Uber Survived the Spying Scandal. Their Careers Didn’t.

The men who gathered intelligence for Uber were supposed to be ghosts. For years, they were un-Googleable sentries, quietly informing executives about the actions of competitors, opponents and disgruntled employees. But the secrecy of the tightknit team ended abruptly in 2017 when one of its members turned on the others, accusing them of stealing trade secrets, wiretapping and destroying evidence.

They flouted the law while carrying out Uber’s dirtiest missions, their former co-worker, Richard Jacobs, claimed in an April 2017 email sent to top Uber executives. His lawyer followed up with a letter that said the team went so far as to hack foreign governments and wiretap Uber’s own employees.

But Mr. Jacobs’s most damning allegations of illegal activity were not true. In June, nearly four years after his claims drew wide attention, he retracted them. In a letter to his former co-workers that he wrote as part of a legal settlement, Mr. Jacobs explained that he had never intended to suggest that they broke the law.

“I am sorry,” he wrote. “I regret not having clarified the statements at an earlier time and regret any distress or injury my statements may have caused.” Gary Bostwick, a lawyer for Mr. Jacobs, declined to comment.

The story Mr. Jacobs told, and the years it took to unravel, were entwined with Uber’s terrible reputation. In the months before his story emerged, the ride-hailing company had been accused of permitting rampant workplace harassment, mishandling medical records and concealing data breaches.

It seemed to make sense to people that Uber was also spying and stealing. The company thrived and fell in an economy fueled by perception. After its year of relentless scandals, Uber hired a new chief executive with a do-gooder persona, cleaned house and began publicly reporting data about sexual assaults on its rides, a signal that the company would no longer cover up misconduct. Although Uber has yet to turn a profit, it has trimmed losses in recent years and reported $4.8 billion in revenue in the most recent quarter.

An Uber spokesman declined to comment on what Mr. Jacobs claimed and then retracted — and how those claims reverberated for the people involved.

In the end, Uber’s troubled reputation stuck more firmly to its employees than to the company itself. This account is drawn from hundreds of pages of documents in lawsuits connected to the incident and conversations with some of the men involved, who are speaking about that chapter in their career and its aftermath for the first time.

Mr. Jacobs’s former teammates said they still faced uncomfortable questions from friends, family and potential employers about their past. While Uber regained trust, they didn’t. The men constantly worried about the next time someone — a new co-worker, their children — Googled them.

Laptops instead of firearms

On a sunny spring Friday in 2016, Nick Gicinto walked out of a secure Central Intelligence Agency facility in suburban Virginia for the last time.

It was a bittersweet departure. Mr. Gicinto had worked at the agency for more than a decade, traveling around the world and honing his ability to cultivate sources and collect information. His wife also worked for the government, but their careers created a strain on the family. Mr. Gicinto regularly missed his son’s birthdays and wanted to be home more often.

The next Monday, he arrived at Uber’s offices in Washington, D.C. There were no security guards, no metal detectors. Mr. Gicinto could walk straight onto the elevator and into the office, a sprawling space with fishbowl conference rooms and a seemingly endless array of free snacks.

“It was over to your desk and off to the races,” Mr. Gicinto recalled, a stark contrast to the rigid environment he had left at the C.I.A. There was just one moment of discomfort, when Mr. Gicinto had to pose for a picture for his employee badge — it was the first time he had been photographed in quite a while.

That year, Uber was expanding aggressively into foreign markets. The pushback was swift and sometimes violent. Taxi drivers staged widespread protests, and in Nairobi, Kenya, several Uber cars were lit on fire and drivers were beaten. Competitors in China and India used sophisticated methods to collect Uber’s data and undercut its prices.

To fight back, Uber began to recruit a team of former C.I.A. officers like Mr. Gicinto, law enforcement officials and cybersecurity experts. The team would gather intelligence about threats against Uber drivers and executives, and investigate competing companies and potential acquisitions.

“They didn’t know what was going on, on the ground,” Mr. Gicinto said. “They recognized that they needed somebody who understood the human aspect of these things and understood foreign environments.”

Hiring from the intelligence community is a longstanding practice for tech companies, according to Margaret O’Mara, a history professor at the University of Washington in Seattle and the author of “The Code: Silicon Valley and the Remaking of America.”

The semiconductor firms from which Silicon Valley derives its name established the tradecraft for the firms that followed them. They were hypercompetitive and paranoid about trade secret theft, and often hired former intelligence and law enforcement personnel to protect their intellectual property.

“Security and secrecy have always been an important part of Silicon Valley’s nature because it’s a highly competitive industry,” Ms. O’Mara said.

In addition to Uber’s recruitment from the C.I.A., Google, Facebook and Amazon poached hackers from the National Security Agency to fend off cyberattacks, former Federal Bureau of Investigation agents to staff teams responsible for fielding law enforcement requests and former Pentagon officials to advise on defense contracts.

Image-conscious Silicon Valley executives were often reluctant to discuss where the hires came from, and keen to avoid criticism that they were employing the same intelligence gathering techniques the government used. Still, executives were eager consumers of the skills these employees could provide.

Mr. Gicinto said he had believed that he would lead Uber’s new intelligence team. But on his first day at Uber, he met Mr. Jacobs, who according to court filings was a former Defense Intelligence Agency officer who had worked on counternarcotics operations in Colombia and supported Special Operations forces during the Iraq war. The two men would share the responsibility, they learned, and report to Mat Henley, a cybersecurity executive who had investigated fraudsters for eBay and child predators for Facebook before joining Uber.

The relationship was tense, Mr. Gicinto recalled, and both men seemed uneasy about sharing leadership.

Still, their work ramped up quickly. The group, which grew to include dozens of employees, wanted to keep track of Uber’s competitors overseas, whether they were taxi drivers or executives at the Chinese ride-hailing firm Didi. But they also needed to protect their own executives from surveillance, and fend off web-scraping operations, which used automated systems to collect information about Uber’s pricing and driver supply.

It was an overwhelming task. To keep up, the team outsourced some of the projects to intelligence firms, which sent contractors to infiltrate driver protests. Other work was done in house, as Uber built its own scraping system to gather large amounts of competitor data. Scraping public data is legal, but the law limits the use of such data for commercial purposes.

The team rushed to hire more staff, and Mr. Gicinto recruited people he knew from his time at the C.I.A.: a fellow agent, Ed Russo, and Jake Nocon, a former agent for the Naval Criminal Investigative Service, who met Mr. Gicinto when they worked at the Joint Terrorism Task Force in San Diego.

When Jean Liu, Didi’s chief executive, visited the Bay Area, Uber had her tailed. And when Travis Kalanick, Uber’s chief executive at the time, traveled to Beijing, employees tried to throw off Didi’s surveillance teams, shuttling Mr. Kalanick’s phones to other hotels so his location would ping in a place he wasn’t.

“To us, every bit of this was this game of helping our executives carry out their meetings without divulging who they were meeting,” Mr. Henley, who led Uber’s global threat operations, said. “And it was super fun, right? It was a cat-and-mouse game going back and forth.”

The team’s reliance on intelligence contractors often caused trouble. A contractor trailed Ms. Liu during a conference at a hotel in San Francisco, snapping photos. The contractor was sitting at a table in the hotel lobby when members of Ms. Liu’s entourage sat down next to him. Spotting an opportunity, he recorded their conversation and sent his findings to Uber headquarters.

“When I received it, I sent it to Uber Legal and said: ‘We just got this. What we do with it?’” Mr. Gicinto said. The audio was choppy and filled with background noise. “It brought no value to us.”

While trying to maintain their frenzied pace, Mr. Gicinto, Mr. Nocon and Mr. Russo were also adapting to the culture shock of being plucked from government work and plunged into a growing tech company. The excesses that tech workers took for granted — the endless catering, the nap pods, the glitzy offices — were a stark departure from their old jobs. And the men were objects of curiosity for their co-workers.

“We were definitely looked at as a bit of an anomaly,” Mr. Nocon said. In one staff meeting, he recalled, a co-worker remarked on the difference, saying that while many employees had toted laptops throughout their careers, Mr. Nocon had carried a firearm instead.

The work itself felt entirely familiar. “I didn’t spend that much time thinking about it, like, ‘Is this weird to be doing this for a tech company?’” Mr. Nocon said. “This just feels like I’m doing what I received training to do.

“The end purpose in this is really kind of similar to the end purpose of doing surveillance operations for law enforcement,” he continued. “You’re trying to get an understanding of something that you can’t get off the internet.”

Mr. Jacobs, who also came from a law enforcement background, seemed to think the work was unusual. The recording of Ms. Liu in mid-2016 stuck in his mind, and eventually made its way into the letter his lawyer sent to Uber executives nearly a year later.

She had been recorded in a public place, which the law allows. But, according to his email and his lawyer’s letter, Mr. Jacobs believed that his co-workers who supervised the surveillance had crossed a line.

The golden route

Despite the intelligence team’s efforts to keep tabs on Didi, the rival continued to pull ahead in China, and by August 2016, Uber was ready to surrender. Uber sold its Chinese business to Didi in exchange for a stake in the company. That same month, Uber made another big change: It acquired Otto, a self-driving truck start-up founded by former Google executives.

The acquisition triggered alarm at Google. Executives there believed that Otto’s founders had walked out the door of Google with crucial documents about how its Waymo self-driving cars were built, and had relentlessly poached key employees after their departure. Now, those employees and documents were flowing into Uber, the Google executives believed.

Uber already had a unit of engineers working to develop autonomous vehicles, but Mr. Kalanick believed that acquiring Otto would accelerate Uber’s plans. He imagined a future in which Uber passengers would be transported by self-driving cars instead of human drivers, but the market was flooded with other companies chasing similar dreams.

To woo investors, the autonomous companies developed what they called “golden routes” — routes on which their cars could reliably drive without encountering major problems. Visiting venture capitalists would go for test rides along a golden route while deciding whether or not to invest.

With the overseas work ending, the intelligence team began filming competitors’ vehicles as they navigated their golden routes.It recorded Waymo’s vehicles on those routes in Arizona and staked out Uber’s own routes in San Francisco and Pittsburgh to look for spies.

“The work that we did out there didn’t feel like tech work,” Mr. Nocon said of his time in Arizona. “That was just the work that I’d been accustomed to doing for years, working for the government, just observing things from public places.”

In February 2017, Uber faced a reputational reckoning. Users who objected to the company’s labor practices had launched a mass campaign calling on people to delete Uber’s app. A former employee, Susan Fowler, went public about her experiences with sexual harassment at Uber, opening an avenue for other employees to speak up about harassment within the company. Weeks after Ms. Fowler’s revelations, Waymo sued Uber, accusing it of trade secret theft. (Ms. Fowler would later work as an Opinion editor for The New York Times.)

Things weren’t going well on the intelligence team, either. Mr. Jacobs and other employees repeatedly clashed, so Mr. Henley stripped him of his managerial duties and assigned him to report to Mr. Gicinto, according to Mr. Henley and legal documents from Mr. Jacobs and his former co-workers.

In April, Mr. Henley said, he received word that Mr. Jacobs was transferring confidential documents to his personal email account and decided to fire him. In the 2017 letter, Mr. Jacobs’s lawyer at the time, Clayton Halunen, said Mr. Jacobs had been demoted in retaliation for raising concerns about the group’s surveillance work. Mr. Halunen did not respond to a request for comment.

After human resources scheduled a meeting with Mr. Jacobs, he emailed his resignation to Mr. Kalanick and other top Uber executives, claiming his team was “engaging in illegal and unethical practices including hacking, impersonating, defrauding, stealing trade secrets and wiretapping Uber’s competitors, opposition groups and the company’s own employees.”

Mr. Jacobs said in the email that Mr. Gicinto had orchestrated the illegal activities, and his lawyer followed up with a 37-page letter that detailed his allegations of illegal behavior and named Mr. Russo, Mr. Nocon and Mr. Henley.

It was the first hint of yet another scandal, one the company could not afford.

‘Character assassination for cash’

“Everything went off the rails,” Mr. Henley said. Uber hired a law firm, WilmerHale, to investigate Mr. Jacobs’s claims. At the same time, the Waymo lawsuit loomed, and Uber stopped trying to gather intelligence about its autonomous-car competitors. The team’s focus shifted yet again, and members were tasked with internal investigations, looking into fraud on Uber’s platform and media leaks by employees.

Mr. Jacobs’s allegations went unmentioned in the office, but the men knew they were being investigated. “We just start hearing about people getting pulled in to be interviewed,” Mr. Henley said.

Some of the things Mr. Jacobs raised in the letter were true — Ms. Liu, the Didi executive, was followed and photographed, and the team filmed Waymo’s vehicles and scraped competitors’ apps to collect pricing information. But some of his alarming claims of lawbreaking were false, Mr. Jacobs acknowledged this year in his letter to his former co-workers.

“When I wrote the email, I did not intend to imply that Mr. Henley, Mr. Gicinto, Mr. Nocon and/or Mr. Russo had a ‘mission’ to ‘steal trade secrets,’” Mr. Jacobs wrote.

He said the men had hacked an Argentine government website; the team had downloaded publicly available data about registered taxi drivers. He said they had wiretapped Uber’s own employees; what he called wiretapping was in fact a leak investigation in which the team identified an employee who had secretly recorded an internal meeting and shared the recording with the news media.

Uber paid $7.5 million to Mr. Jacobs and his lawyer to cooperate with the WilmerHale investigation, according to legal filings in the Waymo lawsuit. The findings were never made public, but the men said they had been told that they were cleared of any wrongdoing. That June, under pressure from investors, Mr. Kalanick resigned.

In November 2017, Mr. Jacobs’s allegations were revealed publicly in the midst of the Waymo lawsuit. Overnight, the men involved went from being nowhere online to everywhere.

The letter, written by Mr. Halunen, seemed to all but confirm Waymo’s theory that Uber had stolen its technology to leapfrog ahead in the race to build self-driving cars. The federal judge overseeing the case, William Alsup, said the letter required a postponement in the trial so Waymo could dig into the claims.

“If even half of what is in that letter is true, it would be an injustice for Waymo to go to trial,” Judge Alsup said.

Testifying in court, Mr. Jacobs seemed to distance himself from some of the claims in the letter. He hadn’t had much time to review it before his lawyer sent it, he said, and he wasn’t sure if Mr. Gicinto and his other former co-workers had broken the law.

“I did not believe it was patently illegal. I had questions about the ethics of it,” Mr. Jacobs testified. “It felt overly aggressive and invasive and inappropriate.”

Once Mr. Jacobs’s allegations became public, Uber executives quickly denounced the intelligence team.

“There is no place for such practices or that kind of behavior at Uber,” Tony West, the company’s chief legal officer, wrote in an internal email. “To the extent anyone is working on any kind of competitive intelligence project that involves the surveillance of individuals, stop it now.”

The members of the intelligence team feared they had just been publicly fired, and scheduled a meeting with Mr. West.

“Tony met with me and my entire team, and it was actually a good meeting,” Mr. Gicinto said. “People felt better.” But he and other members of the team still wanted Uber to set the record straight. It seemed to them that the company wouldn’t defend them because its reputation was already suffering so much. An Uber spokesman declined to comment on the meeting on Mr. West’s behalf.

The work continued. The team briefed Dara Khosrowshahi, the new chief executive, on intelligence it had gathered after surveilling self-driving cars belonging to Cruise, the General Motors-owned outfit, Mr. Gicinto recalled. It investigated a leak from Mr. West’s legal team to The Information, a tech publication.

But reminders of the scandal lingered. Some members of Uber’s other security teams refused to work with the men.

One by one, the team members resigned. Mr. Henley went to the internet infrastructure firm Cloudflare, and Mr. Nocon and Mr. Gicinto went to Tesla. Mr. Russo returned to government work. After they left, Uber sued them, claiming they had taken confidential documents from the company.

“We don’t object to these former employees making any claims they wish,” an Uber spokesman said at the time. “What we do object to is their walking off with company property and their misuse of privileged information for personal gain.” The lawsuit was settled confidentially.

The men filed a libel suit against Mr. Jacobs, calling his claims “character assassination for cash.” The allegations of wiretapping employees, hacking governments and stealing trade secrets — which Mr. Jacobs eventually said were untrue — had not been publicly refuted and continued to follow them.

At Cloudflare, Mr. Henley became a manager on the security team. But he struggled to hire employees, who he said would drop out of the interview process after looking him up online. “If you type in my name, there’s one issue that comes up at the top,” he said.

He left Cloudflare after only a year and returned to investigating child safety issues online, as he had done at Facebook. He now relies on former Uber employees to vouch for him with clients.

At Tesla, Mr. Nocon and Mr. Gicinto continued to investigate leaks to the media. But in 2018, an employee who admitted to them that he had shared sensitive information later discovered the claims made by Mr. Jacobs, and resurfaced them. Mr. Gicinto felt he couldn’t continue in his line of work.

“If you continue to do this, you are always going to be on the X, you will be a target,” he said.

He quit Tesla and went to work at a cybersecurity firm with Mr. Russo. Mr. Nocon has remained at Tesla.

In 2021, Mr. Jacobs settled the libel lawsuit by his former co-workers. The terms of the settlement are not public.

The men said their experiences in Silicon Valley left them distrustful of the executives who were eager to use their talents but unwilling to take responsibility for them.

The appetite for intelligence gathering in the hypercompetitive tech world continues, though. Mr. Gicinto, the former C.I.A. officer, has a warning for any of his former colleagues considering a move to this part of the private sector, where the motivations behind a given mission are not always as clear as he found them in his past work life.

“In the government, when you’re given a mission or you’re given a task, you go and you execute on the mission,” Mr. Gicinto said. “Your experience tells you to go execute because your boss or the leadership have given you this tasking, and you worry about how to do it — not whether or not you should do it, because you’ve never had to worry about that before.”