Weekly Roundup: GoDaddy Can Phish Off Edition

It was a Christmas dream come true. Right before the holiday, GoDaddy sent all of its employees the following email:

Though we cannot celebrate together during our annual Holiday Party, we want to show our appreciation and share a $650 one-time Holiday bonus!... To ensure that you receive your one-time bonus in time for the Holidays, please select your location and fill in the details by Friday, December 18th.

Over 500 of them promptly clicked through, no doubt thrilled at the prospect of additional help at a time when their spouses or other family members were likely suffering from uncertain employment or no work at all.

They didn't get a bonus. Instead, they got a written warning that they had fallen afoul of a so-called "phishing" message created by GoDaddy security staff to test awareness of identity theft via fraudulent email, and a notification that they had all been re-enrolled in a computer security course.

Merry Christmas! But I've seen (and done) worse...

GoDaddy pointed out that "phishing tests" are common across Corporate America, and they are right; every major company for which I've worked has occasionally sent one to its employees. These tests don't accomplish anything except gratifying the DeVry graduates on the IT Security teams, which over the past decade have managed to become the most powerful tech department in many firms. GoDaddy also pointed out that many real phishing emails play on people's hopes and dreams; who among us has not briefly hoped against hope that the friendly Nigerian prince trying to get $50M out of his country was real?

In this case, however, the plain fact is that GoDaddy did not need to humiliate its employees in this fashion. This sort of thing is part and parcel of what they call "late-stage capitalism" on Reddit, and it's animated by the unshakeable belief that the perceived needs of the corporation, however vague and unimportant, take immediate precedence over the dignity, safety, or happiness of its people. I'd expect nothing less from GoDaddy, which is probably the worst webhosting company and registrar in the entire world.

That being said, treating your people like trash around the holidays is a long and well-respected tech-firm tradition. On December 24, 2000, your humble author was finishing up his day as a sysadmin/DBA for a firm called SubmitOrder.com when I heard a chorus of email beeps around me, followed almost immediately by some weapons-grade grumbling. Apparently one of our vice presidents decided it was important to let all the employees know that

SUBMITORDER.COM IS AN "AT-WILL" ENTITY IN WHICH EMPLOYEES MAY BE TERMINATED AT ANY TIME, WITH OUR WITHOUT CAUSE

at approximately 6:15PM... on Christmas Eve. I don't know what the desired effect of the email was, but the practical effect was that we all stopped what we were doing and went home, including the database team which had been planning to work the holiday to ensure a successful Jan 1 rollout of a new schema.

When we came back to work on the 26th, the email was the subject of constant discussion, to the point that the prankster in me thought it might be worthwhile to shake up this hornet's nest even further. The most vocal critic of the Christmas Eve missive had been a twentysomething contract UNIX admin named Ben. I liked Ben, but I also knew he was highly emotional and prone to hilarious outbursts, so I penned a fake email to him, supposedly from the same Vice President as before, titled

New Year's Changes --- Get Out, You Contractor Filth.

The body of the email alleged that the UNIX contractors were stealing from the company, that they were all fired immediately, and that SubmitOrder.com would probably attempt to prosecute them after their termination. I connected via telnet to our spectacularly stupid Lotus Notes server and promptly tricked it into accepting the faked-up email as real. In two minutes, or less, Ben would get that email, I'd watch him get it, and the fun would begin.

Unfortunately for me, at that precise moment another VP decided to call my desk and ask me some questions about the Jan 1 database rollout. So I was on the phone, facing away from Ben, when he got the email, at which point he stood up, yelled "FUCK THIS BULLSHIT!", took his IBM Model M keyboard, and smashed his own monitor with it before running out of the office, keyboard in hand, screaming, "WHERE THE FUCK DOES $VP_IN_QUESTION SIT?" I dropped the phone and chased after him, catching him in the hallway leading to the executive suites. That led what you might call a "tough conversation" in which I briefly thought Ben was going to also hit me with the keyboard.

Luckily for me, another contractor actually got fired that afternoon, so Ben took that dude's monitor and nobody ever mentioned the incident again --- until today, that is. It was neither the first, nor the last, time for me to pull a prank that caused major violent disruption in the workplace, but that's a tale for another time.

I think GoDaddy should give all 500 or so of the people who clicked on their fake email an actual $650 holiday bonus. Total cost to the company would be thirty-five grand. Compared to the more than twenty million dollars a year the firm paid Danica Patrick for... nothing, this would be money well spent. In fact, GoDaddy could give all of its employees that bonus for a total cost of under five million dollars, or One Quarter Of A Danica.

Don't look for that to happen. It would send the wrong message. It would make GoDaddy look like a company with a moral code rather than one with a shareholder responsibility. In the meantime, if you'd like to send the company a Christmas message of your own, consider moving your domain registrations from GoDaddy to GANDI.

* * *

For Hagerty, I wrote about lying with pictures.