E93: Twitter whistleblower, cloud security vulnerabilities, student debt forgiveness & more

**David Sacks** (0:00)
I want to play the theme music for this episode, okay? Hold on one second.

**Jason Calacanis** (0:12)
If you let the Indian government plant spies in your office, give a little whistle.
If you have too many bots, you can come up with your own metric, MDAUs. When you want to incent your staff to not look at the bots, give them bonuses based on dows. Based on dows. Always let your bonus be your guide. When you're on the board and you see metrics that you don't like, turn a blind eye.

**Chamath Palihapitiya** (0:52)
Turn a blind eye.

**Jason Calacanis** (0:57)
Sorry, sorry.
I just got subpoenaed. They said everybody's getting subpoenaed again.

**Chamath Palihapitiya** (1:03)
This is Jake Calat is best.

**Jason Calacanis** (1:27)
Thanks for watching!

**Erik Friedberg** (1:28)
This is gonna be the story of 2022 for sure.

**Jason Calacanis** (1:29)
Right before, I guess the big case between Elon and Twitter is about to happen, I guess, in October at some point, a Twitter whistleblower has come forward and dropped a nuke into the middle of what was basically the story of the year in business, I think. The former head of security hired by Jack himself, an incredibly well-respected Peter Mudge Zatko, he's referred to as Mudge, one of the most respected people in the security industry, again, recruited by Jack in 2020 after a team of hackers, you may remember, took over all these verified accounts, Obama, Biden, and Elon's account as well. And he was head of security until January of this year, eight months ago, and he claims through explosive documents, a huge document dump that Twitter executives ignored, these Twitter executives ignored multiple security vulnerabilities. Now, why is this important? Well, obviously, if Obama, Biden, and other heads of state have their Twitter handles, they could say something that could cause an international incident, and that's actually happened with hacks before.
He also says they were not following even the most basic security protocols like safeguarding staff access to core software. Of course, all this comes after there were Saudi infiltrator spies, essentially inside of Twitter. I mean, the list of things here that he is alleging is truly colossal. He dumped these documents to the Department of Justice, the SEC, Congress, and the Washington Post. He alleges that the vulnerabilities make Twitter extremely vulnerable to foreign spies hacking and disinformation campaigns.
And perhaps most importantly to the acquisition, the complaint also adds that Twitter's policy towards fake accounts incentivized quote, deliberate ignorance by undercounting spam accounts and giving bonuses to execs for increasing users but not finding bots. Sacks, your thoughts, I mean, on this, you talked about your subpoena or whatever that was. No, it's a subpoena.

**David Sacks** (3:39)
I'm being depositioned. It's...

**Jason Calacanis** (3:42)
Oh, you're having a deposition?

**David Sacks** (3:43)
Yeah, they want to depo me too, which is kind of amazing. But let's save that because I think this is more newsworthy.
So you'll recall on a previous show, we talked about this idea that if Twitter sues Elon to go after the kill fee or to go after damages, the question will very rapidly become about whether Twitter has a bot problem and will Discovery reveal documents that show that Twitter executives knew or should have known there was a problem?
And so I said the question will very rapidly become what did Twitter executives know and when did they know it? Now, I couldn't have predicted that this whistleblower would come forward, but what he's basically saying is not only is there a bot problem, there is a cover up of the bot problem. He's accusing the company of positively Nixonian tactics here. So just to build on what you said, J Cal, he said that Twitter executives don't have the resources to fully understand the true number of bots on the platform and their executives are disincentivized to count them properly because doing so would negatively affect their bonuses. So I didn't know that their bonuses were in any way tied to this bot issue. So basically, he's making the Upton Sinclair argument that it's hard to get a man to understand a problem when his salary depends on not understanding it. So that's part of what he's saying. He's also saying that he's accusing Twitter CEO Parag Agarwal directly. Let's just say these are allegations, right? These are not proven yet.
But here's what he's saying. Basically, he's saying that Parag and his lieutenants repeatedly discourage him from providing a full accounting of Twitter security problems to the company's board of directors. They basically prevented him from producing a written report. He also says that the company's executives ordered him to knowingly present cherry-picked and misrepresented data to create the perception of progress on urgent cybersecurity issues. He also alleges that they went behind his back to have a third-party consulting firm, their report scrubbed to hide the true extent of the company's problems. As a result of this, he's basically saying that Twitter executives committed securities law violations by making material misrepresentations and omissions in SEC filings. This is what got Elon to commemorate Zacko's revelations with one of his trademark memes, which was the meme of Jiminy Cricket singing, Give a little whistle from the film Pinocchio.