I honestly think that there's three proper responses:

1. Work on your system to help prevent something like this doesn't happen again.

2. Add a couple dollars of "insurance" to the cost. If the PR statement is accurate and there's been "2 million nights stayed" before an incident like this, having a couple bucks per renter would have more than covered the cost of this theoretically isolated incident.

3, which is far more important, figure out a way to reimburse her. This is already far overdue, and I realize there's a couple lawyers that'll say "But it opens the door for a fault-based civil suit", but that's an issue for the lawyers. It seems like human decency here, and it would be a transparent PR tactic to have waited 5 weeks to do it, but it really does seem like it's something they'll have to do to recover from this, especially if she keeps blogging about it.

I would add onto 3--however the reimbursement is done, make sure she doesn't publish the actual numbers. One of the AirBnB guys blogged about this and included the maximum on his insurance policy for his east coast cabin. The first comment was "if you publish this number, everyone and anyone who sues will sue for this amount". Likewise with any future settlements.

I would guess there's some of (3), but I'm surprised that a company with their level of funding, in a market with this kind of potential risk, didn't already have someone on staff with expertise in handling such a contingency. I can accept that the founders aren't experts in what to do in such an event, but surely someone hireable is.

Maybe it's encouraging from one perspective, because it shows that even big startups are still pretty ad-hoc affairs, run by the founders without the kind of tight PR-management that big corporations do. But past some point, especially in some businesses, it probably does make sense to copy some of the BigCorp approach of having a dedicated crisis-management team who are experts in what to do about major negative events (i.e. the mixture of the substantive angles, legal angles, and PR angles).

Part of the reason I intrinsically trust start ups over BigCos is because they do not have such teams. Instead, I would expect the start up to be more personal, hands on, response and human. AirBNB, as much as I love them, seems to be falling flat on its face in this regard.

I tend to have the same view, yeah. I think there are situations where less bureaucracy in that regard can actually produce a more paralyzed response, though, depending on the personalities of all involved. For example, if you have a legal team but not a crisis-management team, the founders can be receiving far too cautious advice, and a not-legally-knowledgeable founder might not feel confident ignoring it. A good crisis-management advisor would instead give advice that balances legal risks with some sort of assessment of which of the legal risks are worth taking, while the legal department is more likely to tell you to avoid anything risky.

1) Does not have to involve taking on the whole burden, but it does have to involve drawing a line in the sand. "If this happens, we will do these steps" - steps might be provide proof that they've submitted information to the police (though privacy prevents the actual information, of course), provide case workers in serious cases like this that are familiar with social services in the area, and in this particular case, an admission that they've really dropped the ball, that they will go further in this case because they dropped the ball and didn't follow through, and add something about 'but in future the policy will be more realistic'. They can do something without doing everything (of course finalising any such policy needs legal eagles and fine tooth combs...). The author's problem seems not to be that airbnb was faceless, but that offers of assistance were only to secure good internet commentary.

In terms of decision making - there is only option 1 left now. If they dont take it they won't have a back to be hit on.