The 'Always On' Brain

So, I’ve finally finished my infographic resume, check it out if you feel so inclined:

Infographic Resume for Alexis Adair

But now I’m wondering whether it was worth the trouble.  I just tried to use it to apply to an amazing job, but apparently automated HR programs like Jobvite won’t actually let you attach anything to an application.  They say you’re uploading a document, but all the program actually does is excerpt the OCR text from a PDF or Word document – the actual document is never attached (in spite of the fact that the upload box explicitly stated “the document will be attached in its original format”).  And the OCR doesn’t even keep basic formatting like bold or centering, nevermind graphics.  So apparently I just applied to a job with no resume.  Nice.

It’s no wonder I see some job listings go unfilled for 4, 5, even 6 months or longer – these automated systems mostly screen candidates out, and HR never even sees a bunch of people who just might be the ones they would want to hire.  It’s unfortunate that exactly the sort of company that should appreciate an original, creative resume is completely unable to accept one.

There have been a number of articles, particularly in the past week, regarding the fact that some employers are requesting (or requiring or demanding) applicants’ Facebook passwords.  Some “only” demand that the applicant “friend” them, but others are actually going so far as expecting them to hand over the login password to their account.  I find it extremely unscrupulous that anyone in HR would ask such a thing, and that’s just a starting point.

I agree with a lot of the reactions that say this is an invasion not only of the applicant’s privacy, but also that of every one of their friends on the social media site.  But that’s just the tip of the iceberg.  Most of the articles I’ve seen are completely missing what I consider the most important aspects of this controversy – the clear illegality of the request, and the gigantic risks to safety and security that it creates – not only for the applicant, but also for the employer making the request.

Now, I’ll be the first to agree that whatever you put on the internet *publicly* is fair game.  If my Facebook profile is public, then whoever wants to look me up can find me, be they my employer, my grandmother or a stalker.

HOWEVER, it’s a biiiiig stretch from viewing a publicly visible profile, to logging in AS ME.

First there’s the question of whether this practice is legal.  Personally, I think this question is pretty darn easy – the answer is NO, it’s NOT.

Let’s look at a reasonableness standard here – any reasonable person should expect someone’s Facebook profile to contain information about their age, race, national origin, political and religious views, marital status, whether they plan to have children, and/or their sexual orientation.  So an HR employee asking for access to someone’s profile, whether by having that person “friend” them, or by asking that person for their password, is DIRECTLY, EXPLICITLY asking that person for EVERY ONE of those things.  And since federal laws prohibit employers from asking an applicant about ANY of those things, I’d say it’s pretty clear that the practice is, de facto, illegal.  I think General Counsels everywhere should be talking to their companies’ HR departments ASAP about the illegality of these practices.

Aside from the clear illegality of requesting someone’s password, there is tremendous potential for abuse.  In an article in The Atlantic, author Megan Garber states that ”These are not rogue or clueless HR reps.”  Though I understand her point in context, I beg to differ.  These HR reps most certainly are completely clueless on matters of personal and corporate security (as well as employment law), or they wouldn’t ask someone for their password.  But even more important, they *could be* rogue.  With so much publicity around this behavior and its apparent wide practice, it would be breathtakingly easy for just such a “rogue” HR employee to ask for someone’s password information, and then use it nefariously.  How would an applicant be able to tell that a given HR employee *isn’t* rogue?  Frankly, how many times has this already happened, where someone’s password information provided in an interview was later used to either steal from a bank account, charge to a credit card, and/or steal their identity?  I could almost guarantee you that number isn’t zero, or at the very least that it won’t be for long, if this practice isn’t put to a stop immediately.

Now, some people might think, what damage could someone possibly do with just your FB password?  Plenty.  Keep in mind, this is an HR department, and you’re either applying, or already at the interview stage.  Which means you’ve already provided your social security number and address.  And in at least some places, you will already have been asked for your direct deposit information.  Think about this for a minute.  It’s a well-known fact that, unfortunately, many people use the same password for everything.  So….  This HR employee has your social.  They have your bank account number.  They know your bank.  And at some point, if you’re a serious candidate, HR may run a credit check, so they know all your credit card accounts.  And now they know your password.  And bada bing, bada boom, they can log onto your bank website and into your account.  They can log into every one of your credit card accounts.  They can open new accounts in your name.  And not just the HR employee who asked for your password.  Potentially any HR employee.  And anyone in IT at that company with administrator privileges.  Oh, and when you gave them your password, did you write it down on something?  A post-it, perhaps?  Now who else has access to YOUR ENTIRE LIFE???  And even if you didn’t write it down, you have no idea how safe, secure or clean that HR employee’s computer is.  For all you know, they opened a link in their email and inadvertently downloaded keystroke-tracking spyware.  So now some hacker has your password too.

Can anyone really afford to be that stupid?

I would think that the banking and credit card companies should be EXTREMELY concerned about the potential for theft and identity fraud that this practice creates, and should pressure any companies they do business with to ensure that their HR departments do NOT allow this practice.

Another thought I didn’t see articulated much was, as a company, do you really want to hire someone who would so easily divulge something as sensitive as a password?  To do so is a violation of the website’s terms of use (and Facebook has officially weighed in on this) - do you really want an employee who so casually violates contracts and disregards security concerns?  Why would you have any reason to believe that same person as an employee would abide by your own company’s contracts, or protect your company’s sensitive data?  Sadly, few of the articles or comments have addressed this angle, save for one I saw in response to the article at The Atlantic.  Commenter Al_Fakh_Yughoud wrote: “I personally would not hire someone who surrendered his/her password upon request…, because I would consider that person a security risk, someone who would not refuse to obey an illegal/unethical request by an unscrupulous supervisor….  Every company expects that their employees don’t give out their personal password to access the company network, not even to the IT people. And every company expects that employees would report to the appropriate people instances in which a superior made an illegal or even just unethical request” [emphasis mine].

Even when someone is smart enough to say NO, apparently some recruiters have the gall (as I saw in this discussion on LinkedIn) to assume the person must be “hiding something”.  As if the request isn’t ridiculous enough in the first place.  Never mind that it’s just generally smart to be careful about what you put out in public on the internet.  Inferring that someone with a “private” profile is necessarily hiding something is patently absurd.  Women especially, as well as anyone with children, have extremely strong incentives to lock down their public social media – for their own personal safety and that of their families (need we revisit geotags in smartphone photos?).  Public = stalkable.  And employers should respect this.  Not that men can’t be stalked or abused, but it’s orders of magnitude more likely for women to be the victims.  And domestic violence doesn’t necessarily stay at home.  How many times has a violent spouse or boyfriend come to a woman’s workplace and killed not only the woman but her coworkers as well?  HR should think long and hard about that before they insist that a woman’s social media profile be public or else she must be “hiding something.”  There are very good reasons to “hide.”

As I’m sure will happen many times in this brave new world, the technology has gotten far ahead of the legislation.  I’ve had my say now, so here’s your call to action, dear readers:

If you have interviewed at a company that has asked you to “friend” them or provide your password – OUT THEM!  One good option is to go to Glassdoor.com, and ANONYMOUSLY review your interview experience – tell the world which employers are asking for passwords!!

But more importantly, write to your Congressional representatives.  Tell them that it is urgent that they pass legislation which:

• Makes it illegal for an employer to request or require ANY password (whether social media, email, smartphone, as-yet-uninvented device or anything else) from a potential (or current) employee
• Makes it illegal for an employer to require that an employee or applicant “friend” or otherwise connect to them on any social media platform
• Makes it illegal for an employer to infer anything negative about the fact that a person’s social media profile is on a private setting.
• Makes it illegal for an employer to make a negative inference or take any negative action based on a person’s refusal to provide access to a private social media account

Thank you.  Soap box over.

For more reading, these are some of the articles that set me off (those not already linked in the text above):

[slightly modified from a discussion board post I made for a class assignment]

Management thinking great Peter Drucker states that you have to start out with “what is right rather than what is acceptable” before you compromise, so that you don’t make the wrong compromise (from The Daily Drucker, p. 304).

As an aside, I would argue that part of the reason is that the compromise itself is what is “acceptable” – it’s what you settle for when you can’t get what’s ideal.  If you’ve compromised the ideal before you even reach the point where you have to compromise, you haven’t left yourself many good options.

But I digress.  I think in corporations, compromises are most often made over money – how much to budget, and for what.  Where to strike the balance between profitability and the sustainability of the organization.

And this is where successful companies have realized that having a purpose can help guide those determinations and compromises.  Some part of any corporation’s purpose is, of course, to make money, to be profitable.  But that can’t be the sole driving force in a company.  It doesn’t motivate workers, or create or increase morale, and it often doesn’t even drive profitable behaviors, because the decision-makers ignore sustainability and future success in favor of profits now, and by failing to invest and plan ahead, can (eventually) completely eliminate the business’s ability to be profitable.

So, “what is right” is what aligns with the company’s purpose.  To use our first class presentation subject, Procter & Gamble, as an example, the company’s purpose is “touching and improving more consumers’ lives in more parts of the world more completely.”  And this sense of purpose is infused throughout the company.   We had the good fortune to interview a P&G employee who said that he is guided only a daily basis in his work by the company’s purpose.  With that sense of “what is right,” people at any level of the company can make the right decisions, the right compromises, and still achieve the company’s goal without “cutting the baby in half.”  The company can decide to invest in an audacious goal like digitizing the entire company, because they see that doing so, and using technology to be as efficient and informed as they can possibly be, will help enable them to touch and improve consumers’ lives all over the world, including growing markets like China and India, where they can’t necessarily just sell to a few giant Wal-marts, but need to reach many smaller stores in order to deliver their products to their consumers.

A blind pursuit of nothing but profit can lead organizations to make bad compromises and bad decisions.  “Undisciplined pursuit of more” is what Jim Collins, in “How the Mighty Fall,” labels as the second of five stages of corporate decline.  If you cut costs and expand markets or grow company size without investing in technology, training, and process improvement, you can end up with a company that is analogous to a tree that has rotted on the inside, where it may still look fine on the outside, but it’s only a matter of time before a storm comes that tears the whole thing down.

And the expert interview [part of our class materials] with Jim Igel touched on this, as well, when he and Guy St. Clair addressed the importance of corporate social responsibility.  The interesting fact is that social responsibility and even altruism in corporations is not only *not* anathema to profitability, but there’s also a substantial body of research demonstrating that the two things actually go hand in hand – a company that benefits society ultimately improves its own bottom line (cf. “Built To Last” by Jim Collins).

Coincidentally, I posted this homework assignment on Friday, October 7, and the very next day, October 8, @TEDNews tweeted this TED Talk by Simon Sinek, discussing how inspired and inspirational leaders and organizations “Start With Why” – “people don’t buy what you do, they buy why you do it.”