WASHINGTON (AP) – The former Twitter security chief told Congress Tuesday that there was “at least one agent” from the Chinese intelligence service on Twitter’s payroll and that the company knowingly allowed India to add as well. agents to the company’s directory, potentially giving those countries access to sensitive user data.
These were some of the troubling revelations from Peiter “Mudge” Zatko, a respected cybersecurity expert and Twitter whistleblower who appeared before the Senate Judiciary Committee to expose his allegations against the company.
Zatko told lawmakers that the social media platform is plagued by weak cyber defenses that make it vulnerable to exploitation by “teenagers.thieves and spies ”and put the privacy of its users at risk.
“I’m here today because Twitter’s leadership is misleading the public, lawmakers, regulators, and even their own board of directors,” Zatko said as he began his sworn testimony.
“They don’t know what data they have, where they live and where they come from and so obviously they can’t protect it,” Zatko said. “It doesn’t matter who has the keys if there are no locks.”
“Twitter’s leadership ignored its engineers,” he said, in part because “their executive incentives have led them to prioritize profit over safety.”
In a statement, Twitter said its hiring process is “independent of any foreign influence” and access to data is managed through a number of measures, including background checks, access controls, and monitoring systems and processes. detection.
One issue that didn’t come up during the hearing was whether Twitter is accurately counting its active users, an important metric for its advertisers. Tesla CEO Elon Musk, who is looking to get out of a $ 44 billion deal to buy Twitter, he claimed without proof that many of Twitter’s 238 million daily users are fake or malicious accounts, also known as “spam bots.”
Even so, “that doesn’t mean Musk won’t use Zatko’s accusation that Twitter was disinterested in removing the robots to try and bolster his argument for abandoning the deal,” said Insider Intelligence analyst Jasmine Enberg.
The Delaware judge who oversaw the case ruled last week that Musk may include new evidence relating to Zatko’s allegations in the high-risk trial, which is expected to begin on October 17. During the hearing, Musk tweeted a popcorn emoji, often used to suggest that one is sitting waiting for the drama to unfold.
Separately on Tuesday, Twitter shareholders voted overwhelmingly to approve the deal, according to multiple media outlets. Shareholders have been voting remotely on the issue for weeks. The vote was largely a formality, particularly given Musk’s efforts to cancel the deal, although it does clear up a legal obstacle to closing the sale.
Zatko’s message echoed the one he brought in Congress against another social media giant last year. But unlike Facebook whistleblower Frances Haugen, Zatko did not bring internal documents to support his claims.
Zatko was the head of security for the influential platform until he was fired earlier this year. In July, he filed a whistleblower complaint with Congress, the Department of Justice, the Federal Trade Commission, and the Securities and Exchange Commission. Among his most serious allegations is that Twitter violated the terms of a 2011 FTC agreement by falsely claiming that it has put stronger measures in place to protect the security and privacy of its users.
Senator Dick Durbin, an Illinois Democrat who heads the judicial committee, said Zatko has detailed flaws “that could pose a direct threat to hundreds of millions of Twitter users and American democracy.”
“Twitter is an immensely powerful platform and cannot afford open vulnerabilities,” he said.
Unbeknownst to Twitter users, their personal information is disclosed far more than they realize – or sometimes even Twitter itself -, Zatko testified. He said Twitter did not address the “basic systemic failures” presented by the company’s engineers.
The FTC has been “a little over the top” and far behind its European counterparts in controlling the type of privacy violations that have occurred on Twitter, Zatko said.
Zatko’s claim that Twitter was more concerned about foreign regulators than the FTC, Eenberg said, “could be a wake-up call for US lawmakers,” who have been unable to pass meaningful regulations on social media company.
Senator Lindsey Graham, a Republican from South Carolina, said a positive outcome that could come from Zatko’s achievements would be bipartisan legislation to establish a stricter regulatory system for technology platforms.
“We have to improve our game in this country,” he said.
Many of Zatko’s claims are not corroborated and appear to have little documentary support. Twitter called Zatko’s description of events “a false narrative … full of inconsistencies and inaccuracies” and lacking important context.
However, Zatko proved to be a compelling whistleblower who has “a lot of credibility in this space,” said Ari Lightman, a professor of digital media and marketing at Carnegie Mellon University. But he said many of the problems he raised can likely be found in many other digital technology platforms
“They avoid security protocols in the sense of innovating and running very fast,” Lightman said. “At the beginning we gave digital platforms a lot of autonomy to grow and develop. Now we’re at a point where we are: “Wait a minute … This got out of hand.”
Among Zatko’s claims that caught the legislator’s attention was Twitter’s apparent negligence in dealing with governments trying to get a spy job within the company. Twitter’s inability to log how employees log into user accounts made it difficult for the company to detect when employees were abusing their login, Zatko said.
Zatko said he spoke with “high confidence” about a foreign agent that the Indian government posted on Twitter to “understand the negotiations” between the Indian ruling party and Twitter about the new restrictions on social media and the progress of the negotiations.
Zatko also revealed Tuesday that he was told about a week before his dismissal that “at least one agent” from the Chinese intelligence service MSS, or the Ministry of State Security, was “on the payroll” on Twitter.
He said he was similarly “surprised and shocked” by an exchange with current Twitter CEO Parag Agrawal about Russia, in which current Twitter CEO, who was Chief Technology Officer at the time, asked if he would be It was possible to “target” content moderation and surveillance at the Russian government, since Twitter doesn’t really have “the ability and tools to do things right.”
“And since there are elections, doesn’t that make them a democracy?” Zatko recalled Agrawal saying.
Senator Charles Grassley, the committee’s grade Republican, said Tuesday that Agrawal refused to testify at the hearing, citing ongoing legal proceedings with Musk. But the hearing is “more important than Twitter’s Delaware civil litigation,” Grassley said. Twitter declined to comment on Grassley’s remarks.
In his complaint, Zatko accused Agrawal, as well as other senior executives and board members of numerous violations, including “false and misleading statements to users and the FTC about the security, privacy and integrity of the Twitter platform.” .
Zatko, 51, first rose to fame in the 1990s as a pioneer in the ethical hacking movement and later worked in senior positions at the Department of Defense’s elite research unit and at Google. He joined Twitter in late 2020 at the urging of then CEO Jack Dorsey.
O’Brien reported from Providence, RI; Ortutay reported from Oakland, California.
Follow Marcy Gordon at https://twitter.com/mgordonap