by Dan Lyons
Those incidents were strange, but they didn’t really prove anything. I racked my brain trying to figure out what the HubSpot idiots might have done. I recalled that on my last day at HubSpot, Chernov did my exit interview himself, instead of sending me to HR. He also confiscated my company laptop, a MacBook Air. I was fairly certain that I had removed my personal Gmail account from the machine before handing it over. But what if I hadn’t? What if my password was still stored on the machine, and Chernov had been able to restore my personal Gmail account? He might have been snooping into my email for months.
If HubSpot had gained access to my email, and to my Facebook and Twitter accounts, they might know which people I talked to during my reporting. These included some current and former HubSpot employees. I had assured those people I would not use their names. Now they might be in jeopardy.
One theory was that someone had broken into my house to get the manuscript. It would be easy enough to do. Our house isn’t exactly Fort Knox. I had printouts strewn all over my office, and versions stored on my computer and backed up onto a thumb drive.
Most people, however, seemed to believe that I had been hacked. I shut down my MacBook Air and never touched it again. I bought a new MacBook and changed the passwords on all of my accounts. But I still did not feel safe. If someone had hacked me, what else had they taken? I had to assume that someone had cracked my home network and obtained not just my book manuscript, but everything.
They might have been in the server where we keep our family photos. They might have gained access to our Wi-Fi router. They might still have access to the router. They could have accessed our bank accounts and credit cards, or installed keystroke logging software on my computer and recorded every letter I typed, discovering all of the passwords to all of my accounts. They might have invaded Sasha’s computer as well as mine. They might have gained access to the cameras on our laptops and sat there, watching us, recording us. What about our cell phones? And our home phone? Had someone parked on our street and watched our house, waiting for us to go out so that they could break in?
What if HubSpot had hired outsiders to do the dirty work, and those guys kept copies of what they found? Indeed, a few months before the HubSpot scandal broke, I discovered that my Social Security number had been stolen, and that someone had used it to file a fake tax return, hoping to scam the Internal Revenue Service. Hackers could have put my Social Security number and all of my financial information up for sale on the dark web, a secretive world inhabited by criminals with sites that can only be accessed using special software that cloaks your identity. Pictures of my kids could be floating around in pedophile forums, along with our home address and the name and address of their school.
Unless someone from HubSpot or its board of directors called and explained to me exactly what happened, for the rest of my life I would have to assume that all of these things had happened. Hackers might have started out just trying to get a copy of a book manuscript, but in the end they might have done much more damage, not just to me but to my family as well.
I’ve grown used to the call from my credit card company telling me that my card has been compromised and they’re sending me a new one. But this felt different. This was targeted and personal. The people who did this were people who knew me. This wasn’t the same as getting rounded up in a massive hack where bad guys steal millions of credit card numbers and yours just happen to be one of them.
Once, when I was in high school, our house was burglarized. One Sunday night we came home from our weekly dinner at my grandmother’s house to find a door broken open, rooms ransacked, jewelry missing. Someone had studied us, learned our routine, and then hit the house when they knew we would be out. We suspected a kid in the neighborhood, but the police could not prove anything.
The worst part wasn’t that things were stolen. It was the feeling we had afterward. It was as if until then we had gone through life believing that the locks on our doors and windows could protect us, that danger was something abstract and far away, something that happened to other people but not in our sleepy neighborhood in a tiny town in New England. After the robbery I wondered if we would ever feel safe again. As Chekhov wrote, “However happy [one] might be, life will sooner or later show its claws.”
HubSpot had shown me its claws. This company was not just a wacky frat house with Cinco de Mayo margarita bashes and sales bros puking in the men’s room and a bunch of clueless twenty-something managers. The people who ran the place were not just a pack of bullshit-slinging charlatans, but something more sinister. It seemed to me that maybe their intent all along had been not only to get hold of the book but to send me a message: You think you can make fun of us? Just look at what we can do to you.
The day after HubSpot announced Volpe’s termination, a former executive at HubSpot asked me to meet him in a town outside Boston. I thought he knew what had happened and wanted to tell me. At the last minute he canceled the meeting, saying he was afraid I might be followed. I said that seemed a bit extreme, but he responded: “You’re fucking with a company that’s worth a billion and a half dollars. These people take this shit seriously.”
Suddenly the whole thing seemed not funny at all, not even a little bit.
To make things worse, all this was happening just as I was about to leave Boston for Los Angeles, to spend several months as a writer on the third season of Silicon Valley. I left with massive anxiety, fearing that Sasha and the kids might be in danger. Sasha assured me that I was worrying about ghosts that didn’t exist. If something happened, she had friends and neighbors and relatives nearby. On weekends I would fly home to Boston. Nevertheless, I left for Los Angeles still feeling that that none of us was really safe.
What came next was a kind of police procedural, as I set out to discover what had happened. Beyond the question of what HubSpot had done to me lay a second and more intriguing question, which was why they had done it. Why would anyone go to such lengths to get hold of a memoir whose essential purpose was to entertain? It occurred to me, and to others as well, that HubSpot might be worried that I had stumbled on some damaging piece of information. What could they be so worried about? Just as I was thinking that the book was pretty much done, I wanted to dive back in and find out what I’d missed.
Lawyer friends told me I should expect to hear from law enforcement and that I should hire an attorney. I retained Steven A. Cash, a lawyer from Washington, DC.
Cash and I started trying to piece together a timeline of events. There were three key dates.
On June 22, Halligan sent me an email asking about the book. I told him it was a funny memoir about being a middle-aged journalist trying to fit in at a company with a kooky culture. He said he was concerned that the word “bubble” was in the title, because he didn’t think HubSpot was a bubble company. Sales were growing 50 percent! After a few messages, he went dark.
On July 13, I emailed a draft of the manuscript to my editor.
On July 29, sixteen days after I sent the manuscript, HubSpot announced that Volpe had been fired.
These three dates seemed to form a kind of narrative, but we still had no idea what happened. All we knew was that the board had hired a Boston law firm, Goodwin Procter, to conduct an investigation. Members of the board had read the report produced by Goodwin Procter, so they knew what Volpe had done.
Perhaps this was naïve, but I hoped that someone from HubSpot’s board of directors would contact me and offer an explanation. No one ever did. Bear in mind that I’ve met some of these people. I would not call them friends, but I know them, and they know me. One director lives in my town. We’ve had coffee together. We have mutual friends. Nevertheless, I heard nothing.
Remember the HubSpot culture code? Remember the stuff about HEART, and how the T stands for “transparent”? The culture code deck contains a slide with a paraphrase of the famous Louis Brandeis quote about sunlight being the best disinfectant, and another slide that says, “We are radically and remarkably tran
sparent.” When it came to my situation, apparently these principles were no longer operative.
Steven Cash, my attorney, contacted HubSpot general counsel John Kelleher asking for information. Kelleher bounced Cash to Goodwin Procter. A lawyer at Goodwin Procter offered no information and would not even say which law enforcement agencies had been alerted.
Days after that conversation, however, Cash got a call from an assistant U.S. attorney who said she was investigating the case with agents from the FBI’s cyber crime division. I met with them in September 2015. Even after the meeting, I still had no idea what HubSpot had done.
Later I would hear some crazy stories. One was that the spying involved “Dumpster diving,” meaning that Volpe, or someone working for him, had gone to my house and dug through my trash, trying to find a manuscript. I tried to imagine Volpe out in my driveway in the middle of the night, digging through bags of used cat litter. I didn’t know whether to laugh or to cry.
Another story, told to me by several present and former HubSpot employees, is that when Volpe was fired, HubSpot held an all-hands meeting to explain the news to employees, and Halligan and Spinner were sobbing.
I also heard that the scandal began when a whistleblower inside the company ratted out Halligan, Volpe, and Chernov to the general counsel or to a member of the board. I have not been able to find out if this is true, or who the whistleblower might be.
On October 9, 2015, the assistant U.S. attorney told my lawyer that the government did not plan to bring any charges related to the case. The AUSA would not say what her investigation had uncovered. I wasn’t sure whether to be relieved or disappointed. At first glance it might seem that since no charges were brought, nothing bad had been done to me. But the AUSA herself told me, during my interview, that the government might find evidence of illegal activity but decide not to invest resources to pursue the case.
Clearly, Volpe did something. Why else would the board of directors fire him? In November, four months after the news broke and a month after the feds told us they would not be pressing charges, I sent an email to Lorrie Norrington, a member of the HubSpot board of directors, asking if she would tell me what happened. Norrington is an independent director, meaning she does not work at HubSpot and does not represent one of the company’s big venture capital firms. She was also the only board member quoted in the press release. During my time at HubSpot I’d met her and liked her. In my email asking for an explanation, I told her I was concerned especially because Halligan had talked about “really aggressive tactics.” I hoped that perhaps out of the goodness of her heart she would tell me what had been done to me and what steps I should take to safeguard myself and my family. I heard nothing back.
The three characters caught up in the scandal have emerged unscathed. In August 2015 Chernov landed a job at a small start-up in Cambridge whose executives include former HubSpot employees. Chernov is the vice president of marketing. Halligan remains the CEO of HubSpot, and in September 2015, just weeks after the scandal broke and at a time when he was still being sanctioned by the directors, he gave a keynote speech at the Inbound conference in front of thousands of adoring customers.
Volpe for a few months went dark on social media, but on the day that my lawyer got word from the AUSA that no criminal charges would be filed, Volpe apparently got the same news. On October 9 he suddenly surfaced, posting on Twitter a photograph of the HubSpot executive team at the New York Stock Exchange, with this message: “One year ago today I was at @NYSE celebrating HubSpot IPO. Want to build Boston’s next pillar company? Hit me up.” In November he published a blog post announcing that he would be holding “open office hours” for Boston techies who wanted to talk to him and that he had latched on to a new cause: diversity. “Boston tech can’t grow into what it should be without more gender and ethnic diversity,” he wrote.
For the record: HubSpot’s sixteen-member management team contains two Indian guys—one of them is Shah, the co-founder—plus two white women and twelve white men. On the eight-member board, everyone besides Shah is white, and only two are female.
The biggest beneficiary of the scandal was Wingman. It was remarkable enough when he was promoted to vice president after Chernov was hired as a vice president and Cranium apparently didn’t want Wingman, his loyal sidekick, to be outranked by the new guy. Before joining HubSpot, Wingman worked as a social media manager—the guy who sends out tweets. Now he is a C-level executive at a publicly traded company with a $2 billion valuation. The mind reels.
As for me, the journey I’ve taken over the past three years is not what I imagined when I set out in 2012 to reinvent myself as a marketer. I don’t regret that I tried to start a new career or that I went to work for a tech company; I do regret that the company I chose was HubSpot. Even that wasn’t all bad. HubSpot shares went up after the IPO, and by the time I sold my options, I cleared about $60,000. Certainly back in 2012 I didn’t expect that I would end up writing for a popular TV comedy like Silicon Valley and spending part of my time in Los Angeles. I also didn’t expect to end up writing a book about being a fifty-something guy struggling to work with Millennials—because I honestly didn’t expect this would be such a struggle. I knew life at a start-up would be less structured than life at an eighty-year-old publishing company, but I really thought I could adapt. In the end, I found I wasn’t prepared for things like Fearless Friday and teddy bears being given a place of honor at the table during management meetings.
Certainly when I joined HubSpot I didn’t think I was going to work for bosses who would engage in activity that might be illegal, or on the verge, or that I would be the target of their actions. I also never imagined that a board of directors of a “radically transparent” company would refuse to tell the full story about what happened.
The board’s handling of the scandal raises serious questions about HubSpot’s corporate governance. HubSpot has three independent board members who do not represent venture capital firms. Each of them, however, holds shares in HubSpot worth millions of dollars. Instead of coming clean, the directors have released only a tiny amount of information, leaving huge questions unanswered.
HubSpot has vowed to develop a “Company-Wide Code of Business Conduct and Ethics training program.” That’s a good start, but not enough. The directors should share everything in the Goodwin Procter report, and not just with me but with their public shareholders. The board represents shareholders and is accountable to them, yet is denying them information. Investors who have put money into HubSpot are supposed to have a voice in how the company is run. They are asked, every year, to elect board members and to approve the compensation paid to management, among other things. How can HubSpot’s shareholders vote intelligently when the board withholds information from them?
Something happened that was so bad that the board fired a top executive. According to HubSpot’s press release, Halligan knew about the behavior and did not report it to the board. Shareholders are entitled to know more than this in order to decide whether he is fit to remain in place as the company’s CEO. What was Halligan’s role? What did he know, and when did he know it? Why did the board fire Volpe and consider firing Chernov, but not Halligan?
The irony to me is that taking the job at HubSpot has led me back to where I began—back to being a reporter and writer, trying to get to the bottom of a story. As I hit my deadline on this book I am still trying to get answers. In December 2015 I hired an attorney who filed a Freedom of Information Act request seeking the release of documents from the U.S. attorney’s office and FBI related to this case. I’m not sure this will work. I’ve been told it’s a long shot.
Meanwhile, I keep thinking about HubSpot’s customers, those thousands of people who attended the Inbound conference in September 2015 and cheered for Halligan, even though they knew about the scandal and the criminal investigation. You could not be a HubSpot zealot and be ignorant of Volpe’s firing, of Halligan being sanctioned, or that legal authorities had been notified.
/>
The customers didn’t care. Many of them truly love HubSpot and feel an almost religious devotion to the company. They’ve been swept up in HubSpot’s narrative about being lovable and magical and making the world a better place. The same goes for HubSpot’s employees. In December 2015 HubSpot was ranked fourth on a list of the top fifty places to work in the United States, based on an employee survey conducted by Glassdoor. Also near the top of the list was Zillow, the real estate website that has been sued by women claiming the company had an abusive, ageist, frat house culture. HubSpot scored higher than even Facebook and Google. A lot of its employees really, truly love the company and are happy there. I understand why. For the right kind of person, it’s a great place, with nice perks and a fun culture. Even former employees remain loyal to HubSpot and still love the company.
I had a different experience. Where others saw a fun place to work, I saw a place where “old people”—those over forty, and certainly people over fifty—were largely unwanted, and the company made no secret of it. I saw astonishing uniformity and groupthink, and an incredible lack of diversity, based not just on age but also on race, euphemized as “culture fit.” I saw poorly trained managers, haphazard oversight, and an organization that was out of control.
I know that HubSpot can be a fun place to work, that they put on an entertaining show at Inbound, and that at least some customers, maybe a lot of customers, derive real value from HubSpot’s software. But I fear that customers and employees are being naïve about the people they’re working for and doing business with. HubSpot has fifteen thousand customers. Those companies entrust their private data to HubSpot, things like emails, customer lists, pricing, and billing. HubSpot holds data not just about its own fifteen thousand customers but data from their customers as well. If your plumber or pool installer or local appliance store uses HubSpot software, HubSpot may be holding information about you, without you even knowing it.