A former Twitter security chief has come forward with documents exposing “serious shortcomings” at the company related to privacy, security, and content moderation.
Peiter Zatko, the whistleblower who filed the complaint against Twitter
A formal complaint was submitted to the U.S. Securities and Exchange Commission, the Federal Trade Commission, and the Department of Justice.
The complaint was filed by the nonprofit law firm Whistleblower Aid on behalf of Peiter Zatko, Twitter’s former security chief. Whistleblower Aid also represented Facebook whistleblower Frances Haugen.
In the complaint to the SEC, Zatko alleges that he “witnessed senior executives engaging in deceptive and/or misleading communications affecting board members, users, and shareholders” multiple times in 2021. He claims CEO Parag Agrawal asked him to provide misleading documents.
This story has also been reported by The Washington Post and CNN.
Zatko accuses Twitter of failing to accurately disclose four major issues to the board: outdated software lacking basic security measures, “general issues” over who can access or control systems and data, flawed internal processes, and a “staggering volume and frequency of security incidents affecting large amounts of user data.”
He also claims that over half of Twitter’s 500,000 servers run outdated software, and more than a quarter of employee computers have disabled software updates that would provide critical security patches.
Zatko says Twitter’s broad employee access to systems and data is “unprecedented for a company of Twitter’s significance.”
If government regulators find Twitter misled consumers about its security protocols, the company could be in violation of a 2011 agreement with the FTC.
Back then, Twitter was banned for 20 years from misleading consumers about how it protects user security and personal information. The agreement also required Twitter to create and maintain a comprehensive information security program audited by an independent party for 10 years.
A spokesperson for the Senate Intelligence Committee said in a statement that the grand jury has also received the complaint and is arranging a meeting to discuss the allegations in detail: “We take this matter very seriously.”
Zatko’s complaint also references misleading information Twitter provided to billionaire Elon Musk, who is currently caught in a legal battle. Musk is trying to back out of his Twitter acquisition deal, citing doubts about Twitter’s claim that “less than 5% of accounts are ‘bots’ or spam accounts.”
A lawyer representing Zatko said he has no contact with Musk and that the complaint is objective.
Elon Musk’s attorney Alex Spiro from Quinn Emanuel told CNBC, “We have issued a subpoena to Mr. Zatko. We believe he and other key employees can help clarify Twitter’s issues.”
Musk and Twitter will face off in court this October, where Delaware Chancellor Kathaleen McCormick will decide if Musk is legally required to complete the Twitter purchase.
Twitter CEO Agrawal Accused of Lying
Parag Agrawal, Twitter CEO, and his wife Vineeta Agarwal walking to a morning session at the Allen & Company Sun Valley Conference on July 7, 2022, in Sun Valley, Idaho (photo: Getty Images)
Zatko accuses CEO Agrawal of lying in a May 16 tweet claiming the company “strongly encourages detecting and removing as much spam as possible every day.” Zatko says this is false. Twitter executives allegedly discouraged measuring bot accounts accurately because revealing the true numbers would damage the company’s image and value.
Zatko also claims Twitter lacks proper security controls. According to The Washington Post, about 7,000 Twitter employees have “broad access to the company’s internal software with insufficient oversight.”
In a memo to employees shared by CNN reporter Donie O’Sullivan on Twitter, Agrawal described Zatko as “a former Twitter security chief who was terminated in January 2022 for poor leadership and performance.”
“We are reviewing the claims made public so far, but what we see is a false, inconsistent, inaccurate story presented without important context,” Agrawal wrote.
“With the current attention on Twitter, we expect more headlines in the coming days, which will only make our work harder,” he added. “We will pursue every avenue to protect our integrity as a company.”
