Whistleblower calls Twitter 'ticking bomb of security vulnerabilities'

Shortly after ten o'clock in the morning, Peiter Zatko entered an adjoining building of the American Senate. He wore a dark gray suit and was leaning on a wooden stick decorated with flames. Zatko took a seat in room 216 and read a short statement. Then he answered the politicians' questions for two hours and 24 minutes. What he said during that time could change the way the US deals with its tech companies.

Zatko, 51, gray goatee, rectangular glasses, was Twitter's chief of security from November 2020 until his dismissal in January 2022. In July, he filed a complaint against the company with the Senate. So Zatko became a whistleblower.

He claimed Twitter had serious security flaws. The platform, he explained, is vulnerable to hackers and foreign spies. In addition, they downplay the number of their fake profiles and collect unrestrained data from their users.

Twitter dismissed all of this in July, accusing Zatko of acting out of resentment. The company had justified the dismissal of the man with poor performance. He was paid a severance payment anyway, according to the Wall Street Journal it was seven million dollars.

On Tuesday, Zatko testified before the Senate for the first time - and catapulted himself into the center of a debate that has been going on in the United States for years. It revolves around the question of whether the Internet giants on the American west coast should be regulated more strictly. Whether companies like Google, Apple, Facebook and Amazon have become too powerful and perhaps even need to be broken up.

In room 216, Zatko repeated his allegations. He described Twitter as a "ticking bomb of security vulnerabilities". The service, he said, posed a "real risk" to millions of Americans and national security. According to Zatko, he tried to remedy the situation, but management was not interested.

Zatko also accused Twitter of collecting more data than necessary, such as users' phone numbers and places of residence. An internal investigation revealed that employees only knew why they were being recorded for 20 percent of the data.

And all of the company's engineers, the whistleblower explained, have access to the data. They even have the ability to take over users' profiles. "It's not far-fetched," Zatko said, "to say that one Twitter employee could hijack the accounts of every senator in this room."

Zatko also claimed that there was probably a Chinese government spy in the company at the time. He brought this to the attention of management but was ignored.

Peiter Zatko, a former hacker also known as "Mudge," painted a picture of a company in deep trouble: disorganized and sloppy with data, vulnerable to hackers, infiltrated by foreign agents. After the hearing, Twitter succinctly said Zatko's claims were "full of inconsistencies."

All of this sounds familiar. Zatko isn't the first whistleblower to confuse America's internet giants. Silicon Valley used to be seen as a savior, as a place that promised prosperity and progress. But today, many people are skeptical about big tech, even the employees.

Last year, for example, former Facebook employee Frances Haugen testified before the Senate. Haugen had downloaded internal documents intended to prove that Facebook puts profits before the well-being of its users. Zatko, on the other hand, had no documentation with him on Tuesday to support his claims.

But the man seems to know what he's talking about. Considered an industry icon, he has worked at the Pentagon and Google and was personally recruited in 2020 by then Twitter boss Jack Dorsey. A few months earlier, hackers had taken control of the Twitter profiles of celebrities including Joe Biden, Barack Obama, Bill Gates and Elon Musk. The attackers attempted to cheat users out of bitcoin balances.

Hearings like the one in room 216 are always a show. A way for American politicians to make their mark in front of millions of TV viewers. But Zatko's appearance could have concrete consequences.

For example, Connecticut Senator Richard Blumenthal called for the creation of a new agency to regulate tech companies. He said the penalties from the previous body, the Federal Trade Commission, or FTC for short, were ineffective.

Zatko confirmed that. Fines such as the $150 million fines imposed by the FTC in the spring for allegedly illegally selling Twitter data left managers cold, he said. "Such sums are priced in."

The hearing could have another consequence - for Elon Musk. Musk announced in April that he would buy Twitter. But a little later he declared the deal void. Musk cited the reason why Twitter was hiding the true number of fake profiles.

He later expanded his arguments and also relied on Zatko's criticism of the alleged lack of data security. Twitter and Musk are in a legal battle. And thanks to Zatko, the tech billionaire could be gaining the upper hand.

However, Twitter's shareholders want to stick to the agreement and approved the takeover by Musk on Tuesday. The choice shouldn't have been difficult for them: Twitter shares were recently quoted at around $42, well below Musk's offer. The entrepreneur had bid $54.20 per share.

So Zatko's testimony before the Senate could come in handy for Musk. In any case, he seemed to have felt well entertained on Tuesday. He tweeted shortly after the hearing began. It contained no words, just an emoji: a bag of popcorn.

"Everything on shares" is the daily stock exchange shot from the WELT business editorial team. Every morning from 7 a.m. with our financial journalists. For stock market experts and beginners. Subscribe to the podcast on Spotify, Apple Podcast, Amazon Music and Deezer. Or directly via RSS feed.