This presentation discusses key issues such as how to stop your online life from affecting your career, your employer and perhaps your reputation! Objectives include to identify and discuss how online social networking can affect the workplace, to discuss employer and employee rights and responsibilities, to provide practical hints and tips for maintaining appropriate privacy when using social networking websites, and to provide a framework for businesses to use in developing their policies and procedures for online social networking.

1. Online social networking and the workplace Presented by: Micheal Axelsen Director Applied Insight Pty Ltd

2. Cheer up, it could be worse Maybe you can go dive in a swimming pool full of my money to make you feel better. @Rynobi: You're a bank. You made a $1.6 billion first-quarter profit. Cheer up. RT @westpac: Oh so very over it today. Finally! A bank that feels existential pain."

3. INTRODUCTION

4. About this presentation Key Issues How to stop your online life from affecting: your career your employer perhaps your reputation! Objectives Identify and discuss how online social networking can affect the workplace Discuss employer and employee rights and responsibilities Provide practical hints and tips for maintaining appropriate privacy when using social networking websites. Provide a framework for businesses to use in developing their policies and procedures for online social networking.

5. About this presentation Agenda Social networking overview and who’s using it So... that hollow empty feeling was my career? Social networking and the workplace Practical hints and tips Rights and responsibilities Developing OSN policies and procedures Conclusion

6. Expectations What are your expectations from this session? Strawpoll: Who uses social networking websites? MySpace, FaceBook, Friendster, MyYahoo, Twitter, Flickr, Photobucket, SchoolFriends, Blogger, LiveJournal, Tumblr, Microsoft Live... Blogs/Vlogs? Others? Strawpoll: Who didn’t know about these websites? Strawpoll: Anybody here ever ‘Vlog Naked’? (sorry, just wondering)

7. Social Networking overview: who’s using it

8. The growth of online social networking September 2006 – Facebook in Australia March 2010 – Facebook now claims 7.8 million Australian users Appears to be here for some time, in some form Employees expect to have access, customers expect to use it to discuss and evaluate businesses A general distrust of advertising, but a trust of an online user

9. What is online social networking? Online social networking includes: Text (blog posts, comments on blogs, mailing lists or forums, microblogging – Twitter, pwnce) Video (video-blog posts on for example YouTube, Google Video) Photographs or artwork (for example, Flickr or Photobucket, Audio (for example, podcasts) Dedicated online social networking websites such as MySpace or Facebook – also Google Buzz (?)

10. Why is online social networking growing? Our lives are increasingly digital We often meet friends and family online, and make friends online. Allows us to achieve work/life balance With growth of Web 2.0, higher access to easy to use technology – no specialist expertise required

11. Is it different? Not really, people always talked to each other and said ‘stuff’ – blowing off steam Trouble is those conversations at barbecues were never indexed by Google. Frequently we forget the context of the forum – and its accessibility – and say ‘regrettable’ things.

12. So that hollow empty feeling was my career?

13. Last year’s video is tomorrow’s viral

14. Things that make you go ‘hmm’ Censored Ex-boyfriend site

15. Oh-kaaay

16. Recent examples

17. Social networking & the workplace

18. Public and digital lives Alritey. The names Ryan workin at #### #### At the moment to get the money to go out and enjoy my much appreciated young life. As far as i know i enjoy life to the max, i love to get wrecked, mwi and be around mates and loud music. No better way to spend a weekend than gettin out my #### in one way or another and be surrounded by loud music and knowing that i have a stunning girlfriend when i go home.

19. The risks to business: seven risks Productivity Losses Legal Reputation Viruses and spyware Privacy breaches and identity theft Social engineering Inadvertent release of information

20. Some business examples of issues Staff issues: Employees sacked for blogging Using firm email addresses to argue with clients Embarrassing photos of office Christmas parties Employees with ‘lewd’ Facebook sites Customer/online reputation issues: Suing Whirlpool Twitter & Best-Buy Comcast technician falling asleep while on hold – Youtube FTW!

21. Internal and external privacy issues, and other related issues Productivity cost (cyber-slacking) Phishing attacks, risk of spyware, viruses Unintended consequences Spur of the moment tweets Employees may become stalker targets Submit intellectual property Inadvertently transfer intellectual property to a client

22. Practical hints and tips

23. How to keep an online world sane Simple things Common sense! Don’t post in your real name – set up three email addresses: Personal, anonymous email address that forwards to your main email (for blogging comments & mail lists) – but expect that this is not fail-safe – very useful if you want to stalk Justin Bieber Personal (for all your personal email) Work (for work email – no personal email!) Only post online what you’d be happy for Mum (or a potential recruiter/client) to see

24. How to keep an online world sane Simple things Wall posts are wall posts on someone else’s wall, and a tweet is forever (particularly now they’re archived by Library of Congress!) Get permission before you post a photo of someone online Only ‘friend’ friends! Be coy about your age Never post photos of official identification documents... Just so you know

25. How to keep an online world sane For the more paranoid If you have a social networking website (e.g. MySpace, Facebook), use the privacy options – so many people still don’t Limit the sites you participate in – perhaps FaceBook for friends, LinkedIn for work colleagues? Too many are too difficult to manage Plain old do not accept a flung zombie, which Hero are you?, Blackjack or other application on Facebook Don’t get me started on Farmville... Set up Google Alerts to monitor your name and email address

26. Google Alerts www.google.com/alerts

27. Dealing with it Strawpoll: who knows whether their business searches for these discussions? Good talk is good, right? The only good way to respond is to give good service and hope that people blog about it At least show an interest and respond to address a grievance, and be transparent about it Professional monitoring services Reputation Hawk Reputation Defender Cymfony There are many others of course

28. Dealing with it Simple (and cheap) Google Alerts/Yahoo Alerts/MonitorThis Customer representatives join online, private, forums and lurk there while watching for issues Set clear expectations as to what staff can do with your brand name on the internet Responding to online comments Don’t post a hot and angry response Don’t exercise legal muscle unless you really have to Respond with transparency and honesty, but take up discussions off-line at a senior level, after research! Engage with the author of the post is most effective

29. Dealing with it Words of wisdom Sometimes, leaving it lie is the best option! Don’t lie and pretend to be a customer – you will be found out, and the price will be high! Avoid a search engine optimisation solution – the ethics are questionable and doesn’t remove the offending post Invite genuine customers to respond in a forum – but this can be risky! Sometimes these comments come from a direct competitor! Social networking and the use of the internet is increasing – ignore the trend at your peril It’s not all problems – marketing opportunities to engage your clients, and also to recruit reliable staff

30. rights & responsibilities

31. What is OSN being used for by business? Increased professional contacts, exposure to new ideas Use the network to recruit new employees Allow new-hires to mix with current employees It is good when customers say positive things about the business Online reputation monitoring & proactive customer support

32. What can we do to ‘minimise harm’? We need to minimise the potential for harm from social networking for both ourselves and our livelihoods. It is important that businesses recognise that there are potentially great benefits that can arise from online social networking, and so a ‘blanket ban’ within the workplace frequently is counterproductive (and really won’t help with activities at home and by customers).

33. Whose activities need to be governed? Five stakeholders: Customers Employees Suppliers of the business Business owners Independent third parties such as journalists or industry regulators

34. Current Employees A business can control what is done with its equipment and resources, and additionally can dictate behaviour on work time. However, courts are generally reluctant to allow employers to intrude into employees’ activities in their private time. A fiduciary relationship exists between the employer and the employee Note limitations on use of OSN by prospective employers – can look, can use the info (but not in a disciminatory way) – but if they store it, privacy issues apply. See especially Privacy Commissioner: http://www.privacy.gov.au/faq/individuals/sn-q5

35. An employer and employee’s fiduciary relationship Practically, there are three duties: to work with care and diligence to obey all lawful and reasonable orders to act with good faith and fidelity There are two types of employee - standard and professional employees if an employee ‘tarnishes his employee’s image’ the employment relationship would allow disciplinary procedures, and/or termination Essentially, if the employee’s actions on the OSN make it difficult to carry out their work duties due to special considerations, then the employer could dictate what can and cannot be done

36. Control over current employees An employer can exercise control in the context of the duties they are owed. Different standards will apply depending upon the employee’s role. Clear and explicit expectations (and inclusion in the contract of employment) would be necessary to exercise control over current employees

37. Former employees Since they’re no longer employed by the business, duties owed are much less Control is very limited Generally, a post-employment restraint only allows the protection of a ‘trade secret’ – information of a ‘high degree of confidentiality’ must not be misused Legal action will likely be expensive & uncommercial without an express covenant

38. Other stakeholders Other stakeholders (customers, business owners, suppliers, independent third parties) will be governed by, for example, defamation actions. Commercially – probably not a lot a business can do about such activities without involving legal actions, which may or may not suit

39. Developing OSN policies and procedures

40. AS/NZS 4360:2004 Risk Management

41. Tailoring your response

42. Elements of policy & procedure Standard Title Purpose Revision History Effective Date Persons affected Definitions Responsibilities Change to suit risk appetite Policy Procedures

43. Understand the risks

44. The focus of attention In accordance with your risk appetite: Define what are acceptable online social networking activities Develop an employee training and awareness program Monitor your online reputation Respond to online social networking activities

45. Draft Policy – Very Low Risk Appetite For a very low risk appetite In recognition of the very high impact that online social networking activities have upon the business activities of XYZ Pty Ltd, XYZ Pty Ltd implements very strict restrictions on the use of online social networking activities by employees using XYZ Pty Ltd equipment, and/or making reference to the business of XYZ Pty Ltd. XYZ Pty Ltd emphasises procedural controls, regular and intense monitoring to online social networking activities referring to the business of XYZ Pty Ltd, and provides explicit guidelines to follow in responding to such activities.

46. Draft Policy – Very High Risk Appetite For a very high risk appetite As online social networking activities have minimal impact upon the business activities of XYZ Pty Ltd, XYZ Pty Ltd provides some guidance in the use of online social networking activities by employees. Responses to online social networking activities that refer to the business of XYZ Pty Ltd are made on a case by case basis as XYZ Pty Ltd becomes aware of them.

47. Acceptable online social networking activities Possibilities Could ban all mentions by employees Could ask for pre-approval of a comment Could allow employees to publish, but have marketing manager subscribe to RSS feeds and have employees agree to make changes if requested Only have authorised representatives respond online Could block online social networking websites in work hours (but please be realistic)

48. Staff training and awareness program Possibilities Content Awareness of acceptable online social networking activities Core principles in ensuring the privacy of personal information in an online environment Specific training on the use of major identified online social networking websites to ensure privacy. Practical advice in the use and etiquette of online social networking tools, including the use of email Make your requirements part of induction program, perhaps with an exam Require existing staff to attend annually, and perhaps pass an exam

49. Online reputation monitoring Possibilities Engage online reputation monitoring service provider At least set up Google Alerts! Document risky mentions in monthly, quarterly, or annual online social networking references report Subscribe to likely private online forums Ensure that applicants for positions are aware that the candidate’s online profile may be examined in the course of assessing the candidate’s suitability for the position.

50. Responding Possibilities May need to have lawyers involved For an employee, the HR manager would deal with it Core principles: Demonstrate an interest and respond online to address a grievance, and be transparent about it Never post an immediate, negative, response to an online reference. Have a conversation in person at a senior level Legal action considered Making no response may be the least harmful All responses conducted professionally and honestly Monitor and document responses in social networking references report

51. Conclusion

52. Conclusion Review the expectations wall How did we go? Obtaining a copy of the presentation See www.michealaxelsen.com for a copy of this presentation Main Message Set up Google Alerts! (www.google.com/alerts) Set privacy options in Facebook/MySpace! Use three email addresses, and no private email at work! Know what your customers say about you at the virtual water-cooler! Applied Insight Pty Ltd Services Guide to the Development of Online Social Networking Policies & Procedures Social networking training for staff Social networking review for your business Social networking policies & procedures

53. About the speaker Services Micheal Axelsen provides business systems consulting services – that is, how can IT be made to work for your business? Position and qualifications Director of Applied Insight Pty Ltd Member of ISACA Qualifications Bachelor of Commerce (Hons) Masters of Information Systems FCPA Currently undertaking PhD in the impact of technology use upon professional skills.

54. Contact details Micheal AxelsenDirector, Applied Insight Pty Ltd m: 0412 526 375t: +61 7 3139 0325e: micheal.axelsen@appliedinsight.com.au blog: www.michealaxelsen.com Applied Insight Pty LtdPO Box 603Toowong DC 4066AUSTRALIA

55. References AS/NZS 4360:2004 Risk Management Boyd, D., and Ellison, N. "Social Network Sites: Definition, History, and Scholarship," Journal of Computer-Mediated Communication (13:1), March 2007, pp 210-230. Brandenburg, C. ‘The Newest Way to Screen Job Applicants: A Social Networker's Nightmare’. Federal Communications Law Journal. Los Angeles: Jun 2008. Vol. 60, Iss. 3; p. 597 (30 pages). Emerald Insights. ‘MySpace or yours? Advertising and social networks’. Strategic Direction. Bradford. 2008. Vol. 24, Iss. 8; p. 15 Engdahl, S (Editor). “Online social networking”. Greenhaven Press. Farmington Hills, MI, USA. c2007.

56. References Espejo, R (Editor). ‘Should social networking web sites be banned?’. Greenhaven Press. Detroit, MI, USA. 2008. Johnson, R A, and Middleton, J M. ‘Accounting for Second Life’. Journal of Accountancy. New York: Jun 2008. Vol. 205, Iss. 6; p. 54 (5 pages) Lavenda, D. ‘Does 'blogging' have a place in the workplace?’. The British Journal of Administrative Management. Orpington: Jul 2008. p. 27 (3 pages) Mac Sithigh, D. ‘The mass age of internet law’. Information & Communications Technology Law. Abingdon: Jun 2008. Vol. 17, Iss. 2; pg. 79 McCallum, R. “Employer Controls over Private Life”. New South Wales University Press Ltd. Sydney, NSW, Australia. 1999.

57. References Stewart, A. ‘Drafting and enforcing post-employment restraints’. Australian Journal of Labour Law. Vol 10 pp181-221. 1997. Willard, N E. ‘Cyber-safe kids, cyber-savvy teens : helping young people learn to use the Internet safely and responsibly. Jossey-Bass. San Francisco , CA, USA. 2007.

58. Appendix:OSN Risk Examples

59. Scenarios Productivity Losses Employees use social networking websites during work time to the detriment of business performance. Legal risks As no policy explicitly states that email use is monitored by the employer, the employee brings an action for wrongful dismissal when dismissed for posting inappropriate content to an email forum. As no policy explicitly states that web use is actively monitored, it is difficult for a business to further investigate an employee who is suspected of posting details of an upcoming marketing program and product price list onto Wikipedia.

60. Scenarios A junior financial planner with an accounting firm provides taxation advice in a public forum using the firm’s email address and with a signature including the firm’s name. The advice is posted publicly, is relied upon by some readers who suffer a loss and subsequently bring an action against the accounting firm. Reputation Risk A customer writes a blog post or video that is negative towards your product, service or staff. An employee writes a blog post or posts a video that is negative towards the company’s product, service or staff.

61. Scenarios An employee writes a blog post or status update that places company secrets in the public domain using the business’s equipment. An employee posts lewd photographs online in a public forum. A friend of an employee posts lewd material on the employee’s public website or social networking page. Photographs of office functions depicting inappropriate behaviour are posted online by staff. Photographs of office functions depicting inappropriate behaviour are posted online by staff employed by the venue.

62. Scenarios An employee writes a blog post or posts a video that is derogatory to his or her colleagues or the firm’s customers. An ex-employee writes a blog post or posts a video that is derogatory to his or her colleagues or the firm’s customers. A supplier writes a blog post that is derogatory about the company’s ability to pay its suppliers. Viruses & spyware A staff member’s computer infects all networked computers with a virus that was launched from a website that advertised on MySpace.

63. Scenarios The accountant’s username and password for the business’s online banking is stolen by a Trojan key-logging program that was downloaded to the accountant’s laptop from an advertisement on a niche social networking website while her teenaged son was using the computer at home. Privacy breaches/identity theft Using an edited copy of a signed letter and a business-card posted on Flickr, a fraudster creates a fake letter of employment as supporting documentation for a bank loan in an employee’s name that is subsequently defaulted upon and causes personal bankruptcy for the employee.

64. Scenarios The employee subsequently brings an action against the business for not taking reasonable precautions to prevent this from happening. Although the resulting court case is unsuccessful, it is a serious distraction and expense for the business. An employee posts a photograph of a colleague and her children on her blog at the annual Christmas function. The colleague’s estranged husband is able to identify the children’s school from the uniform they are wearing, and subsequently collects the children from the school. The children are never seen again.

65. Scenarios Social engineering Using names, email address, and positions gleaned from Facebook, position titles and references from LinkedIn, and faked letterhead or invoices from a site such as Flickr or Photobucket, a conman is able to extract payment for non-existent products or services. Using photos from Flickr of a business card and letterhead, and information gleaned from Facebook, a fraudster poses as a contract cleaner who then uses an unattended and logged-in computer to steal clients’ taxation information on a 4gb USB memory stick.

66. Scenarios Inadvertent release of information The company’s proprietary approach to the bidding process for government work is submitted to Wikipedia by the business development assistant and is not able to be withdrawn in time.