"Mudge" since the L0pht · record spelling Peiter C. Zatko, as signed in his own Senate statement FACT · @dotMudge
PEDIGREE
L0pht Heavy Industries → @stake · "How to Write Buffer Overflows" (1995) · L0phtCrack author · DARPA program manager (Cyber Fast Track) · Google · Stripe FACT
HABITAT
Senate hearing rooms — 1998 and 2022, both times under oath, both times bearing bad news FACT
THE ACT
Twitter Security Lead, Nov 16, 2020 – Jan 19, 2022; whistleblower disclosure filed July 6, 2022 with the SEC, FTC, DOJ, and Senate Intelligence Committee — a documented federal filing, entered in the official Senate hearing record FACT
STATUS
REHIRED BY THE GOVERNMENT — CISA senior technical adviser (2023); returned to DARPA (2024) FACT
That’s correct, actually. One of us with just a few packets.
Mudge (Peiter Zatko), answering the U.S. Senate in 1998 when the chairman put it to him directly — that the seven-member L0pht could make the internet unusable for the entire nation in about thirty minutes. From the hearing footage (embedded below). The 1998 testimony.
The specimen, first observed in a Boston loft in the early 1990s, exhibits a behavior almost unknown in this archive: it tells powerful institutions the truth about their security, in writing, under its own name, and then does it again twenty-four years later.
Approach this drawer differently. Nearly every other file in this cabinet documents a fabrication — a forged credential, a vanished client, a product that never worked. This file documents the opposite animal: the one that found the fabrication and filed the paperwork. The reader deserves to know up front that the archive's honest reading of this record runs in the specimen's favor.
But favorable is not the same as unexamined. The counterparties got their say in the charge sheet above, at full strength, because that is the house rule. Every event below carries its receipt. Both sides get the microphone.
the drama timeline
ACT I — THE LOFT (1992–2000)
The juvenile form, observed in its natural habitat: a rented Boston loft full of salvaged hardware and seven pseudonyms. Watch what this colony does when it finds a weakness. It publishes.
1995
The buffer-overflow paper, and the password cracker
Publishes "How to Write Buffer Overflows," foundational research on the vulnerability class that would dominate the next two decades, and authors L0phtCrack, the password-auditing tool that made Windows password weakness undeniable. The L0pht's practice — find it, tell the vendor, publish when ignored — helps found what becomes the responsible-disclosure movement, by his own later sworn account.
Seven hackers tell the Senate they could take down the internet in 30 minutes
All seven L0pht members testify before the Senate Governmental Affairs Committee — under their handles — that they could render the internet unusable in about half an hour, via structural weaknesses in its routing infrastructure. When the chairman put the claim to him directly, Mudge did not soften it: "That's correct, actually. One of us with just a few packets." Asked why the network was so fragile, he gave the line the hearing is remembered for — that the internet was academic plumbing pressed into commerce it was never built for: the streets, he said, like Boston's, weren't designed well because "they followed the cows around and laid the pavement down. I mean, you can get it to work, but it can be really painful, and that's the stage we're in right now." Nobody at the witness table is bluffing, and nobody in the room fixes it. The Washington Post's 2015 retrospective files the hearing under warnings nobody listened to.
Note the display behavior: the specimen appears before the apex institution of its range and announces the habitat is flammable. The institution thanks it politely. The habitat remains flammable for decades. Remember this scene; the specimen will re-enact it.
The L0pht before the Senate Governmental Affairs Committee, May 19, 1998, with Mudge as lead witness — the original hearing footage, posted by L0pht member Joe Grand.
The loft goes legitimate; the specimen goes inside
The L0pht merges into @stake (1999), where he serves as VP of research and development, later chief scientist. In 2010 he takes an appointed position at DARPA running cyber programs — creating Cyber Fast Track, which funneled DoD research money to hacker-space researchers — and leaves a decorated civilian: the Office of the Secretary of Defense's Exceptional Public Service medal, the highest it can give a non-career civilian, per his sworn statement.
Mark the contemporary dissent, on the record and answered by it: the early-2000s antisecurity movement made L0pht-into-@stake its archetype of the "sellout" — the underground's best talent taking corporate, then federal, pay while, they argued, fellow hackers went to prison. The specimen's reply was not a rebuttal but a career: Cyber Fast Track, a whistleblower disclosure under his own name, and, in the end, the government hiring him to write its security doctrine.
A platform catches fire in public. Its keeper reaches for the one animal whose entire recorded history is walking into burning structures and filing accurate reports about the wiring.
JUL 2020
Teenagers take over Twitter
Twitter is hacked by a group of teenagers who seize the accounts of some of its highest-profile users — then the largest hack of a social media platform in history, in Zatko's sworn description — as part of a cryptocurrency scam. Afterward, then-CEO Jack Dorsey personally recruits Zatko to assess the state of the company's security and make fundamental changes.
Joins Twitter as "Security Lead," a senior executive role over information security, privacy engineering, physical security, IT, and Twitter Services. What he finds, per his later disclosure: "10 years of overdue critical security issues" and a company not making meaningful progress on them.
The dates in this node come from the disclosure itself — a document whose first page is a lawyer's letter to the Senate Intelligence Committee, now preserved with a GPO authentication seal. Few specimens in this archive have their chronology this well notarized.
The central sequence. Watch the order of events carefully — both sides will later argue about nothing so much as the order of events.
JAN 19, 2022
Fired
CEO Parag Agrawal terminates Zatko. Two accounts exist and the reader gets both: the disclosure states he was terminated after he alleged fraud by Mr. Agrawal; Twitter states he was terminated for "ineffective leadership and poor performance." No tribunal has ever chosen between them.
Before the disclosure exists in public, DOJ and FTC hit Twitter with a $150 million civil penalty for violating the FTC Act and its 2011 consent order — the company had told users that phone numbers and emails were collected for account security, then used them for targeted advertising. The same consent order Zatko would soon allege Twitter had "never been in compliance" with was, on the government's own contemporaneous record, being violated.
Independent corroboration is the rarest nutrient in this ecosystem. Here the regulator documented the genus of the problem before the whistleblower published the species.
Twitter and Zatko sign a separation agreement under which Twitter pays him and his counsel $7.75 million. Eight days later, his lawyers at Whistleblower Aid file the disclosure — roughly 200 pages with exhibits, per CNN — with the SEC, FTC, DOJ, and the Senate Intelligence Committee. Among its allegations: about half of Twitter's roughly 500,000 servers ran outdated software; roughly half of employees had access to live production systems and user data; and the company had "never been in compliance" with the 2011 FTC order.
CNN and The Washington Post publish the redacted disclosure. Agrawal's response, in full flight: "a false narrative that is riddled with inconsistencies and inaccuracies, and presented without important context," from an executive "terminated in January 2022 for ineffective leadership and poor performance," whose "allegations and opportunistic timing appear designed to capture attention and inflict harm on Twitter."
The disclosure becomes a $44 billion bargaining chip
Musk's lawyers, hunting for exits from the acquisition, file a third termination letter arguing the undisclosed $7.75 million payment breached the merger agreement. Twitter rejects the claim and pushes toward trial. Whatever the disclosure was written to be, it is now also ammunition in the largest tech-acquisition fight in history — a use its author did not choose.
Testifies before the Senate Judiciary Committee. From the record: "Twitter leadership is misleading the public, lawmakers, regulators and even its own board of directors." On the regulator: the FTC is "a little over their head" and "left letting companies grade their own homework." Per NPR's account of the hearing, he also testifies that the FBI had informed Twitter's security team that at least one agent of China's Ministry of State Security was on the payroll — his testimony, corroborated by no public adjudication. And from his written statement, the line the charge sheet's critics never quote: "I did not make my whistleblower disclosures out of spite or to harm Twitter. Far from that. I continue to believe in the mission of Twitter and root for its success."
Observe the symmetry the specimen has constructed across twenty-four years: 1998, a Senate table, the internet is broken and here is how. 2022, a Senate table, the platform is broken and here is how. The testimony evolved. The institutions' listening did not noticeably improve.
The test of any whistleblower is what the serious institutions do next. Watch where this one gets invited.
JAN 2023
Rapid7
Joins cybersecurity firm Rapid7 as executive in residence — his first post-Twitter perch, by which time Musk has completed the purchase and the Delaware fight has ended without any court ruling on the disclosure's merits.
The U.S. government's own cyber defense agency brings him on as a part-time senior technical adviser for secure-by-design. CISA Director Jen Easterly, on the record: "Mudge joins us in a part-time capacity to help us collaboratively shape a culture of security by design that is foundational to every security team, every C-suite, and every board room in the country."
In this archive, the year after a subject's biggest controversy usually features a rebrand, a new LLC, and a podcast. This one features a federal security clearance's worth of institutional trust. Costly signals do not come costlier.
Returns to DARPA — the agency he served as a program manager in 2010 — as Chief Information Officer, per his sourced encyclopedia biography. The kid who told the Senate the internet was broken now runs information security for the agency that helped invent it. The archive keeps the tape running.
Twitter's position (theirs, not ours): the disclosure is "a false narrative that is riddled with inconsistencies and inaccuracies," from an executive fired for "ineffective leadership and poor performance," with "opportunistic timing" [8].
The timing facts: the $7.75 million separation payment predates the disclosure by eight days, and the disclosure surfaced in the middle of the Musk deal fight, where it was promptly weaponized [6].
The anonymous account: a person familiar with his tenure told CNN several of his claims were investigated and found unpersuasive, and that he at times lacked understanding of Twitter's FTC obligations — anonymous and unsworn [8].
The scope limit that cuts against him: no court, agency, or tribunal has ever adjudicated the disclosure's specific allegations as true. They remain allegations — sworn, detailed, and untested.
The filing is a documented fact, not a rumor. The disclosure exists as a GPO-authenticated document in the official Senate hearing record, filed by counsel with the SEC, FTC, DOJ, and Senate Intelligence Committee — and he repeated its substance under oath, on camera, under his own name [1][2][4].
The regulator corroborated the theme before he published it. Two months before the disclosure went public, DOJ and FTC extracted a $150 million penalty from Twitter for violating the very 2011 consent order he alleged the company had never complied with [5].
The pedigree is real and the record is long: foundational buffer-overflow research, L0phtCrack, the 1998 Senate testimony, DARPA's Cyber Fast Track, and the Secretary of Defense's highest civilian public-service medal, per his sworn statement and sourced biography [2][7][16].
The institutions voted with their hires. After the disclosure — after Twitter's rebuttal, after the Musk circus — CISA hired him to help set national secure-by-design policy, and DARPA brought him back as CIO [14][15][16]. Governments do not hand the keys to people they believe fabricated a federal disclosure.
YOU DECIDE
Scoped to the claims, never the man. The claim "Zatko filed a detailed federal whistleblower disclosure and stood behind it under oath" is documented beyond argument. The disclosure's specific allegations were never adjudicated — the deal fight that might have tested them ended when Musk bought the company — and Twitter's rebuttal remains on the record at full strength. That is the honest asterisk, and it is the only one.
Weigh the costly signals. He put his real name on a disclosure against one of the most powerful platforms on earth and sat for sworn testimony; the regulator had already fined the company $150 million over the same consent order; and the United States government, twice, hired him afterward. Against that: one anonymous quote and a rebuttal from the executive he accused. This drawer holds charlatans. This file is in it to mark the difference.
The archive does not judge. The archive merely keeps the tape running.
GovInfo — hearing record, "Data Security at Risk: Testimony from a Twitter Whistleblower" (S. Hrg. 117-976)FACT — the official record of the September 13, 2022 hearing.
govinfo.gov/app/details/CHRG-117shrg60055
Video — L0pht testimony before the U.S. Senate, May 19, 1998TESTIMONY — the original hearing footage, posted by L0pht member Joe Grand.
youtube.com/watch?v=VVJldn_MmMY
Wikipedia — Peiter ZatkoFACT — sourced biography: the 1995 paper, L0phtCrack, @stake, DARPA 2010, Google 2013, the OSD medal, the 2024 DARPA CIO return.
en.wikipedia.org/wiki/Peiter_Zatko
troll.fan — X / Twitter (the hacker drama)CROSS-LINK — the security mess Zatko was hired to clean up: the platform’s decade of break-ins, from Hacker Croll to the 2020 God-mode hack.
troll.fan/dossiers/twitter-x.html
SUBJECT'S OWN CHANNELS — THE SPECIMEN, UNEDITED
X — @dotMudgeSELF-PUBLISHED — the subject's account, in his own words. Account-level link only; no fabricated permalinks.
x.com/dotMudge
The standard. Everything above is sourced to the official Senate hearing record, the subject's own sworn statement, DOJ and SEC filings, and named press reporting. Facts are stated as facts; allegations are stated as allegations and wear their author — and on this page that cuts both ways: the disclosure's claims about Twitter are Zatko's, and the "poor performance" and "false narrative" claims about Zatko are Twitter's. Neither is adopted. Nothing on this page is a fraud finding against the subject, and the page says so plainly: this is the case file of a documented whistleblower, kept to the same evidentiary standard as the charlatans it shares a cabinet with — because the standard is only worth keeping if it produces different verdicts for different records. The burden of proof is on us, not the subject. If it couldn't survive a defamation challenge, it wouldn't be on this page.