Hacker News Reader

Comment by throwoutway | Hacker News Reader

At this point, the Twitter board needs to bring in an outside investigatory team.

Mudge, who is well respected in the industry, is saying the executives are lying to the board.

Twitter’s CEO publicly mocks him, refuses to testify to Congress, and instead we hear that people are being offered money to dish dirt on their respected colleague.

If Twitter’s board does not act, then they’re willfully ignorant to the behavior and that negligence is going to harm investors. Lastly, if the board does not act, then the investors need to bring this to vote at the next shareholder meeting.

View on HN

Why did Twitter pick Agrawal for their CEO. I hadn't read anything about him before Mudge's revelations and every single thing I've read since has not been kind to him. He seems to be doing a really bad job navigating this event and nobody appears to have any respect for the guy.

But you don't get to be CEO of a company the size of Twitter if you are this bad at managing. So, what's going on?

I've wondered the same thing. He had one of the most epic upward trajectories of anyone ever going from rank and file to CEO of a multibillion dollar company. Did he even have any other job on his resume?

I assume he has some connections that let him shoot up through the ranks. I think his wife is a general partner at a16z, maybe that has something to do with it? But a lot of people fit that bill who might want to get their bestie listed as CEO

Maybe Jack saw a shitstorm on the horizon, and Agrawal was naive or willing enough to become the patsy?

Maybe every other possible executive at the company knew how to read the tea leaves? A lot of people don't want to be company CEOs because it's a lot more visible and higher-pressure than merely being CXO or SVP of X.

Also can carry serious criminal liability via Enron Response Regulation Sarbanes Oxley "The Sarbanes-Oxley Act of 2002 requires the CEO and CFO of publicly traded companies to issue a statement certifying that the accompanying financial statements and disclosures fairly present, in all material respects, the operations and financial condition of the company."

Has that ever come up in practice, particularly for a company the size of Twitter?

No. We've had a generation of tech companies with Unparalleled relative lobbying power in DC rewrite the rules in Non-GAAP accounting. The pendulum swings both far and fast.

He runs the company himself without any interference from Jack, how is he a patsy?

That separation is what we call "plausible deniability."

"How did person C get this position? Oh he's just a fall guy for person D." will start to be believable to me when I see it happen in the real world at least once. So far it's only something I've seen in Game of Thrones and Japanese Animes.

So, Big Head is running Twitter?

His LinkedIn "Experience" sure is unusual; seems like he basically held a few internships until joining Twitter as an engineer. 10 years later, he's CEO.

He's Indian. Just like all the other tech companies that put Indian's in charge, it's to get more access to India. The next billion users.

Reminds me of when GM got their first woman CEO right ahead of a massive scandal.

To be honest this whole thing seems overblown to me, Zatko is complaining that the board weren't aware that Twitter had massive security holes. There is one small problem with this accusation. Twitter's board hired famous ethical hacker Mudge to tackle their security issues. Maybe Zatko will eviscerate Mudge's failings under oath, but that doesn't get you very far since Zatko is Mudge*.

Zatko was hired by the CEO (Dorsey) and reported to the CEO and CTO, not the board.

Zatko says an inaccurate and misleading security report was going to be made to the board at their Dec 9/21 meeting and he was able to stop it. Agrawal let the report go to the board's Risk Committee a week later.

Zatko then reported that the Risk Committee meeting report was fraudulent (because of the inaccuracies?) and was fired two weeks later. Twitter then paid him $7 million to shut up but an NDA can't block an SEC whistleblower complaint.

I took all that information from this article: https://www.washingtonpost.com/technology/interactive/2022/t...

Yes, but if you read his complaint, he makes clear direct statements that Agrawal lied about things that are clearly jdugement calls, so he's already established himself as over-reaching. It's also worth noting $7m is not a big severence for this kind of departure - Swisher weighed in on this and her reaction to 7m was "that's not a big severence for this sort of thing", let alone to cover up wrongdoing.

>>being offered money to dish dirt on their respected colleague.

that dirt also better be security related, not digging up ex's or that he told an offensive joke one time at a conference years ago which seems to be the SOP for "dirt" these days

The board's behavior is a really interesting point. On one hand, they are doing the owners (stockholders) a dis-service by first being gullible enough to be successfully kept ignorant about the company's security situation, and then not making rapid management changes upon being alerted to it(by Mudge, it seems). On the other hand, if they can successfully get Musk to pay the offer price, they have then represented the owners interests very effectively.

The fact that the case is coming up soon makes me think that the board thinks they can focus on the case for now, and fix the company's problems later, after the case, if they win it. If the case looses, they'll be out of a job anyway and it will be some other board's problem.

> The board's behavior is a really interesting point

The board know about the poor security. But they also see the Equifax leak (far worse than the data twitter holds), and how small that fine was, and they make the conscious decision not to invest in security.

They also know they might be given government incentive money/contracts to increase security against foreign agents. If they do the work now, they won't get paid that money.

Win win!

Thank you for pointing out that the Equifax data breach was much worse. Twitter is just an easy target because politicians use the platform to spread their political message, and so if they can threaten them then that only helps the platform cater to their cause.

> if they can threaten them

Im going to leak your public tweets or else

The fact that he is still CEO tells me all I need to know about the board.

Mudge is a seriously decorated security expert. Parag is a nobody.

The second he tried to discredit Mudge, he should have been out. But here we are.

I wouldn't touch that stock with my worst enemy's money.

The board and the shareholders are massively incentivized not to show that the execs are lying though, even if they know for certain that they are lying.

> that negligence is going to harm investors.

Only if the truth comes out. If you can control the narrative long enough, it becomes indistinguishable from reality, at least as far as the markets are concerned.

You are speaking from the alternate universe where people care if any of this stuff is ethical. In reality only a tiny cohort of message board nerds (I'm including myself) care and 95% of twitter users, if they ever hear about it all will be over it in about 5 seconds.

But activist shareholders could sue the board / executives for breach of their duties and get money out of it. Whether or not they actually care, they could pretend to care in order to profit from it.

Regardless if it’s true, they could say they lost out on Elons buyout because the board acted inappropriately before and during the buyout negotiations.

You are making the risk assessment the expected value of legal action is higher than the expected value of market returns or other applications of that same fund.

I'm not sure where you gained such confidence.

Fiduciary responsibility is not an alternate universe. Neither are ethics rules. Publicly traded companies have many rules they need to follow, and executives & board members can face suits & fines for breaking them

> Mudge, who is well respected in the industry

Keep in mind, although he's classed as an 'ethical' hacker, many whitehats come from blackhat backgrounds, and turned whitehat because of fear of getting caught up in draconian CFAA[0] trials. Every hacker in their youth done some stupid stuff that could haunt them later. If you didn't do stupid stuff in your youth, you never really grew or learned from it.

[0] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

That's why you don't request your personal file from the FBI, either they have a file on you from your youth or you have given them reason to suspect you did something at some point. I'm curious, but not that curious.

Tens of thousands of people FOIA their DOJ files each year. Unless you're already pinged for something, I doubt the FBI is going to expend any additional effort solely because you've asked for some personal files.

>If you didn't do stupid stuff in your youth, you never really grew or learned from it.

So, he's... just like most people? Do you have any specific incident(s) to point to, re: Mudge, or is this just speculation that can be applied to nearly everyone?

Mudge held a significant position within the Department of Defense.

That doesn't happen without having any skeletons in your closet identified and investigated.

> That doesn't happen without having any skeletons in your closet identified and investigated.

Yup. They would have gone in with a proctoscope, and would not have tossed him an ID card, unless he could completely convince them that he's good for it.

If they are looking for dirt, they won't get it. I assume they are intelligent people, and know that, so maybe they are actually doing what has been suggested; looking for as much accurate information as possible -either way.

NPD is a multibillion-dollar company, because they sell accurate information; not information that people want to hear (how they get that information, well, that's another matter).

> They would have gone in with a proctoscope, and would not have tossed him an ID card, unless he could completely convince them that he's good for it.

Astronauts undergo detailed psyche exams, personality evaluations, and usually have some level of security clearance. And yet..

https://www.wikipedia.org/wiki/Lisa_Nowak

11 years after getting clearance she committed assault as a jilted/cheated lover and that somehow means they missed something?

How is that relevant to whether someone has a skeleton in the closet when they are getting a background check?

Not only that, but we know fabrications happen and take years to dispel. If a powerful entity wants to ruin your reputation, they can and do not need truth behind them.

It's courageous for him to speak the truth (at least his observations) when they were unwilling to and actively try to undermine it.

> Yup. They would have gone in with a proctoscope, and would not have tossed him an ID card, unless he could completely convince them that he's good for it.

This is a mild overstatement. DARPA doesn't necessarily require clearances for PMs; even if a particular project does, it's not necessarily one that requires the "full-scope" process (meaning polygraph and the rest of the works).

I wound't be surprised if Mudge had to fill out an SF-86, but that's not that invasive as far as background investigations go. It's nearly identical to the process used for Global Entry.

What kind of clearance do you actually need to be a DARPA PI?

None that I'm aware of (or can find on DARPA's site). DARPA might help a PM maintain their clearance if they already have one, but I don't think they require one for new PMs (unless the project directly requires classified information, which of course some do).

@throwawaylol_ is correct. I'm afraid you're mistaken.

I saw your other comment as well, thanks.

(I don’t know why ‘throwawaylol_ is flagged; I vouched for their comment.)

In talks, Mudge has referenced participation in various Pentagon projects that would definitely require a nontrivial clearance.

I'm not doubting so much as asking curiously: I've participated in what I'd guess are fairly sensitive Pentagon projects (commercially, over about a year and a half†) and I've never been cleared for anything.

† None of it involved vulnerability research; this was back in my anti-DDOS days.

Same, except I was directly involved in vulnerability research and mitigation and didn't need clearance. You only need a clearance if you are directly privy to information requiring said clearance.

That would depend on the project, and what aspects of it you might be involved in.

Mudge was a DARPA PM; that's a significant position in the sense that he led DARPA-funded research programs, but I don't think it's one that actually requires a clearance.

Source: currently do DARPA-funded research. No PM has ever mentioned having a clearance to me, and the work itself is entirely uncleared.

To be fair, marshray did not mention clearance, just that some skeletons would be looked for. Getting cleared is not the only time or the only way the federal government does that sort of thing.

Sure. I actually wouldn’t doubt that Mudge was already a known entity to USG. I just wanted to dispel some of the clearance voodoo that comes along with “significant position within the Department of Defense.”

In his most recent testimony, Mudge mentioned that he was in the leaked OPM database with his details and clearance level leaked which implies he had clearance.

Did he mention a clearance level, or just being in the OPM breach? My understanding is that the OPM breach included plenty of uncleared employeesas well.

(I’m not trying to be stubborn! If he really did hold a clearance as a DARPA PM, then I’m wrong in his case.)

You could have been in the OPM database being a janitor at the VA.

Although that wording about "Clearance level" does seem to suggest more than just the baseline government employee background check.

Yeah, that’s the part I’m curious about: there are plenty of “public trust” or SBU roles that I’d expect to have been leaked with the OPM breach that are “cleared” in the pop sense of the word, but are not actual clearances in the US Government’s sense.

That doesn't necessarily mean Mudge had a Secret clearance or something. For all we know, he could have had a Public Trust position, which meant he handled sensitive but unclassified information. Anybody in IT or infosec would have that kind of clearance.

https://en.wikipedia.org/wiki/Sensitive_but_unclassified

https://news.clearancejobs.com/2020/09/01/what-is-a-public-t...

> but I don't think it's one that actually requires a clearance.

In general, it doesn't. For some project areas it sometimes does. It really depends.

Right. The context in question is I2O, since that’s the office that Mudge was a PM in. I’d expect other offices to have different expectations around clearances, particularly the ones that do ballistic or aerospace research.

You kidding? You ever visit the office? It’s no joke, you need clearance to take a piss.

I’ve been inside of the DARPA building a handful of times, without a clearance. I did have to sign in and show ID, however.

It's maybe possible I2O didn't require clearances when Mudge was a PM. Certainly at least since they moved to their current location everyone who works in the building or for the organization is cleared*.

Most programs themselves are unclass, and there are lots of collaborations in fundamental research where it's completely open, not even controlled unclass (CUI). That doesn't imply anything about the PM's clearance status. Not sure why a PM would go out of their way to talk about clearance status unless they were specifically planning for classified discussions. Your point about having a clearance not being some huge deal is certainly true though.

*Some support service people like janitorial may not be - I don't know, but then those people are escorted by people who are.

I have had several friends go through the interviews to get TS-level clearance. The point of getting a clearance is to get the dirt out on the table, not to find dirt. You can get one with many skeletons, and if you are honest about their presence, nobody minds.

This is a no-true-Scotsman argument where none was asked for, but thank you for linking to Wikipedia properly.

“Ethical” hacker is also a nonsense term. Ethics means the study of moral philosophy, it is not a synonym for “good” and to use it as such belies a superficial understanding of both morality and hacking.

> “Ethical” [...] is not a synonym for “good”

I think it's generally accepted that these days it is a synonym for, if not "good" per se, at least "morally acceptable".

I got into infosec consulting perfectly cleanly, as did most of my peers. Sure some of them were involved in shenanigans in the distant past, but that is a very broad brush to paint with and seems out of place here given zero specific knowledge about Mudge and what he may or may not have done just because he is in an industry where some people occasionally did some questionable things in the past.

Reply on news.ycombinator.com