesday was that Twitter knowingly allowed the government of India to place its agents on the company payroll, where they had access to highly sensitive data on users. Twitter’s lack of ability to log how employees accessed user accounts made it hard for the company to detect when employees were abusing their access, Zatko said.

Zatko also accuses the company of deception in its handling of automated “spam bots,” or fake accounts. That allegation is at the core of billionaire tycoon Elon Musk’s attempt to back out of his $44 billion deal to buy Twitter. Musk and Twitter are locked in a bitter legal battle, with Twitter having sued Musk to force him to complete the deal. The Delaware judge overseeing the case ruled last week that Musk can include new evidence related to Zatko's allegations in the high-stakes trial, which is set to start Oct. 17.

Sen. Charles Grassley, the committee's ranking Republican, said Tuesday that Twitter CEO Parag Agrawal declined to testify at the hearing, citing the ongoing legal proceedings with Musk. But the hearing is “more important that Twitter’s civil litigation in Delaware," Grassley said. Twitter declined to comment on Grassley's remarks.

In his complaint, Zatko accused Agrawal as well as other senior executives and board members of numerous violations, including making “false and misleading statements to users and the FTC about the Twitter platform’s security, privacy and integrity.”

Zatko, 51, first gained prominence in the 1990s as a pioneer in the ethical hacking movement and later worked in senior positions at an elite Defense Department research unit and at Google. He joined Twitter in late 2020 at the urging of then-CEO Jack Dorsey.

-----------

WASHINGTON (AP) — Peiter “Mudge” Zatko, the Twitter whistleblower who is warning of security flaws, privacy threats and lax controls at the social platform, will take his case to Congress on Tuesday.

Senators who will hear Zatko’s testimony before the Senate Judiciary Committee are alarmed by his Twitter allegations at a time of heightened concern over the safety of powerful tech platforms.

It’s Zatko’s second Capitol Hill appearance, and in some ways a 21st-century echo of his first. In 1998, he testified before a Senate panel along with fellow members of a hacker collective who warned about the security dangers of the then-emerging internet age.

Zatko, a respected cybersecurity expert, was Twitter’s head of security until he was fired early this year. He has brought the stunning allegations to Congress and federal regulators, asserting that the influential social platform misled regulators about its cyber defenses and efforts to control millions of “spam” or fake accounts.

Sen. Dick Durbin, the Illinois Democrat who chairs the panel, has said that if Zatko’s claims are accurate, “they may show dangerous data-privacy and security risks for Twitter users around the world.”

Zatko's accusations are also playing into billionaire tycoon Elon Musk's battle with Twitter. The Tesla CEO is trying to get out of his $44 billion bid to buy the company; Twitter has sued to force him to complete the deal. The Delaware judge overseeing that case ruled last week that Musk can include new evidence related to Zatko’s allegations in the high-stakes trial set to start Oct. 17.

The allegation that Twitter engaged in deception in its handling of automated “spam bot” accounts is at the core of Musk’s attempt to back out of the Twitter deal.

At the same time, many of Zatko’s claims are uncorroborated and appear to have little documentary support. In a statement, Twitter has called Zatko’s description of events “a false narrative.”

Also on Tuesday, Twitter’s shareholders are scheduled to vote on the company’s pending buyout by Musk. The vote is something of a formality given that the deal is on hold while the court case plays out. But if the measure passes as expected, it would also pave the way for a Musk takeover should Twitter prevail in court.

Zatko also filed complaints with the Justice Department, the Federal Trade Commission and the Securities and Exchange Commission. Among his most serious accusations is that Twitter violated the terms of a 2011 FTC settlement by falsely claiming that it had put stronger measures in place to protect the security and privacy of its users.

The SEC is questioning Twitter about how it counts fake accounts on its platform. Twitter uses counts of its presumably real users to attract advertisers, whose payments make up about 90% of its revenue. The “spam bots” have no value to advertisers because there’s no person behind them.

San Francisco-based Twitter has an estimated 238 million daily active users worldwide. The company says it removes 1 million spam accounts daily.

Zatko’s 84-page complaint alleges that he found “extreme, egregious deficiencies" on the platform, including issues with "user privacy, digital and physical security, and platform integrity/content moderation.”

It accuses CEO Parag Agrawal and other senior executives and board members of making “false and misleading statements to users and the FTC" about these issues. Twitter denies those claims and said that Zatko was fired in January for “ineffective leadership and poor performance.” Zatko’s attorneys say the performance claim is false.

Twitter also hinted that Zatko's complaint might be designed to bolster Musk's legal fight with the company. Twitter called Zatko’s complaint “a false narrative” that is “riddled with inconsistencies and inaccuracies, and lacks important context."

News of Zatko’s complaint surfaced on Aug. 23, almost two months before the Twitter-Musk trial is scheduled to begin. . One of Zatko’s attorneys has said “he’s never met Elon Musk. Doesn’t know Elon Musk. They know people in common.”

The company also says it has significantly tightened security since 2020.

Among Zatko's specific allegations:

— The company had such poor cybersecurity that it easily could have been exposed to outside attacks or attempts to siphon off its internal data.

—The company lacked effective leadership, with its top executives practicing “deliberate ignorance” of pressing problems. Zatko described former CEO Jack Dorsey as “extremely disengaged” during the last months of his tenure, to the point where he wouldn’t even speak during meetings on complex issues. Dorsey stepped down in November 2021.

—That Twitter knowingly allowed the government of India to place its agents on the company payroll, where they had “direct unsupervised access” to highly sensitive data on users. It makes a parallel but less detailed accusation that Twitter took funding from unidentified Chinese entities who may have gained access enabling them to access the identities and sensitive data of Chinese users who secretly use Twitter, which is officially banned in China.

Better known by his hacker handle “Mudge,” Zatko, 51, first gained prominence in the 1990s. He was the best-known member of the Boston-based collective L0pht, which pioneered ethical hacking, embarrassing companies including Microsoft for poor security. His work raised awareness in the computing world that forced such major companies to take security seriously. He co-founded the consultancy @Stake, which was later acquired by Symantec.

Zatko later worked in senior positions at the Pentagon’s Defense Advanced Research Projects Agency and Google. He joined Twitter at Dorsey’s urging in late 2020, the same year the company suffered an embarrassing security breach involving hackers who broke into the Twitter accounts of world leaders, celebrities and tech moguls, including Musk, in an attempt to scam their followers out of bitcoin.