“Mr. Zatko’s allegations of widespread security failures and foreign state actor interference at Twitter raise serious concerns,” said the chair of the Senate Judiciary Committee, Senator Richard J. Durbin (D-Ill), and the committee’s top Republican Senator Charles E. Grassley (R-Iowa) in a joint statement. “If these claims are accurate, they may show dangerous data privacy and security risks for Twitter users worldwide.”
The Washington Post writes that Zatko has already held three meetings on Capitol Hill and a private discussion with Judiciary Committee employees.
According to TechCrunch, European data protection agencies are also investigating Zatko’s allegation. According to the complaint, Twitter would have attempted to deceive EU regulators if they had inquired about the company’s security procedures, just as it did the FTC. Due to the location of Twitter’s EU headquarters, Ireland’s Data Protection Commission, which oversees the implementation of the EU’s General Data Protection Regulation (GDPR), claimed to have “engaged with Twitter” regarding the concerns stated in the whistleblower report.
Meanwhile, France’s data watchdog, CNIL, told TechCrunch that it is “currently investigating” claims made in Zatko’s complaint and that its investigation could result in “an order to comply or a sanction” if Twitter is found to have broken the law. TechCrunch notes that it’s unclear what sanctions Twitter could face in the EU, but GDPR allows fines of up to 4 percent of a company’s global annual turnover depending on the severity of the violation.
Twitter declined to comment to The Washington Post on news of the hearing, and a representative from the company did not immediately respond to The Verge’s request for comment. But in an internal memo sent after the revelations became public, Twitter CEO Parag Agrawal said the claims are “a false narrative that is riddled with inconsistencies and inaccuracies, and presented without important context.”
“Mr. Zatko was fired from his senior executive role at Twitter for poor performance and ineffective leadership over six months ago,” a spokesperson for the company told CNN when the allegations became public. “Mr. Zatko’s allegations and opportunistic timing appear designed to capture attention and inflict harm on Twitter, its customers and its shareholders.”
Zatko, fired by Twitter in January shortly after Agrawal became CEO, makes numerous damning claims about security lapses at the company in the complaint filed with the Securities and Exchange Commission (SEC) last month. In particular, he says the company has violated the agreement it made with the Federal Trade Commission (FTC) to uphold various security safeguards; if broken, it was agreementn in 2009.
The former security chief also alleges that Twitter’s approach to measuring the number of bots on its platform is misleading, which if true would cast down on its claims that less than 5 percent of its monthly users are bots, fake accounts, or spam. This figure has proven key in Twitter’s ongoing legal battle with Elon Musk, after the Tesla CEO attempted to back out of his agreement to buy the social media network over a dispute about the number of bots on its platform.