Today marks the conclusion of a years-long saga that started when John Oliver did a segment on Net Neutrality that was so popular that it brought the FCC’s comment system to its knees. Two years later it is finally near addressing all the issues brought up in an investigation from the General Accountability Office.

The report covers numerous cybersecurity and IT issues, some of which the FCC addressed quickly, some not so quickly, and some it’s still working on.

“Today’s GAO report makes clear what we knew all along:  the FCC’s system for collecting public input has problems,” Commissioner Jessica Rosenworcel told TechCrunch . “The agency needs to fully fix this mess because this is the way the FCC is supposed to take input from the public. But as this report demonstrates, we have real work to do.”

Here’s the basic timeline of events, which seem so long ago now:

• May 2017: John Oliver’s segment airs, and the next day the FCC claims it was hit by denial-of-service attacks that took down its comment system, ECFS. (In fact it was merely the sheer volume of people who wanted to share their opinion of the FCC’s plan to kill net neutrality.)
• July 2017: Despite calls for details, the FCC refuses to release any details on the cyberattack, despite Congressional demands, saying the threat was “ongoing.” (Its investigations had not in fact determined malicious intent and its official account was in doubt internally from the start.)
• August 2017: Congress calls for an independent investigation of the FCC’s claims and its comment system. (That’s the report released today. Also around this time another improbable “hack” was found to have (not) happened in 2014.)
• October 2017: FCC’s chief information officer, David Bray, who claimed the attacks took place both in 2017 and 2014, leaves the FCC.
• December 2017: The FCC votes along party lines to kill net neutrality.
• June 2018: A watchdog group acquires 1,300 pages of emails, which (though very heavily redacted) show that the DDoS claims were essentially false and known to be so.
• August 2018: The FCC finally admits that it was never hacked, and the next day its own internal report comes out showing that it really was just overwhelming interest from people wanting to be heard. Members of Congress accuse Chairman Ajit Pai of “dereliction of duty” in perpetuating this dangerously incorrect narrative.

Then it’s pretty quiet basically until today, when the report requested in 2017 was publicly released. A version with sensitive information (like exact software configurations and other technical information) was internally circulated in September, then revised for today’s release.

The final report is not much of a bombshell, since much of it has been telegraphed ahead of time. It’s a collection of criticisms of an outdated system with inadequate security and other failings that might have been directed at practically any federal agency, among which cybersecurity practices are notoriously poor.

The investigation indicates that the FCC, for instance, did not consistently implement security and access controls, encrypt sensitive data, update or correctly configure its servers, detect or log cybersecurity events, and so on. It wasn’t always a disaster (even well-run IT departments don’t always follow best practices), but obviously some of these shortcomings and cut corners led to serious issues like ECFS being overwhelmed.

More importantly, of the 136 recommendations made in the September report, 85 have been fully implemented now, 10 partially, and the rest are on track to be so.

That should not be taken to mean that the FCC has waited this whole time to update its commenting and other systems. In fact it was making improvements almost immediately after the event in May of 2017, but refused to describe them. Here are a few of the improvements listed in the GAO report:

Representative Frank Pallone (D-NJ), who has dogged the FCC on this issue since the beginning, issued the following statement:

I requested this report because it was clear, after the net neutrality repeal comment period debacle, that the FCC’s cybersecurity practices had failed. After more than two years of investigating, GAO agrees and found a disturbing lack of security that places the Commission’s information systems at risk… Until the FCC implements all of the remaining recommendations, its systems will remain vulnerable to failure and misuse.

You can read the final GAO report here.

The coronavirus has decimated the travel industry, and Airbnb, the home rental company that appeared unstoppable not so long ago, has not been spared.

While the headlines have focused on the measures it’s taking to stockpile cash to offset its losses, behind the scenes, the nearly 12-year-old company has been busily redesigning its products. These include rethinking its home screen and app landing pages to reflect a world where short-term stays are out and longer-term stays — including for medical professionals needing to quarantine themselves from their families — are in.

We talked with Airbnb’s chief design officer, Alex Schleifer,  this morning to learn more about what’s been changing behind the scenes and how. Our chat has been edited lightly for length and clarity.

TC: Airbnb’s home page is suddenly very focused on three things — online experiences, monthly stays, and what you’re calling “frontline,” which is an area for hosts to offer housing to healthcare staff and first responders. What was that design process like and how long did it take?

AS: Our team mapped it out in under three weeks. There were a couple hundred employees working on the project at any point in time — people from ops, products, localization, design, policy, engineering. It’s a complex operation (here); everything we need to do needs to be done in 60 languages. Because of the scale of everything we do, the idea is often the easiest piece.

The difficulty was [sharpened] because the crisis was also impacting us. Everyone was working from home. There were questions around how do we do childcare, for example. But there was still immense energy, including because we had thousands of hosts contacting us and saying, ‘We want to help.’

TC: Where exactly do you start on a redesign like this one?

AS: You define the scope of it. You could put a banner on your home page, or you can start talking with hosts and governments to understand what kind of help they need and whether this is something they want, then you start building. Part of that is looking at the behavior of the guests on our platform in real time, which changes every day. It’s also a matter of talking with other travel partners and seeing what they are doing.

Ultimately, we [decided to take] over a pretty large amount of real estate so frontline workers know where to go. They also use our core search, but we want to make sure they have specific space for people who want to donate space or support the program. We had a goal of 100,000 homes that would be provided, but we beat that goal faster than we thought we would.

TC: Are these spaces being offered at no cost?

AS: They are donated or offered at reduced pricing.

TC: Another new section now centers around ‘online experiences.’ These are hosts who are offering their own classes on cooking and other things?

AS: Yes, like “Sangria mixing with Pedro,” which is a cocktail mixing show with a lot of entertainment. Airbnb is all about connection — it’s built on hosting. But if not everybody is able to travel, the question becomes: what are our options here? We discussed a lot of ideas, but the way we were working and connecting as a team [remotely] and living online with family made this idea more concrete for us. So we contacted hosts, did trial runs with these hosts with mic set-ups [and everything else required], and launched with 50 people. Now, we have nearly 100 hosts offering experiences online and thousands more who’ve offered to host experiences. Some of the most popular offerings — which aren’t one-to-many experience where you are watching a show but rather an interactive experience — are already sold out.

(Above, Airbnb’s homepage before the updates.)

TC: Do you see this becoming a sizable piece of Airbnb’s business going forward?

AS: It’s only a few weeks old, but even for a product in its first version, we were really enjoying this. It has beaten expectations, and I do think it will be a huge business for us as we get out of the pandemic because it allows hosts to host both online and real-world experiences.

TC: I’m sure a lot of ideas have been batted around. How are you choosing what to circle around?

AS: We’re lucky to sit on a lot of data, but you can only test so much. You need really strong and fast decision-making, so leadership and the executive team would meet daily.

The other thing that as a designer I appreciate is we made sure to remove abstract layers of communication. We wouldn’t just load up a Google doc but we made it real using [the collaborative interface design tool] Figma to look at all the designs and quickly prototype and screen-share, whether with the experiences team or me or [CEO] Brian [Chesky], to see what customers would see and make decisions.

TC: You mention Figma. What other tools have you been relying on more heavily as you work from home?

AS: We like to use as few tools as possible, but Figma is a game changer because people can see decisions being made live. Google Docs is really powerful for us. Slack also allows us to work asynchronously, which is important. And Zoom has been critical to everyone.

TC: Things are changing by the day. Parts of the world are opening while others remain shut. How is this impacting your work?

AS: We built the product and site to be really modular and also targetable by region because you’re right, the world will open up on different schedules with different restrictions and permutations and we want to make sure we can offer to people what is available to them. In some cases, they might be [hampered by] travel within a certain distance, or air travel might not be open, so we want to help people to find things that are close by.

We’re also building other pieces continuously, some in direct response to the crisis, including a hub that communicates to our guests and hosts what’s happening with travel and what happens after the storm.

As a global company, we’re pretty used to [adapting to change]. Of course, this is a different scale.

As a small business owner, I was excited to learn about the $2.2 trillion Coronavirus Aid, Relief, and Economic Security Act that offers low-interest loans to firms impacted by the COVID-19 pandemic. However, as I read through the details and began to apply, it became clear that this legislation — while well-intentioned — may not be enough to help many SMBs and startups.

Here’s a quick recap of my experience.

Emergency Economic Injury Grants and Economic Injury Disaster Loans

First and foremost: You need to act swiftly. Emergency Economic Injury Grant and Economic Injury Disaster Loan programs included in the CARES Act function on a first-come, first-served basis, and are funded from a limited pool of resources.

I began my company’s application process by submitting our EIDL and EEIG applications through the SBA website. This was easy, if tedious. It took about two hours to complete the necessary online forms and about two seconds to click the EEIG checkbox. Submission was seamless, but I haven’t received any further communication from the SBA since completing my application, which is a bit confusing — EEIG funds are supposed to be dispersed within 3-5 days of the submission date.

However, I know there’s been a huge volume of submissions recently and this must be exceptionally difficult to handle. I look forward to any email correspondence or updates from the SBA that might give me — and other applicants — an updated estimate of the expected dispersal timeline.