Skip to content
Naked Security Naked Security

Would you hand over your social media account details for a new job?

The Job Index wants you to log into your social media accounts to send recruiters a report on your Facebook, Twitter and LinkedIn personas.

As the makers of recruiting platforms are happy to remind us, your social media self is extremely likely to be perused by recruiters who’ll either snap you up when they see the results or turn up their noses at, say, your posts about OMG how much you HATE your boss and hope he DIES!

According to one such vendor, as of 2013, 93% of recruiters were likely to look at a candidate’s social profile, and 42% had been moved to give the thumbs-up or -down based on what they turned up.

There have been various tools put forth that make it easier for employers to get at your “true” self.

(And before you protest that our social media selves are not, in fact, our “true” selves, I need to point out that researchers say otherwise. “Disagreeable” or “non-conscientious” people are, in fact, more likely to emit the unpleasant aroma of, say, bad-mouthing peers and employers on social media.)

Now, there’s another such tool to go beyond just plain old running a search on a candidate.

Called The Social Index, the online service promises to rifle through the digital footprints of short-listed job candidates and present employers or recruiters with a report.

That report is an infographic that, the company claims, maps out a candidate’s “personal brand.”

It crunches data from Facebook, Twitter and LinkedIn. According to a report from Mashable, The Job Index focuses on those three social platforms partly because they’re common, but also because, typically, they’re the ones most relevant to a company’s client activities or reputation.

It takes about 30 seconds for the candidate to be analyzed before their “social footprint” is ready. Within 24 hours the report will be delivered to both the client and the job seeker.

It’s a lot faster than slogging through Google searches for a name. Plus, as the founder of the Australian company, Fiona McLean, points out, when you rely on search engine results, you can’t even be sure the profile you’re looking at is for the right person.

As far as privacy goes, McLean points out that the system only looks at public information, and it doesn’t share people’s posts with companies.

If it’s not online, then a client can’t see it in the report.

The system maps out when, where, and how often people are posting. It also gives a timeline for your career, highlighting both the good – say, when you got promoted, or your average tenure – and the bad – say, unaccounted chunks of time that don’t reflect your being employed, or a brief average tenure that could point to a pattern of getting shown the curb after a few months.

Like Klout, it also shows how much of an influencer you are: How many connections you have on any given platform, for example. The system also does some sentiment analysis to show how positive your digital self is.

Employers will be able to tweak it to fit a given role. McLean gave the example of a job that requires a lot of social media interaction: if your profile shows that you don’t post much, that’s bad.

I worked with someone early on who was hiring for a social media role, and they were getting a lot of people who were saying ‘well I know social media, I do a lot of it,’ but the reality was they knew the theory of it but couldn’t demonstrate it.

…on the other hand, if you’re spending all day posting when social media interaction isn’t part of your gig, that’s pretty bad too, McLean said:

If the role is a back office accountant and they are equally on social media between 10 and 4, the chances are, they are not doing the core part of the role as well as they could.

But wait, isn’t it illegal to ask employees for their account logins? Illegal, as in, it’s against user policies to share your account passwords?

Back in June, we got wind of a service that offered to scour potential tenants’ social media profiles for landlords.

The service, called Tenant Assured, still hasn’t launched, but its plan is to provide detailed reports assessing rental applicants’ personality traits, creditworthiness and financial risk by directly accessing their Facebook, Twitter, LinkedIn and Instagram profiles, with the applicant’s consent.

Consent needs to be given for either of these social media-mining apps.

That still doesn’t answer the question, though: isn’t it illegal to demand workers’ passwords?

No, it’s not, at least in the US. As it is, a number of US states have tried to make it so, but the US House has declined to ban the practice.

At any rate, job candidates and tenants alike can decline to hand over access to their accounts.

But if apps like Tenant Assured and The Social Index become widely used, will we even have a choice? My way or the highway or, in this case, pry way or the highway!

Hand over access, or some day you could well find yourself being disregarded for an apartment or a job.

When it comes to The Social Index, the small mercy is that they’re only going after publicly posted data.

It’s yet another very good reason to clean up your past posts and to lock down your privacy.

To maintain privacy, use privacy controls. Millions of Facebook users are oblivious to, or just don’t use, privacy controls.

Don’t be one of them, and while you’re at it, don’t let your friends or family fall into that category.

To see who can find the things you’ve shared, you can use privacy shortcuts and Activity Log to review your personal trail of glory and misdeeds.

Go to Facebook’s Activity Log page for a list of your posts and activity, from today back to the dawn of your Facebook life.

There, you can find stories and photos you’ve been tagged in, Pages you’ve liked, friends you’ve added, your photos, and photos you’re tagged in that are shared with Public.

Besides photos we’re tagged in without our permission, most of the stuff that’s in our Graphs is up because we put it there.

To further clean up our Facebook personae, we can always remove a tag from a photo or post we’re tagged in.

As Facebook outlines here, you do that by hovering over the story, then clicking and selecting Report/Remove Tag from the drop-down menu. Then, remove the tag or ask the person who posted it to take it down.

Also, to further lock down your profile, take a gander at these three ways to better secure your Facebook account.

17 Comments

I stopped using social media years ago because I realized it created a huge digital fingerprint which could be used against me in the future. Everyone says or does something dumb eventually. I choose not to keep a permanent digital record of my lapses in judgement. If I cannot contribute anonymously, I simply won’t contribute.

I can understand the rationale (whether I agree with it or not) of certain prospective employers wanting to know how much and what kind of digital presence you have. But when we get to things like, say renting a home – if I don’t have a presence (or if I violated Facebook’s real name policy, for example), and was denied on the basis that nothing about me could be found, would that hold up in court? How much of a difference is not having an online social profile from liking men, or women, or being a rabid fan of a particular sports team? Can we really discriminate on that basis?

In principle, no, I would never give out access to my accounts.

(In practice, I would have to admit there’s very little risk should I be forced to do it. I’m one of those “millennials” who keeps a Facebook in name only, because I have so many family members in my friendslist. Every now and then I post cat pictures, but that’s about it. I don’t have a Twitter or LinkedIn, either. All my other social media accts are under unrelated usernames, and it would take some sleuthing to trace them back to me. But, of course, it could be done – assuming the focus on social media stalking were to come off the Big Three.)

Sorry, my social media site’s terms and conditions prohibit me from sharing login information. Surely your organization doesn’t want to hire employees who violate agreements they made, does it?

On July 5, the U.S. Ninth Circuit Court of Appeals issued an opinion that found, in part, that sharing passwords can be grounds for prosecution under the Computer Fraud and Abuse Act (CFAA). The decision, according to a dissenting opinion on the case, risks making millions of people who share passwords into “unwitting federal criminals.”

soon enough you’ll be required by the public and private sectors to have any social media presence just to apply for any job.

Also, there’s no law or legal requirement to release your tax returns if you run for President of the US. It’s all just smoke and mirrors to divert your attention from whats really going on.

in fact i don’t even have a computer, and i just thought this comment here out of thin air, yes, I’m that good.

So, in other words, you have the right to your “freedom of speech” but you may pay the price for that “freedom” based on someone’s personal bias for or against their perception of you and your comments. All part of the price of living in a “free” society.

So if you have a concern about what people might think of your posts, you’re probably better off having a private AND a public social media account, and keep the private one *private* and just post appropriately censored content for the thought police on the public account.

I would absolutely provide access to the private details in my social media accounts. Unhesitatingly. Because if I’m then passed over, the magnitude of the discrimination suit I can file is unbelievable. HR *can not even ask* about some of the personal details I keep in my accounts. The moment they do, they open up a huge risk of lawsuit.

So, yeah. I would. If HR is stupid enough to walk into that obvious a trap they deserve what they get.

your missing the point. they won’t have to ask you anything if you give them your details and they read it them selfs. then they won’t turn you down because of it, but they will turn you down because of it if you know what i mean.

I do, but it amounts to the same thing. HR is not allowed to know these things as part of the interview process unless you volunteer it without being asked. Demanding access to the private details in your social media accounts is legally speaking the same as asking for that information. And since they asked, you volunteering the answer does *not* shield the company from a discrimination suit.

Full disclosure: my wife works in HR and is absolutely horrified by this practice because of the amount of liability involved.

Good luck proving “discrimination” in such a lawsuit. It’s always some other reason that they didn’t hire you.

That’s the great thing. You don’t have to prove discrimination. You have to prove that HR asked for information they had no right to ask. That gets the suit filed. The rest is psychology. HR exists, among other reasons, to prevent the suit from getting filed in the first place. Barring that, making sure that every legal I got dotted and every T got crossed because the standard of evidence in these cases isn’t proof beyond a reasonable doubt. It’s a judge’s opinion on the preponderance of evidence.

Take a wrongful termination suit. If you term an employee, even for good cause, but don’t have a disciplinary paper trail then all you have is your word against theirs. A judge could go either way on that. However, if you have a trail of writeups and others disciplinary action then the suit falls heavily in your favor. My wife used to handle this sort of things in HR. Documentation is everything.

Same with discrimination. If you have nothing other than the fact that you asked for information you’re not legally allowed to ask then there’s a good chance the judge will rule against you. Remember- it’s not proof, it’s preponderance of evidence.

I wonder what they do when users use two-factor authentication (as I do for social media that supports it.) Since any job I apply for is in security, it would be an interesting conversation with the hiring manager if I was asked to downgrade my authentication.

Yep literally what I would do. Sure here is my FB details, awww to bad you also don’t have access to the FB code generator on my smartphone :/

I don’t do Facebook anymore. I deleted my inactive (2 or 3 yrs.) Facebook account early this year. I deleted myself from LinkedIn years ago when I got loads of spam from “friends” who are my friends and asked them “why” and they said “What the @*$! are you talking about?”. I still keep my Tumblr account hoping that what happens on Tumblr stays on Tumblr (the pictures are great!) I haven’t commented on newspaper sites in years. That’s about it. Now if someone wants to know my current thoughts and ideas they will have to go through the comments on Sophos. What is said on Sophos, stays . . . you know the rest. Right? If Sophos ever gets hacked!! Now if a prospective employer or apartment owner wants to know something about me they will have to ask me personally andI will get my quill pen out and write a reply.

What happens on tumblr tends to get screenshotted and posted around the Web, actually. You should be okay as long as you don’t make or comment on a popular post.

My social media profile is 95% for forwarding political speech and funny pictures. There is very little personal information shared and 0 (as far as I know) pictures of me or my family. Our cats, yes, they have a few pictures out there (with the metadata stripped).
I realize this is not what was intended for sites like Facebook, but it’s too dangerous to overshare. At least Google+ has tighter controls over who can see what you post (even if it does scan it all for ad targeting).
You hate to live in fear, but it’s more about being smart, than being afraid. I try my hardest to think before I post. I just thank goodness the Internet wasn’t around when I was a teen or I’d have embarrassing videos and a whole LiveJournal that I’d never want anyone to find. I feel bad for today’s kids who are kicking themselves in the shins and they don’t even know how badly it can bite them (unless that’s the video they posted online, kicking themselves in the shins or getting bitten).

Comments are closed.

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?