He seems to have tried to escalate things to people above Agrawal nearly constantly. He was hired by Jack Dorsey, and felt accountable to him and to the board, but he reported to Agrawal, who believed that Mudge had a responsibility to follow the chain of command very rigidly.
I have previously had managers who want you to rigidly follow the chain of command, and if you are a "hacker" type, they are a shock (and you are a shock to them). They are often very interested in controlling information that goes upward and how mandates flow downward through them (both to control their reputation and make sure everyone gets information in "proper context"), to the point that they see it as an attack on their position to even speak with their manager. A "hacker" would rather put the information in front of the people who need it, instead of filtering it through the hierarchy.
At the first opportunity Agrawal had to clean house, he cleaned out Mudge because he didn't want to work with him. House cleaning is normal for a new CEO. From Agrawal's perspective, Mudge did a terrible job, since he wanted to circumvent Agrawal.
Agrawal's memo, in contrast, reeks of insecurity. The combination of how he's treated mudge and Rishi Sunak and the potential consequences of this complaint (particularly if FTC investigates and finds Twitter has not been following the consent decree) boxes him into a corner -- he won't be able to recruit the talent to solve these security problems and will be seen as an impediment to compliance/mitigation. I could easily see the FTC et al insisting on his resignation as part of a settlement. It's an own-goal.
With $10mm cash bonuses on the table it’s extremely obvious why Agrawal would insist on being MITM
Aha, eg:
https://www.dailymail.co.uk/news/article-10258453/Twitters-n...
So his performance bonuses is more than 10x his salary - incentives to fake good numbers and hide the bad stuff, indeed!
The content of the complaint is all that matters, and it should be judged on its own merits. It never matters who said what, and attempting to make it matter is ad hominem fallacy; it is what is said that matters.
That said, I can't quite fathom why Twitter's cybersecurity matters any more than the cybersecurity of any of the myriad of online forums, HN included: the "data" simply isn't all that important; it is all public, it is all talk, and talk, as we know, is cheap. Say Twitter is completely overrun by foreign state actors who delete everything. The outrage is going to be minimal. "Dang, I really enjoyed mouthing off on Twitter. Oh, well."
Secondly, private messages between people are not public either. Opening that data up or allowing it to be read or manipulated by other entities will drive a lot of outrage and the data contained within is important!
When gaming services leak IPs, they too can get DDoS'ed. E.g. during tournaments or when someone is losing their match.
Seriously, so what? Twitter's IP does not affect national security.
>and as the public square of present, Twitter essentially drives public discourse...
This is being awfully kind to a platform that 77% of Americans have absolutely nothing to do with.
>especially when a large portion of the legacy media has been reduced to sourcing their stories and directly quoting from Twitter.
Ah, legacy media, conservative politispeak for CBS, NBC, ABC, CNN, etc. Can't get away from Twitter on the major networks anymore, it's Twitter all the time? Just what in the heck are you talking about? Turn the news on sometime. The only reason for Twitter to be in the news is Elon Musk (previously, Trump). Or, you know, give one example of a major news outlet using Twitter as source for a story. Real journalists do not do that. They use legitimate sources.
> Secondly, private messages between people are not public either. Opening that data up or allowing it to be read or manipulated by other entities will drive a lot of outrage and the data contained within is important!
Absurd. No one cares what you say in private to a complete stranger you'll never meet.
Governments and their respective departments (at all levels: federal, state, local, etc.) communicate with their constituents via social media, Twitter in particular as well as via the media outlets that will report on said statements from Twitter.
Change the algorythm such that those messages no longer reach people and you can bet the respective countries will pass legislation and puninitive measures against Twitter.
>This is being awfully kind to a platform that 77% of Americans have absolutely nothing to do with
Except I outlined some of the other ways people interact with Twitter, even without accounts. You seem to be incredulous that other forms of media rely on Twitter... You should look a bit closer next time you turn the TV on.
I just did and there was a segment about Russia playing titled "'Slower burn' of Russia's economy has begun". Guess where almost all of the footage they aired came from? Twitter. Guess how the reporters are finding people on the ground to interview? Twitter. Guess how analysts are keeping abreast of military developments (e.g. troop movement, statements released by governments, etc.)? Twitter.
>Absurd. No one cares what you say in private to a complete stranger you'll never meet.
Many service providers conduct customer service via DMs these days. My ISP's preffered lines of contact are Twitter and WhatsApp. Even if we take a step back, do you truly believe that there are no people sharing sensitive information between each other via private messages?
That's not what's dangerous.
Instead, dangerous things include manipulating the algorithms so that "news" of ones choice get lots of visibility. Then a foreign state can influence the elections
I think this is bollocks. 23% of Americans say they use Twitter. 61% of Americans voted in the last Presidential election. So with my bad math, say a foreign state somehow gets every possible Twitter users vote going their way, at best it's going bamboozle 14% of weak-minded Americans. That's at best, the perfect and unbeatable score. The reality is that most Twitter users are not obsessed with the platform, and most Americans are not on the fence with their votes. This concern is not really supportable.
In addition to that, the manipulators / nation states don't attack only via Twitter, and, everything combined ...
I worked with Mudge (not super close, but enough to see how he worked across teams etc) and can certainly say this is not the case. At least when I saw him Mudge was excellent at the program leadership aspect of his role. At one point he ended up a DARPA PM. You can't go from L0pht to DARPA without getting really good at working with other people and leading projects.
While he was always a notable presence, he was also never prone to drama, and very good at having ego when it was important but never letting it get in the way.
Additionally all of the details sound like every KPI chasing consumer facing tech company I've ever worked with. I think we all know a few very competent people who have stood up to leadership at insane tech companies and ultimately gotten fired for it.
https://www.cnn.com/videos/business/2022/08/23/peiter-mudge-...
* L0pht / @stake: security research, red teaming, and source code auditing, IIRC.
* BBN: research.
* NFR: technical advisory board.
* DARPA: Managing a program that provided grants for new security products and tools.
* Google ATAP: Google's "invention studio".
* CyberUL: Testing of security products.
Again, I don't doubt Mudge's bonafides. I don't doubt his security knowledge. But this job was nothing like any he's had in the past.
I also don't doubt his claims. Everything he's stated is almost certainly true. It does take more than a year to fix most of these problems and I wonder if he just got frustrated with the political battles that occur in these situations.
Decades of experience as a rebellious hacker? Well, that's not commercial experience. Founded a security consultancy? Too small, they just don't know how to operate in a large bureaucracy. Worked at a secretive company as an individual contributor? They've been completely silent in public, clearly they haven't achieved anything interesting in years. Working elsewhere as an individual contributor? They just don't know how to build a team. Decades as a senior manager at a huge multinational corporation? Out of touch bullshitter, stale coding skills, doesn't know how we really do things these days.
I mean, if an auditor publicly reports an audit finding that is ignored by the company and his ethics demand its reporting, is he branded a "whistleblower"? I do not think so, instead it is an "auditor finding". Why does that not apply here?
It kind of dovetails with how pathetically organized IT in general is from a professional standpoint. Lawyers, Doctors, ... ?Accountants? and the like have centuries-codified procedures, principles, and the like for ethics. You generally don't get to hire one of those and tell them how to breach ethics (now, there are a lot of corrupt lawyers and a lot of corrupt accountants see: Arthur Andersen).
The exploit industry has the 0day and x days of forewarning process, so there is that, but the fact a security consultant/professional gets accused of whistleblowing when... um, isn't that sort of the point? You hire a security consultant kind of like an auditor. And if auditors find major failings and they aren't addressed, aren't they supposed to report them?
I'm pretty sure the security IT industry does not have even accountant levels of professional conduct and organizations.
As IT subsumes and infiltrates, now to the point that fundamental bill of rights / human rights are dependent on secure and functioning IT systems, it gets... a bit more important. Arguably more important than the ethics around accountants and doctors. Lawyers, because they deal with the law, are probably more important still, but it shows that IT security may be rising in import to that level.
[0] Companies want the letter to say whatever their regulators and/or contractual obligations demand that it say.
Twitter is a publicly held company.
I'm sure there are conflicts of interest and some degree of confidentiality for auditors and clients, but there is a fundamental public interest of disclosure, at a minimum to the government, in the event of irregularities.
From the SEC:
"In addition, we will continue to focus on auditors. As the Supreme Court noted nearly 30 years ago in U.S. v. Arthur Young & Co., 465 U.S. 805 (1984), auditors play a crucial role in the financial reporting process by serving as the “public watchdog.” So, it is important that we carefully monitor their work and ensure that they fully comply with their professional obligations. If there is a significant restatement or if we learn about improper accounting from a whistleblower, our proactive efforts, or the media, then you can expect that we will scrutinize not only the CEO, CFO and Controller, but also the engagement partner, engagement quality reviewer, and the auditing firm as a whole. We are going to probe the quality of the audit and determine whether the auditors missed or ignored red flags, whether they have proper documentation, and whether they followed professional standards.
And it is important to remember that our ability to bring Rule 102(e) bars against auditors extends beyond instances where there are accounting irregularities at a public company. Our Rule 102(e) program is remedial in nature and meant to protect the integrity of the Commission’s processes. As a result, we can and have investigated auditors when their audits fail to meet the most basic standards, regardless of whether there was an actual problem with the auditing client. By pursuing actions over these bad audits, we can fully leverage the Division’s resources and close off access to those who shirk their responsibilities as gatekeepers to the securities markets."
From there you can see legal and institutional gravitas, ethics, and expectations of accountants and auditors of public companies. That's kind of what I'm getting at re: elevating security and certain IT roles to higher responsibility and codification.
Now, is this a smear attempt by Jack Dorsey in relation to the Elon Musk lawsuit? Eh, maybe.
https://www.investor.gov/introduction-investing/general-reso...
(search for "resign")
The SEC quote is about requiring auditors to meet their professional standards. Those standards require them to follow certain processes, things like needing to see evidence for certain things, and not both preparing the books and auditing them, and require that they not issue letters they don't actually agree with. Those standards do not require informing the public or regulators about problems they find.
There's certainly something to be said for having some codified professional standards for infosec professionals, but if public or regulator notice is something you think is important to be in those standards you shouldn't model them off of the standards for auditors, because auditors have no such professional responsibility.
A) an old hand and doesn’t know how to run a security program with the tech today
B) a strong tech hire who can’t lead a program.
But Mudge is still… Mudge, and he’s also proven his ability to collaborate so if he was a bull in a china shop a twitter, that would be surprising.
There’s also a broader trend here of well known security leads that originate from that time working at social media and leaving quickly, like Alex Stamos, who also u-turned out of Facebook.
So are the odds higher that Mudge did a bad job, or this set of companies are not great internally and old guard security leads are pointing it out? The twitter CEO letter framing him as a bad employee doesn’t address this context.