4 ms·
Most of the complaints in the whistleblower docs aren't about anything illegal. There's some places where they show that twitter's public statements, after a s
by ryan_lane 4y ago
Most of the complaints in the whistleblower docs aren't about anything illegal.
There's some places where they show that twitter's public statements, after a security incident, around their security posture were misleading. That's potentially illegal, but even that could be a grey area.
There's some places where they show twitter didn't comply with creating and enforcing an SLDC, but if you've ever worked on an SLDC, you know it's a joke that's there for compliance checkbox reasons. Also, this is certainly a grey area because most likely to actually comply with this, you only need to have a document generated, training for how it should be used, and very basic processes in your git workflows. I'd be surprised if they hadn't done enough to legally comply with this.
The statements around "employees with production access" are vague. What _kind_ of production access do they have? If you're an engineer, you have production access, because your code can be deployed there. If you're in ops/support, you have production access, because you need to access user data. Hard to properly judge the seriousness of this without knowing more details.
For me, the lack of audit access seems to be the biggest legal issue, especially if they were lying to regulators about their progress.
It's not that the accusations aren't bad. They paint a picture of an org that has serious security issues, seriously management and organizational health/culture issues, flailing executives, and an incompetent board. But, it really seems like most of it simply isn't illegal.
- nrmitchi 4y agoI'll agree with most of these statements, but would object to "they show twitter didn't comply with creating and enforcing...". I don't think it's clear that they have shown anything. This is simply a complaint making statements without any real form of evidence. As you say in your final statement, this is just painting a picture of an organization. It's definitely not fair to take everything stated here at face value with all of the context which is clearly missing.
- ryan_lane 4y agoIt says in the document that there is an SLDC defined, but that the company isn't fully complying with it.
- nrmitchi 4y agoIt could say in the document that Jask Dorsey shits unicorns. It being a statement in a complaint document does not in any way mean that it is true (or has been "shown" to be).
- notmelgibson 4y ago
- dilyevsky 4y agoHaven't read all the report yet but covering security related things can easily land you in legal hot waters, happened with other tech execs - https://www.justice.gov/usao-ndca/pr/former-chief-security-officer-uber-charged-obstruction-justice https://www.justice.gov/usao-ndca/pr/former-chief-security-o...
- ryan_lane 4y agoDisclosure of an attack, if that attack results in exfiltration, is required by law. If you cover up that, and don't disclose, someone is going to be in legal trouble. If you've had an attack, you disclose, and what you discuss in terms of the protections you had in place, and the actions you're going to take afterwards weren't completely accurate, that's more of a grey area.