If you have a few minutes, reading the full complaint is worth it - the blog posts and the articles don't really do the whole story justice.
There is extremely damning evidence that this unnamed individual ("D.S.") in Ireland was acting at the behest of Deel senior leadership, including:
- the COO of deel reached out to a rippling payroll manager on linkedin to recruit them. The rippling employee didn't respond. Shortly thereafter, D.S. pulled up that employees personnel record in the HR system that has their unlisted phone number. Shortly after THAT, the COO of deel reached back out to that employee via WhatsApp and that phone number.
- The information was about to publish a story about Deel potentially violating sanctions. New information in the article was that at least one of the customers involved was a company called "tinybird". No one at rippling was aware that this company even existed, but a week BEFORE the article came out, but after the reporter had been asking questions of Deel, D.S. started searching Slack for "tinybird" (and there were no other searches of "tinybird" across the whole company)
- Around the same time, the reporter for the information reached out to rippling and had internal Rippling slack messages about potential similar sanctions violations. A short time before that happened, D.S. was suddenly searching for "russia", "sanctions", "iran", etc.
- There was an email between D.S. and the ceo of Deel, along with an introduction to someone from the family VC fund.
- And then, of course, the honeypot - a fake channel, fake chats from the Rippling CRO, but the chats had real stories that former Deel employees had alleged. Email sent to only the CEO of Deel, his dad/chairman of the board, and their GC. Just a short time later, D.S. was searching for the fake channel, trying to find it, adn trying to find these chat messages.
I'm sure the CEO will try to have plausible deniability, that it was someone else in his org that he delegated investigating these things to, he had no idea, etc. But if they can get D.S. to crack and share the details of what happened, I think it will be tough to toe that line.
> So, to confirm Deel’s involvement, Rippling’s General Counsel sent a legal letter to Deel’s senior leadership identifying a recently established Slack channel called “d-defectors,” in which (the letter implied) Rippling employees were discussing information that Deel would find embarrassing if made public. In reality, the “d-defectors” channel was not used by Rippling employees and contained no discussions at all. ... Yet, just hours after Rippling sent the letter to Deel’s executives and counsel, Deel’s spy searched for and accessed the #d-defectors channel—proving beyond any doubt that Deel’s top leadership, or someone acting on their behalf, had fed the information on the #d-defectors channel to Deel’s spy inside Rippling.
I am sending legal letter to someone warning them that I have dirt on them AND am also mentioning where the dirt is. And that didn't ring any warning bells to Deel's management? Just wow, if true. If they are truly this incompetent, they have no business doing corporate espionage.
I don’t think the letter was “warning they have dirt on them”.
Presumably it was a letter on another topic say an accusation about Rippling poaching Deel’s employees.
Rippling’s legal counsel sends a letter back saying “we aren’t poaching, there are plenty of Deel employees are looking to leave based on posts to Twitter and Slack discussions such as those in the “d-defector” channel.”
IMO this is going to create a wave of product offerings from security startups that "monitor for corporate espionage" similar to what Meta was doing tracking copy/paste into whats app, but do it across all apps. Like detect for seldom searched keywords, etc.
or lets calm down, this much espionage doesnt actually happen that much, and when it does, separating out people on need-to-know basis and introducing honeypots have been routine parts of the process for decades and costs nothing, no startup to be built here
"security startups that "monitor for corporate espionage"" imply introducing yet another third party that literally has access to all the things (or logs thereof) thereby introducing a nice fat pwn factor for everyone
Absolutely agree, although it's around an hour's read.
Into the void I say: There's a typo on page 39 (of the PDF; the bottom of the page says 37) line 1. That item should be item 4 since it comes after another item 3.
(page 12 also has "at which the Rippling would be offering those solutions" which should probably be just "Rippling", I suspect it said "the Rippling platform" before being corrected to "Rippling" but forgetting to remove "the")
Is it known how Rippling obtained information about D.S.' Slack activity? Does Slack provide this information or did Rippling obtain this information by running third party monitoring software on D.S.' machine?
The complaint goes into a lot of detail. Start at page 16 and read through at least page 23 if you want to understand what Ripling could discern from the spy's Slack usage.
> In part to ensure that the confidential information in Rippling’s Slack channels is used only for authorized purposes, Rippling employees’ Slack activity is “logged,” meaning every time a user views a document through Slack, accesses a Slack channel, sends a message, or conducts searches on Slack, that activity (and the associated user) is recorded in a log file.
Enterprise Slack - everything is audited, and searchable with appropriate permissions. Your slacks on company time or with company equipment are not private from said company.
Agree, the entire complaint is fascinating reading. I suspect Deel's responses will mostly be "we deny everything," but any counter-arguments they make will also be very interesting.
I have to say, I think if this was just limited to the Slack previewing behavior, it's unlikely it would have been caught. Previewing Slack channels is not particularly unusual or suspicious behavior and many people, probably most, don't even think of it as being something that'd be logged. (I personally didn't think of it until reading this post, but in retrospect, of course it is. Everything is.)
Crossing the line into dumb things like Deel executives personally contacting the spy's subordinates via their personal phone numbers, which he had no way of knowing is like sending up a massive flare of weirdness. I'm not saying loyalty to one's employer is everything, or even particularly important, but if I was randomly headhunted by a C-level from a direct competitor, who I had never spoken to or expressed interest in, I'd be pretty suspicious, and I'd find it underhanded. I might mention it to someone.
Supposing the allegations are substantially true, I wonder why Deel felt comfortable going that far. Maybe underestimation of competition?
I have never heard of either company before and I'm starting to wonder whether I'm the odd one out.
For those as lost as me, a cursory look tells me that Rippling is a "Workforce management system (HR, IT, Finance)" while Deel is a "Payroll, Compliance and HR Solution".
I use Deel to hire people internationally. It's mostly an EOR company. They promised a lot though, I once thought about moving my entire HR workflow to Deel (even for local employees), but quickly decided against it.
My company uses it. When you work for a company that uses Rippling, you are “co- employed” by both your company and Rippling. Your company does everything as far as hiring, firing, HR, management, etc.
But as far as taxes, insurance and benefits, you “work for” Rippling. It allows small companies to have the benefits of a larger company. Your company pays the PEO per head. It also serves as an SSO provider. Another startup I worked for in the past used Insperity.
Thank you for the explanation. It's been something I've been meaning to research because I'd never encountered this before my current employer and it's become something I will actually ask about in the future.
I prefer smaller employers (500 or less) but this is pretty fantastic. I've worked for a Fortune 500 employer with a solid, expensive-but-generously-subsidized healthcare plan, a tiny employer with expensive coverage that wasn't all that great but I've never been able to select from three different providers with a few options a piece.
It was a "killer feature" for me. My family has low-to-moderate medical needs, I like HSA eligible PPOs if the deductible/cost is right. I was able to find three plans that were taken by my family's specific specialists where I could max out the HSA deduction and pay less than half what I had at the last "typical employer plan" company.
This came too late for the Dental side of things -- I would have saved a couple grand per child on braces by purchasing the "Cadillac Plan" even with the two-year lock-in. The last three employers all had plans that seemingly no dentist on Earth is "in network" for and from insurance brands I've never heard of.
There's other upsides -- working at BigCo, we received various discounts at specific car rental companies/hotel chains that the company negotiated discounted rates in exchange for preference for business travel.
I haven't looked into what my company is doing, fully, yet, but it sounds like we have a subset of some of those features, too. We're around 150-200 people (I think) but this is the most comprehensive and reasonably priced benefits offering I've ever seen.
I personally use Deel so that as a one-person company I can access large group benefits. Using their EOR saves me about $5000/year on health insurance compared to an ACA policy.
The best part about this story is the spy, when asked to hand over his phone, decided to hide in the bathroom and lock himself in before storming out of the building refusing to hand it over.
> On March 12, Rippling sought and obtained an order from Ireland’s High Court to seize the alleged spy’s phone. When served, the purported spy feigned compliance before “hiding in the bathroom and then fleeing the scene,” the complaint says.
This is gold, and hilarious. I get why someone would "spy" on rippling for money, but my god, don't use a phone. And why would you even need to be on prem to do this kind of spying? There are so many better ways.
Y Combinator
Andreessen Horowitz
SV Angel
General Catalyst
Spark Capital
Soma Capital
Coatue
Quiet Capital
AltaIR Capital
Elad Gil
Franklin Templeton
Alexis Ohanian
Four Cities Capital
Emerson Collective
Justin Mateen
Lachy Groom
Neo
Altimeter Capital
Mubadala
La Famiglia
Nat Friedman
Sinai Capital Partners
Firebolt Ventures
Y Combinator Continuity Fund
Daniel Gross
BAM Elevate
Avichal Garg
Incisive Ventures
Ryan Petersen
Darian Shirazi
Counterpart Advisors
Worklife
Weekend Fund
Recursive Ventures
William Hockey
Green Bay Ventures
Esas Ventures
Jeffrey Wilke
Roosh Ventures
Cem Garih
Fresh Ventures
Dara Khosrowshahi
Nick Raushenbush
Jeffrey Katzenberg
Bouaziz & Partners
Alexandre Scialom
Ben Lang
Vinay Hiremath
Rex Salisbury
Terrance McArthur
Pierre Bi
John Zimmer
Anthony Schiller
Talal Chedid
Raed Malek
I can't believe I'm about to defend a HR payroll systems.... but I wouldn't call Rippling or Deel "crapware". We use both; they're boring but necessary products, and they do their job well.
[Edit: Added Deel, since we use both! Also hello to the Rippling salesperson who is reading this and is about to reach out to me to convince us to switch.]
If you have a reasonably competent sales team, you don't need "spying", you just ask the customers about their experience with the competitor.
Any reasonably company both shops around and is happy to throw one provider under any number of buses if it gets them a better deal with another provider.
Remember that Israeli companies, including Deel, are mostly founded by members of Unit 8200 who are literal spies. These folks have their formative technical experience being spying on Palestinians in order to keep the occupation going.
Simple rule of thumb is never trust an Israeli company with your data or your customers' data.
> How did Deel start? What’s your story?
I'm originally from France. I lived in Israel, the U.K., the U.S., and Spain. Similarly, my co-founder, Shuo, was born and raised in Beijing. -Alex Bouaziz
Deel is the worst. I had to use them to be paid as a contractor. This was ok for about two years. Then Deel decided it wanted to force everyone to be paid using their Deel Wallet, a stored balance visa card. The terms and conditions of the Deel Wallet would force arbitration, allowed arbitrary changes to deposit and withdrawal terms and came with a $1000 penalty of one should choose to file a legal claim against Deel Wallet..
Readit News
There is extremely damning evidence that this unnamed individual ("D.S.") in Ireland was acting at the behest of Deel senior leadership, including:
- the COO of deel reached out to a rippling payroll manager on linkedin to recruit them. The rippling employee didn't respond. Shortly thereafter, D.S. pulled up that employees personnel record in the HR system that has their unlisted phone number. Shortly after THAT, the COO of deel reached back out to that employee via WhatsApp and that phone number.
- The information was about to publish a story about Deel potentially violating sanctions. New information in the article was that at least one of the customers involved was a company called "tinybird". No one at rippling was aware that this company even existed, but a week BEFORE the article came out, but after the reporter had been asking questions of Deel, D.S. started searching Slack for "tinybird" (and there were no other searches of "tinybird" across the whole company)
- Around the same time, the reporter for the information reached out to rippling and had internal Rippling slack messages about potential similar sanctions violations. A short time before that happened, D.S. was suddenly searching for "russia", "sanctions", "iran", etc.
- There was an email between D.S. and the ceo of Deel, along with an introduction to someone from the family VC fund.
- And then, of course, the honeypot - a fake channel, fake chats from the Rippling CRO, but the chats had real stories that former Deel employees had alleged. Email sent to only the CEO of Deel, his dad/chairman of the board, and their GC. Just a short time later, D.S. was searching for the fake channel, trying to find it, adn trying to find these chat messages.
I'm sure the CEO will try to have plausible deniability, that it was someone else in his org that he delegated investigating these things to, he had no idea, etc. But if they can get D.S. to crack and share the details of what happened, I think it will be tough to toe that line.
> So, to confirm Deel’s involvement, Rippling’s General Counsel sent a legal letter to Deel’s senior leadership identifying a recently established Slack channel called “d-defectors,” in which (the letter implied) Rippling employees were discussing information that Deel would find embarrassing if made public. In reality, the “d-defectors” channel was not used by Rippling employees and contained no discussions at all. ... Yet, just hours after Rippling sent the letter to Deel’s executives and counsel, Deel’s spy searched for and accessed the #d-defectors channel—proving beyond any doubt that Deel’s top leadership, or someone acting on their behalf, had fed the information on the #d-defectors channel to Deel’s spy inside Rippling.
I am sending legal letter to someone warning them that I have dirt on them AND am also mentioning where the dirt is. And that didn't ring any warning bells to Deel's management? Just wow, if true. If they are truly this incompetent, they have no business doing corporate espionage.
Presumably it was a letter on another topic say an accusation about Rippling poaching Deel’s employees.
Rippling’s legal counsel sends a letter back saying “we aren’t poaching, there are plenty of Deel employees are looking to leave based on posts to Twitter and Slack discussions such as those in the “d-defector” channel.”
"security startups that "monitor for corporate espionage"" imply introducing yet another third party that literally has access to all the things (or logs thereof) thereby introducing a nice fat pwn factor for everyone
The keyword you're looking for is "data loss prevention", it's a thriving market.
Really worth the full read.
Absolutely agree, although it's around an hour's read.
Into the void I say: There's a typo on page 39 (of the PDF; the bottom of the page says 37) line 1. That item should be item 4 since it comes after another item 3.
(page 12 also has "at which the Rippling would be offering those solutions" which should probably be just "Rippling", I suspect it said "the Rippling platform" before being corrected to "Rippling" but forgetting to remove "the")
> In part to ensure that the confidential information in Rippling’s Slack channels is used only for authorized purposes, Rippling employees’ Slack activity is “logged,” meaning every time a user views a document through Slack, accesses a Slack channel, sends a message, or conducts searches on Slack, that activity (and the associated user) is recorded in a log file.
I have to say, I think if this was just limited to the Slack previewing behavior, it's unlikely it would have been caught. Previewing Slack channels is not particularly unusual or suspicious behavior and many people, probably most, don't even think of it as being something that'd be logged. (I personally didn't think of it until reading this post, but in retrospect, of course it is. Everything is.)
Crossing the line into dumb things like Deel executives personally contacting the spy's subordinates via their personal phone numbers, which he had no way of knowing is like sending up a massive flare of weirdness. I'm not saying loyalty to one's employer is everything, or even particularly important, but if I was randomly headhunted by a C-level from a direct competitor, who I had never spoken to or expressed interest in, I'd be pretty suspicious, and I'd find it underhanded. I might mention it to someone.
Supposing the allegations are substantially true, I wonder why Deel felt comfortable going that far. Maybe underestimation of competition?
I'm not so sure, this is very damning
Not cheap, but worth it for sure considering how much time they save you.
https://www.rippling.com/peo
My company uses it. When you work for a company that uses Rippling, you are “co- employed” by both your company and Rippling. Your company does everything as far as hiring, firing, HR, management, etc.
But as far as taxes, insurance and benefits, you “work for” Rippling. It allows small companies to have the benefits of a larger company. Your company pays the PEO per head. It also serves as an SSO provider. Another startup I worked for in the past used Insperity.
I prefer smaller employers (500 or less) but this is pretty fantastic. I've worked for a Fortune 500 employer with a solid, expensive-but-generously-subsidized healthcare plan, a tiny employer with expensive coverage that wasn't all that great but I've never been able to select from three different providers with a few options a piece.
It was a "killer feature" for me. My family has low-to-moderate medical needs, I like HSA eligible PPOs if the deductible/cost is right. I was able to find three plans that were taken by my family's specific specialists where I could max out the HSA deduction and pay less than half what I had at the last "typical employer plan" company.
This came too late for the Dental side of things -- I would have saved a couple grand per child on braces by purchasing the "Cadillac Plan" even with the two-year lock-in. The last three employers all had plans that seemingly no dentist on Earth is "in network" for and from insurance brands I've never heard of.
There's other upsides -- working at BigCo, we received various discounts at specific car rental companies/hotel chains that the company negotiated discounted rates in exchange for preference for business travel.
I haven't looked into what my company is doing, fully, yet, but it sounds like we have a subset of some of those features, too. We're around 150-200 people (I think) but this is the most comprehensive and reasonably priced benefits offering I've ever seen.
Edit: noticed you said insurances, is PI included?
Deleted Comment
Deleted Comment
> On March 12, Rippling sought and obtained an order from Ireland’s High Court to seize the alleged spy’s phone. When served, the purported spy feigned compliance before “hiding in the bathroom and then fleeing the scene,” the complaint says.
Y Combinator Andreessen Horowitz SV Angel General Catalyst Spark Capital Soma Capital Coatue Quiet Capital AltaIR Capital Elad Gil Franklin Templeton Alexis Ohanian Four Cities Capital Emerson Collective Justin Mateen Lachy Groom Neo Altimeter Capital Mubadala La Famiglia Nat Friedman Sinai Capital Partners Firebolt Ventures Y Combinator Continuity Fund Daniel Gross BAM Elevate Avichal Garg Incisive Ventures Ryan Petersen Darian Shirazi Counterpart Advisors Worklife Weekend Fund Recursive Ventures William Hockey Green Bay Ventures Esas Ventures Jeffrey Wilke Roosh Ventures Cem Garih Fresh Ventures Dara Khosrowshahi Nick Raushenbush Jeffrey Katzenberg Bouaziz & Partners Alexandre Scialom Ben Lang Vinay Hiremath Rex Salisbury Terrance McArthur Pierre Bi John Zimmer Anthony Schiller Talal Chedid Raed Malek
Sales driven companies are all corrupt and corrupting. This kind of espionage is common, as is outright bribery of buyers.
[Edit: Added Deel, since we use both! Also hello to the Rippling salesperson who is reading this and is about to reach out to me to convince us to switch.]
Any reasonably company both shops around and is happy to throw one provider under any number of buses if it gets them a better deal with another provider.
hilarity ensues
Simple rule of thumb is never trust an Israeli company with your data or your customers' data.
https://en.wikipedia.org/wiki/Deel_Inc.
> How did Deel start? What’s your story? I'm originally from France. I lived in Israel, the U.K., the U.S., and Spain. Similarly, my co-founder, Shuo, was born and raised in Beijing. -Alex Bouaziz
Also, they're listed on https://www.israelitechalternatives.com/company/deel/
Deleted Comment