The Securities and Exchange Commission (SEC) is reportedly investigating the way Twitter handled a security lapse in 2018 that exposed personal user information before it was acquired by billionaire Elon Musk. People familiar with the matter, who spoke on the condition of anonymity, revealed that the SEC is scrutinizing whether the former top executives of Twitter adequately disclosed the privacy issues to shareholders or implemented proper controls.
The security breach in question occurred when a bug on the social media platform allowed outsiders to view user email addresses during password resets, thus revealing the identities of users. The individuals of interest during the investigation include Twitter's former Chief Financial Officer, Ned Segal, and former Chief Technology Officer, Parag Agrawal, who is currently the CEO of the company. The incident took place in 2018 when Jack Dorsey was still the CEO.
At present, it remains unclear whether there will be any enforcement action resulting from this investigation or when it will conclude. It's important to note that none of the former executives have been accused of any wrongdoing at this time.
Last year, Agrawal and Segal were ousted from their positions after Elon Musk acquired Twitter for $44 billion and rebranded it as X Corp. Following the acquisition, Musk hired an external law firm to conduct an internal investigation into complaints regarding lax computer-security measures at the company.
Twitter faced several security breaches in 2018, including the discovery of a computer virus that exposed users' passwords and a security flaw that made it possible to identify the country codes associated with Twitter users' phone numbers. These missteps could have enabled wrongdoers to identify the countries where the accounts were based.
The SEC has been investigating various aspects related to Musk's controversial purchase of Twitter, focusing on the management of the social media firm and the actions taken by the billionaire in acquiring it. In fact, the agency recently sued Musk, seeking his testimony about whether his actions leading up to the Twitter buyout violated securities laws. Musk's attorney, Alex Spiro, responded to the case, stating that the SEC has already questioned Musk multiple times as part of their ongoing investigation.
Regarding the 2018 security issues surrounding user information, they came to light during the aftermath of Musk's attempt to cancel his buyout of Twitter last year. Musk argued that the company was plagued with operational problems, including inadequate measures to safeguard customer data. Since 2018, the company has experienced multiple hacks and security issues.
Peiter Zatko, Twitter's former head of security, filed a lawsuit against the company last year, alerting US authorities about significant weaknesses in Twitter's defenses against hackers. He claimed to have raised concerns about data breaches and the company's exaggerated number of computer bots among its customer base, but these concerns were dismissed by his colleagues. Twitter denied the allegations, describing them as a false narrative and attributing Zatko's firing to ineffective leadership and poor performance.
Musk referred to these concerns while arguing his case for being able to withdraw his offer of $54.20 per share. However, he later agreed to proceed with the deal at the originally proposed price.
Twitter has previously acknowledged contacts from the US Federal Trade Commission (FTC) and the SEC regarding operational mishaps and some of Musk's actions in relation to the acquisition. Although no formal charges or lawsuits have been filed thus far, the company has faced regulatory scrutiny concerning its privacy protections. It is also subject to a consent decree with the FTC, which mandates greater oversight.
Last year, Twitter agreed to pay $150 million to settle FTC allegations that it had misused users' phone numbers for targeted advertising, which violated the terms of the consent decree. The FTC has been investigating Twitter's privacy and data security practices since Musk's takeover.
The legal disputes between Musk and Twitter's former top executives have even extended to the accumulation of legal fees during congressional and other investigations. Recently, a Delaware judge ordered X Corp. to pay $1.1 million in legal bills covering Agrawal, Segal, and former Chief Legal Officer Vijaya Gadde for their testimonies regarding Twitter's alleged interference in elections.