Utah Wants To Kill Zenefits For Giving Away HR Software For Free

from the no-disruption-allowed dept

Another day, another example of regulators protecting legacy businesses and trying to shut down quite useful disruptive innovations. Zenefits is an incredibly fast growing company that has become the rather de facto standard for HR software for startups in Silicon Valley. Part of the key? It gives away the software for free -- software that, from competitors, costs quite a lot (to the point that many startups don't adopt HR software until much later in their lifecycle). A great NY Times profile from a few months ago detailed the rise of Zenefits and how its business model developed. In short, Zenefits had started building some online HR software, and was trying to figure out a business model, when it realized that it could give away the software for free and just get commissions by also acting as an insurance broker. The full story is much longer (and fascinating), but here's a snippet from that profile:

When businesses buy health coverage for their workers, they often go through brokers, who play the role that travel agents once did for the airlines. They are middlemen who figure out the best fit between buyers and sellers of health care, then take a percentage of the sale. And the commissions can be quite hefty. After connecting a small business with a health care provider, a broker collects a monthly fee of about 4 to 8 percent of a company’s health premiums.

The commission rates are set by care providers and aren’t usually disclosed to the small-business purchasers. But the fees amount to several hundred dollars or more per employee annually, and they generally continue for as long as a business keeps its health coverage. The broker collects the monthly fee from the care provider even if the business never talks to its broker again.

“I was thinking, wait a minute, that is a ton of money, and these guys don’t do very much for it,” Mr. Conrad said. This presented an obvious business model for Zenefits. It would become a broker itself. Thanks to the Affordable Care Act, health insurance providers now publish set rates. This meant that Zenefits could offer brokerage online, letting small businesses buy health insurance pretty much the same way people shop for airline tickets.

From there, the "software" just became a hook and a selling point. Yes, it's still the core of the actual "business," but it's just an insanely effective promotion for the insurance brokerage part, which the company has also made super simple. Businesses pay the same exact price they would normally pay for their health insurance -- but they get this great HR software as part of the deal (and Zenefits collects the commissions that traditional insurance brokers would have collected for doing much, much less). Of course, as the article also notes, it's not easy to become a brokerage, but Zenefits put in all of the effort to become a registered insurance broker in various states to make this work -- and it's made the company grow like gangbusters.

And... of course, traditional insurance brokers absolutely hate it. The NY Times article noted that brokers have complained to regulators in four states, including Utah. And that brings us to the latest story. While the investigations in Texas and Washington went nowhere, in Utah, the Utah Insurance Department -- which is run by a former insurance broker named Todd Kiser (founder of Kiser Insurance Agency) -- has told the company that it has violated a bunch of rules for daring to give its software away for free. Specifically, the Insurance Department calls out [pdf] the fact that the free software somehow violates rules against "inducements" or "rebates" for insurance.

The full letter is an astounding example of regulations designed to protect incumbents over innovators. First it attacks the use of free software, despite the fact that the end result is better for companies:

Zenefits' providing free software use of its electronic platform and dashboard violates Utah's inducement and indirect rebate insurance laws. By Zenefits offering clients the free use of its electronic platform and dashboard, by which employers can control and coordinate payroll functions and manage tax-related elections; generate tax forms; access FSA, HSA, and accounts; and administer 401k retirement savings plans and stock options; Zenefits has created a significant free inducement for clients to purchase insurance products through Zenefits. This software use is neither part of the insurance contract nor directly related to the insurance contract. Also, Zenefits connecting of the various HR benefits and insurance together creates advantages for customers to have a single internet access site to manage all HR and insurance needs; however, again, because Zenefits does all of this for free, it creates an violating inducement and indirect rebate for clients to purchase insurance through Zenefits.

Nowhere does the Insurance Department appear to recognize that it's basically saying "offering a better product is illegal." Instead, later in the document, it flat out admits that its goal here is to protect the legacy players who didn't innovate:

Concerning Utah's insurance public policy and State interest, the Utah Insurance Department has the important responsibility to maintain a fair, competitive insurance business environment for all licensees. Some of the main purposes of the Utah Insurance Code are to ensure not only that insurance consumers are protected and treated fairly, but that licensees are also treated fairly within a financially healthy and adequate insurance market that is not only characterized by innovation, but also by fair conditions of competition for all insurance licensees. See Utah Code Sec. 31A-1-102. For these reasons, Utah's specific unfair inducement and rebating laws are strongly enforced.

In short, disrupting the old way of doing business is illegal, because the non-innovators can't keep up. The Utah Insurance Department further makes it clear that innovation that offers a better solution for companies who buy insurance is flat out not allowed under Utah law:

Insurance Department Bulletin 2010-7 emphasizes that a licensee that provides a benefit that is not specified in an insurance contract offered to an insured or potential insured is a violation of state law. This includes offering benefits not specified in the insurance contract at no cost or at a cost below fair market value. Also explained is the fact that providing other value added services not specified in an insurance contract are also insurance violations.

In short: offering insurance buyers a better deal is illegal. The state then says it will fine Zenefits and that the company needs to stop "violating" these rules, and instead come up with a "compliance plan." Of course, for Zenefits, the only really sensible solution is to not do business in Utah, meaning that Utah-based businesses are objectively (and significantly) worse off. That's crazy -- but it's the sort of ridiculous regulatory attacks presented to disruptive businesses all too frequently.

Filed Under: competition, disruptive innovation, incentives, innovation, insurance, rebates, regulations, todd kiser, utah, utah insurance department
Companies: zenefits

LG/Netflix Rebate Site Exposes User Data With AT&T-Esque Hole [Updated]

from the self-hacking? dept

[Update: hole has been closed by ACB's IT team]

The Computer Fraud and Abuse Act is so severely flawed that people are extremely hesitant to report security holes in websites, especially after witnessing what happened to Weev (Andrew Auernheimer), who went to jail for exposing a flaw in AT&T's site that exposed user info when values in the URL were incremented.

The same goes here with this submission from an anonymous Techdirt reader who added this note, along with a link to a post in the Computer Security subreddit.

"I remember a person was recently arrested for finding this same flaw in a website and told (at&t/apple??) about it. He was arrested and jailed if I remember right. This is the type of chilling effects that come when people view techies as hackers and are arrested for pointing out flaws.

The flaw is in:

http://www.acbincentives.com/lgnetflix/claimdetails.asp?txtclaimnum=30345

By changing the number at the end you can harvest personal info.

I won't report the flaw, I could go to jail."

Is that overdramatic? Doubtful. People have reported security flaws to companies only to have these entities press charges, file lawsuits or otherwise tell them to shut up. Weev's only out because the government's case was brought in the wrong venue. The CFAA, which has been used to punish many helpful people, is still intact and as awful as ever.

As the (also anonymous) redditor points out, he or she has tried to contact the company but has found no avenue to address this security hole which exposes names, addresses and email addresses of customers sending in claims for a free year of Netflix streaming that came bundled with their purchase of an LG Smart TV. Incrementing the digits at the end of the URL brings up other claims, some with images of receipts attached. In addition, anyone can upload support documents to these claims.

Here's a screenshot of the hole in question:


As the original poster points out, with a little coding, someone could put together a database of addresses that most likely house a brand new LG Smart TV. And this may not just be limited to LG. ACB Incentives is the company behind this promotion, and it handles the same sort of online rebate forms for a variety of companies. These rebate submission sites all branch off acbincentives.com, which could mean it's just a matter of figuring out how each one handles submitted claims, URL-wise.

Now, I've contacted the company to let them know. Amanda Phelps at the Memphis branch says she's bringing it to the attention of programming. I also let her know that it may affect other rebate pages but that I can't confirm that. We'll see how quickly this is closed*, but all in all, the people at ACB seemed to be concerned and helpful, rather than suspcious.

*Very quickly, it appears. See note at top of post.

But the underlying point remains. Many people who discover these flaws aren't criminals and aren't looking to expose the data of thousands of unsuspecting users. They're simply concerned that this is happening and often incredulous that major companies would be this careless with customers' data. That the kneejerk reaction has often been to shoot the messenger definitely gives those discovering these holes second thoughts as to reporting them, a hesitation that could allow someone with more nefarious aims to exploit the exposed data. The law needs to change, and so does the attitude that anyone discovering a flaw must be some sort of evil hacker -- or that the entity must do whatever it takes, even if it means throwing the CFAA at someone, just to prevent a little embarrassment.

Filed Under: cfaa, cybersecurity, promotions, rebates, security, security hole, user data
Companies: acb incentives, lg

DailyDirt: Tuition Debt Is For Chumps?

from the urls-we-dig-up dept

Crowds of students are graduating (or have just graduated) from college, and they might be a little nervous about how they're going to pay off their student loans. Student debt can be difficult to pay off, so some folks are trying to avoid it completely in a few novel ways. Here are a bunch of examples of students getting financially creative with their tuition bills.

• In 2011, Richard Linder got a college degree from Excelsior College for about $3,000 -- without attending any classes in person. Excelsior doesn't require graduating students to have taken any of its own courses, so Linder transferred credits (many of them free) from a variety of online classes. [url]
• Ken Ilgunas went to grad school at Duke and lived frugally in his van because he didn't want to get into debt again after paying off his undergrad loans. Ilgunas showered in the school's gym facilities, bummed electricity and internet from the libraries, and wrote a book (Walden on Wheels) about his lifestyle. [url]
• Jonathan Hood paid for his graduate education at Auburn University with a TON of mail-in rebate offers. Buying stuff, redeeming the rebates and then eBaying the stuff... it takes a lot of time, but he wrote some automation software to help him keep track of all of it (and he'll likely be able to sell that someday, too). [url]

If you'd like to read more awesome and interesting stuff, check out this unrelated (but not entirely random!) Techdirt post via StumbleUpon.

Filed Under: degree, graduate school, jonathan hood, ken ilgunas, rebates, richard linder, student debt, student loans, tuition
Companies: duke, ebay, excelsior college

Tech Company That Junked Unopened Rebate Claims Pays $10k In Fines

from the isn't-that-where-rebates-belong? dept

It's no secret that most people hate rebate programs. They're a pain to deal with, so many people don't even send in the rebate forms -- and then, the various companies that receive them often go out of their way to find reasons to reject them. However, a tech company in San Jose named Vastech went a bit further than that. Rather than coming up with ways to void the rebates, it was caught having thrown over a thousand unopened rebate claims into the garbage. The company has now paid up on all the rebates that it had junked and has agreed to pay a $10,000 fine on top of that. To be honest, that seems rather low for deceiving the public.

Filed Under: fines, rebates
Companies: vastech