Sen. Durbin resuming the hearing. Sen. Whitehouse for questions. Sen. Whitehouse . Thank you very much. Mr. Zatko, i wanted to follow up a little bit on the repeated suggestions you have made in your testimony that the cybersecurity vulnerabilities will expose the United States to risks and to attacks and that security failures threaten the countrys National Security. Good with that . Peiter yes, sir. Sen. Whitehouse i guess he didnt add buyers we saw the same thing with facebook when they were taking ads with payments denominated in rubles and not figuring out that might have been russians behind those ads, and you mentioned concerns about hidden chinese ad buyers. If we could talk a little bit more about the National Security risks associated with, for instance, the unregistered Saudi Foreign agent who worked at twitter or the pressure to hire Indian Government agents, walk us through a scenario of how an individual planted in twitter like that could create a National Security risk for United States, and if you would, a particular reference to the fact that, at least when i use twitter, im sending stuff out thats intended to be public. So, how in that environment can a Foreign Agent create a National Security risk of any significant nature . Peiter yes, sir. There are several aspects to that. There is the nonPublic Information that we have spoken about earlier today. Your phone number, your email address, things that are not advertised to the world. I believe 200 million, if we want to say, regular users, not necessarily from a national severity standpoint, twitter in 2020 internally assessed that they logged information on 200 million users, email addresses, phone numbers, other information like that. This is the information that you need in order to start taking over other peoples accounts. With their phone number and an email address, i can hijack your phone number, i can change your gmail, coinbase, ameritrade, other accounts. I can cause financial harm that way. I can assume your identity. More importantly, i probably want to be able to understand your whereabouts, your network, and understand i will give you an example, in Foreign Governments are concerned, and we could apply that to the United States, there were requests for information about members of the farmers protest. There might be organizations or groups in the United States where once i know your home address and your home phone number, i can approach you in real life. I can put pressure on you, i can possibly recruit you. You can be an unwitting accomplice. I can influence you or target you for influence operations in the real world. Sen. Whitehouse let me just offer the thought that my home address and phone number and email address are pretty widely known, and indeed, in the public domain. How does twitter access to that information is there more . What is the difference between being able to look me up in the phone book and having twitter access the information . Peiter having been in the Public Sector myself, yes, a lot of my information became known. There is also a lot of people who are in particular roles where that information is not known, and the targeting of them perhaps staff, aides, people around you influencing to build that network, which we have seen not in twitter, but which the u. S. In the Intelligence Community has seen as part of the Intelligence Community. Sen. Whitehouse ok, so just lay that out for me a little bit more, given that so much of this information is available through other channels. What with the endgame the four what with the endgame be for, lets say, a Foreign Government trying to put pressure on somebody who could take a difference or make a difference or a decision to the benefit of the foreign country . Peiter identifying a relative, family member, colleague who has Financial Issues or has other elements that can be leveraged against them, to help them influence you in a particular fashion without your awareness. Sen. Whitehouse somebody would be able to create a sort of family or personal network around an individual twitter user and extract information about folks and then to work folks in that network . Peiter that is one particular aspect sen. Whitehouse how would that take place . If somebody has gotten into the twitter system, how would they find that out . Peiter it might be used in combination with other data election sources. One of the concerns about u. S. People traveling to other countries is was there information in the opm database, and cannot information be crossindexed across can that information be crossindexed across the Health Industry databases that have been lost . Do we know that this person has a particular political bias on twitter and start to try all of these things together for people of influence or access within governments are within sensitive positions. Sen. Whitehouse thanks very much. My time is up. Senator sen. Durbin senator graham im sorry, senator cornyn. Sen. Cornyn i want to explore the kind of data on american citizens that can be used for appropriate organ appropriate services for you are familiar with the concept of ubiquitous surveillance, are you . Peiter i can put those together and get the general context, i believe, sir. Yes. Sen. Cornyn basically all the cameras that are publicly posted data on your smartphone. You talked about geolocation data, the type of transactions you engage in, where your home is, how much you paid for it. Even google earth may have taken a picture of your home or your pace of place of business. There are already huge volumes of Data Available for whatever purposes, even above and beyond what social media collects, correct . Peiter yes, sir, there is a lot of information about a lot of us in many different ways available through technology right now. Sen. Cornyn and i daresay, i bet most americans cant fathom the volume of data, and that is without even getting to things like social media. For example, 2015 i think it was, there was a hack of the office of Personnel Management records. I think was 22 million records of government employees, including the applications for security clearances, was hacked reportedly by the peoples republic of china. If people decide that they want to figure out their family ancestry and use one of the dna testing companies, my understanding is many of the testing much of the testing is outsourced to places like china, where obviously it is not secure from Chinese Government access. We were talking about the privacy concerns of americans. This is not just limited to platforms like twitter and social media, correct . Peiter that is correct, sir. I was informed i was in that opm database and my security clearance information was collected as well. Sen. Cornyn turning to twitter, you have talked about the lack of what i would call protection from Insider Threats in the Intelligence Community. A few are working the Intelligence Community, they have logging protocols on who accesses what information. It can be determined if there was inappropriate access. That is the sort of protocols or mechanisms that were not available in places like twitter when you work to, correct . Peiter yes, sir, correct. Sen. Cornyn and so anyone who could get access to that information could, on top of all of the information that i ask you about earlier outside of social media, if you look at the cumulative data picture, is that the kind of information that Foreign Governments like the peoples republic of china are regularly accessing for their purposes . Peiter i cant say whether they are regularly accessing. I dont have that direct information. I am aware that some people and organizations have gotten very good across very large amounts of Data Collected very good at cross indexing across very large amounts of data. Twitter would be a decent contribution to that multisource collection. Sen. Cornyn and that is where things like Artificial Intelligence can come into comb or mine vast sources of data for more targeted or narrow purpose. Peiter the ability to collect and mine, yes, as been augmented by modern ai techniques. Sen. Cornyn so there are what i would call defensive concerns about peoples or individuals or governments access to your personal data, but there are also offensive concerns is welcome and that is where the issue of disinformation or a term that became popularized during the 2016 election aftermath was active measures. These are efforts by Foreign Governments for Intelligence Service to actively create a narrative or a message that is simply propaganda by this Foreign Government that could be used to influence American Public opinion. Is that accurate . Peiter yes, sir, not just american. That is happened worldwide, such as in myanmar, in 20 facebook acknowledging that disinformation campaigns on the platform contribute to genocide. Sen. Cornyn and as you pointed out earlier, when you look at the Data Available on each one of us as american citizens for whatever purposes, good or ill, there is also a lot of information about who we interact with. Something in the Intelligence Community, sometimes they talk about pattern of life. Maybe you want to talk about a network of friends and associates, family members, and the like, from which inquiring minds could obtain Additional Data about us. Peiter yes, and to your point, Information Operations are a concern. Twitter acknowledges they do happen on the platform. They have disclosed numerous ones, and they are aware of others that are ongoing. Sen. Cornyn i am aware that tiktok, which is a chinese company, i believe, and even instagram, which is owned by facebook, have 13yearold age restrictions in terms of terms of use. But there is no limitation on peoples ability to pretend to be an adult, pretend to be somebody they are not, and gain access to social media account and use it for whatever purpose they wish. Peiter i cant speak to tiktok or facebook. Im not familiar with their internal technology for agegating. I do know that was a challenge at twitter, and the majority of agegating was voluntary Self Reporting of what your age was. Sen. Cornyn finally, can you tell me, do you have recommendations based on your 30 years of experience in terms of Data Security on what sort of regulations or laws that congress and the federal government should consider passing . We dont have time to talk about all of those here today, but we would certainly welcome any of your recommendations and insights. Do you think this needs to be an area where the federal government needs to be actively engaged . Peiter yes, sir, i do. I would be happy to supplement my written report. Sen. Cornyn thank you. Sen. Durbin thank you, senator cornyn. Senator hirono. Sen. Hirono thank you for coming to testify, mr. Zatko. Your testimony and all your responses to the various questions we asked you says to me that the situation regarding Data Security and National Security issues with regards to twitter is massive, that twitter is not doing very much to be helpful at all. In fact, there are major disincentives to twitter doing anything to spending the time or the resources to address the concerns that you raise. For example, the fcc, very under resourced with regard to china to keep twitter under any kind of Consent Decree entered into back to 2011, more recently they are contemplating making twitter pay 150 million for some misuse of information, 150 millidollars 150 million fine for a multibillion Dollars Companies nothing for any incentives for them to change what they are doing. And yes, there is information out there from so many different sources, including appliances, cars, and anything else. However, twitter is a huge, if i can call it, single platform to access. Who is going to force twitter really to do anything if we were to adopt some of the legislation that is contemplated, if we dont have an agency that can implement and enforce that law, then we are back where we started. What is it going to take to force twitter to change its ways . Peiter well, this starts at the top at twitter, and you need an executive team that is willing to go in and say the executive team themselves acknowledged, and i heard them say we have 10 years of unpaid debt here and at some point we need to get ahead of they need to prioritize that. The boards primary role is to make sure the right executives are in charge of the company, the ceo in particular, to make sure they are sending the company in the right direction. This needs to be a longterm incentive rather than shortterm incentive for the companies, because the shortterm incentives just mean they are going to tactically run from fire to fire and not actually pay down debt for a longlived, valuable company. Sen. Hirono your discussion of twitter is mainly focused on the shortterm monetary incentives. Who is going to force them to look at the longterm . Do people need to go to prison . What do we need to do to get twitter to what you are telling me, they cannot even identify Foreign Agents in their midst. Peiter yes, maam. And you know, to be blunt, some Foreign Agents would be pretty good difficult to identify. But some in this case are not, and there only to my awareness being identified they are not even attempting to. I think Holding People accountable is a good start. I think that is something that people are concerned of. What you can only hold people accountable if you can measure and quantify what their targets are and what changes need to happen. And if you say, such as what i saw, twitter needs to have a Mature Software security program, that is a very ambiguous and qualitative term. Holding accountability and setting quantitative goals and standards that can be measured and audited independently i believe is what is going to be required to change management structures and drive change in companies when it is needed, such as this. Sen. Hirono so we dont even have the kinds of standards to which we can hold twitter accountable to, is that right . Peiter from what i saw, they were able to be answered in the affirmative without actually meaningfully making the intent of the regulators was correct, but then you can say, yes, i found this, hold up an isolated example, and allow somebody to assume that example was the whole environment sen. Hirono excuse me, so do french regulators have better standards to which the hold twitter accountable to . Peiter my understanding is one of the reasons the french are more fear is they dig in technically and go towards more quantitative results better, less easy for organizations to sort of wordsmith around. Sen. Hirono i think that is something we can learn a lesson from good learn a lesson from. Specifically, you discover twitter compromises user data long after the users close their accounts. In fact, they say that the account is activated but the data is not deleted. The time of your departure from twitter, is that the companys continuing general practice, that they dont really eliminate the data . Peiter yes, i was told straight out by the chief privacy officer that the ftc had come and asked, does twitter delete user information when they leave the platform. The reason this person tells me this, i need you to know this because other regulars are asking us, and this ruse is not going to hold up. Instead of answering whether we delete user data, we intentionally replied that we deactivate users and try to sidestep the program because we know we do not delete user data and cannot comply if they demand this. Sen. Hirono you would think that would be something they could do technically to be able to delete data, because for the users to deactivate your account means there should be nothing there of your account. Is this something technically that they could do . Peiter this goes to one of the fundamental problems i mentioned in my opening statement, which was they would need to know what data they have and where it is and why they got it and who its attached to to do that. If they do that, which should be a fundamental expectation i would have is a user, at that point they could delete the information. Senator hirono thank you. Senator graham for six minutes. Senator graham thank you for coming to the committee and giving us your insight. Something good will come from. Do you believe that . Mr. Zatko i hope so i resting my career and reputation, if something good comes from this five, 10 years down the road it will have been worth it. Senator graham you are willing to take that risk . Mr. Zatko yes. I have been doing this for 30 years. People who have known me in the industry know that im willing to put it on the line hoping that we can improve things. Senator graham im going to work with my democratic colleagues to make sure this is not in vain. Do you still use twitter . Mr. Zatko i still have an account on twitter. I read it. I have not tweeted since i left. Senator graham given what you know, would you recommend all of us continue to use twitter . Should we take a timeout . Mr. Zatko i think tweut certificate a hugely valuable service. Senator graham no matter what you said today you are ok with the rest of us tweeting . Mr. Zatko i think people should look at the information they are getting off it differently. People should put pressure on tweut enand ask questions from the public as well as the government and regulators senator graham you are not asking to shut down but asking them to get better . Mr. Zatko absolutely. Senator graham senator graham would you buy twitter . Mr. Zatko that depends on the price. Senator graham fair enough. The reason i ask that for the rest of us we take what you say seriously its unnerving. Im going to use twitter but ill use it differently. If nothing good comes out of this, shame on us all. Let me just tell you where im headed. There is no way to deal with this without bipartisanship, from my point of view. Im working with Elizabeth Warren, of all people, we have different perspectives on almost everything, but we have come to believe its now time to look at social media platforms anew. We have this general understanding among ourselves that the regulatory system regarding social media is not working effectively. Do you agree . Mr. Zatko based upon what i saw a lot of things arent working effectively, yes. Senator graham the federal trade commission, thats the primary regulator for twitter as far as we know. Mr. Zatko i do not believe that twitter should have been able to be viewed as in compliance senator graham do you know when the 23er8 trade commission was founded . Mr. Zatko no, sir. Senator graham 1914. A lot has happened since 1914. World ward i, world war ii, explosion of social media. Would you say given what you know it seems like the regulatory bodies are outgunned here . Mr. Zatko im big tech i think they are outgunned. Senator graham wig time bigtime. I want people to understand paying 150 million fine seems to be of little consequence. Is that your testimony . Mr. Zatko absolutely. Senator graham imagine what i just said , mr. Chairman. A company doesnt mind paying 150 million get back to doing what they are tkofplgt one of the things aim trying to do with senator warren and others is create a consequence for these organizations to give them an incentive to do better. Dont you think thats where we should be headed . Mr. Zatko yes, sir, i do. Senator graham one thing do you have a car . Mr. Zatko yes. Senator graham do you have a driver license . Mr. Zatko yes, sir. Senator graham if you driver a car you need a license. Real estate, you need a license. Practice as a lawyer, you need licensed. Is there any licensing requirement to run a social Media Company . Mr. Zatko not beyond not to the best of my knowledge. Senator graham can you sue a social Media Company when they do you wrong . Mr. Zatko i do not know. Senator graham the answer is no. They are not licensed. You cant sue them. To be shocked you have a problem thats naive on our part. Heres what i promise to you, we are going to take your testimony, we are going to learn from it. We are going to create a system more like europe. A Regulatory Environment with teeth. An agency that came about after 1914, with the power to deal with privacy issues, content moderation, if you want to be in this space you have to harden your sights against foreign interference, you have to protect your sites against criminality, and if somebody takes your content down, youll have an appeal process outside the group who did it. Does that sound kind of like where we need to be going . Mr. Zatko those all sound good to me. I would measurable and transparent. Senator graham we are headed that way with my good friend who is going to join the grahamwarren team. We are going to come up with a regulatory system to make sure that people in this space pay a better attention. They have consequences that they dont change their behavior. Its long past due. Would you say that the companies we are talking about are some of the most powerful in the history of the world . Mr. Zatko i dont know, sir. Senator graham im ill say that. These Companies Make massive amounts of money. They are virtually unregulated. Their regulatory body was founded in 1914. They are completely outgunned. Under our law you cant sue them when you are wrong. Having said all that there is much value to these companies. Facebook, twitter, google. But there is a dark side. We are going to address the dark side. I will just close with this. Your testimony today has legitimatized what most of us feel is a process out of control. That the Regulatory Environment is insufficient to the task. Its time to up our game in this country. Im not about butt putting these out of business. Im about making them do business in a normal way and take their job more seriously. 23 Elizabeth Warren and Lindsey Graham can come together around that concept, we are off to the races as a body. Thank you very much. What you did today will not be in vain. Mr. Zatko thank you very much, sir. If what i have done can contribute to positive change, it will be worth it. Thank you. Thank you, senator graham. Mr. Zatko thank you for joining us. I would like to ask you about what you encountered in terms of the corporate incentives at the top of the company. Something like pushing passes and security updates to employee devices. Cyber hygiene is not easy, thats a relatively low cost way to mitigate a lot of risk. There is significant risk here. Reputational risk, financial risk. Why based upon your experience working within twitters corporate twittership would the company not have elected to take that step, to mitigate risk in that relatively low cost way or other steps like that . Mr. Zatko i didnt see any financial incentives at the top levels that would then give prioritization to such efforts. In fact, i saw incentives counter to that. And combined with a culture where the Company Needs a crisis to operate and is driven by crises, those didnt afford time or focus from what i saw to do the basic chair ossoff what are the incentives against Something Like patching . Mr. Zatko ill give you an example. One of the things i was surprised while i was there we did a media day from the executives for the street. First one that twitter had done in a very long time. It set very Ambitious Goals for revenue growth. Goals i was kerpbtd the company concerned the company would not be able to hit. Not too many months after that there was an internal Value Creation award presented to me offering 10 million if we tripled these growth goals. I raised concerns saying i dont know how we can do that unless we entirely cut corners everywhere. I do not like this incentive structure. How are we going to be able to devote resources to the basics such as fixing security patching, getting the systems up to date, building a development and testing environment for all of the chair osive how is the growth incentive hostile to Something Like pushing Software Updates to employee devices . Given as i understand it a fundamental security practice, a basic cyber hygiene practice, why were you unable to implement a change like that base line hygiene practice where you want all employee devices to be updated to the latest version . Mr. Zatko i brought that up numerous times. I was repeatedly told that 92 of the systems had Security Software. I kept asking what is the Security Software reporting . It took me a monthplus to get the truth that 30 of the systems were not turned off Software Updates. There was a culture of not reporting bad results up. Only reporting good results up. Because that was the internal incentive structure. You are rewarded based upon relationships and how you performed in a in an madgecy. Not in an emergency not for identifying existing errors and doing the groundwork for keeping the lights on and running the business. My inability to find such basic information was disturbing. Chair ossoff you couldnt get the official to get a system to push passes out. You couldnt make it happen . Mr. Zatko i had the authorization. I couldnt get the real information because people were misrepresenting to the executive team and executive team was further misrepresenting only good news and incorrect news to the board. It took me several months to start going and getting ground truth and find out this had been a culture of only present good and positive reports. Thats how you move forward. Chair ossoff talk about the data, much of it no doubt sensitive, within twitters possession and some of the most alarming aspects of your disclosure and testimony the extent to which twitter may not know what it has. What would be of course you dont know what you dont know. What would be an example of the kinds of data sets that twitter might possess but not fully understand it possesses . What would be the mechanisms other than monitoring user activity by which it would have accumulated such date aa . Mr. Zatko one example i was surprised to see in an internal incident review in 2020, 50 million twitter employees information had been exposed. That number confused me because twitter doesnt have 50 million employees. Twitter has all of the information of all past employees, contractors, and other users because they havent deleted that data. They kept it in the system. Those systems would expose that information. That was surprising to me. The second part of your question . Chair ossoff im running low on time. Let me get to my next point. The risks associated with targeted advertising whether for the purpose of inducing targeted users to click on links that could then harvest data about their devices or their web use or location or possibly inject malwear or for targeted influence campaigns, can you please talk about what you observed and what you viewed to be the risks associated with the advertising model of the capability of enterprise clients of twitters to target ads and links to specific users . Mr. Zatko so that area wasnt specifically my domain. That was under the executive of sales engineering. The parts that i believe are relevant were not only the additional report that we talked about earlier with the Information Operations, but i did see data sets internally to the organization when i first joined, thousands of users had access to the advertisers information, including their Bank Accounts and routeing numbers. When i first joined people could change that information and you could understand why changing the banking account information of a company such as apple or nike might be problematic. Chair ossoff final question and ill yield to senator holly and follow up with you on this one for the record to get as much detail as possible. What records, documents, or Technical Information with as much specificity as you can muster right now would you suggest the congress should seek from twitter to understand the extent of the alleged lack security practice, but also what data may have been exfiltrated, when by whom, what the National Security risk might be. What should we kaoebg from this company so we can assess the level of risk and threat and make policy accordingly . Mr. Zatko i submitted i believe 100plus pages in my disclosure with data. Talking about the sources of that data and providing a road map for investigators. I will do it a disservice trying to summarize the large numbers of sources and locations of the data, but hopefully my lawful disclosures provide that road map and im happy to follow up. Chair o os f ossoff mr. Holly for six minutes. Senator holly i want to make sure i got this straight. You stated today and in your report that about 4,000 twitter employees are classified as engineers, is that right . Mr. Zatko yes, sir. At the time half of the employees, there were 7,000plus fulltime employees. Senator holly that means these 4,000ish employees would have had access to live user data all over twitter, they could access individual users personal information. Have i got that right . Mr. Zatko yes, sir. They would have accession to the production environment f they spent the time to meander around and look around, they would find they could access these large data. Senator holly including geolocation . Mr. Zatko i know twitter has i. P. Locations. They do use Geolocation Services based upon i. P. Addresses. Senator hawleyily 4,000 employees. Extraordinary. Those employees if they wanted to to get this information and docs twitter users. Mr. Zatko thats a concern of mine, yes. Senator hawley thats a significant concern. 4,000 people with the ability to docs individual users who pick up the phone and use twitter. Have you ever seen it happen . Mr. Zatko i have seen numerous situations where twitter engineers had to patch a problem and i said what was the problem . They said engineers could tweet as anybody. The data was exposed in this part. It was always reactionary, in finding these wounds left and right and putting bandaid on them because of the underlying problems were not addressed. The broad access to too much information. Senator hawley when you say twitter engineers could tweet as anybody. What does that mean . Mr. Zatko that meant a twitter engineering understanding how the running systems and data flows were operating could then access and inject or put forward information as, as i mentioned in my oral statement, any of the senators sitting here today. Senator hawley have you ever seen that happen . Mr. Zatko not with no, not directly. Senator hawley are you concerned it has happened . Do you have some reason to believe it has happened . Mr. Zatko the number of cases reported to me by individual engineers say, hey, we found this im going to try to have somebody fix it. Where that was the problem and we wouldnt know if it happened in the past. Yes, i am concerned. Senator hawley thats pretty significant testimony. Let me make sure i understand this point. Facebook whistleblower came forward a couple years ago now, came to me in my office and told us that facebook they at least had policies on the books that restricted back End Developers from accessing user data. Whether or not those policies were followed, who knows. Is it your testimony to me that twitter had no similar policies in place that would have restricted these 4,000 engineers from accessing user data . Mr. Zatko not technical enforcement. Technical policies that were enforced. I did see basic policies such as hey, are you not supposed to access inappropriate systems. I also saw policy saying that your work laptops should only run on the following setups. I was aware that i dont believe any of the laptops were in compliance with those policies. Senator hawley none. Mr. Zatko based upon the policy i read, i do not believe they were in compliance with that policy. Senator hawley zero compliance with their policy. Extraordinary. Let me ask you about this. That same Facebook Whistleblower told us a couple years ago now that twitters content moderation staff routinely kpwhrab brownwaited with content moderators at facebook and google. Is that true to your knowledge . Do you have information about that . Mr. Zatko that would be in a team under counsel. I wouldnt have firsthand knowledge of that. Senator hawley are you aware of any twitter policies that would have prohibited coordination and content moderation between facebook, google, and twitter . Mr. Zatko not to the best of my knowledge. Senator hawley its possible. Mr. Zatko yes. Senator hawley let me ask you about this. Are you aware of any communications regarding content moderation with twitter staff and the United States government in your time at the company . Mr. Zatko im familiar with the conversations that happened through the department of Homeland Security. The traffic light protocol. Where there are messages sent out to organizations about threats that maybe the f. B. I. Or other organizations had insight into. Senator hawley earlier this year, documents we obtained from a different whistleblower at the department of Homeland Security exposed that the disinformation board that the department of Homeland Security set up, that first on the disinformation board of list of companies to meet with was twitter. They had an extensive memo, which is Public Information now. We released it. You can look at t they had a memo prepared with notes for this meeting with twitter, talking about cooperation and content moderation. Frankly in monitoring americans speech. Now we know that thousands of twitter employees have access to that. This was all in the documents. I guess my question to you is, i know you werent in those meetings, why do you suppose that the disinformation board had twitter first on the list of entities to come to to talk about coordinating, monitoring american speech . Mr. Zatko i cant opine on that. I can say that twitter is a tremendously influential platform. We do know there are Information Operations being run on twitter. Senator hawley do you think twitter has proved so phraoeupbt to government pressure to censorship and monitoring people. The hunter biden story, we know that twitter killed the hunter biden reporting. We know Mark Zuckerberg said the f. B. I. Pushed facebook to do it. Twitter killed it completely. Locked up accounts trying to report what we know was a true story. How about by your own report you claim that the twitter c. E. O. Proposed kaeufbg to the russian governments demands to censor content on twitter and spy on its users. You noted this occurred even as you were directing employees to prepare for the russian invasion of ukraine. That sounds like an executive team thats pretty darn phraoeupbt to the demands of governments to weaponize their platform to control information, to spy on its users, whats your view . Mr. Zatko i wasnt there when the hunter biden issue happened. Dont have any information on that. I wasnt briefed into it or involved in any of the investigations. The c. E. O. Was the c. T. O. At the time when he proposed to me that, hey, what do you think about let russia perform their own moderation. They are a democracy. Why should we why shouldnt we let them do it . I didnt know what to think at the time. I was a little flabbergasted. Senator hawley i think i know what to think which is that twitter has been all too eager to take private information from its users without telling them. To sell it and monetize it without their permission. To expose them to the worst kind of security threats. To censor them, spy on them. You have paint add picture of a company that is not only out of control but is truly in many ways a maligned actor. I thank you for being willing to testify. Thank you. Chair ossoff thank you, senator hawley. Thank you for appearing before the committee today. The hearing record will remain open for one week for submission of materials for the record. And with that this hearing is adjourned. [captions Copyright National cable satellite corp. 2022] [captioning performed by the national captioning institute, which is responsible for its caption content and accuracy visit ncicap. Org] the house rt noon eastern. Members will vote on student debt relief. Both the house and senate may take up a shortterm spending deal to avert a government shutdown. The senate is back on monday at 3 00 p. M. Eastern. Senators will work on judicial nominations and vote on changes to a Global Climate treaty. Watch live coverage of the house on cspan. You can watch on our free video app or online at cspan. Org. Cspan is your unfiltered view of government. Homework can be hard. Swatting is even harder. We are providing access to affordable internet. Cox gives you a frontrow seat to democracy. Ken starr passed away on tuesday at the age of 76. A statement said it was due to complications from surgery. He is well known for investigating bill clinton as indican independent counsel. Before that, he served as a u. S. Solicitor general under George H W Bush and a judge on the d. C. Circuit appeals. , a 2019 interview where he reflected on the investigation into bill clinton