While legislators across the country are gaining better understanding of technology and public policy issues, they sometimes get it right without grasping the whole problem. Exhibit A: The reaction to employers demanding that job seekers and employees provide their Facebook or other online services passwords demonstrated an understanding of the privacy issues at stake, even while the security issues were overlooked.
As has been widely reported employer request for passwords was presumably to find out more about a potential employee than a resume may reveal, or to see if the employee was speaking ill of the company. Put another way, companies want to peek into private lives; they want to be present during intimate conversations done on personal time.
Thankfully, several states, and several lawmakers in DC, are stepping in to end the growing practice. Appropriately, the proposals typically do not limit the ability of a potential employer from viewing data that is viewable by the public regardless of where it is posted online, but do prohibit requests for login credentials.
Given ongoing cyber-security debate on Capitol Hill—how to protect critical US infrastructure from cyber-attacks—lawmakers had to respond. How can protecting us from online attacks be a national priority if we allow employers, both current and potential, to force applicants to give up the first line of defense in security: their passwords?
The arguments against such proposals, or to modify them to allow exceptions, are folly. An exception if an employee is suspected of stealing company secrets? Is that reason enough to force someone to self-incriminate or allow employers to pilfer their private lives? Let’s continue to require law enforcement to obtain a search warrant via the courts.
But these people are not being private in that they share their thoughts with 500 “friends.” So what? Would we approve of a company wiretapping a phone or bugging a house based on how many people the inhabitants spoke to or the level of intimacy between them?
The issue of privacy, and the ability to have a private life separate from an employer, is critical. As important is whether we really are willing to enhance cyber-security. When veritable strangers can demand and be expected to receive the keys to a person’s online identity then none of us will ever be secure.