Uber paid a $78,000 fine September 2015 and suspended service in Anchorage, Alaska after it was determined that the company had wrongfully classified drivers as independent contractors.
Complained of “extortion” by a former employee, but paid $7.5 million anyway
When former employee Richard Jacobs sent a demand letter alleging possible criminal behavior by the Uber team where he previously worked, Uber viewed the claims as extortion. Uber deputy general counsel Angela Padilla said Jacobs’ claims were “extortionate.” Yet Uber paid Jacobs $4.5 million ($2 million upfront, $1.5 million in stock, and an additional $1 million to consult with the company and cooperate in any investigations over the course of the next year), plus an additional $3 million to his attorney.
Concerns resulting from Jacobs’ letter and the practices he reported
Federal judge harshly criticized Uber and its lawyers
In Google’s lawsuit against Uber as to alleged theft of self-driving car technology, federal judge William Alsup offered a stern critique of Uber. In particular, Alsup criticized Uber’s Competitive Intelligence group and the company’s intentional concealment of its practices. Beginning with the fact that Uber “withheld evidence,” Alsup continued:
I can no longer trust the words of the lawyers for Uber in this case. If even half of what is in that letter is true, it would be an injustice for Waymo to go to trial.
Alsup specifically criticized Uber’s use of a system that deleted correspondence automatically, saying this was contrary to court instructions for producing relevant documents:
The server [that Uber searched] turns out to be for dummies, that’s where the stuff that doesn’t matter shows up. The stuff that does matter is going to be in the Wickr evaporate file.
Alsup expressed shock at Uber’s practices:
You don’t get taught how to deal with this problem in law school. In 25 years of practice and 18 years in this job I have never seen such a problem.
He continued after a second day of hearings:
I’ve never seen a case where there were so many bad things that—like Uber has done in this case. So many
Alsup said he plans to tell the jury about the new findings, including Uber’s concealment of its practices and intentional destruction of staff discussions:
That is going to hurt your case because any company that would set up that kind of system is as suspicious as can be. I don’t know how you are going to get around that.
Market Intelligence team used surreptitious practices to prevent sensitive information from emerging in legal disputes
Uber’s Competitive Intelligence group used surreptitious practices to communicate with others in Uber in order to avoid creating digital records that could be used in future legal disputes.
Some employees used the Wickr service, which automatically deletes communications after a preset period.
Some employees used special devices for hiding communications. These “non-attributable” devices could not be easily traced back to Uber. Reporting from a hearing, a Tweeter reported Judge Alsup asking who supplied these devices to employees. An ex-Uber employee explained that Uber used third-party vendors so that the expense would stay off of Uber’s books.
The ex-employee confirmed the purpose of these methods: “to evade, impede, obstruct, influence several ongoing lawsuits against Uber.” He said email was a last resort because the messages could be used in litigation. He continued: “There was legal training around the use of attorney-client privilege markings on written materials and the implementation of encrypted and ephemeral communications intended to destroy communications that might be considered sensitive.”
Former Uber employee alleged Market Analytics unit covertly gathered competitors’ trade secrets
A letter from an attorney representing Richard Jacobs, a former Uber security analyst, alleged that Uber had assembled a “Market Analytics” unit to acquire “trade secrets, code-based & competitive intelligence.” The New York Times reported that the Market Analytics team “frequented the code-sharing site GitHub, searching for private material that may have been accidentally revealed by competitors.” The Times also said Uber recruited employees of competitors “to steal trade secrets.”
SoftBank valued Uber at a 30% discount from prior valuation
Japanese holding company SoftBank offered to purchase shares of Uber at a $48 billion valuation, a 30% discount from Uber’s most recent valuation of $68.5 billion. The key news causing the discount was the set of scandals that arose during 2017 — broadly, those summarized on this site.
The transaction ultimately went forward at the 30% discount.
Mike Isaac’s Super Pumped (p.387)reports what he called “sleight of hand” to “prop[] up” the official value of Uber: SoftBank also purchased additional newly-issued shares of Uber at the company’s prior valuation of $68.5 billion. This allowed Uber and some investors to claim that Uber’s value was stable.
Regulators criticized company’s cover-up of data breach
After a data breach exposed information about 57 million user accounts and Uber covered it up (including paying hackers a ransom), multiple regulators criticized Uber’s response.
The FTC said it was “closely evaluating the serious issues raised.”
The New York Attorney’s General office said it opened an investigation of Uber’s actions. The Massachusetts Attorney General reported “serious concerns” about Uber’s conduct. Attorneys general in New York, Illinois, and Connecticut also opened investigations, as did the city of Portland, Oregon.
The UK Information Commissioner’s Office pointed out that “Deliberately concealing breaches from regulators and citizens could attract higher fines.” Current British law imposes penalties up to 500,000 pounds for failing to notify users and regulators about data breaches. More than 2.7 million UK users were affected.
Mexico’s National Institute of Transparency, Access to Information and Protection of Personal Data also criticized the breach and Uber’s response, seeking information about effects on Mexican citizens.
In addition, Uber faced three class action lawsuits alleging that it was negligent in its failure to protect consumer data.
Covered up 2016 hack, paid hackers to delete data, and failed to disclose to regulators
In an October 2016 attack, hackers extracted names, email addresses, and phone numbers of 50 million Uber riders (details), as well as personal information about 7 million drivers (including 600,000 US drivers license numbers). Details from Uber. A subsequent FTC investigation found that more than 25 million names and email addresses, and more than 22 million names and phone numbers, were affected.
Uber did not tell the public about the hack or alert the affected drivers or passengers. Nor did Uber tell regulators, although at the same time Uber was negotiating with the US FTC about other claims of privacy violations. As of November 2017, when the attack was publicly revealed, Uber admitted that it was required to disclose the hack because driver’s license information was among the information taken.
Instead of disclosing the hack to regulators or the public, Uber paid the hackers $100,000 to delete the data and not tell anyone what had happened. The New York Times reported that Uber also pushed the hackers to sign nondisclosure agreements, and that the company “made it appear” as if the $100,000 payout had been part of a “bug bounty” program (paying hackers to find problems) rather than a response to hackers’ demands.
Uber then-CEO Travis Kalanick learned of the breach in November 2016, a month after it took place. Reuters indicated that new CEO Dara Khosrowshahi indicated only having learned about the problem “recently.”
Uber Chief Security officer Joe Sullivan oversaw Uber’s response to the hack. As part of Uber’s 2017 investigation of the situation, new CEO Dara Khosrowshahi fired Sullivan along with Craig Clark, who had been legal director of security and law enforcement (reporting to Sullivan).
Upon learning of Uber’s failure to disclose the privacy breach, multiple regulators criticized the company’s action and opened investigations.
In a December follow-up, Reuters reported that the hacker was a 20-year-old man from Florida.
Drivers in Nigeria use fake GPS to inflate fares
In Lagos, Nigeria, Uber drivers used apps to override phone GPS, causing Uber’s app to record a longer route than was actually taken and inflating the fares charged to passengers. Quartz reports many drivers inflating fares by 1000 to 2000 naira ($3 to $6), though some inflated far more than that.
Drivers reported using this tactic in response to Uber reducing the amount they were paid. They describe protesting unsuccessfully, and resorting to GPS trickery for lack of other ways to get the payment they thought they deserved.
Some drivers said Uber knew about their methods and allowed them to continue. One driver described the Uber app reporting “fake location detected” yet allowing the driver to proceed and charge an inflated fare.
Uber says it refunds all riders who report fraudulent activity.
Nigeria drivers sue for employee status
Drivers in Lagos, Nigeria filed a class action lawsuit arguing that Uber must provide them with employee benefits.