Google+ pros/cons
February 4, 2013 1:01 PM Subscribe
My department is being mandated to start using Google+ and some other Google apps. Please help me think through the security and privacy implications of what I am afraid might become a real mess.
So our department (writers and editors) is being asked to start using Google+ as a way to build audience. We are also creating YouTube channels for our various websites.
The company uses Google Apps for Business - our enterprise email, calendar, etc. - but at this point, Google+ has not been activated. Our IT department doesn't want to activate it, claiming security issues - "company stuff/data would become too easy to distribute outside the company" - so people are using their personal Gmail accounts to access Plus.
This screams massive red-flag to me, but I can't effectively communicate why. So I could use your help pinpointing exactly why it's important that if the company wants us doing business-related work in various Google web apps, it needs to be done while logged into our corporate Google Apps account. I know that Google apps are pretty well connected to one another, and it seems to be a bad idea for personal accounts and business accounts to become associated. (Or am I wrong about that? Am I overthinking this?)
Another wrinkle to this is future-proofing: Right now, let's say the editor of one of our websites sets up the YouTube channel and Plus page for that site. What happens when/if that person leaves the company or the position? Aren't those channels/pages forever tied to the email account and identity logged in at that time?
So our department (writers and editors) is being asked to start using Google+ as a way to build audience. We are also creating YouTube channels for our various websites.
The company uses Google Apps for Business - our enterprise email, calendar, etc. - but at this point, Google+ has not been activated. Our IT department doesn't want to activate it, claiming security issues - "company stuff/data would become too easy to distribute outside the company" - so people are using their personal Gmail accounts to access Plus.
This screams massive red-flag to me, but I can't effectively communicate why. So I could use your help pinpointing exactly why it's important that if the company wants us doing business-related work in various Google web apps, it needs to be done while logged into our corporate Google Apps account. I know that Google apps are pretty well connected to one another, and it seems to be a bad idea for personal accounts and business accounts to become associated. (Or am I wrong about that? Am I overthinking this?)
Another wrinkle to this is future-proofing: Right now, let's say the editor of one of our websites sets up the YouTube channel and Plus page for that site. What happens when/if that person leaves the company or the position? Aren't those channels/pages forever tied to the email account and identity logged in at that time?
Response by poster: To clarify, we do all have corporate Gmail accounts, on our company domain. Google + has not been authorized on that domain - so, if we're logged into our company account, Google + is blocked.
posted by jbickers at 1:05 PM on February 4, 2013
posted by jbickers at 1:05 PM on February 4, 2013
Personal is personal. Business is business. You deny them for the same reason they say they have to block the business accounts from G+....personal stuff/data would be too easy to distribute outside of the personal circles you maintain.
Honestly, the people running the company need to make a decision. They need to craft a clear use policy for their social media efforts. And the people in charge of the company need to realize they are in charge of IT...and direct them to do what the business needs done.
posted by inturnaround at 1:12 PM on February 4, 2013 [8 favorites]
Honestly, the people running the company need to make a decision. They need to craft a clear use policy for their social media efforts. And the people in charge of the company need to realize they are in charge of IT...and direct them to do what the business needs done.
posted by inturnaround at 1:12 PM on February 4, 2013 [8 favorites]
I would have the same concern - if a personal Google account owns a page, what happens to it when that person leaves the company? Especially if they leave on bad terms?
Also, how will it look when someone inevitably posts something personal to the business page instead of their personal stream?
Not sure if it's possible, but can IT authorize only certain accounts to access Google+? Then have them create a dummy account that has no real access to internal things, and use that account for your external Google+ page.
Otherwise, do as needlegrrl suggests - create a new Google account. It can't/won't be at your domain, so instead of jbickers@domain.com, it could be jbickers.domain@gmail.com. It would be outside the control of your IT department because it's just a Gmail account, but it would have a more professional look to it with your company name included.
...On preview, agree 100% with inturnaround. If your dept manager wants you to use Google+ to represent the business, s/he needs to convince IT that it's an acceptable use case. IT can always provide info security training for authorized Google+ users before switching on access if they are paranoid.
posted by trivia genius at 1:15 PM on February 4, 2013 [1 favorite]
Also, how will it look when someone inevitably posts something personal to the business page instead of their personal stream?
Not sure if it's possible, but can IT authorize only certain accounts to access Google+? Then have them create a dummy account that has no real access to internal things, and use that account for your external Google+ page.
Otherwise, do as needlegrrl suggests - create a new Google account. It can't/won't be at your domain, so instead of jbickers@domain.com, it could be jbickers.domain@gmail.com. It would be outside the control of your IT department because it's just a Gmail account, but it would have a more professional look to it with your company name included.
...On preview, agree 100% with inturnaround. If your dept manager wants you to use Google+ to represent the business, s/he needs to convince IT that it's an acceptable use case. IT can always provide info security training for authorized Google+ users before switching on access if they are paranoid.
posted by trivia genius at 1:15 PM on February 4, 2013 [1 favorite]
I think that it is within their rights as a company to ask you to maintain quasi-personal Google+ pages, as long as they are branded as you-as-employee-of-company.
Google Apps does link to Google+ via the email address (your company address) linked to the company's Google Apps account.
Just post to Google Plus from there.
Create a content plan (what to post) and social media plan (who on G+ you link to) that is only relevant to your work identity.
Make sure that there is a differentiator in your company G+ handle from your actual identity (I am not sure if this is possible). Make sure you claim your own personal G+ page from Gmail.
Even though the app is blocked, do not post on G+ as yourself (this is why it is important to claim your profile). If your company sets up a G+ profile for you on a free Gmail account, ask them to remove it. Flag it to Google. Complain in a Google product forum.
Explain to your boss that the IT department has blocked Google Plus.
posted by KokuRyu at 1:28 PM on February 4, 2013
Google Apps does link to Google+ via the email address (your company address) linked to the company's Google Apps account.
Just post to Google Plus from there.
Create a content plan (what to post) and social media plan (who on G+ you link to) that is only relevant to your work identity.
Make sure that there is a differentiator in your company G+ handle from your actual identity (I am not sure if this is possible). Make sure you claim your own personal G+ page from Gmail.
Even though the app is blocked, do not post on G+ as yourself (this is why it is important to claim your profile). If your company sets up a G+ profile for you on a free Gmail account, ask them to remove it. Flag it to Google. Complain in a Google product forum.
Explain to your boss that the IT department has blocked Google Plus.
posted by KokuRyu at 1:28 PM on February 4, 2013
I would definitely not do this under your personal Gmail account, and I'd use the same arguments that you made in your original post to express why this is a Bad Idea -- in particular, noting that it essentially ensures that ownership of content will walk away along with employees when they leave. That's dumb; it's like having everyone use their personal Gmail address instead of a work email account.
My guess is that management will be pretty receptive to this argument, when you also explain in the next breath that the whole problem goes away if G+ is enabled for your domain and then you can use your company addresses to post, and thus create a clean separation between everyone's personal and work profiles.
Then management (your boss or their boss or the CIO or whoever it takes) needs to get G+ switched on. Then, and only then, would I start posting stuff.
What you're getting is the usual I-don't-wanna-change foot-dragging out of corporate IT; if they can avoid doing anything that's going to increase workload or possible data leakage exposure, they're going to do that. It's up to management to decide that the risk is worth the reward in terms of having a social media presence.
If you can't get management buy-in on a sufficient level to override IT's perceived concerns / reluctance, then I would not go forward with G+. It is better to just not do social media at all than to do it wrong, and doing it from personal accounts is Doing It Wrong.
posted by Kadin2048 at 2:57 PM on February 4, 2013 [1 favorite]
My guess is that management will be pretty receptive to this argument, when you also explain in the next breath that the whole problem goes away if G+ is enabled for your domain and then you can use your company addresses to post, and thus create a clean separation between everyone's personal and work profiles.
Then management (your boss or their boss or the CIO or whoever it takes) needs to get G+ switched on. Then, and only then, would I start posting stuff.
What you're getting is the usual I-don't-wanna-change foot-dragging out of corporate IT; if they can avoid doing anything that's going to increase workload or possible data leakage exposure, they're going to do that. It's up to management to decide that the risk is worth the reward in terms of having a social media presence.
If you can't get management buy-in on a sufficient level to override IT's perceived concerns / reluctance, then I would not go forward with G+. It is better to just not do social media at all than to do it wrong, and doing it from personal accounts is Doing It Wrong.
posted by Kadin2048 at 2:57 PM on February 4, 2013 [1 favorite]
I worked at a company that did something similar--encouraged us to use our personal info/accounts to access G+, Twitter, FB, etc. And, like everyone else, I did. (Somewhat--I mostly created throwaway accounts to use for company-related things. Most people did not.)
Then I left the company. I made a public announcement when it happened, even. That was a year ago, and I still get at least weekly communication on one channel or another, asking for information about Company Thing X, or, in more than a few instances, being sent company-related things. For the first month or so after I left, this happened almost daily.
I bear no ill will towards the company, and have responded to the people asking me questions, redirecting them to where they should be. If, however, I were maliciously inclined, I could have done an awful lot of damage. Because the accounts are tied to my personal accounts, the company has no access at all. If I'd stopped responding entirely, they'd never know--until person X emailed someone else to ask why I hadn't given them time-sensitive document Y. If I wanted to respond with hateful screeds about whatever, the company would have no way to stop that. Moreover, since all my accounts would be linked to the company's "image", if I wanted to post a big "HEY FUCK YOU" video to YouTube...well, then there's a big "hey fuck you" video on YouTube, and it's linked to a profile that's explicitly associated with the company, over which the company has no control.
Using the company's email addresses for G+ eliminates this. If you got fired, or left the company, it would be a five-second chore for their IT guy to go in and change your password, locking you out of the account. If they cannot do this, the company is entirely reliant upon the goodwill of former employees. You know that thing over the weekend where HMV was firing a bunch of people, and one of them livetweeted it? You're looking at that scenario, but worse--because no one would be able to get in to delete the updates.
So no. You're not wrong, and you're not overthinking. Talk to your manager. If you get pushed--they insist you do this or you lose your job, and they're not going to enable G+--then create a throwaway account and post (business stuff) only from that.
posted by MeghanC at 3:02 PM on February 4, 2013 [1 favorite]
Then I left the company. I made a public announcement when it happened, even. That was a year ago, and I still get at least weekly communication on one channel or another, asking for information about Company Thing X, or, in more than a few instances, being sent company-related things. For the first month or so after I left, this happened almost daily.
I bear no ill will towards the company, and have responded to the people asking me questions, redirecting them to where they should be. If, however, I were maliciously inclined, I could have done an awful lot of damage. Because the accounts are tied to my personal accounts, the company has no access at all. If I'd stopped responding entirely, they'd never know--until person X emailed someone else to ask why I hadn't given them time-sensitive document Y. If I wanted to respond with hateful screeds about whatever, the company would have no way to stop that. Moreover, since all my accounts would be linked to the company's "image", if I wanted to post a big "HEY FUCK YOU" video to YouTube...well, then there's a big "hey fuck you" video on YouTube, and it's linked to a profile that's explicitly associated with the company, over which the company has no control.
Using the company's email addresses for G+ eliminates this. If you got fired, or left the company, it would be a five-second chore for their IT guy to go in and change your password, locking you out of the account. If they cannot do this, the company is entirely reliant upon the goodwill of former employees. You know that thing over the weekend where HMV was firing a bunch of people, and one of them livetweeted it? You're looking at that scenario, but worse--because no one would be able to get in to delete the updates.
So no. You're not wrong, and you're not overthinking. Talk to your manager. If you get pushed--they insist you do this or you lose your job, and they're not going to enable G+--then create a throwaway account and post (business stuff) only from that.
posted by MeghanC at 3:02 PM on February 4, 2013 [1 favorite]
Hi, I'm a Google Apps guy! (Reseller, certified deployment specialist)
Your management and IT will need to work this out. Using personal accounts is a giant mistake that can't be undone once it's done. There's really no way to transfer many assets from a personal Google account to a business one, practically speaking. And your management should certainly not want people acting on the company's behalf with accounts that they can't control.
There is really only one security issue specific to enabling G+ for Apps accounts - if you're automatically populating "rich profile" data from your internal corporate directory (age, gender, etc) this data may be exposed on G+. Google Apps Directory Sync can populate this information, for example. Read the bottom of this page for more on that. Beyond that, there's really no reason you'd want to disable G+ unless you didn't want your employees having a public presence as employees.
If your IT department is still leery of the whole idea, they can create an organization within Google Apps that has G+ enabled, and put only the people they want within this organization. Services can be enabled or disabled on a per-organization level.
If you or your IT department have any Apps configuration questions, feel free to memail me.
All that said, as others have already said: I would not, as an employee, use my existing Google accounts for company purposes. Create a new one and use it for just that. You might suggest that management actually create these accounts and issue the credentials to the employees, if the IT department can't be convinced.
posted by me & my monkey at 4:04 PM on February 4, 2013 [7 favorites]
Your management and IT will need to work this out. Using personal accounts is a giant mistake that can't be undone once it's done. There's really no way to transfer many assets from a personal Google account to a business one, practically speaking. And your management should certainly not want people acting on the company's behalf with accounts that they can't control.
There is really only one security issue specific to enabling G+ for Apps accounts - if you're automatically populating "rich profile" data from your internal corporate directory (age, gender, etc) this data may be exposed on G+. Google Apps Directory Sync can populate this information, for example. Read the bottom of this page for more on that. Beyond that, there's really no reason you'd want to disable G+ unless you didn't want your employees having a public presence as employees.
If your IT department is still leery of the whole idea, they can create an organization within Google Apps that has G+ enabled, and put only the people they want within this organization. Services can be enabled or disabled on a per-organization level.
If you or your IT department have any Apps configuration questions, feel free to memail me.
All that said, as others have already said: I would not, as an employee, use my existing Google accounts for company purposes. Create a new one and use it for just that. You might suggest that management actually create these accounts and issue the credentials to the employees, if the IT department can't be convinced.
posted by me & my monkey at 4:04 PM on February 4, 2013 [7 favorites]
I would never post to a corporate page from my personal social media account under any circumstances. If I had to, I would create a separate account specifically for that.
posted by empath at 8:35 PM on February 4, 2013
posted by empath at 8:35 PM on February 4, 2013
« Older What can I/should I do with my new-to-me used... | Friends found out about our alternate lifestyle... Newer »
This thread is closed to new comments.
posted by needlegrrl at 1:04 PM on February 4, 2013