13 ms·

We use GitLab self-hosted at my company so I've been following this for a while. My speculation is there's pressure for the C suite to push this Russia and Chi

We use GitLab self-hosted at my company so I've been following this for a while. My speculation is there's pressure for the C suite to push this Russia and China hiring ban for some reason. Looks like the board is telling the CEO this has to happen or they're in negotiation talks to be acquired by a big company like Google who wants this to happen now and the backlash to have passed by the time it's announced. So this will happen whether it's illegal or not (and it looks like it will and is illegal) but the risk will cost less than the reward. If they go to court they spend at most a few mil fighting it over the course of a few years and the executives walk away super rich anyway. If they don't go to court they walk away even more rich. But if they don't do it they might rely on an IPO that's looking shaky because of this bad decision making for the past 2 months. So even if it's illegal, it still makes sense to do this. It looks like an exit strategy because they will never be personally liable. She probably sees this and knows everything going on behind the scenes, but she won't walk away super rich from this but could lose her law license by engaging in discrimination.

AdministrativeA 7y ago
One other thought: in most companies, you just don't open an office there. Or you lock your data down. But they don't have the technical capability to monitor or restrict access to prod data (their VP said this). Because they're remote they can't just not open an office there so they have to restrict hiring to keep Chinese and Russians living in China and Russia out. Normally what would happen is you'd hire them but then not give them access to prod data (usually by saying it requires some background check or clearance you know they can't get) or when it's illegal not to give access, just lock the data down. The alternative is probably illegal, but it's the only one that GitLab has.
- deleted 7y ago
  [deleted]
- itronitron 7y ago
  There is no way that not granting an employee access to prod data can be illegal. That sort of access is a privilege not a right.
jahlove 7y ago
Is it actually illegal to pick and choose what countries you hire employees from? As a customer, I actually like this decision by Gitlab.
- AdministrativeA 7y ago
  For sure I totally see both points to this but from reading the discussion in the issues it looks like there are several very legitimate legal concerns the executives are ignoring to do this. From what I read her objections weren't specific to if this is good or bad for customers, but if it was legal or not. Seems like the legal concerns were just ignored and they decided to move forward without addressing them. I think she even outlines some steps for things they need to do if they plan to move forward but the executive team just rejected the advice completely.
  - jahlove 7y ago
    I went through her comments on this topic and found this [1], regarding her specific legal concerns: > Anticorruption laws prohibit agreements (oral or in writing) that discriminate based on various factors including nationality. The Export Administration Regulations (EAR) requires U.S. persons to "report quarterly requests they have received to take certain actions to comply with, further, or support an unsanctioned foreign boycott." So a customer simply asking to exclude a country that is not prohibited by law could potentially run afoul of the regulations (there are various caveats here but, regardless, we should not sell out diversity, inclusion and compliance for sake of profit). I should also note that under the 1976 Tax Reform Act (TRA), the behavior isn't prohibited but could result in a loss of tax benefits. [1] https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/32606#note_241770308 https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/...
    - Rapzid 7y ago
      So just claims without citations? I know government entities and certain government contractors can require no foreign nationals, and perhaps even non residents?, have access to their data. Requiring that people living in countries with no effective legal structuring in place preventing government coercion of residents not have access to data seems reasonable in certain contexts. Certainly more so for countries that are also adversarial. I'd be surprised to find out there were real legal obstacles to this. On the surface it looks like somebody trying to build a case for their personal stance on the situation. Is she their legal council? Was this run by legal council? "Legal has concerns" would have been a power play and I don't see that..
rhblake 7y ago
No need to speculate, it's right there in the GitLab issue. The now-resigned director of risk and global compliance Candice Ciresi wrote this six days ago [0]: "The countries selected were not chosen because of legal requirements, they were not chosen based on risk, they were not chosen based on political climate (as other countries are facing heightened sanctions from the US). I do hope they were not selected because a customer asked for it - or that could violate anti-boycott laws. In fact, having no objective basis for the restrictions is not conservative - it is careless. (Please let me know immediately if a customer has requested that we not do business with any particular country as that may be a reportable event.) I recommend against proceeding until you have developed a sound basis - that gets applied equally - for any exclusion of any country." To which VP of Engineering Eric Johnson replied: "I appreciate your position. Please be aware there is an active, time-sensitive contract negotiation linked to this matter. And you need to advocate to the DRI that the company walk away from that contract in order to enact your proposal." See also her further comments in [1]. [0] https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#note_237491303 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not... [1] https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#note_239078066 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...
- echelon 7y ago
  > "I appreciate your position. Please be aware there is an active, time-sensitive contract negotiation linked to this matter. And you need to advocate to the DRI that the company walk away from that contract in order to enact your proposal." Could this public backlash sink that deal?
- AdministrativeA 7y ago
  Thanks for putting that together, I do remember reading that exchange. I can't help but think this is more than just a single customer tho. I was talking to someone who told me offhand that this was actually decided on by the executive team and the customer didn't say ban hiring in Russia or China. The way they put it is the customers asked about people in Russia or China accessing their data and the executive team came up with this as a solution because they have no technical solution they can put together quickly. Looks like there's a lot more happening privately that we don't know about and is probably why she decided to resign.
netheril96 7y ago
> by a big company like Google who wants this to happen But Google does have offices in China now. In both Beijing and Shanghai.

AdministrativeA 7y ago

One other thought: in most companies, you just don't open an office there. Or you lock your data down. But they don't have the technical capability to monitor or restrict access to prod data (their VP said this). Because they're remote they can't just not open an office there so they have to restrict hiring to keep Chinese and Russians living in China and Russia out. Normally what would happen is you'd hire them but then not give them access to prod data (usually by saying it requires some background check or clearance you know they can't get) or when it's illegal not to give access, just lock the data down. The alternative is probably illegal, but it's the only one that GitLab has.

deleted 7y ago
[deleted]
itronitron 7y ago
There is no way that not granting an employee access to prod data can be illegal. That sort of access is a privilege not a right.

jahlove 7y ago

Is it actually illegal to pick and choose what countries you hire employees from? As a customer, I actually like this decision by Gitlab.

AdministrativeA 7y ago
For sure I totally see both points to this but from reading the discussion in the issues it looks like there are several very legitimate legal concerns the executives are ignoring to do this. From what I read her objections weren't specific to if this is good or bad for customers, but if it was legal or not. Seems like the legal concerns were just ignored and they decided to move forward without addressing them. I think she even outlines some steps for things they need to do if they plan to move forward but the executive team just rejected the advice completely.
- jahlove 7y ago
  I went through her comments on this topic and found this [1], regarding her specific legal concerns: > Anticorruption laws prohibit agreements (oral or in writing) that discriminate based on various factors including nationality. The Export Administration Regulations (EAR) requires U.S. persons to "report quarterly requests they have received to take certain actions to comply with, further, or support an unsanctioned foreign boycott." So a customer simply asking to exclude a country that is not prohibited by law could potentially run afoul of the regulations (there are various caveats here but, regardless, we should not sell out diversity, inclusion and compliance for sake of profit). I should also note that under the 1976 Tax Reform Act (TRA), the behavior isn't prohibited but could result in a loss of tax benefits. [1] https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/32606#note_241770308 https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/...
  - Rapzid 7y ago
    So just claims without citations? I know government entities and certain government contractors can require no foreign nationals, and perhaps even non residents?, have access to their data. Requiring that people living in countries with no effective legal structuring in place preventing government coercion of residents not have access to data seems reasonable in certain contexts. Certainly more so for countries that are also adversarial. I'd be surprised to find out there were real legal obstacles to this. On the surface it looks like somebody trying to build a case for their personal stance on the situation. Is she their legal council? Was this run by legal council? "Legal has concerns" would have been a power play and I don't see that..

rhblake 7y ago

No need to speculate, it's right there in the GitLab issue. The now-resigned director of risk and global compliance Candice Ciresi wrote this six days ago [0]: "The countries selected were not chosen because of legal requirements, they were not chosen based on risk, they were not chosen based on political climate (as other countries are facing heightened sanctions from the US). I do hope they were not selected because a customer asked for it - or that could violate anti-boycott laws. In fact, having no objective basis for the restrictions is not conservative - it is careless. (Please let me know immediately if a customer has requested that we not do business with any particular country as that may be a reportable event.) I recommend against proceeding until you have developed a sound basis - that gets applied equally - for any exclusion of any country." To which VP of Engineering Eric Johnson replied: "I appreciate your position. Please be aware there is an active, time-sensitive contract negotiation linked to this matter. And you need to advocate to the DRI that the company walk away from that contract in order to enact your proposal." See also her further comments in [1]. [0] https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#note_237491303 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not... [1] https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#note_239078066 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555#not...

echelon 7y ago
> "I appreciate your position. Please be aware there is an active, time-sensitive contract negotiation linked to this matter. And you need to advocate to the DRI that the company walk away from that contract in order to enact your proposal." Could this public backlash sink that deal?
AdministrativeA 7y ago
Thanks for putting that together, I do remember reading that exchange. I can't help but think this is more than just a single customer tho. I was talking to someone who told me offhand that this was actually decided on by the executive team and the customer didn't say ban hiring in Russia or China. The way they put it is the customers asked about people in Russia or China accessing their data and the executive team came up with this as a solution because they have no technical solution they can put together quickly. Looks like there's a lot more happening privately that we don't know about and is probably why she decided to resign.

netheril96 7y ago

> by a big company like Google who wants this to happen But Google does have offices in China now. In both Beijing and Shanghai.