Twitter is accused of 'grossly negligent' cybersecurity practices in new whistleblower complaint

A whistleblower complaint has been filed against Twitter, alleging that the social media giant is not making good on its promise to fortify its security measures. The company’s executives are also accused of presenting misleading information about breaches to Twitter’s network and widespread problems with bot accounts.

The complaint was filed by Twitter’s former head of security, Peiter “Mudge” Zatko, last month and had been submitted to the United States Securities and Exchange Commission, Department of Justice, and Federal Trade Commission. A copy of the complaint was obtained by the Washington Post, which then revealed to the public some of the most concerning accusations Zatko made.

The former head of security claimed the social media giant continued using outdated servers and vulnerable software, which goes against its 2011 settlement with the FTC for a privacy complaint. Zatko added that thousands of employees still have high-level but “poorly tracked” access to core company software. If true, this leaves an opening for a potential takeover of high-profile accounts like what happened to the official pages of Barack Obama, Bill Gates, and Elon Musk.

Twitter was also accused of not prioritizing its problem with bot accounts. On the other hand, the whistleblower said executives are getting rewarded with as much as $10 million for daily user growth.

Upon Zatko’s firing, Twitter reportedly asked him to state his concerns regarding the company’s software security in writing. This account has been included as an exhibit to his whistleblower complaint, where Zatko said, “Twitter is grossly negligent in several areas of information security. If these problems are not corrected, regulators, media and users of the platform will be shocked when they inevitably learn about Twitter’s severe lack of security basics.”

Former Twitter CEO Jack Dorsey hired Zatko in late 2020, but he left the company in January after Parag Agrawal took over. In a statement to the Post, Twitter spokesperson Rebecca Hahn said Zatko’s claims are “riddled with inaccuracies” and that he was fired after 15 months due to “poor performance and leadership.” While Zatko’s attorneys confirmed he was fired from Twitter, they denied the reasons Hahn provided.

Hahn, meanwhile, maintained that Twitter is taking down more than a million spam accounts every day, which brings the annual total to more than 300 million accounts. Twitter also said the increase in daily users is the least factor considered for rewarding executives with cash bonuses.

Photo by Ravi Sharma on Unsplash