Safety and Security in the Share Economy Product of the Research & Information Support Center (RISC)

Table of Contents

Executive Summary ..................................................................................................................... 2 Introduction.................................................................................................................................... 2 Challenges to the Share Economy ............................................................................................ 3 Benchmarking Survey Analysis ............................................................................................. 4 User Safety................................................................................................................................ 8 Privacy ................................................................................................................................... 9 Scams .................................................................................................................................... 9 Host Country Interference/Manipulation ......................................................................... 10 Sexual Violence .................................................................................................................. 10 Violence against Patrons .................................................................................................. 11 Anti-Rideshare Violence.................................................................................................... 11 Cost .......................................................................................................................................... 11 Liability and Insurance Coverage ........................................................................................ 12 Legalities and Compliance in Usage ................................................................................... 13 Intelligence Collection/Surveillance ..................................................................................... 15 Mitigation Tools........................................................................................................................... 16 Where to from Here? ................................................................................................................. 18

The contents of this (U) presentation in no way represent the policies, views, or attitudes of the United States Department of State, or the United States Government, except as otherwise noted (e.g., travel advisories, public statements). The presentation was compiled from various open sources and (U) embassy reporting. Please note that all OSAC products are for internal U.S. private sector security purposes only. Publishing or otherwise distributing OSAC-derived information in a manner inconsistent with this policy may result in the discontinuation of OSAC support.

Executive Summary As ridesharing and homesharing services have emerged as alternatives to more conventional options, many private-sector organizations are grappling with how to incorporate these new offerings into their existing travel or security policies. Potential security considerations include difficulties in vetting service providers, addressing consumer safety concerns, and ensuring insurance coverage for injury/damages. For work-related travel overseas, clear and specific policies on using Share Economy providers may promote personnel and organizational safety. Introduction A traditional work-related trip overseas might have included a stay in a Western-branded hotel – often where the purpose of the trip was being conducted – and perhaps a Western-branded rental car or car service to move between the airport and the hotel. However, with web-based innovation swelling, experiential tourism surging, and scrutiny of travel budgets tightening, an increasing number of global travelers are seeking alternative travel options. From these causes borne the so-called Share Economy 1, wherein people rent assets they already have over varied lengths of time (minutes to days) via the Internet, rather than renting for the traditional daily period via conventional companies. This Share Economy, Four out of “the top five which refers to shared use, is leveraging unused or Sharing Economy underused commodities, like bedrooms or seats in companies with U.S. vehicles, that until recently could not be monetized. A consumers include ride recent report published by Bank of America Merrill Lynch sharing … room sharing … estimates Share Economy global valuation at about and on-demand errand and US$250 billion. For the purpose of this paper, the term delivery services.” ‘Share Economy’ refers to ride- and home-sharing collectively (a detailed explanation of each type of sharing -The Sharing Economy can be found in the Appendix). (PWC) Minimalism, especially since the global financial crisis, is commonality for many Millennials, a growing employee base less inclined to buy when they can borrow, rent, or share and who generally are expert smartphone users. The concept of sharing or bartering is an ancient concept, but the Share Economy marries modern technology, easy global travel, and social trends of minimalism. An added benefit is that there typically is no hard currency exchanged for services; transactions are usually completed wirelessly through the Internet of Things. When used internationally, there is also a far lower concern about language or cultural barriers, since most of the transaction is done online and hardly requires actual human interaction. For private-sector travel, there are considerations and policies to be addressed to protect both traveler and employer. Specifically, ridesharing and homesharing (although there are other burgeoning subsects to the Share Economy) overseas have raised concerns in security circles, typically due to the Duty of Care mandate. An OSAC benchmarking survey found that most organizations recognize security shortfalls, especially in homesharing, but few have been impacted as of yet, and, consequently, few have incorporated specific guidance or requirements into their travel or security policies.

1

Aka collaboration economy, community/collaborative consumption, peer-to-peer economy, gig economy, online platform economy, “disruptors”

2

The Allianz Travel Insurance Sharing Economy Index reported the popularity of the Share Economy (both homeand ridesharing) for any travel has tripled within two years from 17% in 2015 to 50% in 2017. Notable providers include: Lyft (up 41 points to 56%), Uber (up 38 points to 73% in 2017) and Airbnb (up 32 points to 51%). The Share Economy is clearly gaining traction.

“[The Share Economy] is a movement as important as when the web browser came out.” - Shervin Pishevar, venture capitalist at Menlo Ventures

This report addresses some of the most pressing security-related concerns in using ride- and homesharing, including case studies, and will offer best practices already employed by OSAC constituents. The report uses specific company names not to promote or disparage any individual company but to underscore examples from ridesharing and homesharing alike. Select examples are used throughout the report, but there are many others reported on in the media. Challenges to the Share Economy Some security concerns are broad and all-encompassing, regardless of what Share Economy is used. And, many security concerns even overlap with those of traditional hotel and livery services. There are negative news stories, including examples of privacy violations, scams, host country interference, sexual improprieties, and violence against patrons and hosts (particularly drivers). The Share Economy is generally more difficult than traditional travel outlets, like hotels and pre-arranged taxis, to regulate and monitor; although possibly just because laws have had considerable time to account for problems inherent in traditional travel products. Across the board, trust in personal well-being is a tremendous factor in using a ride- or homeshare. However, this goes both ways: a legitimate service provider wants recurring business and, therefore, must maintain professionalism in order to foster a sense of trust and positive reviews. As it pertains to individuals, primary concerns include personal/usage safety, affordability, and quality of service. As it pertains to employers, primary concerns include liability/insurance, legalities/compliance, employee safety, and intelligence collection/espionage. Particularly with homesharing, there is a risk for exposure to personal/property harm coupled with little to no emergency support. Notably, while homeshare hosts generally undergo a background check, the facilities are generally not inspected. Further, private sector organizations’ ability to account for and access their traveling staff in a homeshare may be more difficult, especially during a crisis. Using integrated service providers may mitigate this concern. Employers have a Duty of Care -- a legal obligation -- for their employees traveling at the request of an organization, and for some private-sector organizations this includes specific guidance on permitting or banning ride- or homeshare providers while others are discussing and studying how to proceed. Having a written policy that addresses the Share Economy may protect both employer and employee should a trip not go smoothly; a recurring review of the policy allows for the inclusion of new, emerging technologies (and the exclusion of aging, obsolete technologies). OSAC released a survey in early September to gauge priorities; the findings of this survey are included below.

3

Benchmarking Survey Analysis As the reach of ride- and homesharing widens, more consumers will be using these services— including those traveling for business. The U.S. Government’s General Services Administration (GSA), for example, specifically permits ridesharing but is vague on homesharing. Notably, in 2015, IBM banned the use of rideshares over many of the concerns raised in this report and an individual security incident in Europe, but an immediate employee-led online petition went viral, forcing the company’s HR department to reverse its decision within 24 hours. The findings from the OSAC survey underscore that most of the constituent organizations who completed the survey do not have a written policy that addresses the use of Share Economy providers; however, of those who do have a policy, slightly more have some sort of prohibition/restriction on ridesharing over homesharing. Ridesharing

Homesharing

6

11

Total respondents 13

4

1

4

17

9

21

37

32

43

Constituents with a formal, documented policy that unilaterally prohibits usage Constituents with a formal, documented policy that allows unrestricted usage Constituents with a formal, documented policy with specific provisions or restrictions Constituents with an informal, undocumented policy

Few respondents had specific provisions or restrictions in place for four personal identity concerns -- gender, ethnicity/nationality, sexual orientation, and age – with more reporting restrictions on homesharing. 4.5 4 3.5 3 2.5

Ridesharing

2

Homesharing

1.5 1 0.5 0 Gender

Ethnicity or Sexual Nationality Orientation

Age

Other

4

Some respondents had specific provisions or restrictions in place for traveling staff with clearances and for high-level employees. 4.5 4 3.5 3 2.5 2 1.5 1 0.5 0

Ridesharing Homesharing

Security Clearance

Employment Level

Of the respondents who did permit the use of Share Economies, some of the common security measures reportedly undertaken included: • Awareness of the location of traveler • Communication connectivity between systems in case of emergency • Data privacy • Security briefings of the risk and lack of security assessments • Location and availability of suitable alternatives • Restricting usage in areas with security/safety concerns • Check in/out procedures and journey management protocols • Frequent communication • Inform of the transportation options • Worker tracking/monitoring including ISOS apps • Research security history and provide clear direction for incident reporting • Utilize employer’s relationship with service providers • Address liability concerns • Prohibit some and offer specific guidance on precautions • Communicate safety/security protections in traditional service providers • Restrict bookings to 10+ reviews, 5 stars, and super host status • Leave onus on traveler

5

Many respondents had some specific provisions or restrictions in place for Africa, the Americas, and Middle East/North Africa, whereas Europe had the fewest, for both ridesharing and homesharing. 16 14 12 10 8 6 4 2 0

Ridesharing Homesharing

Africa

Americas

Middle Asia Pacific South and East and Central North Asia Africa

Europe

Some 43% of those who responded reported that the primary reason for having an informal policy was that this was emerging issue for which they have not had time or resources to address formally. Some 16% reported having an informal policy because they had not had a reported issue or problem with usage. The benchmarking survey found that, for the majority of respondent, the biggest safety concern was being responsible for the safety of traveling staff (i.e. workforce safety). Other concerns identified included the inability to vet housing; potential assault, theft, or denial of service based on ethnicity; and life safety concerns (including security of property, fire suppressant system, and fire exits) in homeshares.

Biggest Safety Concern Workforce Safety Liabilty or Insurance Legalities or Compliance Intelligence Collection Other Not My Role

6

Similarly, the single biggest safety concern for travelers was reportedly personal safety at 77%, followed distantly by quality of service (12%). Additional concerns included privacy and personal information protection.

Concern as a Traveler

Personal Safety Quality of Service Other Affordability Not Applicable

Of the 72 respondents, only five had reported security-related incidents from an employee using a Share Economy provider. Two cases involved vehicles being locked so that patrons could not exit; one included the driver wanting personal contact information. One case involved a vehicle accident wherein the patron was injured. Another involved a driver taking circuitous routes, perhaps being the start of a kidnapping. One involved property theft from a homeshare. Tangential (non-specific case) reporting also included accommodations not meeting what was advertised or drivers not being familiar enough with city roads. Notably, any of these reported incidents could have also occurred in traditional taxis and/or hotels. For those accustomed to the instant gratification of smartphone apps, the Share Economy is already part of the vernacular and a readily-available resource. According to a PWC study in 2014, Millennials make up the largest cohort of Share Economy participants at 35%, followed by Generation X at 17%. This seems to track with OSAC survey results, which indicated Gen-Xers and Millennials are the most common travelers among survey respondents.

Traveling Staff 100% 80% 60% 40%

Traveling Staff

20% 0% Generation Millennials X

Baby Boomers

Silent Generation

7

The major concerns and an analysis of usage policies are described within the report below. User Safety Blind acceptance of employee travel preferences without implementing safeguards may jeopardize safety. The desire for on-demand, high-quality, low-cost service can, and often does, outweigh security concerns, including basic Duty of Care protections. There are user and employer safety considerations to ridesharing and to homesharing that may not be explicitly addressed in an employer’s Duty of Care mandate. One of the primary safety concerns in using ride- or homeshares is the very concept of the industry: trusting a stranger. The Allianz Travel Insurance Sharing Economy Index underscored that “only 17% of respondents said they are ‘very trusting’ of the services, while 83% of Americans said they are at least ‘somewhat skeptical.’” That said, there is actually little substantive evidence that ridesharing is more dangerous than traditional taxis; ridesharing options in certain circumstances may prove to be safer due to a lower profile, cashless transactions, and the inherent technical identification and tracking; the latter two attributes make ridesharing less alluring for criminals. While entering and storing personal effects in a stranger’s home comes with certain vulnerabilities, crime also occurs in hotels of every strata. Traveler vulnerabilities in traditional taxis and hotels also apply generally to ridesharing and homesharing and, consequently, are not addressed here (Please review OSAC’s Report, “Taxi Security in Mexico City” for guidance on safety in all forms of taxis, including ridesharing, in Mexico City.). Person Rideshare providers, much like traditional livery drivers, generally undergo a pre-employment background screening. For drivers in the U.S., ridesharing companies typically check for major moving violations (e.g. DUI, hit-and-runs, fatalities, sexual offenses, drug- or gun-related violations, excessive speeding) or a violent crime record – that is, a conviction -- within seven years. These checks are often stricter than traditional livery licensing requirements. Even in the U.S., a criminal record does not annotate accusations or arrests with charges dropped, and it only includes time spent in the U.S. as an adult. A timely example is that the New York City terror attacker on Halloween 2017 came to the U.S. in 2010 from Uzbekistan, so a background check by his employer, Uber, would go back seven years (he passed and had no user complaints in his six months of employment); notably, his affiliation to Uber is unrelated to the attack. Homeshare provider Airbnb reported completing background investigations from terrorist watch lists, felony convictions, sex offender registries, and “significant misdemeanor” data on all U.S.and India- based host applicants and is in the process of requiring checks in other nations. Pre-employment screening gets complicated when looking overseas and wading through foreign laws and criminal databases/records. For example, private companies in Germany are prohibited by law from requesting record checks on prospective/current employees. (Please see Legalities section for more.) Property There is less screening in place for physical property (i.e. vehicle or home). This is generally self-policed by publicly available reviews.

8

Some rideshare providers require only photographs of the vehicle; others have in-person inspections prior to approval. There is little oversight as to the roadworthiness of the vehicle. Taxis are generally inspected on a recurring (often annual) basis, while private vehicles are far less regulated. There is little recourse or oversight if a rideshare driver changes vehicles (so that the app data does not match the actual vehicle) beyond users providing a low review. Airbnb does not have a defined corporate security or safety framework requirement for property. Property inspections and security assessments are not completed on host properties for Airbnb. Access to emergency communications and assistance is significantly reduced, more difficult to obtain, or may be absent all together in a homeshare. Homeshare hosts are not held to the same regulations as hotels. Hotels practice and train their staff for emergencies and have preexisting relationships with emergency responders. This is not necessarily the case in a private dwelling. Homeshares do not necessarily comply with fire and safety regulations, and a patron may not know where to find emergency countermeasures. For example, a homeshare is not obliged to have fire extinguisher or signage to an exit or window safety features. Airbnb is starting to issue smoke and carbon-monoxide detectors to its hosts. It is incumbent on the patron to know how to contact emergency responders and how/where to evacuate in a crisis. Further, hotel staff can access a room for wellness checks should a medical emergency occur; a homeshare owner may not revisit the property until the final day of the agreement, if at all, and an employer is unlikely to have contact information for a homeshare host. Similarly, there are no standards for hygiene and cleaning/sanitation procedures in homesharing, potentially increasingly the likelihood of illness. For homeshares in particular, it is incumbent upon the patron to investigate the safety of the neighborhood and surrounding environs. For example, Airbnb launched a US$1 million program to bring patrons to Cape Town’s townships, specifically Langa, that were once segregated under apartheid to rejuvenate the economy of the area, but the physical safety of patrons in and around the township is not the homeshare company’s responsibility. Privacy Because certain personally identifiable information, including a full name and photo, must be entered to match rideshare user and host, it is possible for cases of stalking to occur. In 2014, a journalist reported that her rideshare driver tracked her down on social media. Tracking patron locations without their permission has also proven problematic for Uber on a corporate level (see God View in Surveillance section). Major rideshare providers assign randomized phone numbers should user and host need to communicate. Key accountability and access control records are not a requirement for Airbnb, and they have no requirement to change keys or access after a client checks out. A homeowner and/or anyone else with access to the property may not be required to undergo a background check, whereas Western hotels generally vet their staff. Homeshares may also accommodate multiple guests simultaneously, with no way to vet anyone within the same abode. Scams Deceitful practices, wherein what is advertised is not what is provided, or outright scams can fleece a homeshare patron, in particular, as security deposits are often required to guarantee a booking. There is little possibility of advanced verification or vetting of quality of service until the patron arrives at the accommodation/vehicle, whereas there is a higher level of confidence, especially in hotels and livery services, in the quality in of and facilities to be expected. In a hotel, if something is wrong, housekeeping can be summoned with an escalation to 9

management if necessary. Rideshare passengers have also been defrauded. For example, in March 2016, a driver planted fake vomit in his vehicle to obtain the US$200 clean-up fee that is charged with the cost of the ride to an offending passenger. Host Country Interference/Manipulation There may be circumstances wherein a host country may interfere with availability and/or access to Share Economy providers. For example, on October 11, 2017, Airbnb listings in Beijing’s city center during the communist party congress (October 18-31) yielded no availability “due to external circumstances.” In cases where the host government has control of the nation’s Internet infrastructure, reliance on web-based apps, including ride- and homesharing, may become problematic (see OSAC 2017 White Paper “Controlling the Message”). Sexual Violence The most common crime reported in the media and in anecdotal constituent reporting in ridesharing has been sexual misconduct. There could also be interactions that are not outright illegal but might make patrons uncomfortable or are at least unethical. Sexual misconduct claims against rideshare drivers do exist, and the depth of a driver’s background check is often a concern. However, cases of sexual misconduct are not exclusive to ridesharing but are frequently cited in media and used as a rationale to bar usage. According to CRG’s assessment, “the majority of sexual assault offences by rideshare (or traditional taxi drivers) have occurred late at night or in the very early hours of the morning, when the victim was traveling alone.” (see OSAC 2017 White Paper “Female Personnel/Traveler Security in India”) One of the most frequently cited case studies against ridesharing occurred in December 2014 in India. A young woman hired an Uber driver at 9:30pm to take her home in Delhi’s Inderlok neighborhood. The woman fell asleep in the backseat of the car and awoke to the car doors locked and in a secluded area. The driver assaulted and raped her, threatening to kill her (knowing where she lived) if she reported the incident to Uber or the authorities. The Delhi Transit Authority claimed the driver did not have a driver’s license on file, and it was unclear if he had undergone mandatory police verification or a background check, which became mandatory in January 2015. The driver was free on bail in connection to three criminal cases, one being rape. The Indian government banned Uber in Delhi, but rideshares have since resumed operations. The driver was convicted in 2015 of kidnapping and sexual assault and is imprisoned. As a result of this hallmark case, Uber implemented a panic button that prompts Uber to alert local police. Sexual misconduct is arguably a bigger risk in homeshares from a Duty of Care perspective due to an inability to secure or access a private residence. For the first time, a homeshare provider is being charged with negligence after a female patron was allegedly sexually assaulted by a host who had previously been accused of battery and domestic violence. Since the host had not been convicted of a crime, it was not apparent in his background check. While this case occurred in the U.S., it underscores the limitations of background checks and the inherent isolation and inaccessibility that comes with a private residence.

10

Violence against Patrons While ridesharing in the U.S. has become so common that some parents arrange unaccompanied rides for their under-age children, that level of trust and presumption of safety might not be the same around the world. Most reported cases of non-sexual violence crime have been theft or assaults against user or host. For example, a rideshare driver was accused of rape, assault, and murder of a female passenger in Puebla (Mexico) in September 2017. The driver had been fired by another rideshare firm for “improper conduct.” As a result, Cabify also enhanced security protocols, to include “more thoroughly screening drivers,” and will develop a panic button on their app. The woman’s murder also prompted protests in Puebla. The same holds true for violence in homeshares. For example, in July 2017, an Airbnb host in the Netherlands was accused of attempted manslaughter of a South African woman who he assaulted and pushed down a flight of stairs. The victim claimed the attack was also racially motivated. The lack of first-hand accounting in the media may underscore how hard it is for patrons to navigate the law enforcement or judicial process; law enforcement’s unwillingness to pursue low-value theft; or (however unlikely) few actual crimes. Anti-Rideshare Violence More frequently than users being targeted for violence in rideshares, violence has targeted the drivers as an extension of the company and frustrations with their footprint in the transportation market. These frustrations have generally stemmed from regulations and taxation on taxis that give ridesharing a competitive market advantage (see Legalities section). While the U.S. private sector is not specifically targeted in this type of crime, there is room for collateral casualty to targeted violence and for inconvenience in vehicle response and/or traffic congestion. That some rideshare offerings are recognizable by make/model/color (Uber Black is typically a new, black luxury vehicle) or branding (Lyft’s pink mustaches) lends to recognition and a higher risk of being targeted by criminals especially in locations where there is violence between drivers of traditional taxis and rideshare vehicles. One of the most widely covered anti-rideshare violence campaigns has been in South Africa, where rideshare drivers have been met with hostility by metered taxi drivers, who claim rideshare providers are stealing their business. Violent clashes between taxi drivers and Uber drivers in particular have become common in Gauteng province in 2017, with several incidents in which both Uber vehicles and drivers have been attacked. (See OSAC’s Report, “Attacks on Ride-sharing Companies in South Africa”) Other violence targeting drivers takes place at airports, which have traditionally barred ridesharing but are beginning to make accommodations including specific pick-up areas. Using airports as a site for protest is also an effective way to bring attention and to disrupt tourism. For example, in September 2017, taxi drivers in Chile protesting against rideshares blocked the street to the Santiago airport, resulting in one death and disruption to tourism. Some 15 people were arrested. Cost The fact that Share Economy services are generally priced lower than those of traditional travel providers is not the only reason they are patronized, but the low-cost issue is a concern of the private-sector and providers alike. There is a clear dichotomy between a travel (or expense) policy built around the idea that employees should use the most cost-effective means of travel 11

and the use of normally licensed and regulated taxi cabs that may cost more. Frustrations can run high – and devolve into violence -- when taxi drivers feel undercut by low-cost rideshare providers. While the cost of car share is generally lower than traditional livery, should the rideshare industry be required to comply with regulatory frameworks applicable to taxis, the cost of services may rise, negating much of or the entire cost differential. “Regulators need to recognize that the rules the PUC is using were literally invented in the era of highways and telephones. We are now moving into a new era” - SideCar CEO Sunil Paul

Further, there are discussions in some places about adding fees, like hotel and tourism taxes, to homeshares that could raise the cost to the equivalent of a hotel rental. It remains to be seen, though, whether with similar costs, travelers would choose traditional providers over Share Economy providers.

Ridesharing continues to adapt, particularly as it pertains to accommodating business travelers. For example, in July 2014, Uber announced a customized service for corporate travelers, “Uber for Business,” and signed a deal with Concur so that business travelers could bill their trip directly to their company. From its founding in 2014 until September 2017, Uber for Business had been a free service, but it now will cost an additional 10% to use. In response to some private-sector concerns regarding effective use of their services for business purposes, Airbnb recently launched Business Travel Ready, offering over 200,000 listings in 130 countries that it considers appropriate for business travelers. The main features of the business-friendly properties are Wi-Fi access, availability for immediate booking, and prohibitions on sharing the property with the owner or anyone else. This offering is integrated with travel management companies for simple expense reporting and gives travel/risk managers visibility to itineraries and property details. Airbnb estimates 10% of its bookings are for business travel. Liability and Insurance Coverage Traditional travel providers are beholden to meeting insurance and liability requirements, and individuals have a personal responsibility to be insured, but the Share Economy falls into a gray area with few insurance requirements. Professional drivers are typically covered under commercial insurance in case of an accident while driving on the job; private drivers must obtain their own personal liability insurance coverage. Rideshare patrons, however, are generally not covered under personal insurance policies in case of injury or damage because a for-fee service is provided. Some personal insurance companies have also vowed to cancel policies or charge premium rates if users are engaged in fee-based ridesharing. Rideshare companies tend to deny liability, claiming to be a broker or match-making service and bear no legal responsibility for injuries or damage caused by freelance drivers. However, a US$1 million liability insurance policy that covers death, injury, and damages – from the driver accepting the patron until the patron has been dropped off -- is now common among leading 12

rideshare companies. These policies, on average, offer better coverage than traditional taxi policies. Rideshare companies provide various other insurance policies depending on circumstance; however, the insurance industry may eventually pivot to offer rideshare-specific policies, likely focusing on driver coverage but possibly incorporating the private sector’s use. In one of the most impactful decisions against ridesharing, British public transport agency Transport for London (TfL) revoked Uber’s operating license on September 30, 2017; however, Uber filed an appeal that allows them to continue operating until a final decision is made in the courts. TfL claims that, based on four areas of concern (including not reporting criminal offenses to police but rather to TfL, driver background checks, and employment status of drivers), Uber is not a “fit and proper” operator. The Taylor Report, an independent review of working practices in the UK, found that it is the only country in the EU where employment has risen but pay has fallen, leading many people to turn to the share economy to supplement meager incomes. Much of the UK’s anti-Uber movement, in particular, has focused on creating “dependent contractors,” who could then qualify for benefits. Similarly, Airbnb has a $1 million “host guarantee” for home owners/hosts against damages, but Airbnb’s insurance does NOT include liability insurance or subleasing. A host must maintain personal “Host Protection Insurance” to protect personal assets for each property. This protection, however, is exclusively for the owner’s property and not for guests or their property. Many questions remain unresolved. Questions have yet to be worked out over whether they protect customers sufficiently from liability and fraud. It remains unclear who bears responsibility for any fees beyond the US$1M coverage in an accident. It remains unclear who is responsible if there is passenger-on-passenger violence or impropriety (especially in cases of multiple passenger pick-up services). It also remains unclear as to whether an employer could be held responsible should an employee be injured or killed while using a Share Economy provider if the employer’s travel or safety policy permits it. It may be worthwhile for interested parties to arrange tripartite discussions to ensure that specific providers are covered in public liability insurance policies, that traveling employees know the insurance provisions/limitations, or that the private sector’s use is excluded in areas that do not meet security thresholds. Legalities and Compliance in Usage In some locations, authorities are starting to investigate whether Share Economies are avoiding taxation or regulation/code compliance while providers claim their operating model is unique. Further, national laws, especially privacy laws, may prevent robust pre-employment screenings compared to U.S. standards. For example, information considered to be “personal data” in Germany (and elsewhere in the EU) requires the explicit consent of the employee and must include “the specific use of his data, the specific purpose for processing and the full name of the third parties that will receive the data in the course of the search to be conducted.” Conversely, in India, law enforcement agencies are generally not centralized, so a comprehensive check would be more difficult. In South Korea, background checks are essentially prohibited, while in China, access to criminal records is strictly limited. The questions of legality could directly impact patrons. Share economies may fall into gray legal areas, and should a patron be caught using one not in accordance with company policy, there might be employment consequences. This could include the employer refusing to reimburse expenses all the way to termination for violating employment policy. Lagging/outdated legal codes could compromise consumer safety, but in many cases, the statues have not caught up with technology or innovation.

13

The rideshare industry faces charges of illegality. To be clear, in many places, specifically Europe, there are two categories within ridesharing: permitted drivers (like UberBlack) and unpermitted drivers (like UberPop, Europe’s version of UberX). Uber is technically illegal in Israel while local provider Gett is not. A number of countries – France, Germany, Italy, Belgium, Netherlands, Spain, and Australia – consider rideshares that employ non-professional drivers illegal. The European Commission, however, is calling on EU member states to ban rideshares only as “a last resort.” Travelers in Turkey may be fined for using ride- or homeshares. South Korea banned UberX and charged senior executives with breaking transportation laws. It is likely that homesharing will face occupancy and/or tourism taxation. Part of the controversy with homesharing is that the traditional hotel industry is required to pay lodging taxes, and an increase in homeshare bookings reduces hotel utility and tax revenues. Many homeshare providers likely do not add hotel or tourism taxes (or pay these taxes to the city), but Airbnb may begin collecting hotel taxes, likely leading to rising costs to patrons. Homeshares might be outright illegal or have heavy usage restrictions in areas zoned as residential. Many cities are deciding on the number of people that can be hosted at once and the number of days per year a residence can be shared. Airbnb has argued that it is not legally responsible when its hosts violate local housing laws and contends that compliance is solely the responsibility of the hosts. These issues are relevant because even patrons can be held accountable for booking an unauthorized homeshare through immediate eviction and hefty fines. And, in cases where homesharing was illegally rented, it is unclear if travel insurance claims would cover re-housing and/or the sunken cost. A recent case occurred in Berlin, in September 2017, where the Berlin Administrative Court overturned a ruling, allegedly to deal with housing shortages for residents, to allow an individual in Pankow district to rent out his home for up to 182 days per year. While there are many homeshare listings posted for Berlin, there is no change to the state’s regulatory law. Attorneys involved in the case have recommended individuals pursue their own legal action to be granted permits. There are graphic placards supporting the #boycottairbnb movement throughout Germany. Similarly, in 2014, Barcelona fined Airbnb about US$35,000 for violating local tourism laws. In 2015, Barcelona fined Airbnb and Homeaway about US$35,000 for offering illegal accommodations (i.e. those without a tourism registry and license, and without taxation). In 2016, Barcelona fined them both nearly US$700,000, the maximum possible fine for being socalled repeat offenders. If homeshares are operating within the legal framework, there are other compliance considerations as well. Airbnb’s usage policy specifically dictates that individual hosts must take responsibility for compliance with civil rights laws and anti-discrimination practices. A 2015 Harvard Business School study indicated that in the U.S., “the prevailing view among legal scholars is that [antidiscrimination] laws likely do not reach many of the smaller landlords using Airbnb.” This is the case in homeshares because guests include their name and a photograph, whereas a traditional hotel does not. The study’s findings included: ‘While [ethnic/racial] discrimination has shrunk in more regulated offline markets, it arises and persists in online markets.” In 2016, a social media hashtag #AirBnBWhileBlack emerged further highlighting potential racial bias in using homeshare. While this study focused on five U.S. cities, it could underscore a larger issue of possible discriminatory practices across the Share Economy when names, profiles, and images are part of the selection process.

14

Policy Approaches from Around the Globe

(source: World Economic Forum, December 2016) Intelligence Collection/Surveillance Uber’s so-called “God View” gained notoriety in 2014 when the then-CEO treated partygoers for a new launch to “see all of the Ubers in a city and the silhouettes of waiting Uber users who have flagged cars.” There were also allegations that the company shared personally identifiable information of users in real time with partygoers. Should this sort of privacy data be expanded upon (or breached) and shared with nefarious entities, this could open users to blackmail or other subversive action. Should rules be different for cleared travelers wanting to use ride- or homeshares? Using homeshares -- where personal effects are left unattended and cannot be secured and covert surveillance is possible -- must be a consideration especially for those involved in proprietary trade secrets. Homeshares generally do not provide safes. Conversely, Western-branded hotels generally do have safes, train staff on respecting customers’ privacy, and have anti-theft provisions in place. China is known for its wide-reaching intelligence collection. The 2017 China CSR: Beijing notes: Activities and conversations in hotel rooms (including meeting rooms), offices, cars, and taxis, may be monitored onsite or remotely. Overt placement of microphones and video cameras are common in Chinese taxis. All personal possessions in hotel rooms, residences, and offices may be accessed at any time without the occupants’ consent/knowledge. Elevators and public areas of housing compounds are also under continuous surveillance. Business travelers should be particularly mindful that trade secrets, negotiating positions, and other

15

business sensitive information may be taken and shared with competitors, counterparts, and/or Chinese regulatory/legal entities. This intelligence collection effort, then, could benefit from access to private residences and vehicles. China has decided “to facilitate the healthy development of the Sharing Economy. The sector will enjoy easier access, greater policy transparency, and better protection of legitimate rights of platform companies, resources providers, and consumers.” The Chinese government’s zealous encouragement of Share Economies should give pause. Should Chinese Share Economies be integrated into security policies or programs, additional measures might be considered to avoid the potential for economic espionage or subversion or infiltration into the whole system. While China is the most ambitious country in developing and promoting Share Economies, other countries that US travelers visit have robust intelligence collection agencies. These include but are not limited to: Russia, Iran, Cuba, and others, including non-state actors, potentially interested competitive intelligence. Mitigation Tools No matter what shared service provider may be used, there are some mitigation techniques that may help reduce the risk to personnel, property, and the bottom line. New policies and frameworks may be needed specifically to accommodate ride- and/or homesharing. Share Information: Regardless of the policy, share reliable news stories or analytic reporting with travelers so that they are aware of possible risks associated with the Share Economy, and provide travelers with resources and guidance on how to avoid these risks. This includes risks associated with particular countries, service providers in those countries, simmering tensions that may impact travelers indirectly, and with individual travelers, as identified in the OSAC benchmarking survey. Communication to travelers should include possible risks associated with Share Economies and traditional hotels/taxis alike along with best practices and risk mitigation strategies (see OSAC IDWG Hotel and Guest House Selection and Security report). Legalities: Some ride- and homeshares operate in a legal gray area. Travelers should confirm whether a provider in a particular place or time is appropriate for them. Legalities may focus on the age or number of guests, the length of stay, the location, and/or patron behavior. Not knowing a local law is generally an insufficient defense to avoid a fine or other penalty. Rating System: eBay's rating system was a model to establish credibility for individual users. The ubiquity of the Internet fosters trust in those who can manipulate it. Online reviews and ratings, especially in large volume, begets confidence in the I think that one of the product or service being offered, despite the feedback biggest contributors to the coming from strangers. Through various social networking success of these services sites, users can validate each other independently, verify has been the transparency content, and identify commonalities. This ability to seek data and trust gained from and mass opinions are the basis for trust, credibility, and peoples personal details transparency in the Share Economy. The online, publicly and personalities being available rating systems do help in identifying and removing accessible via social substandard providers but only after a number of patrons networks. have experience a bad interaction and have taken the time - Anonymous user to complain. For example, if an Uber driver scores an average of less than 4.2 stars, his employment could be 16

terminated, and passengers rated below 3 stars risk difficulty getting a ride. Providers’ livelihoods often depend on positive feedback and may result in communal pressure toward legitimacy. Safety Measures: Brazil's Easy Taxi has gained an edge in that market by more thoroughly vetting local drivers in high-crime cities. Some rideshare providers offer “Ladies Only” driver and passenger options in places where targeted sexual violence might be higher. Many rideshare companies have reporting apps that alert management via SMS message immediately that help ensure passenger safety, driver professionalism, and car viability. Similarly, a built-in feature for rideshares is the ability to share the expected time of arrival, the most efficient route, the driver’s name, photo, and license plate, and the desired destination. Real-time location tracking provides security and transparency in the Share Economy. Geolocation allows for being able to locate traveling staff. With rideshares, this may include sharing the “share my arrival time” app with a colleague or manager. This helps establish legitimacy to the service provider by providing their image and car information and helps to reduce inadvertently hailing an illegitimate taxi. Further, the estimated time of arrival of a car share also allows patrons to avoid milling on a street, instead waiting in a safer space. On the homeshare side, Airbnb has purchased Legitifi technology in an effort to authenticate users. Increasingly, new technologies can assist in tracking traveling employees for safety purposes. Travel and Security departments each are good points of contact to check in with regularly, so that an employee’s location and wellbeing can be confirmed. One operational risk company noted that the integration of employee monitoring with Share Economies will help companies maintain their Duty of Care requirements. Once a plan can be developed, it must be communicated to travelers so that they know they are being monitored/tracked while using authorized shared economy suppliers. Artificial Intelligence: One way to refine – and even to safeguard – the Share Economy is through the introduction of artificial intelligence (AI). AI is an optimal tool because it negates human malfeasance, interference, or manipulation. AI can also filter through Share Economy options to identify needs and preferences. A lovely home posted on a website does not necessarily equate to an honest brokerage of rental. Outright fraud or manipulation of images are extremely easy. Searching for the street address and images independently may help confirm the legitimacy of the property. Online services can also confirm deed ownership to ensure whoever is renting a property actually owns it. Outreach: Many Share Economy providers want to work with international travelers and their sponsoring agencies. Some ride- and homeshare companies even have specific offerings that communicate and interact online with travel management, expense integration, or other administrative offices. For example, Airbnb announced a partnership with Concur in July 2013 to allow business travelers to book and expense homeshare booking options, while Concur and Uber for Business launched a partnership in July 2016 for “In 20 years we won't be ride sharing. Some employers require an assigned corporate able to imagine a world ID numbers to log when booking with homeshares that allows where we didn't have travel management companies some visibility on traveler access to things through locations. Outreach and coordination between preferred collaborative Share Economy providers, internal compliance, travel consumption.” management companies/divisions, and security departments - Sequoia's Greg McAdoo may well be worth the effort.

17

Where to from Here? The biggest concerns, not just found in this paper but in the benchmarking survey as well, focus on risk management and Duty of Care and focus more squarely on homeshares over rideshares. How – and if – private-sector organizations engage with ride- and homesharing depends heavily on internal culture and priorities. Entities with less-structured travel policies may allow unfettered usage, while those that control traveler bookings may not. These findings and consideration may prompt discussions between internal divisions on how to proceed. Ignoring the Share Economy will not mitigate potential problems, especially as more people start to use various providers. Based on current reporting, news accounts, and the OSAC benchmarking survey, formal guidelines focusing on ride sharing seem less of a pressing issue and driven far more in a case-by-case and country-by-country basis than the security and risk mitigation concerns surrounding homesharing on a global scale. A natural first step might be to gauge the traveling population on whether they wish to use Share Economies on work-related travel; which services are desired; under what circumstances or caveats they are willing to operate; and why they are choosing to do so in the first place. For example, the convenience of a smartphone app to hail a ride in a foreign city may be easier, trusted, and more convenient than conventional safety protocols require. This could be assessed by an internal survey or in-person interviews. The traveling population’s responses – those data points -- may prove to be levers for negotiations with traditional service providers to increase their offerings, or they might be beneficial in discussions with Share Economy providers to assist more readily in Duty of Care obligations. Decisions must be made internally on what degree of integration Share Economies should have in travel or security programs. These data points may also be useful for internal discussions of travel and safety policies, their comprehensiveness, and whether existing policies should be revised or updated. Much of safety is common sense, but a policy can reinforce safe (or safer) options. Should adjustments be made, consider identifying specific Share Economy providers that may or may not be allowed, and update that list frequently to include newcomers to the market and new service offerings from permitted vendors. For example, Uber’s founder pointed to driverless vehicles as a next iteration of ridesharing. This may also include a checklist of what security measures homeshares in particular should offer and how to account for per diem allotments. Similarly, those data points may necessitate further discussions -- perhaps formal ones -- on how to redirect Share Economy usage or embrace it into the organizational culture while ensuring minimal vulnerabilities. OSAC’s benchmarking survey may be useful in this decision. Similarly, Advito offers a sample checklist to evaluated Share Economy suppliers that might also be a useful tool. Permitting the use of the Share Economy is highly case dependent. Perhaps unilateral permission or banning may not prove appropriate for an employer, as was the case in 2015 with IBM. Considerations might be made for the service provider, location, duration of travel, travel experience, past experiences with a service provider, and title of each individual traveler. Informal discussions or formal security briefings prior to booking might suffice. Considerations, benchmarking findings, and case studies all suggest, however, that employers proactively incorporate the Share Economy into risk management practices.

18