6 ms·

>"or that the employee uses for business purposes." This is the part that fucks the whole thing up. It's too vulnerable to misinterpretation or abuse.

by phaus 13y ago

tptacek 13y ago
Using an unauthorized Internet application to conduct business for your company was already something that could get you fired. The law doesn't authorize employers to break into your accounts; you presumably retain "quitting" as a recourse to turning over account information.
- phaus 13y ago
  Of course, but when you see how many laughably horrible decisions our courts make on a regular basis, it wouldn't be all that surprising for a company to argue that your personal account was used for business purposes for a variety of reasons. For example, the mere mention of your employer's name on a site like Linkedin, or perhaps a developer that is known to work at a prominent company who maintains a programming blog. It's also already a prosecutable offense to lock your company out of a business related account, so what is the point of establishing more legislation?
  - tptacek 13y ago
    Laws that create prosecutable offenses in the ILCS say things like "Any person failing to comply with $(CLAUSE) shall be guilty of a $(CRIME_LEVEL)". This one obviously does not do that. The reason for the legislation is that Illinois companies are specifically not permitted to demand credentials for personal social media accounts; it creates an exception to at-will employment in Illinois that would enable you to sue your employer if you were terminated incident to refusing credentials.
  - rayiner 13y ago
    > Of course, but when you see how many laughably horrible decisions our courts make on a regular basis, Only if you let HN and reddit rashly interpret your court decisions for you... > It's also already a prosecutable offense to lock your company out of a business related account, so what is the point of establishing more legislation? Because by itself, the previous language created an ambiguous situation. All the new bill does is clarify that the ban on asking for login credentials for a personal account doesn't override the offense of locking your company out of a business-related account.
hkmurakami 13y ago
The most vulnerable example would be retweets of your company's tweets using your own personal account. Retweeting mental barriers are so low (even compared to FB likes and shares) that a huge fraction of people would be caught under such an umbrella.
- jmj42 13y ago
  > retweets ... using your own personal account. No, I think it's pretty clear. Once information is publish via the company's twitter account, it becomes public information. It would be a very long stretch for retweeting public information to change the nature of a personal account to fall under this law. Not to mention, Illinois' has notoriously labor friendly courts (I live in IL). While landing in court is an obvious problem for the employee to defend/prosecute, the reputation/record of IL labor courts make it an even steeper hill for an employeer to climb than for the employee.
  - hkmurakami 13y ago
    Hmm, how about things like tweeting links to your company's blog, your company's product, or your company's documentation? This probably happens a little bit less frequently but enough for us to at least take a cursory look. While I would hope that most startups are above this kind of behavior, since startups tend to ask their people to use their personal accounts for marketing purposes, I have to at least have some concern...
    - tptacek 13y ago
      Like I said downthread, reading the statute in the airless vacuum of a message board, it's easy to try to poke holes in it. In reality, anything that amounts of an exception to the at-will doctrine creates an enormous minefield for employers. Terminated employees are very frequently disgruntled and can be counted on, over time, in the large, to bring meritless cases. Employers who want to survive without being stuck up for settlements are going to become very process-bound for how they handle credentials. Think of it this way: worst-case downside to employee from this law: early termination. Downside to employer: horrifically expensive legal debacle.
deleted 13y ago
[deleted]
malandrew 13y ago
I think the only litmus test necessary is that the account name use the companies name in someway. i.e. If your company is Acme Anvil Co and the terms Acme or Anvil are in the username (or vanity url, etc), in someway, then it qualifies as a business account. Barring that, any social media accounts should be viewed as personal, even if the following amassed under that account came by virtue of employment with the company in question.

>"or that the employee uses for business purposes." This is the part that fucks the whole thing up. It's too vulnerable to misinterpretation or abuse.

by phaus 13y ago

>"or that the employee uses for business purposes." This is the part that fucks the whole thing up. It's too vulnerable to misinterpretation or abuse.

tptacek 13y ago

Using an unauthorized Internet application to conduct business for your company was already something that could get you fired. The law doesn't authorize employers to break into your accounts; you presumably retain "quitting" as a recourse to turning over account information.

phaus 13y ago
Of course, but when you see how many laughably horrible decisions our courts make on a regular basis, it wouldn't be all that surprising for a company to argue that your personal account was used for business purposes for a variety of reasons. For example, the mere mention of your employer's name on a site like Linkedin, or perhaps a developer that is known to work at a prominent company who maintains a programming blog. It's also already a prosecutable offense to lock your company out of a business related account, so what is the point of establishing more legislation?
- tptacek 13y ago
  Laws that create prosecutable offenses in the ILCS say things like "Any person failing to comply with $(CLAUSE) shall be guilty of a $(CRIME_LEVEL)". This one obviously does not do that. The reason for the legislation is that Illinois companies are specifically not permitted to demand credentials for personal social media accounts; it creates an exception to at-will employment in Illinois that would enable you to sue your employer if you were terminated incident to refusing credentials.
- rayiner 13y ago
  > Of course, but when you see how many laughably horrible decisions our courts make on a regular basis, Only if you let HN and reddit rashly interpret your court decisions for you... > It's also already a prosecutable offense to lock your company out of a business related account, so what is the point of establishing more legislation? Because by itself, the previous language created an ambiguous situation. All the new bill does is clarify that the ban on asking for login credentials for a personal account doesn't override the offense of locking your company out of a business-related account.

hkmurakami 13y ago

The most vulnerable example would be retweets of your company's tweets using your own personal account. Retweeting mental barriers are so low (even compared to FB likes and shares) that a huge fraction of people would be caught under such an umbrella.

jmj42 13y ago
> retweets ... using your own personal account. No, I think it's pretty clear. Once information is publish via the company's twitter account, it becomes public information. It would be a very long stretch for retweeting public information to change the nature of a personal account to fall under this law. Not to mention, Illinois' has notoriously labor friendly courts (I live in IL). While landing in court is an obvious problem for the employee to defend/prosecute, the reputation/record of IL labor courts make it an even steeper hill for an employeer to climb than for the employee.
- hkmurakami 13y ago
  Hmm, how about things like tweeting links to your company's blog, your company's product, or your company's documentation? This probably happens a little bit less frequently but enough for us to at least take a cursory look. While I would hope that most startups are above this kind of behavior, since startups tend to ask their people to use their personal accounts for marketing purposes, I have to at least have some concern...
  - tptacek 13y ago
    Like I said downthread, reading the statute in the airless vacuum of a message board, it's easy to try to poke holes in it. In reality, anything that amounts of an exception to the at-will doctrine creates an enormous minefield for employers. Terminated employees are very frequently disgruntled and can be counted on, over time, in the large, to bring meritless cases. Employers who want to survive without being stuck up for settlements are going to become very process-bound for how they handle credentials. Think of it this way: worst-case downside to employee from this law: early termination. Downside to employer: horrifically expensive legal debacle.

deleted 13y ago

[deleted]

malandrew 13y ago

I think the only litmus test necessary is that the account name use the companies name in someway. i.e. If your company is Acme Anvil Co and the terms Acme or Anvil are in the username (or vanity url, etc), in someway, then it qualifies as a business account. Barring that, any social media accounts should be viewed as personal, even if the following amassed under that account came by virtue of employment with the company in question.