5 Questions Coinbase Still Refuses to Answer About Hacking Team

Late Monday, March 4, Coinbase CEO Brian Armstrong announced that former members of spyware firm Hacking Team would “transition out of Coinbase.” The announcement came after nearly a week of mounting online fury towards the crypto exchange, organized around the hashtag #DeleteCoinbase, and triggered in part by BREAKERMAG’s reporting on Coinbase’s acquisition of the analytics firm Neutrino. As we detailed, Neutrino leadership was largely identical to the leadership of Hacking Team, which had allegedly been complicit in human rights abuses, sanctions violations, and the monitoring and murder of journalists worldwide.

The announcement that Hacking Team members would be leaving Coinbase looked, at first blush, like swift and moral action by Coinbase to correct a glaring misstep. However, Armstrong’s announcement left a number of unanswered questions, which were swiftly laid out on Twitter by figures including Udi Wertheimer, who launched the #DeleteCoinbase hashtag.

Below (in bold) are questions we sent to Coinbase PR representatives late Tuesday, March 5, requesting answers within 24 hours. On Thursday afternoon, roughly 36 hours later, a Coinbase representative contacted staff writer Jessica Klein, but refused to answer any questions about the Neutrino acquisition, or the conditions under which Hacking Team members will leave the company.

Under the bolded questions we sent to Coinbase, we have added context to explain why these questions are important, and what Coinbase’s refusal to answer them may imply.

1) Is there a specific timetable for the former Hacking Team members to leave Coinbase?
Armstrong’s announcement that former Hacking Team members will “transition out of” Coinbase leaves an extremely wide window for interpretation. The “transition” could take weeks, months, maybe even years, during which time former Hacking Team members could be accessing and handling Coinbase customer data. That could plausibly include access to millions of driver’s licenses and other sensitive documents provided to the exchange as part of the “Know Your Customer” process. Coinbase’s refusal to answer this question leaves open the possibility that Hacking Team members will not be leaving Neutrino immediately.

They may no longer be formal employees of the company, but could be engaged as contractors, either intermittently, or on an ongoing basis.

2) Can you disclose how many current employees of Neutrino will be impacted in addition to the leadership team?

So far, we are aware of the three Neutrino executives who formerly helped lead Hacking Team—Giancarlo Russo, Alberto Ornaghi, and Marco Valleri. But we still don’t know how big Neutrino’s overall staff is, or how many former Hacking Team employees were part of the new venture. Answering this question would also help us answer the next one.

3) Is Coinbase positioned to operate Neutrino’s technology without its staff?
This question is important for two reasons. It has become clear over the last week that many exchanges feel legal pressure to use some sort of blockchain tracking to screen for customers linked to criminal or terrorist activity. If Coinbase cannot use Neutrino’s tracking technology after former Hacking Team members exit, it may have to write down the cost of its acquisition and seek another solution.

At the same time, many users were shocked that Coinbase has been using such tracking systems at all, as it would seem to undercut some of the autonomy promised by cryptocurrency. This was not completely new information—Coinbase has a track record of shutting down user accounts when they cross certain invisible lines. And it is highly likely that this practice will continue, whether with Neutrino’s technology or through other methods.

4) Can Coinbase guarantee that former Hacking Team members—especially leadership—will not serve in contract roles in the future?
However long it takes for former Hacking Team members to “transition out” of Neutrino/Coinbase, there is wiggle room as to what precisely their status will be afterwards. They may no longer be formal employees of the company, but could be engaged as contractors, either intermittently, or on an ongoing basis.

Get the BREAKERMAG newsletter, a weekly roundup of blockchain business and culture.

Coinbase’s refusal to answer this question may be most disturbing of all. It leaves open the possibility that Armstrong’s announcement was entirely lip service, and former Hacking Team members will retain prominent roles within Coinbase’s analytics operation—just without the legal status of employees.

5) Was Neutrino leadership given financial incentives to depart, in addition to the sale price of the company?
It’s likely that Neutrino leadership signed contracts during the acquisition by Coinbase that included exit clauses governing terms for any future departure from Coinbase. Because no previously unknown information about Hacking Team or recent actions by its former executives were at play in the #DeleteCoinbase fallout, it seems unlikely that the separation announced by Armstrong would be considered a justified firing “for cause.”

Instead, Coinbase may have negotiated the resignations of the former executives and team members—implied, again, by the term “transition” used in Armstrong’s announcement. Negotiated resignations, even those reached in the midst of PR disasters, often include severance packages for departing executives. According to Bitcoin Magazine, former Hacking Team executives received $3 million each from the $13.5 million dollars paid by Coinbase to acquire Neutrino. Any severance received by former Hacking Team executives would be in addition to that amount. In short, Coinbase’s acquisition of Neutrino has already made some very unethical people quite rich. In attempting to save face after their disastrous acquisition, Coinbase may have paid those people even more money—money potentially derived from user fees.

At the time of publication—two-and-a-half days after sending our inquiry—we have still not received answers to these questions. Coinbase did comment on a related issue. As #DeleteCoinbase gained momentum, Coinbase head of sales Christine Sandler told Cheddar that Coinbase’s prior blockchain analytics providers “were selling client data to outside sources,” which understandably further stoked user distrust.

Coinbase maintains that Sandler misspoke, and provided the following statement on that topic: “Coinbase has never shared our customers’ personally identifiable information with any third-party blockchain analysis vendors. As an inherently open protocol, crypto blockchains are public by nature and as such, we do not control visibility into basic transaction data. As part of our compliance programs, we have worked with a number of blockchain analytics companies over the years and will continue to work with those that share our values, in particular, the ethical use of the limited transaction data that we provide. While we will always do what’s necessary to remain compliant in the regions in which we operate, we will not share broad sets of transaction and address information with vendors if it is beyond their immediate scope of work.”

Bringing these two threads together, readers should note the explicit reference in the above statement to “third-party blockchain analysis vendors.” Neutrino, and former Hacking Team members, are now part of the Coinbase Family. They are no longer third parties.

And we have no clear idea when they’ll be leaving the family.

Image via the Hacking Team website.