Monday, February 24, 2014

Written on the Subway Walls - On privacy & security on social media

My reaction when... 
Let me tell you a quick story -

During my senior year of college, I was taking a class about organizational culture. My professor started lecturing on the pros and cons of social media - especially if you're not careful about your privacy settings. She went on to share an example of a student who had written some - ahem - not-so-flattering commentary about the course on their personal Facebook.

Want to take a guess as to who that student was? 

This is where the concept of "social media (networking) security" comes into play. Networking security are the best practices we must implement in our use of social media in order to keep our personal information safe. In a business setting we use "social media policies" which are formal rules and guidance set down by an organization to protect employees, and the rights and interests of the company. Think of it as the "code of conduct" for online interactions. Check out the video from Social Media Manager Matt Winn of Volusion for more tips on building a social media policy
How to create the perfect internal social media policy -
Two Minute Tuesdays from Volusion
I've put together a few items that might helpful for developing your own social networking privacy. I've based my advice on the guidance Director of IT Policy at Cornell University, Tracy Mitrano, offered her son before he goes away to camp. This, and more, is captured in her article, "A Wider World" 

1. Maintain personal saftey
  • Don't post information that could suggest you're vulnerable. Don't post "Going to Bermuda in a week!" on your public page - as this could make you a target for a break-in. 
  • Be wary of who you "friend" - you should never accept a friend request from someone you do not know - even if you share mutual friends. 
  • Don't overshare your personal data - information like birthdays, phone numbers, addresses etc could make you susecptable to idenity theft. 
2. Explore all the opportunities the camp (and the internet) has to offer - The internet is limitless in the amount of information - need instructions on how to make a basket from old magazines? Interested in King Richard's stance on boiled meat? You can find it online. But that doesn't mean everywhere is safe...
  • Stay away from links that contain security risks, or ask you to download plugins, cookies, or other Software that aren't neccessary to run your program. These downloads could cause harm to your computer, and put your personal information at risk 
  • Don't open emails, or messages that "don't look right". Your friend's accounts may have been hacked - leaving you at risk. Don't open links to the "newest diet craze" or from exotic princes looking for $5,000 loan :) 
3. Treat others how you want to be treated - If you can't say anything nice - don't say anything at all. This goes for both network security and social media policies.
  • Refrain from racist, bullying and generally offensive comments and content. The National Labor Relations Board rules that "employers may encourage employees to refrain from making insulting remarks or engaging in hateful speech in social media" - but this is your reputation, and that of your company - act with caution. 
  • Employers also have the right to "prohibit sexual harassment, workplace violence and threats of violence, sabotage and/or abusive and macious ativity" - in writing your own social media policies, be sure to do your research and understand exactly what the law covers, and what it doesn't. 
After reading a number of articles, and experiencing personally, what happens when you don't take care of your own privacy - this is a critial component to being able to use social platforms in the most effective way possible, for both you, and your organization.

Your privacy and security on social platforms is your responsibility. With all the changes, updates, and regulations, the amount of information can be overwhelming. You owe it to yourself to make sure you, your family, and your organization are protected.

As my mother would say, "Don't post anything you wouldn't want written on the bathroom walls!"
____________________

I've shared only a handful of overarching thoughts with you here. If you're interested in learning more about the specifics of social networking privacy, and social media organizational policies (and you should!) I encourage you to check out the following -

  1. National Labor Relations Board Posts Template Social Media Policy
  2. NLRB’S General Counsel Releases New Social Media Report Containing Much Needed Guidance on Lawful Social Media Policies
  3. The NLRB Strikes Down Employer Policies on Social Media and the Confidentiality of Complaint Investigations







24 comments:

  1. Great post Adrienne, I love that you had a personal example to go with this weeks topic. Did the professor address you after class about it?

    You compiled a very good list of do's and don'ts. It's interesting how some of these seem quite obvious, yet so many people fall victim to it each day.

    I find your third point to be one of the most important. The harassment, bullying and other hurtful activities that take place on social networks is beyond ridiculous. Out of the rules you listed, which is the most important to you?

    ReplyDelete
    Replies
    1. The professor emailed me about it after class, and, all things considered, was very lovely and understanding about the whole thing :)

      I would agree with you - the last "thought" is the most important to me as well. It's not just about bullying though. While that is important - especially for today's youth - treating other people in a respectful manner also translates to other behaviors - don't spam them, don't overshare, be mindful of what you are posting that may effect them.

      For instance (and this is a personal pet peeve of mine) when a bride & groom spend $1400 on a professional camera man, perhaps they don't want the first pictures of their wedding shared from your blurry camera phone for the whole world to see!

      Delete
  2. Adrienne - It looks like many of us had similar takeaways from this week's readings. I like your bullet about being careful who you friend.

    We are largely a digital social community when it comes to professional networking. We connect with alumni, industry professionals and colleagues on LinkedIn and other job networking sites. We've all heard "It's all about who you know" when it comes to job searching. This makes it hard to draw the line on who to "friend." Do you accept friend requests from HR managers, prospective employees and in-network contacts that you do not know? I would think the best advice is to "be smart" and accept people based on your personal judgement. What are your thoughts on this?

    Kristen

    ReplyDelete
    Replies
    1. Kristen - I completly agree with you about being concerned about connecting with people I don't know on LinkedIn. It could result in a potential connection, job, networking opportunity - OR it could be a scam.

      My policy is, if someone I don't know wants to connect with me on LinkedIN, I always send them a message first, asking them where they are from, and how they found my profile. If they respond with a logical answer, I accept. If they don't respond, or send something generic, then I don't accept them. I don't want to be connected with people that I can't trust!

      Delete
  3. Hey Adrienne, I’m sure that was an uncomfortable situation. I have heard of similar events that have happened with colleagues who have complained about work on their profile. While we may think of social media sites as a place to vent, it takes moments like this to realize privacy doesn’t exist anymore.

    I like that you pointed out that you should treat others how you want to be treated. I can’t stress enough how many times I’ve read of children or teenagers being cyber-bullied or fights occurring from arguments that started on social networking sites. Have you seen this BuzzFeed article? http://www.buzzfeed.com/ryanhatesthis/this-is-the-most-epic-brand-meltdown-on-facebook-ever

    What started as a business owner defending herself ultimately became a social media nightmare. It spread like wild fire that people even took to other sites like Yelp to destroy the business and the owners. Talk about bad press! You really need to be careful about what you post.

    Have you heard about any other


    Resource:

    Broderick, R. (2013, May 14). This Is The Most Epic Brand Meltdown On Facebook Ever. Retrieved February 26, 2014, from http://www.buzzfeed.com/ryanhatesthis/this-is-the-most-epic-brand-meltdown-on-facebook-ever

    ReplyDelete
  4. Sorry, I hit sent too fast. Have you heard about any other stories in the press about fights that escalated as a result of social media?

    -Amanda

    ReplyDelete
    Replies
    1. Fights happen on social media all day, every day on every platform! I even see it on my own FB timeline, and I'm sure you do too.

      The meltdown you mention isn't really about privacy - those business owners agreed to be on Kitchen Nightmares, agreed to be in the public eye, and in-turn, risk the public's critique. I think "cyber-bullying" as we most frequently think of it between pre-teens and teens is (for the most part) a very different scenario than the behavior of those business owners.

      With privacy / secruity controls, a person or organization can hope (and I say hope because there's always a chance) to have some degree of privacy. Personal FB profiles and invite-only blogs are designed to have a much different relationship with audiences than FB pages set up by organizations to connect with their customers and drive awareness of their company.

      Delete
    2. While I agree those business owners agreed to be on television, they claimed their page was "hacked". Whether it was or not, someone who had access to their account was threatening the people who responded, and this completely destroyed their reputation.

      How do you think companies can better protect their pages from being compromised? I know we immediately remove anyone who has admin access to our company social sites as soon as they give their two-week notice about leaving. We don't want a scenario happening where people backlash after they quit and post something inappropriate.

      We also only allow 2 or 3 people to have access to our accounts at anytime. We had a scenario where someone thought they were logged into their Twitter account and accidentally posted something on our page. We immediately noticed it and took it off, but we have over 16K followers. I'm sure a few people saw the post before it was removed.

      Delete
    3. Hi Amanda - We use the same guidance - we only have a few account owners at a time. Additionally, all IBMers have to take a required "social business" course, all about our social policies and procedures. This is an annual course, that is updated based on the newest platforms and technologies. That way, regardless of what type of role you have within the company, you understand what is expected of you when conducting yourself on social platforms.

      Delete
    4. Amanda and Adrienne,

      The pervasiveness of security challenges via social media takes many forms and user conduct is only the tip of the iceberg. The IT department at our campus is constantly complaining about the malware downloads directed at our network and servers via Facebook.

      It got to the point that they tried to eliminate access to Facebook and Twitter on the campus network. Because of what we all recognize as the broad use of such services, especially among traditionally aged college students, I was able to fend this off (and become a little unpopular with the CIO).

      Mike

      Delete
  5. Hi Adrienne,

    Yikes! I'm sure that situation with your Professor must have been a bit embarrassing, but thankfully it all worked out ok!

    I think you had a great post! I would have to agree with you and the others that the cyber bullying is very serious today. Since I work with teenaged students at the alternative high school, I have seen how this bullying has an effect on them first hand. We have even had a few students talk of suicide because of it, and one who attempted. Thankfully, our school also has a full-time staff of mental health clinicians that work with our students, so all have been counseled and worked with. The unfortunate part is that many schools do not have these same resources, and these bullying attacks fall through the cracks until someone succeeds at taking their own life, or the lives of others. In some cases, the parents have been legally charged for their children's behavior.

    Do you, and anyone else commenting, think charging the parents is the right method for addressing children's behavior within social media?

    Thanks,
    Dawn

    ReplyDelete
    Replies
    1. What a loaded question you bring up! I think the issue of blame / charging a parent for the behavior of their child is far to over-reaching to be addressed with a yes or no answer.

      There are many instances where a parent's actions may have enabled, or encouraged the behavior of the child. (Perhaps an abusive parent / child relationship). There are other instances where the parent may have done everything in their power to address the issue. It's really much too dependent on the particular scenario to decide one way or another.

      I will say,on a related note, parents and/or guardians have a responsibility to know and understand the privacy and security settings on all of the internet-connected devices in their homes, and within reach of their children.

      Delete
    2. Hi Dawn, what a good question you brought up. I would say no also. A parent can do everything possible to monitor what their child does on social media at home, but once they leave the house parents are not able to monitor their children, you have to just hope they exercise what you taught them at home.

      Charging parents over social media behavior would open up even more serious issues. For example, if a child steals another students phone on the way home from school; should the parent be arrested for theft? I would say, no.

      Delete
    3. Hi Adrienne and Andrea,

      I am in agreement with you both. The topic is one of much debate and one that must take into consideration many scenarios and bits of information.

      Also, with many homes today having both parents working, it is extremely difficult to monitor all of the actions of their children.

      Adrienne, you make an interesting point about parents and guardians knowing the privacy settings on devices in their homes. This would be great as a tool, if the owner if the IP address could monitor and lock such settings. Facebook and Twitter ... if you are scanning Google for your company name, take this suggestion. :)

      Perhaps the answer to such issues may be more education regarding the risks of different content on social media. My 3 year old great nephew has his own iPhone and iPad. Now, I personally don't think this is something necessary, but my nephew and his wife do. They want their kids to be as current with things as possible, and they use the devices for learning games, etc.

      Does anyone think there should be mandatory classes for these types of things in schools? Since I work in a school, I was curious at everyone's thoughts on this. Typing classes used to be mandatory when I was in school, but now are not ... so perhaps these types of classes should replace them.

      Thanks for the feedback everyone!

      Dawn

      Delete
    4. Hi Dawn - I 100% believe this needs to be covered in standard academic curriculum! Along with other relevant things like, "how to balance your checkbook", or "what is a 401k?" :)

      Delete
    5. I definitely concur!!!!!
      :)

      Dawn

      Delete
  6. Adrienne,

    Great personal anecdote. I had a similar story recently. My 17-year-old came home one day to relate what he prefaced as a "funny" story. Seems a girl in his school received a phone call from the college coach who had given her a soccer scholarship for next year. He was rescinding the scholarship in reaction to activities and photos the girl had posted about on Facebook.

    After discussing with my son why "funny" wasn't the best adjective in this situation, we had a great conversation about security online, etc. I was glad to see that he had already been thinking about it a lot and had set up careful parameters for himself.

    Interestingly, there are, in some cases, positive outcomes when some cohorts of people practice poor social media self-defense. Urbina (2014) recently wrote of the growing use of social media postings and information to identify and incriminate those who commit crimes.

    Can you think of any other positive outcomes of poor security habits that might arise?

    Mike

    Reference:

    Urbina, I. (Feb 15 2014). Social media, a trove of clues and confessions. The New York Times. New York, NY: New York Times Company.

    ReplyDelete
    Replies
    1. Agree with you Mike - "cringe-worthy" would have been the adjective I would have chosen.

      Poor social media habits usually result in unfortunate consequences for at least one party involved. Aside from helping to solve crimes, as you mentioned, I can only think of one other instance where I have appreciated someone's oversharing.

      We're conducting interviews for our summer intern position, and I have shamelessly checked out each and every one of our short-listed candidate's social media profiles - including blogs, twitter, pinterest, youtube and FB. We have, on a few occasions, reviewed candidates who looked good on paper, but not on their social media profiles.

      It's not about an individual's freedom (or lack there of) to say whatever they want on their owned spaces. It's (in my opinion) a judgement call. Someone gossiping, or speaking negatively about someone, or bragging about behaving in an - ahem - unseemly manner - in a public place doesn't instill confidence in that person -regadless of what their resume says. So perhaps the employer avoids hiring someone who could have ended up as a "bad fit" because they were able to see their true personality / behaviors from social media.

      Delete
    2. Good for the business, but not so much the candidate! But your right, that is a benefit at least for the employer.

      Some of it, in my mind, is a matter of degree. If someone has one or two-boneheaded posts and I am really interested in them, I might give them some leeway and ask around the issues to get more insight.

      If someone's profile picture is of them holding beer pong trophies from the last three consecutive years, I'd be less inclined to spend my time.

      We obviously are not alone in thinking this way some 40 percent of employers scan social media sites to gain insight into candidates.

      Mike
      .

      Delete
  7. Hey Adrienne!

    Very nice post. You bring up some great points about social media security. One of my favorite points that you made is when you stated that you should not boast about when and where you are going on vacation. I think people do this way too often without thinking. I will log onto Facebook and a bunch of my friends are talking about vacations they are on. Sometimes I find it hard to censor what I say, I'll be about to post something and think, "you know what, people do not need to know where I am."

    Do you censor what you say online or are you prone to posting about your whereabouts? Do you think that it really does make a difference if we use security settings on social sites?

    -Michele

    ReplyDelete
    Replies
    1. I brought this idea up on Kristen Spirko's blog as well. I don't use any geotagging platforms - either ones that are built in (such as on FB) or standalone sites like Foursquare. Neither do I share my address on any of my profiles.

      I share my whereabouts when I'm in the nearby area - for example, "headed to trivia tonight!" I'll be back in my apartment within a few hours, and I live in a very safe neighborhood and secure apt. building. If I am going on vacation, I usually share the photos after I get back - (mostly so I can make sure I like all the ones I post) so people wouldn't necessarily know which dates I am away.

      Also - I have very secure settings on my FB page - which is where I do most of my personal sharing. I've done a lot to make sure I'm very hard to find, but a "fingers crossed" thought does run through my mind occassionally!

      Delete
    2. Sounds like you have it all worked out! I too do not use foursquare or the locating "perk" of Facebook. I hate the idea of it. I do not need everyone knowing where I am at all time. Some of my friends us them and I just think, "Are you crazy!?" I do not share my address either and most times I do not even like putting my e-mail address. Posting pictures about a vacation after you get back is a great idea as well.

      -Michele

      Delete
  8. Hi Adrienne-

    In Matt Winn’s video about social media policy, I was a bit surprised that he did not mention Section 7 of the National Labor Relations Act. I think it is very important for businesses to understand what constitutes “protected concerted activity” of employees on social media. If employees are engaging in dialogue with each other on social media (be it positive or negative), this interaction is allowed by Section 7. On the other hand, individual employees are ranting on their own without any interaction from coworkers is prohibited. Opinions are also largely protected. “Expressing an opinion in social media discussions among employees, even if an opinion is factually incorrect, is protected under the Act” (Halpern, 2012).

    I love your mother’s advice about not posting anything that you wouldn’t want written on the bathroom walls! In social media, the effects are even worse because they are viral. It is the equivalent of writing on a bathroom wall that is then linked to numerous other bathroom walls.
    My father used to tell me never to write anything down on paper while I was angry. “Once you put it on paper” he said, “there is no retracting your comment.” The same is really true today online. Once you post a comment, it can be forwarded, printed and cached. Deleting a comment online does not erase all history or evidence.

    Reference:
    Halpern, S. J. (2012). When is your company's social media policy an unfair practice? National Law Review. Retrieved from http://www.natlawreview.com/article/when-your-company-s-social-media-policy-unfair-labor-practice-recent-nlrb-decisions-

    ReplyDelete
    Replies
    1. Hi Susan - I can understand why Matt may not have mentioned Section 7. When you start to talk about laws / regulations / unions it tends to get a little "gorpy" - people's eyes start to glaze over if you know what I mean!

      I'm sure that whenever an organization starts to put a social media policy in place (or any corporate policy for that matter) they work closely with their legal team, who would cover the NLR. Also - since it was only a 2 minute video, just covering the basics, I can see why he left it out :)

      Delete