Your Facebook password should be none of your boss' business
aclu.org
aclu.org
I once left an interview because the NDA they wanted me to sign gave them rights to all of my work for the next 6 months, and the right to audit me at any day or time by searching my house!
I told the HR person I wasn't willing to sign that, and why, that it would prevent me working anywhere if I didn't get that particular job, and she reacted as if I was being a prima donna.
That said, companies have been requiring that applicants submit credit reports for a long time, so the idea that there's a bright line between what's "private" and what's "public" when it comes to employment isn't quite right.
I thought this was a really nice way of letting your employees have a choice even though in this particular case they probably could have forced everybody to do it. Now you have companies which do not really need to have this personal information asking employees for it. Here's the thing though. If my employees had lots of nasty things to say about my company then my reaction wouldn't be to stop them by monitoring everything they do. Wouldn't you want to try and fix the problem?
Similarly, I never post anything on Facebook (or the Internet at large) that I wouldn't feel comfortable seeing on the front page of the newspaper. But the moment anyone asks for any account password, I'm done talking to them.
I think you've just hit on the legal remedy for this bullshit.
It is illegal for an interviewer to ask about your religion, your race, your age, your political views, your sexual orientation, etc. All of those things are part of the typical facebook profile so asking to even look at someone else's facebook profile for purposes of an interview is a clear violation of the law.
Here's a list of things that an interviewer is barred from asking: http://jobsearch.about.com/od/interviewsnetworking/a/illegal...
For example you apply for a job somewhere and the next time you log into facebook you get a message that reads something like.
"InitTech PLC has requested read only access to your account for 48 hours, please be aware that compliance with this is a condition of employment with InitTech PLC Allow/Deny"
Something slightly similar to your "temporary access" theory happens if you owe the IRS even a small amount of money. They enter your bank account to seize cash and the bank charges you $100 for the inspection/invasion.
As for the topic at hand, I don't see why one cannot simply say they have no Facebook account. Since FB began, there have been more years of myself having no account than there have been of having one (meaning I'm a serial "account-deleter").
The implications of this are terrifying. I'm glad that organizations like the ACLU are on this, because if corporations can set a precedent for this sort of privacy invasion, we're screwed to the nth degree.
If it is simply a screen to avoid applicants who would be massively unsuitable , membership of extreme political parties or heavily into drugs etc then perhaps not.
Otherwise you might need a form from HR for each social network you join.
The way I imagine this will play out in practice is that you will get companies who are "social reference agencies" or similar.
They will have special privileges with facebook etc and will be hired by other companies to screen applicant based on a number of factors and will produce a report for the client company that probably wouldn't contain any specific data etc but simply screen for any "red flags".
I mean, sure, facebook could just update privacy agreement and have everyone agree to it then go this way but at that point I could demand my data to be removed/locked under law to prevent any one from using it in this manner.
Interviewer: Ok then, we'll just need your facebook login information and we'll be all set.
Applicant: Sure thing, but first I'll need a key to your house.
Interviewer: What? Why?
Applicant: I'd like to go in when you're not there and rummage through your stuff, to make sure you're the kind of person I want to work for.
If your potential employer asked you for passwords to your bank accounts, stock managers or asked you to hand over your journals, why would you comply?
I know the job market is still tough out there for people, but why would you want to work for a company that won't trust you based on your face to face interview, the documents you submit, your references and a due diligence web search?
Were people compelled to give out their AOL passwords for jobs in the 90's?
Recently, I was watching an episode of Mad Men with a friend, and one of the characters abruptly fired one of their employees. My fried was aghast and was glad that 'that behavior couldn't happen today.' Well - it can and does happen today.
Last year I worked for a start-up owned by a friend. Before coming on-board, I had agreed verbally on an equity sharing deal. I didn't put anything in writing because I trusted the guy; I knew him for years. The red flag was that he kept waiting for a certain 'favorable legislation to be enacted' before splitting up the corporation. Well, when business started picking up, I reminded him emphatically about the equity, and then I was abruptly fired. Naively, I was shocked that it could happen like that. But, every attorney I called said I was out of luck.
Anyway, the point is that employers can probably ask you to do anything they want, that isn't explicitly denied by law. So, it makes sense that they may fire you for not sharing passwords.
Either way, employers asking for a password to anything feels insanely slimy.
I'd be much more concerned if they asked for my userids & passwords for email accounts, Skype, MSN, IRC, domain names and 'Hacker News' (especially if they just went by the name & not the content)!!
What can Facebook do? At best, they can lobby the Government and/or employment regulators in an attempt to bring this practice to light and make requesting passwords and access to private accounts illegal. It's a very indirect method and may not change things now, tomorrow or even next month.
Sharing my password, any of them, is simply totally unacceptable. No way. I'm not giving them the key to my front door either am I? Or my ID card with my boss' face on it so that he can impersonate me, because that's also what this is (though that probably won't happen, so they key example is better, but that doesn't make this less true).
You would only really need this to become procedure at one large company (say wallmart) to set a precedent that others will follow.
To me, that's what's most troubling about this: employers have the ability to strike now, while the iron is hot. If enough big employers can establish this as a standard practice, then pretty soon it becomes procedural. (Like the background check, the drug test, and other procedures that BigCo routinely uses in hiring practices).
In a perfect world, sure, you'd love to be able to walk away from a job offer and say "Well, I wouldn't want to work for any company that subjects me to this...so sayonara, suckers!" But a) vanishingly few people are in a position to do that, and b) there's a real danger that this practice becomes so widespread as to be unavoidable.
While I do think the current situation is being blown out of proportion, I think the potential danger is very real.
For instance, someone named John Smith might rename his FB profile "Johnny S." This tactic allows our hypothetical Mr. Smith to dodge search engine results for his full name. It wouldn't protect him from having to hand over his password, but at least it keeps all those photos of his brandishing red Solo cups out of employers' SERPs. (Also, with the right privacy settings in place, it keeps him from being searchable on Facebook by someone who's not a friend).
If the password-handover procedure actually does become standard, then yes, I'd imagine we'd see the rise of dummy profiles and other countermeasures.
Employers should not request access to candidates' social media outlets, just as they do not request to spend a weekend with me to observe my habits. Candidates, on the other hand, need to ensure their online presence is something they are proud of (and happy to defend) if seen by friends, parents, clerics and potential employers, IMHO.
The problem is that this is difficult, especially for younger people.
I've had various online aliases over the years, most of which have been abandoned because they no longer reflect me at all.
Let's say you were 16-18 and naive and got roped into some extreme political or religious cult group (this didn't happen to me btw). You might post all kinds of things and at the time you would probably be totally convinced that these were things you would be happy to share forever.
Basically, we need to tell kids "don't post anything online under your real name unless you would be happy to tattoo it onto your forehead"
And even that's probably not enough. Look at all the people who regret tatoos they've gotten. We're simply not very good at predicting how our lives or perspectives may change over time.
The guideline that I came up with is "don't post anything, anywhere, that you wouldn't be comfortable seeing on the front page of the newspaper".
Now all I have to do is keep drumming that message into him for the next three years.
Of course, there is the problem of people tagging you in Facebook that you can never un-tag.
I also recall another comment where someone pointed out that their friends on Facebook have an expectation of privacy in their own communications and that s/he will not compromise (betray) that expectation. That seems to me to be a pretty clear ethical argument. As a reasonable person, I would have a hard time challenging the ethics of such a response.
Finally, personally, I agree with other comments here, that the access and information is none of their business.
What perhaps some (not all) in the preponderance of relatively privileged professions represented on HN may not fully realize, is that for many people in the workforce there is effectively little or no choice. Jobs -- especially with decent pay and benefits -- are hard to come by, and many do not have the financial means to risk an episode or continuance of unemployment.
For the sake of those people, as well as ourselves, we need to band together in opposition to this behavior. Even for ourselves, if the practice becomes commonplace, that sets a precedent that may subsequently box us in.
In many US states, it is legal to record a conversation if one of the parties is aware (i.e. if you are recording a conversation in which you are a participant).
I'm uncomfortable with doing this in normal circumstances, since it's a pretty manipulative way of getting a recording of someone. But if you're getting abusive requests from your employer and (I agree) you're not likely to get it in writing, this seems like the appropriate response.
Illegal is the wrong word for it. It's not illegal, it's a violation of the Facebook TOS - a matter for at most a civil (and not criminal) court.
That's not relevant, though, because US v. Lori Drew[2] decided that a user can't be prosecuted under the CFAA for breaking a ToS agreement. (BTW, IANAL.)
0: http://www.law.cornell.edu/uscode/text/18/1030
1: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
2: https://wikispaces.psu.edu/display/IST432TEAM24/United+State...
Update: 2 of the comments on the ACLU article say this also. I'm surprised this line of reasoning isn't more prominent on the issue.
It should be illegal though- I'm not sure when it ever became acceptable to ask for someone's login credentials.
It's shady, and seems short-sighted, but no one is disclosing information against their will here.
Edit: A bit of searching leads me to the Civil Rights Act of 1964 (https://en.wikipedia.org/wiki/Civil_Rights_Act_of_1964). I'm not sure if the wording specifically prohibits asking about protected statuses, but any legal decisions about that would probably have their roots in that Act.
The Employment Equity Act is aimed at protecting women, visible minorities, people with disabilities and Aboriginals.
"5. Every employer shall implement employment equity by
(a) identifying and eliminating employment barriers against persons in designated groups that result from the employer’s employment systems, policies and practices that are not authorized by law" (1)
The Canadian Human Rights Act is aimed at preventing discrimination "practices based on race, national or ethnic origin, colour, religion, age, sex, sexual orientation,marital status, family status, disability orconviction for an offence for which a pardon has been granted."
"7. It is a discriminatory practice, directly or indirectly,
(b) in the course of employment, to differentiate adversely in relation to an employee,on a prohibited ground of discrimination." (2)
I'm no lawyer but I would tread lightly on "differentiating" by any of these statuses.
(1) http://laws-lois.justice.gc.ca/eng/acts/E-5.401/page-3.html#...
My only point is that I don't see why there needs to be a special exemption for social networking data, if the predatory behavior is already illegal b
In hiring laws, it's the applicants that are getting screwed by the lack of these laws, because their choices are to either acquiesce to the hiring manager's demands or lose the job. While it's easy for some people to say "I'd just walk out," a single mother who needs to feed her kids probably wouldn't be so quick to do so.
In the end, it's a matter of the job market. If the market were flush with openings, hiring managers would have to be on their best behavior for fear of losing a promising candidate. Right now though, that's unfortunately not the case, so it's up to regulation to give people some basic rights. In my opinion.
It's like if, in order to perform a credit check on you, they asked for your SSN, mother's maiden name, etc., and then applied for a couple of credit cards on your behalf to see if you get accepted.
There are ways to perform credit checks without committing identity theft. I would think there must be ways to obtain 'social references' without identity theft either.
This article cites the exact same incident that every article I've read cites. Maybe when at least a single new incident is reported since the last time this made headlines we can talk about it being wide spread.
There's a severe power imbalance. If you don't take the job, in most cases there are seven other qualified applications who will take it instead. Odds are that one of them will fork over their login info. And even though few people truly want to disclose it, once it becomes a de-facto standard, people will have little choice. The power imbalance is the crucial problem, and companies shouldn't be allowed to dictate unreasonable terms to employees or potential employees just because that imbalance allows them to obtain consent in most cases.
However, the employer doesn't have to "confirm membership" of any status in order to open themselves up to credible legal action. All they need to do is give the impression that they were given some information about protected status, and their "no hire" decision becomes easily suspect.
It would be hard in a litigation setting for the employer, after viewing someone's Facebook data, to be able to cite and document exactly which pieces of information influenced their decision, and which pieces of (discriminatory) information did not influence their decision.
This isn't something that a smart employer would want to open themselves up to. It seems like the actual cases cited have all been rather limited in scope (checking prison guards for gang affiliation).
However, if it's a civil matter (i.e. you sue), then you just need "balance of evidence", not "proof beyond reasonable doubt". You'll try to prove that it was a factor, and they'll try to prove that it wasn't. You might argue that at this stage you're be neck and neck with the other candidates (having passed the previous filters), and it's just going to come down to a "gut feeling" from the hiring manager - so they will almost certainly be swayed by anything which they might dislike on your Facebook page. I've a feeling it would be a horrible case to try to defend against.
There's valid reasons for demanding Facebook login details, but if I were an employer I'd use a trusted third party to look for me, and only report things which have been cleared by a legal team. When the Australian government does security vetting, this is how it works - security personal do all the vetting, keep everything private except the "security clearance passed / failed", and can get thrown in prison if they let the wrong information out.
I'd wonder what kind of IT person doesn't have an account with facebook, twitter, a personal domain, etc.
Nice ludditism, though.
I don't understand neither sneak's position nor yours, really. What exactly is odd about not wanting to feed the privacy black hole that is Facebook? I have nothing against those who do, but frankly I'll avoid it if I can.
sd0w34hd8yjddghaJHj323HDa6GassGa79AsSFlk889FfSDFGd8AS78
Then, I would print this password out on a sheet of paper and give it my boss.
Because either you stand up against that company policy and show some spine, or if you are more worried about your job than your dignity, you wouldn't dare dream of ticking your boss off.
Unless you don't really want the job, and only want to give your potential-future boss access to some juicy information, so that you can sue him easier later on for discrimination against you; and want to have some fun in that process.