Twitter\u2019s former chief information security officer (CISO) leveled a series of serious accusations against his former employer in testimony before U.S. Congress, including allegations that foreign agents from India and China worked for the company, and that Twitter executives mislead the public and regulators on data security.<\/p>\n
\u201cFirst, they don\u2019t know what data they have, where it lives, or where it came from, and so, unsurprisingly, they can\u2019t protect it,\u201d Peiter Zatko told the Senate judiciary committee on Tuesday.<\/a> \u201cThat leads to the second problem: employees need to have too much access to too much data on too many systems.\u201d<\/p>\n He joined the company in November 2020. Twitter says\u00a0he was fired in January<\/a> for \u201cineffective leadership and poor performance.\u201d<\/p>\n Zatko was quoted by SC Media as saying Twitter\u2019s data infrastructure is so decentralized that not even leadership knows all the data the company collects or where it\u2019s stored. When he brought those concerns to Twitter\u2019s leadership, he claimed their incentive structure led them to prioritize \u201cprofits over security.\u201d<\/p>\n The news site The Record quoted him<\/a> saying roughly half of Twitter employees are engineers who have vast practical access to the company\u2019s systems. However, those systems often lack logging capabilities, so it can be hard to track if someone \u2014 such as an agent of a foreign government \u2014 inappropriately accesses information.<\/p>\n Several news agencies noted that Twitter has been\u00a0under a consent decree<\/a> with the U.S. Federal Trade Commission since 2011 because of several data security incidents. As recently as May, Twitter settled a civil complaint<\/a> from the agency accusing the company of violating that order by collecting phone numbers of users for account security purposes, then using them to target advertising. The company agreed to pay a US$150 million fine.<\/p>\n In response to the allegations, Agence France Press and others noted<\/a> that in a statement, Twitter said its hiring process is \u201cindependent of any foreign influence\u201d and access to data is managed through a host of measures, including background checks, access controls, and monitoring and detection systems and processes.<\/p>\n The Reuters news agency noted many of the allegations are uncorroborated and have little documentary support.<\/p>\n Zatko was emphatic. \u201cIt\u2019s not far-fetched to say that an employee at the company could take over the accounts of all of the senators in this room,\u201d he was quoted as saying. \u201cGiven the real harm to users and national security, I determined it was necessary to take on the professional and personal risk to myself and my family of becoming a whistleblower.\u201d<\/p>\n The testimony comes as the U.S. House of Representatives is dealing with a bipartisan federal privacy bill.<\/a><\/p>\n The post Twitter can\u2019t protect users\u2019 data, former CISO alleges<\/a> first appeared on IT World Canada<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" In testimony before the US Senate, Peiter Zatko said the company doesn’t know what d<\/p>\n","protected":false},"author":17,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[361,16],"tags":[391,396,393,275,44],"class_list":["post-28372","post","type-post","status-publish","format-standard","hentry","category-privacy","category-security","tag-di","tag-postmedia","tag-security-strategies","tag-top-story","tag-twitter"],"acf":[],"_links":{"self":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/28372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/comments?post=28372"}],"version-history":[{"count":2,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/28372\/revisions"}],"predecessor-version":[{"id":28442,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/28372\/revisions\/28442"}],"wp:attachment":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/media?parent=28372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/categories?post=28372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/tags?post=28372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}