Author: azeeadmin

Asia’s venture capital-backed startups are gunning for Starbucks .

In China, the U.S. coffee giant is being pushed by Luckin Coffee, a $2.2 billion challenger surfing China’s on-demand wave, and on the real estate side, where WeWork China has just unveiled an on-demand product that could tempt people who go to Starbucks to kill time or work.

That trend is picking up in Indonesia, the world’s fourth largest country and Southeast Asia’s largest economy, where an on-demand challenger named Fore Coffee has fuelled up for a fight after it raised $8.5 million.

Fore was started in August 2018 when associates at East Ventures, a prolific early-stage investor in Indonesia, decided to test how robust the country’s new digital infrastructure can be. That means it taps into unicorn companies like Grab, Go-Jek and Traveloka and their army of scooter-based delivery people to get a hot brew out to customers. Incidentally, the name ‘Fore’ comes from ‘forest’ — “we aim to grow fast, strong, tall and bring life to our surrounding” — rather than in front of… or a shout heard on the golf course.

The company has adopted a similar hybrid approach to Luckin, and Starbucks thanks to its alliance with Alibaba. Fore operates 15 outlets in Jakarta, which range from ‘grab and go’ kiosks for workers in a hurry, to shops with space to sit and delivery-only locations, Fore co-founder Elisa Suteja told TechCrunch. On the digital side, it offers its own app (delivery is handled via Go-Jek’s Go-Send service) and is available via Go-Jek and Grab’s apps.

So far, Fore has jumped to 100,000 deliveries per month and its app is top of the F&B category for iOS and Android in Indonesia — ahead of Starbucks, McDonald’s and Pizza Hut .

It’s early times for the venture — which is not a touch on Starbuck’s $85 billion business; it does break out figures for Indonesia — but it is a sign of where consumption is moving to Indonesia, which has become a coveted beachhead for global companies, and especially Chinese, moving into Southeast Asia. Chinese trio Tencent, Alibaba and JD.com and Singapore’s Grab are among the outsiders who have each spent hundreds of millions to build or invest in services that tap growing internet access among Indonesia’s population of over 260 million.

There’s a lot at stake. A recent Google-Temasek report forecast that Indonesia alone will account for over 40 percent of Southeast Asia’s digital economy by 2025, which is predicted to triple to reach $240 billion.

As one founder recently told TechCrunch anonymously: “There is no such thing as winning Southeast Asia but losing Indonesia. The number one priority for any Southeast Asian business must be to win Indonesia.”

This new money comes from East Ventures — which incubated the project — SMDV, Pavilion Capital, Agaeti Venture Capital and Insignia Ventures Partners with participation from undisclosed angel backers. The plan is to continue to invest in growing the business.

“Fore is our model for ‘super-SME’ — SME done right in leveraging technology and digital ecosystem,” Willson Cuaca, a managing partner at East Ventures, said in a statement.

There’s clearly a long way to go before Fore reaches the size of Luckin, which has said it lost 850 million yuan, or $124 million, inside the first nine months in 2018.

The Chinese coffee challenger recently declared that money is no object for its strategy to dethrone Starbucks. The U.S. firm is currently the largest player in China’s coffee market, with 3,300 stores as of last May and a goal of topping 6,000 outlets by 2022, but Luckin said it will more than double its locations to more than 4,500 by the end of this year.

By comparison, Indonesia’s coffee battle is only just getting started.

Fourteen years after unveiling its first location in New York, Nintendo is finally opening an official store in Japan, too. Nintendo Tokyo will be located in Shibuya Parco, the new flagship of the Parco department store chain. Nintendo Tokyo is scheduled to open at the same time as the shopping center in fall.

In an announcement, Nintendo said “we are preparing to make this store, which will be a new base for communicating Nintendo information in Japan, an enjoyable place for a wide range of consumers.” In addition to games, consoles, accessories like amiibo, and branded merchandise, Nintendo Tokyo will also host gaming kiosks and events (if the New York store, in Rockefeller Center, is anything to go by, these might include tournaments, demos, and launches).

Nintendo recently posted strong third-quarter revenue growth, but also cut its Switch forecast for the year. Sales may pick up again, however, if Nintendo releases a smaller and less expensive version of the console, as Japanese financial publication Nikkei reported it plans to do.

Fourteen years after unveiling its first location in New York, Nintendo is finally opening an official store in Japan, too. Nintendo Tokyo will be located in Shibuya Parco, the new flagship of the Parco department store chain. Nintendo Tokyo is scheduled to open at the same time as the shopping center in fall.

In an announcement, Nintendo said “we are preparing to make this store, which will be a new base for communicating Nintendo information in Japan, an enjoyable place for a wide range of consumers.” In addition to games, consoles, accessories like amiibo, and branded merchandise, Nintendo Tokyo will also host gaming kiosks and events (if the New York store, in Rockefeller Center, is anything to go by, these might include tournaments, demos, and launches).

Nintendo recently posted strong third-quarter revenue growth, but also cut its Switch forecast for the year. Sales may pick up again, however, if Nintendo releases a smaller and less expensive version of the console, as Japanese financial publication Nikkei reported it plans to do.

Facebook said today it has removed hundreds of Facebook and Instagram counts with links to an organization that peddled fake news.

The world’s fourth largest country with a population of over 260 million, Indonesia is in election year alongside Southeast Asia neighbors Thailand and the Philippines. Facebook said this week it has set up an ‘election integrity’ team in Singapore, its APAC HQ, as it tries to prevent its social network being misused in the lead-up to voting as happened in the U.S.

This Indonesia bust is the first move announced since that task force was put in place, and it sees 207 Facebook Pages, 800 Facebook accounts, 546 Facebook Groups, and 208 Instagram accounts removed for “engaging in coordinated inauthentic behavior.”

“About 170,000 people followed at least one of these Facebook Pages, and more than 65,000 followed at least one of these Instagram accounts,” Facebook said of the reach of the removed accounts.

The groups and accounts are linked to Saracen Group, a digital media group that saw three of its members arrested by police in 2016 for spreading “incendiary material,’ as Reuters reports.

Facebook isn’t saying too much about the removals other than: “we don’t want our services to be used to manipulate people.”

In January, the social network banned a fake news group in the Philippines in similar circumstances.

Despite the recent action, the U.S. company has struggled to manage the flow of false information that flows across its services in Asia. The most extreme examples come from Myanmar, where the UN has concluded that Facebook played a key role in escalating religious hatred and fueling violence. Facebook has also been criticized for allowing manipulation in Sri Lanka and the Philippines among other places.

Facebook said today it has removed hundreds of Facebook and Instagram counts with links to an organization that peddled fake news.

The world’s fourth largest country with a population of over 260 million, Indonesia is in election year alongside Southeast Asia neighbors Thailand and the Philippines. Facebook said this week it has set up an ‘election integrity’ team in Singapore, its APAC HQ, as it tries to prevent its social network being misused in the lead-up to voting as happened in the U.S.

This Indonesia bust is the first move announced since that task force was put in place, and it sees 207 Facebook Pages, 800 Facebook accounts, 546 Facebook Groups, and 208 Instagram accounts removed for “engaging in coordinated inauthentic behavior.”

“About 170,000 people followed at least one of these Facebook Pages, and more than 65,000 followed at least one of these Instagram accounts,” Facebook said of the reach of the removed accounts.

The groups and accounts are linked to Saracen Group, a digital media group that saw three of its members arrested by police in 2016 for spreading “incendiary material,’ as Reuters reports.

Facebook isn’t saying too much about the removals other than: “we don’t want our services to be used to manipulate people.”

In January, the social network banned a fake news group in the Philippines in similar circumstances.

Despite the recent action, the U.S. company has struggled to manage the flow of false information that flows across its services in Asia. The most extreme examples come from Myanmar, where the UN has concluded that Facebook played a key role in escalating religious hatred and fueling violence. Facebook has also been criticized for allowing manipulation in Sri Lanka and the Philippines among other places.

A lapse in security has led to the leaking of over a hundred thousand Aadhaar numbers, TechCrunch can reveal.

One of the web systems used to record attendance of government workers for the Indian state of Jharkhand was left exposed and without a password as far back as 2014, allowing anyone access to names, job titles, and partial phone numbers on 166,000 workers as of the time of writing.

But the photo on each record page used the file name as that worker’s Aadhaar number, a confidential 12-digit number assigned to each Indian citizen as part of the country’s national identity and biometric database.

The data leak isn’t a direct breach of the central database run by Aadhaar’s regulator, the Unique Identification Authority of India (UIDAI), but represents another lapse in responsibility from the authority charged with protecting its data.

Aadhaar numbers aren’t strictly secret but are treated similarly to Social Security numbers. Anyone of the 1.23 billion Indian citizens enrolled in Aadhaar — more than 90 percent of the population — can use their unique number or their thumbprint to verify their identity in order to enroll in state services, like voting, welfare or financial assistance. Aadhaar users can even use their Aadhaar identity to open a bank account, get a SIM card, call an Uber, buy something on Amazon, or rent an Airbnb.

But the system has been plagued with problems that have led to starvation in cases, and the illicit trade of citizen data on the underground market.

It’s unclear why the Jharkhand government site was accessible to anyone who knew where to look, but little effort had been put in to ensure the security of the system — or even hide it from the outside world. The site was easily found on a subdomain of the state government’s website, but for long enough that it was indexed by Google, which cached copies of not only the site itself, but also its attendance record pages that still contain Aadhaar numbers in each worker’s photo.

TechCrunch asked Baptiste Robert, a French security researcher who goes by the online handle Elliot Alderson, to take a look at the site. Robert has prior experience in revealing Aadhaar-related data leaks. Using less than a hundred lines of Python code, Robert demonstrated that it was easy for anyone to scrape the entire site in batches to download their photos and corresponding Aadhaar numbers.

TechCrunch verified a small selection of Aadhaar numbers from the site using UIDAI’s own verification tool on its website. (We used a VPN in Bangalore as the page was unavailable in the U.S.). Each record came back as a positive match.

After confirming our findings, we reached out to both the Jharkhand government and UIDAI.

At the time of publication, neither had responded, but the website had been pulled offline.

The exposure may represent a fraction of the billion-plus users registered with Aadhaar, but uncovers yet another inadvertent disclosure of citizen data from a system that UIDAI claims is impenetrable. Instead of learning from mistakes and mishaps, UIDAI instead has shown a long history of rebuffing evidence of security incidents or breaches with mockery and declaring findings as “fake news,” by claiming to refute evidence without presenting any of its own.

The leak of Aadhaar numbers may not be seen as sensitive compared to leaked biometric data. Former attorney general Mukul Rohtagi once called a separate leak of Aadhaar numbers “much ado about nothing.” But it’s raises fears that obtaining and misusing someone’s number could lead to identity theft and fraud — which reportedly peaked last year.

Others have expressed concern that the system puts privacy at risk by recording information on a person’s life, which authorities can use to conduct surveillance on ordinary citizens.

But the exposure alone contradicts the Indian government’s claims that the Aadhaar system as a whole is secure.

In recent years, several security lapses involving data relating to Aadhaar have reignited fresh concerns about the centralized database — including several issues found by Robert. Last year, security researcher Karan Saini, a New Delhi-based security researcher, found a poorly-secured web address used by state-owned utility company Indane that had direct access to the Aadhaar database, allowing him to query results from the system. UIDAI rubbished the reports, baselessly claiming that there was “no truth to this story” in a series of tweets from its official Twitter account, despite evidence to the contrary. In the same year, India’s Tribune newspaper reported that some were selling direct access to the Aadhaar database. UIDAI responded by filing a complaint against the reporter with police.

Despite the security concerns, India’s Supreme Court ruled the database constitutional in September after a long-running court battle.

A lapse in security has led to the leaking of over a hundred thousand Aadhaar numbers, TechCrunch can reveal.

One of the web systems used to record attendance of government workers for the Indian state of Jharkhand was left exposed and without a password as far back as 2014, allowing anyone access to names, job titles, and partial phone numbers on 166,000 workers as of the time of writing.

But the photo on each record page used the file name as that worker’s Aadhaar number, a confidential 12-digit number assigned to each Indian citizen as part of the country’s national identity and biometric database.

The data leak isn’t a direct breach of the central database run by Aadhaar’s regulator, the Unique Identification Authority of India (UIDAI), but represents another lapse in responsibility from the authority charged with protecting its data.

Aadhaar numbers aren’t strictly secret but are treated similarly to Social Security numbers. Anyone of the 1.23 billion Indian citizens enrolled in Aadhaar — more than 90 percent of the population — can use their unique number or their thumbprint to verify their identity in order to enroll in state services, like voting, welfare or financial assistance. Aadhaar users can even use their Aadhaar identity to open a bank account, get a SIM card, call an Uber, buy something on Amazon, or rent an Airbnb.

But the system has been plagued with problems that have led to starvation in cases, and the illicit trade of citizen data on the underground market.

It’s unclear why the Jharkhand government site was accessible to anyone who knew where to look, but little effort had been put in to ensure the security of the system — or even hide it from the outside world. The site was easily found on a subdomain of the state government’s website, but for long enough that it was indexed by Google, which cached copies of not only the site itself, but also its attendance record pages that still contain Aadhaar numbers in each worker’s photo.

TechCrunch asked Baptiste Robert, a French security researcher who goes by the online handle Elliot Alderson, to take a look at the site. Robert has prior experience in revealing Aadhaar-related data leaks. Using less than a hundred lines of Python code, Robert demonstrated that it was easy for anyone to scrape the entire site in batches to download their photos and corresponding Aadhaar numbers.

TechCrunch verified a small selection of Aadhaar numbers from the site using UIDAI’s own verification tool on its website. (We used a VPN in Bangalore as the page was unavailable in the U.S.). Each record came back as a positive match.

After confirming our findings, we reached out to both the Jharkhand government and UIDAI.

At the time of publication, neither had responded, but the website had been pulled offline.

The exposure may represent a fraction of the billion-plus users registered with Aadhaar, but uncovers yet another inadvertent disclosure of citizen data from a system that UIDAI claims is impenetrable. Instead of learning from mistakes and mishaps, UIDAI instead has shown a long history of rebuffing evidence of security incidents or breaches with mockery and declaring findings as “fake news,” by claiming to refute evidence without presenting any of its own.

The leak of Aadhaar numbers may not be seen as sensitive compared to leaked biometric data. Former attorney general Mukul Rohtagi once called a separate leak of Aadhaar numbers “much ado about nothing.” But it’s raises fears that obtaining and misusing someone’s number could lead to identity theft and fraud — which reportedly peaked last year.

Others have expressed concern that the system puts privacy at risk by recording information on a person’s life, which authorities can use to conduct surveillance on ordinary citizens.

But the exposure alone contradicts the Indian government’s claims that the Aadhaar system as a whole is secure.

In recent years, several security lapses involving data relating to Aadhaar have reignited fresh concerns about the centralized database — including several issues found by Robert. Last year, security researcher Karan Saini, a New Delhi-based security researcher, found a poorly-secured web address used by state-owned utility company Indane that had direct access to the Aadhaar database, allowing him to query results from the system. UIDAI rubbished the reports, baselessly claiming that there was “no truth to this story” in a series of tweets from its official Twitter account, despite evidence to the contrary. In the same year, India’s Tribune newspaper reported that some were selling direct access to the Aadhaar database. UIDAI responded by filing a complaint against the reporter with police.

Despite the security concerns, India’s Supreme Court ruled the database constitutional in September after a long-running court battle.

Facebook published an internal memo today trying to minimize the morale damage of TechCrunch’investigation that revealed it’d been paying people to suck in all their phone data. Attained by Business Insider’s Rob Price, the memo from Facebook’s VP of production engineering and security Pedro Canahuati gives us more detail about exactly what data Facebook was trying to collect from teens and adults in the US and India. But it also tries to claim the program wasn’t secret, wasn’t spying, and that Facebook doesn’t see it as a violation of Apple’s policy against using its Enterprise Certificate system to distribute apps to non-employees.

Here we lay out the memo with section by section responses to Facebook’s claims challenging TechCrunch’s reporting. Our responses are in bold and we’ve added images.

Memo from Facebook VP Pedro Canahuati

APPLE ENTERPRISE CERTS REINSTATED

Early this morning, we received agreement from Apple to issue a new enterprise certificate; this has allowed us to produce new builds of our public and enterprise apps for use by employees and contractors. Because we have a few dozen apps to rebuild, we’re initially focusing on the most critical ones, prioritized by usage and importance: Facebook, Messenger, Workplace, Work Chat, Instagram, and Mobile Home.

New builds of these apps will soon be available and we’ll email all iOS users for detailed instructions on how to reinstall. We’ll also post to iOS FYI with full details.

Meanwhile, we’re expecting a follow-up article from the New York Times later today, so I wanted to share a bit more information and background on the situation.

What happened?

On Tuesday TechCrunch reported on our Facebook Research program. This is a market research program that helps us understand consumer behavior and trends to build better mobile products.

TechCrunch implied we hid the fact that this is by Facebook – we don’t. Participants have to download an app called Facebook Research App to be involved in the stud. They also characterized this as “spying,” which we don’t agree with. People participated in this program with full knowledge that Facebook was sponsoring this research, and were paid for it. They could opt-out at any time. As we built this program, we specifically wanted to make sure we were as transparent as possible about what we were doing, what information we were gathering, and what it was for — see the screenshots below.

We used an app that we built ourselves, which wasn’t distributed via the App Store, to do this work. Instead it was side-loaded via our enterprise certificate. Apple has indicated that this broke their Terms of Service so disabled our enterprise certificates which allow us to install our own apps on devices outside of the official app store for internal dogfooding.

Author’s response: To start, “build better products” is a vague way of saying determining what’s popular and buying or building it. Facebook has used competitive analysis gathered by its similar Onavo Protect app and Facebook Reserch for years to figure out what apps were gaining momentum and either bring them in or box them out. Onavo’s data is how Facebook knew WhatsApp was sending twice as many messages as Messenger, and it should invest $19 billion to acquire it.

Facebook claims it didn’t hide the program, but it was never formally announced like every other Facebook product. There were no Facebook Help pages, blog posts, or support info from the company. It used intermediaries Applause (which owns uTest) and CentreCode (which owns Betabound) to run the program under names like Project Atlas and Project Kodiak. Users only found out Facebook was involved once they started the sign-up process and signed a non-disclosure agreement prohibiting them from discussing it publicly. TechCrunch has reviewed communications indicating Facebook would threaten legal action if a user spoke publicly about being part of the Research program. While the program had run since 2016, it had never been reported on. We believe that these facts combined justify characterizing the program as “secret”

How does this program work?

We partner with a couple of market research companies (Applause and CentreCode) to source and onboard candidates based in India and USA for this research project. Once people are onboarded through a generic registration page, they are informed that this research will be for Facebook and can decline to participate or opt out at any point. We rely on a 3rd party vendor for a number of reasons, including their ability to target a Diverse and representative pool of participants. They use a generic initial Registration Page to avoid bias in the people who choose to participate.

After generic onboarding people are asked to download an app called the ‘Facebook Research App,’ which takes them through a consent flow that requires people to check boxes to confirm they understand what information will be collected. As mentioned above, we worked hard to make this as explicit and clear as possible.

This is part of a broader set of research programs we conduct. Asking users to allow us to collect data on their device usage is a highly efficient way of getting industry data from closed ecosystems, such as iOS and Android. We believe this is a valid method of market research.

Author’s response: Facebook claims it wasn’t “spying”, yet it never fully laid out the specific kinds of information it would collect. In some cases, descriptions of the app’s data collection power were described in merely a footnote. The program did not specify specific data types gathered, only saying it would scoop up “which apps are on your phone, how and when you use them” and “information about your internet browsing activity”

The parental consent form from Facebook and Applause lists none of the specific types of data collected or the extent of Facebook’s access. Under “Risks/Benefits”, the form states “There are no known risks associated with this project¨ however you acknowledge that the inherent nature of the project involves the tracking of personal information via your child’s use of Apps. You will be compensated by Applause for your child’s participation.” It gives parents no information about what data their kids are giving up.

Facebook claims it uses third-parties to target a diverse pool of participants. Yet Facebook conducts other research programs on its own without the need for intermediaries that obscure its identity, and only ran the program in two countries. It claims to use a generic signup page to avoid biasing who will choose to participate, yet the cash incentive and technical process of installing the root certification also bias who will participate, and the intermediaries conveniently prevent Facebook from being publicly associated with the program at first glance. Meanwhile, other clients of the Betabound testing platform like Amazon, Norton, and SanDisk reveal their names immediately

Did we intentionally hide our identity as Facebook?

No — The Facebook brand is very prominent throughout the download and installation process, before any data is collected. Also, the app name of the device appears as “Facebook Research” — see attached screenshots. We use third parties to source participants in the research study, to avoid bias in the people who choose to participate. But as soon as they register, they become aware this is research for Facebook

Author’s response: Facebook here admits that users did not know Facebook was involved before they registered.

What data do we collect? Do we read people’s private messages?

No, we don’t read private messages. We collect data to understand how people use apps, but this market research was not designed to look at what they share or see. We’re interested in information such as watch time, video duration, and message length, not that actual content of videos, messages, stories or photos. The app specifically ignores information shared via financial or health apps.

Author’s response: We never reported that Facebook was reading people’s private messages, but that it had the ability to collect them. Facebook here admits that the program was “not designed to look at what they share or see”, but stops far short of saying that data wasn’t collected. Fascinatingly, Facebook reveals it was that it was closely monitoring how much time people spent on different media types.

Did we break Apple’s terms of service?

Apple’s view is that we violated their terms by sideloading this app, and they decide the rules for their platform, We’ve worked with Apple to address any issues; as a result, our internal apps are back up and running. Our relationship with Apple is really important — many of us use Apple products at work every day, and we rely on iOS for many of our employee apps, so we wouldn’t put that relationship at any risk intentionally. Mark and others will be available to talk about this further at Q&A later today.

Author’s response: TechCrunch reported that Apple’s policy plainly states that the Enterprise Certificate program requires companies to “Distribute Provisioning Profiles only to Your Employees and only in conjunction with Your Internal Use Applications for the purpose of developing and testing” and that “You may not use, distribute or otherwise make Your Internal Use Applications available to Your Customers”. Apple took a firm stance in its statement that Facebook did violate the program’s policies, stating “Facebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple.”

Given Facebook distributed the Research apps to teenagers that never signed tax forms or formal employment agreements, they were obviously not employees or contractors, and most likely use some Facebook-owned service that qualifies them as customers. Also, I’m pretty sure you can’t pay employees in gift cards.

Go-Jek, the Indonesia-based ride-hailing company that is challenging Grab in Southeast Asia, has announced the first close of its Series F round, as TechCrunch reported last week. The company isn’t revealing numbers but sources previously told us it has closed around $920 million. Go-Jek is planning to raise $2 billion for the round, as reported last year.

Go-Jek said that the first close is led by existing backers Google, JD.com, and Tencent, with participation from Mitsubishi Corporation and Provident Capital. It didn’t provide a valuation but sources told us that week that it is around $9.5 billion.

The company said it plans to spend the money deepening its business in Indonesia, its home market, and growing its presence in new market expansions Vietnam, Singapore and Thailand. It is also working to expand to the Philippines, where it had a request for an operating license rejected although it did complete a major acquisition after buying fintech startup Coins.ph.

The Go-Jek business in Indonesia includes transportation, food delivery, services on demand, payments and financial services. That’s very much the blueprint for its expansion markets, all of which are in different stages. Go-Viet, its Vietnamese service, offers food delivery and motorbike taxis, Get in Thailand operates motorbike taxis and in Singapore Go-Jek provides four-wheeled car options.

Combined those efforts cover 204 cities, two million drivers and 400,000 merchants, the company said, but the majority of that is in Indonesia.

Grab, meanwhile, became the top dog after buying Uber’s local business, and it operates in eight countries. It recently crossed three billion rides to date and claims 130 million downloads. Grab said revenue for 2018 was $1 billion, it expects that to double this year. The company has raised $6.8 billion from investors, according to Crunchbase, and its current Series H round could reach $5 billion.

Go-Jek claims it has 130 million downloads — despite just being in three markets — while it said it reached an annualized transaction volume of two billion in 2018 and $6.7 billion in annualized GMV. Those figures require some explaining as Go-Jek is being a little creative with its efforts to compete with Grab on paper.

Transactions don’t mean revenue — a transaction could be a $1 motorbike ride or a payment via QR code — and GMV is not revenue either, while both are ‘annualized’ which means they are scaled up after measuring a short period. In other words, don’t take these figures too literally, they aren’t comparable to Grab.

Go-Jek, the Indonesia-based ride-hailing company that is challenging Grab in Southeast Asia, has announced the first close of its Series F round, as TechCrunch reported last week. The company isn’t revealing numbers but sources previously told us it has closed around $920 million. Go-Jek is planning to raise $2 billion for the round, as reported last year.

Go-Jek said that the first close is led by existing backers Google, JD.com, and Tencent, with participation from Mitsubishi Corporation and Provident Capital. It didn’t provide a valuation but sources told us that week that it is around $9.5 billion.

The company said it plans to spend the money deepening its business in Indonesia, its home market, and growing its presence in new market expansions Vietnam, Singapore and Thailand. It is also working to expand to the Philippines, where it had a request for an operating license rejected although it did complete a major acquisition after buying fintech startup Coins.ph.

The Go-Jek business in Indonesia includes transportation, food delivery, services on demand, payments and financial services. That’s very much the blueprint for its expansion markets, all of which are in different stages. Go-Viet, its Vietnamese service, offers food delivery and motorbike taxis, Get in Thailand operates motorbike taxis and in Singapore Go-Jek provides four-wheeled car options.

Combined those efforts cover 204 cities, two million drivers and 400,000 merchants, the company said, but the majority of that is in Indonesia.

Grab, meanwhile, became the top dog after buying Uber’s local business, and it operates in eight countries. It recently crossed three billion rides to date and claims 130 million downloads. Grab said revenue for 2018 was $1 billion, it expects that to double this year. The company has raised $6.8 billion from investors, according to Crunchbase, and its current Series H round could reach $5 billion.

Go-Jek claims it has 130 million downloads — despite just being in three markets — while it said it reached an annualized transaction volume of two billion in 2018 and $6.7 billion in annualized GMV. Those figures require some explaining as Go-Jek is being a little creative with its efforts to compete with Grab on paper.

Transactions don’t mean revenue — a transaction could be a $1 motorbike ride or a payment via QR code — and GMV is not revenue either, while both are ‘annualized’ which means they are scaled up after measuring a short period. In other words, don’t take these figures too literally, they aren’t comparable to Grab.