Bulletins

FireEye discloses breach, theft of cybersecurity tools by 'state-sponsored' actor

Following what it called a "state-sponsored attack" that it has referred to the FBI, security company FireEye disclosed Tuesday that some of its valuable tools for testing the defense of its customers have been stolen.

In a filing with the SEC, FireEye said "we have found that the attacker targeted and accessed certain Red Team assessment tools that we use to test our customers' security." "Red Teams" are security experts who target the defenses of their customers in hopes of finding problems with their security before criminals do.

Those tools, considered among the best in the security industry, are likely to wind up on the internet where they can be used against anyone. Stock in FireEye plunged 7% in after-hours trading.

Tom Krazit

Tom Krazit ( @tomkrazit) is Protocol's enterprise editor, covering cloud computing and enterprise technology out of the Pacific Northwest. He has written and edited stories about the technology industry for almost two decades for publications such as IDG, CNET, paidContent, and GeekWire, and served as executive editor of Gigaom and Structure.

Latest Bulletins

California, New York, and six other states take on crypto lender Nexo

Eight states, led by California and New York, have taken legal action against Nexo highlighting growing concerns about companies that offer unregistered crypto lending products.

Keep Reading Show less

The sky’s the limit for DALL-E, but investors have a rough road ahead

It’s a famous startup saying that the next big thing will start out looking like a toy. And there’s no toy that VCs have been more excited about playing around with recently than DALL-E and other generative AI image tools.
Keep Reading Show less

What is an anti-perk at work?

We know there’s no such thing as a free lunch. Still, the idea that many corporate benefits aren’t always a benefit recently touched a nerve on Twitter.

“Been thinking about anti-perks in tech jobs. What perks *sound* good but are a hard no from you?”

The tweet came from Jessica Rose, a developer relations advocate, founder of a meetup series for programmers and aspiring programmers and co-founder of Trans*Code, a hacker org devoted to drawing attention to transgender issues and opportunities.

Rose’s “hard no” was to those so-called benefits that have been around since time immemorial (or at least since the dot-com era). “Don't give me food or hammocks or video games, just let me work remotely or go home on time,” said Rose.

'Don’t touch me'

The tweet thread was full of varied responses, but the paradox of unlimited vacation was the clear favorite. “Wow, people are just so suspicious about unlimited paid time off,” Rose told Protocol when we caught up with her to ask about the tweet.

Other workers balked at in-office massages (“don’t touch me”), free booze, open-plan offices (did anyone in the history of the world ever call this a benefit?), fitness rooms, nap rooms, escape rooms (really any rooms), and something called “blameless retrospectives.” Um, what?

If employees are going to be suspicious of whatever perks you offer, why offer any perks at all?

“So I'm aware of how wonderfully spoiled it is to complain about perks being given out in some kinds of tech workplaces,” said Rose. “I'm the most unimpressed by ‘perks’ which either directly undermine employment rights (like unlimited paid time off can do in some regions) or are intended to throw work/life balance out of kilter in the workplace's favor.”

Unlimited or flexible vacation time can work, but it helps when the culture is one where people are encouraged to take time off and experts agree that mandatory minimums go a long way in helping create that kind of culture.

Your best interests or mine? Why can’t it be both? ¯\_(ツ)_/¯

A director of engineering at Google who formerly worked at Microsoft and Zillow called employer-sponsored coaching an anti-perk. “I’ll spring for a coach who is looking out for my best interests, not the company’s, thanks,” she said, adding, “I know I am lucky to be offered this, but it always feels like a trap.”

There’s good reason to be at least a little wary of these programs. Last year Protocol reported that when tech companies work with coaching programs like BetterUp and Bravely the conversations themselves are confidential, but the company often receives aggregated reports on the issues workers are expressing in general, the topics they’re discussing, what's going well for them at work, and what's not.

When Protocol spoke to Twilio’s VP of talent management Andrew Wilhelms about the company's coaching partnership, Wilhelms explained that BetterUp provides a set of Twilio-specific priorities to coaches and Twilio can update those priorities and goals based on what kind of culture change the company needs to see.

This might feel overly controlling, or it might be a great way to help change a company’s culture for the better, especially if a majority of employees are feeling stressed and burned out and are more likely to tell this to a coach than their manager. Twilio told Protocol that 99% of the employees who used the coaching service last year said the sessions were a valuable use of their time, and that 94% said the sessions made them more effective at their job.

“Thoughtful, meaningful perks can benefit both employers and team members, by helping keep their team members happy and hopefully keep them in their role for longer,” Rose said.

Free SunChips < values-based work culture

Research shows that today’s employees don’t want snacks as much as they want work that aligns with their values, and that extends to benefits.

  • “I love work perks that demonstrate an employer's ethics and commitment to meaningfully supporting their team members,” said Rose.
  • These benefits can include big structural benefits like location-agnostic pay and support for different kinds of employee leave, but also smaller things like “sending people a small bonus on their birthday to buy a cake,” Rose added.
  • Rose also looks for “employers who don't subcontract out cleaning or security staff, to make sure that all of their team members get access to the same kinds of pay and support.”

What your 'perks' say about your corporate culture

Some “anti-perks” are just common decency and respect, such as believing your employees are telling the truth when they call in sick. In response to Rose’s prompt, one senior system admin pointed out a job listing that offers an “honor-based sick leave policy” in addition to its “commitment to an open, inclusive and diverse work culture.”

And think twice about listing your game room in your job description, tweeted a product designer from Miro:

“When they advertise a ping-pong table in the job listing, it's a huge 🚩 for me. And I love ping-pong. If a silly perk like this [is] such a relevant part of your benefits package, that says a lot about what the company values, and likely its culture."

A version of this story appeared in Protocol's Workplace newsletter. Sign up here to get it in your inbox three times a week.

What a CFIUS focus on national security risk means for tech deals

Brisk political winds are chilling tech business relations between the U.S. and China, and perhaps more than anything right now, companies with business in China are fretting over one thing the U.S. government could do: change the rules for investments flowing from China into the U.S.
Keep Reading Show less

EV adoption is one of the world's only climate bright spots

This year is on track to be a record for global electric vehicle adoption. EVs are expected to make up 13% of light duty vehicle sales, and the world is on track to hit a 2030 milepost en route to net zero by mid-century. Yet the road ahead is far from smooth in other industries.

Keep Reading Show less

Your business might need a virtual assistant

The popularity of VAs has grown dramatically over the past couple of years. And we’re not talking about virtual assistant tech; we’re talking about real people.

Keep Reading Show less

Nobody's enforcing RTO mandates ... yet

Apple called its employees back to the office as the company’s three-day-per-week hybrid schedule finally began in early September. Many tech companies have eased up on requiring office work, making Apple somewhat of an outlier when it comes to RTO.

Another outlier, Google, has been in hybrid mode since April, reportedly leading to outbreaks of COVID-19 at the office. Yet for all the talk about Google’s three-day-a-week RTO policy, two workers who spoke to Protocol anonymously say it’s not much of a mandate. An employee and a contractor both told Protocol that the hybrid policy doesn’t seem to be imposed across the board.

“The impression I have is that it’s basically not enforced,” the employee said. The Google contractor said attendance varied across different teams, noting that while some of their teammates go to the office three days a week, most only go in once. (Neither Google nor Apple returned emails inquiring about how their hybrid policies are enforced.)

Sundar Pichai’s plan to make Google “20% more efficient” may lead nervous workers to choose to go to the office more often. (An August survey found that CBRE tenants were “evenly split” on whether a recession would drive more workers to the office out of anxiety for their job security.)

As of now, most companies’ hybrid requirements are only enforced as a “very soft mandate,” said Brian Kropp, distinguished VP of research at Gartner. About half of companies with a hybrid mandate are tracking office attendance, Kropp said, but even those that are doing so “have no real plans to fire people for not coming to the office, as long as they’re getting their work done.”

More than 40% of HR leaders surveyed by Gartner last month said they weren’t tracking office attendance. Thirty-five percent said they were gathering attendance data from key fob or badge swipes, while 22% said managers were tracking their teams’ attendance. Another 10% said employees were self-reporting their attendance.

Companies that selectively enforce attendance requirements may wind up with unfair outcomes, Kropp said.

“If you have a mandated set of days where you have to come to the office, but it’s unevenly enforced across the company, then you run into issues of fairness,” Kropp said. “That just creates more variability across the company, which then creates more risk as well in terms of that inconsistency.”

And while flexibility puts companies at an advantage when it comes to competing for talent, it also requires more sophisticated management, Kropp said. “The question you should really be asking is: Does our managerial population, on average, have the capability to manage much more flexibility, or not?” Kropp said. “If the answer is ‘yes, they do,’ you should push for as much flexibility as you can.”

To run high-performing teams in a flexible environment, managers need to be “half social worker, half engineer,” Kropp said. That means more empathy and more capacity for planning and organization.

While companies may seem settled into their hybrid ways of working, many leaders are leaving policies open to change with time rather than overcommitting themselves. The world is unpredictable, as we’ve learned in the last 2.5 years. “A lot of these executives — the way that they’re framing it now is, ‘This is our hybrid strategy for now, and it could evolve and could change,’” Kropp said.

Amazon falls into that category. As Andy Jassy put it at the Code Conference on Wednesday, Amazon doesn’t have a plan to force employees back to the office: “We’re going to proceed adaptively as we learn.”

A version of this story appeared in Protocol's Workplace newsletter. Sign up here to get it in your inbox three times a week.

How to do a background check on a potential employer

If you truly want to gauge a company’s culture before accepting a job offer, you have to become a bit of a sleuth. A journalist, even. Troll Blind and Glassdoor. Browse LinkedIn for current employees who seem trustworthy, or former employees who seem not to have an agenda.

But not everyone has the time to investigate companies in this way. Instead, they may rely on company-sponsored chats with current employees.

  • Ian Royer, a public relations specialist with Amazon Canada, took Amazon up on its “Candid Chats” program that connects candidates with members of employee resource groups.
  • He was on a mission to determine whether he fit with Amazon’s culture. “I am at a point in my career where when I do interviews, I interview for my fit, not the company,” Royer said.
  • Royer spoke with representatives from Amazon’s Black Employee Network and LGBTQ group Glamazon after encouragement from his recruiter. Those conversations ultimately won him over.

Steve McElfresh, founder of HR Futures, said it’s worth it for employers to offer to connect candidates with current employees. The more information, the more helpful to candidates. Still, it’s impossible for company-sponsored candidate-employee chats to be completely candid. Those chats are not entirely trustworthy.

  • “In most cases you’ve got to assume they’re using a stable of people who are prepped and primed to be positive about the company,” McElfresh said. “There’s nothing fundamentally wrong with that, but I think you've got to take it with a grain of salt.”

For those who want to connect with employees on their own, scouring LinkedIn and similar sites might be the best option. Professional platform Candor, a new startup trying to be the “more authentic LinkedIn,” was built with job sleuthing in mind.

  • “Especially in a remote world, it's so hard to figure out and so hard to get to know people and know if that culture fit is going to be there at your next opportunity,” said Candor founder Kelsey Bishop.
  • Candor profiles look kind of like corporate mood boards, with descriptors like “my core values,” “teammates that really inspire me” and “things that motivate me.” Bishop said the service is meant for casual networking, and to help people suss out the working styles of their potential future co-workers.

Bishop added that anonymous platforms can quickly turn toxic, hence Candor’s model with private profiles. But without anonymity, how candid will someone really be?

  • “As a candidate, you have to dig beyond what’s publicly available,” McElfresh said. “I would certainly be looking for more of the anonymous material.”
  • On the other hand, you can’t verify the identity, and therefore validity, of anonymous reviews. “The problem with anonymous material is you get the extremes,” McElfresh said. “You get people who are clearly unhappy, resentful and are almost assuredly overrepresented.”

The most prepared candidates will do all of the above. Just perusing Glassdoor or talking to one company-sponsored employee won’t give you the full picture. You’ve got to really do your research to figure out the fit.

A version of this story appeared in Protocol's Workplace newsletter. Sign up here to get it in your inbox three times a week.

The SEC may back off from a total ban on payment for order flow

The SEC reportedly will not push for a total ban on payment for order flow, a proposal that chair Gary Gensler said was "on the table" just a year ago.

Keep Reading Show less

Government warnings about viral fads may come too late

The FDA this week announced that cooking chicken in NyQuil isn’t safe, which seems obvious; it came from a “NyQuil cooking challenge” video that went viral — more than a year ago.

Government warnings about viral online fads may come too late to be effective. The NyQuil chicken challenge resurfaced in January after starting as a joke on 4chan in 2017.

  • In June, the FDA warned of the dangers of keeping avocados fresh by placing them in water. That video was popular a couple years ago.
  • Schools and lawmakers took a few weeks to catch wind of, and warn parents about, a “devious licks” video that resulted in students damaging school property.
  • The Tide Pod challenge, which started as a joke on Twitter in late 2017 before making its way to YouTube and elsewhere, got the Consumer Product Safety Commission’s attention about a month after it went viral.
  • And French lawmakers needed a few months to warn against the 2018 “InMyFeelings” challenge, which involved getting out of a moving car and dancing.

Government leaders need a lesson on virality. The timing of these warnings highlights the difficulty of staying on top of potentially dangerous challenges, which can go viral in a matter of days. “The FDA is always playing catch-up with these things,” Jeffrey Blevins, a professor at the University of Cincinnati’s journalism department, told me. “It’s impossible for them to be ahead of it. Who in their right mind would have thought of NyQuil chicken?”

  • But the fact that the FDA and other government agencies need months — even years — to identify and warn people about dangerous viral trends defeats the purpose of the warning. Once the alert comes around, the damage may have already been done.
  • The way in which the FDA responds to harmful viral videos might not be that effective anyway: The ones making the posts go viral — kids — probably aren’t following government alerts, Blevins said. “I would really encourage these agencies to think about being a little more creative in how they respond,” he said.
  • The FDA could post TikToks or poke fun at the absurdity of cooking chicken with NyQuil while also explaining the harms, for example. (The FDA didn’t immediately return a request for comment.)

It’s not just the government; pediatricians, schools, and other organizations are aware of the dangers of social media trends and are trying to catch on to them quickly. But word spreads fast, and in order for the government’s warnings to be effective, they need to happen sooner.

A version of this story appeared in Thursday's Source Code. Sign up here to get it in your inbox each morning.

Kraken CEO Jesse Powell is stepping down

Kraken CEO Jesse Powell is stepping down and will be replaced by chief operating officer David Ripley, the company announced Wednesday.

Keep Reading Show less

YouTube will now let creators make money from Shorts

Tuesday's “Made On YouTube” event was basically a competition to see how many ways creators and YouTube execs could talk about beating TikTok without actually saying the word “TikTok.”

Keep Reading Show less

Coinbase wants to build the AWS for crypto

Coinbase is launching a new product to connect developers to the Ethereum blockchain as part of its effort to offer a full stack of crypto infrastructure technology and diversify its business away from consumer trading revenue.

Keep Reading Show less

Tech is outpacing the Fortune Global 500 in race to net zero

The tech industry is way ahead of the curve when it comes to setting climate goals, particularly compared to other major industries.

Keep Reading Show less

NYC subway cameras are 'surveillance theater,' privacy group says

Privacy groups are outraged at New York's plan to install cameras in all subway cars in a bid to stop crime. The proposal, announced by Gov. Kathy Hochul on Tuesday, is an expansion of an earlier pilot project that the governor said was “working very well.” Under her expanded plan, there will be two cameras in each of New York’s 6,455 subway cars.

Keep Reading Show less

Microsoft's new Windows 11 update 'eradicates' a key hacker tactic

Microsoft is hoping that adoption of its latest version of Windows 11 will wipe out a popular technique for stealing credentials, thanks to the company's move to turn on certain security features by default in the operating system.

Keep Reading Show less

Amazon, PepsiCo and others pledge jobs and trainings for refugees

Leading U.S. companies including Amazon, Pfizer and PepsiCo have pledged to hire 20,000 refugees over the next three years.

Keep Reading Show less

The Treasury wants to know what you think about Tornado Cash

The Department of the Treasury issued a request for comment Monday on Biden’s March executive order on cryptocurrency, creating a formal process around an issue that has already generated significant discussion. The Treasury is accepting comments through Nov. 3.

Keep Reading Show less

Uber's breach shows how hackers keep finding a way in

It's still unclear whether the breach of Uber's internal IT systems, revealed on Thursday, was anything more than embarrassing for the company.

Keep Reading Show less

US military orders audit of its own online manipulation operations

In 2020, employees from Facebook and Twitter contacted the Pentagon with concerns about fake accounts they suspected had ties to the U.S. military, according to a Washington Post report. One Facebook executive even reached out to the Pentagon’s head of influence operations policy, Christopher C. Miller. The executive warned Miller that foreign adversaries could likely suss out the origin of these accounts, given that Facebook could, too.

Keep Reading Show less

Appeals court backs Texas' social media must-carry law (again)

A federal appeals court has once again backed a Texas law that would fundamentally remake social media by forcing companies such as Meta and Twitter to carry most content, including hate speech.

Keep Reading Show less

Eric Schmidt went to Ukraine. Now Elon Musk is his war tech hero.

Call it a reconnaissance mission to Europe’s future Silicon Steppe.

Eric Schmidt, Alphabet’s technical adviser and former Google CEO, just returned from a personal mission to Ukraine where he scoped out its military tech operation and met with the country’s minister of defense. A tireless advocate and funder of emerging tech for defense and national security uses, Schmidt sees the war in Ukraine as a launch pad for fast-moving tech implementation.

Keep Reading Show less

Biden's crypto game plan has a heavy focus on risk

The Biden administration offered a deeper look into its crypto game plan Friday, unveiling a strategy that focuses more closely on the risks posed by the controversial industry. It released nine reports that came in response to the president’s crypto executive order issued in March.

Keep Reading Show less

The FTC zeroes in on fake countdown clocks and pre-checked boxes

The Federal Trade Commission on Thursday signaled rising concern with manipulative digital interfaces, including subscriptions that auto-renew without disclosure, countdown clocks that falsely suggest deals will go away if customers don't buy quickly and the steering of consumers toward privacy options that give "away the most personal information."

Keep Reading Show less
Bulletins