Applying For A Job? Great, Give Us Your Google And Facebook Passwords
ReadWriteWeb has a scary article about the city of Bozeman, Montana. It doesn't sound like a scary place, but if you want to say, work for the City, you'll need to give them all your social networking usernames and passwords.
ReadWriteWeb says:
The form (PDF) is a standard waiver that allows the city to perform a background check, which is obviously a routine procedure, but in addition, the city asks prospective employees to "please list any and all, current personal or business websites, web pages or memberships on any Internet-based chat rooms, social clubs or forums, to include, but not limited to: Facebook, Google, Yahoo, YouTube.com, MySpace, etc." The form provides three lines for entering this information.
Handing over your password, of course, allows the City to poke around in all of your business — including search history and email archive.
The local TV station picked up the story and, according to city attorney Greg Sullivan they don't look at, "the things that the federal constitution lists as protected things," and maintains that no one has removed their name from consideration because of the requirement.
So why do they even need your passwords? Mr. Sullivan says the City has "positions ranging from fire and police, which require people of high integrity for those positions, all the way down to the lifeguards and the folks that work in city hall here. So we do those types of investigations to make sure the people that we hire have the highest moral character and are a good fit for the City."
My moral character says it's wrong to poke around in an applicant's personal life, but what do I know.
Want to Work for the City of Bozeman, MT? Hand Over Your Social Network Logins and Passwords [ReadWriteWeb] (Thanks, David!)
Post a comment
Comments:
This is legal? Since it's the city, and not a private company that's doing this, they obviously think there's a loophole or precedent.
I mean, if you undergo a background check and your friends express that you may be a shifty character, they can probably deduce that you may go to some shifty websites as well. But they don't need to spy on you for that.
What happens if you give them the wrong passwords? When they call you back, you can just say you had them changed? But they'll probably ask you for the current ones. I wonder how long you could do this before they just give up and evaluate you without this information..
This is an extreme invasion of privacy. This isn't like running a credit check, this is digging through e-mails and having access to financial data. I regularly communicate with Mr. Pi on various topics, including bills and such. I don't want anyone knowing where I bank, or how much is in my account because I happen to mention it in an e-mail planning a vacation.
@farcedude: Watch Facebook declare they're 2x as popular as 3 yrs ago only to find out they have 1/2 the IPs because people have their "professional" page and their "leisure" page.
This sounds illegal, and an invasion of privacy.
How about "We need copies of your car key, house keys, and the time your child leaves from school, and you are not to open any personal mail you receive at home until you bring the envelopes in here first so we can read it"
Where do you draw the line?
It speak a lot to the type of employee they are seeking. Apparently, they want someone who will mindlessly turn over their personal social data without question. So, who works for the city of Bozeman MT? The desperate? The folk who have only heard of the internet? Those with no social life? Certainly, no one who respects privacy.
@pecan 3.14159265: Technically everything's legal until a law is passed against it or a court rules an existing law a violation of a state/federal constitution.
So this is legal until it's challenged, and when challenged, it'll likely be overturned. Until then, it's "legal".
@farcedude: Yeah I completely agree. But I can somewhat understand why people want to see what you are doing to a very small extent. I would never give it up, especially passwords, but there are some crazy people out there. The faster you learn about your new hires...the easier the problem can be resolved.
They still have no right to ask for passwords.
Regardless of the privacy implications, any company that explicitly demands that any security credentials be provided written down on a piece of paper automatically fails at meeting nearly every security standard I can think of.
They would also be failing to meet the legal standards of several states that are not Montana.
Finally, if anything, public workers should be demanding more privacy, not giving up more confidential information.
@pecan 3.14159265: The larger question in Montana is whether it is in violation of the constitution. Montana's constitution (re-done in 1976 because we can't make up our minds) has very strong privacy statements. I would assume that the state AG will issue an opinion on this at some point.
The city manager, etc should be damn thankful that the legislature just got out of session, otherwise they would have been reamed.
Mr. Sullivan says the City has "positions ranging from fire and police, which require people of high integrity for those positions, all the way down to the lifeguards and the folks that work in city hall here. So we do those types of investigations to make sure the people that we hire have the highest moral character and are a good fit for the City."
Okay, I get it, the new fire chief might be into all sorts of seedy stuff and you wouldn't know it - but I have to say, from what I've read in textbooks and studies, people who want to hide things will find a way. This is why people go "He was such a nice family man," and are surprised when they see police swarming their neighbor's house and find out later he was into children. People find a way. Asking for passwords and stuff is probably just the tip of the iceberg for them because if you give it over, that links you to email addresses, other users, and from there they could follow the trail and dig deeper into the people with which you associate yourself. It's not my fault the next door neighbor is running a bootleg moonshine business in his basement, but if we end up on the same wine enthusiast website, what is the city going to do if I hand over my password, and then the news breaks that my neighbor's moonshine business has been shut down.
@pecan 3.14159265: It's legal if you give permission. Police departments routinely give polygraphs to applicants, too.
some general comments:
1. First, no one who has any measure of sense associates their real name with their online names, when it comes to chat boards or comments that have any possibility of being used for unforseen purposes. You use a dummy/spam email address to register for things -- I'm surprised at people who get all indignant about forms asking for your personal information online -- just put in junk crap. (although I know people for whom even creating one email account is a challenge, so who knows if they could manage more than one)
2. So if you've done that, why even write anything down when they ask you? I mean, aside from Facebook or other things that can obviously be traced to you via a Google search. If your online alias names cannot be traced to your online presence, there is no need to tell them, because you and that name are never associated. Aside from that, who in their right mind asks for your password? The person writing this questionnaire is obviously an idiot.
3. And related to that, someone in this podunk town got the idea that they're big important people, and decided to emulate the background check that the Obama administration runs on new staffers -- they have this exact question (without the passwords). But that's understandable -- for a very public, federal administration job with important public relations implications. This is, what, Bozeman, where we want to make sure the manager of garbage collection doesn't have a negative online reputation? come on. Part of the responsibility of authority is realizing where it does not extend do, and excusing yourself from policing that.
@HiPwr: A polygraph is different because your answers determine your results. Giving over your information allows them to spitball it and make decisions based on perceptions, ill context and snooping.
Soooo creepy.
Your google password allows access not only to your email account, but to other services like Google Checkout, which contains credit card information and purchase history. There's no way I'd submit that kind of information for a job application. I mean, its just full of clothes and video games, but that's noone's business but my own.
@ludwigk: Besides, if they want to see my Facebook and Youtube content, they can send me a friend invite, just like everyone else!
@angelzero:I was thinking the same basic thing. As a tech person in a high security industry, anybody who is willing to give their password to someone else is not a person that I would want to hire. The whole point of a password is secrecy.
Privacy issues aside - if someone is trying to be so precise as to use the terms "any and all" or "to include, but not limited to" to describe their request, I wouldn't infer they are implying that I should list sites to which I personally belong. Are they asking for my memberships, my parents', my wife's, whose? Just skip it and move on.
Then again, I'm not looking for a job.
@farcedude: That's why I keep two entirely seperate online identities. My real life persona doesn't even have a myspace page.
I like the last paragraph of the waiver statement about how the Montana Constitution gives the applicants the right to review any information gotten from this background check & that the city won't let you see the information anyway...
So invasive, (probably) illegal, & unconstitutional.
Amazing. What law school did this guy go to?
I routinely peruse left-wing websites like DailyKos, which would without doubt include quite a few Communists among its tens of thousands of members. Does that make me a Communist? I'm waiting for the first guy to get fired because he inadvertently forgot that he opened an account at Democratic Underground six years ago, but hasn't so much as visited the site since 2004. This policy opens itself up to so much abuse, lawsuits are inevitable. I'll be so looking forward to the hilarity that will ensue.
@kepler11: But they're asking for online social networking blogs, websites, etc. that aren't just Facebook where you can (or not, I guess now) use your real name. If they have your user name and password, that IS you! It doesn't matter that you use a screen name - your act of putting it down on paper for them tells them that you are this alias.
Armed with your user name, they can search your chat logs, they can look through your comment history, they can build a profile based on what you say behind your alias - and contrast that with how you are in public. I can say confidently that I am the same person publicly and privately, but of course a person's word is no longer enough. In some ways, I get it - but in a great deal of other ways, not everyone is out to embezzle funds or steal company secrets or poison Tylenol. Most of us just want to make an honest living.
@pecan 3.14159265: I think they are leaving themselves wide open to litigation if they decline to hire someone based on some arbitrary judgement about on-line activity.
If they are wise, they will stop this practice.
@Sargasm: Indeed. This is gets a big "As if". There's a reason I have passwords on my stuff - to keep people out. Why would this even be relevant to the hiring process?
~I
@Sargasm: This is a violation of most online services' terms of service contracts that you agree to you when you join up.
@HurtsSoGood: This is a funny point, because I read a ton of newspapers and magazines and websites. Every day I read WSJ, HuffPo, WaPo and a ton of other news sites. I guess if the town were to look at my browsing history, they might think that I'm on the fence about politics!
@Xerloq: Technically, if you really want to parse the request, they're not even asking for your sites and logins. Simply personal and business sites.
I'd give them:
IBM.com
Microsoft.com
Joe Shmoe's Facebook
Sara the Myspace angle hot girl I don't know but am friends on with on Myspace.com
But in all serious, I've been on the internet for like 15 years and have signed up for hundreds of sites. I can't even remember 99% of the sites let alone the logins for them.
@farcedude: Just discussed this with coworkers, and they pointed out that this is probably a CYA (cover your a$$) maneuver, so that when an applicant is hired, and five years later turns out to be a pedophile, they can look back and say that he didn't give them the passwords to those sites, so he was defrauding them on the application (or something to that effect).






















So. Wrong.