IT Professionals Walk a Tightrope When Dealing With Illegal Activity of Employees on Company-Owned Devices
In our November 8, 2013, post No Hall Pass for School Officials in School Texting Scandal, we discussed the impact of inappropriate and possibly illegal employee activity on company-owned electronic devices for both employees and organizations. Now, we turn our attention to the company’s IT staff, and the professional, legal and ethical dilemmas many might face when dealing with the improper conduct of employees.
The Importance of IT Protocols
Employee misconduct comes in many forms – the conduct might simply amount to a violation of company policy or it might amount to a criminal act. Regardless, organizations should consider implementing protocols for IT staff to follow when reporting and/or investigating the possible misconduct. For example, chain-of-command – to whom will IT staff report possible misconduct? Is there a direct line to a supervisor, or does the IT professional report these incidents to a senior level manager? What happens if, as in the Coatsville case, the IT staffer believes the supervisor is involved in the illegal conduct? Does corporate protocol anticipate these circumstances? These questions should be discussed with all stakeholders so that the IT protocol includes a procedure that works for the organization. So, what are the important takeaways relating to IT protocols?
- The protocol should tell IT staffers what to do with evidence of possible misconduct. For example, who is responsible for and/or authorized to report possible misconduct to senior management and/or law enforcement personnel.
- Organizations should train IT staff on the protocol so that they know how to respond when confronted with possible misconduct.
- The protocol should outline to IT staff when to engage with inside or outside legal counsel to insure that preservation obligations of the company are met. IT staff should not be forced to make this important decision in a vacuum.
As we often say, a good protocol should tell employees what responsibilities that each employee holds, and the obligations of those employees to perform certain duties when they are faced with employee misconduct.
What to do When Law Enforcement Becomes Involved
Another issue that should be addressed for your IT professionals is what to do when, as in Coatsville, law enforcement personnel become involved. For example, in the Coatsville matter, the IT Director was first told by the District Attorney to preserve the integrity of the computer system and its content as evidence of an alleged illegal act. Then, the Acting Coatsville Superintendent directed the IT Director to give-up the computer codes to an outside computer firm. The IT staffer walks a tightrope in complying with the directives of a supervisor while simultaneously following the legal requirements to preserve data and records for criminal prosecution. What can a company do?
- Have a protocol in place that clearly delineates how IT personnel should react to involvement of law enforcement.
- Supervisors or managers too should know how to respond to reports of misconduct. For example, supervisors and managers should know that intimidation of IT professionals is not appropriate following a report of possible misconduct. For a good example, see dailylocal.com, More details in alleged harassment of texting scandal whistleblowers, October 1, 2013. (The Acting Superintendent’s email to the IT Director ordering compliance with his demands lest he be slapped with insubordination regardless of what the county’s district attorney ordered).
According to the District Attorney involved in the Coatsville matter, an organization facing a criminal investigation should map out a clear strategy for preserving any computer evidence, backing up files with minimal disruption to the organization’s operations, and then a plan to communicate the strategy to law enforcement personnel to prevent any inference of company interference in the investigation. See edweek.com, Pa. Texting Scandal Highlights Complexities for IT Leaders, October 16, 2013. “The IT director really at that point has a double set of duties,” Mr. Hogan said. “They have to preserve any data that might be related to the investigation from the standpoint of the government. They also have a duty to follow any lawful orders of the [enterprise] regarding that data.” As noted above – thinking about this upfront so that IT professionals have a protocol to follow would have alleviated some of the strain on the IT Director in this case – as well as the possible conflict with local law enforcement.
Do you Hire an Outside Forensic Vendor?
Finally, another big issue commonly faced by organizations is when to hire an outside forensic firm to preserve computer evidence and the integrity of the entire computer systems. The retention of an outside firm can help negate any inference that the business is involved in covering-up, or worse, destroying, evidence. A well thought out and documented protocol might include a section addressing when to hire a forensic computer firm, how that firm will be retained, and who will be responsible for working with the firm. Preservation of evidence is an important component of any potential legal action – criminal or civil. As a result, having a clear road map of how an organization responds to preservation of evidence can help save the organization from the threat of sanctions if litigation later develops.
Have you dealt with employee misconduct on employee devices? Were you equipped to respond? As always, we welcome your insight.
The saga of Facebook firing cases continues. In this episode, a non-profit organization operating after school programs for high school students terminated two employees who engaged in an extensive Facebook trash talk session about their employer, screen shots of which were sent to Human Resources. (See NLRB v. Richmond District Neighborhood Center.) After the employees were terminated, they filed an unfair labor practice charge with the NLRB.
Interestingly, the employer actually prevailed in this case and the administrative law judge found that the Facebook posts were not protected under the National Labor Relations Act. Here’s a sampling of the posts between the two teen center employees:
Moore: U goin’ back or no??
Callaghan: I’ll be back, but only if you and I are going to be ordering shit, having crazy 10 events at the Beacon all the time. I don’t want to ask permission, I just want to be LIVE. You down?
Moore: I’m goin’’’ to be a activity leader I’m not doing the t.c. [sic] let them figure it 15 out and they start loosin’ kids I ain’t help’n HAHA
Callaghan: ha ha ha. Sweet. Now you gonna be one of us. Let them do the numbers, and we’ll take advantage, play music loud, get artists to come in and teach kids how to 20 graffiti up the walls and make it look cool, get some good food. I don’t feel like being their bitch and making it all happy-friendly middle school campy. Let’s do some cool shit, and let them figure out the money. No more Sean. Let’s [f*&^] it up. I would hate to be the person taking your old job.
Moore: I’m glad I’m done with that its to much and never appreciated so we just go be have fun doing activities and the best part is WE CAN LEAVE NOW hahaha I AINT GON BE NEVER BE THERE even tho [sic] shawn gone its still hella stuck up ppl there that don’t appreciate nothing.
Callaghan: You right. They don’t appreciate shit. That’s why this year all I wanna do is shit on my own. Have parties all year and not get the office people involved. Just do it 35 and pretend thay [sic]are not there. I’m glad you aren’t doing that job. Let some office junkie enter data into a computer. Well make the beacon pop this year with no ones help.
Moore: They gone be mad cuz on Wednesday I’m goin’ there add tell them my title is ACTIVITY LEADER don’t ask me nothing about the teen center HAHA we gone have hella clubs and take the kids
Callaghan: hahaha! [F*&^] em. Field trips all the time to wherever the [f*&^] we want!
Once the organization learned of these posts it was understandably upset – what would the parents of the teens who attended the program think – not to mention program funders? And how could they trust these employees to do their jobs?
These were the arguments the organization made in its defense to the employees’ unfair labor practice charge. They argued that the Facebook posts were so “egregious” that they went beyond the bounds of what is protected under the NLRA. And the ALJ agreed with them, finding that the fact that the organization believed that the Facebook comments jeopardized the program’s funding and the safety of the youth it served meant that the employer “could lawfully conclude that the actions proposed in the Facebook conversation were not protected under the Act and that the employees were unfit for further service.”
So, a victory for the employer. But what does that mean for other employers facing situations where employees bad mouth the organization on Facebook or other social media sites?
We still think that any time an employer is considering terminating an employee based on the employee’s social media activity, the employer needs to carefully consider whether the posts might be protected and consider seeking legal counsel for assistance in wading through these tough issues. What are your thoughts?
The texting/tweeting scandals just keep coming – and once again this one is all true. This unfortunate episode comes from the Coatsville Area School District in Pennsylvania. The scandal highlights technology, ethics and employment issues, as well as the complexities that IT staff must navigate when dealing with evidence of alleged immoral and illegal activities on company-owned devices. In this first post, we will look at the issues businesses face when employees engage in nefarious activity on company-owned electronic devices.
So, let’s take a look at some of the facts. The Coatesville, Pa., School District Superintendent Richard Como and Coatsville Area High School Athletic Director Jim Donato recently resigned following the disclosure of their inflammatory texting conversation. The pair had exchanged a myriad of racist and sexist slurs directed at students, faculty, and administration officials on district-owned cell phones. In one appalling exchange, Como and Donato used fourteen slurs using the “n” word. In another text, the pair allegedly discussed financial misdealing within the district and monetary kickbacks.
The district’s IT Director (Hawa) discovered the racist slurs while performing a routine data transfer on Athletic Director Donato’s district-owned cell phone. Mr. Hawa reported the incident to the district’s deputy superintendent, and then to the district’s attorney. News reports confirm that Hawa ultimately sent the transcript to the Chester County District Attorney after he became concerned that some Coatsville school board members and their attorney were attempting to cover-up the texting scandal. See Daily Local News, Coatsville school officials sighted at courthouse, dailylocal.com, October 18, 2013. The District Attorney initiated a grand jury proceeding into the texting scandal, the alleged financial kickbacks, and other alleged improper activities of the school employees. See abclocal.go.com, Grand jury investigation into Coatsville texting scandal, October 15, 2013. The NAACP also conducted its own hearing into the incident revealing additional claims that the district discriminated against low-income and minority families, as well as disabled children. The NAACP plans to investigate the claims made at the hearing for possible legal action against the district. See philly.com, Coatsville school board denies accusation of bias, October 18, 2013.
So, what are the lessons learned from this scandal? First, there are lessons for anyone who uses social media, electronic devices, etc.:
- In the digital age, everyone must understand that electronic communications will NOT remain private.
- Emails and texts – whether good or bad – do not disappear. As discussed in prior posts, forensic experts can often easily retrieve “deleted” information from a cell phone or computer. If you would not say what you are saying in front of a judge (or your grandmother) – don’t post it!
- Don’t use your work provided device as if it were your own device. As happened here, what happens if you turn in that device for a routine data transfer? What will someone find? Company officials and IT staff – under appropriate policies and procedures – will have the right to investigate information contained on company-owned cell phones and computers. Employees must understand that even though they might be permitted to use a company-owned device for business and personal purposes, that device, and the content on that device, still remain the property of the business.
Second, there are important lessons for private and public corporate entities:
- Implement policies and procedures that permit you to monitor, inspect and act upon inappropriate text messages or interactions.
- Implement policies and procedures that outline the circumstances and procedures for reporting alleged illegal activities. These policies could spell out the appropriate chain-of-command for reporting this activity, as well as the individual in the organization who has the authorization to discuss company matters with outside law enforcement officials.
- Implement policies and procedures on appropriate and inappropriate use of company provided devices. Then, train your employees on what that means – clearly not everyone understands this concept yet.
Third, evidence obtained from a company-owned device might be used in a termination decision, however, there could be consequences beyond loss of employment for inappropriate text messages:
- For example, the former Coatsville Superintendent may find out his conduct might negate the school district’s obligation to pay-out his retirement pension. I bet that Como never thought that his texts with the Athletic Director could ever jeopardize his reputation, career, and ultimately his retirement pension.
- Depending on the content of the inappropriate exchanges, district attorneys could use employee text messages to prosecute employees or their employers under criminal statutes. Just think of what may face the Superintendent – “Theft by deception or extortion, theft of services, tampering with public records or information, are a few stated crimes listed under the forfeiture act that could cause Como to forfeit his pension.” See Daily Times News, delcotimes.com, Former Coatsville schools chief at center of racist text saga files for pension, November 6, 2013.
- The EEOC, local departments of human rights or the NAACP may use those text messages to support claims of discrimination, retaliation or unequal treatment against the employer.
In short, employees need to exercise some modicum of restraint in their communications. Employers, knowing that employees may not do so, need to have policies in place to respond to inappropriate and possibly illegal conduct by employees. Are you prepared?
You really can’t make this stuff up. The story sounds like the plot of a D.C. beltway suspense novel – senior White House director involved with national security and Iranian nuclear negotiations caught and fired after anonymously leaking sensitive national security information, and lobbing insults at Capitol Hill, White House staffers and politicians via Twitter. The abrasive tweets criticized government policies, and even the actions of the director’s boss, the President of the United States. But someone did not make it up…sadly, it is all true. See White House Official Fired Over Anonymous Tweets, Reuters.com, October 23, 2013.
Jofi Joseph, was the director of nuclear non-proliferation on the White House National Security Council staff. But his employment was terminated after the government discovered that for two and a half years, Joseph anonymously posted hundreds of the blunt tweets like those outlined above. According to news reports, Joseph described himself in his Twitter bio as a “keen observer” of national security, noting that he was unapologetic for saying what others only thought (the Twitter account has since been shut down). See White House Staffer Fired for Tweets Criticizing Bosses, NBCWashington.com, October 23, 2013. The White House confirmed Joseph’s termination.
So have these highly publicized terminations deterred employees from posting negative comments regarding their employers? Probably not. Yet, the lesson from this recent termination (and so many of those in the past) is that even an employee’s anonymous posts can be uncovered and have a significant negative impact on that individual’s job security and reputation. In this day and age, individuals should not rely upon the supposed anonymity of the internet to protect their identities. As an aside, Joseph’s antics could also impact others… Joseph’s wife is currently employed in a high profile job on Capitol Hill. I wonder whether Joseph had any thought about how his actions might affect his wife’s career. Whether he thought about it or not, the circumstances surrounding his termination might affect how others view his family. When conducting training on social media use for employees, I always caution employees to consider all the ramifications of their actions before proceeding down the road of negative posts. This situation certainly highlights why this guidance is important.
From an employment perspective, companies should consider how their social media policies handle employees’ negative posts or, more importantly, the leak of sensitive information. Employers should consider having procedures in place to investigate and address potentially damaging posts. As you all know from past posts, certain laws, e.g. the National Labor Relations Act, may protect employees for negative comments on the internet (see A Reminder to Avoid Prying Into Private Group Facebook Pages!) but not all employee posts are protected. Employers should be prepared to act on those that are not – particularly if the posts contain confidential information.
Have you ever personally posted something you later regretted, or have you had to address negative employee posts in the workplace? Do you have the policies and procedures in place to handle these situations? As always, we welcome your insight.
We’re happy to bring you this guest post by our new associate, Kristen Barlow Rand. Thanks, Kristen!
In a recent case in Ohio federal district court, Lazette v. Kulmatycki, a court looked at whether a former employee could proceed with claims for violation of the Stored Communications Act (SCA), invasion of privacy and other claims after her former supervisor read 48,000 of her personal emails.
According to the former employee, when she left Verizon Wireless she returned a company-issued Blackberry. Verizon’s policy permitted employees to use Blackberries for personal email, and the former employee believed she had deleted her personal Gmail account from the device when she returned it. However, as her supervisor found out, she had not deleted the personal account. Instead of wiping the device and re-issuing it to another employee, over the next 18 months the supervisor read 48,000 of the former employee’s personal emails without her permission. What was in these emails? Information on the former employee’s health, finances, family and employment status. And, the supervisor shared the contents of the emails with other people. Not surprisingly, when the employee found out about this, she sued.
In the case, Verizon argued that the supervisor did not violate the SCA because the supervisor had authority to access the emails. Under Verizon’s theory, even though the former employee did not know the Gmail account hadn’t been deleted and did not know her supervisor was reading her emails, it was her fault for leaving the account on a company device. The court didn’t buy this argument, noting that the former employee’s mistake in failing to delete her Gmail account did not mean that she implicitly consented to her supervisor reading 48,000 emails.
Verizon also claimed that the supervisor had authority because the supervisor read the emails on a Verizon-owned device. The court didn’t buy this argument either because the former employee neither “knew nor approved” of the supervisor reading her emails. The “mere fact” that the supervisor used a company-owned device for access did not give the supervisor authority to read the emails. As a result, the former employee’s SCA claims survived the motion to dismiss.
The court also allowed the former employee’s claim for invasion of privacy to go forward because her emails were “highly personal and private” and a reasonable jury could certainly find the supervisor’s conduct to be offensive enough to constitute an invasion of privacy.
Shortly after the court issued its opinion, the case settled. Even though the case has settled, the court’s opinion was interesting in part because of the court’s very strong position that just because the supervisor used a company device, that did not mean there was authorization to read the emails.
Additionally, while the opinion didn’t get into much detail regarding the company’s policy on monitoring of company-issued devices, it is interesting to speculate about whether clear policy language putting the employee on notice that personal emails could be monitored would have changed the court’s mind. It may be that even the clearest and strongest policy language would not have made a difference, due to the conduct of the overly curious supervisor who read tens of thousands of personal emails for no other reason than his own apparent amusement.
Do you think employers should be permitted to access an employee’s personal email account when that account can be accessed on a company-issued device? Does it matter if the employer has a legitimate business reason to do so?
Do private Facebook wall posts fall within the protection of the Federal Stored Communications Act (“SCA”)? The United States District Court of New Jersey ruled they do in Ehling v. Monmouth-Ocean Hospital Service Corp., Civ. No. 2:11-CV-03305 (WJM) (Aug. 20, 2013). So what is the SCA and how could the Court’s ruling affect your HR decisions?
Here is the case in a nutshell. Plaintiff Deborah Ehling, a registered nurse and paramedic, frequently posted comments and photos to her Facebook wall – a wall that limited access to only her Facebook friends. Plaintiff was not shy with her comments. For example, after a shocking shooting in Washington D.C., Plaintiff posted the following:
“[a]n 88 yr old sociopath white supremacist opened fire in the Wash D.C. Holocaust Museum this morning killing an innocent guard (leaving children). Other guards opened fire. The 88 yr old was shot. He survived. I blame the DC paramedics. I want to say 2 things to the DC medics. 1. WHAT WERE YOU THINKING? and 2. This was your opportunity to really make a difference! WTF!!!! And to the other guards ….. go to target practice.”
Plaintiff’s employer, Monmouth-Ocean Hospital Service Corp. (“MONOC”), received a copy of the post from a co-worker and Facebook friend. As many of you likely know – most employers learn about employee Facebook posts because their so-called “friends” turn them in.
After receiving the post, MONOC suspended Plaintiff with pay stating her comments reflected a “deliberate disregard for patient safety.” Plaintiff filed a complaint with the National Labor Relations Board (“NLRB”). The NLRB found MONOC did not violate the National Labor Relations Act, and that no privacy violation occurred as the post was sent unsolicited to MONOC management.
MONOC ultimately terminated Plaintiff for other disciplinary violations, unexcused absences, and her failure to return to work after numerous FMLA leaves of absences. Ehling then filed suit in federal district court alleging, among other things, that MONOC violated the SCA, and the common-law claim of invasion of privacy for inappropriately accessing her Facebook post.
So, let’s step back a minute. What does the SCA do? The purpose of the Act is to protect information that a “communicator” meant to keep private. The SCA applies to: (1) electronic communications; (2) that were transmitted via an electronic communication service; (3) that are in electronic storage; and (4) that are not public. Given this, the Ehling Court ruled that Facebook posts configured to be private – not open for general public viewing – met all four criteria. “The Court note[d] that when it comes to privacy protection, the critical inquiry is whether Facebook users took steps to limit access to the information on their Facebook walls.”
Although Ehling chose to keep her Facebook wall private, and hence her posts were covered under the SCA, the Court determined the “authorized user exception” applied. The authorized user exception applies where (1) access to the communication was “authorized,” (2) “by a user of that service,” (3) “with respect to communication … intended for that user.” Each prong of this exception was met in the Ehling case. Access to Ehling’s Facebook posts was “authorized” as her co-worker voluntarily – without solicitation or coercion – provided copies to management. The co-worker was also a “user” under the exception as he had a Facebook account, and Plaintiff had friended him. Plaintiff intended her Facebook rants to be viewed by her friends – including all of her Facebook friends at work. The Court, therefore, dismissed Ehling’s claims under the SCA. Interestingly, Ehling’s common law claim for an invasion of privacy into her Facebook account also failed. The Court, just as with the SCA claims, found that there was no intentional intrusion into her Facebook account.
So what might an employer learn from Ehling v. MONOC? First, at least one court found that an employee’s private Facebook posts fell within the protection of the SCA, and that accessing them without authorization might open up the employer to liability. Second, how management accesses, or receives copies of, the employee’s Facebook post matters. If management solicits, or coerces, an employee to provide copies of, or access to, another’s Facebook posts, or asks the employee to login to Facebook to view the other employee’s account, the SCA exception might not apply – the access might not be “authorized.” But if, as in Ehling, a co-worker voluntarily provides information to management without strings attached the access might fall within the “authorized user” exception.
This case should remind all Facebook users to think about who their Facebook “friends” are…would your “friend” turn you in to an employer for a thoughtless Facebook comment? Food for thought.
Do school districts need help with monitoring students’ social media behaviors to prevent bullying, threats, acts of violence and self-harm? Several districts believe so. Following a pilot program, Glendale Unified School District in Glendale, California recently hired Geo Listening to monitor and report on the cyber-activity of over 14,000 middle and high school students.
According to Geo Listening’s website, their mission is to “provide more timely and relevant information to school administrators so they can better intervene in the lives of children.” The company’s monitoring service analyzes and reports on the social media activity of students from their public posts. Geo Listening then provides a daily report of conduct such as bullying, cyber-bullying, despair, hate, harm to self or others, crime, vandalism, substance/drug abuse, and truancy. What to do with the monitored information is then left to the discretion of the school district. Geo Listening simply hunts and gathers for the data. Despite this, the program has raised some concerns over privacy and free speech rights by students.
Yet, school districts do not provide a list of students to Geo Listening. Rather, the company uses “deductive reasoning to link public accounts” to the students. LA Times, Glendale district says social media monitoring is for student safety, (Sept. 14, 2013). Geo Listening declined to articulate what that means and how that is accomplished. However, if the school district does not provide student names to Geo Listening, or reveal private confidential information in the monitoring process, then the district is not likely violating any privacy laws. Indeed, many employers hire companies to review public social media posts of applicants or employees. (See More Risks to Job Applicants with Questionable Social Media History – where we talked about Social Intelligence, a company which performs social media background checks on applicants for employers).
Geo Listening also contends it does not violate student privacy – it neither hacks into students’ accounts nor peeks into private communications or emails. According to Geo Listening, the students themselves make the information public – the company simply monitors where and what kids communicate. “Parents and school district personnel – they are not able to effectively listen to the conversation where it’s happening now,” Geo Listening CEO told CNN, California school district hires firm to monitor students’ social media, (Sept. 15, 2013). Geo Listening believes its service bridges this communications gap without violating any privacy or free speech rights.
In the end, despite the criticisms and questions – has monitoring Glendale’s students helped? Superintendent Richard Sheehan certainly believes that the monitoring will assist the district in providing a safer environment for students. Recently, the district was able to intervene on behalf of a student who had expressed a desire on social media to end his life, and to date, the district has not commenced any disciplinary action for conduct reported under the monitoring program – even against a student who posted a photo of himself holding what turned out to be a fake gun. Sheehan’s staff simply talked with the student’s parents about the dangers of posting those types of photos online. See, CNN, California school district hires firm to monitor students’ social media, (Sept. 15, 2013).
What do you think? Should school districts look at all student behavior – in and out of the classroom? As we have discussed previously, social media platforms are public venues. Information disclosed is no different than carrying on a conversation in a public place. Regardless, when, how and why we look at that information becomes an important question to ask. How would this apply in the employment context? Should employers be monitoring the communications of its employees online – and what information would employers be looking at? As always, we welcome your input.
Does clicking the “Like” button on Facebook amount to protected speech under the Constitution? According to a ruling on Wednesday from the Fourth Circuit, yes, it does. In fact, according to the Court, “it is the Internet equivalent of displaying a political sign in one’s front yard, which the Supreme Court has held is substantive speech.”
The Court’s decision in Bland v. Roberts doesn’t have any direct impact for private employers because it solely deals with the First Amendment rights of a group of public employees’ from the Sheriff’s office in the City of Hampton, Virginia. However, we have been waiting for this ruling to see how the Court viewed the legal impact of “liking” something or someone on Facebook. We wondered whether the Court find that one mouse click equates to conduct that is protected under the law?
So, let’s take a look at the background of this case. The dispute arose because a group of employees refused to support their boss – the local Sheriff – in his reelection campaign and instead expressed support for his opponent. According to the employees, that support cost them their jobs. After the Sheriff won reelection, he refused to reappoint the employees and they sued claiming the Sheriff violated their First Amendment right to free speech.
The employees expressed their support for the other candidate in various ways, but the one that interests us is the employee who “liked” the opposing candidate’s Facebook page. Prior to the appeal to the 4th Circuit, the district court had found that “merely ‘liking’ a Facebook page is insufficient speech to merit constitutional protection.”
But the Court of Appeals disagreed noting that when the employee clicked “like”, several additional things happened. First, the candidate’s campaign page’s name and a photo of the candidate were added to the employee’s profile, which other Facebook users could view. Additionally, Facebook issued a notification that the employee liked the candidate’s campaign page, and the employee’s name and profile photo were added to the candidate’s campaign page’s “People [Who] Like This” list.
The Court held that the fact that “a user may use a single mouse click to produce that message that he likes the page instead of typing the same message with several individual key strokes is of no constitutional significance.”
Several things about this case interested me. For example, how will this case be used in other legal contexts? Presumably, the National Labor Relations Board will jump on this case to support the notion that “liking” something on Facebook constitutes protected concerted activity. Additionally, there was such a stark contrast in how the district court thought about a Facebook “like” versus the Court of Appeals – how will other courts view similar activity?
The district court seems to have focused on the mechanics – liking is just clicking a button – but the Court of Appeals really dug into the implications of that mouse click, engaging in a multi-page analysis of “what it means to ‘like’ a Facebook page.” Reading, in a court opinion, a lengthy explanation of how Facebook works, what users do to log on and create a profile, etc. is rather amusing since much of what the Court included seems so obvious to the rest of us, but I give them credit for taking the time to do a careful analysis.
What other actions on Facebook might be considered protected under various laws? What about being “tagged” in a photo at a political event or a fundraiser – would that be enough to show an employee’s support for a particular cause? It will be interesting to see how this all unfolds. As always, if you have any thoughts, please share them with us.
Remember the days when a simple firewall and anti-virus software protected a corporate network? Unfortunately, to thwart today’s computer villains (often sponsored by foreign governments), companies may require a more “James Bond” type of defense. For this reason, investors have pumped hundreds of millions of dollars into advanced cybersecurity platforms – betting that businesses will finally get their heads into the security game. “Rare is the corporation whose network has not yet been breached,” Sameer Gandhi, venture capitalist with Accel Partners reported to USAToday, Crowdsourcing, data mining help stop hackers, (Sept. 11, 2013). “The reality is that these threats are becoming more sophisticated, and we can expect them in higher volume in the future.” (Of course, Accel Partners has an interest in businesses beefing up their security protocols, since Accel recently invested millions into a new security company – CrowdStrike – to further develop its anti-hacking platform. See Danny Yadron, Firm that Tracks Foreign Hackers Gets $30 Million Funding Round, Wall Street Journal (Sept. 9, 2013)).
So, let’s take a look at CrowdStrike’s new security business model. CrowdStrike uses big data and “crowdsourcing” analytics to identify and map cyber-criminal behavior within a corporate network. It then purges the intruders from a corporate network before a compromise occurs. The system becomes “smarter” each time it sees how hackers break in to steal information. See USAToday, Crowdsourcing, data mining help stop hackers. To complement these new advanced software tools, CrowdStrike also focuses on the human aspect. Its investigative team, which is trained to collect, investigate and decipher data on threatening groups and corporate security risks, includes a former cybersecurity official from the F.B.I., as well as many others from the defense, intelligence and law enforcement communities. The investigators and forensic experts give businesses the ability to track and hunt those cyber-villains on the network, and to understand why and how the threats occurred.
Other security business firms have been busy increasing their cybersecurity platforms as well. Cisco recently purchased Cognitive Security, a security firm that uses artificial intelligence techniques to detect cyberthreats, and Sourcefire, a leader in intelligent cybersecurity systems. According to recent news releases, Cisco, with these acquisitions, hopes to accelerate its “security strategy of defending, discovering, and remediating the most critical security threats across the attack continuum.”
It certainly appears that these new security platforms are trying to help businesses be proactive with their security protection and detection – that is, to discover a threat before it is too late. What is the old saying – it takes a whole village to raise a child? Well, in today’s hyper-competitive and global marketplace you might need a whole team of highly skilled investigators and forensic experts to safeguard corporate data. However, businesses still need to recognize that their own employees play a big role in security of the company’s data. Businesses should consider looking to external resources, such as these new security platforms. However, they should also be looking at their own internal policies, procedures, training and best security practices to insure they are meeting the quickly changing world of data security and protection.
As the world evolves at a supersonic pace, businesses might need to rethink the importance of their security efforts. As these new business ventures demonstrate, cybersecurity is becoming a critical and necessary function to remain globally competitive. From state-sponsored cyberterrorism and theft to corporate infiltration and espionage, the disappearance of a business’ competitive advantage might be one stolen secret away.
Have you invested in these new security platforms, or are you aware of others that might be of interest to our readers? As always, we would love to hear from you.
With all the news lately regarding the NSA’s surveillance program, it is not surprising that people are concerned, and even a little apprehensive, regarding what information others can view on their personal electronic devices. With the recent surge of BYOD, the clash between personal and corporate data is even more apparent. But what can an employer really view on an employee’s BYOD smartphone or tablet? And when it comes to the use of personal devices, do employees trust their employers?
Recently, MobileIron, a mobile device management software developer, conducted a survey (MobileIron Trust Gap Survey) of 3000 workers across the United States, United Kingdom and Germany. Of those 3000 workers, 80% now use personal smartphones and tablets for work related functions. But only 30% surveyed “completely trust their employer to keep personal information private.” 41% of employees surveyed did not think their employer could see anything on their mobile devices – and 15% were not sure what the employer could see. “There’s a ton of confusion out there, and so the trust gap has widened. Employees don’t really know what their employer can and can’t see.” Ojas Rege, vice president of strategy at MobileIron, told CIO.com, What Can Employers Really See on a BYOD Smartphone or Tablet. “They’re just guessing.”
With a well-crafted BYOD policy, however, an employee should not be surprised about what an employer can see on a personal device. Notice is important, so you might consider telling employees what information the organization needs to see and why. By way of example:
- Apps: An employer has a stake in regulating what applications an employee can use on their personal devices for security purposes (e.g. protecting against outside access to client information, and to prevent the loss of proprietary information.)
- Litigation or Pre-Litigation: In the event of litigation or pre-trial investigation personal devices may be subject to search and review for evidentiary reasons. A BYOD personal device becomes just like any other evidentiary tool that may contain relevant information.
- Corporate Information. Regardless of what an employee may think, all corporate information, whether generated through the use of personal or corporate devices, or personal emails and data, belongs to the employer. The device may not belong to the company, but the information certainly does. Employees ought to understand this before using their personal devices for work purposes.
When looking at BYOD, employers should also consider what information employees don’t want them to see. The survey illustrated the type of personal information and activities most workers were concerned about – personal emails, text messages, photos, videos, voicemails and Web activities. Not surprisingly, younger employees, ages 18-34, were far more concerned about personal privacy than workers over the age of 55. Depending on how the organization manages their mobile devices – it may or may not have access to this kind of information. To make an informed decision about using a personal device, employees should know whether this information will be accessible to and/or monitored by the employer.
The survey certainly demonstrated there is a “trust gap” with employee use of personal devices for work purposes. So how should an employer bridge the trust gap? Unfortunately, the survey really demonstrated that no matter what a company does, whether it places employees on notice of all monitoring activity in writing, asks an employee permission to review a personal device or explains in written detail the purpose behind the surveillance, only 30% of workers believed these measures would increase their level of trust. Roughly 30% of the respondents stated that there was nothing an employer could do to increase their level of trust in the company.
Yet, a complete BYOD policy that spells out what information is needed and why should give an employee some measure of comfort in knowing the circumstances around which a personal device may be investigated or monitored. Armed with that information, the employee can then decide whether they want to use their personal device for work purposes. From the company perspective, a solid and tailored BYOD policy might dispel some of the negativity surrounding monitoring activity on corporate and/or BYOD personal devices.
Has your organization run into concerns over access to information on personal devices? If so, what actions have you taken to bridge that “trust gap”?
Teresa is the Chair of Fredrikson’s Non-Competes and Trade Secrets Group, and an MSBA Certified Labor and Employment Law Specialist. She counsels business clients on risk management and policy development relating to employee use of technology, and also litigates their business and employment disputes. Teresa trains, writes and lectures extensively on legal issues arising from business use of technology and social media.