Twitter whistleblower alleges execs misled board and public on spam, security

A Twitter whistleblower is alleging “extreme, egregious deficiencies by Twitter” related to privacy, security and content moderation, according to complaints filed with with the Securities and Exchange Commission, Federal Trade Commission and Department of Justice and published by The Washington Post.

The complaints were filed by nonprofit law firm Whistleblower Aid, which is representing Twitter’s former head of security Peiter “Mudge” Zatko. Whistleblower Aid verified the authenticity of the documents with CNBC.

Shares of Twitter are down about 3.5% in premarket trading.

In a complaint with the SEC, Zatko alleges that he “witnessed senior executive engaging in deceitful and/or misleading communications affecting Board members, users and shareholders” on multiple occasions in 2021, during which CEO Parag Agrawal asked Zatko to provide false and misleading documents.

The document mentions misrepresentations by Twitter to Elon Musk, who is locked in a legal battle seeking to back out of a deal to purchase the social media company, over the Tesla CEO’s “doubts on the accuracy of Twitter’s claim in legal findings that <5% of accounts are ‘bots,’ or automated spam accounts.”

A lawyer representing Zatko said the former Twitter employee has had no contact with Elon Musk, who in July said he was withdrawing his $44 billion bid to acquire the company.

“We have already issued a subpoena for Mr. Zatko, and we found his exit and that of other key employees curious in light of what we have been finding,” Musk attorney Alex Spiro of Quinn Emanuel told CNBC.

Musk and Twitter will meet in court in October where Delaware Court of Chancery Chancellor Kathaleen McCormick will determine if Musk is still on the hook to acquire the company.

Zatko alleges that a tweet by CEO Agrawal on May 16, which said the company is “strongly incentivized to detect and remove as much spam as we possibly can, every single day” was “a lie.” He said Twitter executives are not incentivized to detect bots and “senior management had no appetite to properly measure the prevalence of bot accounts” because “if accurate measurements ever became public, it would harm the image and valuation of the company.”

Zatko further alleged that the company didn’t have proper security controls in place. According to The Washington Post, about 7,000 Twitter employees had “wide access to the company’s internal software and that access was not closely monitored.”

Twitter in a statement said Zatko was fired in January “for ineffective leadership and poor performance.”

“What we’ve seen so far is a false narrative about Twitter and our privacy and data security practices that is riddled with inconsistencies and inaccuracies and lacks important context,” a Twitter spokesperson told CNBC. “Mr. Zatko’s allegations and opportunistic timing appear designed to capture attention and inflict harm on Twitter, its customers and its shareholders. Security and privacy have long been company-wide priorities at Twitter and will continue to be.”

Read more from the Washington Post.