Maryland Corrections Agency Demanding All Social Media Passwords Of Potential Hires
from the privacy? dept
You may recall back in 2009 that we wrote about how the city of Bozeman, Montana was requiring people who applied for jobs with the city to cough up all of their social networking usernames and passwords, so that city employees could log in and look around. Beyond being positively ridiculous, this seemed like a huge invasion of privacy. After an awful lot of public ridicule, the city (wisely) decided to drop the requirement, and claim the whole idea had been a "mistake."Apparently not everyone in local government was paying attention.
The ACLU is apparently taking on the case of a Maryland man who applied to be "re-certified" for a job with the Maryland Department of Corrections, after he had taken a brief leave. As a part of the interview process, he was required to hand over his Facebook password. Apparently, the Department of Corrections is now requiring all social media account info, including passwords, as a part of their "background check" process. In at least this case, the guy in question was told not to change his password for a few months -- leading to all sorts of questions about what private info state officials might look into while logged into his account. The ACLU sent a letter (pdf) to the Maryland Corrections Dept. noting that it believed the policy was "a frightening and illegal invasion of privacy," and a clear violation of the Stored Communications Act. The ACLU letter also demanded that the Maryland Department of Corrections rescind this policy.
It appears that Maryland's response to all of this has been to totally ignore the letter. The ACLU waited three weeks, and after receiving no response at all, has gone public with the story. I would imagine that a lawsuit will soon follow.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Reader Comments
Subscribe: RSS
View by: Time | Thread
Setup fake/dummy account?
Just name, a few photos and a few likes/connections/maybe even friends.
Turn over the credentials to the decoy account.
Now, I fully disagree with these types of policies. The real solution is for the employer to not ask for this info, but as long as they're going to ask (and people need work), let's do what we can to protect ourselves.
[ link to this | view in chronology ]
Re: Setup fake/dummy account?
[ link to this | view in chronology ]
Re: Setup fake/dummy account?
It does sort of create a plausible deniability(sp?). "Nope, wasn't me, must have been someone from XYZ agency as they took my passwords and forbid me to change it."
[ link to this | view in chronology ]
Re: Setup fake/dummy account?
[ link to this | view in chronology ]
Drug Test?
I'm not in favor of giving passwords out. I wouldn't apply to a job that asked me to give that information out or told me not to change my password. But that's my choice. And I could refuse a drug test for employment if I wanted to - and not be offered the job as a result.
I'm all in favor of the ACLU successfully challenging a rule that I think will only serve to reduce the number of qualified applicants available to the MD Correctional System. But how is this social media test any different than a drug test?
[ link to this | view in chronology ]
Re: Drug Test?
[ link to this | view in chronology ]
Re: Re: Drug Test?
And again, I fail to see how this is different. If one's Facebook stream shows you doing or taking something illegal, then how is this test isn't the same as a drug test.
Perhaps its not as defensible in court as a drug test if you were to not get hired (or fired) but it could be construed as another test for illegal activity. And in a correctional facility, don't you want that?
[ link to this | view in chronology ]
Re: Re: Re: Drug Test?
Many state laws say otherwise. This of course varies from state to state, but the majority of them state that testing notification has to be given in advance.
[ link to this | view in chronology ]
Re: Re: Re: Drug Test?
There is no justification for given them your passwords.
If you were required to drive for a job, would you feel ok giving the company a copy of your car keys? They can just drop by and take your care whenever they might need to check out that it wasn't illegally modified?
[ link to this | view in chronology ]
Re: Re: Re: Drug Test?
You can't see how this is different from a drug test? How about you give up your bank account username and password, just to see if you're making any illegal transactions. Then sit at home and wonder why you have no money left.
Let me explain it like this, you take illegal drugs, your judgement is impaired, you go to work while impaired, and you make some sort of mistake. Maybe it causes someone to get injured, or causes your employer to lose thousands of dollars. To try and prevent this they do a pre-employment drug screen. If you fail, you are not offered the job. What they are testing for is whether you have any illicit substances in your system.
To say that this drug test is the same as offering up your username and password for a social media site is the same as (given the technology actually existed) allowing your prospective employer to take over your body, telling you that you aren't allowed to lock them out for a couple of months. While they are in your body they can walk through life impersonating you, doing things that you have no control over, for which you will feel the ramifications of further down the line.
If you really want to compare this to a pre-employment drug screen you have to realize that the drug screen only allows the tester to see the results of a given action, not have the power to alter that action. In the social media example this would equate to the tester being able to see the result of something you do on a given site, not having the power to do something in your name on that site. Giving up your credentials for the site would allow them to do just that. Pissing in a cup does not allow the tester to take the drugs for you.
[ link to this | view in chronology ]
Re: Re: Re: Drug Test?
There is a constitutional amendment, as well as an implied right to privacy, that protects your freedom to speak, be heard and associate freely.
Therefore, the government, can't force you to relinquish your rights, and Maryland Correctional is a government agency, except in certain narrowly tailored instances.
It would be the same if they insisted that only practicing Southern Baptists could work for them.
The ACLU is right in this one, and the sooner and firmer that government agencies get the message the better it will be for all of us.
[ link to this | view in chronology ]
Re: Re: Re: Drug Test?
1) No company GIVES a drug test. They hire outside, independent labs to do so. All that is usually required is a little urine or blood.
2) Do you readily give up the keys to your home to an employer to search for "illegal" activities before they hire you? No? They why would you think giving up your social media accounts is any different?
I think it's always telling that someone wants to claim it's "like" something else, when it clearly is not like that other thing at all. This is not like taking your blood, this is snooping in on your private conversations with friends and relatives. Thought and conversations are not the same as taking blood to test for drug use (though in my personal opinion that's pretty invasive, too... what I ingest at home on my time should have no bearing on my employability if I do a good job at work every day).
[ link to this | view in chronology ]
Re: Drug Test?
Where is the line? Require you to hand over your GPS so the can check if you were speeding or visiting shady neighborhoods, demand your medical records to see your health history looking for STDs other bad habits. Demand your banking and credit card history .... ?
We willingly give up our privacy in little bits, that become bytes, that non-linearly become kilo-mega-giga-tera-peta-yottabytes. I value my privacy not because I have something to hide, I value my privacy and as a citizen of the United States of America, I'm not willing to give these up for a job or for our government to eliminate risk for me.
[ link to this | view in chronology ]
Re: Re: Drug Test?
But seriously...
Different industries do ask for more personal information to receive benefit or employment. The adult film industry (by law) tests for STDs and performers can't work without a clear HIV test. Your car keys aren't taken but your driver's license is and your driving record IS checked. People with a history of smoking can be charged a premium for health care.
Our government doesn't guarantee you a job that has no screening - especially in the private sector. What it does do is help protect a person from discrimination on the basis of things that are beyond their control and some personal choice - race, sex, sexual orientation, etc. You're free to start your own business if you don't like the practices and enforce your own hiring rules so long as they don't discriminate.
But that said, I am in total favor of the ACLU winning this (if they take legal action) - I'm not happy with the slow erosion of our privacy either. But that's happening because we as a society are asking for more and more Facebook, not because the Feds or private employers are asking for too much. As society becomes more open, it is reasonable to expect employers to ask for this information as part of a background check.
[ link to this | view in chronology ]
Re: Re: Re: Drug Test?
[ link to this | view in chronology ]
Re: Drug Test?
I'm not saying either scenario is likely.
Another difference is that your blood/urine aren't going to the employer directly for them to run any tests willy-nilly, checking your genes for genetic disorders or what have you. It goes to a lab that (presumably) tests it only for drugs and then reports back to the employer with a yea or nay. Whereas giving passwords over to the employer allows them to check anything and everything.
As an example, let's say an applicant used to do drugs, but hasn't for many years. Their facebook profile and history may show that, but obviously their blood/urine will not.
[ link to this | view in chronology ]
Re: Drug Test?
There are no laws against using social media.
Its also different in the same way that a physical search for drugs at Customs is significantly different than a Customs agent wanting to copy all the data off you laptop and smartphone to peruse at their leisure.
In fact, I'd say requiring full and ongoing access to your Facebook account is actually worse. It goes against freedom of speech, freedom of association, and is pretty clearly in violation of the Fourth Amendment. The chilling effect of knowing that both the government and your boss has access to what you say to your friends and family is severe.
[ link to this | view in chronology ]
Re: Drug Test?
A drug test looks for ONLY the specified illegal behavior, that is, use of the drugs being tested for. You agree to take it with full informed consent - You know what they're looking for, and you know whether or not you've engaged in the behavior being tested for (even if you think you can beat the test).
Giving a potential employer full access to your social media does not - it gives a potential employer carte blanche to go fishing through your whole life just because they want to, with no specified purpose or limits. You don't know what they're looking FOR, you don't know what they're looking AT, and you don't know WHO is looking or who else they're sharing your data with, how long they're retaining it...
[ link to this | view in chronology ]
Re: Drug Test?
Presumably a drug test only tests for use of illegal drugs. If you get turned down for a job because of a drug test you can at least challenge the test.
Checking your online persona is entirely different. Are they looking to see whether you "liked" things that are perfectly legal but the government reviewer doesn't like?
Plus, they now have my password and account credentials, so they can actually alter my material or cause problems. They really don't like you? Take your password to a public hotspot and send a threatening email to the President or do a hundred other things that cause you trouble.
There are huge differences between a mandatory drug test and surrendering your online persona.
[ link to this | view in chronology ]
Re: Drug Test?
[ link to this | view in chronology ]
Another frightening prospect...
[ link to this | view in chronology ]
Re: Another frightening prospect...
At work "You are not on Linkdin?" with a quizzical look.
Why are you not part of the hive? There must be something wrong with you, what are you hiding?
[ link to this | view in chronology ]
Re: Re: Another frightening prospect...
When security is a priority for FB I *might* consider it.
[ link to this | view in chronology ]
Re: Re: Another frightening prospect...
[ link to this | view in chronology ]
Re: Another frightening prospect...
Then when someone accuses me of just setting up the account for the interview, I point out thatI've had it for months.
[ link to this | view in chronology ]
Re: Another frightening prospect...
I guess in the end, Sally Floyd had the last laugh. You're now a non-person if you ignore social networking.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
Re:
If theirs has that policy, it would mean that anyone who was hired while meeting HR policies would then have to be immediately fired for violating IT policies.
NMM
[ link to this | view in chronology ]
Hm... waiting to see if this ideas is going to be combined with...
http://www.orlandoforums.com/forum/news-politics-current-events/147954-police-use-college-i ntern-undercover-stripper.html
Let the lawsuits fly!
[ link to this | view in chronology ]
Interesting...
So what does that say about an applicant who complies.... that they can't honor an agreement.
Yes... liars make great employees.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
It also seems like this would be a violation of Facebook's terms of service, which say you can't login as anyone other than yourself and you can't share your password with anyone. And since the federal government insisted in the Lori Drew case that violating a web site's terms of service is equivalent to "computer hacking", it seems like the State of Maryland may be soliciting a federal felony here, as well.
[ link to this | view in chronology ]
I'd just delete my Facebook - done deal.
[ link to this | view in chronology ]
Re: Done Deal
First the stigma of not wearing your red arm band ... Why don't you have a Facebook account (See above)
And then AH ... you used to wear your red arm band and now you took it off. What are you hiding? What is wrong with you?
As Mike always says ... if it is on the internet, it is there forever.
[ link to this | view in chronology ]
Facebook?
Just kidding! I don't have one, won't get one, and don't care about it either! I also have never bought coffee at Starbucks or been to a nightclub.
[ link to this | view in chronology ]
State of Maryland form letter to new parents...
Congratulations on the birth of your new baby! [[insert name of baby]] is a wonderful name. We're sure your child will accomplish great things and provide you and your family with years of joy and love.
Now that your child has been born, the State of Maryland has created several social media and email accounts for their use over the course of your child's life.
Until they are old enough to use these services themselves, we encourage you to create posts to share your child's experiences with your friends and family.
Facebook, twitter, Hotmail, Yahoo!, and gmail account information is listed here:
Facebook: [[insert user id]]
twitter: [[insert user id]]
Hotmail: [[insert user id]]
Yahoo!: [[insert user id]]
gmail: [[insert user id]]
The current password for all 5 accounts is your baby's name followed by their date of birth in the format MMDDYY. Please login to the accounts and change the passwords as soon as possible to protect your child's identity.
Please keep in mind that any password changes are transmitted to FICO, Experian, Equifax, TransUnion, and the Maryland Departments of Revenue, Justice, and Motor Vehicles. This is to aid in future credit reporting and background checks and prevent your child's identity from being stolen.
We assure you that any user account information will be completely secure and will be obscured from any state, federal, or private employee.
Warmest regards on this happy occasion,
[[insert name of current governor]]
[[insert digital signature of current governor]]
Governor, State of Maryland
[ link to this | view in chronology ]
Facebook friend breach of privacy
I'm sure Facebook's own T&Cs mention something along the lines of letting other use your account.
What if my employer uses my password to start spying on my sexy wife's beach pictures? My daughter's photos? An old friend who's a potential new employer?
[ link to this | view in chronology ]
Well, maybe my employer got it and changed my password so that I can't login.
Let me first defend MD Dept of Corrections, first. Department of Corrections is concerned with incarcerated people. A plausible reason for demanding this information from its employees and potential employees is, of course, background information.
Corrections employees can, and probably have, formed relationships with the inmates, and monitoring their social interactions online with inmates, their friends, and their relatives, CAN indicate that the employee is having n improper relationship, and I don't necessarily mean one of a sexual nature, with inmates.
The problem is, that there is this federal agency called the Office of Personnel Management, and background checks fall in with their line of responsibilities (www.opm.gov) and although the process costs the government a huge amount of money each year, it is certainly necessary to help weed out those who may not be suited for government employment.
I do believe that this was a misguided attempt to help ensure public safety. I do believe that at not time, should anyone be required to submit passwords of any kind, to anyone, for any reason.
That being said, to obtain a Top Secret Security Clearance with Sensitive Compartmented Information eligibility and access, one is not (at least not military or contractors) required to divulge this information.
A more appropriate way to do this might be to create employer accounts and require employees to declare their employment, allowing the employers to see each emplyee's wall posts, friends, likes, etc. Except, there's still the high probability that employees will still be discriminated upon for their personal views which have nothing to do with the jobs they perform.
Oh, and lets not forget that anyone who declares their employment with any company in particular can now be targeted by that affiliation. In the Army, we called not broadcasting personal and professional information a part of Force Protection. I suppose it could be modified to be called Workforce Protection in the civilian world.
I hope ACLU files suit and wins, no matter what Maryland's stance is, now that this is public.
Anyone for an amendment to the Privacy Act?
[ link to this | view in chronology ]
Re: Passwords
I was a prison librarian and one day one of the inmates ,where I worked (maximum security), sent or had sent a holiday card. Then I had a public phone number and it was relatively easy for this inmate to get my address. Nothing came of it. The inmate was in for burglaries, but I realized that it was a hazard. I was living in a gated community with private police and far outside the cities. If I hadn't been, perhaps I would have felt more vulnerable.
[ link to this | view in chronology ]
Maryland decided to stop asking for Facebook passwords for 45 days
"Update 2/22, 5:11pm: The Maryland Department of Public Safety and Correctional Services has suspended the practice of asking for Facebook login information for 45 days, according to an email they sent to The Atlantic." http://www.theatlantic.com/technology/archive/11/02/maryland-agency-stops-asking-interviewees-for-fa cebook-login-info/71582/
[ link to this | view in chronology ]
Passwords
[ link to this | view in chronology ]
Re: Passwords
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
TOS
[ link to this | view in chronology ]