Over the past two days, we have noted what appear to be large problems with the pledging of time to the WordPress Five for the Future program. That is important as the head of WordPress was criticizing a competitor of this for-profit company, Automattic, over there much smaller pledging to that. One thing that we found was that Automattic is pledging time to a group that appears to have been inactive for over two years. We also found that a team with 14 listed members had 338 people pledging contributions to the team. It turns out the divergence between members and pledges can go even higher than the 24 times for that team.

On July 25, an update was put out for the Community team stating that there were 60 people that contributed to the team:

As part of the Five for the Future promotion, we will disclose the number of members who contribute to the community team.
60
(The current number of Program Managers, Program Supporters and Event Supporters.)

At the time, the page for the team stated there were 2309 people pledging time with the team:

That is over 38 times the actual number of people contributing to the team. So not a minor discrepancy.

So the problem grows wider as we look further into this.

The page for the program doesn’t mention who is in charge of it. Looking at Team Updates section of make.wordpress.org, we found that the last two updates on the team were done by Automattic employees. That is rather concerning. If this is going to be used by the head of Automattic to compare other companies to his, as he is already doing. Looking over the numbers, they seem like they should have raised eyebrows as to the accuracy of the pledges.

The overall numbers displayed both times should have raised red flags. Here there were as of September 1:

• 8,314 self-sponsored contributors have pledged 116,530 hours
• 905 company-sponsored contributors have pledged 7,838 hours

What we saw with non-legitimate looking pledges is that there appeared to overwhelmingly be from self-sponsored contributors. The numbers there bear that out. Not only is the vast major of pledges not for company-sponsored contributors, but there is a large discrepancy in the average hours. The self-sponsored contributors are pledging an average of 14 hours, versus 8.7 hours of company-sponsored contributors. Legitimate self-sponsored contributors could, on average, provide more hours, but that is a huge discrepancy. It looks even less legitimate when you consider it across a much larger group of people is.

The author of that post is an Automattic employee and credited Automattic employee for input.

Later in September, the author of that post wrote another post that is heavily focused on data analysis. So it is hard to believe they would could have missed the issue.

Here are the previous numbers from May 23:

• 8,102 self-sponsored contributors have pledged 114,001 hours
• 897 company-sponsored contributors have pledged 7,926 hours

The company-sponsored contributors increased between May and September, but the number of hours decreased. By comparison, the number of self-sponsored contributors increased, and the time increased. The additional self-sponsored contributors were averaging 12 hours for each additional contributor. While the new company-sponsored contributors had negative hours on average. Obviously, they couldn’t have negative hours, other contributing were either decreasing their hours or high-hour contributors were dropping out.

What also stands out looking at the data shown is that they reporting the “percentage of sponsored contributors pledged to 5ftF who logged into WordPress.org in the past 3 months.” They don’t do that self-sponsored contributors. Presumably they would have that information to show, but they haven’t. The number in the September post was 80.33%. The number dropped to 62.63% “percentage of organizations with at least one Active 5ftF Sponsored Contributor (with w.org profile activity in the past 3 months).”

The author of that post is an Automattic employee and credited two other Automattic employees for input.

This program really needs to have a group independent of Automattic providing oversight of it, because it is in a rather troubled state at this point. And Automattic, at best, has completely missed it.

Considering the extent that WordPress has become an arm of Automattic, their employees missing obvious concerns on something so public raises concern about how things are going in other areas, including security.