After terminating Peiter Zatko, Twitter asked him to spell out his concerns with the company’s security so that it could investigate. This document, attached as an exhibit to this month’s whistleblower complaint, was the result.
Read the full document
The complaint has potential implications for Twitter’s legal battle with Musk, who is trying to get out of a $44 billion contract to buy the social media platform. The deal includes a pledge by Twitter that its shareholder filings are accurate. But Musk contends that Twitter has drastically underestimated the number of bots on its platform, a violation that should allow him to walk away without penalty. The dispute is set to go to trial in Delaware Chancery Court in October.
On Tuesday after the publication of this article, Musk tweeted an apparent reference to the whistleblower, sharing a meme of Jiminy Cricket from Disney’s “Pinocchio” with the words “Give a Little Whistle.”
Overall, Zatko wrote in a February analysis for the company attached as an exhibit to the SEC complaint, “Twitter is grossly negligent in several areas of information security. If these problems are not corrected, regulators, media and users of the platform will be shocked when they inevitably learn about Twitter’s severe lack of security basics.”
Zatko’s complaint says strong security should have been much more important to Twitter, which holds vast amounts of sensitive personal data about users. Twitter has the email addresses and phone numbers of many public figures, as well as dissidents who communicate over the service at great personal risk.
This month, an ex-Twitter employee was convicted of using his position at the company to spy on Saudi dissidents and government critics, passing their information to a close aide of Crown Prince Mohammed bin Salman in exchange for cash and gifts.
Zatko’s complaint says he believed the Indian government had forced Twitter to put one of its agents on the payroll, with access to user data at a time of intense protests in the country. The complaint said supporting information for that claim has gone to the National Security Division of the Justice Department and the Senate Select Committee on Intelligence. Another person familiar with the matter agreed that the employee was probably an agent.
Twitter India’s office in New Delhi in 2021. The whistleblower complaint alleges the Indian government forced Twitter to put one of its agents on the payroll.
Senate Intelligence Committee spokeswoman Rachel Cohen said the committee is trying to set up a meeting with Zatko to discuss the complaint in detail.
“Take a tech platform that collects massive amounts of user data, combine it with what appears to be an incredibly weak security infrastructure and infuse it with foreign state actors with an agenda, and you’ve got a recipe for disaster,” Charles E. Grassley (R-Iowa), the top Republican on the Senate Judiciary Committee, said in a statement. His office has had discussions with Zatko about the allegations. “The claims I’ve received from a Twitter whistleblower raise serious national security concerns as well as privacy issues, and they must be investigated further.”
Many government leaders and other trusted voices use Twitter to spread important messages quickly, so a hijacked account could drive panic or violence. In 2013, a captured Associated Press handle falsely tweeted about explosions at the White House, sending the Dow Jones industrial average briefly plunging more than 140 points.
