The company filed for the sale on Tuesday, with the company seemingly trying to take advantage of its soaring stock price, which is up 650% so far this year. Its stock dropped on the news though, down around 2% as of 9.45 a.m. ET.
Shakeel Hashim
Shakeel Hashim ( @shakeelhashim) is a former growth manager at Protocol, based in London. He was previously an analyst at Finimize covering business and economics, and a digital journalist at News UK. His writing has appeared in The Economist and its book, Uncommon Knowledge.
Latest Bulletins
David Hatfield has stepped down as co-CEO of cloud security vendor Lacework but will remain on the company's board of directors, Protocol has learned.
The change is effective immediately, said Jay Parikh, who had been Lacework's second co-CEO and was previously Facebook's vice president of engineering. With the change, Parikh is now the sole chief executive of the privately held company, a prominent up-and-coming player in cloud security that last year achieved a valuation of $8.3 billion.
Lacework planned to inform employees of the change on Tuesday. Hatfield, who previously served as president at Pure Storage, leaves Lacework's executive leadership a few months shy of his second year with the company.
As part of the co-CEO model, Hatfield, who goes by the nickname "Hat," focused on business operations and expansion at Lacework, which has raised $1.85 billion in funding. Hatfield joined Lacework as CEO and chairman in early 2021. He could not immediately be reached Tuesday.
Parikh joined as co-CEO in mid-2021, and has focused on product and engineering for the company. The two have known each other for two decades, having previously worked at the same time at Akamai Technologies.
In an interview with Protocol, Parikh characterized the move as planned and amicable, prompted by conversations between "Hat, myself, and the board" that led to the conclusion that the co-CEO model was no longer the best fit for the company. Lacework's executive leadership and board have been "looking at where the business is and what it needs to get to the next level," and have determined that "unifying the company" under a single CEO made the most sense right now, Parikh said.
When it comes to Lacework's product and sales strategy and its relationships with customers, partners, and the big public cloud platforms, the move should help with "making sure that's all unified [around] one set of priorities with one focus," he said.
Parikh said he doesn't believe Hatfield has "any immediate plan to go jump into anything full-time anytime soon." Hatfield is "still going to be spending a good amount of time" on Lacework, Parikh told Protocol.
Lacework CEO Jay Parikh
Image: Lacework
Founded in 2014, Lacework offers a "data-driven" service that aims to stand out in the fast-growing cloud security market by collecting and analyzing data from across a customer's cloud environments. The goal is to to provide customers with crucial security insights, such as which threats to prioritize for action, the company has said.
The company raised a $525 million funding round in January 2021, followed by an additional $1.3 billion in funding in November 2021 that brought with it the $8.3 billion valuation. Lacework touted that round as "the largest funding round in security industry history," and the company ranks at No. 3 in terms of the biggest valuations for privately held security companies, according to CB Insights.
Lacework is also notable for having been just the third company to be incubated out of Sutter Hill Ventures, following a model that was used to launch Pure Storage and Snowflake. The Lacework platform supports AWS, Google Cloud, and Microsoft Azure, as well as Kubernetes environments.
In May, Lacework disclosed that it had laid off 20% of its staff, in response to what the co-CEOs then described as a "seismic shift" in "both the public and private markets." The company had previously reported having more than 1,000 employees as of March, and did not immediately have a figure available for its current employee count on Tuesday.
Prior to Lacework, Hatfield had previously spent nearly seven years as president at Pure Storage followed by 16 months as its vice chair, according to his LinkedIn. He joined the company as president in 2013, a few years into its founding, and stayed on through its initial public offering and its first several years as a public company.
While there are no plans to directly replace Hatfield at Lacework, given the unification of the CEO duties under Parikh's leadership, the company does plan to hire a chief revenue officer in the near future, Parikh said.
Ultimately, Lacework's leadership is focusing on making moves that will set it up "to be successful over 10, 20 years — we're not building this to be a transaction," Parikh said.
Keep Reading
Show less
California’s new pay transparency law, SB 1162, promises to shake up compensation in the tech industry by requiring employers in the state to list pay scales in job ads and reveal pay information to both the state and to current employees. We spoke with Susan Alban, operating partner and chief people officer at Renegade Partners, and compensation consultant Ashish Raina to learn how.
Startups will adopt pay bands earlier. Five or 10 years ago, it wasn’t unusual for 50-person companies to be operating without a “career ladder” or “career architecture” with compensation bands for different job functions and levels, Alban said.
- Today’s tighter labor market — and demands from candidates — mean that companies structure their compensation bands sooner.
- Because the new law applies to companies with just 15 employees, even tiny startups will be required to define their pay bands in a more structured way, Alban said.
- “Which is a little funky when you have, like, eight people, to have a band for every single job, because sometimes you just have one person in a job,” she said. “It just nudges companies to be a little bit more thoughtful in defining what is the job, what is the relative seniority, and what would we reasonably pay relative to market-based pay.”
Companies may find other ways to differentiate pay in order to compete for the best talent. The law only requires companies to disclose base pay, not stock, bonuses, or benefits.
- This means bonuses and equity could become more important forms of compensation, which may shift the issue of unequal pay to other areas.
- Bonuses “can be very arbitrary,” especially in early-stage companies where goals change all the time, Alban said.
- They may prove to be even more important levers for attracting and retaining great employees, however. “Fair pay is not equal pay,” Raina said. “If someone is more proficient or more highly performing in a role, there should be a differentiation in pay.”
The law might provide a little more incentive for companies to hire outside of California, but not much. The law on its own is unlikely to have a major effect on where companies hire, but it adds more administrative headache to California employers.
- “I don’t hear employers talking about not wanting to hire in the state of Colorado because of these laws,” Alban said.
- Some companies may choose to advertise jobs with a national labor rate that would overpay candidates in low-cost states like Mississippi but underpay Californians, Raina said.
Big companies are likely to comply more readily than startups. An online job search shows companies like Google, Salesforce, and Twitter listing pay ranges in ads. Some listings cite the Colorado law explicitly.
- “I think the general consensus among progressive technology employers is that this is the way the world is going,” Alban said. “Rather than fret about it and deviate from hiring in particular regions to avoid compliance, better to just comply anyway.”
- Some startups likely won’t comply with the law, Raina said. “They’re trying to survive,” he said. “Yes, this law exists, and yes, there’s going to be some risk if they don’t comply, but that isn’t necessarily people’s forefront of an issue.”
A version of this story appeared in Protocol’s Workplace newsletter. Sign up here to get it in your inbox three times a week.
Keep Reading
Show less
Pour one out for the Lightning cable.
The European Parliament voted in favor of new charging standards that will require all phones, tablets, and cameras sold in the European Union to be USB-C-ready by 2024. The mandate will extend to laptops in 2026.
The rule — which was introduced in June — passed 602-13, while eight members abstaining from voting. That reflects an overwhelming desire to make the average person's life easier (goodbye, cluttered junk drawer) as well as cut down on pernicious e-waste. While the decision means that ports such as micro-USB will fall by the wayside, Apple's Lightning port is also slated to go the way of the dinosaur.
The company's iPad and various MacBooks rely on USB-C charging. But Apple has held steadfastly to the technology for the iPhone, rolling out its most recent iteration of the phone with a Lightning rather than a USB-C port. The iPhone was the bestselling phone in the EU last year, with Apple capturing 34% of the smartphone market.
The European Council needs to sign off on the legislation before it officially goes into law. But that prospect looks likely. After that, the clock to USB-C hegemony begins counting down. The timing could work out well for Apple at least; the company releases a new iPhone every year in September. With the mandate likely to take effect in fall 2024, it means next year's iPhone could well be the last one to feature a Lightning port — unless Apple decides to just get the switch over with, something the company is reportedly considering.
The company could also make a USB-C version of the iPhone for the EU and a Lightning version for everyone else, of course, but that seems unlikely given the logistical hurdles. The iPhone could also go totally portless for charging, though that would be a much more radical leap.
As written, the rule would allow electronics without a USB-C port to continue being sold as long as they are "placed on the market before the date of application," according to a press release announcing the vote. Regardless, if you're a Lightning stan, uh, you should consider snapping up an iPhone 14 sooner than later.
Cutting down on e-waste is a sneaky climate policy. The Global E-Waste Monitor put out by the United Nations showed that nearly 54 million tons of e-waste piled up in 2020, a number that could rise to almost 75 million tons by the end of this decade. That's a local environmental concern given the toxic chemicals and components. But it's also a huge waste of emissions. More than two-thirds of the carbon pollution tied to electronics is emitted in the manufacturing process.
Cutting down on the number of charging cables produced (and trashed) is a relatively modest way to cut down on e-waste. Stronger policies that favor right-to-repair as well as companies working harder to stave off forced obsolescence could also offer a pathway to reduce the amount of electronic churn. Improving e-waste recycling is yet another avenue to cut down on trash; the Global E-Waste Monitor found only 17.4% of electronic trash is currently recycled. Apple and other tech companies have touted moving toward a circular economy as central to their sustainability goals. While the EU's USB-C mandate alone won't make that transition magically happen, it could spur further innovation and serve as a reminder of all the work that remains to be done.
Keep Reading
Show less
Carbon dioxide removal service buyers and sellers are focused on one metric: $100 per ton. It’s one of Frontier’s stated criteria that the fund uses to evaluate its advance purchases. In a survey of the long-duration carbon removal community, CarbonPlan found that stakeholders are focused on the $100 benchmark. The Department of Energy even announced that it would be investing in carbon removal research to bring the cost of the technology down to $100 per ton.
Where did that number come from? In short, it’s the cost per ton of removal services that it would take for the CDR industry to reach commercial viability. It’s based on a handful of factors.
- It’s the point at which carbon removal becomes affordable at the scale needed to make it a meaningful tool to reach net zero (and, eventually, negative emissions), Shuchi Talati, a senior visiting scholar at Carbon180, told Protocol.
- It evolved from modeling and policy conversations, and is aligned with other existing costs, like the European Union’s carbon price (which will likely reach that number in a decade).
- It’s also tied to the social cost of carbon, a metric that measures the economic damage a ton of carbon emitted causes. Estimates of the social cost of carbon keep increasing as climate damages become clearer.
- Another reason could be much simpler. The climate community could just be taking its cue from the DOE, anchoring its own targets to the agency’s 2021 Carbon Negative Shot target, which was set for $100 per ton, CarbonPlan’s Danny Cullenward wrote in an email to Protocol.
So far, no one has come anywhere close to reaching that target. Currently, most carbon removal services cost well above $100 per ton, although the Inflation Reduction Act’s updated 45Q tax credit of up to $180 per ton for direct air capture could help some startups get closer to achieving that target.
“$100 per ton is an extremely ambitious 10-year target, likely probably more of a 15- to 20-year target,” Talati said. But she thinks it’s “important to be ambitious,” and “there’s a lot of momentum around CDR and getting these technologies to scale.”
The world could have to remove billions of tons of carbon pollution per year from the atmosphere by midcentury depending on how fast emissions fall in the interim. That makes the momentum behind scaling CDR all the more important.
A version of this story appeared in Protocol’s Climate newsletter. Sign up here to get it in your inbox twice a week.
Keep Reading
Show less
When Google announced the closure of its Stadia cloud gaming platform last week, the news was delivered at roughly the same time to employees, partners, and players on Thursday morning. Within hours, it had become clear that Stadia’s shutdown, planned for next January, would involve more than just refunding consumer purchases and quietly bowing out.
Now developers are scrambling to salvage planned projects, migrate players to other platforms, and figure out whether they’re still owed money from Google before the search giant puts Stadia out to pasture for good.
Stadia’s shutdown came as a surprise. Scores of indie game makers, not typically bound by the conservative norms of corporate PR, took to Twitter to explain their frustrations upon learning of the shutdown from news articles and a terse five-paragraph blog post from Stadia chief Phil Harrison.
- “Tangle Tower was due to launch on Stadia in 2 days time, and this article was the first I heard about it shutting down,” SFB Games co-founder Tom Vian tweeted on Thursday.
- “We have a title coming out November 1st,” Rebecca Heineman, CEO of indie studio Olde Sküül, wrote in response to Vian. “Now we hear about this.” Olde Sküül has since announced it will release its planned Stadia game, Luxor Evolved, on console and PC in 2023.
- “We have a game coming to Stadia in November. Who wants to guess that Google will refuse to pay us the money they owe us for it,” tweeted Mike Rose, founder of British game publisher No More Robots. “Hours later and I still have no email from Stadia, and no clarity on what’s happening with our games, deals, anything.”
- Necrosoft Games creative director Brandon Sheffield was quick to point out how strange it was that Stadia released a new software development kit just two days prior to the announcement.
- Necrosoft Games was planning a sequel to its Stadia exclusive game Gunsport, and Sheffield told The Verge he has no idea if the publisher will be able to release Gunsport on other platforms or receive some type of reimbursement.
- “We were having marketing discussions [with Stadia] just last week,” Sheffield said. “So it’s unfortunate all around, as I think the platform was gaining some good traction.”
It wasn’t just indies caught off guard. Google’s Stadia announcement kicked off a wave of uncertain responses from major third-party partners, including Bungie, CD Projekt Red, and Ubisoft. The consensus: We’re looking into it.
- Ubisoft has been Google’s longest cloud gaming partner, having given the company Assassin’s Creed Origins to test Stadia’s Project Stream predecessor. And with 38 games on the platform, Ubisoft said on Friday it was “working” to allow Stadia customers to bring those purchases to PC but had nothing more to share.
- “We hear you - we are looking into ways for you to continue your HITMAN experience on other platforms,” wrote Hitman developer IO Interactive.
- “All I can say now is that we’re currently looking into the matter, and exploring possible options,” a representative of Cyberpunk 2077 studio CD Projekt Red told The Verge.
- “We just learned about Stadia shutting down and have begun conversations about next steps for our players,” a Bungie representative posted to the company’s Destiny 2 forums.
- One player of the online component of Rockstar’s Red Dead Redemption 2 who logged more than 6,000 hours into the game for Twitch and YouTube content has no idea if they can migrate their account off of Stadia. Rockstar has yet to respond to Stadia’s shutdown.
It’s not clear why Google axed Stadia now, and why it did so with little to no warning for any of the various parties that invested time, money, and other resources into the platform over the last three years.
- Google is undergoing a serious cost-cutting effort at the moment to contend with the economic downturn. And Stadia was expensive: Last year, Bloomberg reported that Stadia spent tens of millions of dollars just to secure rights to a single big-budget release like Red Dead Redemption 2.
- CEO Sundar Pichai said last month he wants to make the company “20% more productive,” and hiring slowdowns, the cancellation of a new Pixelbook, and other cost-cutting efforts may have pushed Stadia toward the chopping block.
- Stadia arrived on the gaming scene with big ambitions in 2019 that included developing original exclusives that would make use of the platform’s cloud computing advantages.
- But Google’s internal studios were shuttered less than 18 months after launch, and many of its ambitious cloud features like State Share never made it to more than 10% of the platform.
- Ultimately, Stadia chief Harrison said the main culprit was a lack of growth: “While Stadia’s approach to streaming games for consumers was built on a strong technology foundation, it hasn’t gained the traction with users that we expected.”
- "The number one problem is the business model. Secondly, you need to deliver something consumers cannot get elsewhere," said Benjy Boxer, the co-founder of game streaming platform Parsec who now oversees the product at Unity. "In my opinion, the only way cloud gaming will ever shift to the mainstream is if we get to a point where we’re not selling the distribution technology and instead selling a unique value proposition."
- Boxer said Stadia had "amazing technology" but failed at selling coherent product and experience. "Stadia never figured out who their customer was," he added.
It’s perhaps too early to draw broader conclusions about Stadia’s closure, what it could mean for cloud gaming as a whole, and whether the platform’s demise is the nail in the coffin for Google’s gaming ambitions. But Google’s sloppy handling of the announcement and Stadia’s stunning failure is evidence that even the largest, most experienced companies can find themselves lost in the woods when trying to crack such a notoriously difficult set of problems.
Cloud gaming is still available on platforms operated by Microsoft, Nvidia, and — for the time being — Amazon, too. But developing games is costly, difficult, and multidisciplinary work that takes years, and streaming those games over the cloud has yet to be accomplished in a sustainable fashion with an attractive business model. Google found this out the hard way, and let’s hope Stadia’s shutdown provides the road map that helps keep its competitors alive.
A version of this story appeared in Protocol’s Entertainment newsletter. Sign up here to get it in your inbox three times a week.
Keep Reading
Show less
Trading of Twitter shares was briefly halted midday as CNBC and Bloomberg reported that Elon Musk now plans to go through with his deal to buy Twitter for $54.20 a share. The news was later confirmed.
Musk sent a letter to Twitter with his proposal to buy the company, according to an SEC filing. Twitter said it has received the letter and intends to close the deal at the originally agreed-upon price of $54.20 a share.
Musk and Twitter have been in a legal battle to push the Tesla CEO to buy Twitter since July, when Musk filed to back out of his proposed $44 billion acquisition. Musk tried to walk out of the deal based on allegations that Twitter was misstating the number of bots and spam accounts on the platform, which Twitter rejected. A trial in the case is scheduled to begin on Oct. 17.
The news coincidentally broke just as Twitter employees were near the start of a three-hour meeting to plan its 2023 strategy, according to reporter Casey Newton. "I am sitting on 2023 company wide strategy readouts and I guess we are going to collectively ignore what’s going on," Twitter employee Rumman Chowdhury tweeted.
Twitter shares jumped 15% on the news before being halted.
This is a developing story and will be updated.
Keep Reading
Show less
The U.S. is set to unveil a fresh set of policies Thursday aimed at choking off China’s access to advanced chip manufacturing technology and the chips themselves, according to a person familiar with the matter.
Thursday’s planned announcement will articulate and expand upon the Biden administration’s early efforts to impede China’s military establishment and domestic surveillance apparatus from obtaining technology related to computing that is largely focused on AI applications. Those efforts to date have included notification letters to chip companies and tool makers advising them of new limits on sales. The administration’s goal is to use a broad range of policies, including export controls, a potential executive order, and the foreign direct product rule, among other methods.
The Commerce Department declined to comment. The White House did not respond to a request for comment. Reuters and The New York Times reported earlier Monday that the announcement was set for this week, but did not specify a day.
The Biden administration’s strategy around China’s access to American chip technology has begun to take shape following the appointment of several key White House officials and the confirmation of Commerce Department Undersecretary for the Bureau of Industry and Security Alan Estevez in March. The BIS is responsible for American export controls.
The administration’s plans include blocking Chinese businesses, government research labs, and others from purchasing products that use American-made tech, The New York Times reported. Expanding the use of the foreign direct product rule to block Chinese entities from buying certain chips is only one element of the strategy, the newspaper said.
Protocol reported in August that the Biden administration plans to roll out export control rules on semiconductor manufacturing equipment that is capable of making chips with fin field-effect transistors, or FinFETs. FinFET loosely refers to the shape of the transistor, which is sometimes referred to as the 14-nanometer manufacturing process. Thursday’s announcement is expected to include export controls on chipmaking tools.
In late August, Nvidia and AMD disclosed they had received notification letters from the Commerce Department ordering them to halt sales of chips designed for artificial intelligence computing. Neither company disclosed the technical limits the administration imposed on the AI chips, but Nvidia CEO Jensen Huang said it was a combination of computing horsepower and a “specific level of inter-chip connection bandwidth.”
Beyond the logic chips made by Nvidia and AMD for AI applications, the Biden administration has also considered blocking several types of memory, according to two people familiar with the administration’s thinking. High-bandwidth memory (which is useful for training large AI models) and flash were among the memory technologies under consideration, the people said.
Administration officials had been briefed by several memory manufacturers about establishing specific thresholds for flash and high-bandwidth memory, according to another person familiar with the discussions. It wasn’t immediately clear what, if any, export controls or other measures would apply to memory in Thursday’s announcement.
Correction: An earlier version of this story misstated the date of Alan Estevez's confirmation and the month in which Nvidia and AMD disclosed notification letters. This story was updated on Oct. 4, 2022.
Keep Reading
Show less
Companies like Meta and Lyft have stopped hiring for the year, and that’s music to the ears of other tech companies that are still staffing up. Much of talent sourcing still takes place on LinkedIn, but many recruiters have found their own techniques to use the service more efficiently. We asked LinkedIn’s VP of talent acquisition and three outside recruiters for their best LinkedIn hacks for sourcing talent.
When reaching out, short and sweet is key. When sending a connection request, executive recruiter Darrell Rosenstein said he rarely sends more than three sentences or 150 characters.
- “If you’re at 300 characters, you’re way over for a candidate,” Rosenstein said.
- Rosenstein also doesn’t ask for an appointment or include a Calendly link in the first message to a candidate. “That’s a second email,” Rosenstein said. “After they’ve connected, then for sure.”
- Specific, well-informed messages targeted to the candidate are crucial to getting a good response rate — by all means, don’t “spray and pray,” said Shawn Cole, co-founder and president of Cowen Partners. “We do not want to be the agency that sends out stupid messages.”
Focus on skills, not pedigree. Erin Scruggs, VP of talent acquisition at LinkedIn, said skills — which candidates can list on their profiles — are the “future currency” of recruiting, particularly in a tight labor market.
- “Everything we’re doing on the product is about contextualizing skills, and understanding how skills of one role map to another role,” Scruggs said. “If you’ve got somebody who’s a cashier, they may very likely have the same skills as a customer service rep.”
- This can be particularly useful for employers that don’t have as much name recognition or as strong of a “talent brand,” Scruggs said. It can also help a team source more diverse hires.
- Employers that aren’t yet a household name may want to consider skipping the first page of search results — maybe even checking out the candidates on the last page, Scruggs said. “They may not come from the five companies you typically hire from, but it helps you think a little bit more broadly about who could do the job, who’s capable of doing the job,” Scruggs said. “That sometimes helps you go for the people that haven’t been pinged 35 times in the last week.”
Post content to your company LinkedIn page to build a recruiting brand. Particularly for lesser-known startups, content can offer a glimpse into your company culture and personality.
- “I follow thousands of talent acquisition professionals,” Scruggs said. “When I go to hire, I have sort of an affinity bias towards people whose posts that I’ve really enjoyed or people who have been really insightful along the way. I think the reverse is true: Employers can create their talent brand by being really intentional about what they post.”
- Outside recruiters can use this tactic as well. As an executive recruiter, Rosenstein said he posts content to his own profile that helps him engage candidates and raise his response rates.
Try LinkedIn’s “best-kept secret”: affinity groups. Paige Scott, who leads the Asset Management practice at the recruiting firm Kingsley Gate Partners in San Francisco, said groups are one of her favorite LinkedIn features for reaching candidates.
- Groups can reach a targeted set of users like financial officers of health tech startups, for example. Reaching out through groups can be particularly helpful for those who haven’t ponied up for LinkedIn’s premium subscription options, she said.
- “It’s probably the best-kept secret on LinkedIn,” Scott said. “Groups are an incredible way to reach a bigger, broader audience without having to trigger different licenses.”
A version of this story appeared in Protocol’s Workplace newsletter. Sign up here to get it in your inbox three times a week.
Keep Reading
Show less
Kim Kardashian broke the internet, and according to the Securities and Exchange Commission, she also broke the securities laws.
The SEC announced Monday that the mega-influencer, reality TV star, and billionaire businesswoman will pay $1.26 million to resolve allegations she touted EMAX tokens on Instagram without disclosing she was being paid for it. Kardashian, who the SEC said "also agreed to not promote any crypto asset securities for three years," did not admit wrongdoing.
The SEC also said she had received $250,000 for her post on the token from EthereumMax. Her fine represents the payment, plus interest and a $1 million penalty.
SEC Chair Gary Gensler took the opportunity of the settlement announcement to tweet that the case showed "when celebrities / influencers endorse investment opps, including crypto asset securities, it doesn’t mean those investment products are right for all investors."
Keep Reading
Show less
On Thursday, California Gov. Gavin Newsom signed into law a bill that makes phone calls from California’s prisons free of charge. The new law places the cost of calls not on incarcerated people — or the people receiving calls from them — but on the state’s Department of Corrections and Rehabilitation.
California is the second state after Connecticut and the biggest state by far to institute such a law, which is a direct shot at the $1.4 billion prison telecom industry. For years prison telecom companies have maintained rates that “can be unjustly and unreasonably high, thereby impeding the ability of inmates and their loved ones to maintain vital connections,” the FCC said in 2020.
Prison reform advocates argue the new California law will have a hugely positive impact on the families of incarcerated people in California — and potentially other states that follow California's lead.
"From a public policy perspective, we should be wanting people to stay connected to their social networks, to their families, to be able to start looking for employment if they are close to getting out," said state Sen. Josh Becker, who sponsored the bill, SB 1008. "But we have a very perverse system, which inhibits that and actually throws many families into debt."
For years, the high cost of prison phone calls has sapped money from low-income families with incarcerated loved ones. According to a 2015 report by the Ella Baker Center for Human Rights, 34% of families go into debt in their attempt to maintain contact with loved ones inside through phone calls and visitations. The impact is disproportionately felt by women of color, because of the corresponding disproportionate number of men of color in America’s prisons.
Now, with the governor's blessing, "the simple cost of a call is never going to impair their ability to tell their children they love them or help their partner problem-solve a parenting situation,” said Bianca Tylek, executive director of Worth Rises, a prison reform organization, which was a key player in advocating for the bill.
The new law covers the 93,000 incarcerated people in the state's prison system, and Becker hopes future legislation will extend free calls into California's city and county jails, as well.
In addition to making calls free to users, the law prohibits local agencies from “receiving revenue for the provision of communication services to persons in its custody." The law also charges the state’s utility commission with ensuring service does not fall below standard, now that calls are free. Proponents of the law say the policy change will cost California about $12 million annually, but that is a small fraction of the $14.2 billion budget for the state’s corrections department.
In recent years, the Federal Communications Commission has tried to clamp down on the astronomical costs charged by prison telecom providers including slashing fees and capping rates at 21 cents per minute for interstate calls in 2013. More recently, the FCC adopted a rule to prevent prison phone companies from seizing pre-paid funds from users, after one prison telecom giant, GTL, was found to have seized $121 million in customer funds. Other local governments have notched their own victories in the fight against sky-high prison call rates. In 2019, New York became the first major city jail system to make calls free. In 2020, San Francisco also made phone calls from its jails free and announced a policy change that would "permanently stop generating revenue from incarcerated people and their families through phone calls."
But advocates are hopeful that California's law will set an example for other state governments, because of the sheer size of its prison population. “California has a much bigger system, and what it does matters to the rest of the corrections community,” Tylek said. “It will be a huge trendsetter for everyone else.”
Keep Reading
Show less
Rohit Chopra arrived as director of the Consumer Financial Protection Bureau one year ago today. True to his reputation as an aggressive watchdog from his time as an FTC commissioner and an earlier stint at the CFPB, he has pursued a busy agenda that’s setting up regulatory battles to come.
Chopra hasn't been afraid to challenge big banks or fintechs. His fight against banking’s so-called junk fees, for instance, won plaudits from both consumer-focused groups and fintech trade organizations.
- To little surprise, the agency has been more active under Chopra and the Biden administration compared to the Trump years.
- Fintech-focused initiatives have included promises for greater scrutiny of algorithmic lending, earned wage access programs, and fraud on peer-to-peer payment networks.
- Chopra’s CFPB has also stated plans to invoke the agency’s dormant authority to examine certain nonbank financial companies, including fintechs.
- The agency’s competition-focused office shut down a sandbox program that offered fintechs a regulatory safe harbor to test new financial products.
All eyes in the fintech world are on open banking. The CFPB regulatory docket this fall includes a long-delayed rule-making effort to allow customers to more easily move their data between financial institutions. The effort is part of the Biden administration’s goal to boost competition in markets.
- "We believe that consumers, not financial institutions, own their data and hope the CFPB will provide clear guidance establishing consumers’ right to control and permission their financial information," said Penny Lee, CEO of the Financial Technology Association.
- As for other priorities, a recent agency report on “buy now, pay later” lending also indicates further action is likely. “Exactly what shape that takes isn't immediately obvious,” said Jason Mikula, a fintech consultant and author of the Fintech Business Weekly newsletter. "Any action on BNPL is likely to focus on credit underwriting/credit reporting, how companies assess consumers' ability to pay, consumer protections (chargebacks), and adequate and consistent consumer disclosures.”
- Consumer advocates want to see more protection extended to pay-later loans and other new financial products. They also want the CFPB to ensure that “criminals cannot use P2P services or other means to defraud people and steal their money,” said Lauren Saunders, associate director at the National Consumer Law Center.
- Something to watch: How the agency balances rule-making and the CFPB’s bully pulpit (something close watchers of the agency say he has leaned on more to this point) with enforcement actions. "I think he is trying to use the carrot and the stick," said Jonah Crane, a partner with Klaros Group.
The agency’s tactics and a growing list of priorities are prompting powerful pushback. The industry and Republican members of Congress are circling.
- Banking industry groups and the U.S. Chamber of Commerce sued the agency on Wednesday, claiming it violated administrative procedure law by updating its examination guidebook to include oversight of potential discrimination in bank accounts and other financial products not already covered by fair lending laws.
- The bureau said its mandate to investigate unfair, deceptive, and abusive acts or practices (UDAAP authority, in bureaucratese) gives it oversight of the products. But the lawsuit marks the most significant legal challenge yet from business groups that have been critical of Chopra’s tactics for some time.
- Sen. Pat Toomey, ranking member on the Banking Committee, has called the agency “lawless,” and congressional scrutiny in the form of document requests and oversight hearings will only increase if Republicans gain control of either the House or Senate this fall.
The agency seems to be gearing up for that possibility. American Banker reported that the CFPB launched an office this summer dedicated to responding to congressional requests. Crane, a former Treasury official, said document requests can eat up a lot of administrative resources: “It is a big exercise, but it seems he is preparing to handle it without distracting from his day job.” But there’s little question that Chopra’s second year in the job will be more challenging than his first.
A version of this story appeared in Protocol’s Fintech newsletter. Sign up here to get it in your inbox each morning.
Keep Reading
Show less
Tech salaries are about to get a lot more transparent. On Tuesday, Gov. Gavin Newsom signed a new law to require California employers to post salary ranges in job postings and report hourly pay data by employees’ race and sex to the state. We spoke with four employment lawyers and other pay transparency experts about what this means, and how to comply.
What does SB 1162 require? Starting in January, employers with 15 or more workers will be required to disclose salary ranges in job postings, including on third-party sites. Companies with 100+ employees, including contractors, will have to report on mean and median wage data.
- The law only addresses base pay, not benefits, bonuses, or equity.
- In addition to these requirements, the law will require employers to reveal pay scales to employees who request that information about their current role.
Who has to comply with SB 1162? Any 15-plus-person company with employees in California will be subject to the law — even if your HQ is elsewhere.
- It’s unclear whether it will apply to companies with fewer than 15 workers based in California, but this will likely be clarified in the coming months, said Lulu Seikaly, senior corporate employment counsel at Payscale.
What if my employees are remote? The law doesn’t address remote work, and how this law applies to non-California workers who may want to know their role’s pay scale is still a “gray area,” said Rachel Conn, a San Francisco-based partner in the Labor and Employment group at the law firm Nixon Peabody.
- Conn said that large employers should be prepared for requests about pay scales from employees outside California. “You may see pressure from employees to have that information included, even if they’re not subject to the law,” Conn said. “It remains to be seen whether or not it’s going to encompass all remote workers.”
- Aaron Goldstein, a Seattle-based partner at the law firm Dorsey & Whitney, expects the law to only apply to California-based employees. “Generally speaking, the rule is that protections in the state law apply to the state where the employee lives and works.”
Didn’t California companies with 100+ employees already have to report pay data? Yes! Private companies with 100 or more employees started reporting their annual pay data by sex and race/ethnicity last year.
- The new law expands this requirement to include contract workers, and mandates that companies report their mean and median hourly wage data, said Emily Sweet, VP of social impact at OpenComp and lead executive of the OPEN (Organizations for Pay Equity Now) Imperative.
- “Private employers with 100 or more employees that are hired through labor contractors — third-party sources — must also complete a separate pay data report for their contractual employees as well,” Sweet said. “That is a real difference.”
Can companies get around this? After Colorado passed its pay transparency law, some companies tried to dodge the requirement to disclose pay ranges by excluding Colorado applicants in job ads.
- It’s unlikely that will be much of an issue in California because of the state’s huge labor force and wealth of employers.
- “I don’t think they’re going to be able to get around it in California, because once you have employees in California, California has all the protections of this law,” said Goldstein. “This law is going to primarily be concerned with companies that already have employees in the state.”
A version of this story appeared in Protocol’s Workplace newsletter. Sign up here to get it in your inbox three times a week.
Keep Reading
Show less
Microsoft said Friday it's "working on an accelerated timeline" to provide a patch for two newly disclosed vulnerabilities affecting Exchange email servers, which the company acknowledged have been used in attacks on customers.
One of the vulnerabilities could enable remote execution of commands on a compromised server, prompting concern among security researchers about the potential for significant exploitation in coming days. The remote code execution vulnerability, which is being tracked by the identifier CVE-2022-41082, has similarities to the previously disclosed "ProxyShell" flaws. The new vulnerability was dubbed "ProxyNotShell" by researcher Kevin Beaumont, who was among the first to report seeing exploits of the bug in a series of tweets on Thursday.
Remote code execution vulnerabilities are considered a serious security risk due to the potential for attackers to take full control of a compromised system. Log4Shell, a critical vulnerability that was discovered in the Apache Log4j logging software component in December 2021, fell into the category of a remote code execution flaw.
The second vulnerability, which is being tracked at CVE-2022-41040, can be used by an attacker to trigger the remote code execution vulnerability, Microsoft said in a blog post. The vulnerabilities affect Microsoft Exchange Server 2013, 2016, and 2019, according to Microsoft.
A limiting factor on the exploitability of either of the newly disclosed bugs is that an attacker would need to have successfully logged in to a vulnerable Exchange server that they were attempting to exploit, Microsoft said.
The company released details on a mitigation that can be used to block the attack patterns for the vulnerabilities that've been observed so far.
"At this time, Microsoft is aware of limited targeted attacks using the two vulnerabilities to get into users’ systems," the company said in its blog post.
One researcher told Protocol on Thursday that exploitation of the vulnerability is expected to escalate in the next few days. Exchange "is a juicy target for threat actors to exploit" because its servers must be connected directly to the internet, and are a key function for many businesses as email can't be turned off without causing a major disruption, said Travis Smith, vice president of malware threat research at cybersecurity vendor Qualys.
Microsoft said in its post that customers of Exchange Online won't need to take action in response to the new vulnerabilities. Beaumont disputed that, saying in a tweet that for Exchange Online customers, "if you migrated and kept a hybrid server (a requirement until very recently) you are impacted."
Beaumont also said that his testing has found that to meet the requirement of being an authenticated user for exploiting ProxyNotShell, "this can be any email user," which is "pretty risky." Already, exploitation of the vulnerabilities "has been happening for at least one month in the wild," he said in a tweet.
The vulnerabilities were initially disclosed by researchers at cybersecurity vendor GTSC.
Keep Reading
Show less
Google is stepping up its push for open video formats: The company plans to force hardware manufacturers to support the AV1 video codec if they want to run Android 14 on their mobile devices, according to comments left in recent commits to the Android Open Source Project (AOSP) that were first spotted by Esper senior technical editor Mishaal Rahman.
According to those AOSP comments, the next version of Google’s Android Compatibility Definition document will require hardware makers to support AV1 for both tablets and phones. Previously, devices only had to support VP8 and VP9, two open codecs that are predecessors of AV1.
Google has yet to publicly release the compatibility requirements for Android 14; the company is expected to release a beta version of Android 14 in April 2023. Google did not immediately respond to a request for comment.
AV1 is a royalty-free video codec spearheaded by the Alliance for Open Media, which counts Google, Amazon, Netflix, and others among its members. Google has been a major supporter of AV1, and has been requiring Android TV device makers to support the codec since last year, as Protocol was first to report two years ago.
Google has also been using YouTube to grow the adoption of AV1. The video service now re-encodes all of its videos in AV1, and has been pushing companies like Roku to support the codec for its living room devices.
AV1 support on mobile has been uneven, however, in part because Qualcomm has yet to add hardware decoding capabilities for the codec to its chipsets. As a result, Google is giving device makers the option to rely on software decoding of AV1 video streams, according to Rahman.
Google’s mandate of AV1 support on Android is just one piece of a broader push for open media formats. The company is also looking to establish royalty-free alternatives to Dolby Atmos and Dolby Vision, as Protocol was first to report last week.
Keep Reading
Show less
A troubling new vulnerability affecting Microsoft Exchange email servers has been disclosed by researchers, though details are still emerging on the severity and exploitability of the flaw.
The vulnerability, disclosed by researchers at cybersecurity vendor GTSC, could enable remote execution of commands on a compromised server, according to the company. It appears to be a "zero-day" vulnerability, which means it was not disclosed to the software vendor before spreading in the wild and before a patch could be created.
Trend Micro said Thursday that the vulnerability was submitted to Microsoft via its Zero Day Initiative program. On Friday, Microsoft said it’s “working on an accelerated timeline” to provide a patch for two newly disclosed vulnerabilities affecting Exchange email servers, including the remote code execution flaw disclosed by GTSC.
Researcher Kevin Beaumont, who was among the first to discuss GTSC's findings in a series of tweets Thursday, said he is aware of the vulnerability being "actively exploited in the wild" and that he "can confirm significant numbers of Exchange servers have been backdoored."
Remote code execution vulnerabilities are considered a serious security risk due to the potential for attackers to take full control of a compromised system. Log4Shell, a critical vulnerability that was discovered in the Apache Log4j logging software component in December 2021, fell into the category of a remote code execution flaw.
Travis Smith, vice president of malware threat research at cybersecurity vendor Qualys, told Protocol that he expects exploitation of the vulnerability to escalate in the next few days. Exchange servers must be connected directly to the internet and are a key function for many businesses since email can't be turned off without causing a major disruption, Smith noted. For those reasons, Exchange "is a juicy target for threat actors to exploit," he said in an email.
On Thursday, the initial reaction among security researchers was that it wasn't clear from GTSC's original disclosure whether this was in fact a brand-new, zero-day vulnerability in Microsoft Exchange, or if it might just be a new version of a previously disclosed vulnerability known as "ProxyShell." Beaumont noted in a blog post that a key portion of the exploit process detailed by the vendor "looks exactly like ProxyShell," which was disclosed in 2021.
However, GTSC subsequently updated its blog post, making it clear that the vulnerability affected Exchange servers that had already been patched with the latest updates. As a result, "an exploitation using Proxyshell vulnerability was impossible," the researchers said in the blog post update.
John Hammond, a well-known researcher at cybersecurity vendor Huntress, tweeted that the update makes clear that this "is in fact a new 0-day" remote code execution vulnerability.
Mike Parkin, a senior technical engineer at Vulcan Cyber, told Protocol that he had reached the same conclusion.
The fact that the compromised system was up to date before it was breached "indicates the attack leveraged a new vulnerability, not the one that was previously known," Parkin said in an email. Still, GTSC "hasn't released many details, so we are having to extrapolate from what they have said," he said.
Correction: This story was updated on Sept. 29, 2022, to correct the description of ProxyShell.
Keep Reading
Show less
The gas-powered vehicle ban dominoes have begun to fall.
New York Gov. Kathy Hochul announced on Thursday that the state will follow California’s lead in banning the sale of new gas- or diesel-powered cars beginning in 2035. Like the Golden State, New York has also set interim targets: 35% of new cars sold must be zero-emissions by 2026, and 68% by 2030.
The plan is still not quite finalized, though. Hochul directed the state’s Department of Environmental Conservation to implement the new rules, and it will still have to hold a public hearing and open comment period before finalizing them.
This comes just a month after California threw down the gauntlet and restricted future internal combustion vehicle sales. Given that more than a dozen states — including New York — have adopted California's previous tailpipe standards, it was likely at least some of those states would follow the Golden State's lead on zero-emissions vehicle sales. New York is the first state to do so, though others such as Massachusetts, Washington, and Virginia are likely to follow suit in the near future.
“We had to wait for California to take a step because there’s some federal requirements that California had to go first — that’s the only time we’re letting them go first,” Hochul said at a press conference, in reference to a Clean Air Act provision that allows California alone to set its own vehicle emissions standards. A policy quirk allows other states to adopt those standards, but not to lead the way.
In addition to the gas-powered car sales ban, Hochul also announced that the state will invest $10 million in its existing Drive Clean Rebate program to encourage New Yorkers to purchase EVs. The program offers a point-of-sale rebate of up to $2,000 off a car’s sticker price, and can be combined with federal rebates like the $7,500 tax credit on new EVs. In its five years of existence, the program has handed out $92 million in rebates statewide, according to a press release. The state is also making $5.75 million available to local governments to transition their fleets to zero-emission vehicles and install public EV chargers and hydrogen fueling stations.
New York, along with 49 other states plus Puerto Rico and Washington, D.C., also had its EV charging plan approved by the Biden administration. That will unlock some of the $175 million in funding for EV charging set aside for the state as part of the bipartisan infrastructure law. Building out charging infrastructure could help make it that much easier for the state to meet its zero-emissions vehicle sales mandate.
Keep Reading
Show less
Tech industry groups are once again pleading with the 5th Circuit to block HB 20, Texas' on-again, off-again social media law, which the court recently allowed to take effect.
In an unopposed motion filed Thursday, the plaintiffs in the ongoing legal battle, NetChoice and the Computer & Communications Industry Association, asked the court to "preserve the status quo" until the Supreme Court has a chance to review the issues raised in the case. The Texas law aims to prohibit online platforms from moderating content on the basis of viewpoint, a limitation that tech companies argue infringes on their First Amendment rights and conflicts with broad authority they have under Section 230 to moderate content.
This is not the first time NetChoice and CCIA have sought to block the law. Earlier this year, the 5th Circuit lifted an injunction on the same law, though its decision on the underlying case between tech groups and the state of Texas was still pending at the time. The tech groups argued that the 5th Circuit's actions would wreak havoc on companies operating in Texas and pushed for the Supreme Court to add the case to its shadow docket and re-institute the block on the law. Weeks later, the Supreme Court obliged, with a majority voting in NetChoice and CCIA's favor.
But the 5th Circuit decision earlier this month put the law back in play. In their motion, NetChoice and CCIA noted that even the three conservative justices who voted to keep the law in effect in May said that HB 20 "concerns issues of great importance that will plainly merit the [Supreme] Court’s review." The plaintiffs are asking the court to block the law from being implemented until the justices have had a chance to conduct that review.
That chance may come sooner rather than later: While the 5th Circuit gave the Texas social media law a green light, the 11th Circuit blocked a similar law in Florida earlier this year. That circuit split has created a rare opportunity for the Supreme Court to decide on issues related to online speech and the First Amendment rights of private platforms once and for all. Earlier this month, Florida filed a petition with the court asking it to take up its case surrounding SB 7072, a law that would limit tech platforms' ability to moderate certain political speech. Now, both sides of the debate are awaiting an answer as to whether they'll have a chance to fight it out in the highest court.
Until the Supreme Court provides that answer, though, NetChoice and CCIA are arguing that the 5th circuit shouldn't allow a disruptive — if not outright disastrous — law for so many businesses to go into effect. "If Supreme Court review was 'plainly merit[ed]' even before this circuit split," the motion reads, "it certainly is now."
Correction: An earlier version of this story incorrectly stated that NetChoice and CCIA filed a motion with the Supreme Court. They filed with the 5th Circuit.
Keep Reading
Show less
Sometimes a major "hack" isn't really a hack at all, such as with some breaches caused by the mishandling of APIs.
The latest such breach attributed to negligence with APIs, or application programming interfaces that are used for exchanging data across applications, is the massive theft of customer data from Australian telecom Optus.
First disclosed by Optus on Sept. 22, the data exposed in the breach of 9.8 million customer records includes driver's licenses, passports, and Medicare ID numbers, in addition to names, phone numbers, and email addresses.
Optus has attempted to characterize the cyberattack as "sophisticated," but according to Australian Minister for Cybersecurity Clare O'Neil, it was actually just a "basic" attack. Optus “effectively left the window open” for customer data to be stolen, she said.
The incident reportedly started with the attacker accessing an API server that was not protected with any type of authentication. In other words, the attacker didn't even have to log in. Anyone from the internet could have theoretically done the same thing, said Filip Verloy, technical evangelist at Noname Security, a vendor that offers API security products.
"This should be a wake-up call for a lot of organizations about how easy it was to get this data," said Nick Rago, field CTO at another API security vendor, Salt Security.
The use of APIs has grown widely as companies of all sorts have morphed into software providers, with API services enabling much of the key functionality for modern apps and websites.
Optus executives have not denied that an API was leveraged by the attacker to steal the customer records, according to reports. Protocol has reached out to the company for comment.
Based on the information that has come out so far, it appears that the API in question was actually "doing exactly what it was meant to do" when it called up the Optus customer records, Rago said. That means the API wasn't "hacked" in any sense of the word, but was just used for an unintended purpose, he said — what's sometimes referred to as an "API abuse" attack.
It's likely that Optus just didn't know about the existence or functionality of this particular API, according to Rago. It would appear there was a "lack of visibility and a lack of governance, in terms of not knowing this API existed in the first place and why it was exposed in this manner," he said
In general, it's recommended that businesses take a "layered security" approach to protecting APIs, using a firewall or API security product, identity authentication, authorization for governing access to data, and encryption for sensitive personal data, said Yotam Segev, co-founder and CEO of data security vendor Cyera. "It appears that Optus failed on every front," Segev said.
By way of analogy, even if the front door of your house was left open or broken into, you could still have a locker inside of your house to protect your sensitive documents, said Anshu Sharma, co-founder and CEO of data privacy technology vendor Skyflow. "Even if the bad guys get in, they won't get your [sensitive] data," he said. But it appears that Optus did not have this type of capability, either.
Keep Reading
Show less
The neobank MoneyLion charged service members excessive fees for loans and often refused to cancel paid memberships, according to a lawsuit filed Thursday by the Consumer Financial Protection Bureau.
The CFPB is accusing MoneyLion of violating the Military Lending Act by charging above a 36% rate cap on loans to service members and their families, through a combination of interest rates and monthly membership fees.
“MoneyLion targeted military families by illegally extracting fees and making it difficult to cancel monthly subscriptions,” CFPB Director Rohit Chopra said in a statement announcing the lawsuit. “Companies are breaking the law when they require monthly membership fees to obtain loans and then create barriers to canceling those memberships.”
MoneyLion went public last year through a SPAC deal and is worth about $227 million after its shares fell almost 18% today. Ahead of its public debut, the company's leadership disclosed that it had received investigative demands from the CFPB related to its membership model.
The company did not immediately respond to a request for comment Thursday.
The lawsuit cites a pair of personal loan products, including one focused on credit building, that require a membership for access, with recurring fees between $19.99 and $29 each month.
The CFPB said that MoneyLion refused customers’ requests to cancel memberships if they had outstanding loan balances. The company also refused to cancel memberships even after the loan was paid off if the customer still owed previous membership fees, according to the agency.
Through the lawsuit, the CFPB is seeking monetary relief for customers, an "end to MoneyLion's unlawful practices," and a civil money penalty.
The lawsuit is the fourth enforcement action the CFPB has taken related to the Military Lending Act in the past two years, the agency said.
Keep Reading
Show less
Google is shutting down its Stadia cloud gaming service, nearly three years after its launch and roughly 18 months since the company shut down its internal game development division.
In a blog post, Stadia chief Phil Harrison said the platform "hasn't gained the traction with users that we expected so we’ve made the difficult decision to begin winding down our Stadia streaming service."
Harrison wrote that the company intends to refund all Stadia purchases, including hardware purchases of Stadia controller and Chromecast bundles through the Google Store and all software through the Stadia store, and plans to do so by January. After January 18, 2023, the service will become unavailable, the blog post reads. Harrison noted that this isn't the end of the road for Google's gaming ambitions, and the company intends to apply the technology learnings elsewhere.
"The underlying technology platform that powers Stadia has been proven at scale and transcends gaming. We see clear opportunities to apply this technology across other parts of Google like YouTube, Google Play, and our Augmented Reality (AR) efforts — as well as make it available to our industry partners, which aligns with where we see the future of gaming headed," he wrote. "We remain deeply committed to gaming, and we will continue to invest in new tools, technologies and platforms that power the success of developers, industry partners, cloud customers and creators."
Keep Reading
Show less
Amazon announced pay raises and the rollout of new benefit programs to warehouse employees Wednesday. But one of those products may pose increased risks to the company’s most precarious workers: the expanded rollout of Amazon’s Anytime Pay Program.
The program, first announced in October 2020, allows employees to access a portion of their checks in advance of a regular pay date. Such products are typically referred to as “earned-wage access” and position themselves as a lower-fee and thus less predatory alternative to payday loans. Amazon is using Wisely, a product offered by payroll company ADP, for the service.
Employees load their wages in advance onto a Visa debit card and are then able to use that card wherever Visa cards are accepted, or can withdraw cash at some ATMs. When Amazon first rolled out the program to some workers, those workers could obtain up to 50% of their paycheck in advance. Now, more workers have access to the program, and can cash out on 70% of their paycheck in advance by transferring funds to their Wisely Pay Visa card.
The benefits for low-wage workers are obvious: Having access to wages in advance of payday can be helpful in handling unexpected expenses, particularly when an employee lives paycheck to paycheck. And, as has been well-covered, most Amazon warehouse workers don’t make enough money to have ample emergency savings, despite the company’s campaigning about a livable minimum wage and Wednesday’s pay increase.
But earned-wage access products also carry risks for consumers. The products are not currently regulated as loans, due to a Trump-era CFPB advisory opinion that carved out a special exemption for earned-wage access should providers fit certain criteria, like not charging fees. Wisely claims to offer earned-wage access “at no cost,” so it fits these requirements and hence is exempt from regulatory disclosures required of credit cards or payday loans.
However, the fine print of Wisely’s terms and conditions say there are some fees associated with the card: They just aren’t mandatory charges. The company charges $5.95 should customers want to load an additional $20 to $500 out of their own checking account onto the cards, for example, and says that fees may be charged at certain ATMs where the card is used. It then says that users should log in to their account to see a list of other applicable fees.
Consumer groups asked the CFPB to review its oversight of these types of products last fall, because they fear fees could harm consumers who aren’t expecting them. The CFPB also revoked a special regulatory exemption for Payactiv to experiment with earned-wage access products, signaling the agency will soon tighten regulations on these types of products.
ADP's partner bank, Fifth Third Bank, has run into trouble with the CFPB before. The bureau sued Fifth Third in 2020 for automatically enrolling customers in products they did not consent to and opening unauthorized accounts. According to a press release, this was implicitly encouraged because employees of the bank were subject to ambitious sales goals.
ADP and Fifth Third Bank did not respond to requests for comment.
This story was updated to reflect that Amazon later responded to a request for comment.
Keep Reading
Show less
More pay transparency is coming to California. The Golden State is joining New York City, Colorado, and Washington in requiring employers to disclose pay ranges in job ads.
Gov. Gavin Newsom signed Senate Bill 1162 into law on Tuesday, according to statements from the California Legislative Women’s Caucus and the TechEquity Collaborative.
Under the law, employers with 15 or more workers will be required to include pay ranges in job postings, and those with 100 or more employees or contractors will have to report median and mean hourly pay rates by job category and “each combination of race, ethnicity, and sex.”
“This is a big moment for California workers, especially women and people of color who have long been impacted by systemic inequities that have left them earning far less than their colleagues,” said state Sen. Monique Limón (D-Santa Barbara) in a statement. Limón introduced the bill in February.
The TechEquity Collaborative’s chief programs officer, Samantha Gordon, praised the law in a statement as “an important step in equalizing the playing field for the 1.9 million contractors, temps, vendors, and contingent workers” in California.
The bill received pushback from the California Chamber of Commerce and the Society for Human Resources Management. The chamber called the bill a “job killer” because the pay reports were going to be published online, but that provision was later removed from the bill, SHRM noted earlier this month.
“You are grouping together workers in very broad categories, as broad as ‘professionals,’” CalChamber policy advocate Ashley Hoffman said in a chamber podcast. “If you think of a hospital, that would encompass nurses, but it would also encompass someone who just graduated college and starting in your HR department. It’s truly a broad category.”
According to Forbes, SHRM argued that pay transparency would increase compression between newer and more experienced employees and could deter candidates from applying before learning about other fringe benefits.
SB 1162 doesn’t make clear how the law applies to companies that employ workers remotely.
Keep Reading
Show less
Cost-cutting in tech is officially hitting the industry’s titans. After years of ruthless staffing up, both Meta and Google have told some employees to find new jobs within the company or leave, according to a report in The Wall Street Journal.
These actions at Meta, via departmental reorganizations, have affected a “significant number” of employees. Cuts aren’t unexpected, a Meta spokesperson pointed out: Mark Zuckerberg told investors on the company’s July earnings call that he planned to “steadily reduce head count” over the coming year, and that “many teams are going to shrink so we can shift energy to other areas.”
The changes reported out of Google have apparently hit around half of the employees of the company’s 100-plus-employee startup incubator, Area 120, where a number of projects have been canceled. Google didn’t immediately return Protocol’s request for comment, but Sundar Pichai has spoken publicly about plans to cut costs, slow hiring, and make the company 20% more productive. On Friday, he reportedly told employees at an all-hands meeting that announcing job cuts to the whole company was “not a scalable way to do it,” but that he would “try and notify the company of the more important updates,” CNBC reported.
To find out what this all means for Big Tech and the rest of the industry, I spoke with Colleen McCreary, Nolan Church, and Steve Cadigan — three people-leaders who have led HR at companies like Credit Karma, DoorDash, Carta, and LinkedIn.
Moves like these are common in Big Tech. Giving employees 60 days to find another role is a “pretty normal big-company proposition,” said McCreary, the chief people, places, and publicity officer at Credit Karma. “Projects get spun up, projects get wound down.”
- Cadigan, the first CHRO at LinkedIn and author of the book “Workquake,” agreed, noting that he’s seen companies use this practice throughout his career. It “raises the employability” of affected workers “if you really believe they’re good people and you really did just cancel that project — it’s not about poor performance.”
- That said, a 30-day deadline to find a new job “feels pretty aggressive in a big company,” said McCreary, who sees 60 days as “much more normal.” Sixty days also allows companies to avoid triggering WARN requirements, which — depending on how many employees are let go in a given location — can require 60 days of pay, McCreary said.
- “Deeper cuts” are expected to follow these 30-day notices at Meta, WSJ reported, citing anonymous sources. Indeed, Zuck told investors in July that he expected the company to “get more done with fewer resources.” (Since last year, Meta has cut its 2022 expense guidance to between $85 billion and $88 billion, down from between $91 billion and $97 billion.)
Big Tech has plenty of reasons to keep job cuts quiet.
- Layoffs are a huge threat to an employer’s brand and hurt morale internally; they leave companies “scarred for a long period of time, both internally and externally,” McCreary said.
- Large tech companies are “really good with controlling the narrative” and know that the word layoff is “a hot button for the press,” said Church, the former chief people officer at Carta, who co-founded the executive talent marketplace Continuum.
- Still, quietly cutting jobs carries its own reputational risks. “Your staff knows if you’re not treating people fairly — if you’re taking people out with sniper shots in the night, metaphorically speaking,” Cadigan said.
For at least eight years, big tech companies have been hoarding talent — both from startups and from each other — as a competitive strategy, said Church.
- That has meant tolerating some bad hires and underperformance — the “bunch of people at the company who shouldn’t be here,” as Zuck put it bluntly over the summer.
- “That was an OK trade-off in the previous macro environment,” Church said. Now, even Big Tech is feeling the pressures of a worsening economic situation, and leaders are “trying to stay on this high wire between public market investors who care about cost cutting and winning the war on talent on the other.”
One thing we know: More performance management is coming. McCreary said she gets a call from a CEO or head of HR “once a week” on how to do a layoff — but she’s also “hearing a lot more about, ‘How do you do performance management?’”
- Giving underperforming employees honest feedback leads some to quit on their own, helping companies avoid terminations and other methods of reducing head count, said Cadigan.
- While serving as LinkedIn’s CHRO a decade ago, Cadigan championed managing underperforming employees out of the company as an alternative to involuntary terminations (while butting heads with the board, which wanted to see more employees fired, he said).
- Offering this kind of straightforward feedback is “something very few companies are good at,” Cadigan said. “If we’re doing this right, we’re helping people figure it out on their own without having to fire.”
A version of this story appeared in Protocol's Workplace newsletter. Sign up here to get it in your inbox three times a week.
Keep Reading
Show less
Calendly, the $3 billion scheduling startup that everyone likes to periodically fight about, has made its first acquisition: Prelude, a startup specializing in the hiring process. Prelude is specifically geared toward scheduling job interviews or other types of recruitment-related meetings.
"What makes this acquisition especially exciting is that it accelerates our vision to holistically solve external scheduling challenges for individuals and teams in companies of all sizes, from SMB to enterprise," CEO Tope Awotona wrote in a blog post announcing the acquisition.
Calendly has been focused on companies, not just individual users, for the past few years now. It released a group meeting feature to help teams schedule across time zones back in December 2021. The Prelude acquisition shows Calendly's interest in the HR software space and hints at its desire to build out other specific use cases. Awotona told TechCrunch that this is unlikely to be its last acquisition or its only dive into catering to specific industries.
Keep Reading
Show less
Celsius Network CEO Alex Mashinsky resigned from the embattled cryptocurrency lender Tuesday morning. The lender is in the middle of bankruptcy proceedings after pausing withdrawals in June.
“I regret that my continued role as CEO has become an increasing distraction, and I am very sorry about the difficult financial circumstances members of our community are facing,” the resignation letter reads.
In a press release, Mashinsky added that he “will continue to maintain [his] focus on working to help the community unite behind a plan that will provide the best outcome for all creditors.”
Celsius said it had named CFO Chris Ferraro its chief restructuring officer and interim CEO Tuesday. Ferraro joined the company in March and became CFO in July, according to his LinkedIn profile. He previously spent 18 years in various roles at JPMorgan Chase.
Celsius became emblematic of the crypto liquidity crisis earlier this summer, leading it to pause all transactions in June. A rogue employee had also leaked thousands of users’ email addresses, adding to suspicions about the company’s stability. Another lender, Voyager, also filed for bankruptcy amid market turmoil in the same period after hedge fund Three Arrows Capital defaulted on a loan.
Several leaked reports in recent weeks showed that Celsius was plotting risky actions to save the company with Mashinsky at the helm. A leaked call showed that, rather than returning customers' assets, the company considered selling customers a new token representing their debt as a form of IOU. The call also revealed that employee assets would be returned on the same timeline as customers'. A customer leaked the audio, saying it was sent to her by an unnamed Celsius employee.
In the leaked call, CTO Guillermo Bodnar also said the company was creating a transaction management system. The company had been using an Excel spreadsheet before to track assets.
Meanwhile, the CEL token faced a short squeeze, largely organized by supporters on Twitter. The currency jumped 300% from its price after the transaction pause, despite reports suggesting that the lender was likely insolvent. Cryptic messages from Mashinsky and his wife Krissy — including a picture of Krissy Mashinsky wearing short-shorts — were interpreted by some as support for the squeeze.
Update: This story has been updated to include Celsius's comment about Chris Ferraro's appointment as interim CEO.
Keep Reading
Show less
Most Popular
Bulletins