Home Depot’s Former Lead Security Engineer Had a Legacy of Sabotage
Information continues to trickle in on the Home Depot data breach, and it's an ugly one. Last week, the company confirmed that its security lapse—the biggest ever for a retailer—had compromised the credit cards of 56 million customers from April to September. The data now being sold on black markets could contribute to an estimated $3 billion in illegal purchases.
Security experts, the New York Times reported, are "flabbergasted" that Home Depot could fall victim to such an enormous breach, less than a year after Target exposed the data of 40 million consumers' cards last holiday season. But former employees of the home-improvement chain told the Times they were less surprised, and that security at Home Depot had long been "a record of missteps":
In recent years, Home Depot relied on outdated software to protect its network and scanned systems that handled customer information irregularly, those people said. Some members of its security team left as managers dismissed their concerns. Others wondered how Home Depot met industry standards for protecting customer data. One went so far as to warn friends to use cash, rather than credit cards, at the company’s stores.
Buried at the bottom of the Times story was another concerning detail: Ricky Joe Mitchell, the former lead security engineer at Home Depot's stores, was convicted this spring of sabotaging the security network of his previous employer.* He is now serving a four-year sentence in federal prison. Ars Technica dug up more details on Mitchell's less-than-stellar record:
When Mitchell learned he was going to be fired in June of 2012 from the oil and gas company EnerVest Operating, he "remotely accessed EnerVest’s computer systems and reset the company’s network servers to factory settings, essentially eliminating access to all the company’s data and applications for its eastern United States operations," a Department of Justice spokesperson wrote in a release on his conviction. "Before his access to EnerVest’s offices could be terminated, Mitchell entered the office after business hours, disconnected critical pieces of … network equipment, and disabled the equipment’s cooling system."
According to Ars Technica, Mitchell also got into legal trouble over malicious technical activity in high school, when he was expelled for planting viruses in the school's computer system. He reportedly described himself on his website as someone who loved "to write and distribute Viruses." Of course people can change a lot between high school and adulthood. But between that early history and his actions at EnerVest Operating, Mitchell's employment at Home Depot isn't giving too many added votes of confidence to the company's security team.
*Correction, Sept. 23, 2014: This post previously misstated Ricky Joe Mitchell's title. He was not the head of Home Depot's IT security; he was lead security engineer.
President Obama Is Serious About Cracking Down on Tax Inversions
Yesterday, the Treasury Department announced a new set of rules, effective immediately, meant to curb tax inversions—the controversial deals in which U.S. corporations move their addresses overseas for tax purposes by buying a smaller foreign company. There's a decent chance the government's efforts will have some teeth, at least to judge by investors' reactions.
Inversions have been all over the news lately thanks to Burger King’s decision to buy Tim Hortons and move to Canada, as well as a spate of deals in the pharmaceutical and medical device industry. Burger King's plan to move north seems to be moving full speed ahead, but as soon as the Treasury rolled out its new regulations, health stocks started dropping. Reuters reports that the “move could jeopardize” Illinois-based AbbVie’s deal to buy Shire and decamp to the United Kingdom; both companies saw their share prices tumble yesterday. Medtronic, which has a merger lined up that would potentially move it to Ireland, saw its stock fall as well, and “may become one of the biggest losers,” according to Bloomberg. The rule changes are also dampening investor hopes that Pfizer would make another attempt to merge with U.K.-based AstraZeneca. Both of those stocks tumbled, too. "Inversion deals now are clearly going to be very difficult to pull off," Navid Malik, head of life sciences research at securities firm Cenkos, told Reuters.
So, what are these new rules? The changes are designed to both make inversions harder to execute and less profitable tax-wise. For instance, when an American company buys a foreign target and inverts, its old shareholders aren’t allowed to own more than 80 percent of the newly combined corporation. Some U.S. companies sidestepped that rule by paying out a huge dividend to shrink themselves right before their merger—now they won’t be able to do so. The Treasury is also taking steps to clamp down on “hopscotch loans,” which some inverted companies have used to access their foreign profits without paying any U.S. taxes on them.
Some doubt, however, that Treasury’s new regulations will have much of an effect on the eight inversion deals that are currently in motion. “These rules do not strike anything like a mortal blow to the pending deals,” corporate tax consultant Robert Willens told his clients, according to Bloomberg. He wrote that Medtronic and AbbVie should wrap up their mergers “without missing a beat.”
Still, given that the Treasury’s moves are essentially fallback measures meant to compensate for the president’s inability to pass anything through Congress that would block inversions, it's impressive that they’ve still thrown so many of these deals into question.
Which States Should Secede From the Union?
Britain has decided to remain whole, but the secession fever gripping the world has not yet broken. Catalonia will hold a nonbinding vote on independence in November, and a number of other European regions are contemplating going it alone.
There’s always some idle secession chatter in the freedom-and-independence-loving United States, too. A new poll shows one in four Americans support “the idea of your state peacefully withdrawing from the United States of America and the federal government.”
But could it ever be more than a rhetorical phenomenon in the States? It seems unlikely, given that those who benefit most from union are those most interested in secession.
Here’s from a recent poll on who wants to leave:
Secession got more support from Republicans than Democrats, more from right- than left-leaning independents, more from younger than older people, more from lower- than higher-income brackets, more from high school than college grads. … Of the people who said they identified with the Tea Party, supporters of secession were actually in the majority, with 53 percent.
In other words, it’s recipients of government largess who want to get out. It’s net donors to the government who want to stay. To wit, only one in five residents of the wealthy New England states supports secession, separatist-lusty Vermont included, versus one in three residents of the poorer southwest, where the urge is more pronounced.
In the United States, the most likely breakaway is Texas, and there’s at least some reason to believe it might do fine as an independent republic. It has access to international waterways. It has a diversified economy, with all that cattle and oil money coming in. It has a long foreign border with Mexico. Most of all, it has that independent spirit.
But it takes a lot more than grit to make it as a new country—and generally, the poorer, smaller, and less-diversified the state, the worse it would fare after independence. Secession itself would also be extremely costly, though how costly would depend on whether the United States acceded to the plan (not likely) and how much it wanted to antagonize New Kansas or Free Texas or what have you. Would it forgive said state's debts? Would it implement airspace restrictions, travel restrictions, sanctions, or even a full embargo? Might it bar a new country from the global payments system?
But let’s say we’re in a heartless, rationalist thunderdome-type situation. In that case, who deserves to get kicked out?
Alas, it probably makes sense to ax a poor state like West Virginia. A few states send Washington more money in taxes than they receive in benefits. But most get a lot more than they give. In West Virginia, the disparity ranks among the highest, primarily because the state is so poor. The average household there makes $43,500 a year. In Maryland, it’s $72,000. Combine that with high rates of disability and heavy use of social programs, and West Virginians take almost $3 for every $1 they pay in. That’s using 2010 data. Now that the hugely redistributive Affordable Care Act is in place—taxing the rich, giving health insurance to the poor—the skew is likely greater.
By the same token, rich states like New Jersey, Delaware, Maryland, Massachusetts, and Connecticut end up donating tax dollars to get pushed out to the lower-income frontier. Such rich economies would be well suited to going alone—especially if they banded together to maximize their economic diversity and the potential of their physical infrastructure. The Thirteen Colonies, for instance, might make for a lovely new country.
All else equal, we’d probably notice the change the least if we got rid of Wyoming, which has the smallest population. Since it’s part of the contiguous lower-48, though, it might make more sense to dispense with the former monarchy of Hawaii, which as the economist Tyler Cowen has noted, is culturally distinct and hard to defend. Alaska also seems like a good option. It has oil resources to support it. It has a small, hardy, heavily armed population. And, along with Texas and Vermont, it keeps threatening to secede anyway.
But finally, we come to the States that are just asking for it, namely Florida, America’s lunatic dongle, and Ohio, our land of pool-raft fuckers and skyline chili. If they left, would we really miss them?
But there is, of course, a reason they never do—just like why Scotland never did. Cleaving a part of a country away from another makes sense in some rare cases—when countries’ polities are deeply cleaved on political, economic, or social lines, for instance. It’s hard to imagine the largely united if decidedly federalist United States ever wanting to go down the same path. And it is worth noting that it’s more likely that we’ll get additions rather than subtractions in the coming years.
See also: Michael Brown Memorial Burns Down
Krispy Kreme Stuffed Half a Million Calories Into One Box of Doughnuts
It's called the Kripsy Kreme Double Hundred Dozen and it's exactly what it sounds like: 2,400 glazed Krispy Kreme doughnuts stuffed into a single, heart-stopping box. The giant package measures 11.4 feet by 3 feet and is so heavy that it took eight Krispy Kreme workers to deliver it, according to USA Today. No one ever weighed the box, but it was delivered late last week to 360 Resourcing Solutions, which won a contest for the Double Hundred Dozen on Twitter by tweeting about the promotion.
How many calories do 2,400 Krispy Kreme doughnuts contain? Some quick googling reveals that a single original glazed Krispy Kreme has 210 calories (reminding us once again that bagels actually tend to have more calories than doughnuts). Multiply that out by 2,400 and you get about half a million calories (504,000 to be exact) for the entire pack. For the sake of comparison, half a million calories can also be achieved with 405 Chipotle burritos (chicken, white rice, black beans, sour cream, cheese, and guac), 951 Big Macs, and 450 pints of Ben & Jerry's Half Baked ice cream.
The obvious if effective marketing stunt—we're writing about it!—was reportedly conceived to promote Krispy Kreme's new "occasions" division for catering corporate and special events. Krispy Kreme says it will make custom doughnuts for these events and doughnut-ified food art like doughnut towers. We'll file this one away alongside the 13-straight hours of smoked brisket Arby's aired on TV in May.
Apple Won’t Shut Down Beats Music After All (but Will Probably Rename It)
This afternoon, TechCrunch reported that Apple was planning to shut down Beats Music, the streaming service founded by Dr. Dre and Jimmy Iovine that the company acquired, along with its headphone brand, for $3 billion. This seemed a bit strange, since Tim Cook has rhapsodized about just how much he loves the subscription service, and the fact that Apple desperately needed to find foothold in streaming. But the story cited five sources, "including several prominent employees at Apple and Beats."
“It’s not clear when exactly Jimmy Iovine and Dr Dre’s music service will be shut down or what Apple will do with streaming, but every source with knowledge of the situation that we talked to agreed Apple plans to sunset the Beats Music brand,” TechCrunch reported.
Now, Apple has denied the story through it's spokesman, Tom Neumayr. Except, it's sort of a nondenial denial. According to Re/code's Peter Kafka, the "Beats brand may go away," but the company "wants to stay in streaming music." Which seems a lot like what TechCrunch said. Here's a bit more of Kafka for context:
Note that Apple does seem pretty pleased with the iTunes brand, which was the focus of its controversial U2 album giveaway this month.
Shuttering the Beats Music brand name makes some sense, as the company hadn’t generated a ton of traction before Apple bought it in May—at that time, it only had a few hundred thousand subscribers.
Now here's where TechCrunch reports that Apple might just slap a new name on its Beats, or use its back end (which is the valuable part, anyway) as part of iTunes:
One source said Apple may roll streaming into iTunes. This could be the most logical strategy for Apple if it can find a way to keep its traditional music file download customers happy while opening its catalogue to streaming for early adopters who want to listen from the cloud. Perhaps rather than just buy buttons, there could be play buttons in iTunes, too. Another source said Apple plans to make some significant music announcement in the first half of next year.
Rebranding Beats as part iTunes isn't quite the same as shutting the service down. But it feels like we're splitting hairs over headlines here.
In any event, here's what we can take away from today's late afternoon music biz news: Streaming is still the future, Apple still seems to realize that, and it's not going to throw the whole streaming service it just bought into the trash heap because it likes iTunes better.
The U.S. Is So, So Far Behind Europe on Clean Energy
With the United Nations Climate Summit near at hand, the Energy Information Administration has published a short, chartified reminder of just how far the United States is behind Europe when it comes to generating no-carbon electricity. Behold—we're the stumpy bar at the bottom.
And for a sense of progress, here's what the chart looked like in 2002.
While most of the countries that produce at least half of their power from zero-carbon sources rely heavily on nuclear and hydroelectric power, the U.S. has been slow to convert its power sources to renewables like wind, solar, or biomass. The transition hasn't gone smoothly all over Europe; in Germany, the cost of going green has been immense enough that Der Spiegel ran a feature titled "How Electricity Became a Luxury Good." Still, you can get a quick sense of how much catching up we have to do.
Pabst Blue Ribbon Is Being Sold to the Russians, Was So Over Anyway
Pabst Blue Ribbon, the cheap-but-tolerable beer that will forever be identified with early 2000s American hipsterdom, is being bought by Russian investors. According to the New York Times, Oasis Beverages will pay more than $700 million to acquire the Pabst Brewing Co., which also makes Colt 45 and Old Milwaukee. The sale will net a tidy profit for Dean Metropoulos, the businessman who bought Pabst for a mere $250 million in 2010.
After a quarter century of declining sales, Pabst came back from the dead during the early aughts because it was a dirt-cheap beer with a kitschy, blue-collar appeal that tickled the cool kids in places like Portland and Williamsburg. It also had an absolutely unbeatable endorsement from Dennis Hopper in Blue Velvet, that, due to Slate's profanity policy, I won't reproduce here. But unlike style statements such as trucker hats and handlebar mustaches, its popularity managed to sustain and grow through the decade, even as sales of pale American lagers like Bud Light and Miller Light flat-lined. In a relatively short period of time it has become a mainstream bargain brew with a global market.
But last year, something funny happened. According to Euromonitor, U.S. sales of Pabst by liter basically stopped rising in 2013, even as they continued their upward march globally. Granted, it was just one off year. But it seems entirely possible that Pabst's future will hinge on drinkers abroad. It certainly wouldn't be the first beer to try and sell an all-American image overseas even as U.S. drinkers lose interest.
"Pabst Blue Ribbon is the quintessential American brand—it represents individualism, egalitarianism and freedom of expression—all things that make this country great," Eugene Kashper, the chairman of Oasis Beverages, said in a statement after the sale was announced. Most Americans probably stopped buying that a while ago. But maybe Russians haven't.
Why Innovators Hate MBAs
If you want to be an innovator or an entrepreneur, should you go to business school? At first glance, maybe not: Peter Thiel once said "never ever hire an MBA; they will ruin your company." Meanwhile, Scott Cook, founder and leader of Intuit, recently told me, "When MBAs come to us we have to fundamentally retrain them—nothing they learned will help them succeed at innovation." Perhaps a stronger indictment comes from Elon Musk, founder of Tesla, SpaceX, Solar City and PayPal, who said, "As much as possible, avoid hiring MBAs. MBA programs don't teach people how to create companies ... our position is that we hire someone in spite of an MBA, not because of one."
While we generally recognize that management training has value, why do leaders of innovative companies offer such harsh criticisms?
I would argue that the fault doesn't lie in the person but in the purpose of management itself. Business schools teach management principles that were developed in the later industrial revolution to solve the large-company management problem—not the innovation problem. As the industrial revolution transformed the economic landscape, replacing small workshops with large companies, the "new giants" created demand for management to make the trains run on time. Business schools followed close behind, with tools to train managers on how to coordinate and control these growing industry titans. However, while these more familiar management practices work well for relatively familiar problems, such as how to optimize activities and coordinate execution, increasing evidence suggests these techniques work poorly for managing the comparative uncertainty of bringing a new idea to market. In other words, business schools have focused on how to capture value from customers, not how to create value.
Another way to think about it would be examine the traditional S-curve that describes the life of a product or company (see Figure 1):
Early in the life of a company, during the startup phase, uncertainty is high and the entrepreneur is forced to wear a dozen hats to create value. Core tasks include search and discovery in an effort to create a customer. But once that uncertainty begins to resolve, the core tasks shift to execution and optimization in order to capture value. The founders are often kicked out of the company during this shift, and MBAs take the reigns to scale up the company.
When we talk about conditions of high uncertainty, we need what we might call an innovation school, rather than a business school, approach. An innovation school deals with the emerging science of managing uncertainty. Figure 2 shows the differences between these two schools of thought:
To provide an example of how these schools differentiate, consider the following: In business school (B-school), when you study marketing, you typically learn the importance of building and protecting your brand or doing quantitative analysis to identify customer segments and get customer feedback. In an innovation school (I-school), however, you should initially ignore your brand and obtain all customer feedback through direct interaction, whether by experience, observation, or interviews. What's more, rather than emphasize building brands by satisfying a broad range of customers through perfected products, I-school emphasizes the need to test low-fidelity prototypes with small groups of customers, embracing errors as opportunities to learn.
Further illustrating this point, in B-school, when you learn finance, you're taught about marginal cost logic: the importance of leveraging prior fixed-cost investments with new initiatives. But this approach biases you toward incremental innovation efforts. In I-school, you learn how to look for opportunities to build something disruptive, something that hasn't been built before, to deliver a unique solution. In a world of uncertainty, leveraging investments can often be a bad practice because it may lead to building a workaround solution instead of one that nails the job to be done.
I'm not saying that one approach is good and the other is bad. Both are good. The key to success is to recognize when to apply a more familiar B-school approach and when to apply I-school thinking—a decision that rests primarily on the degree of uncertainty. In other words, when uncertainty is high, apply an I-school approach. When the uncertainty has been resolved, use a B-school approach. Fortunately business schools are starting to adopt these ideas, but we are in the midst of a transition. The real question is, how do you manage uncertainty? Are you applying the right process?
How Accelerators Have Changed Startup Funding
A little more than a decade ago, it used to be a much costlier undertaking to start a new technology business, particularly in software. The cloud and distributed computing has changed all that.
So has the growth of accelerators, like Y Combinator and TechStars and others that provide small amounts of seed funding to startups in exchange for some equity in your business. But in contrast to a decade ago, that small amount of money goes further. That, plus the connections and mentoring that accelerators typically offer, has gone a long way toward displacing the importance of traditional venture capitalists in financing early stage companies. And that's likely to be a good thing for you.
"Now, if you go to an accelerator like YC or Techstars you have exposure to huge numbers of investors and a big network to help you," says Yael Hochberg, Ralph S. O’Connor Associate Professor in Entrepreneurship at Rice University Jones Graduate School of Business. Hochberg also compiles an annual ranking of best accelerators.
In the past, venture capitalists had the upper hand, Hochberg says. You had to get a "warm" introduction to one, and then they took their time getting back to you, especially if they were interested in your company and knew you were running out of money. You also needed larger sums from them—typically on the order of millions of dollars. And even if you you didn't always approach them for money—say for instance, if you were also interested in leveraging their connections to help get your business off the ground—the dynamics of operating in a closed environment also favored them and the deals they made.
A New Paradigm
Accelerators have turned all that on its head. The seed funding they offer, generally between $25,000 and $100,000 in exchange for an equity stake of between five percent and seven percent, is a lot more useful and sustaining to entrepreneurs now than it might have been years ago. The best accelerators also have a thicket of connections every bit as useful as venture capitalists who come in for later funding rounds. And when they send their companies out for so-called demo days, not one but dozens of venture capitalists show up to bid.
"When you talk to VCs on demo day, 100 people are competing in an atmosphere that's closer to an auction," Hochberg says.
That, in turn, is driving up the value of startups chosen by some of the leading accelerators. The average valuations of a Y Combinator-funded firm in 2013 and 2014 was between $40 million and $50 million, according to TechCrunch and others. The success of businesses that have emerged from accelerators—and they are some of the biggest names in tech today, including Airbnb, Dropbox, Reddit, which all cycled through Y Combinator—has also edged out VCs in other ways. Typically the funds associated with accelerators relied heavily on investments from venture capitalists, who often took on roles as limited partners to establish a window on the accelerator companies. The huge success of many of the portfolio businesses has allowed some of the funds to begin operating independently, Hochberg says.
Nevertheless, some venture capitalists claim to like the changes brought about by accelerators, even if that means more competition. Canaan Partners, of Westport, Connecticut, for example has invested in several Y Combinator companies in the past year, including cost-cutting travel startup RockeTrip and online grocery shopping company Instacart. Those companies received $2.6 million and $44 million respectively in funding in 2014.
"Because the ecosystem has become more transparent you are always competing with other firms," says Ross Fubini, a partner at Canaan, who adds startups are still likely to choose the best venture capital firm, rather than the highest valuation.
Entering the Fray
Meanwhile, some VCs have started their own accelerators to spot and support early stage companies that might make worthwhile investments later on.
Second Century Ventures, which invests primarily in real-estate focused companies, started an accelerator it calls REach in late 2012. The accelerator, which works with companies that are pre-revenue to $11 million in revenue annually, takes an equity stake of between two percent and five percent, but not in exchange for money. Instead, it offers a nine-month educational program, as well as mentorship and a 1,600 person "insights panel." The panel, made up of real estate companies, lets the accelerator companies test their products directly with them.
Of the 15 companies that have participated in the accelerator, nine have raised close to $30 million, primarily from other VCs, but also from SCV. And some, including electronic signature startup Docusign, have found their products resonate outside the real estate industry.
"Between the mentorship and insights panel, it helps the companies develop strategically and create products designed for this industry" and potentially others, says Constance Freedman, a managing director of REach and SCV.
See also: Six Productivity Tools for Entrepreneurs
A Chinese Company Just Announced the Biggest IPO in U.S. History
After months of anticipation, Alibaba's initial public offering has cemented its place in history as the biggest IPO ever in the U.S. Shares of the Chinese e-commerce giant, which does more sales than Amazon and eBay combined, were priced at $68 apiece on Thursday to raise $21.8 billion. No IPO in the U.S. has previously topped the $20 billion mark, though Facebook came close with $16 billion in 2012 and Visa raised $17.9 billion in 2008. The world record for largest offering is held by Agricultural Bank of China, which raised $22 billion in 2010.
Alibaba has been closely watched by investors as it planned its offering over the past several months. The company is a household name in China, where it is all but synonymous with online shopping. It is much less well known in the U.S., but essentially something of a PayPal meets Amazon meets Twitter meets Spotify meets Hulu meets plenty of other things. For almost every business you can think of, the odds are that there's an Alibaba equivalent.
The $68 share price values Alibaba's entire company at $168 billion, which the Wall Street Journal reports makes it "instantly one of the largest listed in the U.S." and gives it a larger market capitalization than Amazon's $150 billion. Alibaba stock is scheduled to begin trading on Friday on the New York Stock Exchange under the aptly named ticker "BABA."