Read the letter Elon Musk sent to Twitter with more reasons to terminate his $44 billion takeover deal

In a filing on Tuesday, lawyers on behalf of Musk cited allegations by whistleblower Peiter Zatko, Twitter’s ex-head of security, who claimed he raised questions about severe shortcomings in the social media company’s handling of users’ personal data. The letter said that the allegations meant that Twitter had breached the conditions in the merger agreement. 

Read the full text of the letter, addressed to Twitter’s chief legal officer from Musk’s lawyer: 

Dear Ms. Gadde:

We write on behalf of X Holdings I, Inc. And X Holdings II, Inc. (The “Musk Parties”) to provide an additional notice of termination of the Agreement and Plan of Merger by and among the Musk Parties and Twitter, Inc. (“Twitter”) dated as of April 25, 2022 (the “Merger Agreement”). On July 8, 2022, the Musk Parties terminated the Merger Agreement (the “July 8 Termination Notice”) on certain bases. Since that time, Twitter has challenged the validity of the July 8 Termination Notice and contends that the Merger Agreement remains in force, a position that the Musk Parties are contesting. Allegations regarding certain facts, known to Twitter prior to and as of July 8, 2022, but undisclosed to the Musk Parties prior to and at that time, have since come to light that provide additional and distinct bases to terminate the Merger Agreement. Although the Musk Parties believe this termination notice is not legally necessary to terminate the Merger Agreement because they have already validly terminated it pursuant to the July 8 Termination Notice, the Musk Parties are delivering this additional termination notice in the event that the July 8 Termination Notice is determined to be invalid for any reason.

On August 23, 2022, the Washington Post published a whistleblower report to Congress, the SEC, FTC, and DOJ filed by Peiter “Mudge” Zatko, Twitter’s former chief security officer, on July 6, 2022 (the “Zatko Complaint”). The Zatko Complaint alleges far-reaching misconduct at Twitter—all of which was disclosed to Twitter’s directors and senior executives, including Parag Agrawal—that is likely to have severe consequences for Twitter’s business. For example, Mr. Zatko alleges that:

• Twitter is in material noncompliance with both its obligations under a 2011 FTC consent decree and its general obligations under data privacy, unfair trade practice, and consumer protection laws and regulations;

• Twitter is uniquely vulnerable to systemic disruption resulting from data center failures or malicious actors, a fact which Twitter leadership (including its CEO) have ignored and sought to obfuscate;

• Twitter’s platform is built in significant part on the misappropriation and infringement of third party intellectual property; and

• Twitter acquiesced to demands made by the Indian government that its agents be hired by Twitter and given access to Twitter user information.

These allegations, if true, demonstrate that Twitter has breached the following provisions of the Merger Agreement, thereby giving the Musk Parties the right to terminate the Merger Agreement pursuant to its terms as more fully described below.

Section 4.5 Permits; Compliance With Laws. In the Merger Agreement, Twitter represented, inter alia, that it was in compliance with all applicable laws. That representation was apparently false when made on the date of the Merger Agreement and as of the date of the July 8 Termination Notice, and continues to be inaccurate. The Zatko Complaint alleges that Twitter has been violating a consent decree it entered into with the FTC in 2011. That consent decree required Twitter to establish and maintain “a comprehensive information security plan” to ensure that its users’ personal data was sufficiently protected from disclosure. Mr. Zatko’s statements purport to reveal that Twitter has not been, and perhaps never will be, in compliance with that decree. Twitter has already paid a fine of $150 million for violating an aspect of that decree, and Facebook recently paid $5 billion for similar user data violations. In addition, the Zatko Complaint alleges that Twitter has repeatedly violated the 2011 FTC consent decree (by going well beyond the violations settled in Twitter’s recent $150 million settlement), in addition to breaching a slew of other data privacy, unfair trade practice, cybersecurity, and consumer protection laws and regulations that Twitter must comply with, including but not limited to Twitter granting agents of the Indian government access to confidential user data. These violations would have material, if not existential, consequences to Twitter’s business, constituting a Company Material Adverse Effect as defined in the Merger Agreement.

Section 4.6 Company SEC Documents; Financial Statements. In the Merger Agreement, Twitter also represented, inter alia, that no documents it filed with the SEC since January 1, 2022, “contained any untrue statement of a material fact or omitted to state any material fact required to be stated therein or necessary to make the statements therein... Not misleading.” That representation was apparently false when made on the date of the Merger Agreement and as of the date of the July 8 Termination Notice, and continues to be inaccurate. The Zatko Complaint alleges that Twitter’s SEC filings contained untrue statements of material fact or omitted to state material facts necessary to make the statements therein not misleading. For example, Twitter’s 2021 10-K, dated February 16, 2022, states that “concerns related to... Privacy, data protection, safety, [and] cybersecurity” “could potentially negatively affect mDAU growth and engagement,” while omitting the significant privacy, data protection, safety, [and] cybersecurity risks Mr. Zatko alerted the board of prior to the filing of the 10-K, including those facts outlined above. Similarly, Twitter’s representation in its 2021 10-K that Twitter “strive[s] to comply with applicable laws and regulations relating to privacy, data protection, and cybersecurity” was materially misleading if, in reality, Twitter was ignoring Mr. Zatko’s warnings that the company was in violation of privacy, data protection, and cybersecurity laws and regulations.

Twitter’s material misrepresentations and/or omissions in the Merger Agreement and Twitter’s 2021 10-K regarding these serious allegations also constitute fraud in the inducement, giving the Musk Parties the right to recission.

Section 4.8 Disclosure Controls and Procedures. In the Merger Agreement, Twitter also represented, inter alia, that it had disclosed “any fraud to the Knowledge of the Company, whether or not material, that involves management or other employees who have a significant role in the Company’s internal control over financial reporting.” That representation was apparently false when made on the date of the Merger Agreement and as of the date of the July 8 Termination Notice, and continues to be inaccurate. One component of the Zatko Complaint is that Twitter’s CEO, Parag Agrawal, knowingly presented false and misleading reports to Twitter’s Board of Directors in order to cover up flagrant vulnerabilities in Twitter’s security and data protection infrastructure. Twitter was made aware of precisely that in an internal report prepared by Mr. Zatko in February 2022. Twitter was obligated to disclose Mr. Agrawal’s conduct “whether or not material” (although it was clearly material), and failed to do so.

Section 4.11. Litigation. In the Merger Agreement, Twitter represented, inter alia, that there were no threatened or pending lawsuits or Government investigations that would constitute a Company Material Adverse Effect (within the meaning of the Merger Agreement). It is likely the case—given the extensive information withheld from the Musk Parties detailed in the Zatko Complaint—that the representations set forth in Section 4.11 will be false as of the date of any potential closing of the transactions contemplated by the Merger Agreement, resulting in a failure of the closing condition set forth in Section 7.2(b). Indeed, Twitter is now facing multiple Congressional inquiries: the Senate Judiciary Committee has announced a full Committee hearing, the House Energy and Commerce Committee announced that it is “assessing next steps,” and multiple US Senators have publicly called for the FTC and DOJ to open investigations. See

https://www.washingtonpost.com/technology/2022/08/24/twitter-whistleblower-senate-hearing; https://www.washingtonpost.com/technology/2022/08/23/twitter-whistleblower-congress-investigation. The data privacy authorities of Ireland and France are also investigating the claims in the Zatko Complaint. Https://techcrunch.com/2022/08/24/twitter-whistleblower-security-eu/. It is likely that the SEC, FTC, and DOJ, as well as additional foreign regulators are not far behind. Twitter will also now face a myriad of civil lawsuits, asserting claims pursuant to various privacy and cybersecurity laws, state consumer protection laws, false advertising laws, intellectual property theft and misappropriation and common law claims, such as unjust enrichment, fraud, and breach of contract. Many of these civil claims are likely to be asserted as class action claims that could threaten the viability of the platform. This still-rolling litigation avalanche brings with it billions of dollars of potential damages, fines, and penalties, to say nothing of the significant reputational and operational harm that comes in parallel, clearly constituting a Company Material Adverse Effect under the terms of the Merger Agreement.

Section 4.14. Intellectual Property. In the Merger Agreement, Twitter represented, inter alia, that it was not infringing the intellectual property of others (the “Non-Infringement Rep”) and that it was in compliance with all applicable data privacy and protection requirements (the “Data Privacy Rep”). Both representations were apparently false when made on the date of the Merger Agreement and as of the date of the July 8 Termination Notice, and both continue to be inaccurate. As revealed by the Zatko Complaint, Twitter apparently never acquired the rights to Twitter’s core machine learning models, which the Musk Parties understand to be fundamental to the Twitter platform itself. That infringement threatens not just significant monetary damages, but the potential for injunctive relief that would threaten Twitter’s ongoing business as currently operated. Either alone would be a Company Material Adverse Effect under the terms of the Merger Agreement. Similarly, the Zatko Complaint lays out widespread, egregious violations of the data privacy protections that a company like Twitter is expected—and, indeed, legally required—to have in place. This would be a gross violation of trust by the Twitter platform that will have legal and commercial consequences, and which also gives rise to a Company Material Adverse Effect under the terms of the Merger Agreement.

Section 7.2. Conditions to the Obligations of Parent and Acquisition Sub.  Finally, in the Merger Agreement, Twitter represented, inter alia, that it had not and would not (prior to closing) experience a Company Material Adverse Effect (within the meaning of the Merger Agreement). The breaches and consequences described above, individually and collectively, suggest that Twitter has in fact already experienced a Company Material Adverse Effect under the terms of the Merger Agreement, the full extent of which remains to be seen.

The facts supporting these breaches, which were withheld from the Musk Parties but known to Twitter as of the date of the Merger Agreement and at the time of the July 8 Termination Notice, provided additional bases to terminate the Merger Agreement as of that date and provide additional bases to terminate the Merger Agreement today if the Musk Parties’ termination of the Merger Agreement pursuant to the July 8 Termination Notice is determined to be invalid for any reason. This also provides a basis for recission. Because these facts were known to Twitter and withheld from the Musk Parties, and because Twitter has since taken the position that the Merger Agreement remains in effect, the Musk Parties hereby provide this additional notice of termination of the Merger Agreement effective as of July 8, 2022 pursuant to Section 8.1(d)(i) thereof on the basis of the facts set forth above. For the avoidance of doubt, these bases are in addition to, and not in lieu of, the bases for termination identified in the July 8 Termination Notice.

Sincerely,

Mike Ringler

Skadden, Arps, Slate, Meagher & Flom LLP