Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

Twitter Inc. is indeed in very serious trouble if you have someone like Mudge whistleblowing.

Now looking at the chaos, damage control and the PR disaster that is happening at Twitter HQ after this, I have zero confidence in whatever Twitter HQ and the CEO is saying other than admitting their total incompetency towards how they handle information security at the company. All attempts to make this disaster disappear will not only fail, but will eventually backfire.

So what else was Twitter lying about?

"Zatko was fired by Twitter in January and claims that this was retaliation for his refusal to stay quiet about the company’s vulnerabilities."

I don't because I'm not seeing an organization that will hold them accountable.

- This Congress is ill-equipped to understand tech, much less hold it accountable. As long as the people are happy, Congress is happy.

- Lord knows the people are ill-equipped to get how bad this is. They already watched this company allow a rogue employee to shut off the account of the President of the United States (before they chose to do it as policy; https://www.washingtonpost.com/news/the-switch/wp/2017/11/02...) and watched this company deploy a username-to-telephone lookup service publicly where they'd intended to deploy a security protocol (https://www.ghacks.net/2022/08/08/twitter-confirms-that-a-da...). The public doesn't understand why they should care.

- The only group who could really hold Twitter accountable are shareholders, but why should they care if the public and Congress don't? The money will roll in either way.

Unless they've managed to commit an SEC violation (in which case, slap on the wrist incoming), there are no consequences for this kind of bad behavior until someone powerful gets seriously hurt. I'm glad Mudge is doing the right thing, but extremely pessimistic much will come of it. My recommendation is to shed Twitter as a user.

The previous head of security to Zatko talked about fixing these problems. I remember distinctly after the FTC crackdown there were all hands where the discussion came up. I guess these problems were never fixed.

Not exactly. The CNN article doesn't say that, and The Verge's piece[1] on this puts it together pretty clearly.

>Zatko was fired by Twitter in January and claims that this was retaliation for his refusal to stay quiet about the company’s vulnerabilities. Last month, he filed a complaint with the Securities and Exchange Commission (SEC) that accuses Twitter of deceiving shareholders and violating an agreement it made with the Federal Trade Commission (FTC) to uphold certain security standards. His complaints, totaling more than 200 pages, were obtained by CNN and The Washington Post and published in redacted form this morning.

So, breaking it down more concisely:

1.) Fired in January

2.) Musk tries to buy Twitter in early April

3.) Complaint filed with SEC in July by Mudge ("way [after] EM entered the picture")

4.) WaPo published redacted, 200-page report today

[1]https://www.theverge.com/2022/8/23/23317857/twitter-whistleb...

Edit: This is not an endorsement of mud-slinging, just an attempt to make sure everyone knows what actually happened and when, at least as best we can discern at this point.