Former Twitter Head of Security Peiter ‘Mudge’ Zatko Blasts Company in SEC Complaint

The parting between Twitter and former head of security Peiter “Mudge” Zatko in January was apparently not an amicable one, as Zatko filed a complaint with the Securities and Exchange Commission in July accusing his former employer of violating its agreement with the Federal Trade Commission to maintain solid security practices. Joseph Menn, Elizabeth Dwoskin and Cat Zakrzewski of The Washington Post obtained a copy of the complaint from a senior Democratic aide on Capitol Hill. Twitter returned fire rapidly, with CEO Parag Agrawal writing in a note to employees, “There are news reports outlining claims about Twitter’s privacy, security and data protection practices that were made by Mudge Zatko, a former Twitter executive who was terminated in January 2022 for ineffective leadership and poor performance. We are reviewing the redacted claims that have been published, but what we’ve seen so far is a false narrative that is riddled with inconsistencies and inaccuracies and presented without important context.” Agrawal continued, “I know this is frustrating and confusing to read, given Mudge was accountable for many aspects of this work that he is now inaccurately portraying more than six months after his termination … Given the spotlight on Twitter at the moment, we can assume that we will continue to see more headlines in the coming days—this will only make our work harder. I know that all of you take a lot of pride in the work we do together and in the values that guide us. We will pursue all paths to defend our integrity as a company and set the record straight.” A spokesperson for Twitter added, “Mr. Zatko’s allegations and opportunistic timing appear designed to capture attention and inflict harm on Twitter, its customers and its shareholders. Security and privacy have long been companywide priorities at Twitter and will continue to be.” According to the report by The Washington Post, Zatko claimed that he warned colleagues that one-half of Twitter’s servers were running out-of-date and vulnerable software, adding that executives withheld information from the company’s board of directors about the number of breaches and poor protection of user data. Zatko said in his complaint that after Jack Dorsey resigned as Twitter CEO last November, he informed the board that protections for sensitive user data were not as robust as they had been led to believe, leading to his firing by Agrawal. The insurrection at the U.S. Capitol Jan. 6, 2021, was also touched upon in Zatko’s complaint, as he claimed that while internal debate was ongoing over whether to suspend the account of former President Donald Trump, he asked how the platform could secure its production environment in order to prevent hackers or disgruntled engineers from sabotage, and he was told that it couldn’t be done and thousands of employees would still have access. In another disclosure that will likely be closely followed by Elon Musk—who will head to the Delaware Court of Chancery against Twitter Oct. 17 in an attempt to back out of his $44 billion takeover bid for the company due to concerns about bots, fake accounts and spam—Zatko claimed in his complaint that Twitter prioritized user growth over controlling spam and dangled bonuses of up to $10 million to executives for boosting monetizable daily active users on the platform. Ingrid Lunden of TechCrunch reported that the complaint, published by nonprofit Whistleblower Aid, touched on the conflict between Musk and Twitter. The complaint read, as reported by Lunden, “Mudge began preparing these disclosures in early March 2022, well before Mr. Musk expressed any interest in acquiring Twitter, and he has not communicated these disclosures to anyone with a financial interest in Twitter,” although The Washington Post reported that Zatko was allegedly contacted by Musk for a deposition prior to the public release of the complaint. Zatko said in an interview with The Washington Post, “I joined Twitter because it’s a critical resource to the world. All news seems to be either from Twitter or goes to Twitter for the coloring and context and, as such, it not only paints public opinion, it can change governments … I felt ethically bound. This is not a light step to take.” He joined Twitter in the newly created role of head of security in November 2020, after overseeing security at electronic payments platform Stripe—also led by Dorsey—and stints at Google and the Defense Advanced Research and Projects Agency. He spent roughly three decades as a “hacker” before donning a white hat. This January, Twitter revealed that Zatko was no longer with the company and chief information security officer Rinki Sethi would depart soon thereafter, with Agrawal writing in a memo to employees at the time that the moves follow “an assessment of how the organization was being led and the impact on top priority work,” adding that he was limited with how much more he could share due to the “nature of this situation.”