Twitter Misled Regulators About Deleting Users’ Data When They Nixed Their Accounts, Ex-Exec Says

A Twitter spokesperson said in an email statement sent to Gizmodo: “Mr. Zatko was fired from his senior executive role at Twitter in January 2022 for ineffective leadership and poor performance. What we’ve seen so far is a false narrative about Twitter and our privacy and data security practices that is riddled with inconsistencies and inaccuracies and lacks important context. Mr. Zatko’s allegations and opportunistic timing appear designed to capture attention and inflict harm on Twitter, its customers and its shareholders. Security and privacy have long been company-wide priorities at Twitter and will continue to be.”

In an email statement sent to Gizmodo, John Tye— the chief disclosure officer of Whistleblower Aid and Zatko’s lawyer, said “Mudge stands by everything in his disclosure, and his career of ethical and effective leadership speaks for itself. The focus should be on the facts laid out in the disclosure, not ad hominem attacks against the whistleblower.”

Of course, these allegations of giving employees access to user data comes soon after the U.S. convicted a former Twitter employee for allegedly working on behalf of Saudi Arabian Crown Prince Mohammed bin Salman. Feds said U.S. citizen Ahmad Abouammo had worked at Twitter and used his access to send user info on Saudi dissidents over to MBS. Abouammo had apparently worked as a media partnership manager to promote the platform to nations North Africa and the Middle East, but apparently even he had access to user data.

Back in 2010, the Federal Trade Commission settled with Twitter over allegations it failed to safeguard user info, and had let hackers infiltrate the platform two times in a row due to a weak password setup. Hackers were able to send fake tweets from accounts as high-profile as then-President Barack Obama. Twitter was barred from misleading users, but Zatko said Twitter had “never been in compliance” with that order, and that it constantly suffers security incidents approximately once per week that are serious enough to require disclosing to the federal government.

Twitter has long struggled to keep on the straight and narrow with how it handles user data. It had to pay the FTC $150 million this past May for giving advertisers access to users’ phone numbers and emails, which Twitter said was not on purpose. The company has been routinely incompetent with personal information. Security researchers noticed that Twitter’s first attempts to allow users to send money to each other could result in them sending out their home address.

And of course, Zatko’s allegations about bots has inflamed Elon Musk and his crusade to end his Twitter buyout deal. So far, Twitter’s lawyers have had the upper hand in proceedings, claiming that Musk’s claims of bot overload were “factually inaccurate.” Now, Musk’s lawyer Alex Spiro told reporters they have “already issued a subpoena to Mr. Zatko, and we found his exit and that of other key employees curious in light of what we have been finding.”

Zatko’s lawyer told CNN that Zakto had not been in contact with Musk and that he had started this process even before Musk first hinted he wanted to buy Twitter earlier this year.