Technology

For four years, Edhuar Arellano has left his house at 7 a.m. on weekdays to drive customers around the Bay Area for Lyft and Uber . Most days, he doesn&t get home to Santa Clara until 11 p.m. On weekends, he delivers pizzas to make ends meet.

Like a lot of drivers plugging in to ride-hailing apps for work, he likes the flexibility the gig economy has offered. But given the choice, Arellano says he wishes he could just become an employee. That would get him paid vacation, benefits, overtime, his own health insurance and perhaps more say over his working conditions.

&We need to accept whatever they want,& said the 55-year-old father of two grown children. &I can&t control anything.&

That quandary is behind a ferocious battle quietly playing out in the state Capitol in the final days of the legislative session, which ends August 31. Lobbyists for ridesharing companies and the California Chamber of Commerce are scrambling to delay until next year (and the next governoradministration) a far-reaching California Supreme Court decision that could grant Arellanowish — and, businesses fear, undermine the entire gig economy.

The April ruling, involving the nationwide delivery company Dynamex Operations West Inc. and its contract drivers, established a new test for enforcement of California wage laws, and made it much harder for companies in California to claim that independent contractors are not actually employees.

Though the ruling only applies to California, the statelabor force is so huge that it has already had national impact. Shortly after the decision, U.S. Senator Bernie Sanders of Vermont introduced a bill to make a version of Californianew rule the federal standard, a move that only added urgency to employers& calls for state lawmakers to hit the pause button on implementing the ruling.

&Businesses are very concerned. The key is whogoing to be sued here in the near future,& said Allan Zaremberg, president of the California Chamber, which represents 50,000 businesses.

They should be, says labor leader Caitlin Vega, who has been similarly lobbying Capitol Democrats to refrain from meddling and let the Supreme Court decision move forward.

&Companies have made so much money already at the expense of workers,& Vega, the legislative director of the California Labor Federation, said Tuesday during a harried break between Capitol meetings. &We really see the Dynamex decision as core to rebuilding the middle class.&

State and federal labor laws give employees a wide range of worker protections, from overtime pay and minimum wages to the right to unionize. But those rights don&t extend to independent contractors, whose ranks have grown dramatically in the gig economy.

Apps such as Uber, TaskRabbit and DoorDash, which match customers and services online and in real time, have given workers an unprecedented ability to freelance but they also have blurred traditional employer-employee relationships and, labor advocates say, invited exploitation.

Some 2 million people, from Lyft drivers to construction workers, consider themselves independent contractors in California. In 2017, according to the Bureau of Labor Statistics, about one in 14 workers was an independent contractor nationally.

If state lawmakers don&t rewrite the law or stall its implementation for a few months, as businesses want — which the Legislature can legally do, though the clock is ticking — the Dynamex decision will subject businesses in California to a standard that is tougher than the federal governmentor most states&.

Known as the &ABC test,& the standard requires companies to prove that people working for them as independent contractors are:

• A) Free from the companycontrol when they&re on the job;
• B) Doing work that falls outside the companynormal business;
• C) And operating an independent business or trade beyond the job for which they were hired.

Thata high bar for the many companies whose bottom lines have depended on large numbers of contractors to deliver a particular service. According to the business lobby, in the months since the Dynamex decision, law firms have received 1,200 demands for arbitration and 17 class action lawsuits.

Last month, business leaders sent a letter to members of Gov. Jerry Brownadministration, warning that the new test would &decimate businesses,& and urging the governor and Legislature to suspend and then limit the courtruling to only workers involved in the Dynamex case. The letter also asked that the decision not apply to other contractors for the next two years.

Not all those contractors are in tech, Chamber head Zaremberg points out. Emergency room doctors and accountants, for example, could also be impacted. Emergency hospitals and trauma centers contract their doctors through medical groups, and doctors generally work at a combination of hospitals and community clinics.

Photo: shapecharge / iStock / Getty Images Plus

Dr. Aimee Mullen, president of the California chapter of American College of Emergency Physicians, confirms that ER docs are among those uncertain about their contractor status.

&A lot of our members use that model. Itchoice. They like flexibility. They like working at multiple hospitals,& Mullen said.

The California Labor FederationVega contends that, disruptive though it may be, the Dynamex ruling is the right one, particularly on worker exploitation. The core group affected tends to be low-income and immigrant workers, she said.

&The Dynamex decision was a victory for working people — truck drivers who are cheated out of wages, warehouse workers forced to risk their health and gig economy workers who want to be treated with dignity and respect,& Vega wrote in a Sacramento Bee op-ed.

Some workers see room for hybrid solutions. Edward Escobar, a San Francisco ride-hail driver of four years and founder of the Alliance for Independent Workers, a group formed by drivers three years ago, says he has seen a big decrease in how much these companies compensate drivers without a commensurate increase in control over working conditions.

Escobar believes gig companies are trying to have it both ways, and should give their workers either true independence or full employment. His proposal: Let workers choose their own classification, with wage and benefit protection for those who choose to be employees, and more control for contractors over which rides to take and what prices to set.

&These tech titans have been taking advantage of these gray areas,& Escobar said.

Assembly Speaker Anthony Rendon, a Paramount Democrat, said earlier this month that while the Legislature is eager to delve into workforce issues, leaders do not have adequate time to act on it before the session ends next week.

&The Dynamex​ decision strikes at the core of what the future of work looks like in our society,& Rendon said in a statement. &From the decline of union membership to court rulings like the Janus decision, we&ve seen the continual erosion of workers& rights. If the Legislature is to take action, we must do so thoughtfully with that in mind. That will not happen in the last three weeks of the legislative session.&

Nor are the stakes likely to be lowered for workers like Arellano.

&If I don&t work, I have no money,& said the Lyft and Uber driver. &Everything is so expensive in Santa Clara and the Bay Area.&

CALmatters.org is a nonprofit, nonpartisan media venture explaining California policies and politics.

So much for summer Fridays. Yesterday, BuzzFeed reported that a dozen tech companies, including Facebook, Google, Microsoft and Snapchat, would meet at Twitter headquarters on Friday to discuss election security. For two of them, that wasn&t the only meeting in the books.

In what appears to be a separate event on Friday, Facebook and Microsoft also met with the Department of Homeland Security, the FBI and two bodies of state election officials, the National Association of State Election Directors (NASED) and the National Association of Secretaries of State (NASS), about their election security efforts.

The discussion was the second of its kind connecting DHS, Facebook and state election officials on &actions being taken to combat malicious interference operations.& The meetings offer two very different perspectives on threats to election security. States are largely concerned with securing voter databases and election systems, while private tech companies are waging a very public war against coordinated disinformation campaigns by U.S. foreign adversaries on their platforms. Social media platforms and election systems themselves are two important yet usually disconnected fronts in the ongoing war against Russian election interference.

&Effectively combatting coordinated information operations requires many parts of society working together, which is why Facebook believes so strongly in the need for collaboration between law enforcement, government agencies, security experts and other companies to confront these growing threats,& Facebook VP of Public Policy Kevin Martin said of the meeting.

&We are grateful for the opportunity to brief state election officials on a recent call convened by DHS and again today as part of our continued effort to develop collaborative relationships between government and private industry.&

Curiously, while Microsoft and Facebook attended the DHS-hosted meeting, it doesn&t look like Twitter did. To date, Twitter and Facebook have faced the most fallout for foreign interference on their platforms meant to influence American politics, though Google was also called to Congress to testify on the issue last fall. When reached, Twitter declined to comment on its absence, though the company was reportedly playing host to the other major tech election security meeting today.

The meeting with state officials sounds like it was largely informative in nature, with Facebook and Microsoft providing insight on their respective efforts to contain foreign threats to election integrity. On Tuesday, Microsoft revealed that its Digital Crimes Unit secured a court order to take down six domains created by RussiaGRU designed to phish user credentials. Half of the phishing domains were fake versions of U.S. Senate websites.

&No one organization, department or individual can solve this issue alone, thatwhy information sharing is so important,&said Microsoft VP of Customer Security and TrustTom Burt. &To really be successful in defending democracy, technology companies, government, civil society, the academic community and researchers need to come together and partner in new and meaningful ways.&

For the second time this week, U.K. phone giant EE has fixed a security lapse, which allowed a security researcher to gain access to an internal site.

The researcher, who goes by the pseudonym Six, found the companyinternal training site indexed on Google. (We&re not linking to the page as it remains an active site.) Although the site required an employee username and password to log in, the researcher found that an &admin& account existed, of which anyone with the answer to the secret question could reset the password.

It turns out that secret question could have been stronger.

&What is your eye color,& the researcher told TechCrunch. &I tried loads of colors and they all give an error,& he said. &The answer was simply ‘brown,'& he said.

From there, he gained access to the entire internal training site.

EE is the largest phone network in the U.K. with more than 30 million users.

TechCrunch reported the security lapse to the company on Wednesday. A spokesperson for EE said a fixwas implemented early Thursday, and thanked the researcher.

&This account has now been disabled and we have also changed the password and security question for the account,& said a spokesperson. &No customer data is, or has been, at risk as the user account on the training website only gave access to a dummy environment with fake accounts.&

But the researcher disputed part of EEresponse, accusing the company of downplaying the security incident.

The researcher shared several screenshots with TechCrunch of the site. According to the sitelogin page, the portal is the &home of training& for all EE staff. Employees are given access in the first week of their start date, and can access the site for the first time with a password which is their &surname all in lower case.&

Some screenshots showed dummy data, but others showed course content and employee knowledge base resources. He said that he had access to training on linked organizations, including Orange and Plusnet.

Although the researcher found no employee or customer data, he said the admin account allowed him to grant himself &any permissions& he wanted, and change the access of any other group of users, he said.

&I didn&t do any of that because of the law, but that doesn&t mean a malicious attacker couldn&t have done it,& he said.

Earlier this week, EE fixed a vulnerability that allowed customers to gift their own or linked accounts unlimited data for free. The company fixed the bug within two days.