Twitter chief information security officer Lea Kissner departs

Twitter’s most senior cybersecurity staffer Lea Kissner has departed the social media giant.

Kissner announced the move in a tweet on Thursday, saying they made the “hard decision” to leave Twitter, but did not say for what reason they resigned. Elon Musk completed a $44 billion takeover of Twitter two weeks ago, resulting in layoffs affecting more than half of the company and the departure of senior executives, including CEO Parag Agrawal, general counsel Sean Edgett, and legal policy chief Vijaya Gadde.

News of Kissner’s departure was first reported by Casey Newton. Twitter’s chief compliance officer, Marianne Fogarty, and chief privacy officer, Damien Kieran, reportedly also resigned on Wednesday, Newton said, citing messages shared in Twitter Slack that he’s seeing.

It’s not immediately clear who is responsible for Twitter’s day-to-day security operations following Kissner’s departure. A spokesperson for Twitter did not immediately respond to a request for comment.

We have also reached out to Kissner, Kieran and Fogarty for comment and will update this post as and when we hear more. Anyone reading this who would like to pass on more information about this or other Twitter stories can also contact us via channels here.

Kissner previously served as Twitter’s head of privacy engineering and was appointed Twitter’s chief information security officer (CISO) in January 2022 following the departure of security head Peiter “Mudge” Zatko and then-CISO Rinki Sethi. Mudge went on to blow the whistle to federal regulators claiming security mismanagement and lax access controls that put users’ data at risk.

Twitter is currently under a 2011 agreement with the Federal Trade Commission, which accused Twitter of cybersecurity failings that allowed cybercriminals to access internal systems and user data.

The decree mandates that Twitter “establish and maintain a comprehensive information security program” to be audited every decade. It’s not clear how Twitter maintains that compliance with the FTC without a company security lead in place. One employee said in a company Slack that it was for Twitter engineers to “self-certify” compliance with the FTC.

“All of this is extremely dangerous for our users,” a message quoted by Newton said. “Given that the FTC can (and will!) fine Twitter BILLIONS of dollars pursuant to the FTC Consent Order, extremely detrimental to Twitter’s longevity as a platform. Our users deserve so much better than this.”

An essay this week in the MIT Technology Review outlined how current staffing at Twitter, which laid off half its staff at the end of last week, would make operating the company and its platform unsustainable, and it feels like the wheels might be coming off even faster than critics thought they would.

Even before this the company had been facing a number of security and data protection issues. In two from earlier this year, Twitter was fined $150 million in May for violating that 2011 consent decree for misusing email addresses and phone numbers provided by users to set up two-factor authentication for targeted advertising. In August, it revealed (and patched) a security vulnerability that allowed threat actors to compile information of 5.4 million Twitter accounts, which were listed for sale on a known cybercrime forum.

Twitter chief information security officer Lea Kissner departs by Zack Whittaker originally published on TechCrunch