Twitter Cared More About Growth Than Spies Infiltrating Company, Whistle-Blower Tells Congress

Peiter “Mudge” Zatko, the former Twitter whistle-blower who claimed last month the company was guilty of “egregious” security lapses, told Congress that company leadership failed to take action against spies on its payroll.

In testimony to the Senate Judiciary Committee on Tuesday, Zatko said that Twitter’s security precautions were so lacking that if an intelligence agency hadn’t infiltrated the company, “ you’re most likely not doing your job.”

“I’m reminded of one conversation with an executive when I said, ‘I am confident that we have a foreign agent,’ and their response was, ‘Well, since we already have one, what does it matter if we have more? Let’s keep growing the office.’” Last month, in a whistle-blower complaint sent to the Justice Department and the SEC, Zatko claimed that an Indian government agent was working for Twitter while he was there between November 2020 and January 2022, and there were suspicions a Chinese agent had infiltrated the company’s workforce. Earlier this year, a Saudi Arabian national employed by Twitter was sentenced by the Justice Department for spying on dissidents using the social media app.

Zatko said Twitter’s physical security team had been contacted regarding at least one Chinese intelligence agent on the staff. Prior to Zatko’s comments, Sen. Chuck Grassley had claimed the FBI had warned Twitter about a Chinese agent amongst its employees.

Twitter, which has sought to downplay Zatko’s revelations, has not yet responded to a request for comment, but in a letter to staff, CEO Parag Agrawal called the allegations a “false narrative riddled with inconsistencies and inaccuracies and presented without important context.”

Senator Ron Wyden told Forbes he was “deeply troubled” by the accusations that foreign governments may have had access to Americans’ private data. He called on Twitter to encrypt users’ private messages, saying he had personally urged founder Jack Dorsey to do so years ago. “If thousands of Twitter employees have access to private conversations, there’s no guarantee of security unless it’s baked into the design.”

A renowned security expert, Zatko was hired by Twitter after a devastating 2020 attack in which hackers broke into Twitter accounts belonging to President Obama and Bill Gates, among others. In his testimony to the government, Zatko alleged he saw multiple failings in Twitter security that led him to believe the company was “misleading the public lawmakers, regulators and even its own board of directors” over its ability to protect user data.

Zatko claimed that Twitter leadership didn’t understand the scale of the failures and hadn’t addressed the issues because “their executive incentives led them to prioritize profits over security.” He said Twitter was far too lenient with access to company information and was ten years behind industry standards.

“Twitter didn’t even know what it was collecting,” Zatko claimed. “It’s not far-fetched to say that an employee inside the company could take over the accounts of all of the senators in this room.”

Senator Dick Durbin, chair of the committee, warned, “What if next time it isn’t two teenagers trying to pull a crypto scam? Imagine if it’s a malicious hacker or a hostile foreign government breaking into the President’s Twitter account or sending out false information, claiming there was a terrorist attack.”

Zatko’s whistle-blower complaint has drawn wide attention for its revelations. The security expert has been subpoenaed by Elon Musk’s legal team in regards to the Tesla founder’s legal dispute with Twitter over his attempted acquisition of the company. Musk is seeking to pull out of the $44 billion deal—one reportedly set to be approved by shareholders as soon as today—citing issues with the company’s security and handling of bot accounts.

It wasn’t the first time Zatko had appeared in Congress to raise the alarm about security issues. Back in 1998, as part of a hacking crew known as L0Pht Heavy Industries, he brought to light flaws in the security of the internet. Zatko then told the United States Senate Committee on Governmental Affairs that they could take down the internet in just 30 minutes.