China, India had agents working for Twitter — whistleblower

Twitter's former security chief told Congress there was "at least one agent" from China's intelligence service on Twitter's payroll and that the company knowingly allowed India to add agents to the company roster as well, potentially giving those nations access to sensitive data about users.

These were some of the troubling revelations from Peiter "Mudge" Zatko, a respected cybersecurity expert and Twitter whistleblower who appeared before the Senate Judiciary Committee on Tuesday to lay out his allegations against the company.

Zatko told lawmakers that the social media platform is plagued by weak cyber defences that make it vulnerable to exploitation by "teenagers, thieves and spies" and put the privacy of its users at risk.

"I am here today because Twitter leadership is misleading the public, lawmakers, regulators and even its own board of directors," Zatko said as he began his sworn testimony.

"They don’t know what data they have, where it lives and where it came from and so, unsurprisingly, they can’t protect it," Zatko said. "It doesn’t matter who has keys if there are no locks."

"Twitter leadership ignored its engineers," he said, in part because "their executive incentives led them to prioritise profit over security."

In a statement, Twitter said its hiring process is "independent of any foreign influence" and access to data is managed through a host of measures, including background checks, access controls, and monitoring and detection systems and processes.

READ MORE: US panel presses Twitter CEO on whistleblower claims

Shareholders approve Musk's buyout 

One issue that didn't come up in the hearing was the question of whether Twitter is accurately counting its active users, an important metric for its advertisers. Tesla CEO Elon Musk, who is trying to get out of a $44 billion deal to buy Twitter, has argued without evidence that many of Twitter’s roughly 238 million daily users are fake or malicious accounts, aka "spam bots."

Even so, "that doesn’t mean that Musk won’t use Zatko’s allegation that Twitter was disinterested in removing bots to try to bolster his argument for walking away from the deal," said Insider Intelligence analyst Jasmine Enberg.

The Delaware judge overseeing the case ruled last week that Musk can include new evidence related to Zatko’s allegations in the high-stakes trial, which is set to start Oct. 17. During the hearing, Musk tweeted a popcorn emoji, often used to suggest that one is sitting back in anticipation of unfolding drama.

Separately on Tuesday, Twitter's shareholders voted overwhelmingly to approve the deal, according to multiple media reports. Shareholders have been voting remotely on the issue for weeks. The vote was largely a formality, particularly given Musk's efforts to nullify the deal, although it does clear a legal hurdle to closing the sale.

Zatko's message echoed one brought to Congress against another social media giant last year. But unlike that Facebook whistleblower, Frances Haugen, Zatko hasn't brought troves of internal documents to back up his claims.

Zatko said he was similarly "surprised and shocked" by an exchange with current Twitter CEO Parag Agrawal about Russia — in which Twitter's current CEO, who was chief technology officer at the time, asked if it would be possible to “punt” content moderation and surveillance to the Russian government, since Twitter doesn't really “have the ability and tools to do things correctly.”

He also accused Agrawal and other executives of "false and misleading statements to users and the Federal Trade Commission (FTC) about the Twitter platform’s security, privacy and integrity."

Zatko was the head of security for the influential platform until he was fired early this year. He filed a whistleblower complaint in July with Congress, the Justice Department, the Federal Trade Commission and the Securities and Exchange Commission. Among his most serious accusations is that Twitter violated the terms of a 2011 FTC settlement by falsely claiming that it had put stronger measures in place to protect the security and privacy of its users.

READ MORE: US judge: Musk can use Twitter whistleblower claims but can't delay lawsuit