Allegations about data security problems at Twitter are affecting Elon Musk’s legal case to renege on buying the social media platform.
A former Twitter security chief, Peiter “Mudge” Zatko, filed a whistleblower report in July with the Securities and Exchange Commission accusing the microblogging site of letting too many employees have access to the source code and to users’ data while at the same time lacking sufficient plans for a scenario in which multiple servers failed. The complaint alleged, too, that Twitter’s efforts to secure information on many of its servers is insufficient.
Zatko is experienced and well respected in the cybersecurity world. His charges prompted calls from the chairman of the Senate Commerce, Science, and Transportation subcommittee on consumer protection, Sen. Richard Blumenthal (D-CT), for a Federal Trade Commission investigation. Zatko will testify in a Senate committee hearing later this month.
Musk moved to purchase the relatively small but influential social media site earlier this year. He has since reversed course, claiming information from the company that he relied on in deciding to buy Twitter was inaccurate. Specifically, Musk claims that Twitter misrepresented the number of real users on the platform in relation to the number of bot accounts.
Social media platforms, including Twitter, make money from advertising revenues, so the number of real users looking at those ads is critical to assessing the possible profitability of the app.
The billionaire’s lawyers are seeking permission from Chancellor Kathaleen St. Jude McCormick of the Delaware Court of Chancery to let Musk out of the $44 billion deal to buy Twitter. That trial is set to take place over the course of one week beginning Oct. 17. The expedited nature of the proceedings could make it more difficult to introduce the new issues raised by the whistleblower report on the merits of the current legal case, but Musk’s lawyers filed requests to do so and to delay the trial until November. They have also subpoenaed Zatko for a deposition.
Twitter opposes Musk’s efforts to back out of the purchase, and it is moving ahead with the deal as planned. A spokesman for the firm told the Washington Examiner, “We have not breached any of our representations or obligations under the Agreement.” The company also responded to Zatko’s allegations in a public statement, calling them “riddled with inaccuracies.”
A Musk lawyer told Judge McCormick the trial should be delayed by several weeks to allow him to investigate Zatko’s claims about Twitter cybersecurity.
Tulane University law professor Ann Lipton wrote on the Business Law Prof Blog that “Musk’s arguments do not appear to be very strong, though there is the wild card of whether Mudge has identified enough problems to qualify as an MAE,” referring to a material adverse effect, a circumstance that would have a “significant, long-term impact on Twitter’s finances” and might meet the legal standard of letting Musk out of his obligation to buy.
But the internal security decisions Zatko takes issue with relate to trade-offs that might be judgment calls more than legal failings. Brian Bieron of Platform Economy Insights told the Washington Examiner that trade-offs between perfect security and operational efficiency are common at platform companies. “The security teams oversee how hard it is for employees to access and use data or tweak code. The easier it is, the quicker things get done, which is more efficient and productive. The more technical ‘security’ roadblocks in the way of the same thing make things safer but slower.” He continued, “There is no perfect balance.”
Whether Twitter struck the right balance might be a matter to decide during the investigations of the whistleblower’s claims by the SEC, the FTC, and the Department of Justice. Among Zatko’s allegations is that Twitter’s poor security protocols are in violation of a 2011 consent decree with the FTC, a charge that may also nullify Musk’s contract to purchase the company.
In the meantime, Twitter announced it will start testing a feature allowing users to edit tweets up to 30 minutes after the tweet is posted; an internal team will take it for a test drive, and if the company is satisfied, it will offer the edit button to paying subscribers. The feature is one Musk has publicly called for on the platform.
