
Illinois moves to legalise employer access to workers' social media accounts - ramisms
http://stream.aljazeera.com/story/201304302238-0022716
======
jmj42
This isn't even as close to as bad as it made out to be. From the full text of
ILCS after amendment:

(b)(1)It shall be unlawful for any employer to request or require any employee
or prospective employee to provide any user name and password, password, or
other means of authentication to gain access to the employee's or prospective
employee's personal internet account.

(2)An employer may request or require an employee to disclose any user name
and password, password, or other means of authentication for accessing any
accounts or services provided by the employer or by virtue of the employee's
employment relationship with the employer or that the employee uses for
business purposes.

Note: Paragraph 1 retains the ban on asking for account information for
personal accounts, and paragraph 2 authorizes asking for the info for
business/employeer provided accounts.

So, unlike the headline, in fact this bill moves to legalize access to the
businesses social media accounts.

~~~
phaus
>"or that the employee uses for business purposes."

This is the part that fucks the whole thing up. It's too vulnerable to
misinterpretation or abuse.

~~~
tptacek
Using an unauthorized Internet application to conduct business for your
company was already something that could get you fired. The law doesn't
authorize employers to break into your accounts; you presumably retain
"quitting" as a recourse to turning over account information.

~~~
phaus
Of course, but when you see how many laughably horrible decisions our courts
make on a regular basis, it wouldn't be all that surprising for a company to
argue that your personal account was used for business purposes for a variety
of reasons. For example, the mere mention of your employer's name on a site
like Linkedin, or perhaps a developer that is known to work at a prominent
company who maintains a programming blog.

It's also already a prosecutable offense to lock your company out of a
business related account, so what is the point of establishing more
legislation?

~~~
tptacek
Laws that create prosecutable offenses in the ILCS say things like "Any person
failing to comply with $(CLAUSE) shall be guilty of a $(CRIME_LEVEL)". This
one obviously does not do that.

The reason for the legislation is that Illinois companies are specifically
_not_ permitted to demand credentials for personal social media accounts; it
creates an exception to at-will employment in Illinois that would enable you
to sue your employer if you were terminated incident to refusing credentials.

------
evan_
Since the article linked is mostly twitter reactions, here's the actual text
of the bill:

[http://www.ilga.gov/legislation/billstatus.asp?DocNum=1047&#...](http://www.ilga.gov/legislation/billstatus.asp?DocNum=1047&GAID=12&GA=98&DocTypeID=HB&LegID=71494&SessionID=85)

and a better article:

[http://blogs.suntimes.com/politics/2013/04/illinois_house_ap...](http://blogs.suntimes.com/politics/2013/04/illinois_house_approves_bill_to_loosen_workplace_online_privacy_restrictions.html?utm_source=twitterfeed&utm_medium=twitter)

The bill specifically says that the employer cannot fire someone for NOT
giving up their facebook password or whatever, so that's good at least
(however unenforceable it might be)

~~~
SoftwareMaven
They can't fire you for not giving up the password, but they can sure find a
different reason to fire you. If somebody is working in a $10/hour job and is
concerned about their ability to find another job, I don't think that
"protection" will amount to anything.

Serfdom is a somewhat appropriate term, if your actions are monitored and
controlled 24x7.

If I were Facebook, et al, I would be opposing this with _everything_ I had.
Nothing will hurt Facebook more than people being concerned that posting on it
will negatively impact their jobs.

~~~
tptacek
No, this is completely wrong: if you are asked for credentials, and you refuse
to provide them, and you're fired afterwards for what your employer claims is
an unrelated reason, you can sue your employer alleging that you were fired in
retaliation; that is why the law specifically says it's "unlawful" to demand
those credentials.

By your logic, no anti-discrimination law is enforceable either, because you'd
have to be a complete nitwit to actually tell an employee they were being
fired for being a woman, or African American. In practice, employers _always_
make up excuses for unlawful termination.

Also, in practice, each of these exceptions to at-will employment is a vast
gaping constantly-looming risk for employers, since litigation is
extraordinarily expensive and terminated employees are extremely quick to
threaten suit. I've seen meritless discrimination suits brought at previous
employers; they're settled immediately no matter how wrong they are.

So the net effect of laws like this is to create an incentive for employers to
be extremely careful and process-bound for how they handle credentials,
because credentials in Illinois are officially an employment law minefield.

~~~
SoftwareMaven
Sure, _I_ could bring up such a law suit. How many of those $10/hour employees
are going to? The intimidation exists, regardless. At-will employment is the
reason why you have to be afraid for your job if you don't give up your
credentials.

Even if they don't fire you, you've negatively impacted chances of promotion
and possibly put yourself on the top of the layoff list. The balance of power
in the US is very strongly tipped towards the employer; we really don't need
to add more to it.

~~~
tptacek
All of them. It's one of the easiest suits in the world to bring. You could
also sue if you were denied promotion after refusing to hand over credentials.

Again: this law tips the balance of power _AWAY_ from employers.

------
malandrew
Even if the headline had accurately described what this law does, it would
have been easily solvable by letting employees report the names and accounts
of their bosses to the social networks in question and having the social
networks ban those users from using the social network for violating the terms
of service. It would be comical if a CEO or manager requires access to an
employee's Facebook account and the employee is compelled to give it to them
under these laws and the CEO or manager then subsequently loses access to
their own Facebook account. They'd backpedal pretty quickly as soon as they
lose access to the photos posted by their friends and family.

------
fencepost
My take on this is that if I work for, say, the Chicago Tribune as the person
responsible for handling a Twitter account (perhaps @ChicagoTribune?), my
employer can require me to give them the password for that account.

This does not distress me.

The other significant part, that employers can request account information for
accounts "that the employee uses for business purposes" but can't "discharge,
discipline, or otherwise penalize or threaten to discharge, discipline, or
otherwise penalize an employee for an employee's refusal to disclose" I see as
mostly placing requirements on employers: _Make sure your staff is not
becoming the "face" of your brand with their personal accounts._

------
warfangle
Does this trump the CFAA interpretation on violating terms of use (such as
giving out your password)?

------
unethical_ban
No one here seems to have mentioned the reason this law is still bad, even if
it doesn't apply to personal accounts.

Passwords authenticate you as you. It's preached constantly to people that
they DO NOT GIVE PASSWORDS for others to use on their behalf! Even in IT,
where people tend to know the implications, the trend is away from common
accounts for work and toward individual admin accounts to increase
accountability.

If I, for some over riding reason, NEEDED to give a coworker my password for
an operational emergency, I would change it as soon as possible. I would never
give it to anyone at my company for records keeping or access.

------
natch
The problem is this: say you are my friend, and you have such a (fuzzily
defined) "employer provided" account.

If I have trusted your account, without knowing that it is your business
account, my expectation of privacy for personal information I have shared with
you is now broken.

It's an easy cop-out to say don't share anything you don't want shared with
everyone. Too easy.

I do want to be able to share with just certain friends, and I don't want to
unexpectedly have that shared, semi-private, information shared with the
company they work for. This is a serious flaw with the bill.

~~~
jmj42
I'm not sure that that's the responsibility of legislation. If you are misled
(even unintentionally) as the the nature of the account you are sharing
private information with, then the responsibility for having broken the trust
lies with your friend. In this senario, you have willingly shared private
information with the employer.

Now, wether there should be legal ramifications for such a violation of trust
may be a worthwhile questions, but not one that this bill, which only amends
an existing law, even even attempting to consider.

------
jMyles
I have never understood the issue here. Don't you just say no? And if they
require it as a condition of employment, didn't they do you a favor by telling
you that you never really wanted to work there anyway?

You don't have a right to whatever boss you want at whatever job you want.
Sometimes the boss is an asshole. You do have a right to quit. Use it!

~~~
antihero
> didn't they do you a favor by telling you that you never really wanted to
> work there anyway

I see this bullshit argument time and time again on HN. Not everyone is an
intelligent, skilled worker with experience and the ability to pick and choose
jobs. The vast majority of people are vying for the same unskilled or barely
skilled jobs and are just desperately trying to keep food on the table. ANY
legislation that further reduces their bargaining power is abhorrent.

~~~
jMyles
Don't get me wrong; I feel compassion for anybody working a job they don't
want to, especially if they are forced to by a combination of economic
pressure and a lack of value as an employee, real or perceived.

However, part of building value as an employee (in fact as a human being) is
deciding what levels are treatment are unacceptable and standing up against
them.

Are you suggesting that someone of less skill or experience has no right
(forget legally - morally) to quit their job, even if it means a future of
greater economic risk?

If your husband or wife, brother or sister, parent, best friend, roomate -
whomever - comes to you and tells you that they are going to have trouble
meeting their obligations to you because they quit their unjust job, tell
them, "you did the right thing. You need to value yourself and love yourself.
I'll do my best to get by until you can pay me back, and I'll help you find a
job that respects you in the mean time."

No?

~~~
antihero
> However, part of building value as an employee (in fact as a human being) is
> deciding what levels are treatment are unacceptable and standing up against
> them.

Well that's true, I don't disagree. However, to be valuable on the bottom rung
to large companies, you need to either show real management potential (and
have a decent manager) - the good option - or simply be as drone-like and
exploitable as possible.Are you suggesting that someone of less skill or
experience has no right (forget legally - morally) to quit their job, even if
it means a future of greater economic risk?

> Are you suggesting that someone of less skill or experience has no right
> (forget legally - morally) to quit their job, even if it means a future of
> greater economic risk?

No, I'm suggesting the opposite. However, society enforces the judgement by
it's attitude toward the unemployed.

> If your husband or wife, brother or sister, parent, best friend, roomate -
> whomever - comes to you and tells you that they are going to have trouble
> meeting their obligations to you because they quit their unjust job, tell
> them, "you did the right thing. You need to value yourself and love
> yourself. I'll do my best to get by until you can pay me back, and I'll help
> you find a job that respects you in the mean time."

Of course, but a lot of these people don't have a support network, or their
support network has no ability to financially support them.

------
tibbon
Has anyone realized that you can simply say to your employer, "No, I don't
have a Facebook account."?

------
gesman
So, social media services should allow people to have "under duress" version
of the same account. If "duress" password is entered - only predefined,
innocent content is shown.

------
chris_mahan
Ilinois workers, welcome to California!

~~~
tptacek
Where there is a substantially similar statute that permits employers to
demand credentials to _any_ account pursuant to an investigation of "employee
misconduct".

Sheesh.

~~~
chris_mahan
Really? Source, please.

~~~
tptacek
Try Google. I read the comment I replied to, thought, "I wonder what
California says about the same issue", and had the California statute in under
a minute.

~~~
chris_mahan
After review of
[http://www.leginfo.ca.gov/pub/11-12/bill/asm/ab_1801-1850/ab...](http://www.leginfo.ca.gov/pub/11-12/bill/asm/ab_1801-1850/ab_1844_bill_20120911_enrolled.html)
I stand corrected. Don't come to California!

~~~
tptacek
California workers, welcome to Chicago!

:)

~~~
chris_mahan
I heard of this terrible thing called snow...

~~~
tptacek
"Informer" is a great song.

~~~
chris_mahan
Never heard of "Informer".

------
durga
un-f __*ing-believable!

