Comment by phantom_oracle | Hacker News Reader

Comment by phantom_oracle | Hacker News Reader

Just swap this story around and change it to:

Big corp. starts illegally stealing data through improper means and not following T&C of small-funded startup

and there would be an uproar.

All those fluff tech-sites that treat Apples new Iphone with incremental changes as "big news" would suddenly have months of juicy news to bash the big corp to the point where their bigger media-parent companies would follow suit and damage the big corp indefinitely.

Maybe folks should just call "a spade a spade" here.

The startup violated the T&C of ADP and whether or not ADP is 100% honest of the server-volume from this company, the startup still committed an illegal action.

You can "disrupt" industries all you like, but when you break explicit contracts, you can't go crying on social media about it and expect things to work out for you.

As far as PR goes, ADP won with this line:

"We’re willing to work with our clients who use Zenefits, and with Zenefits directly, to find a solution that fulfills our clients’ needs and protects their data."

> The startup violated the T&C of ADP

Here's a fun question... Did Zenefits ever agree to the TOS?

"By accessing and/or using the Site, you indicate your acceptance of these terms and conditions." [1]

IANAL - It seems as though they did agree.

1: http://www.adp.com/legal.aspx

"By accessing and/or using the Site, you indicate your acceptance of the sale of your soul to the devil."

> By using the Zenefits Service, you hereby grant us permission to access your Account Information maintained by identified third parties, and make changes to this information as directed by you, on your behalf as your agent. When you use the 'sync payroll' feature of the Service, you will be directly connected to the website or APIs for the third party you have identified. We will submit information including usernames and passwords that you provide to log you into the site. You hereby authorize and permit us to use and store information submitted by you (such as account passwords and user names) to accomplish the foregoing and to configure the Zenefits Service so it is compatible with the third party sites for which you submit your information.

So basically a user of Zenefits gives Zenefits the authority to act as an agent on behalf of them. So, technically when Zenefits accesses the ADP site they are legally seen as the authorized user themselves.

If I knew that a service was going to act on my behalf towards another party and that other party wasn't happy about the way that service behaved towards them. I might question my use of letting that service act as my agent.

Zenefits is actually pretty smart here because they can say "our users want this, they've agreed to our ToS that says we act on their behalf".

I disagree with your conclusion there. Having your clients violate the ADP TOS (and then subsequently violating it yourself while scraping data) is clearly not a smart move as illustrated by ADP's response.

Agreed. Zenefits took an engineering/business shortcut by scraping and using the default 3rd party user credentials. It was only a matter of time before this got shut off. They'll do what every other large 3rd party does, sign an MSA of some sort, build a better integration, and pay a massive annual fee to ADP for access. This is Financial Services

From a business ethics and security sense, I'm on ADP's side here. However, this type of press (or awareness) from ADP customers' is what makes this move smart: https://twitter.com/AaronKlein/status/607051950928953344

Imagine Zenefits was simply a broker and your broker said to you "ADP just shut off my access to them so I can't use their service, how about we use XYZ instead?". As long as I trust my broker is providing value then it doesn't matter what payroll service I use. So, if Zenefits is confident people value their service above the service a payroll service provides, then they will most likely win in this case.

Reply on news.ycombinator.com