New York (CNN Business). Nearly 25 years ago, Peiter “Mudge”, a young computer programmer, told Congress that the internet was insecure. Zatko explained to a Senate panel that a large part of the problem was that software and ecommerce companies “want problems to be ignored as long as possible.” It’s cheaper for them. Now Zatko is once more raising alarm about online vulnerabilities. But this time, he is focusing his attention on one of his former employers. Ex-Twitter executive claims reckless and negligent cybersecurity policies. In a nearly 200-page disclosure, which was exclusively reported on Tuesday by CNN and Washington Post, the ex-Twitter security executive claimed that the company had engaged in a series security missteps that he claims have misled shareholders, the public, and the Twitter board. Zatko’s disclosure claims that Twitter trusted too many employees with sensitive user data, creating an insecure security situation that could be exploited by outsiders to cause havoc on the platform. It claims that one or more Twitter employees may be working for an intelligence service abroad. Additionally, Parag Agrawal, the CEO of Twitter, misled the company’s board of directors by discouraging Zatko to give a complete account of Twitter’s security flaws. Twitter has denied the allegations and stated that privacy and security have been “long top company priorities.” The company stated that they have not received any specific allegations. However, they said that what they have seen so far is a narrative regarding our privacy and data security practices, which is riddled inconsistencies, inaccuracies, as well as lacking important context. Read MoreZatko’s decision to make his concerns public could lead to him being subject to renewed regulatory scrutiny of Twitter. This is similar to what happened with Frances Haugen’s whistleblower on Facebook. He is being represented by Whistleblower Aid (the same group that represented Haugen). Zatko could also be involved in the massive legal battle between the company, billionaire Elon Musk and Zatko. Musk is trying to end a $44 million deal to buy Twitter. (Musk’s lawyer claimed that Zatko was already being subpoenaed by Musk’s legal team in the dispute with Twitter. Many who have worked with Zatko for the past three decades see him as a principled technologist with a knack of making complex problems accessible and a genuine desire to solve them. This is what he has done for most of his career working in the public and private sectors. They say that the decision to whistle blow is in line with this approach. Mudge testified before Senate Governmental Affairs on May 19, 1998, about government computer security. “He’s not doing it for fun. It doesn’t make him anything,” said Dave Aitel (a former computer scientist at National Security Agency and colleague at @stake cybersecurity consulting firm). “That’s what integrity looks like up close. Zatko could be eligible for a monetary award as a result of his whistleblower activity. The SEC stated that whistleblowers can receive a 30% reduction in agency fines if they provide “original, timely, and credible information that leads directly to a successful enforcement activity”. Since 2012, the SEC has given more than $1 million to nearly 300 whistleblowers. John Tye, founder and lawyer of Whistleblower Aid, stated that Zatko disclosed his information to the SEC in order to help the agency enforce the laws and to obtain federal whistleblower protections. “The possibility of a reward wasn’t a factor in Zatko’s decision. In fact, he didn’t know about the reward program at all when he decided to become lawful whistleblower.” Zatko, now 51 years old, was a leader in cybersecurity grantmaking at the Pentagon. He also worked in a Google division to develop cutting-edge technology. He also advised US lawmakers on how to fix security holes in the internet. Zatko was born in Alabama to a father who was a professor of chemistry at the University of Alabama in Tuscaloosa. He told CNN that he started tinkering around with technology, such as early Apple computers, when he was young. His career has shown that hacking was not just about one-upmanship. There was a social benefit and impact that hackers could have, according to Dug Song, chief strategist at Cisco Security. Dug Song has known Zatko since 1990. In November 2020, Twitter hired Zatko to strengthen cybersecurity and privacy at the company. This was in response to a high-profile hack that was allegedly carried out by a Florida teenager in July 2020. The hack compromised the accounts of some of the most prominent people on the planet, including Joe Biden, then-presidential candidate. According to the disclosure, Zatko was a senior executive and reported directly to Jack Dorsey at the time. CNN’s Zatko stated that this was not the first choice. “This wasn’t the path I wanted to follow. I exhausted all options internally. According to the disclosure, Zatko was fired by Agrawal, Dorsey’s successor as Twitter chief after he raised concerns over the company’s security- and privacy practices. (Twitter maintains that Zatko was fired for poor performance. “This is something that everyone should care about with large corporations, which is honesty and the truthfulness the data that’s… publicly represented, and the national security implications and whether or not users can trust their data with them,” Zatko stated to CNN about his decision to file a disclosure with Congress and regulators regarding Twitter’s alleged security practice. A long history of pushing to fix things Before he cut his hair and donned a suit, Zatko joined the Boston hacking group known as L0pht in the mid-1990s according to Joseph Menn’s book “The Cult of the Dead Cow,” which details how the early hacking scene shaped the cybersecurity sector. L0pht members broke into computers and worked with companies that made the equipment. It is now a common practice for companies to collaborate with outside researchers to fix software bugs. However, this was perceived as provocative and disturbing by software giants at that time. Song said that the Twitter whistleblower could have implications for Elon Musk’s takeover deal. Tatko “sorta bent the industry to his will.” “L0pht set a precedent for how to do it in a respectable and honorable manner. In 1998, Zatko and other L0pht members testified before Congress. Zatko stated to senators that the internet is not the best place for computer security. You are wrong if you think the government is providing you with the technology to solve this problem. Cris “Space Rogue”, another ex-member of L0pht, testified with Zatko that day. He said that L0pht would do all it could to get companies to work together to fix the software problems that the hacker group discovered. Thomas, who uses his hacker name of “Space Rogue” professionally like Zatko said that they had “divided in the past,” adding to the fact that he was fired in 2000 from @stake, the cybersecurity consulting where Zatko was chief science officer. “Feelings were hurt but that doesn’t change the fact that Zatko is who he is, what he believes in, and what he does. So, I believe that his moral standards have not changed in the 30 years I’ve known him. He said that this was normal for Zatko regarding the whistleblower complaint. This is normal for L0pht. This is the normal way we used to do it. Peiter Zatko is widely known as his hacker name Mudge. He can be seen in this undated U.S. government photo. He worked for DARPA, the Pentagon’s R&D arm. In 2010, Zatko joined the Defense Advanced Research Projects Agency, the Pentagon’s R&D arm. This was the first step in the creation of the internet as we know. He led a program that quickly got money to cybersecurity researchers interested finding and fixing vulnerabilities in computers found in cars and other critical infrastructure. Song claims that Zatko called Song and other hackers to Booz Allen Hamilton’s Virginia office for a brainstorming session after he started at DARPA in 2010. Song stated that Hobbit, a hacker who Zatko invited to the meeting, slept in a van outside and attended the meeting naked. Song was impressed by the ability to gather the misfits as well as the military. Song said that Zatko was at the core of hacker spirit. This is something that not many people who have transitioned from our side to commercial or public service have been capable of without being cheesy [or] corny. Zatko explained that he joined Twitter because he believed in the public good. He tweeted that he believed in the mission of (equitably), serving the public conversation. “I will try my best!” As he takes to Twitter, Zatko could find himself in public conversation like never before. CNN interviewed him to say that this was not his first choice. “This wasn’t the path I wanted to follow. I exhausted all options internally. “But I discovered that ethically and with who and what I am, I was obligated by law to follow the law, pursue legal avenues, and disclose, because Twitter is a critically important platform.” Zatko stated. “I believe it’s important that we address some of these issues. I truly believe that I am still fulfilling the mission I was given. This report was contributed by Clare Duffy, Brian Fung, and Donie O’Sullivan of CNN.
World News1 year ago
World News1 year ago
World News1 year ago
World News1 year ago
World News1 year ago