Twitter still has security flaws after Musk takeover, whistleblower says

Twitter’s security issues are far from over.

A new Twitter whistleblower alleges in a lawsuit filed in October that the platform failed to address security issues even after pledging to do so following a major breach in 2020. That year, teenagers hacked into the accounts of politicians, celebrities and other high-profile figures, including former President Barack Obama and tech billionaire Elon Musk to spread a cryptocurrency scam. Twitter has publicly stated in a blog post that it restricted access to its internal systems and tools while it investigated the attack.

The whistleblower, a former Twitter engineer, worries about an internal program that allows employees to tweet under any account. A Twitter employee estimated that around 4,000 employees had access to this program, formerly known as “GodMode”. The existence of the program shows that “Twitter’s public statements to users and investors were false and/or misleading,” the anonymous whistleblower states in the 24-page complaint. The nonprofit law firm Whistleblower Aid filed the complaint with the Federal Trade Commission and the US Department of Justice.

“Our client has reasonable grounds to believe that the evidence contained in this disclosure demonstrates violations of law by Twitter,” the complaint states.

The Washington Post, which interviewed the whistleblower, earlier reported on the allegations. The former Twitter employee, who requested anonymity due to harassment and safety concerns, told the Post that Twitter created the “GodMode” program so workers could tweet for certain advertisers. Twitter engineers renamed the program to “privileged mode” following an internal backlash, the whistleblower told The Post. The whistleblower reportedly told Congress and the FTC that Twitter engineers can still access this program today. Twitter did not respond to a request for comment.

The whistleblower also filed another complaint in September with the FTC and the US Department of Justice, raising similar concerns about the number of employee accesses to Twitter accounts. In that complaint, another Twitter engineer told the whistleblower that they discovered in 2020 that workers could tweet with any account and raised the same concern two years later.

A congressman shared the September and October complaints with CNET.

The latest allegations could prompt further scrutiny from lawmakers and regulators during a chaotic time for Twitter. Before Musk struck a deal to buy Twitter for $44 billion last year, Ex-Twitter Security Chief Peiter “Mudge” Zatko pointed to several security issues within the company, including allegations that employees had too much access to user data. Twitter fired Zatko, who joined the company after the 2020 security breach. In the lawsuit, Zatko accused Twitter of violating an 11-year-old agreement with the FTC. Twitter said Zatko’s allegations were “riddled with inconsistencies and inaccuracies and lacked significant context.” Whistleblower Aid also represents Zatko.

After Musk’s takeover, the company halved its workforce, disbanded its trust and safety board, and made other drastic changes that raised questions about Twitter’s ability to handle security issues and challenges. content moderation issues. Twitter users have also complained that an additional level of account security known as two-factor authentication doesn’t work properly.

The FTC declined to comment on the latest whistleblower complaint. The whistleblower also met with the Senate Judiciary Committee and the House Energy and Commerce Committee, The Post reported.

On Wednesday, Rep. Jan Schakowsky, a Democrat from Illinois, said in a statement that the latest whistleblower allegations “underscore that tech companies routinely fail to protect the security and privacy of consumer data.” She urged Congress and regulators to pass legislation to help protect consumer data.

“I am particularly concerned about Twitter user data, as well as the potential impact of the debts Elon Musk owes to foreign powers,” she said in the statement. “Musk’s leadership has been tumultuous.”

Kyle Gardiner, associate attorney for Whistleblower Aid, said in a statement that whistleblowers play a “vital role in exposing what big tech companies have managed to hide from the public and regulators for too long.”

“As these whistleblowers become more numerous and impactful, we hope big tech companies recognize that transparency and accountability is a better way to operate than breaking the law and putting their users at risk,” he said. said Gardiner.