5 ms·
An employer or college who obtains an applicant's Facebook password and uses that password to access the applicant's Facebook account may be committing a feder
by nokcha 15y ago
An employer or college who obtains an applicant's Facebook password and uses that password to access the applicant's Facebook account may be committing a federal crime under 18 U.S.C. 1030 (Computer Fraud and Abuse Act, prohibiting access of protected computer systems without authorization or in excess of authorization). (Note that the Facebook Terms of Service prohibit sharing one's password or logging in under another's account.) See http://volokh.com/2011/12/01/judge-orders-plaintiff-to-give-defendant-her-facebook-password-so-defendant-can-access-plaintiffs-account-as-part-of-discovery/ http://volokh.com/2011/12/01/judge-orders-plaintiff-to-give-... (noting that such access may be a federal crime even if authorized by a state court order).
The statute (18 U.S.C. 1030) also creates a civil remedy; Facebook may be able to sue employers who access an applicant's account. Even if the statute is held to not apply in such situations (or held to be unconstitutional as applied in such situations [1]), Facebook may still be able to sue under state law for inducing said applicants to breach their contract with Facebook (tortious inteference) by sharing their password.
[1] E.g., see U.S. v. Lori Drew, 259 F.R.D. 449 (C.D. Cal. 2009), where a district court held that 18 U.S.C. 1030 criminalized TOS violations (including falsifying one's date of birth) but was unconstitutional in that regard.
- tibbon 15y agointeresting. I wonder why no one has tried this yet.
- pmorici 15y agoIf someone is dumb enough to give up their Facebook password I doubt they are well versed on the case law surrounding Federal computer crimes.
- fletchowns 15y agoIgnorant maybe, but not dumb.
- just_madhu 15y agoThis is relevant, but not really sufficient to prevent employers from accessing Facebook accounts. Employers that get "permission" from employees or candidates to access a social media account can (likely successfully?) argue that they are proxy for the account owner. We've seen something very similar in the discussions around data rights when people die-- family who inherit passwords are unlikely to be sued where there is explicit permission granted-- because they are not "impersonating" anyone. What could to prevent this is if requests in this manner can be considered coercion or duress-- automatically disqualifying contracts with language requiring disclosure of private passwords, and penalizing parties that try to include similar clauses. I'd love to cite some cases, but have to run (I do appreciate the legal thoroughness!)