Featured Article

What we learned when Twitter whistleblower Mudge testified to Congress

Comment

Peiter Zatko testifying to Congress.
Image Credits: Kevin Dietsch (opens in a new window) / Getty Images

A ticking bomb of security vulnerabilities. Covering up security failures. Duping regulators and misleading lawmakers.

These are just some of the allegations when Twitter’s ex-security lead turned whistleblower, Peiter Zatko, testified to the Senate Judiciary Committee on Tuesday, less than a month after the release of his explosive whistleblower complaint filed with federal regulators. Zatko, better known as Mudge, made his first comments since the public release of his complaint.

Twitter did not respond to a request for comment.

These are the key takeaways from Mudge’s testimony to lawmakers and what we learned from Tuesday’s hearing.

FBI warned Twitter it had a Chinese spy on staff

Sen. Chuck Grassley, the ranking member of the Senate Judiciary Committee, said in his opening remarks that the FBI warned Twitter that it may have a Chinese spy on its payroll.

A redacted version of Mudge’s whistleblower complaint released last month said that Twitter received specific information from the U.S. government that “one or more particular company employees were working on behalf of another particular foreign intelligence agency.” The nationality of the foreign intelligence agents were not disclosed at the time.

But Mudge told the panel that the spy was an agent of China’s Ministry of State Security, or MSS, the country’s main intelligence agency. He added that because Twitter engineers — about 4,000 employees — have broad access to company data, a foreign agent hired as an engineer would have access to personal user information and potentially other sensitive company information, such as Twitter’s plans to censor information in a certain region or concede to demands of a government request. But because Twitter did not closely monitor or log employees’ access, according to his complaint, Mudge said it was “very difficult” to identify what specific data was taken by Twitter employees as foreign agents.

The Chinese spy wasn’t the only agent of a foreign government on Twitter’s payroll. Mudge said in his complaint that the Indian government “succeeded in placing agents on the company payroll” who were granted “direct unsupervised access to the company’s systems and user data.” In August, a former Twitter employee was found guilty of spying for the Saudi government and handing over user data of suspected dissidents.

Thousands of attempts to hack into Twitter weekly

A common theme in Mudge’s complaint is that Twitter did not have the visibility to know what data engineers had access to, or what user data or company information they were accessing. But one system that tracked logins for Twitter engineers found that it was registering “thousands” of failed attempts to log in to Twitter’s systems each week, Mudge told members of Congress.

Mudge said in his complaint that the company saw as many as 3,000 failed attempts each day, describing it as a “huge red flag.” Mudge said then-Twitter chief technology officer Parag Agrawal — now chief executive — did not assign anyone to diagnose or fix the issue, the complaint added.

“This fundamental lack of logging inside Twitter is a remnant of being so far behind on their infrastructure, the engineering, and the engineers not being given the ability to put things in place to modernize,” Mudge testified.

What Twitter knows about its users and why spies want it

Given the focus of Twitter’s apparent lax access controls to users’ information, lawmakers asked Mudge what specific kind of data that Twitter collects from its users. Mudge said Twitter does not fully understand the scale of what data it collects.

He said among the data Twitter collects includes: a user’s phone number, the current and past IP addresses that the user is connecting from, current and past email addresses, the person’s approximate location based on IP addresses, and information about the person’s device or browser they are accessing Twitter from, such as the make and model, and user’s language.

Mudge said it was possible that engineers had access to this information and would be an attractive target for foreign intelligence agencies. One of the reasons he cited was that it would be helpful for governments to target particular groups and keep tabs on what Twitter knows about their agents or information operations.

Mudge also warned that Twitter user information could be used for harassment or targeting individuals as part of influence operations in the real world, such as a family member or a colleague, and used as leverage to influence people close to them without their awareness. “It might be used with other data collection,” Mudge told lawmakers, citing previous breaches, including massive thefts of health data and U.S. government personnel files, such as the breach of 22 million records from the U.S. Office of Personnel Management in 2012. Mudge told lawmakers that his own OPM file was stolen in the breach from when he worked for the federal government.

U.S. government agencies let companies “grade their own homework”

Mudge’s complaint and subsequent testimony lands just months after Twitter paid $150 million in a settlement with the Federal Trade Commission for violating its 2011 privacy agreement, after the company used email and phone data for securing their accounts but then used that same information for targeted advertising.

Mudge told lawmakers that while government agencies have a responsibility to enforce the law and that they have the right intent, he accused the FTC of being a “little over its head” by allowing companies to “grade their own homework.” In response to a question by Sen. Richard Blumenthal, Mudge referenced the 2011 privacy agreement and asked, “How [has Twitter] been passing this?”

Speaking of the regulators and their enforcement powers, Mudge told lawmakers: “What I have seen, the tools in the toolbelt are not working.”

Ex-security chief accuses Twitter of cybersecurity mismanagement in an explosive whistleblower complaint

More TechCrunch

The problem is not the media, but the message.

Apple’s ‘Crush’ ad is disgusting

Ever wonder why conversational AI like ChatGPT says “Sorry, I can’t do that” or some other polite refusal? OpenAI is offering a limited look at the reasoning behind its own…

OpenAI offers a peek behind the curtain of its AI’s secret instructions

The federal government agency responsible for granting patents and trademarks is alerting thousands of filers whose private addresses were exposed following a second data spill in as many years. The…

US Patent and Trademark Office confirms another leak of filers’ address data

As part of an investigation into people involved in the pro-independence movement in Catalonia, the Spanish police obtained information from the encrypted services Wire and Proton, which helped the authorities…

Encrypted services Apple, Proton and Wire helped Spanish police identify activist

Match Group, the company that owns several dating apps, including Tinder and Hinge, released its first-quarter earnings report on Tuesday, which shows that Tinder’s paying user base has decreased for…

Match looks to Hinge as Tinder fails

Private social networking is making a comeback. Gratitude Plus, a startup that aims to shift social media in a more positive direction, is expanding its wellness-focused, personal reflections journal to…

Gratitude Plus makes social networking positive, private and personal

With venture totals slipping year-over-year in key markets like the United States, and concern that venture firms themselves are struggling to raise more capital, founders might be worried. After all,…

Can AI help founders fundraise more quickly and easily?

Google has found a way to bring a variation of its clever “Circle to Search” gesture to iPhone users. The new interaction, launched in January, allows Android users to search…

Google brings a variation on ‘Circle to Search’ to iPhone users

A new sculpture going live on Wednesday in the Flatiron South Public Plaza in New York is not your typical artwork. It combines technology, sociology, anthropology and art to let…

Always-on video portal lets people in NYC and Dublin interact in real time

Apple’s iPad event had a lot to like. New iPads with new chips and new sizes, a new Apple Pencil, and even some software updates. If you are a big…

TechCrunch Minute: When did iPads get as expensive as MacBooks?

Autonomous, AI-based players are coming to a gaming experience near you, and a new startup, Altera, is joining the fray to build this new guard of AI agents. The company announced…

Bye-bye bots: Altera’s game-playing AI agents get backing from Eric Schmidt

Google DeepMind has taken the wraps off a new version AlphaFold, their transformative machine learning model that predicts the shape and behavior of proteins. AlphaFold 3 is not only more…

Google DeepMind debuts huge AlphaFold update and free proteomics-as-a-service web app

Uber plans to deliver more perks to Uber One members, like member-exclusive events, in a bid to gain more revenue through subscriptions.  “You will see more member-exclusives coming up where…

Uber promises member exclusives as Uber One passes $1B run-rate

We’ve all seen them. The inspector with a clipboard, walking around a building, ticking off the last time the fire extinguishers were checked, or if all the lights are working.…

Checkfirst raises $1.5M pre-seed to apply AI to remote inspections and audits

Close to a decade ago, brothers Aviv and Matteo Shapira co-founded a company, Replay, that created a video format for 360-degree replays — the sorts of replays that have become…

Controversial drone company Xtend leans into defense with new $40 million round

Usually, when something starts to rot, it gets pitched in the trash. But Joanne Rodriguez wants to turn the concept of rot on its head by growing fungus on trash…

Mycocycle uses mushrooms to upcycle old tires and construction waste

Monzo has raised another £150 million ($190 million), as the challenger bank looks to expand its presence internationally — particularly in the U.S. The new round comes just two months…

UK challenger bank Monzo nabs another $190M as US expansion beckons

iRobot has announced the successor to longtime CEO, Colin Angle. Gary Cohen, who previous held chief executive role at Timex and Qualitor Automotive, will be heading up the company, marking a major…

iRobot names former Timex head Gary Cohen as CEO

Reddit — now a publicly-traded company with more scrutiny on revenue growth — is putting a big focus on boosting its international audience, starting with francophones. In their first-ever earnings…

Reddit tests automatic, whole-site translation into French using LLM-based AI

Mushrooms continue to be a big area for alternative proteins. Canada-based Maia Farms recently raised $1.7 million to develop a blend of mushroom and plant-based protein using biomass fermentation. There’s…

Meati Foods bites into another $100M amid growth to 7,000 retail locations

Cleaning the outside of buildings is a dirty job, and it’s also dangerous. Lucid Bots came on the scene in 2018 with its Sherpa line of drones to clean windows…

Lucid Bots secures $9M for drones to clean more than your windows

High interest rates and financial pressures make it more important than ever for finance teams to have a better handle on their cash flow, and several startups are hoping to…

Israeli startup Panax raises a $10M Series A for its AI-driven cash flow management platform

The European Union has deepened the investigation of Elon Musk-owned social network, X, that it opened back in December under the bloc’s online governance and content moderation rulebook, the Digital Services Act…

EU grills Elon Musk’s X about content moderation and deepfake risks

For the founders of Atlan, a data governance startup, data has always been at the heart of what they do, even before they launched the company. In fact, co-founders Prukalpa…

Atlan scores $105M for its data control plane, as LLMs boost importance of data

It is estimated that about 2 billion people, especially those in lower and middle-income countries, lack access to quality and affordable essential medicines. The situation is exacerbated by low-quality or even killer…

Axmed raises $2M from Founderful to streamline drug supply chains in underserved markets

For decades, the Global Positioning System (GPS) has maintained a de facto monopoly on positioning, navigation and timing, because it’s cheap and already integrated into billions of devices around the…

Xona Space Systems closes $19M Series A to build out ultra-accurate GPS alternative

Bankruptcy lawyers representing customers impacted by the dramatic crash of cryptocurrency exchange FTX 17 months ago say that the vast majority of victims will receive their money back — plus interest. The…

FTX crypto fraud victims to get their money back — plus interest

Google on Wednesday launched its digital wallet in India with local integrations, nearly two years after the app was relaunched as a digital wallet platform in the U.S. As TechCrunch exclusively reported last month,…

Google Wallet is now available in India

Bluesky has launched a new product roadmap for the coming months. The decentralized social network said on Tuesday that it is planning to introduce direct messages, support for videos, improved…

Bluesky to add DMs, video support and in-app custom feed curation

Samsung Medison, a medical device unit of Samsung Electronics that specializes in developing diagnostic imaging devices, said on Wednesday it plans to acquire Sonio, a Paris-based startup that makes AI-powered software…

Samsung Medison to acquire French AI ultrasound startup Sonio for $92.7M