🎂 Rob Chesnut & Joe Sullivan Fireside Chat

Hi, everyone. Welcome to Cloudflare TV. I'm Joe Sullivan. I'm the Chief Security Officer here at Cloudflare, and I'm really happy to have Rob Chesnut joining me live here on Cloudflare TV. Rob, you're someone I've known for about 20 years now, maybe even more. We first met when I was a federal prosecutor and you were at eBay. And I'm happy to have invited you on to talk about your book that's been out for the last year or so, Intentional Integrity, How Smart Companies Can Lead an Ethical Revolution. Welcome to the broadcast. We're on TV together. This is great. Who would have believed this? I was a federal prosecutor back in the day as well. So it's neat to see you again after all these years in Silicon Valley doing stuff with private companies. Yeah. So you chose to go down this path of focusing on integrity, so much so that you wrote a book about it. You've been talking to everybody about it for the last year. So it's clearly something you really care about. Why did you start to focus on integrity? Look, I think part of it has been something I've been involved with my whole career. I mean, when you're a federal prosecutor, right, you're about rules, you're about trying to uphold the law. My first stop after being a prosecutor was at eBay. And I was working on trust and safety, all the rules of the site and how it operated and preventing illegal transactions and the like. So it's something I've been, it's been central to my career. But I think what really got me focused on it to the point of wanting to write a book about it was I think the world's changed in just the last five or six years. The world is tired of companies that are focused 100% on making money. I think the world is tired of leaders who are engaging in bad behavior and sexual harassment. You know, Me Too is just, you know, is an element of that. And, you know, I, look, I was watching what was happening at companies all around Silicon Valley that were getting in trouble. And I look, I, as the general, I was the general counsel of Airbnb at the time. And I was, you know, thinking, wow, this sort of thing could happen anywhere. Though the scrutiny level is really ratcheted up. How do you drive integrity into the culture of a company? Right? How do you get companies to focus on doing the right thing, not just the right thing for the bottom line? And is there a difference? That's what got me thinking about it and exploring this whole thing. And, you know, we ended up developing an actually an integrity program at Airbnb. And, you know, what really surprised me, Joe, was how people loved it. People really got into it. It was, it turns out people today want more than a paycheck. They want to work at a place that they're proud of. They want to work at a place that has values aligned with their own values. And look, when my parents were growing up, you know, you were worried about, you know, working at the same place for 30 years and getting a gold watch, you would never dare actually speak up about a problem at your company. Boy, that's changed. You know, I think employees are empowered. If they see something they don't like now, they're going to speak up about it. They're going to do a blog post like Susan Fowler did, right, at Uber. They're going to talk to each other on Slack. They're going to go to the press. They're going to even do a walkout, which was the sort of thing that would be unheard of 10 years ago. So I think that the world has really changed and employees are playing a big part in that evolution. And that was something that, you know, that got me really thinking about it and wanting to write a book about it. Right. Yeah, it's funny, you know, that when I think about the concept of integrity in business, you know, the headlines are always about the situations where there's a lack of integrity. We don't actually focus very much on people who do show integrity. But, you know, in your experiences, what's the standard? Is integrity what we usually get? And the headlines are the outer limit? Or do you think there's a lot more we have to do? I think that for a long time, Joe, people didn't talk about integrity at companies. You know, doing the right thing, I think, was defined as, well, if we've got a good year, we'll start a scholarship program or sponsor a little league team. Because it was I think a lot of people thought, you know, it's really not the role of business. You know, we're here to make money, we're here to do business. And I think what we've seen, you know, again, just in the last five to 10 years is a real evolution in how we're thinking about companies and what the role of a company actually is. We've seen it a little bit with B Corps, the idea of a B Corporation for public benefit. And then I think people have started to say, well, wait a minute, why shouldn't all companies have a purpose, a North Star that's good for the world? You know, I think Milton Friedman did us a big disservice, you know, Milton Friedman back in the 60s defined a company, and basically said the company's only objective would be to increase shareholder value, right, to get the stock price up. And when you think about it, you know, why should that be the case? You know, sure, investors and shareholders ought to be important, but employees ought to be important. Customers ought to be important. Doing the right thing for the world ought to be important, too. And, you know, there's a whole body of work, scholarly, you know, work around this idea of stakeholder capitalism, that companies ought to be thinking about a variety of masters to serve. And, you know, just in the last few years, now, this thinking has actually now gained prominence. And, you know, now organizations like the Business Roundtable have now announced basically that Milton Friedman was wrong, and that companies really should think about multiple stakeholders. And I think that's freeing companies up now for the first time to be thinking about doing good as part of doing business, as opposed to that being separate, a separate concept. But I mean, you could take it even further, it seems like the data is now suggesting that doing good might be good for shareholder value as well, right? That's the ironic thing, right? I think in the past, people thought of them as entirely separate concepts. You know, I think, in the old days, people would say, well, you know, we're dumping carbon into the sky, we're polluting the stream, we're doing business with somebody on the other side of the world that mistreats its workers, but fixing those things would actually cost us money. So we really, we can't focus on that, because we're supposed to be focused on shareholders. But we're living in a world of unsurpassed transparency. Now the world is watching, you know, integrity used to be doing the right thing, even when no one is watching. Well, today, everybody's watching everything. People know, people are getting insights into this. And they're concerned about, they're speaking out, employees are speaking out, regulators are speaking out, communities. We're even in an age now of conscious consumerism. And what does that mean? Data shows that 10 years ago, customers didn't think that much about the values of the companies they did business with. To now, over 70% of consumers report that they want to know the values of the businesses that they do business with. And if those values aren't aligned with their own, they're going to go find another business to buy from. So what all of this is leading to, Joe, is that data shows that companies that do well in integrity, that have high ethical standards, according to neutral criteria, those companies are actually outperforming the stock market and actually outperforming competitors. So, you know, there's doing good business now means doing good, because that actually resonates with people. It helps you attract employees, it helps you retain employees, it turns customers into ambassadors. And I think that's the way of the world now in the 21st century, that companies need to demonstrate a higher purpose that will resonate with all of these different stakeholders. And if they do that successfully, you know, look, integrity is a double edged sword. If you screw up, if you don't get it right, it can destroy your brand. But if you get it right, it can actually be wind at your back and help you drive your business. An interesting question when I think about it at a business and level like that is how overt do you like is the right way to approach it to just set up like a big part of the book is kind of talking through step by step what an organization should do to get the right kind of integrity in steps into the culture. But like, I'm not sure you touched too much on the idea of like, now. It seems like some companies really misstep when they get out there and try and talk about their values, because we're also cynical as consumers. We are or cynical bunch now, right? I think a lot of us would love to believe in companies. But we've seen so much misbehavior, we've seen so much bad by companies, we've been lied to, right? Look at Volkswagen. Look at how a company like Volkswagen just outright lied to us about the fact that their cars didn't, you know, their diesel cars had zero emissions. And in fact, they intentionally designed their car in a way to try to rig the test. You look at an organization like Theranos. What all of this has done is I think it's made us a bit cynical. And so I think you've got to be careful about how you do it. You've got to now understand that everything is going to be public. You've got to understand that a cynical world is going to carefully examine your claims. But I think that doesn't mean that you don't try. I think you've got to be intentional about integrity. But you've got to be sincere about it. And you've got to be, you've got to understand that your employees are going to look at it, your customers are going to look at it, the media is going to look at it. And if you're not sincere, and if you're trying to claim something, and then while at the same time doing something inconsistent on the back end, you're going to get called out on it. So, yeah, it's interesting. You gave examples of like a really large multinational corporation and a small startup. You and I live and work in Silicon Valley, which is the center of the universe when it comes to startups. And it seems for better or worse, that there's been a lot of scrutiny of the startup culture in particular. As people who have talked to a lot of different companies, as they start up, what is it about the startup environment that seems to be particularly needing more of a commitment to integrity? Yeah, there's a something about Silicon Valley startups, part of the culture seems to be what is it move fast and break things. And they forget to add on the end except laws, right? Almost, you know, what matters is success. What matters is hitting a financial number, hitting a metric in order to make your investor happy. And that's been part of the culture, I think, you know, for quite some time, this idea of move, move so fast that the law can't even keep up with you. And so, you know, I think it's with some good reason that the world is looking at Silicon Valley now and really wondering, well, is this serving us well? Are these companies actually serving the world well? So I think that I understand it. I'm sad to be a part of a larger culture like this, that's viewed this way, but understand that we probably earn that reputation as a large Silicon Valley group. And I think, but there's another side to it. And the other side, which I like to promote and talk about, is the idea of a mission-driven company, the idea of a company that has a purpose to do good in the world. And I think, you know, what Silicon Valley companies are also coming to understand is that that can be a really powerful force to drive your company in the 21st century. So I think we're learning, we're growing, we have to understand that there have been missteps, understand why some have been cynical. And I think we've also got to have the self -awareness to realize that we've caused some of this ourselves, and we've got to be really thinking more deeply about what it means to be a good company. Yeah, like when you talk, like as I work in the security profession, and a question I often get from founders is, when should I hire my first security person? You probably get that, when do I hire my first lawyer? Yeah, when do I get the first lawyer? You know, let's hold off as long as possible, because there's a perception that the lawyer is going to say no to things. The lawyer is going to tell us to stop. And look, part of this is the legal profession's fault. But there are what I call no lawyers. And these are lawyers that recognize that, well, I'll never get in trouble if I say no, right? If I say no to something, that means we won't take a risk, we won't get in trouble. So there's this bias towards saying no, and that's wrong. You know, I think lawyers need to understand that they're part of a team that needs to understand risk. They need to look at business problems through the lens of a lawyer. They need to understand that they need to speak up for a culture of doing the right thing and following the law. But they can't be seen as the people to avoid on the third floor, you know, don't tell the lawyers about it, right? I think that's a problem that the legal profession is grappling with. And as a result, look, you know, if a company's got 200, 300 people, no lawyers, no security folks, a certain culture builds up, right? Then when you're the first one hired, and I think, you know, you and I have probably each been the first lawyer or the first security person hired at a place. It's hard to change that. It's hard to change that kind of culture and that kind of thinking. Right. Yeah. But one of the things I enjoyed about the book was, you know, you give a lot of examples from your experiences at eBay and Airbnb in particular, because those business models, like those platforms created a lot of challenging, I guess, issues around integrity and trying to figure out what the right thing to do should be. We love talking stories, I'll tell you the story of discrimination on the Airbnb platform. And I had been the general counsel at Airbnb for a couple of months. And the newspaper report, the online report started coming about out about people being discriminated against on Airbnb, that there were certain hosts that were turning people down because of the color of their skin. I think the initial reaction inside the company was a little bit, well, you know, when people get turned down all the time, you know, there couldn't be discrimination really on our platform, because, you know, we're a company that believes in connecting people. This couldn't be happening, right? But the reports kept coming. We started looking at some data and recognizing that indeed, this was a problem. And then the lawsuit started coming. So I go to my first big meeting as general counsel with the founders. I sit down in a room with Brian Chesky, CEO, founder of Airbnb. And I start talking to Brian about the law. You know, what is Airbnb's legal responsibility in this situation, right? Is Airbnb, look, we don't allow discrimination, it's in our terms of service that we don't allow it, right? We don't encourage this sort of behavior. Can we be sued if a few people on the site act this way? What's our, does the law even apply to Airbnb? You know, when someone's renting out a room in their home, do housing discrimination laws apply there? So I started going through this with Brian, Brian holds up his hand and says, Stop, I don't care. I said, Well, what do you mean you don't care? And Brian looked at me, I'll never forget it. Brian said, Rob, the mission of Airbnb is to connect people. The mission of Airbnb is to get people from out behind their computers, to get out into the world, see places they've never seen, and start interacting with locals, start interacting with people they've never interacted before, and connect as human beings. Rob, if people are really being discriminated against on our platform, we are failing as a company. And so he said, Look, I don't care what the law says. And frankly, I don't care what it costs. We have to fix it. Because if we don't, we're phony. And that started an entire program inside of Airbnb. We did a number of things. I remember one thing we did, we actually required every user to stop at a screen. And the only thing on the screen was, I pledge that I will not discriminate against anyone, because of the color of their skin, their race, their gender, their nationality. It was an I agree button. And I don't agree button. And we said to Brian, well, what happens if they say the I don't agree button? Because this isn't the law, actually, in most places in the world. We're doing business, right? And Brian said, well, if they don't agree to this, they're gone. And we lost 1% of our users like overnight. Right? Because there were some people that simply didn't agree to it. And Brian said, I don't care. And it's the sort of thing that might have cost us some money in the short term. We talk about financial consequences of doing the right thing. But I think in the long run, we sent a powerful message to people all around the world that some things are more important than money, that mission and values actually do need to drive your decision making. And I think as a result, Airbnb is a stronger, more successful company today, because it took a stand on something like that. Yeah, it's funny, as you're telling that story, it reminded me of a conversation we had 20 years ago. So I don't know if you remember this conversation, but you and I were talking about whether I should leave the Department of Justice and come work at eBay. And I said, well, you know, I went into government service, because it's about helping people. And you said, well, I found when I left the Department of Justice and came to eBay in a role doing trust and safety, I went from being able to be a voice against crime one case at a time. But here, I have the ability inside this organization to influence policies and process, that if I change the way this marketplace works, thousands, even millions of people could be safer and prevent the harm from happening in the first place. And that's, that's stuck with me for 20 years, that the idea that we need people inside these companies who are there to be the voice of the consumer, the end user, and, and to be thinking long term about the investment and doing the right thing. Yeah, I think I remember that conversation. And you know, the funny thing is, I think I even underestimated things back then, I think I said millions. And yet today, I think what you and I have seen is that we, you know, we can have a major impact on so many people, by taking, you know, stand like that on issues. And, you know, the Cloudflare, take Cloudflare, I'll give you an example, you know, you all had an issue with a not that long ago involving 8chan, right. And, you know, I think the initial reaction to Cloudflare was, look, you know, we provide our services neutrally to everybody. But you know, 8chan was a horrible organization, that was providing a platform, glorifying violence and glorifying mass killings. And I think after a little thought, you all said, you know what, maybe we shouldn't just be providing our services to everybody. Maybe we ought to take a stand and recognize that protecting an organization like that is just wrong. And so you set up standards, I think that was the right thing to do and a great thing for your brand. Look, everybody can agree or disagree on exactly what integrity means. That's kind of interesting, right? It's two people who are upstanding, people trying to do the right thing can look at the same situation and disagree about which path takes integrity. Integrity, I think, is shaped by our life experiences, by our upbringing, by our culture, our religion, and the like. But I think it's important to stand for something, to define what you believe in. And look, I think you all did it there. And I think there are, I can cite so many examples, like in Airbnb's case and eBay's case of doing that sort of thing. And we call it being a 21st century company. I think that's what the world is now expecting of us. Yeah, the interesting thing, looking at these companies that are doing new things, these new platforms that are changing the way we buy goods or where we stay on vacation, how we interact socially online. The interesting thing is that when I read the book, a lot of it is dedicated to the ethical issues that come up in every corporation. So it can be the bribery and corruption, the conflicts of interest, sexual harassment. Those things can happen in any organization. But there's a whole other level of when you build these new business models, everybody's excited about the good way that new technology can be used. And it seems like every company gets surprised about the abusers that come along and be like, oh, you created this really great platform for sharing photos. Well, now I can share child exploitation materials. And then you have companies like Apple who are in quite the controversy right now with this tension over like, okay, we create a platform that allows distribution of photos at a mass scale. And some tiny, tiny, tiny subsection are using it for abusing young people. And so they try and come up with a tech solution to that, which apparently set off the privacy community. It's kind of like as corporations, you wade into these issues and you've probably faced a million over the years where you get surprised by how the abusers are looking at your platform and using it in ways you didn't expect. Right. But I think the phrase in the book, you're responsible for the chaos factory that you create. You can't just say, well, this was just neutral. I never intended it to be done this way. It's your logo in the corner. It's your frame in the screen. And I think it's on you to think about these things while you're in the creation process. I mean, Joe, what people need is more people like you and me who have seen all the different ways that people will likely take something good and use it for a bad purpose. You need to think about that when you're designing. And then you've got to constantly be watching. And look, you're going to have to course correct. You're going to have to understand that, oh, I had no idea somebody would actually do this. I'm going to have to build something to figure out, like at eBay. I think when I first started at eBay, they were selling guns on eBay. They were selling guns. I'll never forget one day I got a call. Somebody was selling. They had gone to get communion from the pope. And they got the wafer from the pope. And instead of putting the wafer in their mouth, they put it in their pocket. And then they stuck it on eBay. You never dream of this sort of stuff happening. But the reaction to it was from the Catholic church and the Catholic community was swift and severe. But all that sort of stuff led us to establish an infrastructure at eBay that monitored what was put on the site. And we established rules around what you could put up and what you couldn't put up. And I thought that was hard. But I was having lunch yesterday, actually, with the head of trust and safety for YouTube. And he was working on the team with me at eBay. And I thought the problems at eBay were bad, trying to do that with the kind of video that they deal with on a daily basis. It's extraordinary. But I think it's a challenge. If you're going to run a platform, you, I think, have the obligation to run it in an ethically responsible way and try to address these problems. And it's part of the business model that you own accountability for the whole experience, right? I think you do. And if you try to duck responsibility for it, the world's going to call you out on it. Yeah. Yeah. Like one of the other things I remember from our eBay time was your approach when we ran into these kind of novel collisions with, I don't know what they're like, say the gun example. We wouldn't just sit by ourselves and try and figure out like, what should we write as the new rule? You mentioned the JARTS example in the book, where you basically reached out to the U.S. Consumer Product Safety Commission and said, we see these people selling JARTS on eBay and they're a recalled item because it's a fun game until the kid gets hit in the head with a JARTS. And you actually work with that regulatory agency to come up with a solution. There's a distrust of government and law enforcement, I think, in Silicon Valley. But I didn't have that and you didn't have that, right? I mean, look, this is stuff that you did at eBay as well. I think you and I both came from a world where we believed that government generally tried to do the right thing, not always, but that generally they were trying to do the right thing. And I think that trust meant that I would pick up the phone and jump on an airplane and go meet with government and work with them and try to help craft something that made sense for the world at large and try to satisfy government. Because I generally believed back then that if you reach out to government in good faith and demonstrated that you wanted to try to do the right thing, that you would usually get a good result. Yeah, in fact, you had me, I think in my four years, with you as my manager, I made it to 46 of the 50 state capitals as I went to go meet with government officials to say, what should we be doing in this situation? Yeah, and I think they were shocked, right? That a company would actually want to reach out and do it. But that was an intentional strategy. And that not just because it would, we felt it was the right thing to do. Now, we also thought it would benefit the business. Another good example of how trying to do the right thing, I think, ultimately reduces your regulatory and compliance costs, protects your brand, and helps you grow as a business. Yeah, I think that's exactly right. We were able to open up new categories of business by having a constructive relationship with the government officials who are out there trying to manage that risk. Well, this half hour went by really quickly. I enjoyed talking with you about this job. Thank you so much for joining me. I highly recommend everybody who's listening, get the book and read it. It was a really enjoyable read for me. It went by really quickly. And so thank you very much. Commercial portion of our presentation. But you know what, for me, for me, Joe, it's also about having the conversation. So anybody, a cloud player that's interested in the subject, reach out to me on LinkedIn and connect. I post about the subject regularly and enjoy it.