Twitter misled federal regulators about its defenses against hackers and spam accounts, the social media company's former security chief Peiter Zatko said in a whistleblower complaint.
In an 84-page complaint, Zatko, a famed hacker widely known as "Mudge," alleged Twitter falsely claimed it had a solid security plan, according to documents relayed by congressional investigators.
The document alleges Twitter prioritized user growth over reducing spam, with executives eligible to win individual bonuses of as much as US$10 million (S$14 million) tied to increases in daily users, and nothing explicitly for cutting spam.
Twitter labelled the complaint a "false narrative."
The social media company has been battling Elon Musk in court after the world's richest person attempted to pull out of a US$44-billion deal to buy Twitter.
Musk has said it failed to provide details about the prevalence of bot and spam accounts.
Tesla Inc Chief Executive Musk had offered to buy Twitter for US$54.20 per share, saying he believed it could be a global platform for free speech.
Twitter and Musk have sued each other, with Twitter asking a judge on the Delaware Court of Chancery to order Musk to close the deal. A trial is scheduled for October 17.
Zatko filed the complaint last month with the US Securities and Exchange Commission and the Department of Justice, as well as the Federal Trade Commission (FTC).
The complaint was also sent to congressional committees.
"We are reviewing the redacted claims that have been published but what we have seen so far is a false narrative that is riddled with inconsistencies and inaccuracies," Twitter Chief Executive Parag Agrawal told employees in a memo.
The Senate Judiciary Committee's top Republican, Chuck Grassley, said the complaint raised serious national security concerns and privacy issues and needed to be investigated.
"Take a tech platform that collects massive amounts of user data, combine it with what appears to be an incredibly weak security infrastructure, and infuse it with foreign state actors with an agenda, and you’ve got a recipe for disaster," he said.
The FTC declined to comment. A spokesperson for the Senate Intelligence Committee said it had received the complaint and was setting up a meeting to discuss the allegation.
Twitter's real regulatory risk lies in whether the documentary evidence shows the "knowing or reckless misleading" of investors or regulators, said Howard Fischer, a partner at Moses & Singer and a former SEC attorney.
Musk reacts with memes
Musk could not be reached for comment but reacted on Twitter with memes and emoji of a robot. Musk's legal team has subpoenaed Zatko, CNN reported after the whistleblower disclosure was made public.
American hackers have admired Zatko since the 1990s, when he was credited with inventing a tool to crack passwords. He later used his hacking chops to become a sought-after security consultant and with other rebellious techies of the era, transitioned to top government and boardroom positions.
The whistleblower document says that after the January 6 riots, the incoming Biden administration offered him "a day-one appointed position as Chief Information Security Officer for the United States," which he turned down.
Cybersecurity leaders expressed widespread support for Zatko, and many deplored Twitter's reaction to his revelations.
Robert Lee, the founder of industrial cybersecurity company Dragos, said it was "one of the very rare times based on who it is I don't even need to know a detail to form an opinion," he said on Twitter. "If Mudge is making this type of claim, it deserves the investigation."
In January, Twitter said Zatko was no longer its head of security, two years after his appointment to the role.
On Tuesday, a Twitter spokesperson said Zatko was fired for "ineffective leadership and poor performance," adding his allegations appeared designed to capture attention and inflict harm on Twitter, its customers and its shareholders.
Debra Katz and Alexis Ronickher, attorneys for Zatko, said in a statement that throughout his tenure at Twitter, he repeatedly raised concerns about inadequate information security systems to the company's executive committee, CEO and board.
Twitter did not respond to a request for comment on that statement.
