Advertisement

SKIP ADVERTISEMENT

Whistle-Blower Says Twitter ‘Chose to Mislead’ on Security Flaws

At a Senate hearing, Peiter Zatko, Twitter’s former head of security, told lawmakers that the company lied about its data practices.

Video
Video player loading
Peiter Zatko, Twitter’s former head of security, said in a Senate hearing that significant security failures put user data at risk.CreditCredit...Haiyun Jiang/The New York Times

David McCabe and

David McCabe, who writes about technology regulations, reported from Washington. Kate Conger, who covers Twitter, reported from San Francisco.

Twitter’s former top security official told lawmakers at a hearing on Tuesday that executives had so heavily prioritized the company’s business that they disregarded concerns about foreign governments infiltrating its operations and misled regulators about its privacy practices.

Peiter Zatko, who was Twitter’s top security official before he was fired in January, testified that the F.B.I. had notified the company during his tenure that “there was at least one agent” of China’s Ministry of State Security “on the payroll inside Twitter.” In another conversation about a possible foreign agent inside Twitter, Mr. Zatko recounted, an executive said that because “we already have one, what does it matter if we have more.”

Members of the Senate Judiciary Committee, which convened the hearing, expressed concerns about Mr. Zatko’s accusations, which he first made in a whistle-blower complaint that became public last month. Senator Charles E. Grassley of Iowa, the top Republican on the committee, said he did not see how Twitter’s chief executive, Parag Agrawal, could keep his job if the allegations were true.

“Twitter has a responsibility to ensure that the data is protected and doesn’t fall into the hands of foreign powers,” Mr. Grassley said.

Mr. Zatko’s testimony added to the turmoil engulfing Twitter as the social media service faces questions about its survival. The company, which is based in San Francisco, has been embroiled in a battle with Elon Musk, the Tesla chief executive, who agreed to buy Twitter for $44 billion in April before trying to back out of the deal. The company has insisted that the purchase go forward and has sued Mr. Musk, with a trial over the case set for next month.

Twitter’s shareholders voted on Tuesday to approve the deal with Mr. Musk, even as it remains uncertain whether the acquisition will be completed. The approval was expected; shareholders do not typically reject deals. Twitter said that 98.6 percent of the votes cast by shareholders approved of the deal, according to a preliminary tally.

The hearing on Tuesday showed that “Twitter is acting dangerously and negligently to turn its back on user safety,” said Nora Benavidez, senior counsel at Free Press, an advocacy group that has called for Twitter to do more to combat misinformation.

Twitter denied Mr. Zatko’s accusations, saying in a statement, “Today’s hearing only confirms that Mr. Zatko’s allegations are riddled with inconsistencies and inaccuracies.”

Mr. Zatko’s whistle-blower complaint has become entangled in Mr. Musk and Twitter’s fight over the company. Mr. Musk’s lawyers have seized on Mr. Zatko’s statements to back their argument that Twitter misled the billionaire about the volume of spam accounts on the service.

Mr. Musk has claimed that he should be able to abandon the Twitter acquisition because the company downplayed the number of fraudulent accounts on the service. Mr. Zatko said in his complaint that Mr. Agrawal had misled Mr. Musk after the billionaire made his concerns known.

A spokesman for Mr. Musk’s legal team did not respond to a request for comment.

At the more than two-hour hearing on Tuesday, Mr. Grassley said Mr. Agrawal had “rejected this committee’s invitation by claiming that it would jeopardize Twitter’s ongoing litigation with Mr. Musk.”

“Many of the allegations directly implicate Mr. Agrawal, and he should be here to address them,” Mr. Grassley said.

Mr. Zatko, who reached a $7 million settlement with the company after he left, described Twitter executives as unconcerned about possible holes in security, especially when it could endanger the company’s bottom line. He said he had told one executive that he was “confident” there was a foreign agent inside the company.

“And their response was: ‘Well, since we already have one, what does it matter if we have more. Let’s keep growing the office,’” Mr. Zatko told lawmakers.

Prosecutors charged two former Twitter employees in 2019 with acting as agents of the government of Saudi Arabia, saying they had used their positions to gain access to information about critics of the Saudi government. A California jury convicted one of them on some of the charges last month; the other man left the country before authorities could arrest him.

During the hearing, Mr. Zatko also reiterated that Twitter had misled the Federal Trade Commission about its data practices and that it had violated the terms of a 2011 settlement it had reached with the agency. Twitter misrepresented to the F.T.C. whether it deletes a user’s data when the user leaves the service, he said. He added that he had not directly been involved in conversations between Twitter and the agency but had been briefed on the discussions by “people involved in the calls.”

Several senators asked whether the regulations governing tech companies were inadequate. Lawmakers have for years considered legislation that would set new privacy and competition rules for the biggest tech platforms. But those efforts have yet to bear fruit.

“Something good will come from this. Do you believe that?” asked Senator Lindsey Graham, a South Carolina Republican.

“I hope so,” Mr. Zatko said. “I’m basically risking my career and reputation.”

David McCabe covers tech policy. He joined The Times from Axios in 2019. More about David McCabe

Kate Conger is a technology reporter in the San Francisco bureau, where she covers the gig economy and social media. More about Kate Conger

A version of this article appears in print on  , Section B, Page 4 of the New York edition with the headline: Twitter Disregarded Alarm Over Foreign Infiltration, Whistle-Blower Says. Order Reprints | Today’s Paper | Subscribe

Advertisement

SKIP ADVERTISEMENT