A week before he was fired, a former security guard at Twitter revealed to senators that he had been made aware that the social media business was employing a Chinese intelligence asset.
It was simply one of several security flaws exposed by well-known cybersecurity expert Peiter “Mudge” Zatko.
After a high-profile breach that exposed high-profile accounts, he was employed in November 2020 but sacked only six months later.
Given the security flaws, he said that learning that a Chinese Ministry of State Security operative was working within Twitter did not surprise him.
‘I had been told because the corporate security physical security team had been contacted and told that there was at least one agent of the MSS, which is one of China’s intelligence services, on the payroll inside Twitter,’ he told a hearing of the Senate Judicial Committee.
‘While it was disturbing to hear, I and many others, recognising the state of the environment at Twitter, were really thinking if you are not placing foreign agents inside Twitter – because it’s very difficult to detect them … it is very valuable to a foreign agent to be inside there – as a foreign intelligence company, you’re most likely not doing your job.’
Twitter Inc.’s former security chief Peiter ‘Mudge’ Zatko is sworn in to testify before a Senate Judiciary Committee hearing to discuss allegations from his whistleblower complaint that the social media company misled regulators
His warnings echo similar criticisms of other social media giants, such as Facebook, that they are not doing enough to protect user data.
And he accused executives of ignoring engineers and their concerns in the race to profits ahead of security.
‘They don’t know what data they have, where it lives and where it came from and so, unsurprisingly, they can’t protect it,’ he said.
‘It doesn’t matter who has keys if there are no locks.’
Zatko filed a whistleblower complaint in July with Congress, the Justice Department, the Federal Trade Commission and the Securities and Exchange Commission.
Among his most serious accusations is that Twitter violated the terms of a 2011 FTC settlement by falsely claiming that it had put stronger measures in place to protect the security and privacy of its users.
Senators focused on his claims that foreign agents had worked inside Twitter.
Sen. Chuck Grassley, the ranking Republican on the committee, said the platform had a trove of information that would be useful for adversaries.
‘Because of his disclosures, we’ve learned that personal data from Twitter users was potentially exposed to foreign intelligence agencies,’ he said in his opening statement.
‘For example, his disclosures indicate that India was able to place at least two suspected foreign assets within Twitter.
‘His disclosures also note that the FBI notified Twitter of at least one Chinese agent in the company.’
Twitter disputes Zatko’s claims. It says he was fired for poor performance and that his complaint is ‘riddled with inaccuracies.’