Ex-security chief: Twitter misled regulators

WASHINGTON — The former security chief at Twitter told Congress that the social media platform is plagued by weak cyber defenses that make it vulnerable to exploitation by “teenagers, thieves and spies” and put the privacy of its users at risk.

Peiter “Mudge” Zatko, a cybersecurity expert, appeared before the Senate Judiciary Committee to lay out his allegations Tuesday.

“I am here today because Twitter leadership is misleading the public, lawmakers, regulators and even its own board of directors,” Zatko said as he began testifying.

“They don’t know what data they have, where it lives and where it came from and so, unsurprisingly, they can’t protect it,” Zatko said.

Zatko said “Twitter leadership ignored its engineers,” in part because “their executive incentives led them to prioritize profit over security.”

His message echoed one brought to Congress against another social media giant last year, but unlike that Facebook whistleblower, Frances Haugen, Zatko hasn’t brought troves of internal documents to back up his claims.

Zatko was head of security for Twitter until he was fired early this year. He filed a whistleblower complaint in July with Congress, the Justice Department, the Federal Trade Commission and the Securities

and Exchange Commission. Among his most serious accusations is that Twitter violated the terms of a 2011 FTC settlement by falsely claiming that it had put stronger measures in place to protect the security and privacy of its users.

Twitter has called Zatko’s description of events “a false narrative ... riddled with inconsistencies and inaccuracies” and lacking important context.

Zatko has also accused the company of deception in its handling of automated “spam bots,” or fake accounts, an allegation at the core of Elon Musk’s attempt to back out of his $44 billion deal to buy Twitter.

Separately on Tuesday, Twitter’s shareholders voted overwhelmingly to approve the deal.