Ex-Twitter exec blows the whistle, alleging reckless and negligent ...

Twitter has major security problems that pose a threat to its own users’ personal information, to company shareholders, to national security, and to democracy, according to an explosive whistleblower disclosure obtained exclusively by CNN and The Washington Post.

The disclosure, sent last month to Congress and federal agencies, paints a picture of a chaotic and reckless environment at a mismanaged company that allows too many of its staff access to the platform’s central controls and most sensitive information without adequate oversight. It also alleges that some of the company’s senior-most executives have been trying to cover up Twitter’s serious vulnerabilities, and that one or more current employees may be working for a foreign intelligence service.

The whistleblower, who has agreed to be publicly identified, is Peiter “Mudge” Zatko, who was previously the company’s head of security, reporting directly to the CEO. Zatko further alleges that Twitter’s leadership has misled its own board and government regulators about its security vulnerabilities, including some that could allegedly open the door to foreign spying or manipulation, hacking and disinformation campaigns. The whistleblower also alleges Twitter does not reliably delete users’ data after they cancel their accounts, in some cases because the company has lost track of the information, and that it has misled regulators about whether it deletes the data as it is required to do. The whistleblower also says Twitter executives don’t have the resources to fully understand the true number of bots on the platform, and were not motivated to. Bots have recently become central to Elon Musk’s attempts to back out of a $44 billion deal to buy the company (although Twitter denies Musk’s claims).

Zatko was fired by Twitter (TWTR) in January for what the company claims was poor performance. According to Zatko, his public whistleblowing comes after he attempted to flag the security lapses to Twitter (TWTR)’s board and to help Twitter (TWTR) fix years of technical shortcomings and alleged non-compliance with an earlier privacy agreement with the Federal Trade Commission. Zatko is being represented by Whistleblower Aid, the same group that represented Facebook whistleblower Frances Haugen.

John Tye, founder of Whistleblower Aid and Zatko’s lawyer, told CNN that Zatko has not been in contact with Musk, and said Zatko began the whistleblower process before there was any indication of Musk’s involvement with Twitter.

After this article was initially published, Alex Spiro, an attorney for Musk, told CNN, “We have already issued a subpoena for Mr. Zatko, and we found his exit and that of other key employees curious in light of what we have been finding.”

CNN sought comment from Twitter on more than 50 specific questions regarding the disclosure.

In a statement, a Twitter spokesperson told CNN that security and privacy are both longtime priorities for the company. Twitter also said the company provides clear tools for users to control privacy, ad targeting and data sharing, and added that it has created internal workflows to ensure users know that when they cancel their accounts, Twitter will deactivate the accounts and start a deletion process. Twitter declined to say whether it typically completes the process.

“Mr. Zatko was fired from his senior executive role at Twitter in January 2022 for ineffective leadership and poor performance,” the Twitter spokesperson said. “What we’ve seen so far is a false narrative about Twitter and our privacy and data security practices that is riddled with inconsistencies and inaccuracies and lacks important context. Mr. Zatko’s allegations and opportunistic timing appear designed to capture attention and inflict harm on Twitter, its customers and its shareholders. Security and privacy have long been company-wide priorities at Twitter and will continue to be.”

Some of Zatko’s most damning claims spring from his apparently tense relationship with Parag Agrawal, the company’s former chief technology officer who was made CEO after Jack Dorsey stepped down last November. According to the disclosure, Agrawal and his lieutenants repeatedly discouraged Zatko from providing a full accounting of Twitter’s security problems to the company’s board of directors. The company’s executive team allegedly instructed Zatko to provide an oral report of his initial findings on the company’s security condition to the board rather than a detailed written account, ordered Zatko to knowingly present cherry-picked and misrepresented data to create the false perception of progress on urgent cybersecurity issues, and went behind Zatko’s back to have a third-party consulting firm’s report scrubbed to hide the true extent of the company’s problems.

The disclosure is generally much kinder to Dorsey, who hired Zatko and whom Zatko believes wanted to see the problems within the company fixed. But it does depict him as extremely disengaged in his final months leading Twitter – so much so that some senior staff even considered the possibility he was sick.

CNN has reached out to Dorsey for comment. A person familiar with Zatko’s tenure at Twitter told CNN the company investigated several claims he brought forward around the time he was fired, and ultimately found them unpersuasive; the person added that Zatko at times lacked understanding of Twitter’s FTC obligations.

Zatko believes his firing was in retaliation for his sounding the alarm about the company’s security problems.

The scathing disclosure, which totals around 200 pages, including supporting exhibits – was sent last month to a number of US government agencies and congressional committees, including the Securities and Exchange Commission, the Federal Trade Commission and the Department of Justice. The existence and details of the disclosure have not previously been reported. CNN obtained a copy of the disclosure from a senior Democratic aide on Capitol Hill. The SEC, DOJ and FTC declined to comment; the Senate Intelligence Committee, which received a copy of the report, is taking the disclosure seriously and is setting a meeting to discuss the allegations, according to Rachel Cohen, a committee spokesperson.

Sen. Dick Durbin, who chairs the Senate Judiciary Committee and also received the report, vowed to investigate “and take further steps as needed to get to the bottom of these alarming allegations.”

The claims I’ve received from a Twitter whistleblower raise serious national security concerns. Sen. Chuck Grassley, the top Republican on the Senate Judiciary Committee

Sen. Chuck Grassley, the same panel’s top Republican and an avid Twitter user, also expressed deep concerns about the allegations in a statement to CNN.

“Take a tech platform that collects massive amounts of user data, combine it with what appears to be an incredibly weak security infrastructure and infuse it with foreign state actors with an agenda, and you’ve got a recipe for disaster,” Grassley said. “The claims I’ve received from a Twitter whistleblower raise serious national security concerns as well as privacy issues, and they must be investigated further.”

The FTC should investigate the claims, and impose fines and individual liability on specific Twitter executives if a probe finds they were responsible for security lapses, Sen. Richard Blumenthal wrote to the agency in a letter on Tuesday obtained by CNN.

The letter by Blumenthal — who chairs the Senate subcommittee on consumer protection — highlights the pressure Twitter now faces from Washington as a result of the disclosure.

“If the Commission does not vigorously oversee and enforce its orders, they will not be taken seriously and these dangerous breaches will continue,” Blumenthal wrote.

Zatko may be eligible for a monetary award from the US government as a result of his whistleblower activities. “Original, timely and credible information that leads to a successful enforcement action” by the SEC can earn whistleblowers up to a 30% cut of agency fines related to the action if the penalties amount to more than $1 million, the SEC has said. The SEC has awarded more than $1 billion to nearly 300 whistleblowers since 2012.

Tye told CNN that Zatko filed his disclosure to the SEC “to help the agency enforce the laws,” and to gain federal whistleblower protections. “The prospect of a reward was not a factor in Mudge’s decision, and in fact he didn’t even know about the reward program when he decided to become a lawful whistleblower.”

The Whistleblower

Zatko first came to national attention in 1998 when he took part in the first congressional hearings on cybersecurity.

“All my life, I’ve been about finding places where I can go and make a difference. I’ve done that through the security field. That’s my main lever,” he told CNN in an interview earlier this month.

Video Ad Feedback Twitter whistleblower was on CNN 22 years ago. Here's what he had to say 03:22 - Source: CNN

The events leading to his decision to become a whistleblower began before he worked at Twitter, with a devastating hack in 2020 in which the Twitter accounts of some of the world’s most famous people, including then-presidential candidate Joe Biden, former President Barack Obama, Kim Kardashian and Musk, were compromised. Twitter told CNN that in response to the incident, the company began compartmentalizing access to customer support tools.

After the attack, Dorsey recruited Zatko, a well-known “ethical hacker” turned cybersecurity insider and executive who previously held senior roles at Google, Stripe and the US Department of Defense, and who told CNN that he’d been offered a senior, day-one cyber position in the Biden administration.

Zatko, center, was among a group of hackers who testified before Congress on cybersecurity in 1998. Douglas Graham/CQ-Roll Call, Inc./Congressional Quarterly/Getty Images

What Zatko says he found was a company with extraordinarily poor security practices, including giving thousands of the company’s employees — amounting to roughly half the company’s workforce — access to some of the platform’s critical controls. His disclosure describes his overall findings as “egregious deficiencies, negligence, willful ignorance, and threats to national security and democracy.”

After the January 6 insurrection, Zatko was concerned about the possibility someone within Twitter who sympathized with the insurrectionists could try to manipulate the company’s platform, according to his disclosure. He sought to clamp down on internal access that allows Twitter engineers to make changes to the platform, known as the “production environment.”

But, the disclosure says, Zatko soon learned “it was impossible to protect the production environment. All engineers had access. There was no logging of who went into the environment or what they did…. Nobody knew where data lived or whether it was critical, and all engineers had some form of critical access to the production environment.” Twitter also lacked the ability to hold workers accountable for information security lapses because it has little control or visibility into employees’ individual work computers, Zatko claims, citing internal cybersecurity reports estimating that 4 in 10 devices do not meet basic security standards.

Twitter’s flimsy server infrastructure is a separate yet equally serious vulnerability, the disclosure claims. About half of the company’s 500,000 servers run on outdated software that does not support basic security features such as encryption for stored data or regular security updates by vendors, according to the letter to regulators and a February email Zatko wrote to Patrick Pichette, a Twitter board member, that is included in the disclosure.

[I]t was impossible to protect the production environment. All engineers had access. There was no logging of who went into the environment or what they did. From Zatko's disclosure

The company also lacks sufficient redundancies and procedures to restart or recover from data center crashes, Zatko’s disclosure says, meaning that even minor outages of several data centers at the same time could knock the entire Twitter service offline, perhaps for good.

Twitter did not respond to questions about the risk of data center outages, but told CNN that people on Twitter’s engineering and product teams are authorized to access the production environment if they have a specific business justification for doing so. Twitter’s employees use devices overseen by other IT and security teams with the power to prevent a device from connecting to sensitive internal systems if it is running outdated software, Twitter added.

The company also said it uses automated checks to ensure laptops running outdated software cannot access the production environment, and that employees may only make changes to Twitter’s live product after the code meets certain record-keeping and review requirements.

Twitter has internal security tools that are tested by the company regularly, and every two years by external auditors, according to the person familiar with Zatko’s tenure at the company. The person added that some of Zatko’s statistics surrounding device security lacked credibility and were derived by a small team that did not properly account for Twitter’s existing security procedures.

But Twitter’s security concerns had come to light prior to 2020. In 2010, the FTC filed a complaint against Twitter for its mishandling of users’ private information and the issue of too many employees having access to Twitter’s central controls. The complaint resulted in an FTC consent order finalized the following year in which Twitter vowed to clean up its act, including by creating and maintaining “a comprehensive information security program.”

Zatko alleges that despite the company’s claims to the contrary, it had “never been in compliance” with what the FTC demanded more than 10 years ago. As a result of its alleged failures to address vulnerabilities raised by the FTC as well as other deficiencies, he says, Twitter suffers an “anomalously high rate of security incidents,” approximately one per week serious enough to require disclosure to government agencies. “Based on my professional experience, peer companies do not have this magnitude or volume of incidents,” Zatko wrote in a February letter to Twitter’s board after he was fired by Twitter in January.

The stakes of Zatko’s disclosure are enormous. It could lead to billions of dollars in new fines for Twitter if it’s found to have violated its legal obligations, according to Jon Leibowitz, who was chair of the FTC at the time of Twitter’s original 2011 consent order.

The agency now has another opportunity to show the tech industry it is serious about holding platforms accountable, Leibowitz added, after officials opted not to name top Facebook execs including Mark Zuckerberg and Sheryl Sandberg in the FTC’s $5 billion privacy settlement with that company in 2019.

[I]f there’s a violation here — and that’s a big if — then I think the FTC should very seriously consider not just fining the corporation but also putting the executives responsible under order. Jon Leibowitz, former chair of the FTC

“One of the big disappointments in the Facebook order violation case was that the FTC let executives off the hook; they should’ve been named,” Leibowitz told CNN in an interview. “And if there’s a violation here — and that’s a big if — then I think the FTC should very seriously consider not just fining the corporation but also putting the executives responsible under order.”

Twitter told CNN its FTC compliance record speaks for itself, citing third-party audits filed to the agency under the 2011 consent order in which it said Zatko did not participate. Twitter also said it is in compliance with relevant privacy rules and that it has been transparent with regulators about its efforts to fix any shortcomings in its systems.

Zatko’s allegations are based in part on a failure to grasp how Twitter’s existing programs and processes work to fulfill Twitter’s FTC obligations, the person familiar with his tenure told CNN, saying that misunderstanding has prompted him to make inaccurate claims about the company’s level of compliance.

Foreign threats

Twitter is exceptionally vulnerable to foreign government exploitation in ways that undermine US national security, and the company may even have foreign spies currently on its payroll, the disclosure alleges.

The whistleblower report says the US government provided specific evidence to Twitter shortly before Zatko’s firing that at least one of its employees, perhaps more, were working for another government’s intelligence service. The report does not say whether Twitter was already aware or if it subsequently acted on the tip.

Parag Agrawal, Twitter's former chief technology officer, was made CEO after Jack Dorsey stepped down last November. Kevin Dietsch/Getty Images

Last year, prior to Russia’s invasion of Ukraine, Agrawal — then Twitter’s chief technology officer — proposed to Zatko that Twitter comply with Russian demands that could result in broad-based censorship or surveillance of the platform, Zatko alleges.

The disclosure does not provide details of Agrawal’s suggestion. Last summer, however, Russia passed a law pressuring tech platforms to open local offices in the country or face potential advertising bans, a move western security experts said was intended to give Russia greater leverage over US tech companies.

While Agrawal’s suggestion was ultimately discarded, it was still an alarming sign of how far Twitter was willing to go in pursuit of growth, according to Zatko.

“The fact that Twitter’s current CEO even suggested Twitter become complicit with the Putin regime is cause for concern about Twitter’s effects on U.S. national security,” Zatko’s disclosure says.

The fact that Twitter’s current CEO even suggested Twitter become complicit with the Putin regime is cause for concern about Twitter’s effects on US national security, From Zatko's disclosure

Zatko’s report is becoming public just two weeks after a former Twitter manager was convicted of spying for Saudi Arabia.

The Saudi case underscores the gravity of the allegations Zatko now levels at Twitter. His report could further inflame bipartisan concerns in Washington about foreign adversaries and the cybersecurity threats they pose to Americans, ranging from the theft of US citizens’ data to manipulating US voters or stealing technology and trade secrets.

Twitter did not respond to specific questions about its alleged foreign intelligence vulnerabilities.

The Musk element

Zatko’s disclosure comes at a particularly fortuitous moment for Musk, who is engaged in a legal battle with Twitter over his attempt to back out of buying the company. Musk has accused Twitter of lying about the number of spam bots on its platform, an issue that he claims should let him terminate the deal.

While the binding acquisition agreement that Musk signed with Twitter in April did not include any bot-related exemptions, the billionaire claims that the number of bots on the platform affect the user experience and that having more bots than previously known could therefore impact the company’s long-term value. After Musk moved to terminate the purchase, Twitter responded with a lawsuit alleging that he is using bots as a pretext to get out of a deal over which he now has buyers’ remorse following the recent market downturn, and asking a court to force him to close the deal. The case is set to go to trial in Delaware Chancery Court in October.

Twitter employees walk by the company's headquarters in San Francisco. Glenn Chapman/AFP/Getty Images

User numbers are vital information for any social media business, as advertising revenue depends on how many people could potentially see an ad. But figures about how many users a service has, or how many people actually view a given ad on a site, are notoriously unreliable throughout the tech and media industries due to manipulation and error.

Alone among social media companies, Twitter reports its user numbers to investors and advertisers using a measurement it calls monetizable daily active users, or mDAUs. Its rivals simply count and report all active users; until 2019, Twitter had worked that way as well. But that meant Twitter’s figures were subject to significant swings in certain situations, including takedowns of major bot networks. So Twitter switched to mDAUs, which it says counts all users that could be shown an advertisement on Twitter – leaving all accounts that for some reason can’t, for instance because they’re known to be bots, in a separate bucket, according to Zatko’s disclosure.

The company has repeatedly reported that less than 5% of its mDAUs are fake or spam accounts, and a person familiar with the matter both affirmed that assessment to CNN this week and pointed to other investor disclosures saying the figure relies on significant judgement that may not accurately reflect reality. But Zatko’s disclosure argues that by reporting bots only as a percentage of mDAU, rather than as a percentage of the total number of accounts on the platform, Twitter obscures the true scale of fake and spam accounts on the service, a move Zatko alleges is deliberately misleading.

Zatko says he began asking about the prevalence of bot accounts on Twitter in early 2021, and was told by Twitter’s head of site integrity that the company didn’t know how many total bots are on its platform. He alleges that he came away from conversations with the integrity team with the understanding that the company “had no appetite to properly measure the prevalence of bots,” in part because if the true number became public, it could harm the company’s value and image.

Jack Dorsey reached out and asked me to come and perform a critical task at Twitter. I signed on to do it and believe I’m still performing that mission. Peiter "Mudge" Zatko, former Twitter head of security

Experts on inauthentic behavior online say it can be difficult to quantify “bots” because there isn’t a widely agreed upon definition of the term, and because bad actors constantly change their tactics. There are also many harmless bots on Twitter (and across the internet), such as automated news accounts, and Twitter offers an opt-in feature to allow such accounts to transparently label themselves as automated. Twitter told CNN that the claim it doesn’t know how many bots are on its platform lacks context, reiterating that not all bots are bad and adding that to focus on the total number of bots on Twitter would include those the company may have already identified and taken action against. The company also does not believe it can catch every spam account on the platform, Twitter said, which is why it reports its less-than-5% figure, which reflects a manual estimate, in its financial filings.

But Zatko told CNN he thinks there would still be value in attempting to measure the total number of spam, false or otherwise potentially harmful automated accounts on the platform. “The executive team, the board, the shareholders and the users all deserve an honest answer as to what it is that they are consuming as far as data and information and content [on the platform … At least from my point of view, I want to invest in a company where I know what’s actually going on because I want to invest strategically in the long-term value of an organization,” he said.

Twitter says that it allows bots on its platform, but its rules prohibit those that engage in spam or platform manipulation. But, as with all social media platforms’ rules, the challenge often lies in enforcing its policies.

Elon Musk is engaged in a legal battle with Twitter over his attempt to back out of buying the company. Brendan Smialowski/AFP/Getty Images

The company says it regularly challenges, suspends and removes accounts engaged in spam and platform manipulation, including typically removing more than one million spam accounts each day. Twitter said the total number of bots on the platform is not a useful number. The company declined to answer questions about the total number of accounts on the platform or the average number of new accounts added on the platform daily as context around its daily bot deletion figure.

But in casting doubt on Twitter’s ability to estimate the true number of fake and spam accounts, Zatko’s allegations could provide ammunition to Musk’s central claim that the figure is much higher than Twitter has publicly reported.

By going public, Zatko says, he believes he is doing the job he was hired to do for a platform he says is critical to democracy. “Jack Dorsey reached out and asked me to come and perform a critical task at Twitter. I signed on to do it and believe I’m still performing that mission,” he said.

Donie O'Sullivan Clare Duffy Brian Fung Zach Wasser Logan Whiteside

Hertz settles lawsuits over hundreds of alleged false arrests | CNN ...

CNN —

Hertz will pay $168 million to settle 364 claims related to the company falsely reporting rental cars as stolen. These cases sometimes resulted in people being arrested and even imprisoned.

One lawsuit involving dozens of such cases alleged systemic flaws in Hertz’s reporting of thefts, including not recording rental extensions, falsely claiming customers hadn’t paid, failing to track its own vehicle inventory and failing to correct false reports to police.

Some of those involved in lawsuits against Hertz reported being held at gunpoint by police and spending days in jail before the false reports were worked out. In one case, a person claimed it took two years for the case against them to be resolved.

Hertz said in its announcement that a “meaningful portion” of the settlement payout will be reimbursed from its insurers, and that Hertz “does not expect the resolution of these claims to have a material impact on its capital allocation.”

While the company has policies in place to ensure “proper treatment” of its customers as well as protect the company, “it has taken significant steps to modernize and update those policies,” Hertz spokesperson Jonathan Stern said in an email. The company would not detail any specific policy changes, however.

The settlement will resolve 95% of pending claims against Hertz regarding these sorts of false arrest claims, the company said.

“While we will not always be perfect, the professionals at Hertz will continue to work every day to provide best-in-class service to the tens of millions of people we serve each year,” Hertz CEO Stephen Scherr said in Monday’s statement.

Scherr had said in an April interview with CNBC that the cases involved “1/100 of one percent” of Hertz customer transactions.

USA TODAY exclusive: Hundreds allege Donald Trump doesn't pay ...

Steve Reilly

USA TODAY

During the Atlantic City casino boom in the 1980s, Philadelphia cabinet-builder Edward Friel Jr. landed a $400,000 contract to build the bases for slot machines, registration desks, bars and other cabinets at Harrah's at Trump Plaza.

The family cabinetry business, founded in the 1940s by Edward’s father, finished its work in 1984 and submitted its final bill to the general contractor for the Trump Organization, the resort’s builder.

Edward’s son, Paul, who was the firm’s accountant, still remembers the amount of that bill more than 30 years later: $83,600. The reason: the money never came. “That began the demise of the Edward J. Friel Company… which has been around since my grandfather,” he said.

Donald Trump often portrays himself as a savior of the working class who will "protect your job." But a USA TODAY NETWORK analysis found he has been involved in more than 3,500 lawsuits over the past three decades — and a large number of those involve ordinary Americans, like the Friels, who say Trump or his companies have refused to pay them.

At least 60 lawsuits, along with hundreds of liens, judgments, and other government filings reviewed by the USA TODAY NETWORK, document people who have accused Trump and his businesses of failing to pay them for their work. Among them: a dishwasher in Florida. A glass company in New Jersey. A carpet company. A plumber. Painters. Forty-eight waiters. Dozens of bartenders and other hourly workers at his resorts and clubs, coast to coast. Real estate brokers who sold his properties. And, ironically, several law firms that once represented him in these suits and others.

Trump’s companies have also been cited for 24 violations of the Fair Labor Standards Act since 2005 for failing to pay overtime or minimum wage, according to U.S. Department of Labor data. That includes 21 citations against the defunct Trump Plaza in Atlantic City and three against the also out-of-business Trump Mortgage LLC in New York. Both cases were resolved by the companies agreeing to pay back wages.

Litigator in chief

In addition to the lawsuits, the review found more than 200 mechanic’s liens — filed by contractors and employees against Trump, his companies or his properties claiming they were owed money for their work — since the 1980s. The liens range from a $75,000 claim by a Plainview, N.Y., air conditioning and heating company to a $1 million claim from the president of a New York City real estate banking firm. On just one project, Trump’s Taj Mahal casino in Atlantic City, records released by the New Jersey Casino Control Commission in 1990 show that at least 253 subcontractors weren’t paid in full or on time, including workers who installed walls, chandeliers and plumbing.

The actions in total paint a portrait of Trump’s sprawling organization frequently failing to pay small businesses and individuals, then sometimes tying them up in court and other negotiations for years. In some cases, the Trump teams financially overpower and outlast much smaller opponents, draining their resources. Some just give up the fight, or settle for less; some have ended up in bankruptcy or out of business altogether.

Trump and his daughter Ivanka, in an interview with USA TODAY, shrugged off the lawsuits and other claims of non-payment. If a company or worker he hires isn’t paid fully, the Trumps said, it’s because The Trump Organization was unhappy with the work.

“Let’s say that they do a job that’s not good, or a job that they didn’t finish, or a job that was way late. I’ll deduct from their contract, absolutely,” Trump said. “That’s what the country should be doing.”

To be sure, Trump and his companies have prevailed in many legal disputes over missing payments, or reached settlements that cloud the terms reached by the parties.

However, the consistent circumstances laid out in those lawsuits and other non-payment claims raise questions about Trump’s judgment as a businessman, and as a potential commander- in- chief. The number of companies and others alleging he hasn’t paid suggests that either his companies have a poor track record hiring workers and assessing contractors, or that Trump businesses renege on contracts, refuse to pay, or consistently attempt to change payment terms after work is complete as is alleged in dozens of court cases.

In the interview, Trump repeatedly said the cases were “a long time ago.” However, even as he campaigns for the presidency, new cases are continuing. Just last month, Trump Miami Resort Management LLC settled with 48 servers at his Miami golf resort over failing to pay overtime for a special event. The settlements averaged about $800 for each worker and as high as $3,000 for one, according to court records. Some workers put in 20-hour days over the 10-day Passover event at Trump National Doral Miami, the lawsuit contends. Trump’s team initially argued a contractor hired the workers, and he wasn’t responsible, and counter-sued the contractor demanding payment.

“Trump could have settled it right off the bat, but they wanted to fight it out, that’s their M.O.” said Rod Hannah, of Plantation, Fla., the lawyer who represented the workers, who he said are forbidden from talking about the case in public. “They’re known for their aggressiveness, and if you have the money, why not?”

Similar cases have cropped up with Trump’s facilities in California and New York, where hourly workers, bartenders and wait staff have sued with a range of allegations from not letting workers take breaks to not passing along tips to servers. Trump's company settled the California case, and the New York case is pending.

Trump's Doral golf resort also has been embroiled in recent non-payment claims by two different paint firms, with one case settled and the other pending. Last month, his company’s refusal to pay one Florida painter more than $30,000 for work at Doral led the judge in the case to order foreclosure of the resort if the contractor isn’t paid.

Juan Carlos Enriquez, owner of The Paint Spot, in South Florida, has been waiting more than two years to get paid for his work at the Doral. The Paint Spot first filed a lien against Trump’s course, then filed a lawsuit asking a Florida judge to intervene.

In courtroom testimony, the manager of the general contractor for the Doral renovation admitted that a decision was made not to pay The Paint Spot because Trump “already paid enough.” As the construction manager spoke, “Trump’s trial attorneys visibly winced, began breathing heavily, and attempted to make eye contact” with the witness, the judge noted in his ruling.

That, and other evidence, convinced the judge The Paint Spot’s claim was credible. He ordered last month that the Doral resort be foreclosed on, sold, and the proceeds used to pay Enriquez the money he was owed. Trump’s attorneys have since filed a motion to delay the sale, and the contest continues.

Enriquez still hasn’t been paid.

Trump frequently boasts that he will bring jobs back to America, including Tuesday in a primary-election night victory speech at his golf club in suburban New York City. “No matter who you are, we're going to protect your job,” Trump said Tuesday. “Because let me tell you, our jobs are being stripped from our country like we're babies.”

But the lawsuits show Trump’s organization wages Goliath vs David legal battles over small amounts of money that are negligible to the billionaire and his executives — but devastating to his much-smaller foes.

In 2007, for instance, dishwasher Guy Dorcinvil filed a federal lawsuit against Trump’s Mar-a-Lago Club resort in Palm Beach, Fla., alleging the club failed to pay time-and-a-half for overtime he worked over three years and the company failed to keep proper time records for employees.

Mar-a-Lago LLC agreed to pay Dorcinvil $7,500 to settle the case in 2008. The terms of the settlement agreement includes a standard statement that Mar-a-Lago does not admit fault and forbids Dorcinvil or his lawyers from talking about the case, according to court records.

Developers with histories of not paying contractors are a very small minority of the industry, said Colette Nelson, chief advocacy officer of the American Subcontractors Association. But late or missing payments can be devastating for small businesses and their employees.

“Real estate is a tough and aggressive business, but most business people don’t set out to make their money by breaking the companies that they do business with,” she said, stressing she couldn’t speak directly to the specifics of cases in Trump’s record. “But there are a few.”

In the interview, Trump said that complaints represent a tiny fraction of his business empire and dealings with contractors and employees, insisting all are paid fairly. “We pay everybody what they’re supposed to be paid, and we pay everybody on time,” he said. “And we employ thousands and thousands of people. OK?”

Despite the Trumps’ assertion that his their companies only refuse payment to contractors “when somebody does a bad job,” he has sometimes offered to hire those same contractors again. It’s a puzzling turn of events, since most people who have a poor experience with a contractor, and who refuse to pay and even fight the contractor in court, aren’t likely to offer to rehire them.

Nevertheless, such was the case for the Friels. After submitting the final bill for the Plaza casino cabinet-building in 1984, Paul Friel said he got a call asking that his father, Edward, come to the Trump family’s offices at the casino for a meeting. There Edward, and some other contractors, were called in one by one to meet with Donald Trump and his brother, Robert Trump.

“He sat in a room with nine guys,” Paul Friel said. “We found out some of them were carpet guys. Some of them were glass guys. Plumbers. You name it.”

In the meeting, Donald Trump told his father that the company’s work was inferior, Friel said, even though the general contractor on the casino had approved it. The bottom line, Trump told Edward Friel, was the company wouldn't get the final payment. Then, Friel said Trump added something that struck the family as bizarre. Trump told his dad that he could work on other Trump projects in the future.

“Wait a minute,” Paul Friel said, recalling his family's reaction to his dad’s account of the meeting. “Why would the Trump family want a company who they say their work is inferior to work for them in the future?”

Asked about the meeting this week, Trump said, “Was the work bad? Was it bad work?” And, then, after being told that the general contractor had approved it, Trump added, “Well, see here’s the thing. You’re talking about, what, 30 years ago?”

Ivanka Trump added that any number of disputes over late or deficient payments that were found over the past few decades pale in comparison to the thousands of checks Trump companies cut each month.

“We have hundreds of millions of dollars of construction projects underway. And we have, for the most part, exceptional contractors on them who get paid, and get paid quickly,” she said, adding that she doubted any contractor complaining in court or in the press would admit they delivered substandard work. “But it would be irresponsible if my father paid contractors who did lousy work. And he doesn’t do that.”

But, the Friels’ story is similar to experiences of hundreds of other contractors over the casino-boom decade in Atlantic City. Legal records, New Jersey Casino Control Commission records and contemporaneous local newspaper stories recounted time and again tales about the Trumps paying late or renegotiating deals for dimes on the dollar.

A half-decade after the Friels’ encounter, in 1990, as Trump neared the opening of his third Atlantic City casino, he was once again attempting to pay contractors less than he owed. In casino commission records of an audit, it was revealed that Trump’s companies owed a total of $69.5 million to 253 subcontractors on the Taj Mahal project. Some already had sued Trump, the state audit said; others were negotiating with Trump to try to recover what they could. The companies and their hundreds of workers had installed walls, chandeliers, plumbing, lighting and even the casino’s trademark minarets.

One of the builders was Marty Rosenberg, vice president of Atlantic Plate Glass Co., who said he was owed about $1.5 million for work at the Taj Mahal. When it became clear Trump was not going to pay in full, Rosenberg took on an informal leadership role, representing about 100 to 150 contractors in negotiations with Trump.

Rosenberg’s mission: with Trump offering as little as 30 cents on the dollar to some of the contractors, Rosenberg wanted to get as much as he could for the small businesses, most staffed by younger tradesmen with modest incomes and often families to support.

“Yes, there were a lot of other companies," he said of those Trump left waiting to get paid. "Yes, some did not survive."

Rosenberg said his company was among the lucky ones. He had to delay paying his own suppliers to the project. The negotiations led to him eventually getting about 70 cents on the dollar for his work, and he was able to pay all of his suppliers in full.

The analysis of Trump lawsuits also found that professionals, such as real estate agents and lawyers, say he's refused to pay them sizable sums of money. Those cases show that even some loyal employees, those selling his properties and fighting for him in court, are only with him until they’re not.

Real estate broker Rana Williams, who said she had sold hundreds of millions of dollars in Manhattan property for Trump International Realty over more than two decades with the company, sued in 2013 alleging Trump shorted her $735,212 in commissions on deals she brokered from 2009 to 2012. Williams, who managed as many as 16 other sales agents for Trump, said the tycoon and his senior deputies decided to pay her less than her contracted commission rate “based on nothing more than whimsy.”

Trump and Williams settled their case in 2015, and the terms of the deal are confidential, as is the case in dozens of other settlements between plaintiffs and Trump companies.

However, Williams' 2014 deposition in the case is not sealed. In her sworn testimony, Williams said the 2013 commission shortage wasn't the only one, and neither was she the only person who didn't get fully paid. “There were instances where a sizable commission would come in and we would be waiting for payment and it wouldn’t come,” she testified. “That was both for myself and for some of the agents.”

Another broker, Jennifer McGovern, filed a similar lawsuit against the now-defunct Trump Mortgage LLC in 2007, citing a six-figure commission on real-estate sales that she said went unpaid. A judge issued a judgment ordering Trump Mortgage to pay McGovern $298,274.

Even Trump’s own attorneys, on several occasions, sued him over claims of unpaid bills.

One law firm that fought contractors over payments and other issues for Trump — New York City’s Morrison Cohen LLP — ended up on the other side of a similar battle with the mogul in 2008. Trump didn’t like that its lawyers were using his name in press releases touting its representation of Trump in a lawsuit against a construction contractor that Trump claimed overcharged him for work on a luxury golf club.

As Trump now turned his ire on his former lawyers, however, Morrison Cohen counter-sued. In court records, the law firm alleged Trump didn’t pay nearly a half million dollars in legal fees. Trump and his ex-lawyers settled their disputes out of court, confidentially, in 2009.

In 2012, Virginia-based law firm Cook, Heyward, Lee, Hopper & Feehan filed a lawsuit against the Trump Organization for $94,511 for legal fees and costs. The case was eventually settled out of court. But as the case unfolded, court records detail how Trump's senior deputies attacked the attorneys' quality of work in the local and trade press, leading the firm to make claims of defamation that a judge ultimately rejected on free speech grounds.

Trump claims in his presidential personal financial disclosure to be worth $10 billion as a result of his business acumen. Many of the small contractors and individuals who weren’t paid by him haven’t been as fortunate.

Edward Friel, of the Philadelphia cabinetry company allegedly shortchanged for the casino work, hired a lawyer to sue for the money, said his son, Paul Friel. But the attorney advised him that the Trumps would drag the case out in court and legal fees would exceed what they’d recover.

The unpaid bill took a huge chunk out of the bottom line of the company that Edward ran to take care of his wife and five kids. “The worst part wasn’t dealing with the Trumps,” Paul Friel said. After standing up to Trump, Friel said the family struggled to get other casino work in Atlantic City. “There’s tons of these stories out there,” he said.

The Edward J. Friel Co. filed for bankruptcy on Oct. 5, 1989.

Says the founder's grandson: “Trump hits everybody.”

Contributing: John Kelly, Nick Penzenstadler, Karen Yi, David McKay Wilson

Exclusive: Trump's 3,500 lawsuits unprecedented for a presidential nominee

USA TODAY exclusive: Hundreds allege Donald Trump doesn't pay his bills

Trump, companies accused of mistreating women in at least 20 lawsuits

Exclusive: More than 100 lawsuits, disputes over taxes tied to Trump and his companies

Dive into Donald Trump's thousands of lawsuits

Trump casino empire dogged by bad bets in Atlantic City

As campaign rolls on, so do Trump's lawsuits in Florida

How USA TODAY NETWORK is tracking Trump court files

Trump and the Law

Hertz faces lawsuit from 47 customers claiming false arrests | CNN ...

Washington, DC CNN —

47 Hertz customers have filed a lawsuit against the rental company that describes horror stories after they were allegedly falsely reported as having stolen its rental cars, and in some cases even jailed.

The plaintiffs allege being blind-sided by arrests — sometimes at gunpoint — and in some cases spending time in jail. Some plaintiffs describe losing their jobs in the fallout from the arrests.

The lawsuit alleges systematic flaws in Hertz’s reporting of thefts, including not recording rental extensions, falsely claiming customers haven’t paid, failing to track its own vehicle inventory and failing to correct false reports to police. The lawsuit was filed in Delaware Superior Court and comes on the heels of a court ruling that these cases could be pursued outside bankruptcy court. (Hertz had filed for bankruptcy in May 2020 before emerging in July 2021.)

Hertz said in a statement that it disagreed with the ruling allowing the cases to be pursued outside bankruptcy court, and that it’s committed “to do right by our customers.”

“We are reviewing and considering each claim brought against Hertz on its individual merits,” Hertz spokesman Jonathan Stern said. “We have begun extending settlement offers to dozens of claimants and will continue to do so on a case by case basis.”

Hertz CEO Stephen Scherr admitted in April that “several hundred people” were impacted by the company’s errors.

Some of the plaintiffs say they were using Hertz rentals to make a living driving for Uber or Lyft, or to transport their families. One plaintiff, Bianca DeLoach, described being swarmed by police with their guns drawn at a gas station in March 2021 while her children watched from inside the rental she’d paid for. The complaint says DeLoach spent nine nights in jail. Charges were dismissed months later.

Another plaintiff, Mary Lindsay Flannery, says she was in a car she’d rented from Hertz in 2020 when police pulled her over and told her that the vehicle was stolen. The car was impounded, the complaint alleges. Flannery was unable to get an explanation from Hertz despite repeated attempts. She was arrested weeks later, leaving her daughter alone without a parent because her father was deployed overseas, according to the complaint.

Flannery had three panic attacks while in jail, was physically attacked by cellmates and bitten by bed bugs, the complaint says.

The criminal case against Flannery was dismissed and she was released after 14 days.

James Tolen was driving a Hertz rental in Houston in December 2020 when he was pulled over and told to open his door, the complaint alleges.

“When he opened the door at least 4 officers had guns pointed at him. They made him raise his shirt, then they patted him down and cuffed him in the back of a squad car,” the complaint says. “It was humiliating and terrifying.”

Police later called Hertz and learned the car wasn’t stolen – Hertz had reported the car stolen months before renting it to Tolen’s then-partner, the complaint says.

Reginald Brown, driving a car he’d rented from Hertz for Lyft, was jailed overnight and lost his full-time job while he was being prosecuted, the complaint says. The case against him was dismissed almost two years later, the complaint says.

Lyft and Uber did not immediately respond to requests for comment.

Darnay Taper spent two nights in jail last year after being pulled over in March 2021 by eight police cars while during a Hertz rental and held at gunpoint, according to the complaint. Taper, who has heart disease, was denied access to his medication while in jail, the complaint says. The case against Taper was dismissed months later after Hertz didn’t show at a preliminary hearing, the complaint alleges.

Zillow facing sexual harassment suit

Brett Molina and Jessica Guynn

USA TODAY

A former employee of Zillow is suing the real estate giant for sexual harassment, comparing the company's internal culture to an "adult frat house."

According to the filing in federal court, Rachel Kremer accused Zillow management of "despicable and inappropriate sexual conduct" while she was employed there.

The lawsuit alleges Kremer received several explicit text messages and an e-mail with an advertisement for a sex toy.

In a statement, Zillow says it investigated the claims and fired an employee in its Irvine, Calif., office.

"The allegations in the complaint do not reflect Zillow's culture or workplace and are completely inconsistent with our values," said Zillow spokeswoman Jill Simmons. "We don't tolerate harassment of any kind."

Kremer's attorney, Mark Geragos, said he has "no doubt" the lawsuit will expand.

Current and former Zillow employees from Irvine and other offices have contacted his firm since he filed the lawsuit, he said, corroborating his client's claims of pervasive sexism inside Zillow.

"Given the number of people who have made inquiries and have already signed up at our office, it is clearly a major problem at this company," said Geragos. "They need a global resolution."

This is not the first lawsuit tied to Zillow's Irvine office. According to the Orange County Register, another Irvine employee filed a lawsuit against the real estate company for failing to pay overtime.

The charges are just the latest in a rash of lawsuits over alleged sexism and discrimination in the mostly male technology industry.

Earlier this year, Tinder, which is a popular dating app, settled a lawsuit from Whitney Wolfe, its former vice president of marketing, who alleged she was subjected to a pattern of sexist behavior.

Next month, a gender discrimination and retaliation lawsuit goes to trial against prominent Silicon Valley venture capital firm Kleiner Perkins Caufield & Byers.

The suit, filed in 2012 by former partner Ellen Pao, shined a bright light on an uncomfortable reality: Women say they routinely deal with sexism on the job in the freewheeling industry. Kleiner Perkins denies the allegations.

Charges of sexism have embarrassed an industry that prides itself on being a meritocracy where anyone regardless of gender or race can succeed.

Many people blame the industry's gender gap for a "brogrammer" culture, a hybrid of "bro" and "programmer" that describes the frat-house attitudes and behavior inside some companies.

Ex-ITT students want to join suit to get debt canceled

Fatima Hussein

IndyStar

They said they were defrauded, and now they want a seat at the table.

Last week, a group of former ITT Tech students moved to establish themselves as creditors in the school's bankruptcy proceedings in the U.S. Bankruptcy Court for the Southern District of Indiana.

On Jan. 3, five former students filed a 109-page complaint, seeking to act as representatives for hundreds of thousands who say they have been defrauded by the Carmel-based school. Their goal is to have the debt they owe the school canceled.

ITT filed for bankruptcy last year after the Education Department cut off the company’s access to federal student aid.

By the time it declared bankruptcy in September, ITT Tech had been subject to lawsuits from the Consumer Financial Protection Bureau, the Securities and Exchange Commission and the Massachusetts and New Mexico attorneys general.

Government agencies scrutinized the company over alleged failure to disclose bad loans to investors, inflated job placement numbers and aggressive recruiting tactics.

The students' complaint seeks to establish that ITT defrauded students who attended the school during the past 10 years.

The Legal Services Center of Harvard Law School is representing the students. Eileen Connor, director of litigation for the center's Project on Predatory Student Lending, is the lead attorney representing the students. She was unavailable for comment.

Along with legal documents, the students filed more than a thousand pages of first-hand accounts from 541 fellow students — including dozens of students in Indiana — who attended ITT, affidavits from several whistleblowers and evidence developed from state and federal law enforcement investigations.

Hundreds of unidentified Indiana students gave testimony about how the loans they racked up while attending the school ruined their credit scores, left them destitute and caused them mental health issues.

One student who was enrolled in the criminal justice program at the Carmel campus from September 2010 to January 2012 said, “I’ve been in financial hardship since then. I do not earn much in my current job. I work as a grocery stocker, and most of my check goes to paying off my loan. I had my hours cut about a year ago, and this led me to default on my loan, which has affected me greatly because I am not eligible for credit anywhere. My credit score is horrible because of this school. I cannot afford anything. I can barely make ends meet.”

Another student who majored in computer forensics and attended ITT Tech in Carmel from January 2009 to January 2014, said, “I can barely make ends meet. It has destroyed my nearly perfect credit score because I have had to make the choice to skip my loan payment in order to be able to buy food or make my rent for the month.”

Testimonials have come from throughout the U.S. One student who was enrolled in ITT's Network System Administration program at a Washington campus stated, "I joined the Army to pay for school, and ITT Tech mislead my dreams of higher education. Now I'm $10,000 in debt and have nothing to show for it. I‟m constantly being harassed by collection agencies and it's making me depressed."

Students who have their pay garnished to satisfy loans are often struggling to support themselves with low-wage or minimum-wage jobs that are a far cry from the high-salary positions promised by ITT recruiters, according to the complaint.

For example, one student says: "For crying out loud, I work at McDonald's as a drive-thru attendant 32-60 hours a week earning only $8p/h... and my husband has gotten laid off his $28,000p/y factory job… Because my daughter has a psychotic & behavior disorder . . . the state could file charges of child neglect and endangerment if I can't afford to buy food, pay rent/water/electric bills."

ITT Tech was one of the country’s largest for-profit college chains. Over the past decade, it took in more than $11 billion in revenue, 98 percent of which came in the form of tuition, according to the Legal Services Center of Harvard Law School. The center said 76 percent of the tuition was paid through federal student aid.

Originally part of the conglomerate ITT, the school spun off as its own publicly traded entity in 1999.

At the time of bankruptcy, the company operated 137 campuses in 39 states, providing career-oriented programs to 43,000 students under the names ITT Technical Institute and Daniel Webster College.

ITT's closure displaced more than 35,000 students and more than 8,000 employees, including at least 662 workers in Indiana. The company employed 275 people at its Carmel headquarters.

ITT reported assets of $389 million and liabilities of $1.1 billion to the bankruptcy court. The company’s assets include almost $80 million owed by ITT students who were enrolled at the time of the bankruptcy filing.

The students request a court order certifying the case as a class action, an injunction ordering ITT from collecting on all private students loans administered by ITT, actual and compensatory damages against ITT in an amount to be determined and an order awarding disbursements, costs and attorney's fees.

Deborah J. Caruso, the Chapter 7 trustee appointed by the U.S. Bankruptcy Court to oversee the liquidation, responded to the students' lawsuit in an email.

“Since the filing of these Chapter 7 cases in September, we have been working with state regulators, the SEC, the Consumer Financial Protection Bureau, and the Department of Education to better understand and address the causes of ITT’s collapse and develop a path forward,” Caruso said.

Call IndyStar reporter Fatima Hussein at (317) 444-6209. Follow her on Twitter: @fatimathefatima.

ITT Tech's collapse could help former students wipe out their loans

The rise and fall of Elizabeth Holmes: A timeline | CNN Business

CNN —

More than three years after Elizabeth Holmes was first indicted and nearly four months after her trial kicked off, the founder and former CEO of failed blood testing startup Theranos was found guilty on four out of 11 federal fraud and conspiracy charges.

The verdict comes after a stunning downfall that saw Holmes, once hailed as the next Steve Jobs, go from being a tech industry icon to being a rare Silicon Valley entrepreneur on trial for fraud.

A Stanford University dropout, Holmes – inspired by her own fear of needles – started the company at the age of 19, with a mission of creating a cheaper, more efficient alternative to a traditional blood test. Theranos promised patients the ability to test for conditions like cancer and diabetes with just a few drops of blood. She attracted hundreds of millions of dollars in funding, a board of well-known political figures, and key retail partners.

But a Wall Street Journal investigation poked holes into Theranos’ testing and technology, and the dominoes fell from there. Holmes and her former business partner, Ramesh “Sunny” Balwani, were charged in 2018 by the US government with multiple counts of wire fraud and conspiracy to commit wire fraud. (Both pleaded not guilty.)

Here are the highlights of the rise and fall of Elizabeth Holmes and Theranos.

March 2004: Holmes drops out of Stanford to pursue Theranos

Holmes, a Stanford University sophomore studying chemical engineering, drops out of school to pursue her startup, Theranos, which she founded in 2003 at age 19. The name is a combination of the words “therapy” and “diagnosis.”

September 2009: Ramesh “Sunny” Balwani joins Theranos as Holmes’ right-hand man

Balwani joins as chief operating officer and president of the startup. Balwani, nearly 20 years her senior, met Holmes in 2002 on a trip to Beijing through Stanford University. The two are later revealed to be romantically involved.

September 2013: Holmes opens up about Theranos; announces Walgreens partnership

A decade after first starting the company, Holmes takes the lid off Theranos and courts media attention the same month that Theranos and Walgreens announce they’ve struck up a long-term partnership. The first Theranos Wellness Center location opens in a Walgreens in Palo Alto where consumers can access Theranos’ blood test.

The original plan had been to make Theranos’ testing available at Walgreens locations nationwide.

September 2014: Holmes named one of the richest women in America by Forbes

Holmes is named to the magazine’s American billionaire list with the outlet reporting she owns a 50% stake in the startup, pinning her personal wealth at $4.5 billion.

Elizabeth Holmes speaking onstage at TechCrunch Disrupt on September 8, 2014 in San Francisco, California. Steve Jennings/Getty Images

December 2014: Theranos has raised $400 million

Theranos has raised more than $400 million, according to a profile of the company and Holmes by The New Yorker. It counts Oracle’s Larry Ellison among its investors.

July 2015: Theranos gets FDA approval for Herpes test

The FDA clears Theranos to use of its proprietary tiny blood-collection vials to finger stick blood test for herpes simplex 1 virus – its first and only approval for a diagnostic test.

October 2015: Theranos is the subject of a Wall Street Journal investigation; Holmes hits back

The Wall Street Journal reports Theranos is using its proprietary technique on only a small number of the 240 tests it performs, and that the vast majority of its tests are done with traditional vials of blood drawn from the arm, not the “few drops” taken by a finger prick. In response, Theranos defends its testing practices, calling the Journal’s reporting “factually and scientifically erroneous.”

A day later, Theranos halts the use of its blood-collection vials for all but the herpes test due to pressures from the FDA. (Later that month, the FDA released two heavily redacted reports citing 14 concerns, including calling the company’s proprietary vial an “uncleared medical device.”)

One week after the Journal report, Holmes is interviewed on-stage at the outlet’s conference in Laguna Beach. “We know what we’re doing and we’re very proud of it,” she says.

Holmes speaking at a Wall Street Journal technology conference in Laguna Beach, California on October 21, 2015. Glenn Chapman/AFP/Getty Images

Amid the criticism, Theranos reportedly shakes up its board of directors, eliminating Henry Kissinger and George Shultz as directors while moving them to a new board of counselors; the company also forms a separate medical board.

November 2015: Theranos and Safeway partnership falls short

Safeway, which invested $350 million into building out clinics in hundreds of its supermarkets to eventually offer Theranos blood tests, reportedly looks to dissolve its relationship with the company before it ever offered its services.

January 2016: Federal regulators take issue with Theranos’ California lab; Walgreens pulls back

Centers for Medicare and Medicaid Services (CMS) sends Theranos a letter saying its California lab has failed to comply with federal standards and that patients are in “immediate jeopardy.” It gives the company 10 days to address the issues.

In response, Walgreens says it will not send any lab tests to Theranos’ California lab for analysis and suspends Theranos services at its Palo Alto Walgreens location.

March 2016: CMS threatens to ban Holmes, Balwani from lab business

CMS threatens to ban Holmes and Balwani from the laboratory business for two years after the company allegedly failed to fix problems at its California lab. Theranos says that’s a “worst case scenario.”

May 2016: Balwani steps down; Theranos voids two years of blood tests

Balwani departs. The company also adds three new board members as part of the restructuring: Fabrizio Bonanni, a former executive vice president of biotech firm Amgen, former CDC director William Foege, and former Wells Fargo CEO Richard Kovacevich.

Theranos voids two years of blood test results from its proprietary testing devices, correcting tens of thousands of blood-test reports, the Journal reports.

June 2016: Holmes net worth revised to $0; Theranos loses its largest retail partner

Forbes revises its estimate of Holmes’ net worth from $4.5 billion to $0. The magazine also lowers its valuation for the company from $9 billion to $800 million.

Walgreens, once Theranos’ largest retail partner, ends its partnership with the company and says it will close all 40 Theranos Wellness Centers.

July 2016: Holmes is banned from running labs for two years

CMS revokes Theranos’ license to operate its California lab and bans Holmes from running a blood-testing lab for two years.

August 2016: The company unveils ‘miniLab’ device

Holmes tries to move past recent setbacks by unveiling a mini testing laboratory, called miniLab, at a conference for the American Association for Clinical Chemistry. In selling the device, versus operating its own clinics, Theranos seeks to effectively side-step CMS sanctions, which don’t prohibit research and development.

October 2016: Theranos investor sues the company; Theranos downsizes

Theranos investor Partner Fund Management sues the company for $96.1 million, the amount it sunk into the company in February 2014, plus damages. It accuses the company of securities fraud. Theranos and Partner Fund Management settled in May, 2017, for an undisclosed amount.

The company also lays off 340 employees as it closes clinical labs and wellness centers as it attempts to pivot and focus on the miniLab.

November 2016: Walgreens sues Theranos

Walgreens sues the blood testing startup for breach of contract. Walgreens sought to recover the $140 million it poured into the company. The lawsuit was settled August, 2017.

January 2017: More layoffs, followed by a failed lab inspection

Theranos downsizes its workforce yet again following the increased scrutiny into its operations, laying off approximately 155 employees or about 41% of staffers.

The Wall Street Journal reports that Theranos failed a second regulatory lab inspection in September, and that the company was closing its last blood testing location as a result.

April 2017: Theranos settles with CMS, and Arizona AG

Theranos settles with the CMS, agreeing to pay $30,000 and to not to own or operate any clinical labs for two years.

Theranos also settles with the Arizona Attorney General Mark Brnovich over allegations that its advertisements misrepresented the method, accuracy, and reliability of its blood testing and that the company was out of compliance with federal regulations governing clinical lab testing. Theranos agrees to pay $4.65 million back to its Arizona customers as part of a settlement deal.

March 2018: Holmes charged with massive fraud

The SEC charges Holmes and Balwani with a “massive fraud” involving more than $700 million from investors through an “elaborate, years-long fraud in which they exaggerated or made false statements about the company’s technology, business, and financial performance.”

The SEC alleges Holmes and Balwani knew that Theranos’ proprietary analyzer could perform only 12 of the 200 tests it published on its patient testing menu.

Theranos and Holmes agree to resolve the claims against them, and Holmes gives up control of the company and much of her stake in it. Balwani, however, is fighting the charges, with his attorney saying he “accurately represented Theranos to investors to the best of his ability.”

May 2018: “Bad Blood”

Reporter John Carreyrou, who first broke open the story of Theranos for the Wall Street Journal, publishes “Bad Blood,” a definitive look at what happened inside the disgraced company. Director Adam McKay (who directed “The Big Short”) secures the rights to make the film, starring Jennifer Lawrence as Holmes, by the same name.

June 2018: Holmes and Balwani indicted on criminal fraud charges

Holmes and Balwani are indicted on federal wire fraud charges over allegedly engaging in a multi-million dollar scheme to defraud investors, as well as a scheme to defraud doctors and patients. Both have pleaded not guilty.

Minutes before the charges were made public, Theranos announced that Holmes has stepped down as CEO. The company’s general counsel, David Taylor, takes over as CEO. Holmes remains chair of the company’s board.

Former Theranos COO Ramesh "Sunny' Balwani leaves the Robert F. Peckham U.S. Federal Court on June 28, 2019 in San Jose, California. Former Theranos CEO Elizabeth Holmes and former COO Ramesh Balwani were apperaing in federal court for a status hearing, both facing charges of conspiracy and wire fraud for allegedly engaging in a multimillion-dollar scheme to defraud investors with the Theranos blood testing lab services. Justin Sullivan/Getty Images

September 2018: Theranos to dissolve

Taylor emails shareholders that Theranos will dissolve, according to a report from The Wall Street Journal. Taylor said more than 80 potential buyers were not interested in a sale. “We are now out of time,” Taylor wrote.

March 2019: Theranos gets the documentary treatment

Alex Gibney, the prolific documentary filmmaker behind “Dirty Money,” “Enron: The Smartest Guys in the Room,” and “The Armstrong Lie,” debuts “The Inventor” on HBO, following the rise and fall of Theranos.

September 2020: Holmes’ possible defense strategy comes to light

A new court document reveals Holmes may seek a “mental disease” defense in her criminal fraud trial. Later, in August 2021, unsealed court documents reveal Holmes is likely to claim she was the victim of a decade-long abusive relationship with Balwani. The allegations led to the severing of their trials. His trial is slated to begin in 2022.

December 2020: Holmes’ criminal trial delayed til 2021

Initially set to begin in July 2020, Holmes’ criminal trial is further delayed til July 2021 due to the coronavirus pandemic.

March 2021: Holmes’ pregnancy further delays trial

News surfaces that Holmes’ is expecting her first child, once more further delaying her criminal trial. Holmes’ counsel advised the US government that Holmes is due in July 2021, a court document revealed. She gave birth in July.

Holmes collects her belongings after going through security at the Robert F. Peckham Federal Building with her defense team on August 31, 2021 in San Jose, California. Ethan Swope/Getty Images

August 2021: Holmes’ criminal trial begins with jury selection

More than 80 potential jurors are brought into a San Jose courtroom for questioning over the course of two days to determine if they are fit to serve as impartial, fair jurors for the criminal trial of Holmes. A jury of seven men and five women is selected, with five alternatives.

December 2021: Jury begins deliberating her fate

After three months of testimony from 32 witnesses, the criminal fraud case of Theranos founder Elizabeth Holmes makes its way to the jury of eight men and four women who will decide her fate. The jury would go on to deliberate for more than 50 hours before returning a verdict.

January 2022: Holmes found guilty on four of 11 federal charges

Holmes is found guilty of one count of conspiracy to defraud investors as well as three wire fraud counts tied to specific investors. She is found not guilty on three additional charges concerning defrauding patients and one charge of conspiracy to defraud patients. The jury returns no verdict on three of the charges concerning defrauding investors. Holmes faces up to 20 years in prison as well as a fine of $250,000 plus restitution for each count.

March 2022: After Hulu miniseries debuts, Balwani’s criminal trial kicks off

“The Dropout,” a scripted miniseries about Theranos produced by ABC, debuts on Hulu. Amanda Seyfried stars as Holmes and Naveen Andrews plays Balwani. Their romantic and professional relationship features prominently in the show.

Following delays due to Holmes’ prolonged trial then a surge of Covid-19, jury selection for Balwani’s trial gets underway. On March 22, opening arguments are held and the government’s first witness, a former Theranos employee turned whistleblower, is called to the stand.

July 2022: Balwani guilty of federal fraud

After four full days of deliberations, a jury finds Balwani guilty of ten counts of federal wire fraud and two counts of conspiracy to commit wire fraud. Like Holmes, Balwani faces up to 20 years in prison as well as a fine of $250,000 plus restitution for each count of wire fraud and each conspiracy count.

September 2022: Holmes asks for new trial, says a key witness expressed regrets

Holmes asks for a new trial after claiming that a key witness visited her house unannounced and allegedly said he “feels guilty” about his testimony.

In a court filing with the United States District Court for the Northern District of California, Holmes’ attorneys said Adam Rosendorff, a former Theranos lab director who was one of the government’s main witnesses, arrived at her home on August 8 asking to speak with her. According to the filing, Rosendorff did not interact with Holmes but did speak to her partner Billy Evans, who recounted the exchange in an email to Holmes’ lawyers shortly after.

“His shirt was untucked, his hair was messy, his voice slightly trembled,” Evans wrote about Rosendorff. According to Evans’ email, Rosendorff “said when he was called as a witness he tried to answer the questions honestly but that the prosecutors tried to make everybody look bad.”

The former Theranos lab director also “said he felt like he had done something wrong,” Evans wrote.

October 2022: Rosendorff takes the stand again

Rosendorff takes the stand again to address concerns from Holmes’ defense team and their claims he had shown up at her home after the trial concluded asking to speak with her and expressed regrets about his testimony.

At the hearing, Rosendorff reaffirmed the truthfulness of his testimony at Holmes’ trial and said that the government did not influence what he said.

November 2022: Request for new trial is denied

A federal judge denies Elizabeth Holmes’ request for a new trial, according to court filings, paving the way for the founder of failed blood testing startup Theranos to be sentenced later in the month.

DC attorney general sues Mark Zuckerberg over his handling of the ...

Washington CNN Business —

Washington, DC, Attorney General Karl Racine sued Mark Zuckerberg on Monday, accusing the Facebook co-founder of misleading the public on the company’s handling of privacy and personal data in connection with the Cambridge Analytica scandal.

The suit, filed in DC superior court, represents Racine’s latest attempt to hold Zuckerberg personally liable after a judge rejected an attempt last year to name Zuckerberg as a defendant in an ongoing suit against Facebook over the same issue.

Racine’s office has been locked in a legal battle with Facebook for years over allegations the company failed to monitor third-party apps’ use of user data and failed to disclose the leak of data to Cambridge Analytica, the analysis firm used by Donald Trump’s 2016 presidential campaign, on a timely basis. In 2018, Facebook said Cambridge Analytica may have had data from as many as 87 million of its users.

What made Monday’s suit against Zuckerberg possible now, according to Racine’s office, was a trove of evidence unearthed during the litigation process in the ongoing case involving Facebook.

“The evidence shows Mr. Zuckerberg was personally involved in Facebook’s failure to protect the privacy and data of its users leading directly to the Cambridge Analytica incident,” Racine said in a statement Monday. “This unprecedented security breach exposed tens of millions of Americans’ personal information, and Mr. Zuckerberg’s policies enabled a multi-year effort to mislead users about the extent of Facebook’s wrongful conduct. This lawsuit is not only warranted, but necessary, and sends a message that corporate leaders, including CEOs, will be held accountable for their actions.”

Meta (FB), Facebook (FB)’s parent company, didn’t immediately respond to a request for comment.

In a tweet, Meta spokesman Andy Stone said it is “an important time” to revisit Racine’s earlier failure to add Zuckerberg to the existing Facebook suit. Monday’s complaint was first reported by The Washington Post.

The complaint seeks to highlight Zuckerberg’s personal involvement in decisions surrounding Facebook’s data practices. It alleges, among other things, that Zuckerberg “provided direct input on Facebook’s internal policies relating to data sharing on the Platform, and was so involved that he personally reviewed certain applications’ use of data.”

The complaint continued: “As CEO, Zuckerberg had the authority to control and direct — and had knowledge of — Facebook’s deceptive trade practices and misrepresentations to District consumers.”

As a result, the complaint said, Zuckerberg should be held responsible under DC’s consumer protection law and ought to pay damages and restitution, along with being barred from violating the district’s consumer protection law again.

Racine had indicated in early April that his office was considering bringing a separate complaint against Zuckerberg, following repeated clashes with Facebook over document production.

Special counsel Durham alleges Clinton campaign lawyer used ...

CNN —

Special counsel John Durham accused a lawyer for the Democrats of sharing with the CIA in 2017 internet data purported to show Russian-made phones being used in the vicinity of the White House complex, as part of a broader effort to raise the intelligence community’s suspicions of Donald Trump’s ties to Russia shortly after he took office.

The accusation – which Durham couched in vague, technical language in a court filing late Friday – has been seized upon by Trump and his supporters, who claim the former President was subjected to a smear campaign.

Durham says in the filing that Michael Sussmann, the Democratic lawyer, spoke about internet data related to Trump in a meeting with a federal agency, which sources say was the CIA, more than five years ago. Sussmann claimed the information “demonstrated that Trump and/or his associates were using supposedly rare, Russian-made wireless phones in the vicinity of the White House and other locations,” according to the filing.

Durham’s office said it found nothing to support the allegation. The special counsel also noted that the data showed a Russian phone provider connection involving the Executive Office of the President “during the Obama administration and years before Trump took office.”

The data was compiled by a tech firm that had special access to the purportedly suspicious internet data through an “arrangement” with the US government, and that firm was in touch with Sussmann, according to the filing.

An executive at the tech company, Rodney Joffe, and his associates exploited this arrangement by mining domain name system traffic associated with the Executive Office of the President and other data “for the purpose of gathering derogatory information about Donald Trump,” Durham’s prosecutors wrote.

Joffe is not charged with any crime.

A spokesperson for Joffe said he “is an apolitical internet security expert with decades of service to the U.S. Government who has never worked for a political party, and who legally provided access to DNS data obtained from a private client that separately was providing DNS services to the Executive Office of the President (EOP).”

“Upon identifying DNS queries from Russian-made Yota phones in proximity to the Trump campaign and the EOP, respected cyber-security researchers were deeply concerned about the anomalies they found in the data and prepared a report of their findings, which was subsequently shared with the CIA,” the spokesperson added later in the statement.

Sussmann last fall pleaded not guilty to a charge of lying to the FBI about a separate meeting. Defense attorneys for Sussmann called Durham’s recent statements in court about the internet data “misleading.”

“The Special Counsel has again made a filing in this case that unnecessarily includes prejudicial – and false – allegations that are irrelevant … and are plainly intended to politicize this case, inflame media coverage, and taint the jury pool,” they wrote in a court filing Monday night.

They said Durham had a fact wrong: that Sussmann told the CIA about internet data related to Russian phones being used around the White House before Trump was President, and not from after he took office.

Durham’s most recent assertions in court about Sussmann implied that the CIA heard from him about Russian phones being used around the White House after Trump became President as a way to raise the intelligence communities’ suspicions about Trump.

But Sussmann says that isn’t so.

“Although the Special Counsel implies that in Mr. Sussmann’s February 9, 2017 meeting, he provided Agency-2 with (Executive Office of the President) data from after Mr. Trump took office, the Special Counsel is well aware that the data provided to Agency-2 pertained only to the period of time before Mr. Trump took office, when Barack Obama was President,” Sussmann’s lawyers wrote.

Sussmann’s team added that the reasons for concern that Sussmann took to the CIA about Trump and Russia weren’t intentionally manipulative.

Durham’s office says in the filing that he plans to use the information in it at Sussmann’s trial. Durham’s office declined to comment further.

Right-wing media outlets and Republican politicians, including Trump, are citing Durham’s court filing to accuse Hillary Clinton’s 2016 campaign of spying on Trump because of the use of the data.

But Durham’s court filing doesn’t allege that the pro-Clinton researchers’ use of internet data meant that there was any eavesdropping on content of communications.

Durham has used the Sussmann case to more broadly draw attention to the role of unsavory political opposition research in the 2016 election.

Sussmann is charged with making a false statement to the FBI about his representation of the Democrats, when he shared data that pro-Clinton researchers believed linked Trump Organization servers to a Russian bank in 2016.

The five-year statute of limitations appears to have passed for Durham to accuse Sussmann of any wrongdoing related to his meeting with the CIA. Passing along information from researchers to intelligence officials for further investigation is not uncommon and isn’t necessarily a crime.

The new details were included in a more mundane request to have Sussmann agree to waive any conflict-of-interest issues that could arise because his lawyers have represented others connected to the investigation in the past.

Sussmann is set to go to trial in a few months, and the case is largely expected to be based on the testimony of former FBI General Counsel James Baker, who has made shaky statements in testimony over the past few years about his memory of his interactions with Sussmann.

This story has been updated with additional details and reaction.

Katelyn Polantz Evan Perez
Katelyn Polantz
Evan Perez

The 5 key takeaways from the Twitter whistleblower | CNN Business

Washington CNN Business —

Twitter’s former head of security is blowing the whistle on company practices that he says have jeopardized US national security and misled investors and regulators. With a nearly 200-page disclosure to the US government, Peiter “Mudge” Zatko has become the latest whistleblower to come forward from the tech industry.

Zatko levels a barrage of devastating allegations that US lawmakers who have received the disclosure say are extremely concerning. A highly respected cybersecurity expert with experience in senior roles at Google, Stripe and the Defense Department, Zatko claims Twitter (TWTR) (TWTR) is full of critical security flaws; may not be deleting the data of users who leave the platform as it is required to do; has misled the public about its spam account problem; may currently have foreign intelligence agents on the payroll; and that it hasn’t lived up to years of legal obligations stemming from an earlier privacy settlement with the Federal Trade Commission, which could lead to further liability.

Here’s more on some of the top takeaways from Zatko’s disclosure.

Twitter is riddled with security vulnerabilities.

One of Zatko’s biggest allegations is that Twitter data is not secure. The company routinely lets thousands of employees — accounting for roughly half its workforce, and all its engineers — work directly on Twitter’s live product and interact with actual user data, the report alleges. That’s a big departure, Zatko claims, from the standard at companies like Google and Meta, where developers are required to use dummy data to perform coding and testing in specialized sandboxes that don’t touch the main products consumers use.

This single fact, according to Zatko, creates a host of security problems: The potential for rogue employees to snoop on Twitter users’ information, or that a poorly coded update could make parts or all of the platform unusable, or that insider threats may give outsiders significant access to Twitter’s systems in ways that would not be possible at other companies. In multiple situations, Twitter learned that employees had intentionally installed spyware on their computers at the behest of third-party organizations, according to the disclosure. It is not clear how many employees may have been involved in the spyware incidents.

Twitter headquarters in San Francisco, California, U.S., on Monday, July 19, 2021. David Paul Morris/Bloomberg/Getty Images

This kind of expansive access is what contributed to a 2020 incident in which hackers gained control of high-profile accounts belonging to Joe Biden, Barack Obama, Elon Musk and a range of other powerful people. And it is responsible, Zatko alleges, for a dizzying rate of security incidents — approximately one per week — that the public may not hear about but that are so serious the company is obligated to report them to authorities like the Federal Trade Commission and Ireland’s Data Protection Commission.

Zatko also alleges Twitter does not reliably delete users’ data after they cancel their accounts, in some cases because the company has lost track of the information, and that it has misled regulators about whether it deletes the data as it is required to do.

In response to more than 50 specific questions from CNN regarding the disclosure, Twitter said members of its engineering and product teams are authorized to access Twitter’s platform if they have a specific business justification for doing so, but that members of other departments — such as finance, legal, marking, sales, human resources and support — cannot. The company also said it uses automated checks to ensure laptops running outdated software cannot access the production environment, and that employees may only make changes to Twitter’s live product after the code meets certain record-keeping and review requirements.

Twitter’s employees use devices overseen by other IT and security teams with the power to prevent a device from connecting to sensitive internal systems if it is running outdated software, Twitter added.

And it has created internal workflows to ensure users know that when they cancel their accounts, Twitter will deactivate the accounts and start a deletion process, Twitter said. Twitter declined to say whether it typically completes the process.

Twitter could easily calculate a better metric to estimate spam accounts, but it chooses not to.

Zatko’s disclosure could give Elon Musk more ammunition to claim Twitter is being evasive about bots — an argument Musk has put forward to justify wanting to back out of buying Twitter for $44 billion.

Video Ad Feedback What the Twitter whistleblower disclosure says about Elon Musk and bots 04:11 - Source: CNN Business

For years, Twitter has said in investor filings that fake or spam accounts represent less than 5% of the daily active users Twitter believes it can monetize with advertising. But Zatko’s disclosure claims the statistic might not present a full picture of the number of spam accounts on the platform, because it does not represent spam accounts as a percentage of all accounts on Twitter — merely as a subset of some selected Twitter users the company finds commercially meaningful.

In 2021, Zatko says Twitter’s site integrity chief told him the company doesn’t really know how many bots there may be on Twitter. Executives had no incentive to find out, Zatko alleges in the disclosure, because “they were concerned that if accurate measurements ever became public, it would harm the image and valuation of the company.”

In light of that allegation, a tweet in May by Twitter CEO Parag Agrawal claiming the company is “strongly incentivized to detect and remove as much spam as we possibly can, every single day,” is a flat-out “lie,” Zatko’s disclosure says.

Twitter has told CNN that the claim it doesn’t know how many bots are on its platform lacks context, reiterating that not all bots are bad and adding that to focus on the total number of bots on Twitter would include those the company may have already identified and taken action against. The company also does not believe it can catch every spam account on the platform, Twitter said, which is why it reports its less-than-5% figure, which reflects a manual estimate, in its financial filings.

Twitter did not respond to Zatko’s allegation about Agrawal’s tweet being a lie.

Some or all of Twitter’s services could be forced offline, perhaps forever.

Partly due to its cybersecurity issues, Zatko’s disclosure says, Twitter’s data centers are constantly at risk of going down. And the company has misrepresented its ability to recover from simultaneous data center outages, Zatko alleges. More than half of Twitter’s 500,000 servers run on outdated software, the report claims; many allegedly lack basic security standards such as the ability to encrypt stored data, while other servers no longer receive vendor support because the software they run on is too old.

Peiter Zatko, known as Mudge in the computer hacking community, poses for a portrait on August 22. Sarah Silbiger for CNN

If multiple data centers fail at the same time, Twitter’s lack of a comprehensive recovery process could make it a potentially catastrophic incident forcing Twitter to shut down for months or even permanently in an “existential company ending event,” according to the disclosure.

Twitter also hasn’t paid for the intellectual property rights to all the datasets that train its artificial intelligence, the disclosure alleges. As a result, Zatko claims, some of Twitter’s core features, such as the recommendation algorithm that decides what tweets to show to users, may be operating illegally.

If the companies that supply the data ever sued to enforce their rights, it could lead to steep financial losses for Twitter and potentially even force it to stop offering the features the alleged infringement helped create, according to the disclosure.

Twitter did not respond to Zatko’s allegations about data center outage risks or intellectual property violations.

Twitter is vulnerable to foreign exploitation and may even now have foreign spies on its payroll.

Due to Twitter’s weak overall cybersecurity stance, foreign governments that gain access to the company — or that can find leverage against it — could do enormous damage to US interests and national security, the disclosure alleges.

The threat is not theoretical, according to the report. It claims that shortly before Zatko was fired from Twitter in January, the US government gave Twitter a specific tip that one or more of its employees was working for a foreign intelligence agency.

It’s not clear whether Twitter knew, or if it has acted on the information. But it would not be the first time: The disclosure is being made public just days after a jury convicted a former Twitter employee of spying for Saudi Arabia. That incident, which was uncovered in 2019, predates the tip described in the disclosure.

The disclosure also alleges that Agrawal, while he was Twitter’s chief technology officer and in the months before Russia’s invasion of Ukraine, proposed making concessions to Russia that could have helped the company grow in the country at the cost of allowing broad-based censorship or surveillance of the platform.

The Twitter Inc. logo is seen on coffee mugs inside the company's headquarters in San Francisco, California, U.S., on Friday, Sept. 19, 2014. David Paul Morris/Bloomberg/Getty Images

“The fact that Twitter’s current CEO even suggested Twitter become complicit with the Putin regime is cause for concern about Twitter’s effects on U.S. national security,” the disclosure reads.

The disclosure also claims that Twitter has taken money from Chinese sources and shared information in return that could potentially lead to the identification of Chinese Twitter users who have illegally circumvented government censorship in order to access the platform. Executives are aware of the risk but believe the company is too reliant on the money to stop taking it, the disclosure says.

Additionally, Zatko claims that India has “forced” Twitter to hire government agents who would have wide-ranging access to internal Twitter systems, and that the company has not disclosed the fact in its transparency reports. Twitter’s tensions with India have run high as civil rights experts have said the country has increased digital authoritarianism amid the pandemic.

Twitter did not respond to Zatko’s allegations concerning China, Russia, India or the US government tip. A person familiar with the matter, and with Zatko’s tenure at Twitter, told CNN the Indian agents Zatko describes are government-mandated roles the country requires of tech platforms under its local laws.

Twitter is violating its many commitments to the FTC.

Zatko’s disclosure alleges “extensive, repeated [and] uninterrupted” violations of federal law barring unfair or deceptive business practices.

In his disclosure to the US government, Zatko claims Twitter deliberately misled regulators about its handling of user data and that the company is not living up to its obligations under a 2011 privacy settlement with the Federal Trade Commission — a legally binding order that requires, among other things, the creation of “reasonable safeguards” to protect users’ personal information.

Twitter has knowingly misled regulators, including the FTC, that ask whether Twitter deletes the data of users who cancel their accounts, according to the disclosure. The company has told regulators it “deactivates” the accounts, but can’t truthfully say it deletes the data because in some cases the company has lost track of it, Zatko alleges. Twitter also knowingly misled the FTC and French regulators on its intellectual property rights violations, the disclosure claims.

The report says user security data — such as email addresses and phone numbers — were actively being misused for advertising purposes even as Twitter and the FTC were already negotiating a settlement in 2020 to resolve a prior instance of that very same type of misuse.

The disclosure raises concerns about how Twitter handles user data. Adobe Stock

Claims that Twitter mishandled user data and deliberately misled regulators; that it failed to develop robust cybersecurity practices; and even that it failed to fill a key information security job in a timely manner all reflect violations of either the Federal Trade Commission Act or a 2011 FTC settlement that required Twitter to better protect user privacy, according to the disclosure.

One of the key requirements of the 2011 consent order was that Twitter implement a “uniform process to develop and test software,” according to the report. Ten years on, and Twitter has only a template for that process, rather than an actual process, and it covers just 8% to 12% of company projects, the disclosure says.

When he arrived at Twitter, Zatko’s subordinates told him “unequivocally that Twitter had never been in compliance with the 2011 FTC Consent Order, and was not on track to ever achieve full compliance,” the disclosure says.

The FTC settlement was supposed to force Twitter to shape up after hackers in 2009 gained access to internal Twitter systems. Instead, “things actually got meaningfully worse,” the disclosure claims. A finding that Twitter has violated its FTC order could lead to billions in new fines and draconian new obligations, legal experts say.

Twitter told CNN its FTC compliance record speaks for itself, citing third-party audits filed to the agency under the 2011 consent order in which it said Zatko did not participate. Twitter also said it is in compliance with relevant privacy rules and that it has been transparent with regulators about its efforts to fix any shortcomings in its systems.

Zatko’s allegations are based in part on a failure to grasp how Twitter’s existing programs and processes work to fulfill Twitter’s FTC obligations, the person familiar with Zatko’s tenure told CNN, saying that that misunderstanding has prompted him to make inaccurate claims about the company’s level of compliance.