Social Media Technology cybersecurity Privacy Whistleblower Data Security
Avid Halaby
Avid Halaby

@AvidHalaby

17 tweets 21 reads Dec 12, 2022
X
The stuff uncovered in the Twitter whistleblower report is much crazier than anything in the "Twitter files" but it's much less politically/tribally salient so it got no attention. Going to do a thread on some of the craziest things, in no particular order.
Twitter didn't monitor employee computers at all, it was not uncommon for employees to install spyware on work devices
Twitter didn't monitor employee computers at all, it was not uncommon for employees to install spywa...
Twitter does not have separate development, test, staging, and production environments. At least 5,000 employees had privileged access to production systems.
Twitter does not have separate development, test, staging, and production environments. At least 5,0...
Twitter does not have separate development, test, staging, and production environments. At least 5,0...
In 2020, Twitter had security incidents serious enough they had to be reported to the federal government on an almost weekly basis. Meanwhile, Parag Agarwal was lying about how secure Twitter was.
In 2020, Twitter had security incidents serious enough they had to be reported to the federal govern...
On 1/6, Mudge (the whistleblower) wanted to take action to prevent potential sabotage by a rogue employee. He learned it was not possible for Twitter to secure its production environment.
On 1/6, Mudge (the whistleblower) wanted to take action to prevent potential sabotage by a rogue emp...
Mudge realized that a data center failure could potentially cause the permanent loss of all of Twitter's data. He shared this fact with senior leadership, who instructed him not to put it in writing for the Board.
Mudge realized that a data center failure could potentially cause the permanent loss of all of Twitt...
Mudge realized that a data center failure could potentially cause the permanent loss of all of Twitt...
Mudge realized that a data center failure could potentially cause the permanent loss of all of Twitt...
A few months later, that exact eventuality almost came true, and only herculean effort by Twitter engineers prevented "permanent, irreparable failure."
A few months later, that exact eventuality almost came true, and only herculean effort by Twitter en...
A few months later, that exact eventuality almost came true, and only herculean effort by Twitter en...
Twitter had no software development lifecycle, and misled both the FTC and its Board about this fact for a decade.
Twitter had no software development lifecycle, and misled both the FTC and its Board about this fact...
Mudge informed Agrawal that there were thousands of failed login attempts to Twitter's engineering system every day. Agrawal did nothing.
Mudge informed Agrawal that there were thousands of failed login attempts to Twitter's engineering s...
Twitter did not keep backups of employee computers. They used to, but then the system broke, was never fixed, and execs decided this was good because it meant they couldn't comply with regulators.
Twitter did not keep backups of employee computers. They used to, but then the system broke, was nev...
"Every new employee has access to data they do not need to have access to."
"Every new employee has access to data they do not need to have access to." https://t.co/qpafM3l8Ho
Twitter is probably still vulnerable to Log4j to this day, lol.
Twitter is probably still vulnerable to Log4j to this day, lol. https://t.co/Cb6MmQKO80
Twitter does not have licenses for the machine learning models it uses in its most basic products.
Twitter does not have licenses for the machine learning models it uses in its most basic products. h...
Twitter knowingly allowed itself to be infiltrated by, or otherwise a tool of, many governments.
Twitter knowingly allowed itself to be infiltrated by, or otherwise a tool of, many governments. htt...
Twitter knowingly allowed itself to be infiltrated by, or otherwise a tool of, many governments. htt...
After Agrawal became CEO, he wanted to present materially misleading information to the Board, overriding Mudge's objections. Other employees raised similar objections. Ultimately it seems the material was shared anyway, and Mudge described the presentation to the Board as fraud.
After Agrawal became CEO, he wanted to present materially misleading information to the Board, overr...
After Agrawal became CEO, he wanted to present materially misleading information to the Board, overr...
After Agrawal became CEO, he wanted to present materially misleading information to the Board, overr...
Internal review after the meeting confirmed this assessment. Mudge began working on a report to correct the record with the Board. As his report neared completion, he was fired.
Internal review after the meeting confirmed this assessment. Mudge began working on a report to corr...
Internal review after the meeting confirmed this assessment. Mudge began working on a report to corr...
Internal review after the meeting confirmed this assessment. Mudge began working on a report to corr...
That's all I have the energy for tonight, I highly recommend reading the full report. PDF here: s3.documentcloud.org
s3.documentcloud.org

Loading page details...

Categories

Social Media Technology cybersecurity Privacy Whistleblower Data Security

Some tweets missing

Telegram Bot
Unroll threads via Telegram! Send any X link to our bot.
@rattibha_bot

Report this thread