ACLU tells VSP to stop shoulder surfing

RICHMOND, Va. (WAVY) - There's a growing trend of employers asking potential employees for their Facebook and Twitter passwords, and it appears the Virginia State Police is among them.

Tuesday, the American Civil Liberties Union of Virginia (ACLU) warned the Virginia State Police that this practice may be violating federal law as well as the U.S. Constitution.

The practice of forcing job applicants to reveal their private communications to employers is known as "shoulder surfing."

In Maryland, the Department of Corrections reportedly revised its shoulder surfing policies after an ACLU complaint.

ACLU of Virginia Legal Director Rebecca Glenberg faxed a letter to Virginia State Police Superintendent W. Steven Flaherty Tuesday asking that he discontinue the practice.

Glenberg's letter stated, in part:

Absent a concrete reason to believe that a potential employee is engaged in wrongdoing of which his Facebook account is likely to contain evidence, these communications are simply none of the VSP's business. Looking at this information is akin to opening an applicant's mail or listening in on his telephone calls. Such eavesdropping intrudes on the privacy of not only the job applicant, but his online friends and correspondents.

According to the ACLU of Virginia, any employer who engages in shoulder surfing may be violating the Stored Communications Act , a federal law that makes it illegal to intentionally access stored electronic communications without valid authorization.

In reply to the question of whether or not it is legal for a company to not hire because someone refuses to hand over this information, Norfolk Attorney Lisa Bertini of  Bertini O'Donnell & Hammer, PC, told WAVY.com, "It is potentially a violation of a general privacy right. There is nothing I can think of right now in Virginia that would protect an applicant if they say no and then they don't get the job."

United States Senators Richard Blumenthal and Chuck Schumer have vowed to close the loopholes in laws that could allow companies to ask for your passwords.

"The good news is it may be illegal already. We do have privacy laws, but they're not updated to deal with modern technologies like Facebook," explained Senator Schumer, (D-New York).

Facebook's terms of rights and responsibilities forbids users from sharing their passwords. A company spokesperson said you should never have to let anyone access your account, or do anything that might jeopardize the security of your account, or violate the privacy of your friends