One of his challenges will be to pay $1.2B in interest payments every year while also making good on the principal. That's quite a bit of debt for a struggling financial situation. Cutting HC will help in the short term; it is unclear if those cuts will be well executed. HN opinion that twitter could run with 200 engineers is woefully naive for a massive company that is under FTC consent order - they probably have >200 privacy engineers (and associated legal staff) just to comply with regulations.
The consent decree requires that the company be 5x as large as it otherwise would. It really, really, really slows down development. For every engineer, there is also a corresponding engineer whose job is to slow them down.
IT IS ORDERED that respondent... establish and implement, and thereafter maintain, a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of nonpublic consumer information.
Computer security 101 says that there should be one set of checks for the information (parsimony of mechanism), all access go through that mechanism (complete intermediation), and as few people/things have access to the data as possible (least privilege).
Making sure all private data goes in the vault and the vault is secure shouldn't take more than 1% of an organization the size of Twitter. Even if they're doing it poorly, it shouldn't be more than 10%.
If it really is 5x (> 80% of their engineering budget), I guarantee you they are in violation of the consent decree -- there is no way to vet that many engineers or audit their work!
5x may be hyperbole, but every change you make has to go through a privacy review. Sometimes even proposing to make a change can be met with great friction.
Any security architecture that requires every single engineer has to do everything exactly right 100% of the time is bound to fail. The order to put in reasonable privacy protections doesn't say "and do it in the most expensive, error prone fashion possible".
It’s actually pretty standard operating mode for many big tech adjacent, regulated industries. They don’t necessarily expect you to be 100% perfect, but they do expect you to build in such a way that their privacy tools can inspect things and you get urgent tasks filed if something doesn’t meet spec.
What they want is additional work, and technical implementation that the agreements are being enforced in code. It’s a fascinating area for a career, but the tools are not well developed and engineers not trained to code this way. Ends up being like a 40% tax on a lot of peoples work, plus the people who write and operate the verification systems.
It’s probably what the security field should have done years ago, but there were never as expensive of fines as for privacy violations.
The bankers aren’t naive, they modeled this out. Sure it could go bad and I wonder if Elon PG’ed (personal guarantee) the debt, but you don’t underwrite your a default out of the gate. It’s one of the worst faux pas of debt capital markets.
He's really not. The banks are only involved so that he doesn't have to sell as much of his Tesla shares. And that's to say nothing of his private ownership of SpaceX, probably also worth a decent chunk.
The covenants on a low leverage transaction are likely highly limited: a)make interest payments, b) make principal payments, c) don’t make illegal dividends, d) don’t cross certain covenants such as EV/EBITDA, fixed charge coverage ratio, or similar, and e) get an audit every year and submit financials to the banks every 90 days.
Not exactly onerous since they were a public company before.
