Ask HN: Is it legal for an employer to post as you on Slack? | Hacker News Reader

Ask HN: Is it legal for an employer to post as you on Slack?

37 pointsjavajosh57 comments

1: I was unceremoniously let go today. 2: I posted a farewell in Slack, and my coworkers replied sympathetically. 3: My laptop was remotely logged out. I also use slack from my phone, and 4: saw that someone posted as me saying "Thanks", a ghost post. Using my phone I 5: commented on the ghost post. Then 6: a few minutes later my slack login was invalidated. My question is: is it legal for someone to post on Slack as me?

Note: I'm in the US, working as a contractor (W-2 to the contractor, who I assume has something like a 1099 with the primary employer). The employer is in Madison, Wisconsin. I am in Florida. As for the contract, I think it's safe to assume it says "We can do anything we want, and you can do nothing."

Note: hire me. javajosh at the gmail.

View on HN

The ops engineer was probably trying to do you a favour / make it so you don't look ignorant and grumpy. Try to assume the best in people and their actions and your life will likely be better for it.

The job is over, with very little to be gained dwelling on trivialities.

You assume I'm ignorant and grumpy, though. My response to the ghost was simply to say that last post wasn't me, and I really was thankful to work with a great bunch of people. However, the possibility that an employer will post as you on Slack should be taken very seriously. Perhaps my case isn't much of an error mode (setting aside feelings of creepiness) but consider the possibilities!

Try to assume the best in people and their actions and your life will likely be better for it.

i think he just meant if you didnt reply at all might look like that and since he saw it just put a thanks in to save face for you

NB: I am not a lawyer, and nothing that is said here can be construed as to be legal advice. If you're really concerned, you need to speak directly to a lawyer who is admitted and recognized by the appropriate bar association for the jurisdiction in question, etc....

That said, the company owns that Slack instance. They can do whatever they want with it.

Now, it might be unethical for someone else to post as another person, but I'm pretty sure it wouldn't be illegal.

Slack does make it difficult for anyone to remove a post made by someone else. That is intentional. But if you can log into their account as them, then I guess they can do whatever they want as the person in question.

Disclaimers: IANAL, YMMV, etc....

If the ops engi is trying to do a favor, that favor would be removing access. Under no circumstances should someone fake being another employee. They shouldn't even have the access to do so. This smells like bad security practices.

It's not. Supervisors and managers have the right to request access for business continuity purposes. They have to carry any business in-flight to its conclusion. Of course audit logs will show how access an account when and form where, etc.

People have to remember, these are business accounts, not personal accounts and all their content belong to the business --which is why one should avoid using business accounts of any type for personal use.

It's only bad security if you assume that you own the account. You don't. Your employer is paying for it, and they have full control of it. They can access all messages. They can reassign it to someone else. All of this is by design.

Shoving words into someone's mouth is no favor.

Agreed.

How do you know what they’re saying as you after you’re locked out? Like, what if they’re sending messages as you to outside vendors, to leverage existing relationships?

Yes. My new Black Mirror script: AI's sockpuppeting dead salespeople, for profit! (note: I'm serious)

> Try to assume the best in people and their actions and your life will likely be better for it.

This is solid advice. After 20 years of (trying to) implementing it, it's made for much better professional and personal relationships.

Is the only thing that was ghost-posted as you "Thanks"? If so, I'd think you'd have very little in the way of damages here. If they had posted something substantive, like "I'm sorry for all the mistakes I made", then you could have a cause of action.

In many cases, whether there is a lawsuit worth pursuing depends on both (1) whether a wrong was committed, and (2) whether there are any damages worth recovering based on the wrong.

In some cases all you need is (1), for example if there are statutorily-specified damages. But in most cases, the recoverable damages will depend on how much you were actually injured/prejudiced by the wrong committed.

I'm not so interested in damages - I suppose this shows my lack of legal training in the way I asked the question! TBH I find it intensely creepy and BAD that an employer might post as you under any circumstances. It feels like I'm (me, the actual person) is being sock-puppetted. It highlights the extraordinary power employers have in WFH situations, and indeed, in any computer mediated interaction between employees. I've personally never seen this before, and find it quite alarming.

My firm has a SaaS provider that lets our marketing folks take over LinkedIn and other social media accounts and make posts using employee identities. It’s strictly opt-in but encouraged. I opt out.

Holy shit. Who's the SaaS that does this and doesn't this run afoul of LinkIn's TOS???

This is more common than you think. I have been pitched by these "lead gen" companies who will hire cheap contractors to use your founder/ceo account to send prospects messages as you to "scale lead gen". I declined. I just can't think of someone impersonating as me even to help with sales. I do know that those people have clients and are reasonably successful.

https://dynamicsignal.com

I begin to see why capitalism works and also why it sucks. It works because it encourages people to find the crack into which they pour their intelligence, no matter how small. Capitalism is fractal in its complexity! Value is like a vein of ore, that may split off from a larger vein, and so be ignored by the larger corp. Fucking crazy man.

What is software here? It is a person doing drugery! We are only 2nd order drudgery doers. But we know a secret: drugery is fascinating, complex, demanding and best of all, objective. Either your work works or it doesn't. Nature is the final arbiter. The satisfaction inherent in mastering Nature is sublime. Our profession, software programmers, architects, etc, are a subset of that, since the limit of our work is to control a large array of bits, and control their behavior over time. We segment these bits into interpreter, bytecode, source code, or in some other way, but it is all the same. And we programmers are constantly in battle over the coupling between text (which is actually "composed keyboard motions") and its "destination" - which is of type string, too. Something even more general than a url. If a url is http://javajosh.com then a "destination" would be something like 'me/mylaptop/linux/firefox/http://javajosh.com'. That's a string "javajosh.com" that went into a particular browser, on a particular machine, with fingers attached to a human, me. In this way we could characterize a human as a monotonic list of "destination" strings.

Anyway, what I'm really trying to say is that we're in danger, we programmers. It's not enough to go through a bootcamp and get hired to make progress on a specific project. Software ate the world, now the world is software. But software doesn't stop eating the world. The next go around is going to be dominated by AI. Your typical "Java Enterprise programmer" is probably going to be a software agent. I believe that the "human winners" will be those who either a) take advantage of AI programmers or b) maintain the best software engineering discipline to make better programs. It's not going to be long before you can feed a program a sequence of images describing the application you want, and they'll make it for you. It may even be a bog standard webapp that a human can understand and debug.

Humans can fight back by minimizing your runtime image. Fewer LOC, fewer deps. Humans are on a more even footing with AI when you minimize complexity. This, in turn, means understand your platform. And this differs for everyone. For a java programmer that means dwelling in the java community. But it's more than one community - in fact it's a list, a chain of them, in a loose hierarchy of "framework", "library", and so on.

Note that to dwell in a community means to consume a life. It means to actively and meaningfully participate, read posts, respond, and be aware of who's who and how things get done. It takes time. It's bad if this is just something you're paid to do. And, IMHO, this is the appropriate "zone of professional specialization". My ideal enterprise would have N employees where each employee was a central figure in each of our dependencies. That way, if push comes to shove we can soft-blackmail them into a (one-time) supply-chain poisoning attack virtually impossible to defend against! I kid - I just want to support open source!

Anyway, something like this is what I had in mind instead of "Thanks." Except I was going to write about microservices and kubernetes!

This is huge. Like, is this legal? Is it ethical?

WTF!

It's common for your previous manager to have temporary access to your machine, files, email and accounts at big companies to support continuity for a few weeks.

It'd be in extremely poor taste to post or email as the person but I don't think there's a legal issue per se. It is the companies infrastructure so your work accounts aren't really yours.

It's a solid reminder though never to use your work machine for personal use and never to use your personal accounts for work use.

Could easily be fraud depending on what’s being said or implied.

I think it's deliberate and it could be quite harmful. Someone who knew your real name and was thinking of messaging you out of work could have thought you'd be lonely or stressed and seen it and figured you were feeling fine, and not bothered to reach out. This could have been the difference between a strong friendship and falling completely out of touch. They shouldn't mess with people like that! The person doing it deliberately (if I'm right) probably didn't think of the harm. If it was accidental they should have deleted it right away.

Best of luck, both in finding a new job and maintaining connections/friendships from this job! I have seen you on HN a lot and am surprised to see you let go. Chalk that up to the halo effect and years of corporate culture programming me to think that productive people are seldom let go.

In the United States? May depend on your location, but as far as I’m aware based on the (large, tech heavy) states where I’ve been in the unfortunate position of executing firings and layoffs, probably not illegal. It’s not uncommon for off-boarding procedures to include taking over the terminated employee account to set up email and chat auto responses, which aren’t materially different than “thanks”.

This is shady as hell. A simple "thanks" message might sound innocent enough but you have no idea what else they are saying on your behalf. They have zero reason to pretend to be you in front of coworkers, period. I have no idea why everyone here is defending the company's actions so hard.

As for the legal part, I'm not a lawyer but I'm fairly confident in saying that you don't have a case for anything. They haven't caused you any real harm. Just forget about it and move on with your life.

Is there any chance someone was cleaning up your laptop/backing up IP and simply forgot it would be signed in as you and not them? A simple "thanks" on a public thread is ambiguous enough that it's not obvious which comment they'd be replying to.

Posting from your account accidentally would likely be fine, legally. I don't have any idea about the law if it was intentional, though.

Messages can be deleted. I would imagine if that scenario were true the person would delete the accidental reply, no?

Maybe. Has the message been deleted?

I can't imagine anyone would be able to answer this definitively without knowing the country you're in, the state you're in if you're in the US, and a copy of your employment contract.

I'm in the US, working as a contractor (W-2 to the contractor, who I assume has something like a 1099 with the primary employer). The employer is in Madison, Wisconsin. I am in Florida. As for the contract, I think it's safe to assume it says "We can do anything we want, and you can do nothing."

I believe that is all covered under Catch 22.

Understand that emotions may be running high, but they said "Thanks". It was a little shady to post as you, but it did no harm.

The corporate account and everything you do under it belongs to them, not to you. It's probably legal but certainly unethical.

Unethical, I’m not sure I find it all that nefarious. Strange yes, unethical, eh.

A lot of people exchange small personal, not strictly work related messages with departing employees, to wish them luck or maybe keep in touch. I think it's unethical for the employer to read that. And it's even more unethical for an employer to reply as you, and make that person think you got the message and/or appreciated it.

For example, if the departing employee later interacts with former coworkers in a social context (employer totally out of the picture), someone could falsely get the impression that somebody replied to a personal message, when they actually did not read it.. That could theoretically have social consequences that are none of the employer's business. Maybe that coworker the IT guy replied "thanks" to was actually stalking them. Maybe there was some kind of affair? Those are probably atypical, but my point is you don't know what weird consequence even a small "thanks" could have. That is why, IMO, the most ethical thing an employer can do here is to not even look at the messages, let alone reply.

Your work account and resources are not yours. The company can use it's slack account which you were given access to previously to post anything. That said, whether they pretended to be you or not, if they said anything slanderous, harmful or materially damaging or if you can at least reasonably claim their posts were of that nature then you can absolutley sue the crap out of them.

Tell me, how would I even find out? If you're locked out of your account, how would you know who's posting as you, in general? Personally, I think there needs to be a hard limit on speaking as someone else. The company can say whatever they want, however they want. But they CANNOT speak as ME! No matter how innocuous it is. It's equivalent to compelling speech with force.

Telling a lie or pretending to be someone is not a crime or illegal in civil law. You are not complelled because you did not make the speech. How would you have found out? You wouldn't have. Can HN make a post as you or me and hide it from us? Sure thing.

>Telling a lie or pretending to be someone is not a crime or illegal in civil law.

It should be. Times have changed, and now it is possible to impersonate someone "perfectly". This has a negative impact on both the one being impersonated and the people that are being lied to. It is a form of fraud. The requirement to connect this to actual damages is an exercise. An exercise lawyers have convinced a population of scared, ignorant people, demands $300/hr to complete. Let me put it simply: you cannot speak as me, and if you do, you're wrong and should be punished.

Now, maybe it's not the law, but it damn well should be. It seems common sense to me. If you cannot imagine the consequences of allowing an employer to impersonate you (especially in the age of AI), then I will say you lack imagination.

Sure and shadow moderation should be banned. And hiring managers secretly colluding to black ball you should be banned. Lots of things should be illegal, I guess the shit answer here is run for congress or lobby a lawmaker. Kinda like "if you don't like it,fork it".

Well, this law would be pretty bipartisan, I would think. Who likes it when their employer counter-party does these things? No-one. And as long as worker voters outnumber employers, workers can pass laws eliminating these degrees of freedom from an employer's tool-chest.

Most lawmakers are sponsored by employers of some kind.

Now I'm thinking. As someone who's started businesses before and hired people - am I not empathizing enough with the employer? What would I do in this situation? I guess the answer to that is simple: first and foremost, I'd abide by my original agreement to end our contract in 2 weeks and not today. That would have side-stepped all of these concerns. Second, not having done that, not posted as me in Slack, indicating a blase lack of concern for my coworkers as I exited. "Thanks" isn't harmful, but it isn't helpful either. I had an opportunity to leave one last impression, and they squandered it with "Thanks". So, to all those saying there is no material harm: I ask, how much value does a person's last impression of you have? How much value does "Thanks" squander in that moment? I don't think that number is zero.

Posting "thanks" as you is not something to be offended over. It's poor form socially, and that's about it. You're upset that you got fired, and you're over reacting to something that isn't a big deal.

I'd encourage you to delete this, since it contains an alias you apparently also use as your email and can therefore be easily linked to you. You don't want this to be something prospective future employers see.

I think that's a reasonable take, TBH. But for a moment consider the missed opportunity here. I'm about to be persona non grata, and its my final farewell. Am I going to limit myself to "Thanks"? No. I want to say something wise and profound, something to lift spirits. Because I'm egotistical enough to think I'm worth a damn, my team likes me, and the company really is going to be worse off without me. In my case, a major refactor went wrong, and I believe that failure is largely my responsibility. Perhaps this means they were right to let me go. But they were wrong to shorten the timeline after promising 2 weeks. Despite my failure I did exert myself and attempt to achieve the goal. We did a good post mortem today - until it was cut short by a remote reset of my laptop.

Therefore, I just want two things:

    1. Payment through 1/20 as originally promised.
    2. Passage of a law prohibiting employers from impersonating employees.

Also, see my "primary response" : https://news.ycombinator.com/item?id=34362583

Something I needed to hear when I left my first company: you lose all battles you were fighting, you lose all investment in the work being done, you lose everything you've built when you leave. Just let it be, it's part of life.

This is not important now, it won't be important in a week, and you won't remember this in a year.

Look forward.

Is it their slack account or your personal account. Just like email, if it is theirs it is theirs.

If I owned a newspaper, I don't think I could write an article under the name of a journalist I just fired.

This is "Thanks" by some poor ops engineer trying to do her job. You'd have her fired if the company lost a lawsuit all to prove some bullshit "ideal". The two things are completely different, for one a newspaper has an Editorial Board, I could go on...

IANAL

Perhaps an unpopular leading question/answer, but who owns that particular Slack account?

If the company owns <ex-employee>@<company.com>’s as the login, they own it and it’s not really “you”/“yours” ~

Honestly, if it weren't, what would you even do about it? Do you really have the time and resources to pursue it? Did you suffer damages from such?

I’m sorry this happened to you.

I think you’re upset and this is where you’re directing your anger. It’s weird, but not a big deal imo. Maybe sleep on it first.

it's frustrating to lose a job. don't take it personally.

Seems like in this case it was pretty innocuous if all they said was "Thanks"

The ethics around impersonating someone are pretty much absolute. It's not ethical. The degree of harm doesn't really factor into that.

They can likely do whatever they want with the account of course.

I mean sure, you're absolutely right, but a "thanks" is not exactly grounds for a pursuit in anything more serious. Yeah it kinda sucks and feels weird but that's about all you can say.

Reply on news.ycombinator.com