Whistleblower alleges Twitter executives deceived regulators about lax security procedures

Read the Full Transcript

• Amna Nawaz:

  Twitter is under fire after a new whistle-blower is alleging that the social network has — quote — "extreme, egregious deficiencies in its cybersecurity defense."

  The new complaint says Twitter is an easy target for hackers and could put users' information at risk.

  Stephanie Sy tells us more.

• Stephanie Sy:

  Amna, the whistle-blower is a former head of security at Twitter, and was previously a renowned hacker himself, known as Mudge. Now lawmakers on Capitol Hill are looking into Peiter Zatko's claims.

  Among many other serious allegations, Zatko says the company misled regulators about its ability and efforts to get rid of fake or spam accounts, a claim that could help Elon Musk, who is trying to back out of a deal to buy the company for $44 billion.

  With more, I'm joined by Elizabeth Dwoskin, Silicon Valley correspondent for The Washington Post, who helped break this story.

  Elizabeth, thanks so much for joining us.

  We have talked often about Twitter's security problems over the years. But what Zatko is alleging here is deception, lies to government regulators, the media and users.

  Can you just boil down for us just a couple of the most egregious allegations here? And tell us why people should be concerned.

• Elizabeth Dwoskin, The Washington Post:

  Yes, these are explosive claims that could be incredibly damaging to Twitter. You're absolutely right that Twitter's had security issues over the years, the security disaster, many would say.

  But now we have Peiter Zatko, Mudge, alleging that they were lying to the board, they were lying to investors, they were lying to the regulators. And these are huge allegations. He says that too many employees had access to internal company systems, that the security was so bad that Twitter was literally on the brink of shutdown, that they didn't delete data that they claimed that they deleted, that he tried to present contrary information to the board and was prevented by the CEO.

  And one thing when you think about, OK, why does the average person care, because not everyone's on Twitter, Twitter is an incredibly influential platform, because it has politicians, it has influencers, public figures.

  And what happens on Twitter can sway the stock price of companies, it can cause national security alerts. Imagine if someone saw on Twitter there's a bomb at the White house. That would cause the public to go into a panic.

  And so if Twitter security, as Mudge alleges, is as weak as he alleges, then you have this exposure to bad actors that can then influence the public discourse, whether it's on politics, the future of companies, or security, the public safety.

• Stephanie Sy:

  There are also some very serious claims about foreign influence, Elizabeth, including that Twitter knowingly hired an agent who worked for the government of India who had — quote — "a direct unsupervised access to the company's systems and user data."

  If that is true, this seems to be about much more than the security of the average Twitter user's account info or even about the reliability of the platform.

• Elizabeth Dwoskin:

  Yes, this — that is the most salacious and troubling allegation in the complaint. And it's actually one that was the hardest for us to substantiate, because a lot of the complaint is redacted. And we believe that that — the Indian stuff is the redacted stuff.

  About — last year, Twitter was required by the Indian government actually to hire two executives that would report directly to the government of India. All tech companies were. And Twitter's pushback is that this is what Mudge is referring to.

  But we have sourcing that says that potentially there was another government agent, but, again, we don't — it was the weakest part of the complaint, because so much is redacted.

• Stephanie Sy:

  For its part, Twitter also says they fired Peiter Zatko for — quote — "ineffective leadership and poor performance." And they call the timing of these allegations opportunistic.

  What other explanations are you getting, Elizabeth, from the company and hearing from employees?

• Elizabeth Dwoskin:

  Well, one of the things that I have heard from a lot of employees is that, despite Mudge being a famous hacker, when he came into Twitter, he had this arrogant attitude, where he was — basically acted like he knew things about subjects that were outside of his expertise.

  One of the most interesting examples, I think, in the complaint, and that comes from my reporting as well, is related to this claim that he makes that Twitter was lying to Elon Musk about spam and bots. He literally says, Twitter's lying in the complaint.

  And one of the things he says, for example, is that he couldn't get a straight answer from anyone at Twitter about the prevalence of spam on the platform. He says he asked and asked and couldn't get an answer.

  But my own reporting, including a document I reviewed from Twitter, shows that, actually, Twitter does have an internal number called spam prevalence. And it was presented at a board meeting that Mudge attended. So maybe he didn't like that number, didn't believe in the number. Maybe he dismissed it.

  I feel like the truth here is somewhere in between.

• Stephanie Sy:

  And you mentioned Elon Musk. The timing does seem opportune for Mr. Musk, because some of the claims deal directly with this problem of spam and fake accounts, which Musk has cited as a reason for withdrawing his bid to buy the company.

  How could this case help him — or this testimony, I guess, help him in his trial, which begins soon?

• Elizabeth Dwoskin:

  Yes, as I said, I feel like this entire complaint was a big call to Elon Musk to subpoena me, depose me.

  And, actually, what we saw today is that Elon's team is going to be deposing him. Now, I think that, even if all the claims don't turn out to be accurate, I think this could open up a Pandora's box in the Elon Musk case. The trial is set to happen, if it doesn't settle, in October. It's very soon. There's a hearing tomorrow.

  And what we think is that there's already been this fight over discovery and data, who's going to get access, for example, to — whether Elon's team is going to get access to internal records of Twitter executives.

  Well, you can see that something like this gives them huge leverage to say, wait, we actually need more executives. We need to find out what's going on. I think it even goes beyond the spam and bots issue that Elon has been consistently raising.

• Stephanie Sy:

  And a whole can of worms for Twitter users as well.

  Elizabeth Dwoskin with The Washington Post, thank you for joining the "NewsHour," as always.

• Elizabeth Dwoskin:

  Thanks for having me.