If it Can Happen to Amazon, it Can Happen To You

Social Media: The Industry Disrupter

Social media continues to be a major business disrupter. For the last decade most companies and brands have been working like crazy to figure it all out. From social media marketing to social hiring reports. How does it all work?

Which platform should we use to market? What is the ROI? How can we keep track of our online reputation? The waters get murky when it comes to hiring employees and screening their social accounts. Yet, so many HR professionals continue to conduct unethical searches and find themselves in compromising situations. Should we screen employees social media prior to hiring? How is that different from the background checks were already conducting? 


Just last week it was reported that an Amazon employee was fired for reporting that her supervisor instructed her to “scour social media on applicants to determine race and gender. ” She did not feel this was the correct way to do this, and notified management. She was terminated. The ex-employee has since then filed a lawsuit against Amazon for wrongful termination among other things.

Many times we hear HR executives say that they do check social media on applicants and don’t give it too much thought as to the legality of it all. According to the Society for Human Resource Management (SHRM), HR execs recruit candidates for specific jobs using social media, up from 56 percent in 2011 and 34 percent in 2008. Using this as a recruitment strategy is different than using it to determine employment, however.

The Right Way to Conduct Social Media Background Checks

This varies from state to state, however for the most part be aware of the following red flags that are allowed under FCRA compliance:

Racist, Sexist, or Discriminatory Behavior
Sexually Explicit Material
Threats or Acts of Violence
Potentially Illegal Activity

Developing a social media policy for your company is a great first step. This way everyone is on the same page when it comes to remaining fair to all applicants.

Never ask for passwords.

Include this as part of your background check policy and clearly state it for all applicants to see and agree to.

Use an outside agency.

Reputation management and workplace safety are just two of the three top reasons companies seek out social media background checks.

At eChatter we use software that is FCRA compliant. Results generated by our staff are in line with federal and state specific laws. However, we don’t stop there. Avoid a PR nightmare by monitoring social media once employees are hired, to protect employees from toxic behavior in the workplace. What starts at the office, sometimes spills into social media and vise versa.

Human Resource Social Media Hiring Scan

OSINT Research: The Devil’s in the Details

For those unfamiliar with the term OSINT Research, it is explained this way by Wikipedia

Open Source Intelligence (OSINT) is the collection and analysis of information that is gathered from public, or open, sources.[2] OSINT is primarily used in national securitylaw enforcement, and business intelligence functions and is of value to analysts who use non-sensitive intelligence in answering classifiedunclassified, or proprietary intelligence requirements across the previous intelligence disciplines.

OSINT sources can be divided up into six different categories of information flow

Open Source Intelligence

OSINT Resources Reveal the Details From the Deep Web

Many times our clients want to better understand the difference between a social media scan and a deep web scan. Taking a close look at the image above explains a lot and kind of surprises most people in terms of the data on the web that is openly available.

eChatter Case Study Examples of Deep Web Details

  • Recently, we were trying to find out whether a POI (person of interest) was married. He had no Facebook clues other than he was in a relationship. After conducting a deep web scan we found a local newspaper article in which he was named along with “his wife”. The wife chose to keep her maiden name.
  • A deep scan was ordered by a client to determine what happened to a deceased person’s body. We found an association letter that was published online indicating the person was cremated and buried at sea.
  • A client needed to know if their POI had any business affiliations that wasn’t disclosed in a divorce settlement. After a deep scan was conducted, we located quite a few businesses tied to the POI.

Does it always work out this way? Not at all. Mainly because some people are much better at hiding this than others or because they were advised to delete everything online by advice of counsel. However, these are the kind of details OSINT research is all about. You will not find this in a Google search.

Online Protection for Small Businesses

Do you think cybercriminals are too busy targeting big businesses like Home Depot, Marriott and Google to bother with your small company? Think again.

Cyber attacks are a growing threat for small businesses and the U.S. economy. According to the FBI’s Internet Crime Report, the cost of cybercrimes reached $2.7 billion in 2018 alone. Small businesses are attractive to cybercriminals because they typically lack the security infrastructure of larger corporations and by accessing a small business’s computer network, typically this opens up the client and vendor networks, too. According to a recent SBA survey, 88% of small business owners felt their business was vulnerable to a cyber attack. And since 71% of cyberattacks occur at businesses with fewer than 100 employees, small companies should be concerned.

For a small business, the cost of a data breach can be devastating. The average cyberattack costs a small business $34,604. Since it takes an average of 191 days for a small business to become aware of a cyberattack, companies that are attacked once are often hit again. No surprise that nearly 60% of companies go out of business within six months of a cyberattack.

The Cost of a Cyber Attack

Fortunately, there are steps you can take to protect your business, clients, and vendors.

1) Train your employees

Employees and emails are the leading cause of data breaches for small businesses because they are a direct path into your systems. Training employees on basic internet best practices can go a long way in preventing cyber attacks. Make sure your employees know how to  spot a phishing email, best web browsing practices, how to avoid suspicious downloads, the importance of creating strong passwords, and most importantly, how to protect sensitive customer and vendor information. Monitoring online mentions of your business name and variations of it is also very helpful and hiring a firm to do a Dark Web check up a few times a year is a good idea.


2) Use antivirus software and keep it updated
Each of your business’s computers should be equipped with antivirus software, antispyware, and updated regularly. You can easily find this online from a variety of vendors. All software vendors regularly provide patches and updates to their products to correct security problems and improve functionality. Configure all software to install updates automatically.

3) Secure your networks
Safeguard your Internet connection by using a firewall and encrypting information. If you have a Wi-Fi network, make sure it is secure and hidden. To hide your Wi-Fi network, set up your wireless access point or router so it does not broadcast the network name, known as the Service Set Identifier (SSID). And always password protect access to the router.


4) Multifactor authentication
Multifactor authentication requires additional information (e.g., a security code sent to your phone) to log in. Check with your vendors that handle sensitive data, especially financial institutions, to see if they offer multifactor authentication for your account.

5) Back up your data
Regularly back up data on every computer. Critical information electronic spreadsheets, client and vendor databases, financial files, human resources files, and accounts receivable/payable files.

6) Secure payment processing
Work with your banks or card processors to ensure the most validated tools and anti-fraud services are being used. Take it a step further by isolating payment systems from other, less secure programs and do not use the same computer to process payments and surf the Internet.

7) Control physical access
Prevent access or use of business computers by unauthorized individuals. Laptops can be particularly easy targets for theft or can be lost, so lock them up when unattended. Make sure a separate user account is created for each employee. And ensure that administrative privileges are only given to trusted IT staff and key personnel.

8) Get strong non-disclosure agreements

If applicable for your business, create well-written non-disclosure agreements. Also, look at any other agreements you use in your business to make sure they cover your intellectual property. These could include employment agreements, licenses, and sales contracts.