Twitter tells US Senator Wyden that it's “transitioning” away from using Mitto for passcodes, as the text message services firm faces surveillance accusations
Ryan Gallagher / Bloomberg :
Context & Ripple Effects
Bloomberg's December investigation reported that Mitto, a Swiss firm sending automated texts for companies in over 100 countries, helped governments secretly surveil mobile users; weeks later, sources said Mitto told clients co-founder Ilja Gorelik had departed amid the surveillance accusations. Twitter's confirmation to Senator Wyden that it is transitioning its passcode traffic off Mitto is the first named platform response to that reporting.
The move also lands on a company already sensitive about its security posture: back in 2020, US lawmakers publicly worried about attacks on Twitter's infrastructure while the company hunted for a chief infosec officer, so a text-message vendor with alleged government-surveillance ties touches an old nerve.
First-order effects
- Twitter has to re-route the SMS passcodes that gate account logins and two-factor authentication to a different provider, a migration executed under direct congressional scrutiny from Wyden.
- Mitto loses a high-profile client whose departure other enterprise customers can read as a verdict, compounding the damage from the investigation and Gorelik's exit.
Second-order effects
- Every other large Mitto client now faces the same vendor-vetting question Wyden posed to Twitter — whether their authentication texts transit a firm accused of enabling government surveillance — forcing procurement teams to audit SMS aggregators they previously treated as commodity plumbing.
- Rival messaging and aggregator providers gain a selling point built on provenance, shifting competition in bulk SMS toward verifiable security practices rather than price per message.
Third-order effects
- If the pattern holds, SMS-based authentication becomes a formally audited supply chain rather than an afterthought — a shift later underscored by whistleblower data showing 1M+ 2FA messages routed through Fink Telecom, a small Swiss firm linked to spy agencies, proving the exposure persisted years after the Mitto revelations.
- Regulators and lawmakers like Wyden gain a template for pressuring platforms on third-party telecom dependencies, pushing vendor transparency disclosures into standard practice for consumer internet companies.
The trend: Two-factor authentication delivery is being reclassified from commodity SMS plumbing into critical security infrastructure, with platforms forced to vet text-message vendors for spy-agency ties.