Twitter whistleblower, cloud security vulnerabilities, student debt forgiveness & more

The episode opens with a theme song that mocks the Twitter bot dispute. Its lyrics joke about letting spies into the office, inventing a metric to hide bots, paying bonuses on that metric, and turning a blind eye as a board member. A speaker then quips that everyone is being subpoenaed again.

After a few lines of intro chatter and the host introductions, the conversation turns to what one host calls the business story of 2022: a Twitter whistleblower, arriving just before the court case between Elon and Twitter.

A host introduces the whistleblower as Peter Mudge, the former head of security whom Jack recruited in 2020 after a hack of verified accounts such as Obama's, Biden's and Elon's. The host calls him one of the most respected people in the security industry and says he served until January of this year.

According to the host, Mudge claims in a large document dump that executives ignored multiple security vulnerabilities and basic protocols such as safeguarding staff access to core software. The host notes this follows earlier reports of Saudi infiltrators inside Twitter, and stresses that a hijacked head-of-state account could cause an international incident.

The host adds that the documents went to the Department of Justice, the SEC, Congress and the Washington Post. Relevant to the acquisition, the complaint reportedly says Twitter's fake-account policy encouraged "deliberate ignorance": spam accounts were undercounted and executives received bonuses for growing users but not for finding bots.

One host (the one being deposed in the case) recalls predicting on an earlier show that a Twitter suit against Elon would turn on whether executives knew or should have known about a bot problem. The whistleblower, he says, goes further and alleges a cover-up, with "Nixonian" tactics, and a bonus structure that discourages counting bots properly. The host says he did not know bonuses were tied to this issue.

He compares this to the Upton Sinclair line that it is hard to make someone understand something when his salary depends on not understanding it. He flags that these are unproven allegations: that Parag and a lieutenant discouraged a full security accounting for the board and a written report, ordered cherry-picked data to suggest progress, and went to an outside consulting firm whose report was allegedly scrubbed.

On that basis, the host says, Mudge claims securities-law violations through misrepresentations and omissions in SEC filings. Elon reacted with a meme of Jiminy Cricket singing "Give a little whistle," which the hosts note became their cold open.

The same host cautions that the claims are unproven and that Mudge is working with the group that backed Frances Hagen (as the source spells it), whose statements he questioned. Still, he argues Mudge cannot simply be dismissed as an Elon partisan: he describes him as a respected cybersecurity authority and early white-hat hacker who would be on any shortlist for a chief security officer.

A host then asks about the governance dysfunction: a security chief hired to fix problems yet allegedly unable to tell the board the truth, while management is incentivized otherwise. He wonders whether the board looked away or management withheld data. Another speaker cautions that one cannot reach all those conclusions yet, and the first says his mind is merely wandering.

A host who read parts of the complaint (not all of it) says it is not especially supportive of Elon's case. He cites a quote saying Twitter is already doing a decent job excluding spam bots and worthless accounts from its mDAU calculation, which he reads as an allegation of omitted details rather than outright lying.

In his view the real target is security disclosure, which at a public company normally flows through the audit committee, roughly once a quarter, to the board. He also says it was reported that Mudge was a poor manager of a large organization, a common failure of promoting a top specialist into leadership, and that this may have cost him management's trust and a hearing before the board. He notes this surfaced only in recent days.

He expects the claims to resemble past FTC disputes involving companies like Facebook and Google, which usually end in settlement and a fine after three to five years. So he suspects the material points toward that outcome rather than a smoking gun for Elon, and that the affirmation of a decent mDAU calculation hurts Elon's claim.

Another host disagrees in part. He agrees the claims are much broader than the bot issue and Elon's complaints, but says parts of them still help Elon. Citing a CNN article, he reports that Mudge argues Twitter obscures the scale of fake accounts by reporting bots as a share of mDAU instead of all accounts, which he alleges is deliberately misleading.

A host spells out the math: with total accounts as the denominator the bot percentage would look higher than with the smaller mDAU base. The speaker says he is only relaying what CNN reports about the allegation, noting that CNN, the Washington Post and Capitol Hill contacts all received the report after Mudge was fired in January and worked with whistleblower lawyers.

He continues with CNN's account: Mudge began asking about bots in early 2021, was told by the head of site integrity that the company did not know the total, and left with the impression that Twitter had no appetite to measure them because a true figure could hurt its value and image.

Another speaker retorts that this means Mudge speaks out of both sides of his mouth, since both quotes come from his complaint, which he calls confusing and a little schizophrenic. The reply is that more material is still emerging, and that the quotes are not the smoking gun one might want, without taking a view on whether he is believable.