I’ve been remiss in posting on the recent stories about potential employers requesting social networking login information in job interviews, but I see that noted cybercrime expert Orin Kerr, a law professor at George Washington University, was on C-SPAN’s Washington Journal this morning, and his comments in the first few minutes of this recording basically sum up what I had to say on this issue: it’s unclear, but such activity may be prohibited by federal law. I just have one additional point to add: although the specific policy result here may seem obvious, the larger question of when use of a dodgily-obtained password violates unauthorized access statutes is actually a much more difficult one.

The civil case Orin refers to in the recording is Pietrylo v. Hillstone Restaurant Group, No. 06-5754 (FSH), 2009 WL 3128420, 2009 U.S. Dist. LEXIS 88702 (D.N.J. Sept. 25, 2009). In Pietrylo, the District of New Jersey upheld a jury verdict against the defendant employer under the Stored Communications Act, 18 U.S.C. § 2701, which prohibits any person from “intentionally access[ing] without authorization a facility through which an electronic communication service is provided . . . and thereby obtain[ing], alter[ing], or prevent[ing] authorized access to a wire or electronic communication while it is in electronic storage in such system.” Pietrylo and other employees participated in a private chat group on MySpace in which they were critical of Hillstone management. One of the managers requested that one of the participants give him her password, which she did, on the reasonable supposition that she “felt that [she] probably would have gotten in trouble” if she refused.