Coinbase Coronavirus Planning & Comms

797 2020-02-26 12:13

Notes:

  • We will update this doc with additional communications and context as things progress.
  • Some internal links were removed from the doc below, for external consumption.
  • Shoutout to our incredible security and comms teams for proactively addressing this. If you’re interested in working at Coinbase check out our careers page. This is one small example of the work product of these teams.
  • We’re sharing these for external consumption in case helpful to other companies. I’m sure we didn’t get everything right. Please avoid nit picking, but if you have helpful/constructive comments, feel free to send our way on Twitter.

Response Levels Framework

General context

The most important overall context to have here is that we’re planning for a really negative outcome. We don’t expect to see anything like this in reality. Our expectation is that the measured mortality rate (once low-severity cases are included in the overall count) will fall significantly and that we’ll see limited transmission in the west, where there will be fewer high density multi-generational housing situations.

We may also see orgs with very low risk tolerance (e.g. daycares, elder care, etc) take protective measures well in advance of the general population. That may cause pressure on employees who depend on those services, especially daycare.

Triggers and Actions

Phase 1 Triggers

More than 100 instances of in-the-wild person-to-person virus transmission between people who are not close relatives/living in the same house and outside of a hospital setting, occurring within the commuting radius of a given Coinbase office. Measured mortality rate remains 1% or above (10x the seasonal flu). Observed transmission rate remains above 1.5.

Phase 1 Actions

  • We may ask certain populations of employees to WFH in the impacted area (e.g. if there is a hotspot of transmission)
  • We will offer optional WFH for all employees in the impacted area (especially important for those with potentially vulnerable populations at home, the very young, very old or those with otherwise compromised immune systems).
  • We will enhance office cleaning schedules to be more frequent/in-depth, especially around areas of high traffic (elevators, meeting rooms, bathrooms, food areas) along with specific mask disposal bins.
  • We will limit office visitors to essential personnel only (and work with recruiting to e.g. move interviews to video calls where possible)
  • We will ask all leaders to start making plans for continuity of operations/identification and movement of critical workloads/personnel to other offices or to WFH.

Phase 2 Triggers (aka local containment is failing)

More than 1000 events as above or any government quarantine actions in the commute range of a Coinbase office. Measured mortality rate remains 1% or above (10x the seasonal flu). Observed transmission rate remains above 1.5.

Phase 2 Actions

  • We’ll work with individual business owners to execute their critical workload movement plans to whatever office seems least impacted.
  • stop meal service in impacted office(s). Potentially moot, as we expect most employees will be voluntarily wfh at this point.
  • stop all visitors to the office(s) OR institute a visitor health screening program (e.g. airport style infrared camera in the office lobby + basic screening questions). Again, may be moot.

Phase 3 Triggers (aka containment has failed, it’s going to be a wild ride)

More than 5000 infections with an increasingly upward trend (Doubling interval is 10 days or less). Measured mortality rate remains 1% or above (10x the seasonal flu). Observed transmission rate remains above 1.5.

Phase 3 Actions

  • mandatory WFH in the impacted area(s)
  • All workload movement plans executed, including potential relocation of essential personnel outside the danger area.
  • at this level, I’d expect our ability to use 3rd party services like cleaning, snacks, etc to start to break down because of fear driven absenteeism.
  • I’d also expect to see regional isolation in the impacted area

Communications

Feb 24, 2020 Communication

To: [email protected]

Subject: An update on the coronavirus

Hey all,

Tl;dr:

  • We continue to believe the risk of COVID-2019 coronavirus to most employees is low, with a slightly elevated risk to our team in Japan.
  • Even so, we’re now suggesting that individuals should start doing some simple contingency planning.
  • Business travel to China and Hong Kong is still restricted. Additionally, we have added Japan, Italy, and South Korea to the business travel restricted list.
  • Please flag any personal travel to—or layovers in—countries on the restricted list to GSOC so we can help you make a plan (instructions here).
  • Stop by #ask-security with questions and for weekly updates.

It’s been three weeks since our last email update, so I wanted to provide an update both around what is known about COVID-19 and what Coinbase is doing.

We still do not see community transmission in or around Coinbase offices, with the exception of our Japan office. For Japan specifically, we’ve put our tier 1 response plan into place (see below for more) and, among other things, are encouraging everyone in that office to work from home.

However, given the continued spread of COVID-19, we feel that it is reasonable for individuals in locations not yet impacted by the virus to begin some personal contingency planning and preparation. In the event of a local transmission hotspot, the key to safety will be “social distancing,” aka making sure we give the virus limited means to spread person-to-person. You may also see moves from local governments to put travel restrictions in place. Your preparations should focus on what will enable you to minimize your contact with and dependency on others. In particular, we encourage people to ensure they have adequate supplies of food, medicine (in particular, prescription medication) and critical household goods (think batteries, trash bags, hygiene supplies, etc.) to last at least 30 days.

What we know

We’re continuing to monitor the situation closely and gather data from primary sources where possible (including the World Health Organization, Centers for Disease Control and Prevention, local public health offices and retained consultants).

COVID-19 is a type of coronavirus. It is primarily transmitted by aerosolized droplets (e.g. the droplets you release when you cough or sneeze. These droplets can travel over 6 feet if you don’t cover your mouth and nose effectively!), much like the flu or a cold. It may also be transmitted via fecal matter (even very small/invisible amounts). The virus can survive for some amount of time outside the human body, although the specific parameters are not yet known, so transmission can occur by touching a surface contaminated with the virus and then touching your eyes/nose/mouth.

Unlike most other coronaviruses, the period of maximum contagiousness appears to occur early in the virus’ life cycle, somewhere between 1 and 3 days after the first sign of symptoms. Some number of individuals that contract coronavirus remain asymptomatic, but can still spread the virus (although we don’t know how common this is). The virus’ incubation period appears to be somewhere in the 5-7 day time period on average, but has a fairly wide range ( summary of research ), and likely depends to a large extent on where the virus lands in a given host (e.g. did the virus get transmitted via someone rubbing their eyes and has to work it’s way to the respiratory tract, or did it land in the lungs directly and can get right to work). According to a study by the CDC in about 80% of cases, symptoms are mild and look a lot like the flu or other viral respiratory illness and may include coughing, fever, body aches, etc. This category of cases generally self-resolve with little to no medical intervention. About 14% of cases develop severe symptoms (including pneumonia or shortness of breath). This category of cases will require medical care, but probably not intensive care. About 6% develop critical symptoms (shock, respiratory failure, etc). This category of cases will require care in an ICU or similar.

The Case Fatality Rate (CFR, the percent of cases that result in death) is impossible to determine reliably at this point. The WHO quotes a 2% rate, but caveats it extensively. The latest published paper ( summary ) addressing the topic breaks the CFR down by age group and quotes between a 0.2% and 0.4% CFR for ages 0-40 and significant jumps for groups older than that. The most at risk populations appear to be the very old and those with already weak immune systems. The paper above also addresses comorbid conditions, with the highest CFR being those with Cardiovascular disease at just over 10%, and the lowest being those with no pre-existing conditions at 0.9% (across all age groups).

What we’re doing

We’re continuing to restrict business travel to China and Hong Kong. As of this week, we’re adding Japan, Italy, and South Korea to the business restricted list, as well as mandatory WFH measures to employees returning to Coinbase offices from Japan, South Korea and Italy for a period of 7 days. If you’re planning personal travel to—or layovers in—any country on the restricted list, please reach out to @GSOC so we can work with you. You can find instructions for flagging travel for us here.

We have a standing Crisis Management Team continually reviewing new information as it comes in. We have established a four tier escalation ladder (from tier 0 to tier 3) for response to changes that impact Coinbase offices. The primary criterion for moving up the ladder is the number of community transmission events within a commute radius of a Coinbase office. All Coinbase offices except Japan are at tier 0. Tier 0 includes improved sanitation measures (both in terms of office cleaning and in terms of making things like hand sanitizer available) as well as continuous risk monitoring via a crisis management team. At tier 1, which is currently active for the Japan office, we encourage as much work from home as possible, limit in-office meetings, visits and services and make or review concrete plans to move critical workflows to offices that are not impacted. At tier 2 we close the office to non-essential personnel/activities/events and execute those workload movement plans. At tier 3 we lock down the office entirely, and go to 100% mandatory wfh.

We’ll continue sharing weekly updates on the coronavirus situation in #ask-security, so please join that channel to ask any questions you might have beyond the below FAQs. If you have questions that are specifically about work travel, please post those in #ask-travel.

Thanks,

[Name]


Employee FAQs:

What IS a coronavirus?

“Coronaviruses” are nothing new. This specific strain started being called “2019-nCoV” and is now designated “COVID-19”. “MERS” and “SARS” were also Coronaviruses with similar spread and impact, but the common cold is also a coronavirus.

COVID-19 is primarily transmitted by aerosolized droplets (e.g. the droplets you release when you cough or sneeze. These droplets can travel over 6 feet if you don’t cover your mouth and nose effectively!), much like the flu or a cold. It may also be transmitted via fecal matter (even very small/invisible amounts). The virus can survive for some amount of time outside the human body, although the specific parameters are not yet known, so transmission can occur by touching a surface contaminated with the virus and then touching your eyes/nose/mouth. Unlike most other coronaviruses, the period of maximum contagiousness appears to occur early in the virus’ life cycle, somewhere between 1 and 3 days after the first sign of symptoms. Some number of individuals that contract coronavirus remain asymptomatic, but can still spread the virus (although we don’t know how common this is). The virus’ incubation period appears to be somewhere in the 5-7 day time period on average, but has a fairly wide range ( summary of research ), and likely depends to a large extent on where the virus lands in a given host (e.g. did the virus get transmitted via someone rubbing their eyes and has to work it’s way to the respiratory tract, or did it land in the lungs directly and can get right to work). According to a study by the CDC in about 80% of cases, symptoms are mild and look a lot like the flu or other viral respiratory illness and may include coughing, fever, body aches, etc. This category of cases generally self-resolve with little to no medical intervention. About 13% of cases develop severe symptoms (including pneumonia or shortness of breath). This category of cases will require medical care, but probably not intensive care. About 5% develop critical symptoms (shock, respiratory failure, etc). This category of cases will require care in an ICU or similar.

Where are we banning business travel?

We’re currently restricting travel to China, Hong Kong, Japan, Italy, and South Korea.

Why isn’t Singapore on the banned business travel list?

Singapore has done a really good job of tracking where their cases have come from, and as a result we’re not seeing a lot of transmission “in the wild” there, so we don’t believe that there is currently a reason to ban business travel there.

Have any employees been traveling in impacted regions?

Several employees have recently traveled to impacted regions, and we are working actively with them to plan for their re-entry to the company in a way that maximizes safety for all other Coinbase employees.

Have any Coinbase employees been infected with coronavirus?

No.

What kind of precautions should I be taking?

Beyond travel restrictions, the best preventative measures to take are the same as with the common cold or the flu:

  • Washing your hands frequently (after traveling on public transportation, before and after eating…)
  • Coughing/sneezing into your elbow, not your hand
  • Arranging with your manager to WFH or take sick time as appropriate, if you have symptoms

See more: CDC Prevention Guidelines

(References from the CDC, ISOS, and WHO.)

Other companies seem to be doing more than we are. How are we sure this is the right approach for us?

We’ve been benchmarking (and working directly with) myriad other companies across several industries. In each case we observed that the risk exposure to these companies varies greatly based on operations in the most heavily impacted regions (e.g., Disney has actual operations in China). This is to say that those teams are assessing the risk likelihood and impact in the same manner we are. Companies with sustained, numerous operations or travellers in China are at a much greater risk than Coinbase. Still, their approach is often in line with ours and we are confident we are enacting the right strategies at this time to protect Coinbase employees. We will continually be reassessing the situation and adjusting our strategy accordingly.

Do we stock masks in each office? Should I wear one?

We have sufficient N95 masks stocked in the San Francisco and New York offices, and more will arrive in our other offices in the next few days. That said, we are not suggesting that anyone needs to wear masks, either inside or outside of the office. Evidence suggests that since the general public isn’t trained on how to properly wear or dispose of masks, the benefit of wearing one is low, and the CDC doesn’t recommend it. We want you to make the best informed decisions possible, so it’s up to you whether or not you choose to use a mask.

Do we stock hand sanitizer in each office?

Yes. Each office stocks sanitizer at reception, and depending on the office, in other areas as well. In addition, the Workplace Experience team has installed hand sanitizer stations in San Francisco, with other offices soon to follow.

What would need to happen for us to change our current approach? What happens if this gets a lot worse?

We have a standing Crisis Management Team continually reviewing new information as it comes in. We have established a four tier escalation ladder (from tier 0 to tier 3) for response to changes that impact Coinbase offices. The primary criterion for moving up the ladder is the number of community transmission events within a commute radius of a Coinbase office. All Coinbase offices except Japan are at tier 0. Tier 0 includes improved sanitation measures (both in terms of office cleaning and in terms of making things like hand sanitizer available) as well as continuous risk monitoring via a crisis management team. At tier 1, which is currently active for the Japan office, we encourage as much work from home as possible, limit in-office meetings, visits and services and make or review concrete plans to move critical workflows to offices that are not impacted. At tier 2 we close the office to non-essential personnel/activities/events and execute those workload movement plans. At tier 3 we lock down the office entirely, and go to 100% mandatory wfh.

As the shape of this health crisis expands, how are we thinking about precautions for each affected country and each Coinbase office?

See above for our escalation ladder, but in general, we’re evaluating quarantine protocols on a by-location basis, focusing not just on headlines, but on the underlying data. We are also factoring in our specific risk factors at Coinbase, including company operations and employee travel. We use all of these inputs to make informed risk assessments for each of our office locations, and we will continually be reassessing the situation and adjusting our strategy accordingly. If you’re wondering about a specific country and associated risk level, feel free to reach out to us in #ask-security.

What sort of office cleaning standards and frequency do we have in our offices?

All Coinbase have cleaning crews that ensure our offices meet a standard of cleanliness. Deep cleaning in all offices are done either on a nightly or weekly basis depending on the size of the office.

In San Francisco specifically, our ABM and Flagship teams thoroughly clean and sanitize common areas throughout the day. Their focus during the day is to keep common areas clean and tidy as the areas are used. Common areas are defined as conference rooms, pantries, restrooms, print stations, high traffic walk-ways, reception, and cafe, among others.

At night our cleaning staff do a deep clean of all common areas and any other surfaces that are considered shared spaces. Our ABM and Flagship teams are also responsible for keeping janitorial areas clean and sanitized to prevent the spread of any germs.

What about the people being treated at Bay Area hospitals? Is this a risk?

There are people being treated for coronavirus at Bay Area hospitals (including UCSF and a hospital in the area of Travis Air Force base, where returnees from Wuhan are currently quarantined). Hospitals and their employees have been preparing to manage the treatment of coronavirus for weeks now, and we don’t believe the treatment of cases in the area is impacting risk for our employees.

If the risk is still low in my area, why are you suggesting I start accumulating supplies?

Being over-prepared is better than being under-prepared, and preparing before you absolutely need to allows you to avoid competition with all the late preppers. The earlier you get it done the easier it is, and the less stress you’ll feel. Additionally, the supplies we’re suggesting you stock up on are supplies you should have on hand anyway in order to effectively weather any regional disaster.

What supplies should I start putting together?

Ready.gov has a good list to use as the starting point for building a disaster supply kit. This basic kit is designed to help you self-sustain for 3 days post-disaster (hurricanes, earthquakes, etc) until the government and aid workers can get help to you. Unlike natural disasters, outbreaks tend to have a longer-lasting impact due to recommended or mandatory “social distancing” (read: self-quarantine). This can last for 30 days or more. As such, we encourage you to plan to self-sustain for at least 30 days. If you build this kit, you will not only be preparing for its potential need because of COVID-19, but future emergencies as well.

What other lifestyle changes should I be making to keep myself and my family safe?

It depends. Essentially, you should decide on the appropriate risk posture for you and your family based on your personal situation. For example, mortality rates for COVID-19 are highly correlated with age —the older you are, the more dangerous it is. They also increase for people with compromised immune systems (respiratory disease, cancer, etc.). So if you live with someone in their 80s, you might want to take a more conservative stance, like limiting personal travel, or not going on a cruise.

If we’re having employees returning from Japan, South Korea, and Italy work from home for seven days, should we also limit contact with people we know personally who are returning from those countries?

Again, that depends on your personal risk posture. If you’ve got people in your life who are in at-risk populations, you might choose to do this, as well as limiting your own travel.

If I need to flag a layover in one of the restricted countries, does that mean I need to change my flights?

Not necessarily. Please reach out to GSOC and we’ll assess current screening measures at the airport that you’re flying through. Some airports are doing an exceptional job screening travelers, but we want to know where you’re at in the world so we can help you make the right risk-adjusted plan.

Are we banning these countries for PTO as well?

Not currently, but we do need you to flag any personal travel to these countries (process here). Also please be aware that we will ask you to work from home for seven days after traveling to any of these countries for personal reasons.

如果这篇文章对你有帮助

在 Twitter 上 Follow 我 :)

下载 硅谷io App

关注互联网创业,用移动 App ,随时随地收藏和复习好文章