6 ms·

I have to say, I'm really impressed with Facebook for coming out and making this their issue, instead of just waiting for the applicants and employers to slowly

I have to say, I'm really impressed with Facebook for coming out and making this their issue, instead of just waiting for the applicants and employers to slowly work it out between themselves. In hindsight, it's seems like an obviously smart move (both to impress their userbase and to remove disincentives to use Facebook), but somehow it didn't occur to me that they might join in on the fight. Good for them.

nextparadigms 15y ago
I actually expected them to do this, because it would've been to their detriment if they didn't. If asking for the employees password became a "thing", people would've started quitting Facebook, or at the very least try to make fake accounts for their employers. But even so, it's still nice to see them actually doing it.
orbitingpluto 15y ago
Agreed. Damn good PR move. <sarcasm> Plus those employers shouldn't be getting their Facebook background checks for free. FB has to protect it's future revenue streams! </sarcasm> When FB starts protecting user data from everybody, individuals, business and government, that'll be something. Might even be worth having to wade through your aunt's cats-in-clothing posts.
- joering2 15y ago
  HOW can Facebook, or anyone else _successfully_ protect user data from government without breaking the law?
  - orbitingpluto 15y ago
    By providing at least token resistance? People shouldn't be getting roped in by the law because law enforcement has free reign to peruse profiles. As well, infiltrating profiles by 'social hacking' (aka asking to friend someone by having a profile with breasts on it) shouldn't be allowed by law enforcement doing fishing operations. In other words, communications on Facebook should be considered as private communication. Monetization by anonymous advertising akin to Google's model should be the accepted quid pro quo for usage.
  - dakotasmith 15y ago
    Sometimes pieces of government are unaware of laws they are breaking until a well-funded challenger can use the courts to educate it.
  - rhizome 15y ago
    Successfully protecting user data from the government isn't an either/or zero-sum situation, it's a game of inches. They should protect it up to the point at which they are most unable, and not a minute nor filing before.
  - Cushman 15y ago
    Require a confirmed court order before any amount of cooperation with authorities, including the acknowledgement that data might exist. Assign a legal team to investigate all such orders, and proactively seek injunctions against those that overstep their authority. Require that all government employees and contractors disclose their involvement (not publicly, obviously) and subject those individuals to enhanced scrutiny with regards to unwarranted data mining. Pursue aggressive legal action against the state for any individuals found in violation of this policy. Of course, any of this would require Facebook or anyone else to treat its users as customers rather than products.
    - DavidSJ 15y ago
      They can also publish statistics about law enforcement requests by political region, as Google does in its transparency report.
    - lurchpop 15y ago
      This would be amazing. What I'd also like to know is if LEOs have FB accounts with additional features, or if they have specialized UI where they can query user data. A whistleblower at Verizon a few years ago talked about a paid self-serve web interface they built for law enforcement to query location data because the volume of requests was too much to process manually. Does the "secret interpretation" of the Patriot Act we keep hearing about include unfettered access to social networks?
  - deleted 15y ago
    [deleted]
  - rdl 15y ago
    Avoid collecting potentially sensitive information in the first place, if at all possible. Collecting and retaining the least possible amount of information about users is good security; it's just bad commercial practice. It also protects your users in case you go out of business and end up sold (or pivoting) into a non-privacy-protecting business model, like what happened with Rapleaf.
- shangrila 15y ago
  FB is indeed probably upset because employers were stupid and started asking applicants for their info directly instead of going behind their backs and asking FB for it instead (which FB would have happily given them ... for a fee, of course). It's pretty likely FB will quietly roll out a paid background check service (which will be hyper-secretive and kept whisper-quiet) at the same time they are publicly grandstanding about this issue. In the linked article, there is a link to a second article about a US Senator who is currently crusading on this issue. He comes right out and says there will be exceptions for law enforcement, government contractors, and jobs with security clearances. Look for them to extend those exceptions until social media spying is back to being a de-facto part of applying for a job, any job. They're going to legitimize this while pretending to be fighting it. (sounds paranoid, yes ... until it happens)
iamandrus 15y ago
I agree. This was a damn good way of handling the situation: taking care of it head-on instead of watching from the sidelines and hoping things get better. I didn't think they would do much (except for maybe a blog post about how you shouldn't give your password to anyone or something similar), but this is totally beyond what I expected.
benihana 15y ago
The cynic in me says that facebook is doing this because the employers didn't go through the proper channels (i.e. pay facebook for that kind of access) and it's a message: If you want that kind of data, you have to pay for it. I hope this isn't the case, but facebook doesn't really have a great record when it comes to privacy.
- joering2 15y ago
  I don't think Facebook would want to sell its data so obviously just offering users' profiles to any business that comes and pays. This would be too bold of a move.
- jonnathanson 15y ago
  Your cynicism is somewhat warranted, but slightly misplaced. Facebook is doing this because not doing so would be really bad for business: i.e., it would threaten the user experience of the site. People would either quit Facebook, spend less time on it, severely tone down or alter their usage of it, or create fake profiles for work. Any or all of those things would be a big detriment to Facebook. So taking a stand on this issue is both good for business and good for PR.
- dinkumthinkum 15y ago
  The possibility of a whistleblower, I think, would be too high. It would probably destroy Facebook or close to it.
ankimal 15y ago
Its an issue that can lead to a chain reaction. Facebook is protecting itself by protecting its users. Employers make 'facebook background check' hiring policy -> FB users/prospective employees become more conscious of this -> User engagement drops as users are more careful about posting anything under the sun -> FB loses
__abc 15y ago
Honestly, this protects them more then anybody else. If this "behavior" became norm for employers, people would begin simply deleting their Facebook accounts in droves. Facebook is valuable, but not "that" valuable where people would sacrifice a potential job opportunity in favor of keeping their Facebook profile. That being said, I do like that Facebook has weighed in and it favors an individuals right to privacy.
larrys 15y ago
"I have to say, I'm really impressed with Facebook for coming out and making this their issue" I don't find it impressive or surprising. This is a major issue that would change what people would want to share. No sharing - no facebook. It's obvious that they need to do whatever they can fair, unfair, legal, fud to stop employers from requesting access to a facebook users page. Another commenter (jerf http://news.ycombinator.com/item?id=3745916 http://news.ycombinator.com/item?id=3745916 ) brought up the issue of legal standing which I agree with. Facebook probably doesn't have legal standing (that is clear) but the mere fact they are raising the issue will stall the process and give them time to come up with a solution. And instill "carry on as usual nothing to see here" into facebook users. They are getting out in front of the problem before it spins out of control.
- yuliyp 15y ago
  Why wouldn't Facebook have legal standing? They're the ones whose servers are being accessed without authorization (employer does not have authorization to use someone else's credentials).
  - larrys 15y ago
    They are getting the credentials by asking the potential employee for them. So it's not without authorization. Even if they wanted to build a case of coercion or duress they would need the cooperation of the employee to do this. And most importantly what is the specific harm done to facebook by this individual action? If I give you my facebook credentials and you login what damage has been done (to facebook in my specific case)? If I was the opposing attorney I would raise the issue of whether they police and take action when people share their passwords in other cases. My guess is they have never taken action on something like this in the past. And as far as changing their TOS what are they going to say? We forbid you from sharing your password with an employer (some might want to do this for some reason) or we forbid you to share with anyone? And if that is the case they have to police all sharing of passwords which, with hundreds of millions of users is simply not going to happen.
    - 15y ago
deleted 15y ago
[deleted]

nextparadigms 15y ago

I actually expected them to do this, because it would've been to their detriment if they didn't. If asking for the employees password became a "thing", people would've started quitting Facebook, or at the very least try to make fake accounts for their employers. But even so, it's still nice to see them actually doing it.

orbitingpluto 15y ago

Agreed. Damn good PR move. <sarcasm> Plus those employers shouldn't be getting their Facebook background checks for free. FB has to protect it's future revenue streams! </sarcasm> When FB starts protecting user data from everybody, individuals, business and government, that'll be something. Might even be worth having to wade through your aunt's cats-in-clothing posts.

joering2 15y ago
HOW can Facebook, or anyone else _successfully_ protect user data from government without breaking the law?
- orbitingpluto 15y ago
  By providing at least token resistance? People shouldn't be getting roped in by the law because law enforcement has free reign to peruse profiles. As well, infiltrating profiles by 'social hacking' (aka asking to friend someone by having a profile with breasts on it) shouldn't be allowed by law enforcement doing fishing operations. In other words, communications on Facebook should be considered as private communication. Monetization by anonymous advertising akin to Google's model should be the accepted quid pro quo for usage.
- dakotasmith 15y ago
  Sometimes pieces of government are unaware of laws they are breaking until a well-funded challenger can use the courts to educate it.
- rhizome 15y ago
  Successfully protecting user data from the government isn't an either/or zero-sum situation, it's a game of inches. They should protect it up to the point at which they are most unable, and not a minute nor filing before.
- Cushman 15y ago
  Require a confirmed court order before any amount of cooperation with authorities, including the acknowledgement that data might exist. Assign a legal team to investigate all such orders, and proactively seek injunctions against those that overstep their authority. Require that all government employees and contractors disclose their involvement (not publicly, obviously) and subject those individuals to enhanced scrutiny with regards to unwarranted data mining. Pursue aggressive legal action against the state for any individuals found in violation of this policy. Of course, any of this would require Facebook or anyone else to treat its users as customers rather than products.
  - DavidSJ 15y ago
    They can also publish statistics about law enforcement requests by political region, as Google does in its transparency report.
  - lurchpop 15y ago
    This would be amazing. What I'd also like to know is if LEOs have FB accounts with additional features, or if they have specialized UI where they can query user data. A whistleblower at Verizon a few years ago talked about a paid self-serve web interface they built for law enforcement to query location data because the volume of requests was too much to process manually. Does the "secret interpretation" of the Patriot Act we keep hearing about include unfettered access to social networks?
- deleted 15y ago
  [deleted]
- rdl 15y ago
  Avoid collecting potentially sensitive information in the first place, if at all possible. Collecting and retaining the least possible amount of information about users is good security; it's just bad commercial practice. It also protects your users in case you go out of business and end up sold (or pivoting) into a non-privacy-protecting business model, like what happened with Rapleaf.
shangrila 15y ago
FB is indeed probably upset because employers were stupid and started asking applicants for their info directly instead of going behind their backs and asking FB for it instead (which FB would have happily given them ... for a fee, of course). It's pretty likely FB will quietly roll out a paid background check service (which will be hyper-secretive and kept whisper-quiet) at the same time they are publicly grandstanding about this issue. In the linked article, there is a link to a second article about a US Senator who is currently crusading on this issue. He comes right out and says there will be exceptions for law enforcement, government contractors, and jobs with security clearances. Look for them to extend those exceptions until social media spying is back to being a de-facto part of applying for a job, any job. They're going to legitimize this while pretending to be fighting it. (sounds paranoid, yes ... until it happens)

iamandrus 15y ago

I agree. This was a damn good way of handling the situation: taking care of it head-on instead of watching from the sidelines and hoping things get better. I didn't think they would do much (except for maybe a blog post about how you shouldn't give your password to anyone or something similar), but this is totally beyond what I expected.

benihana 15y ago

The cynic in me says that facebook is doing this because the employers didn't go through the proper channels (i.e. pay facebook for that kind of access) and it's a message: If you want that kind of data, you have to pay for it. I hope this isn't the case, but facebook doesn't really have a great record when it comes to privacy.

joering2 15y ago
I don't think Facebook would want to sell its data so obviously just offering users' profiles to any business that comes and pays. This would be too bold of a move.
jonnathanson 15y ago
Your cynicism is somewhat warranted, but slightly misplaced. Facebook is doing this because not doing so would be really bad for business: i.e., it would threaten the user experience of the site. People would either quit Facebook, spend less time on it, severely tone down or alter their usage of it, or create fake profiles for work. Any or all of those things would be a big detriment to Facebook. So taking a stand on this issue is both good for business and good for PR.
dinkumthinkum 15y ago
The possibility of a whistleblower, I think, would be too high. It would probably destroy Facebook or close to it.

ankimal 15y ago

Its an issue that can lead to a chain reaction. Facebook is protecting itself by protecting its users. Employers make 'facebook background check' hiring policy -> FB users/prospective employees become more conscious of this -> User engagement drops as users are more careful about posting anything under the sun -> FB loses

__abc 15y ago

Honestly, this protects them more then anybody else. If this "behavior" became norm for employers, people would begin simply deleting their Facebook accounts in droves. Facebook is valuable, but not "that" valuable where people would sacrifice a potential job opportunity in favor of keeping their Facebook profile. That being said, I do like that Facebook has weighed in and it favors an individuals right to privacy.

larrys 15y ago

"I have to say, I'm really impressed with Facebook for coming out and making this their issue" I don't find it impressive or surprising. This is a major issue that would change what people would want to share. No sharing - no facebook. It's obvious that they need to do whatever they can fair, unfair, legal, fud to stop employers from requesting access to a facebook users page. Another commenter (jerf http://news.ycombinator.com/item?id=3745916 http://news.ycombinator.com/item?id=3745916 ) brought up the issue of legal standing which I agree with. Facebook probably doesn't have legal standing (that is clear) but the mere fact they are raising the issue will stall the process and give them time to come up with a solution. And instill "carry on as usual nothing to see here" into facebook users. They are getting out in front of the problem before it spins out of control.

yuliyp 15y ago
Why wouldn't Facebook have legal standing? They're the ones whose servers are being accessed without authorization (employer does not have authorization to use someone else's credentials).
- larrys 15y ago
  They are getting the credentials by asking the potential employee for them. So it's not without authorization. Even if they wanted to build a case of coercion or duress they would need the cooperation of the employee to do this. And most importantly what is the specific harm done to facebook by this individual action? If I give you my facebook credentials and you login what damage has been done (to facebook in my specific case)? If I was the opposing attorney I would raise the issue of whether they police and take action when people share their passwords in other cases. My guess is they have never taken action on something like this in the past. And as far as changing their TOS what are they going to say? We forbid you from sharing your password with an employer (some might want to do this for some reason) or we forbid you to share with anyone? And if that is the case they have to police all sharing of passwords which, with hundreds of millions of users is simply not going to happen.
  - 15y ago

deleted 15y ago

[deleted]