Twitter whistleblower summoned to Senate Judiciary Committee
- Reference: 1661433487
- News link: https://www.theregister.co.uk/2022/08/25/twitter_whistleblower_summoned_to_senate/
- Source link:
Twitter has denied the allegations.
The Senate Judiciary Committee naturally took to the microblogging website to announce his subpoena.
The hearing will feature testimony by Peiter “Mudge” Zatko, who will appear pursuant to a subpoena and whose recent disclosure alleges serious privacy and security failures by the company. — Senate Judiciary Committee (@JudiciaryDems) [1]August 24, 2022
Staffers with Senator Richard Blumenthal [2]reportedly met with Zatko this week. The complaints were also discussed with non-specified staff and ranking members of the Senate Judiciary Committee, the House Energy and Commerce Committee, and the Senate Intelligence Committee, a spokesperson for Zatko told Reuters.
Zatko's 84 pages of disclosures [full [3]PDF here , obtained by the Washington Post] include a treasure trove of alleged fraud, violations of financial rules, and security gross negligence.
[4]
Within the pages is an assertion that the microblogging site failed to comply with its 2011 FTC Consent Order, that more than half of the company's 500,000 datacenters are running non-compliant kernels or operating systems, and that roughly a third of employees have unsecured devices.
[5]
[6]
Some staff allegedly have access to personal user data, and others have purposefully installed foreign spyware. Furthermore, growth was allegedly encouraged over reducing spam to keep Monetizable Daily Active User numbers up.
[7]UK's largest water company investigates datacenters' use as drought hits
[8]Amazon has repackaged surveillance capitalism as reality TV
[9]Japan reverses course on post-Fukushima nuclear ban
[10]PanWriter: Cross-platform writing tool runs on anything and outputs to anything
[11]Python tops programming love list – but if you want a job, learn SQL
Interest has been piqued outside the US too, particularly as the disclosures allege European regulators were purposefully misled. Zatko expressed the belief that Twitter misled the Ireland Data Protection Commission (DPC) and France's similar org, CNIL, regarding datasets for training machine learning algorithms.
The well-known whistleblower also alleged Twitter misled CNIL regarding how it was deploying and using cookies, while using them for both ad tracking and security, in violation of international data requirements in some jurisdictions. Furthermore, Zatko also accused Twitter of delaying a fix for the entanglement of cookies, despite having a ready solution, in order to extract as much profit as possible.
In response, data protection authorities in Ireland and France have reportedly said they will investigate or take action on the allegations – the DPC by " [12]meeting " with Twitter and [13]CNIL by "investigating the complaint."
[14]
Twitter claimed the complaint presented a "false narrative about Twitter and our privacy and data security practices that is riddled with inconsistencies and inaccuracies and lacks important context," and [15]told The Register Zatko was fired from his role at Twitter in January 2022 for "ineffective leadership and poor performance."
Zatko's assertion comes at a convenient time for Elon Musk, who faces legal battles with the company after he backed out of a deal to purchase it. Musk responded to the information predictably, by vague-tweeting about it. ®
[16]pic.twitter.com/KsWiazActx — Elon Musk (@elonmusk) [17]August 23, 2022
Get our [18]Tech Resources
[1] https://twitter.com/JudiciaryDems/status/1562541631483842566?ref_src=twsrc%5Etfw
[2] https://www.reuters.com/technology/twitter-whistleblower-met-us-senate-staffers-this-week-sources-2022-08-24/
[3] https://www.washingtonpost.com/technology/interactive/2022/twitter-whistleblower-sec-spam/?document=undefined
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YwecpLGzo0k2w6H68s0eiwAAAIw&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YwecpLGzo0k2w6H68s0eiwAAAIw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YwecpLGzo0k2w6H68s0eiwAAAIw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/08/24/thames_water_datacenter_water/
[8] https://www.theregister.com/2022/08/24/amazon_ring_surveillance/
[9] https://www.theregister.com/2022/08/24/japan_reverses_course_on_postfukushima/
[10] https://www.theregister.com/2022/08/24/panwriter/
[11] https://www.theregister.com/2022/08/24/ieee_python_language/
[12] https://www.irishtimes.com/technology/data-security/2022/08/23/twitter-accused-of-misrepresentations-to-irish-data-protection-commission/
[13] https://www.lefigaro.fr/secteur/high-tech/accusations-de-fraude-chez-twitter-la-cnil-s-empare-du-dossier-20220824
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YwecpLGzo0k2w6H68s0eiwAAAIw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2022/08/23/twitter_security_whisterblower/
[16] https://t.co/KsWiazActx
[17] https://twitter.com/elonmusk/status/1562105413977493504?ref_src=twsrc%5Etfw
[18] https://whitepapers.theregister.com/
Re: "a false narrative"
It is possible the Twitter is being honest and accurate. Re-read the quote but with the assumption that the security and privacy situation is far worse than Zatko describes:
Twitter claimed the complaint presented a "false narrative about Twitter and our privacy and data security practices that is riddled with inconsistencies and inaccuracies and lacks important context,"
500,000 datacenters is a lot.
To convenient
No fan of either twitter or musk, but the timing of this sounds far to convenient for musk
Re: To convenient
This all dates back to 2020 when Twitter got hacked and big accounts (like Musk's) were used to spam support for crypto scams. The aftermath was that Twitter's deal with the FTC included hiring Zatko to tighten security. Zatko got ignored and fired. He started blowing his whistle in January, long before Musk started buying lots of Twitter shares. It has just taken this long for the complaint to work its way through the legal system.
If Musk had put a tiny bit of effort into finding an excuse not to buy Twitter then this would have been front and centre and not the rubbish about Twitter failing to provide the data needed to count 'bots.
ICO
Does the US not have an equivalent to the ICO (the UK Information Commissioner's Office) to examine data and consumer protection matters?
It feels weird asking someone to come and talk to elected politicians; this is surely an executive matter not a legislative one?
Re: ICO
In the US, almost everything is a "legislative matter". They can investigate and hold hearings on most any topic they desire. They might not have not have any actual effect, but not much stops them. Besides, each event is a chance to be on the national news. As they say, the most dangerous place in Washington is between a Congressman and a microphone.
Re: ICO
Hypothetically speaking :
It might be in the interest to some powerfull people that Twitter could easilly be read/manipulated.
If such were the case and Zatko indeed has proof of what's going on there will be a lot of delicate situations that would hypothetically require immediate attention....
Judging by the immediancy of the preceding I would surmize that Zatko does indeed have proof and that it will be very difficult to dicredit whatever he has.. This affair will undoubetdly lead to a thick black cloud over Twitters head concernign the Musk case.
Heads are going to roll at Twitter in a very short period of time, they will have to sever the dragons head in order to save its tail...
Re: ICO
ROFL if the USA had an ICO their job would be to give all your information to Facebook, Twitter, et al no questions asked!
Mudge has been there before
Mudge has appeared before congress before... In 1998. Interesting watch if you haven't seen it.
https://www.youtube.com/watch?v=VVJldn_MmMY
Re: Mudge has been there before
I agree, that was very interesting, especially since everyone behaved like adults... something we don't see much of these days...
Zatko doesn't come accross as some kind of outsider; the entire team appeared to be very well educated and very clear about what they are doing... They could have chosen the Dark Side but didn't, that alone is a very powerful statement.
> Zatko also accused Twitter of delaying a fix for the entanglement of cookies, despite having a ready solution, in order to extract as much profit as possible.
So he accused them of being a company?
They are all able to stop using tracking cookies but they won't because they might not make as much money so you need to force them. Not by fining them 5 minutes of turnover, try imprisoning some CEOs, CIOs, CTOs and CSOs for a month and see how fast they fix their cookies.
Corrections in line
"false narrative about Twitter , and our privacy and data security practices that is are riddled with inconsistencies and inaccuracies and lack s important context," and told The Register Zatko was fired from his role at Twitter in January 2022 for "ineffective leadership and poor performance."
Perhaps the last is simply that his poor performance was an inability to toe the corporate line, and the ineffective leadership was an inability to keep his underlings on the same line.
"a false narrative"
Hey look, fake news is back !
But with a suit this time, because Trump ain't there any more.