Whistleblower accuses Twitter of hiding major flaws

    Twitter misled users and US regulators about "extreme, egregious" gaps in its online protections, the platform's ex-security chief claimed in whistleblower testimony that could impact the court fight over Elon Musk's buyout bid.
    By: AFP
    | Updated on: Aug 26 2022, 12:00 IST
    Twitter account locked? Here is how to unlock it
    Twitter
    1/6 Log in to your account and look for the message letting you know your account has been locked. (Reuters)
    Twitter
    2/6 Click or tap Start. Then enter your phone number. You can note that this phone number will be associated with your account. (REUTERS)
    Twitter
    3/6 Twitter will send you a text message, or you will receive a phone call, with a verification code. It may take a few minutes for the code to be delivered to your phone. Once you enter the verification code, click or tap Submit to unlock your account. (REUTERS)
    Twitter
    4/6 If your account has been limited because it may have violated Twitter Rules, you can still browse Twitter, but while in this state, you can only send Direct Messages to your followers. You will not be able to engage in actions such as Tweeting, Retweeting, or liking, and only your followers can see your past Tweets. (REUTERS)
    image caption
    5/6 In such a situation, Twitter may ask you to complete certain actions including verifying your email address, adding a phone number to your account, or deleting Tweets that are in violation of our rules. (AP)
    Twitter
    6/6 To restore your account, log in and look for the message letting you know that your account has been temporarily limited to some of your account features. Click or tap Start and follow the instructions to complete the requested actions. (REUTERS)
    twitter
    View all Images
    The ex-worker has warned of obsolete servers, software vulnerable to computer attacks and executives seeking to hide the number of hacking attempts. (AFP)

    Twitter misled users and US regulators about "extreme, egregious" gaps in its online protections, the platform's ex-security chief claimed in whistleblower testimony that could impact the court fight over Elon Musk's buyout bid.

    Peiter Zatko's complaint, which was published Tuesday by US media, also accused Twitter of significantly underestimating the number of fake and spam accounts -- a crucial point in Musk's argument for trying to cancel his $44 billion deal to own the platform.

    Zatko's filing to authorities including market watchdog Securities and Exchange Commission accuses Twitter of "negligence, willful ignorance, and threats to national security and democracy."

    The ex-worker, who Twitter says was fired for poor performance, warns of obsolete servers, software vulnerable to computer attacks and executives seeking to hide the number of hacking attempts, both from US authorities and from the company's board of directors.

    The hacker-turned-executive, who goes by the nickname "Mudge," also claims that Twitter prioritizes growing its user base over fighting spam and bots, the filing says.

    In particular, Zatko accuses the platform and its CEO Parag Agrawal of issuing untrue statements on account numbers because "if accurate measurements ever became public, it would harm the image and valuation of the company."

    His filing argues that because Twitter reports a tally of users based on who can be reached by advertising -- not the actual number of accounts -- the true magnitude of spam bots is effectively unknown to the public.

    Twitter fired back at its former worker, saying Zatko was fired in January for "ineffective leadership and poor performance."

    "What we've seen so far is a false narrative about Twitter and our privacy and data security practices that is riddled with inconsistencies and inaccuracies and lacks important context," the firm said in a statement.

    The "opportunistic timing" of the allegations appears "designed to capture attention and inflict harm on Twitter, its customers and its shareholders," the statement continued.

    A redacted version of the filing was dated July 6, nearly a week before Twitter launched its lawsuit to try to force Musk to close the buyout deal and which is set for trial in mid-October.

    Zatko's legal team called the characterizations of his work and departure from Twitter as "false", noting he was fired after clashing with the new CEO Agrawal.

    - 'Dangerous security risks' -

    The issue of fake accounts is at the heart of the legal battle between Twitter and Tesla chief Musk.

    The billionaire has repeatedly accused the company of minimizing the number of bot accounts on its platform, and he tweeted Tuesday "spam prevalence *was* shared with the board, but the board chose not disclose that to the public..."

    Musk is relying on the bot argument to justify abandoning his buyout deal and avoid paying severance, but Twitter's lawsuit has asserted that it's too late because the parties already have an agreement.

    CNN reported that Zatko has not been in contact with Musk, and that he had begun the whistleblower process before there was any sign of the billionaire's involvement in Twitter.

    "We have already issued a subpoena for Mr. Zatko, and we found his exit and that of other key employees curious in light of what we have been finding," Musk's lawyer Alex Spiro told AFP.

    The markets were not thrilled with Tuesday's news and Twitter shares closed down over seven percent for the day.

    Zatko was hired in late 2020 by the founder and former boss of Twitter, Jack Dorsey, after a massive hack that saw the accounts of major users including Joe Biden, Barack Obama, reality star Kim Kardashian and Musk himself compromised.

    Before joining Twitter, Zatko held senior positions at Google and payments processing firm Stripe as well as DARPA, the technological research arm of the Pentagon.

    US lawmakers immediately raised concerns about the allegations in Zatko's filing and have pledged to look into them.

    "If these claims are accurate, they may show dangerous data privacy and security risks for Twitter users around the world," Senator Dick Durbin said in a statement.

    Follow HT Tech for the latest tech news and reviews , also keep up with us on Twitter, Facebook, Google News, and Instagram. For our latest videos, subscribe to our YouTube channel.

    First Published Date: 26 Aug, 12:00 IST
    NEXT ARTICLE BEGINS
    keep up with tech