Twitter whistleblower Peiter “Mudge” Zatko’s testimony before Congress yesterday can be summed up in three words: sloppy data handling.

Twitter simply has too much user data and does a pretty bad job at managing it, Mudge told lawmakers.

• Among Zatko’s grievances: Too many engineers had too much access to too much data, making it hard to track and opening the door for bad actors to use the data in bad ways.
• “They simply lacked the fundamental abilities to hunt for foreign intelligence agencies and expel them on their own,” he said during the testimony.
• Twitter isn’t necessarily the only social media company with this level of data collection, though. Lots of mobile apps already collect the data Zatko described. And Zatko dealt in potential risks, rather than actual instances of harm.

Twitter leaders also didn’t see security as a top concern, which is an issue that Zatko had described in his original whistleblower complaint.

• Rather than addressing security problems head-on, Zatko explained that leadership would get around their issues by lying to the FTC or hiding the fact that most employees could take over Twitter accounts if they wanted.
• Twitter isn’t as afraid of the FTC as it is of European regulators, especially in France, because those agencies tend to dig deeper and impose harsher restrictions, Zatko said.

Elon Musk wasn’t really a highlight of the testimony, in case you were wondering. Lawmakers didn’t ask too many questions regarding the acquisition, even as Twitter shareholders approved the deal during a (checks notes) seven-minute meeting that was also held yesterday.

So what happens now? Zatko didn’t offer any suggestions for what Washington could actually do aside from having more oversight on social media companies’ data practices. So as always, we might just have to wait for Washington to decide what it wants to do next. And that could take a while.

— Sarah Roach