Peiter "Mudge" Zatko

Peiter C. Zatko, widely known by the handle "Mudge," is an American computer security researcher whose career spans the 1990s hacker underground, U.S. government cybersecurity programs, and corporate security leadership. Born December 1, 1970, he studied at Berklee College of Music before turning to computer science and security research.

L0pht and Early Security Research

Zatko became one of the most prominent members of L0pht Heavy Industries, the Cambridge, Massachusetts hacker think tank active from the early 1990s to 2000. Individually, he authored the 1995 paper "How to Write Buffer Overflows," one of the earliest public technical treatments of buffer-overflow exploitation, and wrote L0phtCrack, a widely used tool for auditing and cracking Windows password hashes.

1998 Senate Testimony and White House Contact

On May 19, 1998, Zatko was one of seven L0pht members who testified before the U.S. Senate Committee on Governmental Affairs about the fragility of Internet infrastructure, telling senators that a small, motivated group could disrupt large portions of the Internet in roughly 30 minutes. In the following years he served as an informal adviser to White House cybersecurity coordinator Richard Clarke, and in February 2000 Clarke brought him into a meeting with President Bill Clinton and technology-industry executives convened after a wave of denial-of-service attacks on major websites.

From @stake to DARPA

After L0pht's assets were absorbed into the security consultancy @stake around 1999-2000, Zatko held roles including vice president of research and development and chief scientist, then worked as a division scientist at BBN Technologies before joining DARPA in 2010 as a program manager. There he launched Cyber Fast Track in 2011, a program that used streamlined contracting to quickly fund small-scale, often hacker-run security research projects. He left DARPA for Google in 2013, then became head of security at the payments company Stripe in 2017.

Twitter and the 2022 Whistleblower Disclosure

In November 2020, following a high-profile breach in which attackers hijacked accounts of prominent users, Twitter hired Zatko as head of security, reporting to CEO Jack Dorsey. He was fired in January 2022, with Twitter citing poor performance; the company reportedly later agreed to a settlement of roughly $7-7.75 million. In July 2022, represented by the nonprofit Whistleblower Aid, Zatko filed a disclosure with the SEC, the Department of Justice, the FTC, and congressional committees, alleging that Twitter executives misled regulators, investors and its own board about the platform's security and privacy practices. The disclosure became public on August 23, 2022, and on September 13, 2022, Zatko testified before the Senate Judiciary Committee that "Twitter leadership is misleading the public, lawmakers, regulators and even its own board of directors." Zatko subsequently worked as a part-time senior technical adviser at CISA starting in September 2023, and in August 2024 returned to DARPA as its Chief Information Officer.

Timeline

• 1970-12-01Born in Alabama.
• 1995Publishes "How to Write Buffer Overflows," an early technical paper on buffer-overflow exploitation.
• 1998-05-19Testifies with six other L0pht members before the U.S. Senate Committee on Governmental Affairs.
• 2010Joins DARPA as a cybersecurity program manager.
• 2011Launches DARPA's Cyber Fast Track program.
• 2017-05-08Hired by Stripe as head of security.
• 2020-11-17Hired by Twitter as head of security, reporting to CEO Jack Dorsey.
• 2022-01Fired from Twitter; the company cites poor performance.
• 2022-07Files a whistleblower disclosure with the SEC, DOJ, FTC and congressional committees regarding Twitter.
• 2022-08-23Whistleblower complaint becomes public after being reported by The Washington Post and CNN.
• 2022-09-13Testifies before the U.S. Senate Judiciary Committee about Twitter's security practices.
• 2024-08-08Appointed Chief Information Officer of DARPA.