1 Social Media: The Business Benefits May Be Enormous, But Can the Risks -- Reputational, Legal, Operational -- Be Mitigated? Toby Merrill, Vice President, ACE Professional Risk Kenneth Latham, Vice President, ACE USA Professional Risk Richard Santalesa, Esq., Senior Counsel, InfoLawGroup LLP David Navetta, Esq., CIPP, Partner, InfoLawGroup LLP
2 focus on: Social Media: The Business Benefits May Be Enormous, Toby Merrill, Kenneth Latham, Richard Santalesa, David Navetta April 2011 Part I: Overview What Is Social Media and Why Should Your Company Care? In less than a decade, social media, in many ways, seems to have taken over the world. This statement is not hyperbole. As one of the largest social networking sites in the social media universe, Facebook boasted more than 750 million people actively using its service. 1 If it hasn t already, Facebook will soon grow twice as large as the population of the United States, which currently hovers at 311 million. 2 Even so, the vast majority of companies did not immediately join the social media revolution. Instead, they spent varying amounts of time observing from the sidelines. But when the first wave of companies did join, it was because they anticipated the significant business benefits of this brave new world -- where the personal, the professional, and the commercial combine seamlessly, and in the blink of an eye. Many others, however, remained unconvinced -- often because of a lack of information and an unclear understanding of how social media could be beneficial. What is this social media thing all about? they wanted to know. And why should my company care? Unlike traditional media, which offers a one-way experience (in which media outlets broadcast information for public consumption), social media offers a two-way interactive experience. Consumers of social media, unlike consumers of traditional media, can interact instantly and directly with either the originators or the authors of the proffered information. They can interact with each other, too. The interaction and cross-communication that social media makes possible is precisely what makes social media so world-changing. As with any new technology, there is a downside. Social media also creates a whole new world of privacy, security, intellectual property, employment practices, and other legal risks, to name just a few (in Part III of this paper, we will review each risk). But the opportunity to interact with anyone, anywhere, anytime is too world-changing to ignore. It has altered the traditional media expectation of consumers listening passively to radio and television broadcasts, or reading newspapers and magazines, with no hope of an immediate interaction (and no way, certainly, for customers to converse with companies). With social media, all that changed. Individuals and groups suddenly have a radical new ability to voice opinions through this new media, a channel never before available. Using social media, everyone can become a commenter, editor, content creator, producer, and distributor. Not only that, but the entire world has become accessible in ways that are disorienting for traditional media and those accustomed to its cultural hierarchy. Consider the popular social networking site, Twitter. This platform allows anyone with an account to post short messages. To tailor the onslaught of messages being broadcast from the Twitter-sphere of 200 million current Twitter subscribers, users can create lists of those they wish to follow so they only receive Twitter feeds from those they select. 3 With Twitter, anyone can send a short message of 140 characters -- called a tweet -- about any topic, including the famous and the infamous, the holy and the ethically challenged. Anyone, for instance, can tweet about President Barack Obama and Lady Gaga, or the Dalai Lama and -- well, you get the idea. Twitter is just one of the components in a social media portfolio. England s Queen Elizabeth II, already with a Twitter account, added a Facebook page last year to complement her YouTube channel, Flickr account, and website. 1.
3 Social Media: The Business Benefits May Be Enormous, Perhaps most surprising, social media has been an enabler of grassroots revolution in countries where such an event seemed impossible. As a case in point, look at the impact of social media on the governments of Colombia, Egypt, Indonesia, Iran, Libya and Tunisia, to name but a handful. In summing up this trend, author David Kirkpatrick in his book, The Facebook Effect, observed that the large scale broadcast of information was formerly the province of electronic media -- radio and television. But the Facebook Effect -- in cases like Colombia or Iran -- means ordinary individuals are initiating the broadcast. You don t have to know anything special or have any particular skills. 4 The social media universe encompasses a much broader array of interactions than those that occur on popular and familiar social networking sites like Twitter and Facebook. Social media actually refers to a growing galaxy of sites that includes: personal and business blogs, news sites with interactive or comment features, group forums, wikis, social and business networking sites, online community sites, social bookmarking sites, microblogging sites, and gaming as well as virtual world sites. (See the Glossary of Social Media Terms on page 10 for brief definitions of these and related terms that appear in this paper.) Social media embraces a cyber-universe of websites that promise to expand -- virtually -- forever. (One example: according to WhiteboardAdvisors.com, by the end of 2010, there were 152 million blogs 5 on the Internet.) In short, like earlier methods of communication that seemed new and a little strange when they first appeared, social media, writes Facebook Effect author Kirkpatrick,...is a new form of communication, just as was instant messaging, , the telephone, and the telegraph. 6 Part II: How Can Social Media Benefit Business? The exponential growth of social media, from blogs, Facebook and Twitter to LinkedIn and YouTube, offers organizations the chance to join a conversation with millions of customers around the globe every day. 7 Harvard Business Review, The New Conversation: Taking Social Media from Talk to Action The key word in the quote above is conversation, since attracting customers by creating a social network is entirely different than broadcasting ads, or employing marketing strategies to convert targeted groups of consumers into customers. Creating online conversations also requires a whole new approach and skill set. Social media embraces a cyber-universe of websites that promise to expand - virtually - forever. Social networking sites encourage businesses to change their traditional marketing strategies and focus on talking with -- not at -- prospects and clients, with the goal of developing and deepening the relationship between the company and customer. But what s the business benefit of that deepened relationship? When prospects grow to know, like, and trust a company, through interacting with their representatives on social networking sites, they are much more likely to do business with that company. It is well-established that people feel more connected with a company when they have direct communication on an ongoing basis and opportunities to express their opinions, commented Lisa Brown, in an article about the use of social media risks in business. 8 Indeed, social networking conversations create a level of immediacy and a kind of public intimacy that is impossible with traditional marketing. And since most large or medium-size companies are perceived by the public as relatively faceless, social networking gives companies the opportunity to present a human face in the form of a social media spokesperson -- an individual who can nurture person-to-person conversations which builds trust in the company s authenticity as well as its professionalism. But there is something else that social networking sites offer a business that no other form of public interface does: the ability to monitor public perception of its brand, products, and services in real time. As an accompanying result, companies also have the opportunity as well as the responsibility 2.
4 Social Media: The Business Benefits May Be Enormous, to provide a quick and effective response, if a negative perception goes viral through social media s worldwide interconnected platforms. Reputation monitoring and repair aside, there are multiple strategies companies can use with social networking sites. As cited in The Harvard Business Review, a large U.S. construction materials company employs a variety of social networking platforms in order to accomplish a handful of business-supporting aims. According to the report, the company uses Twitter to get news in front of reporters; LinkedIn is where company salespeople post scholarly articles to share with each other and their customers; their Facebook page focuses on the company s social responsibility efforts, while the company blog is more of an exchange with customers. 9 The opportunity to interact with anyone, anywhere, anytime is too world-changing to ignore. It has altered the traditional media expectation of consumers listening passively to radio and television broadcasts, or reading newspapers and magazines, with no hope of an immediate interaction. With Social Media, all that changed. As comprehensive as that may sound, it is in reality just one aspect of how a business can harness the power of social media. Several additional popular strategies companies employ include 10 : Branded Fan Pages on Social Networking Sites (to establish a social media presence on Facebook, Twitter, YouTube, and Flickr) Quick Online Response to Rumors and Negative Perceptions (social media is ideal for countering negative viral news about a company) Information Disclosure -- Public Broadcast (social media is an effective way to reach large numbers of people, whether they are actual or potential customers, shareholders, or investors; the U.S. Securities and Exchange Commission (SEC) has been moving in this direction for disclosure of required and public information disclosures) Employment Practices (human resources departments increasingly make use of social media -- particularly LinkedIn and Facebook -- to gather information when making hiring and promotion decisions) Customer Service and Feedback (companies set up blogs to communicate product development information and gather comments from consumers; companies also use Twitter for customer service and feedback: for instance, Best Buy s Twelpforce Twitter account 11 ) Promotions and Contests (encourage site members to engage with a company s products or services) User-Generated Content Promotions (companies also engage customers on social media platforms by encouraging them, with prize incentives, to write about why they like a particular product; caution must be used with such promotions, however, as Federal Trade Commission (FTC) guidelines regarding paid endorsements can lead to legal liability without full public disclosure) Word-of-Mouth Marketing via Blogs (companies provide their products to popular bloggers with big reader audiences, hoping for a favorable review; but a number of risks have developed in this area, including FTC disclosure requirements, as in the strategy above) These diverse forms of social networking may cover a lot of business bases. But how do they translate into business benefits? For the most part, the business benefit of social media is indirect, in much the same fashion that public relations is, although some companies can point to a measurable relationship between their social networking efforts and sales. If we look at the social networking strategies of a national chain of coffee shops (a well-known chain with 5.4 million fans on Facebook, 4,800 subscribers to the company s YouTube channel, 4,880 members on Flickr with 15,900 photos, and more than 700,000 followers on Twitter) 12, we see that their overall business benefit comes in the form of customer identification with the company and its products. Identification is critical: from it grows online interaction, and from online interaction grows customer loyalty. Being able to claim more than five million loyal customers is a bankable social media benefit. 3.
5 PART III: What Are the Reputational, Legal and Operational Risks of Social Media Participation? Social media has changed how people communicate and interact, how marketers sell products, how governments reach out to citizens, [how universities recruit students], even how companies operate. It is altering the character of political activism, and in some countries it is starting to affect the processes of democracy itself. 13 David Kirkpatrick, The Facebook Effect As mentioned earlier, social media makes a whole new world of privacy, security, intellectual property, employment practices, and other legal risks possible. It is important to understand the considerable downside that exists hand-in-hand with the remarkable upside of using social media for a variety of business aims, which can occur in three major areas of risk: reputational, legal, and operational. Reputational The reputational risks of social media can easily equal or exceed the reputational benefits, for one simple reason. The vast reach of social media platforms -- on which millions, globally, communicate every second of every day and night -- offer not only a vast frontier of promotional opportunity, but a vast uncharted sinkhole of risk. In April 2009, two employees of a national pizza delivery chain made a prank video in which one of them tainted a sandwich, ostensibly intended for delivery to customers. When they posted their video on YouTube, it drew over a million viewers. Because of that extreme degree of interest, word of the video trended on Twitter, and within 48 hours, consumer perception of the pizza chain had pivoted 180 degrees -- from positive to negative. The company attempted to perform damage control by quickly launching its own Twitter account to counter rumors and answer questions, while its CEO took to YouTube to personally address the public s concerns. By that time, however, any online search for the pizza chain s name turned up references to the prank video story on the first page of search results a true PR nightmare. But there are less dramatic and drastic ways that employees can harm a company s image. General bad behavior by employees, or the posting of embarrassing information, has the potential to reflect poorly on the company (especially when that behavior is exhibited in a branded social media location, for example on a company s Fan page on Facebook). According to the Miami Daily Business Review, Employees who disparage coworkers, management, clients, vendors or even the company itself, whether intentionally or not, can damage a company s reputation. 14 Ironically, as discussed below, employees who praise their company s products or services can unintentionally get their employer in hot water, too. Legal The legal risks associated with social media should be carefully considered prior to engaging in a social media strategy. The main risks include: employment, privacy, security, intellectual property and media risks. Business managers who want to implement a social media legal strategy should consult with inside and outside counsel who understand information technology law. While these legal risks can be significant, with forethought and planning, they can be managed. In this part of the paper, we will provide an overview of the key risks. The following are some common situations in which social media can be the occasion for legal action: Employment Risks: The practice of investigating potential and existing employees through social media is widespread. According to The Allentown Morning Call, Seventy percent of recruiters and hiring managers in the United States have rejected an applicant based on information they found online. In total, nearly one in five companies has disciplined or fired an employee for social media misdeeds. 15 Employers who hire outside vendors to investigate either an applicant s or an employee s social media activities and content may be required by law to get written consent from those individuals. The information collected from a social media site may constitute a consumer report under the Fair Credit Reporting Act (FCRA). If so, the employer seeking to acquire such information must, in some cases, obtain an individual s consent before the employer may acquire the consumer report (e.g., credit report) regarding that individual. In addition, the FCRA would require employers to provide information to individuals as to how they may dispute the accuracy of the report with the company that furnished the report. This requirement, however, applies only when the employer takes an adverse action based on the report (such as not hiring or promoting the person in question). In addition, a number of states, including Illinois, Oregon, Hawaii, and Washington prohibit employers (with certain exceptions) from using consumer reports in the hiring and promotion processes
6 Impermissible discrimination in hiring based on social media research can subject a company to investigation by the EEOC, as well as possible action for alleged violations of the Civil Rights Act of 1964, the Age Discrimination in Employment Act, the Americans with Disabilities Act, and many other federal and state statutes. 17 Companies whose employees participate in conversations on social media platforms while using company computers may want to monitor their employees social media communications. Such monitoring is not without its legal dangers, though, as an employer may then be subject to liability under the Stored Communications Act (part of the larger Electronic Communications Privacy Act), if an employer accesses the content of non-public communications not stored on the company s own server. In addition, if employees and/or managers engage in unprofessional exchanges online, that can lead to harassment claims against the company. Social media legal risks may also be present if an employer decides to fire employees based on their Facebook interactions with other employees in the organization. In one incident, where an employee was fired for negative comments about her supervisor posted on a Facebook page shared with other employees, the National Labor Relations Board (NRLB) said that employer s action violated the National Labor Relations Act (NLRA). In the NRLB s view, the firing interfered with employee rights under the NLRA stipulation relating to union organizing -- which allows employees to discuss wages, hours, and working conditions with co-workers and others, while not at work. 18 In another case, an employee alleged that a company s social media policy restrictions on employee communications about the company (on such sites) was a violation of the NLRA. 19 The first case settled and the second complaint was resolved for an undisclosed amount, along with an agreement to revise the company s social media rules. Security Risks: Social media sites pose potentially increased security risks, and if a security breach arises from social media activities, the organization may face liability. Security breaches may occur because of malware downloaded onto an organization s website through the use of social media. This can happen when an employee misdeeds. downloads an application, or is a victim of phishing or click-jacking 20 on a social media site while using a company computer. If the organization s social media-related security policies, procedures, and technical safeguards are inadequate, it may be held liable for a breach arising from the surreptitiously acquired malware. In addition, social engineering within social media sites, as well as spoofed social media profiles or pages, provide other points of entry for attackers and pose more legal risks for organizations. A spoofed site is one where criminals have set up profiles or fan pages to look exactly like an organization s own page. If a customer or employee is tricked into providing company information, personal information, or sensitive information (such as usernames and passwords), it could pose legal liability risks to the organization whose profile or fan page was spoofed, or replicated in a fake version. Nearly one in five companies has disciplined or fired an employee for social media Intellectual Property and Media Risks: PR News warns, Make sure your social media team understands what they can and can t do with the intellectual property of others. If your employees post or re-post information [belonging to others] without permission, this can lead to infringement claims against your company. 21 It could also result in potential contractual breach claims, if the intellectual property belongs to an existing client. Companies may be held directly liable for hosting material on their website in circumstances where the safe harbor protections of the Digital Millennium Copyright Act may be unavailable -- or vicariously liable for employee actions on third-party sites that infringe the copyright, trademark, or other intellectual property rights of others. 5.
8 Social Media: The Business Benefits May Be Enormous,. According to the anti-virus software company, McAfee, More than six out of 10 organizations have already suffered losses averaging $2 million, for a collective loss of more than $1.1 billion in security related incidents last year . 24 As a result, in McAfee s survey of more than 1,000 global business decision-makers in seventeen countries, half of those surveyed were concerned about the security of Web 2.0 applications such as social media, micro blogging [like Twitter], collaborative platforms, web mail, and content sharing tools. 25 Finally, when non-executive (non-exempt) employees communicate during off-hours about work-related issues with supervisors -- either through or social networking sites -- that activity can open a company to the so-called wage and hour disputes that have recently grown more common. Because non-exempt employees are paid to work certain hours, and their virtual work time is not counted nor compensated, it remains unsettled as to whether and how they should be compensated for that additional work. When employees access social media platforms at work - even those employees who are designated as social media spokespersons for the organization - they risk endangering the organization s networked computers by unknowingly acquiring malware, viruses, and spyware. Social networking sites, particularly Facebook and Twitter, are a favorite playground for those with bad intentions. PART IV: How Can Organizations Mitigate the Social Media Risks They Inevitably Face? Odd though it may seem, companies that don t actively participate in social media -- to promote their business and build brand awareness -- still need to address the reputational, legal, and operational risks that social media can pose. Why? It s extremely likely that their employees are using social media tools, either at home or during business hours at work, regardless of whether it s employee- or company-owned equipment. In doing so, such employees may unwittingly put their employer at risk. Even non-participating companies as a result, need to be proactive in creating social media guidelines or policies for their employees. Five Basic Steps for Addressing Your Company s Social Media Risks: 1. Conduct a broad assessment of its general social media activities, looking for potential risks. Beyond that general assessment, whenever a social media campaign is contemplated, the organization needs to assess the particular risks of that campaign. Not only should the organization s contemplated campaign align with the culture of the organization and its current marketing strategy, but the risks should be weighed against the benefits -- with both being articulated as clearly as possible. 2. Identify the key players who will be responsible for developing, executing, and monitoring its social media strategy. An active strategy will require a great deal of time and resources so it s important to decide which departments will foot the bill for staffing, technology, and other expenses. Also, identify a senior executive or employee with the political wherewithal that can make decisions very quickly and make time-sensitive decisions as necessary. 3. Draft a simple but comprehensive social media policy or set of guidelines tuned to the company, its customers, and its industry (even if a company decides to grant official social media access solely to designated spokespersons, separate guidelines are still needed for employees using social media when they re not at work.) This social media policy should be reviewed by the organization s human resources, legal, information technology, and communications departments. Also recommended is a review by an independent law firm. 4. Formally address the risks of social media participation with company employees. Since employees actually pose the biggest risk to a company -- albeit, usually without meaning to it is essential to provide regular educational training programs regarding the dangers of damaging the company (reputationally, legally, or operationally) by using social media on the job, or on their own time. 5. Create a social media agreement that employees review and sign annually (as a condition of continued employment, and as part of their employment contract). Such an agreement should be updated annually -- or more often, as warranted -- to address changes in social media that may impact business in new ways. Regardless of whether an organization decides to implement an active social media strategy -- or not -- it must clearly outline how employees are allowed to access social media sites (if they are allowed) and under what guidelines. 7.
9 Here are a few approaches companies have taken: 1.) No Employee Has Access at Work: When the company policy is that no employee will have access at work, it is important that training, guidelines, and agreements educate employees about the reason for the no-access policy, while at the same time outlining the company s at-home social media use concerns, and what is required of employees as a result. 2.) Designated Individuals Have Access for Work: When designated individuals within the company have been granted social media access for work usually for formally approved functions and under specific business guidelines -- more formal education should be provided (similar to training for employees expected to act as media spokespersons for the company). This may also require that all content posted on behalf of the company be cleared through the organization s legal and communications departments. 3.) Employees Only Have Access to Specific Sites: When employees are allowed to access LinkedIn, for instance, in order to further the company s business aims, but are prohibited from accessing other sites -- like Facebook and Twitter -- social media education and training are crucial. Employees also need to know what they can and cannot do on the allowed site, as well as what the penalties are for migrating to prohibited sites. 4.) All Employees Have Total Access at Work: When all employees have total at-work social media access, the same issues need to be clarified and employees need to know when and how long they will be permitted to use social media at work. They need to be instructed on the comments and content they provide as a representative of their employer. They also need to know that their compliance with the company s written social media policy will be monitored and enforced. Formal education and regular confirmation and acknowledgment of the social media policy is critical to success in this regard. Here are a few areas that social media education for employees as well as managers should address, in order to mitigate reputational, legal, and operational risks: When employees post on their personal blogs, or elsewhere online, they must provide a suitable disclaimer that their opinion on a particular subject does not reflect the views of their employer. When communicating a positive opinion about the company or its products, employees must disclose that they are employees; if they post anonymously, the FTC could launch an investigation against the company, generally in response to a complaint. When responding to questions and comments about the company or its products on social media platforms, employees must not post in a way that would lead others to reasonably believe they are doing so on behalf of the company (unless as a designated spokesperson in which case all content should be cleared by the company s legal department). Employees should assume that anything they post online is public information, even if their profile page is only open to their Facebook friends. In any case, they should refrain from posting anything online that is derogatory about the company, its products, clients, co-workers, or managers. In the same vein, they would be wise to refrain from the use of profanity, posting compromising photographs, and so forth. (Unfortunately, others may post compromising pictures of them without their knowledge, so it is wise to avoid allowing such photographs to be taken, or to request removal when they are.) Employees should be particularly careful about sharing company information through social media; the wise choice is to simply not do it. Even if the information is not a trade secret, it s best to avoid sharing even trivial facts that are not otherwise expressly and publicly available, unless that employee is the designated social media spokesperson (who has detailed guidelines pertaining to that job and will have reviewed such content with the legal department). Employees should be equally careful about protecting the information and privacy of the company s clients and customers (as well as its co-workers and managers). When using social media, employees should carefully avoid a violation of the laws pertaining to human rights (including harassment), defamation, copyright or other intellectual property rights, securities, financial disclosure, and privacy rights. 8.
10 Social Media: The Business Benefits May Be Enormous, Employees should be informed that the company s social media policy also applies to their use of social media when not at work. Managers should be trained on the proper usage of social media sites for content posted by their employees. Monitoring of content and any actions responding to employee posts should be reviewed by human resources beforehand. Employees should maintain a professional tone, refraining from heated arguments when using social media, whether at work or at home. Every company creates its own unique corporate culture, so the steps a company takes to remove social media risks will reflect that unique culture. One professional organization s strategy included hosting a social media orientation for staff, providing an online social media center to keep their staff informed of the social media guidelines, and creating a social media team with representatives from various parts of the organization. Their communications team included a dedicated director of social media, who said of the organization s activities, It s more about guiding, as opposed to controlling. 26 In a more open and transparent world, people will be held to the consequences of their actions and be more likely to behave responsibly. 27 PART V: Guidelines for Companies Wishing to Avoid Legal Action Apart from offering social media guidelines for employees, companies should also follow certain practices to ensure their corporate safety on line: 28 Engage the Proper Legal Team Early in the Process: In developing a social media strategy, companies should involve lawyers who understand information technology law, since they can help prevent all the legal pitfalls described above. If lawyers are included early in the planning stage, processes and policies can be developed that are effective for business, while at the same time reflecting the level of risk that the organization is comfortable with. If, however, lawyers are consulted after social media plans have been completed, they may either need to be scrapped or extensively redesigned. Identify the Laws and Legal Risks That May Apply: Communication and understanding is crucial to developing a social media strategy that will not pose undue risk to the organization. Lawyers need key information about the organization s social media activities, including the social media platforms that will be leveraged, the kinds of activities contemplated, the type of information that will be collected, used, and published, and the individuals who will participate on each social media site. With this information, the legal team should determine what legal risks may exist, including applicable regulations, contractual obligations, and common law risks. This analysis will help the organization understand its risk, so it can perform an appropriate cost-benefit analysis concerning its social media activities, and then design mechanisms to mitigate that risk to an acceptable level. Comply with Third-Party Sites Guidelines: Carefully review the terms of service and the privacy policies for each social media site you have a presence on, and be sure you are in compliance with those social media outlets. Site Monitoring: Social media sites may attract postings that infringe upon your company s intellectual property rights, are defamatory, are damaging to your or another company s reputation, or contain confidential or proprietary information. It s important, therefore, to actively monitor social media sites for offensive or infringing posts (via an employee assigned to this task, or through an outside firm). Create a Response Team: Handling damaging statements or content may require a team of people drawn from senior management, legal, corporate communications/public relations, marketing, and human resources. Appropriate action by the response team will depend upon the actual incident and its severity. But it could include: requesting that a post on a third-party site be removed; removing an offensive post on the company s own site; replying to misleading posts with the correct information; responding via other social media outlets; responding with a press release; taking legal action; or any combination of the above actions. 9.
11 PART VI: Making Social Media Work for Your Company The business benefits of social media participation can be substantial, while the cost of non-participation, or opting out, may mean anything from losing business to losing touch with your customers and important trends in your industry. Of course, as we ve outlined in this paper, there is also much to lose if your company does not respond proactively to the many risks posed by social media. To conclude, ensuring your company s social media safety is a matter of taking the following steps: Analyze your company s unique social media safety needs, create detailed social media guidelines, and educate your employees about safeguarding your company when using social networking sites at work and at home. Monitor the social media landscape, including your company s own sites as well as its third-party pages, for content that is negative, damaging, or that potentially infringes on intellectual property rights -- whether your own, or that of your competitors. Be sure that you have adequate insurance coverage for your company s social media activities, and review the coverage parameters and amounts regularly. (Commercial general liability may not cover online content, and your company will need coverage not only for your own website, but for content you ve placed anywhere on the Internet.) Once you ve taken these steps to mitigate the considerable reputational, legal, and operational risks, your company will be in the best possible position to reap the enormous business benefits of social media participation. A Glossary of Social Media Terms: Crowdsourcing: Wikipedia, the online encyclopedia (http://www.wikipedia.org), defines crowdsourcing as the act of outsourcing tasks, traditionally performed by an employee or contractor, to an undefined, large group of people or community (a crowd ), through an open call. Microblogging: The traditional blog (or web log journal) features posts by its owner/author that are typically between 400 and 1000 words long, while the typical microblog entry or posting is much shorter often less than 20 words. The most frequented microblog platforms are Twitter and Facebook s status updates feature, but there are more than 111 such sites worldwide, according to Wikipedia. Social Bookmarking: Social bookmarking sites (for example, Delicious, Digg, and Stumbleupon) allow Internet users to store, organize, and share links to web pages that are useful to them. These pages may relate to any number of user interests and are public -- so those who share the same interests can find these bookmarked sites as well. Social Engineering: Social engineering involves online manipulation in order to con unsuspecting people into revealing valuable information, or into performing an act that will allow fraudsters access to either computers or information. There are many types of social engineering scams, including phishing, pretexting, diversion theft, and baiting. Spoofed: This word refers to a victim of spoofing as someone who s been spoofed, or has fallen for the online scam of responding to a fake website as if it were the legitimate site it resembles. The spoof site is used to extract valuable information from visitors, such as passwords and user IDs. There are other forms of spoofing as well. Spyware: This is a type of covertly installed software (a form of malware) that typically infects home computers without the owner s knowledge, in order to surreptitiously gather information such as browsing habits. Spyware may also be used to change certain computer settings without the permission of the owner. Tweet: A short, 140-character message delivered on the microblogging platform, Twitter, by those who have set up a free account on the site. Twitter: The most famous microblogging site on the Internet, where people can tweet about the things that interest them, as well as retweet or tweet again the tweets of others. See: Wiki: This Hawaiian word for fast has come to mean a collaborative website that enables the creation of content by any number of interested people in an open environment. Examples are: Wikipedia, company intranets, and community sites. 10.
12 About the Authors: Toby Merrill is Vice President of ACE Professional Risk, where he serves as the national product manager of ACE s network security, privacy, technology and media liability products. With more than 14 years of insurance experience, he has worked with a number of Fortune 500 companies in reviewing crisis management plans, as well as seeing how well they actually work following a serious data breach. Prior to his tenure with ACE, Mr. Merrill was a Regional Professional Liability Specialist with Chubb Specialty Insurance.He began his career in the Information Technology department at Cozen & O Connor in Philadelphia. Mr. Merrill has authored numerous articles on network risk management, and frequently serves as a speaker at industry trade conferences on cyber risk and network security topics. He is a graduate of Franklin & Marshall College in Lancaster, Pa., where he received a Bachelor of Arts degree in Business Administration. Kenneth Latham is Vice President of ACE Professional Risk, and product manager for Employment Liability and Fiduciary Insurance. He is responsible for the underwriting and loss prevention activities within the group and has more than 15 years of management liability insurance experience. Ken is a graduate of Pace University. Richard Santalesa is Senior Counsel in Information Law Group's east coast office, based in Fairfield, Connecticut and New York City, where he represents clients on electronic commerce and internet issues, software and content licensing, privacy, data security, outsourcing, website development transactions and other commercial arrangements involving intellectual property and technologysavvy companies. With over 20 years of technology experience, Richard registered his first domain name in 1994 and has authored articles and columns for numerous publications. David Navetta is a Founding Partner of the Information Law Group. David focuses on technology, privacy, information security and intellectual property law. He is also a Certified Information Privacy Professional through the International Association of Privacy Professionals. David has enjoyed a wide variety of legal experiences, including work at a large international law firm, in-house experience at a multinational financial institution, and an entrepreneurial endeavor running his own law firm. David currently serves as a Co-Chair of the American Bar Association s Information Security Committee, and is Co-Chair of the PCI Legal Risk and Liability Working Group. The ACE Group is a global leader in insurance and reinsurance, serving a diverse group of clients. Headed by ACE Limited, a component of the S&P 500 stock index, the ACE Group conducts its business on a worldwide basis with operating subsidiaries in more than 50 countries. Additional information can be found at The opinions and positions expressed in this paper are the authors own and not necessarily of any ACE company or Information Law Group. References to insurance policy contracts are general in nature. Insurance contracts have specific terms conditions, and limitations that govern the rights and obligations of the parties and the scope of coverage in each case ACE Limited. All rights reserved. All trademarks and/or servicemarks contained herein are the property of their respective owners. 11.
13 ENDNOTES: b David Kirkpatrick, The Facebook Effect: The Inside Story of the Company That Is Connecting the World, Simon & Schuster, page David Kirkpatrick, The Facebook Effect: The Inside Story of the Company That Is Connecting the World, Simon & Schuster, page Report, The Harvard Business Review, The New Conversation: Taking Social Media from Talk to Action, page 1. 8 Lisa Brown, Social Media Are Coming of Age in the Business World: Companies Here and Nationally Are Beefing Up Their Networking Staffs, St. Louis Post-Dispatch, September 22, Report, The Harvard Business Review, The New Conversation: Taking Social Media from Talk to Action, page Social Media Risks and Rewards: A guide to the steps companies can take to minimize the risks associated with the revolution in the use of social media, Practical Law Publishing, PracticalLaw.com, February, 2010, page (Additional strategies that companies have employed include: (1) Group pages where social media users gather to discuss particular topics, products, services, and companies. Many organizations actively participate in these forums in order to influence issues important to them; (2) Social Plug-ins: These buttons allow for the instant republication of company content across multiple social media networks. The hope is that the company s content and message goes viral and is viewed by millions; (3) Applications and Login-Connect Interfaces: Some companies create specific applications that can be used on computers and mobile devices. These applications may provide users with access to products and services, as well as provide valuable consumer information to the organization. Login-connection applications allow users to use their login credentials from sites like Facebook to authenticate themselves on the organization s website. In the process, the organization gains access to the users social media information.) 11 Leverage the Power of Social Media, Don t Lament It, C. Mahalingam, Business Line, October 11, 2010, The Hindu Business Line. 12 Social Media Risks and Rewards: A guide to the steps companies can take to minimize the risks associated with the revolution in the use of social media, Practical Law Publishing, PracticalLaw.com, February, 2010, page David Kirkpatrick, The Facebook Effect: The Inside Story of the Company That Is Connecting the World, Simon & Schuster, page Overly Broad Social Media Policy Can Invite NLRB Scrutiny, Miami Daily Business Review, December 1, Common Sense Is a Rule When Using Social Media, The Allentown Morning Call, October 30, Prohibited Employment Policies/Practices, U.S. Equal Employment Opportunity Commission, available at: See: Graham Cluely, Japanese Tsunami RAW Tidal Wave Footage Bogus CNN Video Scams Facebook Users (Mar. 13, 2011), available at And see:graham Cluely, Lost All Respect for Emma Watson? Facebook Clickjacking Attack Spreads Virally (Mar. 1, 2011), available at 21 Social Media Guidelines: Command and Control or Let er Rip!, PR News, September 13, Facebook Promotion Guidelines are available at: 24 Facebook Promotion Guidelines are available at: : Security Incidents Cost Enterprises $1 Billion, press release, McAfee Inc., September 28, : Security Incidents Cost Enterprises $1 Billion, press release, McAfee Inc., September 28, Social Media Guidelines: Command and Control or Let er Rip!, PR News, September 13, David Kirkpatrick, The Facebook Effect: The Inside Story of the Company That Is Connecting the World, Simon & Schuster, page Social Media Risks and Rewards: A guide to the steps companies can take to minimize the risks associated with the revolution in the use of social media, Practical Law Publishing, PracticalLaw.com, February, 2010, page
Top Issues for Safeguarding Brand Reputation When Engaging In Social Media By: Alan L. Friel, Akash Sachdeva, Jesse Brody and Jatinder Bahra Social media has changed the way people communicate, and enabled
March 2, 2010 The New World of Social Media: Business and Legal Risks Call-In Details: United States/Canada: 1-800-214-0694 All other countries: 1-719-955-1425 Participant Passcode: 165381 www.marsh.com
MARKETING AND MEDIA RELATIONS Social Media Guidelines Emporia State University Last Updated: July 09, 2011 Introduction What is Social Media? Social media consists of web-based tools used to interact with
ACCEPTABLE USE POLICY F. Paul Greene Harter Secrest & Emery LLP 1600 Bausch & Lomb Place Rochester, NY 14604 585-231-1435 email@example.com 2016 HARTER SECREST & EMERY LLP THE FOLLOWING TEMPLATE WAS DESIGNED
Policy Statement It is the policy of the to encourage clear and effective communication with all Nova Scotians using a variety of accepted tools, including social media. Social media is helping government
Social Media And the Workplace Scott Patterson Labor and Employment Attorney Butzel Long POTENTIAL ISSUES Employee productivity Harassment and discrimination Too much information Legal issues POTENTIAL
State of North Carolina Department of Public Safety POLICY REQUIREMENTS & PROCEDURES Division: Chapter: Policy: ADMINISTRATION COMMUNICATIONS SOCIAL MEDIA ADMINISTRATION Issue Date: August 13, 2013 Revised:
Insurance Buyers News Property & Liability 300 Montgomery Street Suite 450 San Francisco, CA 94104 415-820-2200 www.pennbrookinsurance.com Insurance Buyers News March/April 2012 Volume 23 Number 2 Data
Iowa County Government Social Media Use Policy This policy outlines appropriate use of social media, as it relates to Iowa County, by employees and departments for official and personal use. This policy
Social Media in the Workplace: Avoiding Legal Pitfalls Todd F. Palmer & Timothy J. Connors Calfee, Halter & Griswold LLP February 13, 2013 Social Media: The Basics Social Media: The Basics Social Media:
Social Media the Legal Risks Chris Holme Partner at Clyde & Co LLP Your source for professional liability education and networking. What are social media? web-based and mobile technologies that turn communication
MARKETING AND ADVERTISING THROUGH SOCIAL MEDIA Ann H. Chen, Wm. Wrigley Jr. Company Gonzalo E. Mon, Kelley Drye & Warren LLP Sylvie G. Motz, Practical Law Company, Inc. Overview Endorsements Promotions
UW SCHOOL OF NURSING Seattle Campus SOCIAL NETWORKING POLICY AND GUIDELINES Adopted: September 26, 2011 BACKGROUND Social networking sites can be an effective way to keep in touch with colleagues; in medical
Introduction Throughout this Policy, the words Translink Company and/or the Group refer to all corporate entities under the ownership of the Northern Ireland Transport Holding Company (NITHC). This includes
Social Media: Risks and Rewards Nilesh (Neal) Patel Member Frost Brown Todd LLC 3300 Great American Tower Cincinnati, OH 45202 513.369.4805 firstname.lastname@example.org Linkedin.com/in/nealpatel1/ 2013 Frost Brown
SOCIAL MEDIA POLICY Presented by: Jaffe PR 727 Kirkwood Avenue - Atlanta, GA - 30316 404.885.9100 - www.theremsengroup.com Presented By Jaffe PR Revised January 1, 2012 SOCIAL MEDIA POLICY 1 NOTE: At Jaffe
Guidelines for University Communications and Marketing Professionals These guidelines were created by Penn State's Division of University Relations. For more information, contact Lisa M. Powers, director,
CLAYTON STATE UNIVERSITY DEPARTMENT OF PUBLIC SAFETY SOCIAL MEDIA POLICY February 2013 I. PURPOSE The department endorses the secure use of social media to enhance communication, collaboration, and information
1 Social Media User Guide Northern Arizona University Created by the Northern Arizona University Social Media Subcommittee, July 2011 2 Getting Started Social media is a great way to broaden your ability
Social Media In the Workplace By Randy Green and John Michael Ekblad 306 West Church Street, Champaign, IL 61820 (217)352-1800 Overview: Social Media What is it? Risks Presented Properly Regulating Employee
1. Acceptance of Terms Welcome to s Social Trading (the Social Trading Features ). Social Trading Features provide an integrated solution of equity trading and exploration of interactions among investors
CUSTOMER SERVICE MEETS SOCIAL MEDIA: BEST PRACTICES FOR ENGAGEMENT 2009 RightNow Technologies. All rights reserved. RightNow and RightNow logo are trademarks of RightNow Technologies Inc. All other trademarks
Bonita Springs Estero Association of REALTORS Policy: Member s Use of Social Media in the Real Estate Business As used in this policy Broker shall refer to the Broker. REALTOR or Agent shall mean a licensed
DISTRICT COUNCIL OF LOXTON WAIKERIE Social Media Policy Policy Identification: Adoption Date: 20 April 2012 Last Review: 17 April 2015 Next Review Date: April 2017 Every 2 years Responsible Officer(s):
Website - Terms and Conditions Welcome to our website. If you continue to browse and use this website you are agreeing to comply with and be bound by the following terms and conditions of use, which together
Sutter Health and Affiliates Administrative Policies and Procedures SOCIAL MEDIA POLICY Communications & Marketing Policy 12-745 Approved by: System Management Team Origination Date: 08/2009 Revised Date:
Social Media Policy Overview... 2 Using Social Media on Behalf of Cedarville University... 3 Content Management... 4 Best Practices... 4 Facebook... 5 Twitter... 5 Blogs... 6 Photos... 6 Video... 6 Comments
City of Boston Department of Innovation and Technology Policy Title: Information Technology Resource Use Policy Effective Date: April 1, 2011 Purpose and Intent The City of Boston recognizes the importance
I N D U S T R Y T R E N D S & R E S E A R C H R E P O R T S F O R I N D U S T R I A L M A R K E T E R S Social Media Use in the Industrial Sector Contents Executive Summary...3 An Introduction to Social
Social Networking Issues in the Workplace Presented By: David Flotten, JD, SPHR HR Consultant/Benefits Technical Advisor Disclaimers Technology is moving faster than the legal system can keep pace. Accordingly,
Social Media Marketing Best Practices Distributed at Igniting Opportunities: Measuring and Monetizing Social Media Presented by The Council of PR Firms and The Social Media Society Hosted by Davis & Gilbert
Communications 01: Social Media Policy: To communicate the Network s mission publicly, to inform and engage the community regarding the Network s activities, and to establish appropriate and professional
Practice Resource Model policy Social media and social networking [FIRM NAME] Social Media and Social Networking Policies and Procedures Social media encompasses a broad range of online sites, services
OFFICE OF EXTERNAL RELATIONS Social Media Policy I. Purpose Social media encompass a wide variety of Internet networking and communication tools, including but not limited to sites such as Facebook and
Privacy in the Cloud Computing Era A Microsoft Perspective November 2009 The information contained in this document represents the current view of Microsoft Corp. on the issues discussed as of the date
Holyoke Community College Social Media Guidelines Adopted: May 3, 2010 by the HCC Web Team Revised February 17, 2012 Introduction Social media offers HCC a tremendous opportunity to connect with and better
North Carolina Office of the Governor North Carolina Office of Information Technology Services North Carolina Department of Cultural Resources Best Practices for State Agency Social Media Usage in North
The British Academy of Management s Website and Social Media Policy The creation of management knowledge through research and its dissemination through teaching and application The British Academy of Management
Social Media Platform Agreements and Brand Risk BRUCE GOLDNER AND NAOMI SOSNER, SKADDEN, ARPS, SLATE, MEAGHER & FLOM LLP, WITH PRACTICAL LAW INTELLECTUAL PROPERTY & TECHNOLOGY This Article summarizes key
County of Orange County Executive Office Information and Technology PURPOSE SOCIAL MEDIA USE County Social Media Use Policy and Procedure Subject: Number: County Social Media Use Policy SM-001 Approved
1 Terms & Conditions In this section you can find: - Website usage terms and conditions 1, 2, 3 - Website disclaimer -Acceptable internet use policy 1,2,3,4 - Acceptable email use policy 1, 2 - Copyright
Best Practices for the Use of Social Media Summer 2011 Belmont University Athletics Overview The rapid growth of social media technologies combined with their ease of use and pervasiveness make them attractive
Huddersfield New College Further Education Corporation Policy for Personal Use of Social Networking and Third Party Websites 1.0 Introduction 1.1 This policy sets out the principles that Huddersfield New
Agent Social Media Policy Addendum to the Agent Advertising Guidelines November 2013 For agent use only. not to be used for consumer solicitation purposes. Addendum to Agent Advertising Guidelines Agent/Producer
University Schools Social Media Guidelines for Employees Purpose of Social Media Guidelines All University Schools Laboratory Employees are subject to the Ball State University Social Media Policy available
SOCIAL NETWORKING AND THE OVERLOOKED ISSUE OF SECURITY Social networking by definition focuses on building and reflecting personal and social relations among people who share common interests, causes or
North Carolina Office of the Governor North Carolina Office of Information Technology Services North Carolina Department of Cultural Resources Best Practices for Social Media Usage in North Carolina December
ACE USA Podcast Released February 3, 2010 Preparing for the Inevitable Data Breach: What to Do Before Sensitive Customer and Employee Data is Breached, Stolen or Compromised Moderator: Richard Tallo Senior
INTRODUCTION AND SCOPE General Guidelines for Use of Social Media Social media can be a valuable and powerful means of communication. Yeshiva University and its constituent schools (collectively, the University
Purpose for Social Media Guidelines: Guilford County Schools (GCS) realizes that part of 21st century learning is adapting to the changing methods of communication. The importance of teachers, students
GUIDELINES FOR THE USE OF SOCIAL MEDIA January 2010 Revised July 2010 Prepared by: The Voices Technology and Best Practice Team TABLE OF CONTENTS Overview of Document...2 General Rules to Follow...3 Social
HUMAN RESOURCES POLICIES & PROCEDURES Policy title Application IT systems and social networking policy All employees and students CONTENTS PAGE Introduction and scope 2 General points 2 Authorisation to
SOCIAL MEDIA AT BLOOMSBURG UNIVERSITY Guidelines for University Communications and Marketing Professionals October 2010 These guidelines were created by Bloomsburg Office of Marketing and Communications.
[Example] Social Media Acceptable Use Policy Overview The [agency] recognises that there are legitimate business and personal reasons for using social media at work or using corporate computing resources.
Terms & conditions for the use of this Website IMPORTANT IT IS DEAMED THAT YOU HAVE READ AND AGREE TO ALL TERMS & CONDITIONS BEFORE USING THIS WEBSITE. By using this website you are deemed to have full
WHITE PAPER The Five Step Guide to Better Social Media Security A Hootsuite White Paper The Five Step Guide to Better Social Media Security A Hootsuite White Paper In 2013, not a single month went by without
SOCIAL MEDIA RISKS Of Healthcare Organizations October 2011 Sponsored by: SOCIAL MEDIA RISKS Of Healthcare Organizations Social media sites such as Facebook, Twitter, YouTube and LinkedIn have become integral
TEMECULA VALLEY CHARTER SCHOOL BOARD POLICY Section 5000 Personnel 5013 Employee Use of Social Media Board Action: Approved Effective Date: 11-2-2015 Temecula Valley Charter School recognizes the value
Version 2.1 ROM Web and Social Media Standards What is Social Media? Social Media can be simply defined as online social conversation. The word conversation is key. Traditional media delivers content one
Spring 2012 NYC Department of Education Social Media Guidelines A. Introduction/Purpose 1. Social media technology can serve as a powerful tool to enhance education, communication, and learning. This technology
Social Media Policies & Handbook Centenary College supports the use of social media to connect with students, colleagues, and alumni. This handbook explains how to do so effectively and safely within the
& Reference Check: Is Your Boss Watching? Privacy and Your Facebook Profile www.ipc.on.ca Reference Check: Is Your Boss Watching? Privacy and Your Facebook Profile Facebook and other online social networks
Subject Regions Hospital Social Media Use and Behavior Attachments Yes No Key words Social Networking, Facebook, YouTube, Internet e-mail, blog, online manners, netiquette, Twitter, web mail Number RH-HR-HR
POLICY NO. 3.14 September 8, 2015 TITLE: INTERNET AND EMAIL USE POLICY POLICY STATEMENT: Many of our employees have access to the internet as well as email capabilities. The County recognizes that these
Social Media Charter 1. Internet, social media, web 2.0 interface and on-line communication "Social media" and "web 2.0" interface are generic terms which designate different activities integrating technology,
Auburn University at Montgomery Policies and Procedures Title: Responsible Office: Social Media Policy University Relations I. PURPOSE This policy outlines the procedures governing social media pages created
Disclosure Best Practices Toolkit 2 0 1 1 E D I T I O N Introduction This document is a series of checklists to help companies, their employees, and their agencies create social media policies. Our goal
Social Marketing & Liability Fred E. Karlinsky, Esq. Co-Chair, Insurance Regulatory & Transactions Practice Shareholder, Greenberg Traurig Louisiana Insurers Conference Insurance Compliance Seminar August
What is social media? Social media is defined as any form of online publication or presence that allows end users to engage in multidirectional conversations in or around the content on the website. (Online
Social Networking Risks and Rewards Presented By: Amber Richard, Director of Interactive Marketing, YMCA of the Greater Twin Cities Natalie Lenz, Human Resources Generalist, YMCA, of the Greater Twin Cities
Virginia Commonwealth University Police Department NUMBER SECTION CHIEF OF POLICE EFFECTIVE REVIEW DATE 2 9 1/2013 2/2013 SUBJECT SOCIAL MEDIA GENERAL The department endorses the secure use of social media
PMorgan Chase Supplier Code of Conduct Purpose This Code sets out the minimum principles that we expect You to follow in Your provision of products and services to PMorgan Chase Bank & Co. and any of our
Your guide to using new media A comprehensive guide for the charity and voluntary sector with tips on how to make the most of new, low cost communication tools such as social media and email marketing.
PAGE 1 OF 7 Introduction The Michigan State University (MSU) Guidelines for Social Media apply to Michigan State University faculty, staff, and student employees and interns who create or contribute to