Twitter’s foreign intel problem – CNN

Amongst its accusations, the whistleblower disclosure claims the US authorities offered particular proof to Twitter shortly earlier than Zatko’s firing that not less than one in all its staff, maybe extra, have been working for an additional authorities’s intelligence service. The disclosure doesn’t say whether or not Twitter acted on the US authorities tip or whether or not the tip was credible.

Twitter’s alleged flaws might doubtlessly open the door to all three potentialities.

In response to the disclosure, the Senate Intelligence Committee’s high Republican, Marco Rubio, vowed to look additional into the allegations.

“Twitter has a protracted monitor file of constructing actually unhealthy selections on all the things from censorship to safety practices. That is an enormous concern given the corporate’s capacity to affect the nationwide discourse and international occasions,” Rubio stated. “We’re treating the criticism with the seriousness it deserves and sit up for studying extra.”

Within the months earlier than Russia invaded Ukraine, Agrawal — then Twitter’s chief know-how officer — appeared ready to make vital concessions to the Kremlin, in response to Zatko’s disclosure.

Agrawal’s suggestion was framed as a option to develop customers in Russia, the disclosure says, and whereas the concept was in the end discarded, Zatko nonetheless noticed it as an alarming signal of how far Twitter was keen to go in pursuit of progress, in response to the disclosure.

“The truth that Twitter’s present CEO even recommended Twitter turn into complicit with the Putin regime is trigger for concern about Twitter’s results on U.S. nationwide safety,” Zatko’s disclosure says.

Twitter can be in a compromised place in China, the disclosure to Congress claims. The corporate has allegedly accepted funding from unnamed “Chinese language entities” who now have entry to info that would in the end unmask individuals in China who’re illegally circumventing authorities censorship to view and use Twitter.

“Twitter executives knew that accepting Chinese language cash risked endangering customers in China,” the disclosure says. “Mr. Zatko was instructed that Twitter was too dependent upon the income stream at this level to do something aside from try to extend it.”

That safety breach, first uncovered in 2019, underscores the gravity of Zatko’s allegations, which describe Twitter as an especially porous group with alarmingly lax cybersecurity controls in comparison with its company friends. To be able to do their jobs, roughly half of Twitter staff have extreme permissions granting entry to dwell consumer knowledge and the lively Twitter product, in response to the disclosure, a observe Zatko says is a major departure from the requirements of different main tech firms the place entry is tightly managed and staff largely work in particular sandboxes remoted from the consumer-facing product. “Each engineer” on the firm, Zatko alleges, “has a full copy of Twitter’s proprietary supply code on their laptop computer.”

Twitter has instructed SME its dealing with of supply code doesn’t fall outdoors of business practices, and that Twitter’s engineering and product groups are approved to entry the corporate’s dwell platform if they’ve a selected enterprise justification for doing so.

The corporate additionally stated it makes use of automated checks to make sure laptops working outdated software program can’t entry the manufacturing atmosphere, and that staff might solely make adjustments to Twitter’s dwell product after the code meets sure record-keeping and evaluation necessities.

The disclosure alleges Twitter has bother lowering its cybersecurity dangers as a result of it may possibly’t management, and infrequently would not know, what staff could also be doing on their work computer systems. Information Zatko disclosed from Twitter’s inner cybersecurity dashboards reveals that 4 in 10 worker units — representing 1000’s of laptops — wouldn’t have primary protections enabled, comparable to firewalls and automated software program updates. Staff are additionally in a position to set up third-party software program on their computer systems with few technical restrictions, the disclosure says, which on a number of events has allegedly resulted in staff putting in unauthorized spy ware on their units on the behest of outdoor organizations.

In its responses to SME, Twitter stated staff use units overseen by different IT and safety groups with the facility to stop a tool from connecting to delicate inner techniques whether it is working outdated software program.

Twitter has inner safety instruments which are examined by the corporate usually, and each two years by exterior auditors, in response to an individual conversant in Zatko’s tenure on the firm. The individual added that a few of Zatko’s statistics surrounding system safety lacked credibility and have been derived by a small crew that didn’t correctly account for Twitter’s present safety procedures.

Undue entry and restricted oversight of worker conduct creates alternatives for insider threats such because the Saudi operative, however the Saudi authorities wasn’t the one one to hunt higher entry to Twitter’s inner techniques, Zatko alleges.

The Indian authorities has efficiently “compelled” Twitter to rent brokers engaged on its behalf, the disclosure says, “who (due to Twitter’s primary architectural flaws) would have entry to huge quantities of Twitter delicate knowledge.” Twitter has withheld that truth from its public transparency stories, the disclosure provides.

Many tech platforms are international enterprises, and in some instances, as with Russia’s try to power tech firms to open native headquarters, their staff can turn into unwitting factors of leverage for governments eager to exert strain on the businesses. Company and consumer knowledge saved on, or accessible by, worker computer systems could be susceptible to being accessed or seized by native authorities. The workers themselves, or their households, could also be susceptible to being threatened or coerced.

However Twitter’s distinctive cybersecurity vulnerabilities has meant that its native workplaces have turn into notably delicate targets, Zatko alleges. India, Nigeria and Russia have all “sought, with various success, to power Twitter to rent native [full-time employees] that could possibly be used as leverage,” the disclosure says.

Twitter’s enterprise practices do not simply undermine the US’ pursuits however these of all democratic nations, the disclosure alleges, citing the corporate’s dealing with of a Nigerian authorities choice to dam Twitter for months final yr over a presidential tweet that was extensively interpreted as a risk towards some Nigerian residents and subsequently eliminated by Twitter.

Regardless of Twitter’s claims to have been in negotiations with Nigeria after it suspended the corporate, these talks by no means really occurred, Zatko alleges. Twitter’s alleged misrepresentations about participating the Nigerian authorities not solely harmed the corporate’s traders, the disclosure says, but it surely additionally gave Nigerian officers cowl to demand far higher concessions from Twitter than the corporate in any other case would have given.

The concessions, in response to Zatko’s disclosure, have “harmed free expression rights and democratic accountability for Nigerian residents.”