A profile of Peiter Zatko, aka Mudge, who worked at DARPA, Google, and Stripe before Twitter, and was a member of hacker groups L0pht and Cult of the Dead Cow

From the L0pht and Cult of the Dead Cow to DARPA and Google, Peiter ‘Mudge’ Zatko took unorthodox approaches to ‘make a dent in the universe’

Washington Post 2022-08-24 Joseph Menn

Discussion

@goldman Jason Goldman on x
Hard to imagine a worse whistleblower for Twitter than an unimpeachable expert who's made a storied career out of finding vulnerabilities and explaining them to industry, government and media.
@dennisf Dennis on x
@sedward5 ... Here it is in all its glory. https://twitter.com/...
@spacerog @spacerog on x
I spoke with @snlyngaas at @CNNnewsroom about @dotMudge and how we released vulns back at @L0phtHeavyInd. Not much has changed in 30yrs, just a continuation of the same process. https://www.cnn.com/...
@donie Donie O'Sullivan on x
NEW: Musk lawyer Alex Spiro said they want to talk to Twitter whistleblower. “We have already issued a subpoena for Mr. Zatko, and we found his exit and that of other key employees curious in light of what we have been finding.”
@kennwhite Kenn White on x
I don't like the phrase “moral compass” because it indulges our tendency towards hero worship, but Mudge has had a long & respected career working on serious things that benefit the public good. It says a lot that professionals of the stature of Dug, Cris, and Dave vouch for him.…
@kimzetter Kim Zetter on x
“Zatko didn't blend into Twitter's culture. Some who dealt with him said he came off as arrogant, especially when venturing past his areas of expertise. 'He's a total savant, but also a bit of a bull in a china shop,' one person...at Twitter said” https://www.washingtonpost.com/ …
@tarah Tarah M. Wheeler on x
Mudge has repeatedly, faithfully, and publicly demonstrated that he will do the right thing to keep people safe. https://www.nbcnews.com/...
@alex_avoigt Alex on x
Given the revelations of Twitter whistleblower Zatko, it is unlikely that Elon can lose the case against Twitter. https://cnn.com/...
@spoofyroot Johnathan Norman on x
Mudge did the right thing. I wonder what impact that will have on his career.
@perrymetzger Perry E. Metzger on x
The problem with Twitter PR claiming that @dotMudge was fired for incompetence isn't that it completely lacks credibility (it does) but that it doesn't address Mudge's extremely specific allegations. What matters here is whether the allegations are true.
@shaunmmaguire Shaun Maguire on x
I sat a few feet away from Mudge at DARPA for a couple years. I consider him a friend and a mentor. I can't think of someone with higher integrity. I've personally seen him do the right thing twice, when it was hard and unpopular. There's nobody I trust more in this situation. ht…
@wbaidlaw @wbaidlaw on x
“For three decades, security pioneer Peiter ‘Mudge’ Zatko has exposed the risks facing technology users as a hacker. Now he's doing it as a whistleblower.” https://www.washingtonpost.com/ ...
@craigmod Craig Mod on x
1998, testifying before congress with the nameplates: Kingpin, Tan, Oblivion, Mudge, and Space Rouge https://www.washingtonpost.com/ ... https://twitter.com/...
@harpermitchell @harpermitchell on x
The thing with Mudge is he's untouchable when it relates to NDAs There are plenty of people who could be whistleblowers about their companies, but this would torch their careers https://twitter.com/...
@cat_zakrzewski Cat Zakrzewski on x
@josephmenn @lizzadwoskin The whistleblower, Peiter Zatko, is a well-known hacker who goes by Mudge. He says his decision to go public is an extension of his previous work exposing flaws in cybersecurity. @josephmenn has more about his career here https://www.washingtonpost.com/ …
@falcondarkstar @falcondarkstar on x
“Mudge is a scrub and didn't really understand what he was doing in security; he couldn't make persuasive arguments and is sounding the alarm about nothing” is certainly an argument.
@therealdtrain37 David Trainer on x
@montana_skeptic Our good friend @matt_levine points out that the “complaint actually doesn't agree with Musk's.... And Zatko is pretty unambiguous that, no, Twitter's numbers are correct.” https://www.bloomberg.com/...
@carole_fennelly @carole_fennelly on x
I second @AlecMuffett on this, and have known @dotMudge for as long. Mudge has worked very hard over many years trying to convince the executive level to take security seriously. Nothing will change as long as security is viewed as a cost center. https://twitter.com/...
@eamonjavers Eamon Javers on x
The Twitter whistleblower's complaint mentions @elonmusk by name 10 times. Even just a quick skim of those mentions shows why this whistleblower is probably *very* good news for Elon. 🧵
@2600 @2600 on x
Thank you, Mudge.
@perrymetzger Perry E. Metzger on x
Mudge is only important here because he's an extremely credible source; otherwise, he's not the story. @paraga sending his PR flacks to portray Mudge as a disgruntled employee isn't merely not credible, it's irrelevant, because it's not evidence that the allegations are false.
@samidhas @samidhas on x
Whistleblowers are the new tech celebrities. For all the truths they are putting forth, as ex employees, they are also clearly looking to get famous with these coordinated leaks . Peiter ‘Mudge’ Zatko's journey from hacker to Twitter whistleblower https://www.washingtonpost.com/ …
@alecmuffett Alec Muffett on x
@thauburger I've known Mudge for ~25+ years, & I know he cares a lot more about security than appearances. And I've seen many corporations that care more about appearances than security. So I'm confident that critics making it personal, doesn't make it untrue. https://twitter.com…
@karaswisher Kara Swisher on x
One note: every tech company have folks like this just dying to explain the holes everywhere https://twitter.com/...
@joshtpm Josh Marshall on x
This may certainly true, in part or in whole. But almost impossible to believe it's not some scheme on musks part to get out of his deal to buy twitter. https://www.axios.com/...
@josephmenn Joseph Menn on x
While I am seeing a lot of mudslinging, this sums up how many security industry veterans see Mudge Zatko. https://twitter.com/...
@jvanegue Julien Vanegue on x
Imagine how hard it must be for a random whistleblower to raise the flag if even @dotMudge, a former White House, Google, AtStake, l0pht, Twitter security leader is presented as a “disgruntled employee” when doing so https://www.washingtonpost.com/ ...
@dangillmor Dan Gillmor on x
Mudge is the real deal on security, but he's not agreeing with Musk re Twitter in almost any way. (Scroll down in this link.) https://www.bloomberg.com/...
@aristos_revenge @aristos_revenge on x
He's one of the guys who wrote l0phtcrack, one of the most common password crackers ever written. Mudge is hacker royalty, working at places like Stripe, DARPA, and eventually Twitter, just to establish his credentials here. https://twitter.com/...
@chey_cobb Chey e-Cobb on x
I've been listening to Peiter Zatko since the mid-90s. Google some of the people you see sitting with him in a Congressional hearing. I'm sure you'll find some of their hacker handles familiar. Heard of l0pht or cDc? https://www.washingtonpost.com/ ...
@karaswisher Kara Swisher on x
While Mudge allegations do not exactly align the legal arguments that Elon Musk is making against Twitter management, it sure does fuck with the whole trial perceptually at least. For sure @jack⁩ who hired the dude & presided over all needs to talk https://www.washingtonpost.com/…
@austen Austen Allred on x
Absolutely insane of Twitter to confront this controversy by slinging mud at Mudge, who has perhaps one of the most pristine reputations in all of tech for acting ethically, while simultaneously not addressing any of the concerns. Mudge had zero incentive to whistleblow. https://…
@kimzetter Kim Zetter on x
Quote from @sawaba: “[Mudge is] literally the last person you want to hire if you're just looking to improve optics after a breach.” In other words, Twitter had to know it was hiring a straight shooter when they brought him in.
@willoremus Will Oremus on x
In our Twitter Space just now, Twitter whistleblower's lawyer John Tye (@wbaidlaw) tells us definitively that Mudge has *not* been in contact with Musk and there was no coordination between the two. This contradicts what one source had told us.
@techbrodrip @techbrodrip on x
Peiter Zatko aka “Mudge” (hacker + former head of security for Twitter + former head of cybersecurity research at DARPA) with Bill Clinton https://twitter.com/...
@rondeibert @rondeibert on x
For those who don't know @dotMudge, @josephmenn provides a short summary of his career, drawing from his book on the Cult of the Dead Cow 👇 https://www.washingtonpost.com/ ...
@danfinlay Dan Finlay on x
There were signs it was this bad- like that time a support person got hacked and the hacker was able to take over tons of checkmark accounts for bitcoin scams. https://twitter.com/...
@scottnover Scott Nover on x
If it turns out that, yes, Twitter lied about and hid its security failures then it's possible that Musk could say that this once-unknown fact, that wouldn't have turned up even in due diligence, could be materially adverse.
@eanmeyer Ean Meyer on x
Holy. Crap. When Rinki Sethi left something seemed off, but they are talented and in demand so I didn't think much of it. That followed by @dotMudge's damning admonishment after seeing the inside is alarming to say the least. https://twitter.com/...
@b_fung Brian Fung on x
The Twitter whistleblower's bombshell report has big implications for @elonmusk — and it isn't just about bots: The security allegations could constitute a “material adverse effect” giving Musk more leverage to pull out. More from @claresduffy: https://t.co/72FBCS5cJ1
@danprimack Dan Primack on x
When the inevitable streaming series on Elon and Twitter is aired, one episode might just be titled “Mudge.”
@faizsays Faiz Siddiqui on x
But any argument Musk could make depends on outstanding factors: the severity of any breaches, data supporting the claims — and the extent to which he relied on the claims in making the deal, the experts said “It still seems against Musk, an uphill battle” https://www.washingtonp…
Vox Sara Morrison on x
Twitter's whistleblower problem is way bigger than Elon Musk's bot complaints
@donie Donie O'Sullivan on x
NEW: First time Twitter CEO @paraga weighs in on whistleblower story. Sending this message to staff this morning. https://twitter.com/...
@alsutton Al Sutton on x
If you are wondering if the stuff about Twitter security being lapse is just one person complaining, you might be interested to know that, 18 months after being let go from the company, I've not been removed from their employees GitHub commiters group. https://github.com/... http…
@elonmusk Elon Musk on x
[Image of Jiminy Cricket: “Give a little whistle"]
@donie Donie O'Sullivan on x
BREAK A former Twitter executive, its head of security, has turned whistleblower. He alleges grave security problems at the company that he says are a risk to national security and democracy. His first TV interview here: https://www.cnn.com/... https://twitter.com/...
@kimzetter Kim Zetter on x
Twitter says Mudge is “disgruntled employee,” who was fired for poor performance/leadership. But there's probably no security exec with more ethics, more credibility than Mudge. He worked for gov for years, his wife is former NSA. I wrote about them here: https://theintercept.com…
@gerritd Gerrit De Vynck on x
oh, and apparently Twitter almost went down for good in 2021 https://twitter.com/...
@justinhendrix Justin Hendrix on x
The document says the company was so overwhelmed by misinformation in the 2020 election that it relied on internal “volunteers” and was distracted from other threats. https://twitter.com/...
@igb Ian Brown on x
I remember when Mudge had us send Twitter kernel and OS reports to a rando buddy of his in Texas.
@caseynewton Casey Newton on x
Holy shit https://t.co/wGcjgqsLJj https://t.co/TKeNLLnyFK
@benedictevans Benedict Evans on x
It is possible to believe both that Elon Musk's case against Twitter is mostly bullshit, and also believe that Twitter is an extraordinarily badly run and dysfunctional company.
@kimzetter Kim Zetter on x
PSA: When someone contacts you to ask your opinion of the Twitter whistleblower story, you don't have to give an opinion. Especially if you're not a security expert. You also don't have to have an opinion if you don't know enough facts yet. It's okay to just say “I don't know.”
@kimzetter Kim Zetter on x
It was clear when Mudge left Twitter something was wrong. Now he's blowing whistle. Says company doesn't properly delete data, too many staff access central controls/sensitive info; senior execs cover up vulns; some staff may be working for foreign intel https://www.cnn.com/...
@nicoleperlroth Nicole Perlr🌻th on x
When @jack was dividing his time between Twitter and Square, I asked him about the fact security researchers were constantly finding gaps in their security. I never forgot his reply: “Those guys like to whine a lot.” Security is a culture and it requires buy-in from the top. http…
@senatordurbin Senator Dick Durbin on x
The whistleblower's allegations of widespread security failures at Twitter, willful misrepresentations by top executives to government agencies, and penetration of the company by foreign intelligence raise serious concerns. https://twitter.com/...
@nicoleperlroth @nicoleperlroth on x
Maybe @twitter's board made a mistake relying on a CEO who also happened to be CEO of another $100B+ company? Just a thought. https://twitter.com/...
@frankpallone Rep. Frank Pallone on x
As Chairman of @EnergyCommerce, I'm carefully reviewing this whistleblower disclosure and assessing next steps. These allegations are alarming and reaffirm the need to pass my comprehensive privacy legislation to protect Americans' online data. #ADPPA https://twitter.com/...
@robertmlee Robert M. Lee on x
Hey @Twitter while y'all deal with the @dotMudge allegations resorting to a smear campaign against him is a really stupid idea. His character, skills, leadership, etc. are some of the most beloved and well documented in the community. Your response is telling. Focus on the facts.
@riskybusiness Patrick Gray on x
Jesus... can open, worms everywhere. You basically can't find anyone more credible than @dotMudge in infosec so this is a massive deal https://cnn.com/...
@nicoleperlroth @nicoleperlroth on x
By reverting to “disgruntled” and “poor performance,” Twitter PR and @paraga grossly underestimated how well respected @dotmudge is at the highest levels of gov, cybersecurity, etc. Shot themselves in the foot big time. https://twitter.com/...
@justinhendrix Justin Hendrix on x
The Post published docs brought forward by the whistleblower, including a 24 page internal assessment of how the company handles threats including disinformation. It finds the company operates “in a constant state of crisis”. https://twitter.com/...
@b_fung Brian Fung on x
NEW: Twitter execs have tried to conceal enormous security vulnerabilities that put users, investors and even US national security at risk, according to a damning new whistleblower report by the company's former head of security: https://www.cnn.com/...
@hackingdave Dave Kennedy on x
I've followed @dotMudge and have known him for years. He's in my top 5 people that I look up to in this industry and one of the folks who energized me to be where I am today in my career. His credentials/career are second to none. This is concerning if he is raising this.
@kimzetter Kim Zetter on x
“About half of the company's 500,000 servers run on outdated software that does not support basic security features such as encryption for stored data or regular security updates by vendors”
@jkosseff Jeff Kosseff on x
This is very bad, particularly in light of the 2011 FTC agreement. I'm sure that we'll hear more in the next few months. https://twitter.com/... https://twitter.com/...
@kaitlancollins Kaitlan Collins on x
Huge exclusive from @donie & co: Twitter has major security problems that pose a threat to users' personal info, shareholders, national security & democracy, per a whistleblower disclosure alleging one or more employees may be working for a foreign intel. https://www.cnn.com/...
@erratarob Robᵉʳᵗ Graham on x
This statement alone is how you know Mudge is at fault here. “Updated software” is a cybersecurity fetish promoted by Holy Warriors. There's actually no need for such servers to be kept up-to-date. https://twitter.com/...
@migueldeicaza Miguel de Icaza on x
Way worse than originally reported. Read the internal report on security from Mudge and the whistleblower filing, link below. Twitter has the security of a mom and pop bodega. And the new CEO covered it up from the board and regulators. https://www.washingtonpost.com/ ...
@walterkirn Walter Kirn on x
This kind of thing must be assumed now, in all social media environments. https://twitter.com/...
@carnage4life Dare Obasanjo on x
Every big company is actually a dumpster fire behind the scenes but this truly takes the cake. https://twitter.com/...
@erratarob Robᵉʳᵗ Graham on x
🧵I'm reading through the documents. I'm pretty sure that I would take Twitter's side in this dispute. Mudge has some valid concerns here and there, but it's overwhelmed by the infosec attitude of Cybersecurity being some sort of Moral Crusade. https://dy1ywzohuuzsd.cloudfront.net…
@troyhunt Troy Hunt on x
Oh boy: https://twitter.com/...
@ashleevance Ashlee Vance on x
Chef's kiss to this Twitter whistleblower photo in the Post. He's such a good hacker that he's in the matrix https://twitter.com/...
@ahtraelnashar @ahtraelnashar on x
Ranking member of Senate Intelligence Committee @marcorubio statement to me on Twitter whistleblower: https://twitter.com/...
@thezedwards Zach Edwards on x
Interesting process to redact an external audit so that you can't be held accountable to the findings: “Twitter counsel explicitly told Mudge that this was intended to hide the findings and prevent them from becoming known internally or externally” https://twitter.com/...
@cbouzy Christopher Bouzy on x
“The whistleblower also says Twitter executives don't have the resources to fully understand the true number of bots on the platform...” Several times, I went on the record and said the less than 5% number was BS. https://www.cnn.com/... https://twitter.com/...
@litmoose Moose on x
Only two things I will say on this: 1. I believe Mudge. 2. Do. Not. Put. Any. Sensitive. Intel. On. Social. Media. Don't transmit your personal info in DM's, don't discuss work, don't don't dont. <3 https://www.cnn.com/...
@dalitdiva Dalit Diva on x
We need accountability from @Twitter on the issues raised by this whistleblower. @paraga what is your response for millions of Indian users whose data and safety were compromised? https://www.washingtonpost.com/ ...
@karaswisher Kara Swisher on x
Odd thing: most of the best know CISOs and cyber voices i folo have been pretty silent on this.
@senmarkey Ed Markey on x
We can't let Twitter and Big Tech break the rules again and again. Whistleblower allegations that Twitter has repeatedly failed to take basic security measures and misled investors, regulators, and the public demand immediate action. We need accountability now. https://twitter.co…
@jordanschachtel @jordanschachtel on x
Whistleblowers blow the whistle on the government to bring information to the people. They do not report people to the government. Keep this in mind when you see reports about a Facebook or Twitter whistleblower. It's a state-run op to empower the state & steal your rights.
@ewerickson Erick Erickson on x
“Zatko also alleges that Twitter's top executives have misled users, regulators and even the company's own board about the condition of its information security.” https://www.cnn.com/...
@smdiehl Stephen Diehl on x
Honestly, Twitter probably should not exist. I don't see any path towards it ever being either a sustainable business or a net positive in the world. The only saving grace is that it's less malign force than Facebook, which isn't saying much. https://techcrunch.com/...
@kantrowitz Alex Kantrowitz on x
From the Twitter whistleblower doc: “Executives are incentivized to avoid counting spam bots as mDAU, because mDAU is reported to advertisers, and advertisers use it to calculate the effectiveness of ads.” This point does not help Elon Musk at all. It hurts him. https://twitter.c…
@rasmus_kleis Rasmus Kleis Nielsen on x
“A constant state of crisis that does not support the company's broader mission of protecting authentic conversation.” A lot of damning allegations in Twitter whistleblower complaint obtained by @josephmenn @lizzadwoskin @Cat_Zakrzewski (screenshot below) https://www.washingtonpo…
@eff @eff on x
The Twitter whistleblower complaint raises questions about how well the company is managing security and employees' access to production systems handling user data. https://www.washingtonpost.com/ ...
@kennwhite Kenn White on x
That speculation is explicitly contradicted by Mudge's attorney (and founder of the whistleblower foundation) who's on record asserting that the process “began before there was any indication of Musk's involvement with Twitter.” https://www.cnn.com/... https://twitter.com/...
@faizsays Faiz Siddiqui on x
NEW: Former head of security accuses Twitter of “Lying about Bots to Elon Musk,” though he provides little hard evidence of his claim in a whistleblower complaint. 6 legal experts say allegations of misleading shareholders could bolster Musk's case. https://www.washingtonpost.com…
@rupakchatto Rupak Chattopadhyay on x
Incredible story. Sour grapes from #bezos for failing to crack the Indian market?? Of course for most who have grown up in the global south, @washingtonpost has about the same credibility as @engpravda https://twitter.com/...
@gossithedog Kevin Beaumont on x
.@dotMudge has gone in hard on Twitter. https://www.washingtonpost.com/ ...
@meenakandasamy @meenakandasamy on x
These revelations (first Facebook now Twitter) are explosive but the state and ruling party apparatus in Delhi have mastered the art of spectacle to such a degree that any discussion about this will be diverted by some thing else. https://twitter.com/...
@malwarejake Jake Williams on x
#HugOps to anyone on the Twitter security and compliance teams who has to deal with the fallout of this. I stand with Mudge in any case. His allegations are credible and everyone always knew “poor performance” was code for “advocating to do things right.” https://www.cnn.com/...
@b_fung Brian Fung on x
Among its allegations, the disclosure obtained by CNN claims half of Twitter employees, including all engineers, enjoy excessive access to the live Twitter product and user data, and coding/testing happens right in the product rather than in a sandbox: https://www.cnn.com/...
@juanandres_gs J. A. Guerrero-Saade on x
Symptoms of Twitter's security dysfunction are visible from the outside but here they are laid bare by a hacker hero @dotMudge. Foreign agents, unpatched systems, widespread unchecked access, and of course no insensitive to curtail spam, bots, or disinfo. https://www.washingtonpo…
@blackamazon @blackamazon on x
Mind you while folks were laughing and “high powered non profits and “experts” were meeting with Twitter and calling us stupid Twitter it self knew it wasn't meeting the goal AND y'all kept lionizing folks inside for making a. Come up off of ignoring it https://twitter.com/...
@sassycrass @sassycrass on x
Hey, @Twitter @TwitterSupport. Hey. Hey, girl. I first asked y'all to hire me to clean this up for y'all 8 years ago. I would have asked for $85K per annum - ceiling. Meanwhile? Ignoring and disrespecting me and my friends just MIGHT have cost you $44 billion. https://twitter.com…
@migueldeicaza Miguel de Icaza on x
I will take Mudge's word over any executive and board member at twitter. This is a Standard & Poor AAA-graded shitshow. https://twitter.com/...
@hypatiadotca Leigh Honeywell on x
Good morning to west coast folks waking up to the Twitter whistleblower news. Twitter's damage control throws Mudge under the bus real hard. Not sure who _could_ be an effective leader when they only get 50 words out of their boss in 1+ years, though https://twitter.com/...
@cbouzy Christopher Bouzy on x
This message from Twitter's CEO to his staff sounds Trumpian. Wow... https://twitter.com/...
@cat_zakrzewski Cat Zakrzewski on x
More from Congress: Sen. Blumenthal sends a letter to the FTC, calling Lina Khan to investigate the Twitter allegations and bring enforcement actions — including fines https://www.documentcloud.org/ ...
@0xmatt @0xmatt on x
The sole comment I will make on the current drama is that it is possible and rational to have trust & respect for both Mudge (former) AND Lea (current). Lea's credibility and attempts to hire for positive impact are not lessened by Mudge's revelations.
@mmasnick Mike Masnick on x
Not yet sure what to make of all the Mudge disclosures, many of which sound credible. But his whistleblowing report on the whole Musk, Agrawal bit stuff is just as misleading as he claims Agrawal was. Everyone is talking about different things.
@annmlipton @annmlipton on x
This is certainly well timed for Musk, I must say. https://twitter.com/...
@mims Christopher Mims on x
The October Musk/Twitter trial is an event horizon beyond which no prognosticator can see the future https://twitter.com/...
@davepell Dave Pell on x
I want Elon not to own Twitter. I want Twitter run by an adult who thinks they are the best person to run Twitter. Today's whistle blower assertions seem like a step in the right direction.
@cat_zakrzewski Cat Zakrzewski on x
NEW: In an explosive whistleblower complaint, Twitter's former security chief claims the company deceived regulators and its own board about its defenses against hackers and efforts to fight spam. w/ @josephmenn and @lizzadwoskin https://www.washingtonpost.com/ ...
@melissaryan Melissa Ryan on x
Ooof. Justin's Twitter thread has all the highlights and they're not good at all. https://twitter.com/...
@kimzetter Kim Zetter on x
“John Tye, founder of Whistleblower Aid and Zatko's lawyer, told CNN that Zatko has not been in contact with Musk, and said Zatko began the whistleblower process before there was any indication of Musk's involvement with Twitter.”
@jeremiahg Jeremiah Grossman on x
It just became substantially harder for Twitter to recruit top security talent.
@nataliaantonova Natalia Antonova on x
My fellas and fly ladies, this is why I keep telling you that Twitter DMs are not secure. Don't share sensitive info via Twitter DMs. https://twitter.com/...
@jstrauss @jstrauss on x
Now do Experian! https://twitter.com/...
@lizzadwoskin Elizabeth Dwoskin on x
This has big implications for the Musk trial, though ?? how it will play out cause a) the biggest revelations are about security b) the spam section is largely recollections, not docs. Still gonna be massive. https://www.washingtonpost.com/ ...
@thepacketrat Sean Gallagher on x
Deep respect for @dotMudge , and I personally experienced some of the problems with @Twitter's platform security 2 years ago...and honestly, this is what I would have expected. Hard to root for anybody in the Musk/Twitter battle, because both sides are 🗑️ https://www.washingtonpo…
@caseynewton Casey Newton on x
Jack's dereliction of duty here is amazing https://twitter.com/...
@quinnypig Corey Quinn on x
It's unclear to me that Twitter's comms folks adequately thought this cunning plan all the way through. https://twitter.com/...
@hackingdave Dave Kennedy on x
“Mr. Zatko was fired from his senior executive role at Twitter for poor performance and ineffective leadership over six months ago,” the Twitter spokesperson said. ^ total bullshit
@typemrt Maurice Turner on x
Difficult to imagine a long-time hacker going to Congress, DOJ, FTC, & SEC as a whistleblower just for being disgruntled. If @dotMudge is right about Twitter leadership's view of security, then it's going tough to fix. https://twitter.com/...
@clancynewyork Eileen Clancy on x
In information security, Mudge is a living legend. Top engineers, even those who are typically contrarian, respect his brilliance and ethics. This is a big deal. https://twitter.com/...
@mktwgoldstein Steve Goldstein on x
‘By reporting bots only as a percentage of mDAU, rather than as a percentage of the total number of accounts on the platform, Twitter obscures the true scale of fake and spam accounts on the service, a move Zatko alleges is deliberately misleading.’ $TWTR $TSLA https://twitter.co…
@senblumenthal Richard Blumenthal on x
New whistleblower allegations about Twitter's abysmal data security practices are deeply concerning—with serious consumer protection & national security implications. I am urging @FTC to swiftly investigate these claims & bring all appropriate enforcement actions. https://twitter…
@sarahemclaugh Sarah McLaughlin on x
This is extremely worrying. We already know Saudi Arabia bribed a Twitter employee to hand over user info. And now we're learning Twitter may have allowed an Indian government agent direct access to user data during protests. https://www.washingtonpost.com/ ... https://twitter.co…
@munsifv @munsifv on x
Indian govt had forced Twitter to put one of its agents on the payroll with access to user data, alleges ex -security chief. This is from a @washingtonpost report on whistleblower complaint on security lapses at Twitter: https://www.washingtonpost.com/ ... More from the complaint…
@jamesrbuk James Ball on x
“Zatko's complaint says he believed the Indian government had forced Twitter to put one of its agents on the payroll, with access to user data at a time of intense protests in the country.” Bloody *hell*.
@chrdnet @chrdnet on x
“Twitter executives knew that accepting Chinese money risked endangering users in China,” the disclosure says. “Mr. Zatko was told that Twitter was too dependent upon the revenue stream at this point to do anything other than attempt to increase it.” https://www.cnn.com/...
@stanphylcap @stanphylcap on x
Interesting stuff from Matt today re $TWTR, where he points out that the whistleblowing complaint *doesn't* dispute the company's bot figures! There's also good stuff on $AMC - $APE... https://twitter.com/...
@te_taipo @te_taipo on x
Lesson from @Snowden If it can be exploited, intrusion capable nation states will exploit it for their own ends. “Twitter is vulnerable to Russian and Chinese influence, whistleblower says” https://cnn.com/...
@ashoswai Ashok Swain on x
According to the whistleblower, three countries had forced Twitter to hire local full-time employees to use them as leverage - These 3 countries are India, Nigeria, & Russia. What a great company the world's so-called largest democracy has!
@katiebolillis Katie Bo Lillis on x
“The whistleblower report says the US government provided specific evidence to Twitter that at least one of its employees, perhaps more, were working for another government's intelligence service. The report does not say whether Twitter acted on the tip.” https://cnn.com/...
@igorbobic Igor Bobic on x
Durbin on Twitter whistleblower: “If these claims are accurate, they may show dangerous data privacy and security risks for Twitter users around the world. As Chair of the Senate Judiciary Committee, I will continue investigating this issue and take further steps as needed”
@donie Donie O'Sullivan on x
New: Twitter is facing questions from its European regulator in light of whistleblower allegations. The Irish Data Protection Commission (DPC) is seeking information from the company. @DPCIreland oversees Twitter's compliance with European laws as Twitter Euro HQ is in Ireland
@mrbcyber Michael Ron Bowling on x
Twitter in a compromised position with China, and entities connected with the state have significant access to information. https://www.cnn.com/...
@bendobrown Benjamin Strick on x
“Take a tech platform that collects massive amounts of user data, combine it with what appears to be an incredibly weak security infrastructure and infuse it with foreign state actors with an agenda, and you've got a recipe for disaster.” @ChuckGrassley https://twitter.com/...
@audreytruschke Dr. Audrey Truschke on x
Relevant news for everyone on Twitter, esp those critical of India's authoritarian government and human rights violations. India Forced Twitter To Hire a ‘Govt Agent’, Claims Former Security Chief in Whistleblower Complaint https://thewire.in/... #India #Twitter #Modi #BJP
@chrdnet @chrdnet on x
📢 Whistleblower: “[#Twitter] has allegedly accepted funding from unnamed “Chinese entities” who now have access to information that could ultimately unmask people in China who are illegally circumventing government censorship to view and use Twitter”. https://www.cnn.com/...
@edwardmurrow666 Edward Murrow on x
You don't say. What? Twitter has a member of the FSB in upper management? Not a surprise. Whistleblower says Twitter is vulnerable to Russian and Chinese influence - CNN https://www.cnn.com/...
@chrizap Chris Zappone on x
“The fact that Twitter's current CEO even suggested Twitter become complicit with the Putin regime is cause for concern about Twitter's effects on U.S. national security” https://cnn.com/... #UkraineRussia
@ilvestoomas Toomas Hendrik Ilves on x
Now this might go far to explain all those suspensions for innocuous treats about bad Russian behavior. https://www.cnn.com/...
@apar1984 @apar1984 on x
Twitter and the Government of India must release public statements and address these concerning allegations that Twitter hired an agent at the behest of the Indian government and gave the person unfiltered access to user data.
@hsajwanization @hsajwanization on x
This may cost Twitter 😅 https://www.washingtonpost.com/ ...
@zafarhilaly Zafar Hilaly on x
Collusion between Twitter/ CIA (?) and RAW was revealed by the ex Twitter security chief who confessed Twitter allowed RAW to infiltrate Twitter to obtain accounts posting anti India content. RAW, CIA and Moussad are, in fact, one outfit operationally.
@b_fung Brian Fung on x
NEW: A deeper look at the Twitter whistleblower's foreign intelligence allegations, including claims “Chinese entities” have leverage over Twitter due to $$ it's taken from them and info it's provided that could ultimately expose Twitter's users in China: https://t.co/HqNmzr3KD1
@garysocially Gary Panjwani on x
Twitter didn't even agree to appoint a grievance officer in India to comply with local laws (something which other tech giants had agreed to). But I am supposed to believe it allowed an Indian “agent” to work inside Twitter with “full access to user data”? Give me a break... http…
@evacide Eva on x
Some of the highlights of Mudge's complaint include that time Twitter hired and gave sensitive access to a probable Indian government agent and Twitter's disinterest in tracking accurate harassment or spam stats because it would make them look bad. https://www.washingtonpost.com/…
@model3owners Trev Page on x
It's really not looking for Twitter. First they misrepresent the bot count, won't deliver proper disclosure, then beg/sue for Elon to buy them before all this crap hit the fan. It's like they knew it was a mess & wanted an out before they were found out https://www.washingtonpost…
@munsifv @munsifv on x
We confirmed contents of the complaint with the whistleblower's attorney. A Twitter source tells @f_potkin that the allegations about India govt had surfaced previously within Twitter. Our story: https://www.reuters.com/...
@cat_zakrzewski Cat Zakrzewski on x
NEW: Leaders of three Congressional committee say they are reviewing Zatko's disclosures. House leaders say they underscore the need for privacy legislation. My report on the Capitol Hill fallout: https://www.washingtonpost.com/ ...

Chronicles

A profile of Peiter Zatko, aka Mudge, who worked at DARPA, Google, and Stripe before Twitter, and was a member of hacker groups L0pht and Cult of the Dead Cow

Related Coverage

Discussion