#jira

Lukasz has told us that most of the material comes from Tesla’s project management system Jira, developed by Australian software company Atlassian. It’s widely used – according to Atlassian – by more than 100,000 companies around the globe. Tesla competitors like Audi and BMW use it, as do Deutsche Bank and Twitter. By chance, we learn during a conversation in the newsroom kitchen that Handelsblatt uses Jira too – not in editorial, but in other departments. It’s a reminder that office small talk can be valuable. A new path opens: maybe our own colleagues can help us make sense of the inner workings of Jira.

Originally built for software developers, Jira allows users to create ‘tickets’ – tasks that can be assigned to others, tracked, and documented collaboratively. It’s meant to streamline work across teams and offices. According to our files, Tesla uses Jira far beyond engineering. Tickets cover everything from battery modules to insurance claims to customer-service quality. Many carry tags like ‘Business Critical’ or ‘HR-Confidential.’

A ticket from New York, dated April 3, 2021, asks whether HR reports could include fields like ‘Ethnicity,’ ‘Hispanic or Latino?’ and ‘Military Status.’ In San Francisco, a technician reports a furnace leaking a ‘pudding-like dross’ on November 4 of the same year. Seven weeks later, a staffer in Barcelona asks for help from the security team. A colleague had emailed to report that the service center in Norway had been left ‘unarmed since Sunday’ because the alarm system wasn’t working. Eventually, someone from the Gigafactory in Germany steps in remotely.

There’s an old trick in business journalism: compare what a company does to what it says it does. Now that we’ve combed through the Tesla Files, we check what the automaker publicly claims about data handling. We can’t help but smirk. All data collected, created, or stored by Tesla ‘must be kept confidential,’ the company states on page 9 of its Code of Ethics – because that information ‘contributes to Tesla’s business success.’ Employees are reminded that ‘the outside world is intensely interested – and in some cases borderline obsessed – with what we do at Tesla.’

One internal policy outlines how to handle sensitive data: personal information such as Social Security numbers or passport IDs may only be shared with a password and with a supervisor’s permission. Access is to be granted solely on a strict ‘need to know’ basis. According to the same document, Jira tickets – due to their ‘sensitivity and risk to Tesla if mishandled’ – are ranked among the highest security levels. Mishandling can result ‘in disciplinary action, up to and including termination of employment.’ By that logic, Jira is the right choice. It’s designed to give users highly specific access rights. Atlassian promotes this as a key feature that allows users to ‘control what users within those applications can see and do.’ But how exactly Tesla configured those settings – and how we can verify this – is unclear. We turn to our colleagues at Handelsblatt who manage Jira internally. Normally, editorial and business operations are strictly separated to protect journalistic independence. But in this case, the business side might hold the key. Our colleagues explain how Jira permissions are managed – and even offer to contact Atlassian support for more technical answers. We don’t mention Tesla. Within a week, we get a reply.

Atlassian recommends using ‘security levels’ to control access. That means tickets and attachments can be made visible only to specific users, departments, or project teams. These levels are visible in the ticket’s source code.

Since our Tesla Jira tickets are saved as archived web pages, we can check their source code. In nearly all of them, we find this fragment: Security Level – Viewable by All value = Viewable by All Users. It sounds like a breakthrough. We take it as confirmation: Jira tickets at Tesla were visible to anyone inside the system. But a closer look at the source code undermines our assumption. The setting doesn’t govern the entire ticket – only the comment section. When Tesla employees write a comment on a ticket, they can choose who’s allowed to read it. The default is ‘Viewable by All Users.’

It’s one of those moments in the Tesla investigation where everything seems to grind to a halt. How can we prove Lukasz’s account if we still can’t talk to Tesla insiders – the only people who could truly confirm the authenticity of the data? The alternative route was through technical analysis. But the evidence we hoped for has just slipped away.

— The Tesla Files by Sönke Iwersen, Michael Verfürden (29%)