A former security chief at Twitter, who released a whistleblower report about the company, told lawmakers on Tuesday that the platform has serious security and privacy failures that leadership has refused to fix.
Peiter “Mudge” Zatko, a cybersecurity expert who served as a Twitter executive from November 2020 until he was fired in January 2022, testified before the Senate Judiciary Committee about the whistleblower complaint he filed with Congress, the Justice Department, the Federal Trade Commission and the Securities and Exchange Commission.
“[I] am here today because I believe that Twitter’s unsafe handling of the data of its users and its inability or unwillingness to truthfully represent issues to its board of directors and regulators have created real risk to tens of millions of Americans, the American democratic process and America’s national security,” Zatko said in his opening statement.
“Further, I believe that Twitter’s willingness to purposely mislead regulatory agencies violates Twitter’s legal obligations and cannot be ethically condoned.”
The cybersecurity expert said that he found that Twitter cannot protect its data because the company does not know “what data it has, where it lives and where it came from.” Employees – particularly engineers, who make up half the full-time workforce – have too much access to data. This means any employee can access loads of sensitive information about a Twitter user, including their geolocation and data needed to directly access their device.
“It doesn’t matter who has the keys if you don’t have any locks on the doors,” he said.
Twitter founder Jack Dorsey recruited Zatko to the company after the platform was infamously hacked by teenagers who took over several high-profile accounts as part of an effort to scam Twitter users out of Bitcoin. After joining, Zatko said he discovered that Twitter had a decade of overdue security issues and as a result disclosed the failures repeatedly “to the highest levels of” the company. When his warnings were ignored, he then submitted the disclosures to government agencies and regulators.
