WeWork evicted a startup after it published a negative blog post about it | Hacker News Reader

WeWork evicted a startup after it published a negative blog post about it

qz.com

209 pointsminimaxir123 comments

It's sad that nowadays people do whatever they can to get attention and one of the best ways is to capitalize on other people's misfortunes.

I just read through the original Medium post, and I can't really sympathize with any of you guys in this thread saying WeWork is the evil.

This guy hacked into their private API (legal or not doesn't matter), and used that information to write a blog post, and at the bottom writes:

"About Thinknum Thinknum indexes alternative web data for thousands of companies, capturing relevant information for financial analysts to use in their investment process. Thinknum has hundreds of institutional clients across hedge funds, investment banks and corporations."

Basically here's how I see it: this guy wanted attention, so betrayed their business partner (WeWork) and used the private information to get traffic to his product. I can't imagine myself ever doing something like this. What did WeWork do to this guy that harmed him? Every company has difficult times. I'm sure WeWork guys wanted nothing more than to build an organization that helps these little guys, but if I were in their position I would feel extremely sad. They don't deserve to be thrown under the bus by someone they're in partnership with, whom they did nothing bad to.

I am a cofounder of @Thinknum. Based on what evidence did you come to the conclusion that we hacked into an API? We did not hack into any private API. We had access to the API.

Having access to the API does not mean that it is public, and that you have permission to do whatever you want with it.

Having permission to use the API means we did not hack into the API - that is what I claimed. I never claimed that meant we had permission to do 'whatever' we want with it.

This guy hacked into their private API

This is called "growth hacking".

yuck!

> hacked into their private API

an unpublished api is not the same thing. I think there needs to be more clarification on this, but if its just an unpublished api they've done nothing wrong.

> its just an unpublished api they've done nothing wrong.

Not correct. A published, documented API comes with instructions on how the API can use used, and how the data can be used. Do not assume that an unpublished/undocumented API is the same, especially when republishing the data.

>A published, documented API comes with instructions on how the API

Agree and since it was undocumented there more than likely were no terms as to how it should be used.

Just because there's no law, doesn't mean it's "nothing wrong", this is what annoys me about many people's sentiment here.

Do you think if your friend who pretends to be all friendly with you in front of you went behind your back and talked behind your back for his own profit, you will still say "oh he did nothing wrong, there's nothing in the law that says you can't talk behind friend's back."?

Your friends example makes 0 sense in this context. Weworks had an api. They didn't document and obviously didn't do enough to protect it nor monitor it for unauthorized usage. So someone used it for whatever they wanted to.

I don't know if you understand my point but just want to argue for the sake of winning over a conversation, or if you don't even agree with my point to begin with.

My point is, doing whatever you can just because you can is not always the right thing regardless of its legality. It is an asshole behavior on my book to betray someone's trust regardless of whether it's legally ok to do so or not. An asshole is an asshole. Feel free to defend that asshole if you want. I'm just not on that boat.

I have tons of other analogy I would like to use but you'll probably try to make counter arguments about those little expressions instead of the real point so I will stop here.

I think the better analogy for this is like having a secret document on your desk and hoping no one walks in and reads it. Is it in good taste to share it with people, obviously no. Did they do anything wrong, no.

In my book, doing something of bad taste counts as wrong. I have no idea what kind of definition you're trying to use for "wrong".

If you really think walking into someone's room and taking a secret document on their desk without their permission and publicizing it to fuck them up so you can gain profit from it is NOT wrong, I have nothing more to say.

Misleading title: these guys weren't kicked out for publishing a negative blog post, they were kicked out for sharing WeWork internal data publicly, which violates the terms under which they got the data.

Here's the blog post:

https://medium.com/@justin.zhen/deep-dive-into-weworks-user-...

(I flagged the article because the title is a lie at present)

It's particularly nauseating to take a screen short of their "internal proprietary social network".

A sense of trust is one of the most difficult things to build within a gathering of peer companies like WeWork has tried to do, and one bad actor poisons the whole well.

Archived version [0] as it seems like it was taken down.

[0]: https://web.archive.org/web/20160722222224/https://medium.co...

Loads briefly and then redirects to medium.com for me.

Yeah, medium posts do that when using the wayback machine. I normally just hit the browser stop button as soon as the text loads. You miss out on images but you can still read it.

The way I got around it is by disabling javascript.

The article title itself was very recently edited to include this information. (I cannot edit the HN title)

Until WeWork pulled this, few people knew WeWork was in trouble. Now everyone on HN does, which includes many WeWork investors and customers. Expect press coverage in a few days.

Streisand effect, people. The coverup is worse than the problem.

Are they definitely in trouble? There seems to be a lot of bias on both sides, and no clear indication either way?

Looks like it.[1] "An example The Information gives is that of a 20-year lease signed in New York’s financial district, on which WeWork got over a year of free rent. This free rent, however, was not spread out over the length of the lease, as is usually standard accounting practice. Instead, it was plugged straight into the current numbers, increasing near-term profits."

WeWork leases real estate on long term leases and subleases it on short-term ones. If occupancy drops, they're in big trouble, caught between declining revenue and fixed lease costs.

[1] http://www.businessinsider.com/weworks-financial-projections...

They probably assume they are in trouble: “To launch a taboo, a group has to be poised halfway between weakness and power. A confident group doesn't need taboos to protect it.” http://www.paulgraham.com/say.html

I haven't dug through their data or financials, but I work across the street from a wework and occasionally I go over and play some ping pong with friends. Their rent seems a little pricey, but it is ALWAYS packed with people in offices and at tables. I have multiple friends (3 or 4 different companies) that are all happily renting there. If other cities are anything like Portland I don't see how they are in trouble at all. Im actually glad wework has terms of service like this and gave them an 30 minute eviction notice.

Density does not equal profitability.

Umm it does if you know what the rates are to be there? Check back in 6 months and see how they do after their first round of churn?

Guessing you work at Lytics!

haha nice! Yeup! :-)

I'm in NYC and we negotiated a ridiculously low monthly rate as an introductory offer into one of their newer buildings (I'm talking more than half off what their initial offer was). It certainly made us question how well they are doing, particularly as they expand so rapidly. I'm also assuming they gave similar breaks to get other folks in the door, which I can only imagine increases churn when that initial 3-6 month deal concludes.

There's a really disturbing trend/pattern in the hacking/tech community here that's worth pointing out: people are way too interested in laws and policies and testing the limits of each.

Laws and policies don't define your success in interacting with others - people do. Laws and policies are just a guide to limit (not allow for) other people's reactions to you being a nuisance.

You have no right claiming to be a victim if your only justification for what you've done is that it technically wasn't illegal and it was sort of allowed under policy that you've taken a very (conveniently) narrow interpretation of.

Here's a simple test for whether you should post something online: * Does it enrich the world that I share (gasp) with other people? * Does it enrich or at least have a neutral effect on my 'business' partners (including business, government, the mail man, and every other person who can make my life painful)? * Does it enrich me enough to be worth my time?

If the answer to any one of those things is 'no', step away from the keyboard and don't post. There are rare exceptions, but if you take the time to reflect and observe, you'll notice that a) the happy, successful people around you follow this rule and b) the dramatic, moody, perpetual victims of the world don't.

Make your choice.

Why not try to be a nuisance? “News is something somebody doesn't want printed; all else is advertising.” - William Randolph Hearst

Nuisance for societal gain can certainly be respectable and arguably an overall good; look at Edward Snowden for example.

But that also supports the original point: he was a nuisance to the US government and they are doing everything they can within the limit of the law (and politics) to get their hands on him. Lucky for him Russia is going through an angsty phase and is granting him asylum for the moment.

In this particular case of scraping and publishing the churn rate, no one really benefits. It was just one person/startup who felt like starting drama and didn't bother thinking about the consequences.

Leave the drama to the TV networks and tabloids.

Nobody benefits. Except WeWork's now better-informed customers and investors. Who seem like somebody to me.

WeWork's customers don't really have any right to know its internal sales data and operating figures. And obviously the investors have access to better numbers than whatever this guy managed to find and scrape from their API.

The question if customers have any rights to know the figures is different from the question if the figures are useful to them.

The comment was about societal gain. Large companies often gather substantial intelligence on suppliers, so clearly there's a benefit.

Investors don't obviously have access to better numbers. Investors in privately held companies generally receive a very carefully groomed set of data. We hope the people compiling that information don't go out of their way to hide anything (although that happens). And we hope that the raw data is accurate (although this too is often distorted). But they probably don't go out of their way to dig up negative stuff. Smart investors definitely don't take a company's offered financials as their only source of information.

And WeWork intends to go public, possibly soon. Those people definitely don't have access to better numbers right now. And they might not get any. IPOs are carefully stage managed.

I disagree? It's just data man. WeWork tested the limits too, when they wrote that overly limiting terms of service.

Nothing sums up the naivete described by the OP as nicely as "It's just data, man". Publishing data has meaning and consequences, both to others and to your own life and future career. Data is power.

Isn't everything "just data"?

Yep. I was blacklisted from several tech events, for writing a mildly negative Facebook post about a local consulting company. This is becoming a real problem. Companies in the tech space are using blacklisting to silence any kind criticism or critique.

How does blacklisting actually work, in this situation? Do you mean that you are actually forbidden from attending conferences? Dude, fuck that! Call them on their groupthink through whatever channels are still open!

@mods: expletive is appropriate in this situation

HN mods generally don't care about cursing, as long as you're contributing to the conversation.

It's completely their prerogative to do so.

And as usual, that doesn't make it right.

  - x is doing something bad
  - x is allowed to do that
  - that doesn't make it right

 The HN comment circle of life

Agreed. This patterns makes me crazy.

If I say, "This use of power is immoral," I read the response of "but they have that power" one of two ways: Obvious tautology, and therefore useless. Or contradiction of my claim of immorality, which basically is an assertion that might makes right.

It is harmful for any stakeholders but the target to tolerate this behaviour. Outing the coverup on HN is entirely appropriate, imo.

No, no, everything is fine, it's not the gummint, so your getting squashed like a bug is perfectly alright.

It's just consequences, man up, they even have a xkcd comic to back it up. Really.

(Unless the shoe is on the other foot. Then it's completely different, and something must be done.)

The referenced blog post was submitted to HN (https://news.ycombinator.com/item?id=12124731) and I asked where OP got the data. OP dodged the question.

Even if you got the data legally, you might not want to disclose it, because

i) It makes it seem more boring ("oh we just made an api call") ii) It opens the door to the other party saying that you violated the TOS (although they would still have done it; after all they are a 16bn firm that wants to defend itself)

They already admitted to using an undocumented WeWork API without asking permission, but simultaneously maintain that they somehow collected all the stats without spidering, scraping, or doing anything else that violated the ToS.

(from the reuters article - "Zhen said he does not believe he violated the terms of his WeWork membership when he used an application programming interface, or API, that he and his Thinknum colleagues found on the WeWork network to locate and analyze WeWork membership data."

Once potential legal wrongdoing is in the picture, and especially after accusations have been thrown around, everyone is in CYA-mode (cover your ass). Playing dumb is a great strategy. My favorite example is when Hillary was repeatedly asked by reporters about wiping her email servers (implying she destroyed evidence). She responded:

"Like with a cloth or something?"

>"Like with a cloth or something?"

10 Tesla ferromagnetic cloth may just do it.

I actually fell off the chair in laughter when I saw her say that.

To be fear, they did not just publish a negative blog post about WeWork as the title may suggest, but somehow obtained proprietary data WeWork probably sees as a trade secret.

Many companies will revoke your access then.

It's still proprietary, but if you publish the data via your API is it reasonable to expect people to not chart it and draw conclusions?

Where's the line between "scraping" (prohibited) and reading (allowed) of the API data?

As I understand it is currently unknown where the author got the data. If WeWorks published this in a publicly available API it is of course reasonable to chart it, but if the author somehow misuses the access he got as a tenant there, this is not (in my view) just an issue about the author publishing a negative blog post as the title indicates.

it's my understanding the API they used was undocumented, so while it's WeWork's fault for not doing a better job securing an API that seems sensitive to them, it's also disrespectful to do something that you're pretty clearly not wanted to be doing

IANAL but you can be in trouble even if the data is openly available but the party managing the data deems it restricted in any way. I believe this is the reason security researchers get in trouble: they access data that is considered restricted and get prosecuted for "stealing" it.

I think the logic to that is something akin to: its illegal for you to take my car even if I leave it unlocked with the keys in it.

The company has to communicate that the data is restricted, they can't just deem it restricted after the fact. Usually when companies or individuals (eg. 3Taps & Aaron Swartz) have gotten in trouble under the CFAA, it's been because they've been served a C&D or IP-blocked and then persist in accessing the data, which the courts have upheld as "knowingly and intentionally accessing a computer without authorization".

In this case, WeWork is within their rights to terminate ThinkNum's membership for the ToS violation, but there's no legal case unless ThinkNum persists in scraping WeWork's data after the termination, or there's evidence that ThinkNum knew that the API was restricted at the time they accessed it. Hence the founder's repeated insistences that he did nothing wrong, and coyness in discussing the source of the data.

Here is the post:

https://medium.com/@justin.zhen/deep-dive-into-weworks-user-...

http://archive.is/ou72L

Don't forget they are also suing an employee for talking to reporters:

http://www.businessinsider.com/wework-is-suing-an-ex-employe...

I'd say this is a pretty clear case of where there's smoke.....

They're suing an employee for (alleged) theft of proprietary documents, obtained through using the credentials of another employee. Not for "talking to reporters."

This is a pretty clear case of where there's smoke...

There's innuendo and hyperbole.

You're confusing motivation with legal cause of action. Yes, the suit talks about alleged document theft. But Us0r is talking about their intent in pursuing the suit.

If WeWork decided to look for a reason to sue a former employee who made them look bad in the press, they would hardly be the first. But exactly none of those suits will say so, because that suit won't get far at all.

But Us0r is talking about their intent in pursuing the suit.

Yeah, I got the part about WeWork's "intent" already and wasn't "confused" by it, as you so kindly suggest. My point is he's using manipulative language to get his point across, which I find distasteful.

I'm not saying you misunderstood; I couldn't know that. I'm saying that in your reply you muddled them. When you say "it is A, not B", you're suggesting that one excludes the other. That's not the case; they're different things.

If you don't like his language, I'd suggest you critique the language instead of contradicting him on a point of analysis.

Look, it's the original commenter who used muddled (and misleading) language in the first place, not me. Whether their "analysis" or his "language" was more critique-worth is beside the point.

I wasn't confused by it. The lawsuit was mentioned as "for document theft" in the article. I thought he was clearly adding his interpretation of motive. Maybe it's just you?

To me it reads as spin, not simply "interpretation."

It's not suing an employee for talking to reporters. That doesn't make sense. It's suing an employee for stealing confidential information.

It's not suing an employee for talking to reporters. That doesn't make sense.

Most company exits include an NDA clause which would prevent talking to reporters so the statement does make sense. Except you're totally right thats not what she's really being sued for.

Such clauses only come into effect if you take the severance package. So, while you can say it's likely the employee was under a non-disparagement agreement, it's not a certainty.

Generally NDA refers to non-disclosure, not non-disparagement.

Yes, but it's also generally a non-disparagement which would stop former employees from speaking negatively about their former company to the press.

Where do they provide a way to replicate their findings?

I am not sure how good they are at scouting locations or predicting market demand. The one I'm in on Miami Beach (why they picked this location to start is beyond my imagination) is maybe 50% full, and 2 more locations are either just opened or coming open soon as well.

Part of what they are doing is using their funding and power to make a massive real estate land grab at very low rates for long lease terms. I believe they are gambling that in 5-10 years the market demand will swell to accommodate some of their lower value areas.

Even if the post is totally accurate, a 6 % churn would not be that bad compared with corporate suites. The wework social network app is not that great either, so I don't think it is representative of anything if you have no followers there. Some people are social and make friends with their ww neighbors, some don't. More about personality. If ww wanted to they could introduce locations with different features or lower price to reduce churn at any time. They can basically dial-a-churn rate in this market.

Corrected 6% per year = a bit bigger than avaeage

The article says 6% per year, not per month.

I corrected it

And this is news because...? If I wrote bad things about my landlord, there's a good chance I'm going to be kicked out as quickly as legally allowed. (Sooner, if the landlord doesn't care about legality.)

Its news because both the issue reported and the inability to address this constructively doesn't speak well of them and unlike most landlords they are soliciting outside investment from the kind of people who read hacker news.

Well, they also contend that the "lease" was violated. So there's that. If you continually poke about in doors around the apartment building that the landlord says you're not allowed to, there'a also a good chance you'll be asked to leave the premises.

What "lease"? WeWork is month-to-month.

It's in quotes continuing the analogy. If they violated the TOS, that's akin to violating the lease on your apartment.

The claim is that the tenant violated the WeWork terms of service (very much akin to a lease, albeit a short-term one) by scraping member data through the WeWork API.

Yes, I understand that. I'm going further and saying that anyone working here should expect to lose their spot for any reason or no reason on a monthly --- meaning, effectively, instantaneous --- basis.

I have a lot of negative things to say about WeWork as a business, and some netting-out-positive things to say about the particular West Loop WeWork space I'm working out of right now. But most of all: I'm here with my eyes open. There's also the concern of "is WeWork even going to exist in 6 months"?

Not even monthly they were given 30 minutes to vacate.

Got it - apologies for misunderstanding you. I thought you were suggesting the opposite (I.e. that there is nothing to violate because of the lack of a long-term lease). :)

That's not how it works. Unless he tenant violates one of the terms on the lease where the punishment is explicitly stated to be immediate eviction (e.g. running a drug operation), evicting tenants is a huge liability for the landlord.

Except that's explicitly not allowed.

Classic Streisand effect.

It also wasn't terribly smart to take "proprietary" customer data and make it available to others via an API. If you say everything is sugar and roses but your own published data says there's trouble brewing, don't be surprised if people call you out!

There's offices on Bishopsgate in London. I walk past there every now and again and it's been getting emptier and emptier.

If you're on a month to month lease and do anything to piss off your landlord (commercial real estate, not residential) they have no obligation to continue accepting your money. I don't see why they're surprised.

They got evicted "effective immediately", not at the end of their 1 month term. This is not a refusal to renew, which I expect requires some amount of notice greater than 30 minutes.

It's not a generic landlord-tenant relationship, and the "eviction," such as it is, is not based on tenant law.

> It's not a generic landlord-tenant relationship, and the "eviction," such as it is, is not based on tenant law.

Generally, protections in law regarding tenancy in real property apply irrespective of the basis of the eviction (with specific exceptions written into the tenancy law.) While housing is more protected, generally, most jurisdictions have significant protections for commercial tenancy as well (because lacking such protections creates a poor environment for business.)

What does a template wework lease look like?

I don't know, but the word "lease" doesn't appear in the story, only something about membership terms.

Beats me.

But you can be sure that those who have signed them have also signed provisions agreeing not to disclose them.

I'm not a startup founder but my take is that companies will grow to a certain size as they progress from (hopefully) smaller space to bigger space at a co-lo space. Once they hit a certain size they either fold or end up moving to a bigger space as it no longer makes sense to pay the high price of co-lo spaces if you are in high growth mode. Am I way off the mark?

They are hypersesensitive because the churns rate is up. As it sits, the current churn rate is higher than the new intake rate = decline is in progress. To stop it = lower rents and or sales commissions but their rents are already high, how high are their commissions to space sellers (if any??)

In any event, the Streisand effect is now well in force, as Animats suggested.

The only thing I take away from this is that now this asshole who gained unauthorized access to an API to get an incomplete set of data to use as a basis for publishing slander is getting all this free marketing from his 'content marketing strategy' aka dumb personal blog. The Trump effect at it's finest.

BAM. +1

WeWork was "Ok." Have moved on. Staff seems to turn over lots.

Had some dealings with them over a deposit, thought it could have gone much better. Had a hard time finding basic account info. They just did not seem like a "mature" organization. But that was a year ago. Maybe things have changed. Overall, give them a "B."

Now in a Non Profit space, WOW, totally different vibe for sure. A+ here. :-)

If Regus did this, they'd have zero total tenants. And I'm only kidding a little.

Have you ever known thinknum? Do you know how they treat employees? like wework treats them

Ummm... "30 minutes to vacate"? Are they crazy? That's a 100% illegal eviction. RPAPL § 853 -- treble damages NYCAC § 26-521 - 529 -- misdemeanor, civil penalties

That's housing law. These aren't standard residential leases. They're very clear about this when you sign up.

Commercial real estate also has some protections.

However, the real problem is that WeWork opens themselves up to a lawsuit which risks bringing all their real number into the spotlight.

If I were a competitor, I'd fund these guys in a lawsuit against WeWork who would be willing to pay a LOT of money to make it go away rather than have a very public discovery phase.

They might be very clear about it, but it doesn't mean anything. Just because you call a lease a "member agreement" or somesuch, doesn't mean it supersedes state and local laws meant to protect tenants.

None of the list of remedies you provided upthread appear to apply to commercial leases, even if terminated unlawfully, so I'm not sure what we're still debating.

We appear to be pretty far from the "100%" confidence level you originally provided.

See my other replies below.

I did. They aren't responsive to this comment. If you disagree, can you explain how?

Even if this would be considered a commercial license (and not a commercial lease) RPAPL § 853 (treble damages for unlawful eviction) and RPAPL § 713 (7) (10 day eviction notice required for a commercial license) apply.

https://commercialobserver.com/2013/11/the-dirt-dictionary-l...

https://www.blumberglegalforms.com/html/05508103080008AdamL....

First, the hot-desk WeWork subscription contract is worded to avoid "exclusive use". If that's what they --- like most WeWork users --- had, it's unlikely they had a lease at all.

Second, even if they did have a lease, statutory notice and penalties are nowhere nearly as strict as they are for residential lockouts (where statutory civil punitive damages untethered to actual damage do in fact apply).

In any case, if they want to claim damages, they're going to have to (a) document actual damages from WeWork's action and then (b) take it to court and wait a year or two to have a chance at recovering, in what will, due to their own actions, be a complicated case.

Nothing is going to happen here. Everyone is simply going to move on.

I mostly agree. If it was a hot-desk user, that would almost certainly be construed as a license by a court. When I was at WeWork, the vast majority were glass-walled permanent offices. Other locations could differ I suppose.

But, as I showed above, even commercial licensors have protections too...with notice needed and treble damages applying. Punitive damages could apply as well. In the end though, kicking some people with laptops (probably) out of their offices would, I would guess, result in a 5-figure award if it went to court...which would make it a somewhat marginal case (even if they were awarded legal costs as well).

Small claims court would probably be a guaranteed $5,000 though.

Does WeWork care about a few thousand dollars vs. stanching the flow of someone spreading bad PR about them? Probably not.

OTOH, now people know WeWork management have no compunction in telling you to GTFO ASAP (legal or not), and for the more risk averse larger tenants, that might be quite a concern...particularly given how much more WeWork charges per square foot (2x++), compared to just an ordinary 1 year sublet in the same area.

So in the end, I would still not do what they did. I would have a) Sent them a legal nastygram b) booted them off the internal network c) given them 10 days notice

but I'm the law abiding type :-)

It doesn't supersede anything, it should be completely unrelated. Do you have any evidence that residential tenancy law applies to office leases or co-worker spaces?

RPAPL § 853 Commercial Lease "Having thus substantiated that the value of its discarded records and personal property is $145,695.20 and that these records and property were discarded pursuant to a wrongful eviction as established by the complaint and, moreover, admitted by defendants according to the uncontroverted proof, plaintiff is entitled to recover treble damages of $437,085.60 under RPAPL § 853." http://law.justia.com/cases/federal/district-courts/FSupp/94...

I was wrong about NYCAC § 26-521 - 529, that's only for dwellings.

Even if the courts determine it's a license, and not a lease (I don't think WeWork has been tested yet), RPAPL § 853 applies, and now RPAPL § 713 (7) would as well. (10 days notice)

https://commercialobserver.com/2013/11/the-dirt-dictionary-l...

Note WeWork usually gives you a designated, numbered, suite, which might confirm that it's a lease. In the above-- "One last “don’t” for a licensor looking to remain one in the eyes of the law: don’t designate a particular space for licensee’s exclusive use. "

I don't know if that's true, but I imagine that in order to get redress for such a claim, one would need to take them to court.

Not sure if that applies to business tenants. Also it's not a lease, it is a "license agreement" haha.

Reply on news.ycombinator.com