Hacker News Reader

Comment by jerf | Hacker News Reader

On what grounds could Facebook sue an employer who asks for your Facebook password? It isn't immediately obvious they have standing to sue the employers. Based on what I assume is their terms of service page (closest thing I could find) [1], it looks like they could sue the employee for giving away their password, but I don't immediately see any grounds for suing the employer. There doesn't seem to be anything forbidding you from using Facebook with somebody else's account at the moment (though look for this to change any minute).

I'm suspecting this could be posturing to stem the short-term damage while they try to get a law passed that gives them standing.

The best guess I could come up with is hitting the employer with some sort of cyber-hacking law, but I wouldn't be comfortable or happy with that sort of twisting of such a law.

[1]: http://www.facebook.com/legal/terms

View on HN

Facebook may sue under 18 USC § 1030(g) (http://www.law.cornell.edu/uscode/text/18/1030#g) for unauthorized access to its computer systems if the employer obtains an applicant's password and then accesses the applicant's account using this password. It is unsettled whether the applicant's permission alone would be a defense. In fact, may be a federal crime even if accessing the account was expressly authorized by a state court; see http://volokh.com/2011/12/01/judge-orders-plaintiff-to-give-...

Thank you to you and jleader for good answers.

If the password was voluntarily revealed because you want to be employed and are ready to provide it as a condition of employment, I don't see how you can call it "unauthorized access".

Volokh discusses something else - what if the user does not allow the access voluntarily but is forced by the court (which, unlike employer, is entitled to use force to compel people to do things) to reveal the password. Then it would be like breaking into a house on a search warrant or forcing you to open the safe (this was discussed some time ago here because of other court decision that said - in TLDR version - that 5th amendment protects passwords). But that's different situation.

>If the password was voluntarily revealed ... I don't see how you can call it "unauthorized access".

Because Facebook (the owner of the computer system) did not authorize the access. In fact, Facebook prohibits such access in its TOS.

Facebook decides what constitutes authorized access, not the user. Your right to access the service is not transferable.

Exactly. Imagine if you had a "Million dollars for the login credentials of FBI/CIA/DOE employees!" program. Just because the employees want the million dollars, does not mean the payer is authorised to access those systems.

OK, I guess you have a point, if the information there is not sole property of the password holder - especially as in the case of FBI, where FBI employee has access not to his collection of lolcats pics but to something more important. I guess one could argue on Facebook you can access other's information too, so it still applies.

voluntarily revealed? What about having their job threatened?

Nobody has rights to hold particular job, it's an agreement between employer and employee. If the employer requires you to wear a suit as a condition to employment, you can choose either to comply or keep the jeans and tshirt and find another job, both decisions voluntary. Same with other requirements. Some of course are not legal - so, unless you work in very special industry, having sex with coworkers is not a legal condition - but I don't see Facebook mentioned anywhere there.

"Tortious interference with contract rights can occur where the tortfeasor convinces a party to breach the contract against the plaintiff..." (http://en.wikipedia.org/wiki/Tortious_interference)

In other words, if the employer (Tortfeasor, Inc.) asks you to reveal your password, they're asking you to violate Facebook's TOS, which could be considered a contract you've entered into with Facebook, so Facebook could have grounds to sue the employer.

You'd have to ask a lawyer about the odds of Facebook winning such a suit, and what the damages might be. I'm just a programmer who gets his legal knowledge from Wikipedia.

IANAL, but, my take on this is: Asking the password itself should be none of facebook's business. However, as soon as the employer logs in with the password, they become subject to the TOS as well. The TOS for example contain this clause: You will not use Facebook to do anything unlawful. I don't know if that is enough, but Facebook can also change their TOS. And the lawsuit would pretty good PR for Facebook and pretty bad PR for the employer regardless of the outcome.

I think Blizzard vs. MDY suggests that inducing a user to break the TOS renders the inducer liable to claims of copyright infringement.

http://en.m.wikipedia.org/wiki/MDY_Indus._LLC_v._Blizzard_En....

"The Court found that since the prohibition on botting was a prohibition related to Blizzard's copyright interest in WoW, users of Glider infringed Blizzard's copyright when played the game in violation of the license. The Court believed MDY to be encouraging and profiting from this copyright infringement, and therefore found MDY secondarily liable for the infringement"

While apparently successful in this case, that would appear to be a gross misuse of copyright and this layman would say that Blizzard got lucky and the judgement as precedent sounds fragile.

That's exactly the way GPL misuses copyright to enforce terms on people who have not agreed to contracts with the software provider.

Yes, it's a loophole in copyright law that can be used to massively expand it's scope. It is, however, well established in court.

I wouldn't agree with that characterization. GPL terms only apply to redistributors. If you receive GPL software, it's yours. It is only if you want to do something that copyright requires you to have permission to do that the GPL actually kicks in. If you never redistribute the software, the GPL actually lays zero constraints on you.

This is in contrast to conventional EULAs, which forbid you from using the software until you agree to them (basically forbidding you to "receive" the software), and forbid you from any form of redistribution. The case hythloday cites is a EULA issue.

There's nothing abusive about how the GPL uses copyright law. If you violate the GPL and redistribute the software anyhow, that simply means that you are redistributing software without the consent of the owner, which is a very direct copyright violation, not a strange penumbric emanation or anything.

And reversed on appeal: "To recover for copyright infringement based on breach of a license agreement, (1) the copying must exceed the scope of the defendant’s license and (2) the copyright owner’s complaint must be grounded in an exclusive right of copyright(e.g., unlawful reproduction or distribution)".

Reply on news.ycombinator.com