Twitter whistleblower raises security flaws before Congress

The former security chief at Twitter told Congress that the social media platform is plagued by weak cyber defences that make it vulnerable to exploitation by “teenagers, thieves and spies” and put the privacy of its users at risk. Peiter “Mudge” Zatko, a respected cybersecurity expert, appeared before the Senate Judiciary Committee to lay out his allegations Tuesday.

“I am here today because Twitter leadership is misleading the public, lawmakers, regulators and even its own board of directors,” Zatko said as he began his sworn testimony.

He told senators he was “risking my career and my reputation” to warn of poor security practices in which too many Twitter employees had unsupervised access to sensitive information, and a corporate culture of only reporting good news up the chain.

Zatko said “Twitter leadership ignored its engineers”, in part because “their executive incentives led them to prioritise profit over security”.

His message echoed one brought to Congress against another social media giant last year, but unlike that Facebook whistleblower, Frances Haugen, Zatko hasn’t brought troves of internal documents to back up his claims.

Zatko was the head of security for the influential platform until he was fired early this year. He filed a whistleblower complaint in July with Congress, the Justice Department, the Federal Trade Commission and the Securities and Exchange Commission. Among his most serious accusations is that Twitter violated the terms of a 2011 FTC settlement by falsely claiming that it had put stronger measures in place to protect the security and privacy of its users.

Dick Durbin, an Illinois Democrat who heads the Judiciary Committee, said Zatko has detailed flaws “that may pose a direct threat to Twitter’s hundreds of millions of users as well as to American democracy”.

“Twitter is an immensely powerful platform and can’t afford gaping vulnerabilities,” he said.

Unknown to Twitter users, there’s far more personal information disclosed than they —or sometimes even Twitter itself — realise, Zatko testified. He said “basic systemic failures” that were brought forward by company engineers were not addressed.

The FTC has been “a little over its head”, and far behind European counterparts, in policing the sort of privacy violations that have occurred at Twitter, Zatko said.

Zatko, 51, first gained prominence in the 1990s as a pioneer in the ethical hacking movement and later worked in senior positions at an elite Defence Department research unit and at Google. He joined Twitter in late 2020 at the urging of then-CEO Jack Dorsey.