Online social networking and the workplace

Presented by: Micheal AxelsenDirectorApplied Insight Pty Ltd

Cheer up, it could be worse

Maybe you can go dive in a swimming pool

full of my money to make you feel better.

@Rynobi: You're a bank. You made a $1.6

billion first-quarter profit. Cheer up. RT @

westpac: Oh so very over it today.

Finally! A bank that feels existential pain."

INTRODUCTION

About this presentation

Key Issues• How to stop your online life from affecting:

– your career – your employer – perhaps your reputation!

Objectives• Identify and discuss how online social networking can affect the

workplace• Discuss employer and employee rights and responsibilities• Provide practical hints and tips for maintaining appropriate privacy

when using social networking websites. • Provide a framework for businesses to use in developing their

policies and procedures for online social networking.

About this presentation

Agenda• Social networking overview and who’s using it• So... that hollow empty feeling was my career?• Social networking and the workplace• Practical hints and tips• Rights and responsibilities• Developing OSN policies and procedures• Conclusion

Expectations

What are your expectations from this session?

Strawpoll: Who uses social networking websites?• MySpace, FaceBook, Friendster, MyYahoo, Twitter, Flickr,

Photobucket, SchoolFriends, Blogger, LiveJournal, Tumblr, Microsoft Live...

• Blogs/Vlogs?• Others?

Strawpoll: Who didn’t know about these websites?

Strawpoll: Anybody here ever ‘Vlog Naked’?• (sorry, just wondering)

SOCIAL NETWORKING OVERVIEW:

WHO’S USING IT

The growth of online social networking

• September 2006 – Facebook in Australia• March 2010 – Facebook now claims 7.8 million

Australian users• Appears to be here for some time, in some form• Employees expect to have access, customers expect to

use it to discuss and evaluate businesses• A general distrust of advertising, but a trust of an online

user

What is online social networking?

• Online social networking includes:– Text (blog posts, comments on blogs, mailing lists or

forums, microblogging – Twitter, pwnce)– Video (video-blog posts on for example YouTube,

Google Video)– Photographs or artwork (for example, Flickr or

Photobucket, – Audio (for example, podcasts) – Dedicated online social networking websites such as

MySpace or Facebook – also Google Buzz (?)

Why is online social networking growing?

• Our lives are increasingly digital• We often meet friends and family online, and make

friends online.• Allows us to achieve work/life balance• With growth of Web 2.0, higher access to easy to use

technology – no specialist expertise required

Is it different?

• Not really, people always talked to each other and said ‘stuff’ – blowing off steam

• Trouble is those conversations at barbecues were never indexed by Google.

• Frequently we forget the context of the forum – and its accessibility – and say ‘regrettable’ things.

SO THAT HOLLOW EMPTY FEELING WAS MY CAREER?

Last year’s video is tomorrow’s viral

Things that make you go ‘hmm’

Censored

Ex-boyfriend site

Oh-kaaay

Recent examples

SOCIAL NETWORKING & THE WORKPLACE

Public and digital lives

Alritey. The names Ryan workin at #### #### At the moment to get the money to go out and enjoy my much appreciated young life. As far as i know i enjoy life to the max, i love to get wrecked, mwi and be around mates and loud music. No better way to spend a weekend than gettin out my #### in one way or another and be surrounded by loud music and knowing that i have a stunning girlfriend when i go home.

The risks to business: seven risks

• Productivity Losses• Legal• Reputation• Viruses and spyware• Privacy breaches and identity theft• Social engineering• Inadvertent release of information

Some business examples of issues

• Staff issues:– Employees sacked for blogging– Using firm email addresses to argue with clients – Embarrassing photos of office Christmas parties– Employees with ‘lewd’ Facebook sites

• Customer/online reputation issues:– Suing Whirlpool– Twitter & Best-Buy– Comcast technician falling asleep while on hold –

Youtube FTW!

Internal and external privacy issues, and other related issues

• Productivity cost (cyber-slacking)

• Phishing attacks, risk of spyware, viruses

• Unintended consequences

• Spur of the moment tweets

• Employees may become stalker targets

• Submit intellectual property

• Inadvertently transfer intellectual property to a client

PRACTICAL HINTS AND TIPS

How to keep an online world sane

Simple things• Common sense!• Don’t post in your real name – set up three email

addresses:– Personal, anonymous email address that forwards to

your main email (for blogging comments & mail lists) – but expect that this is not fail-safe – very useful if you want to stalk Justin Bieber

– Personal (for all your personal email)– Work (for work email – no personal email!)

• Only post online what you’d be happy for Mum (or a potential recruiter/client) to see

How to keep an online world sane

Simple things• Wall posts are wall posts on someone else’s wall, and a

tweet is forever (particularly now they’re archived by Library of Congress!)

• Get permission before you post a photo of someone online

• Only ‘friend’ friends!• Be coy about your age• Never post photos of official identification documents...

Just so you know

How to keep an online world sane

For the more paranoid• If you have a social networking website (e.g. MySpace,

Facebook), use the privacy options – so many people still don’t

• Limit the sites you participate in – perhaps FaceBook for friends, LinkedIn for work colleagues? Too many are too difficult to manage

• Plain old do not accept a flung zombie, which Hero are you?, Blackjack or other application on Facebook

• Don’t get me started on Farmville...• Set up Google Alerts to monitor your name and email

address

Google Alerts

www.google.com/alerts

Dealing with it

Strawpoll: who knows whether their business searches for these discussions?

Good talk is good, right?• The only good way to respond is to give good service and hope that

people blog about it• At least show an interest and respond to address a grievance, and

be transparent about it

Professional monitoring services• Reputation Hawk• Reputation Defender• Cymfony• There are many others of course

Dealing with it

Simple (and cheap)• Google Alerts/Yahoo Alerts/MonitorThis• Customer representatives join online, private, forums and lurk there

while watching for issues• Set clear expectations as to what staff can do with your brand name

on the internet

Responding to online comments• Don’t post a hot and angry response• Don’t exercise legal muscle unless you really have to• Respond with transparency and honesty, but take up discussions

off-line at a senior level, after research!• Engage with the author of the post is most effective

Dealing with it

Words of wisdom• Sometimes, leaving it lie is the best option!• Don’t lie and pretend to be a customer – you will be found out, and

the price will be high!• Avoid a search engine optimisation solution – the ethics are

questionable and doesn’t remove the offending post• Invite genuine customers to respond in a forum – but this can be

risky!• Sometimes these comments come from a direct competitor!• Social networking and the use of the internet is increasing – ignore

the trend at your peril• It’s not all problems – marketing opportunities to engage your

clients, and also to recruit reliable staff

RIGHTS & RESPONSIBILITIES

What is OSN being used for by business?

• Increased professional contacts, exposure to new ideas• Use the network to recruit new employees• Allow new-hires to mix with current employees • It is good when customers say positive things about the

business• Online reputation monitoring & proactive customer

support

What can we do to ‘minimise harm’?

• We need to minimise the potential for harm from social networking for both ourselves and our livelihoods.

• It is important that businesses recognise that there are potentially great benefits that can arise from online social networking, and so a ‘blanket ban’ within the workplace frequently is counterproductive (and really won’t help with activities at home and by customers).

Whose activities need to be governed?

• Five stakeholders:

1) Customers

2) Employees

3) Suppliers of the business

4) Business owners

5) Independent third parties such as journalists or industry regulators

Current Employees

• A business can control what is done with its equipment and resources, and additionally can dictate behaviour on work time.

• However, courts are generally reluctant to allow employers to intrude into employees’ activities in their private time.

• A fiduciary relationship exists between the employer and the employee

• Note limitations on use of OSN by prospective employers – can look, can use the info (but not in a disciminatory way) – but if they store it, privacy issues apply. See especially Privacy Commissioner: http://www.privacy.gov.au/faq/individuals/sn-q5

An employer and employee’s fiduciary relationship

• Practically, there are three duties:– to work with care and diligence– to obey all lawful and reasonable orders – to act with good faith and fidelity

• There are two types of employee - standard and professional employees

• if an employee ‘tarnishes his employee’s image’ the employment relationship would allow disciplinary procedures, and/or termination

• Essentially, if the employee’s actions on the OSN make it difficult to carry out their work duties due to special considerations, then the employer could dictate what can and cannot be done

Control over current employees

• An employer can exercise control in the context of the duties they are owed.

• Different standards will apply depending upon the employee’s role.

• Clear and explicit expectations (and inclusion in the contract of employment) would be necessary to exercise control over current employees

Former employees

• Since they’re no longer employed by the business, duties owed are much less

• Control is very limited• Generally, a post-employment restraint only allows the

protection of a ‘trade secret’ – information of a ‘high degree of confidentiality’ must not be misused

• Legal action will likely be expensive & uncommercial without an express covenant

Other stakeholders

• Other stakeholders (customers, business owners, suppliers, independent third parties) will be governed by, for example, defamation actions.

• Commercially – probably not a lot a business can do about such activities without involving legal actions, which may or may not suit

DEVELOPING OSN POLICIES AND PROCEDURES

AS/NZS 4360:2004 Risk Management

Tailoring your response

Elements of policy & procedure

Standard– Title– Purpose– Revision History– Effective Date– Persons affected– Definitions– Responsibilities

Change to suit risk appetite– Policy– Procedures

Understand the risks

The focus of attention

• In accordance with your risk appetite:– Define what are acceptable online social networking

activities– Develop an employee training and awareness

program– Monitor your online reputation– Respond to online social networking activities

Draft Policy – Very Low Risk Appetite

For a very low risk appetite– In recognition of the very high impact that online

social networking activities have upon the business activities of XYZ Pty Ltd, XYZ Pty Ltd implements very strict restrictions on the use of online social networking activities by employees using XYZ Pty Ltd equipment, and/or making reference to the business of XYZ Pty Ltd.

– XYZ Pty Ltd emphasises procedural controls, regular and intense monitoring to online social networking activities referring to the business of XYZ Pty Ltd, and provides explicit guidelines to follow in responding to such activities.

Draft Policy – Very High Risk Appetite

For a very high risk appetite– As online social networking activities have minimal

impact upon the business activities of XYZ Pty Ltd, XYZ Pty Ltd provides some guidance in the use of online social networking activities by employees.

– Responses to online social networking activities that refer to the business of XYZ Pty Ltd are made on a case by case basis as XYZ Pty Ltd becomes aware of them.

Acceptable online social networking activities

Possibilities– Could ban all mentions by employees– Could ask for pre-approval of a comment– Could allow employees to publish, but have marketing

manager subscribe to RSS feeds and have employees agree to make changes if requested

– Only have authorised representatives respond online– Could block online social networking websites in work

hours (but please be realistic)

Staff training and awareness program

Possibilities– Content

• Awareness of acceptable online social networking activities• Core principles in ensuring the privacy of personal

information in an online environment• Specific training on the use of major identified online social

networking websites to ensure privacy. • Practical advice in the use and etiquette of online social

networking tools, including the use of email

– Make your requirements part of induction program, perhaps with an exam

– Require existing staff to attend annually, and perhaps pass an exam

Online reputation monitoring

Possibilities– Engage online reputation monitoring service provider– At least set up Google Alerts! – Document risky mentions in monthly, quarterly, or

annual online social networking references report– Subscribe to likely private online forums– Ensure that applicants for positions are aware that the

candidate’s online profile may be examined in the course of assessing the candidate’s suitability for the position.

Responding

Possibilities– May need to have lawyers involved– For an employee, the HR manager would deal with it– Core principles:

• Demonstrate an interest and respond online to address a grievance, and be transparent about it

• Never post an immediate, negative, response to an online reference. Have a conversation in person at a senior level

• Legal action considered • Making no response may be the least harmful• All responses conducted professionally and honestly

– Monitor and document responses in social networking references report

CONCLUSION

Conclusion

Review the expectations wall• How did we go?

Obtaining a copy of the presentation• See www.michealaxelsen.com for a copy of this presentation

Main Message• Set up Google Alerts! (www.google.com/alerts)• Set privacy options in Facebook/MySpace!• Use three email addresses, and no private email at work!• Know what your customers say about you at the virtual water-cooler!

Applied Insight Pty Ltd Services• Guide to the Development of Online Social Networking Policies &

Procedures• Social networking training for staff• Social networking review for your business• Social networking policies & procedures

About the speaker

Services• Micheal Axelsen provides business systems

consulting services – that is, how can IT be made to work for your business?

Position and qualifications• Director of Applied Insight Pty Ltd• Member of ISACA• Qualifications

– Bachelor of Commerce (Hons)– Masters of Information Systems– FCPA

• Currently undertaking PhD in the impact of technology use upon professional skills.

CONTACT DETAILS

Micheal AxelsenDirector, Applied Insight Pty Ltd

m: 0412 526 375t: +61 7 3139 0325e: micheal.axelsen@appliedinsight.com.au

blog: www.michealaxelsen.com

Applied Insight Pty LtdPO Box 603Toowong DC 4066AUSTRALIA

References

– AS/NZS 4360:2004 Risk Management– Boyd, D., and Ellison, N. "Social Network Sites: Definition,

History, and Scholarship," Journal of Computer-Mediated Communication (13:1), March 2007, pp 210-230.

– Brandenburg, C. ‘The Newest Way to Screen Job Applicants: A Social Networker's Nightmare’. Federal Communications Law Journal. Los Angeles: Jun 2008. Vol. 60, Iss. 3; p. 597 (30 pages).

– Emerald Insights. ‘MySpace or yours? Advertising and social networks’. Strategic Direction. Bradford. 2008. Vol. 24, Iss. 8; p. 15

– Engdahl, S (Editor). “Online social networking”. Greenhaven Press. Farmington Hills, MI, USA. c2007.

References

– Espejo, R (Editor). ‘Should social networking web sites be banned?’. Greenhaven Press. Detroit, MI, USA. 2008.

– Johnson, R A, and Middleton, J M. ‘Accounting for Second Life’. Journal of Accountancy. New York: Jun 2008. Vol. 205, Iss. 6; p. 54 (5 pages)

– Lavenda, D. ‘Does 'blogging' have a place in the workplace?’. The British Journal of Administrative Management. Orpington: Jul 2008. p. 27 (3 pages)

– Mac Sithigh, D. ‘The mass age of internet law’. Information & Communications Technology Law. Abingdon: Jun 2008. Vol. 17, Iss. 2; pg. 79

– McCallum, R. “Employer Controls over Private Life”. New South Wales University Press Ltd. Sydney, NSW, Australia. 1999.

References

– Stewart, A. ‘Drafting and enforcing post-employment restraints’. Australian Journal of Labour Law. Vol 10 pp181-221. 1997.

– Willard, N E. ‘Cyber-safe kids, cyber-savvy teens : helping young people learn to use the Internet safely and responsibly. Jossey-Bass. San Francisco , CA, USA. 2007.

Appendix:OSN Risk Examples

Scenarios

Productivity Losses– Employees use social networking websites during

work time to the detriment of business performance.

Legal risks– As no policy explicitly states that email use is

monitored by the employer, the employee brings an action for wrongful dismissal when dismissed for posting inappropriate content to an email forum.

– As no policy explicitly states that web use is actively monitored, it is difficult for a business to further investigate an employee who is suspected of posting details of an upcoming marketing program and product price list onto Wikipedia.

Scenarios

– A junior financial planner with an accounting firm provides taxation advice in a public forum using the firm’s email address and with a signature including the firm’s name. The advice is posted publicly, is relied upon by some readers who suffer a loss and subsequently bring an action against the accounting firm.

Reputation Risk– A customer writes a blog post or video that is negative

towards your product, service or staff.– An employee writes a blog post or posts a video that

is negative towards the company’s product, service or staff.

Scenarios

– An employee writes a blog post or status update that places company secrets in the public domain using the business’s equipment.

– An employee posts lewd photographs online in a public forum.

– A friend of an employee posts lewd material on the employee’s public website or social networking page.

– Photographs of office functions depicting inappropriate behaviour are posted online by staff.

– Photographs of office functions depicting inappropriate behaviour are posted online by staff employed by the venue.

Scenarios

– An employee writes a blog post or posts a video that is derogatory to his or her colleagues or the firm’s customers.

– An ex-employee writes a blog post or posts a video that is derogatory to his or her colleagues or the firm’s customers.

– A supplier writes a blog post that is derogatory about the company’s ability to pay its suppliers.

Viruses & spyware– A staff member’s computer infects all networked

computers with a virus that was launched from a website that advertised on MySpace.

Scenarios

– The accountant’s username and password for the business’s online banking is stolen by a Trojan key-logging program that was downloaded to the accountant’s laptop from an advertisement on a niche social networking website while her teenaged son was using the computer at home.

Privacy breaches/identity theft– Using an edited copy of a signed letter and a

business-card posted on Flickr, a fraudster creates a fake letter of employment as supporting documentation for a bank loan in an employee’s name that is subsequently defaulted upon and causes personal bankruptcy for the employee.

Scenarios

– The employee subsequently brings an action against the business for not taking reasonable precautions to prevent this from happening. Although the resulting court case is unsuccessful, it is a serious distraction and expense for the business.

– An employee posts a photograph of a colleague and her children on her blog at the annual Christmas function. The colleague’s estranged husband is able to identify the children’s school from the uniform they are wearing, and subsequently collects the children from the school. The children are never seen again.

Scenarios

Social engineering– Using names, email address, and positions gleaned

from Facebook, position titles and references from LinkedIn, and faked letterhead or invoices from a site such as Flickr or Photobucket, a conman is able to extract payment for non-existent products or services.

– Using photos from Flickr of a business card and letterhead, and information gleaned from Facebook, a fraudster poses as a contract cleaner who then uses an unattended and logged-in computer to steal clients’ taxation information on a 4gb USB memory stick.

Scenarios

Inadvertent release of information– The company’s proprietary approach to the bidding

process for government work is submitted to Wikipedia by the business development assistant and is not able to be withdrawn in time.