The Facebook, Inc., Mark Zuckerberg v. Winklevoss: 9th Circuit Opinion Affirming Decision of Distict Court

Appeal from the United States District Court for the Northern District of California James Ware, District Judge, Presiding

Argued and Submitted January 11, 2011—San Francisco, California

Filed April 11, 2011

Before: Alex Kozinski, Chief Judge, J. Clifford Wallace and Barry G. Silverman, Circuit Judges.

Opinion by Chief Judge Kozinski

COUNSEL

Jerome B. Falk (argued), Sean M. SeLegue, John P. Duchemin, Shaudy Danaye-Elmi and Noah S. Rosenthal, Howard Rice Nemerovski Canady Falk & Rabkin, San Francisco, California, for the defendants-appellants-crossappellees.

E. Joshua Rosenkranz (argued), Orrick, Herrington & Sutcliffe LLP, New York, NY; I. Neel Chatterjee, Monte Cooper and Theresa A. Sutton, Orrick, Herrington & Sutcliffe LLP, Menlo Park, California; and Theodore W. Ullyot and Colin S. Stretch, Facebook, Inc., Palo Alto, California, for them plaintiffs-appellees.

James E. Towery, Alison P. Buchanan and Jill E. Fox, Hoge, Fenton, Jones & Appel, Inc., San Jose, California, for the defendant-appellee.

OPINION

KOZINSKI, Chief Judge:

Cameron Winklevoss, Tyler Winklevoss and Divya Narendra (the Winklevosses) claim that Mark Zuckerberg stole the idea for Facebook (the social networking site) from them. They sued Facebook and Zuckerberg (Facebook) in Massachusetts. Facebook countersued them and their competing social networking site, ConnectU, in California, alleging that the Winklevosses and ConnectU hacked into Facebook to purloin user data, and tried to steal users by spamming them. The ensuing litigation involved several other parties and gave bread to many lawyers, but the details are not particularly relevant here. The district court in California eventually dismissed the Winklevosses from that case for lack of personal jurisdiction. It then ordered the parties to mediate their dispute. The mediation session included ConnectU, Facebook and the Winklevosses so that the parties could reach a global settlement. Before mediation began, the participants signed a Confidentiality Agreement stipulating that all statements made during mediation were privileged, non-discoverable and inadmissible “in any arbitral, judicial, or other proceeding.”

After a day of negotiations, ConnectU, Facebook and the Winklevosses signed a handwritten, one-and-a-third page “Term Sheet & Settlement Agreement” (the Settlement Agreement). The Winklevosses agreed to give up ConnectU in exchange for cash and a piece of Facebook. The parties stipulated that the Settlement Agreement was “confidential,” “binding” and “may be submitted into evidence to enforce [it].” The Settlement Agreement also purported to end all disputes between the parties.

The settlement fell apart during negotiations over the form of the final deal documents, and Facebook filed a motion with the district court seeking to enforce it. ConnectU argued that the Settlement Agreement was unenforceable because it lacked material terms and had been procured by fraud. The district court found the Settlement Agreement enforceable and ordered the Winklevosses to transfer all ConnectU shares to Facebook. This had the effect of moving ConnectU from the Winklevosses’ to Facebook’s side of the case.

The Winklevosses appeal.

A. Because ConnectU switched sides, it no longer had any interest in appealing the district court’s order. The Winklevosses sought to intervene after the district court entered judgment enforcing the Settlement Agreement. The court denied the motion as unnecessary, holding that they were “already parties to the[ ] proceedings to enforce the Settlement Agreement” and “may appeal that Judgment.” In fact, the Winklevosses had earlier been dismissed from the case. But, by ruling that they were “already” parties, the district court implicitly granted them intervention nunc pro tunc. See Beckman Indus., Inc. v. Int’l Ins. Co., 966 F.2d 470, 474-75 (9^th Cir. 1992). They therefore have standing to appeal. See Marino v. Ortiz, 484 U.S. 301, 304 (1988) (“[T]hose [litigants who] properly become parties[ ] may appeal an adverse judgment. . . .”).

B. The Settlement Agreement envisioned that Facebook would acquire all of ConnectU’s shares in exchange for cash and a percentage of Facebook’s common stock. The parties also agreed to grant each other “mutual releases as broad as possible,” and the Winklevosses represented and warranted that “[t]hey have no further right to assert against Facebook” and “no further claims against Facebook & its related parties.” Facebook moved to enforce the Settlement Agreement, and also asked the district court to order ConnectU and the Winklevosses to sign more than 130 pages of documents, including a Stock Purchase Agreement, a ConnectU Stockholders Agreement and a Confidential Mutual Release Agreement. facebook’s deal lawyers claimed that the terms in these documents were “required to finalize” the Settlement Agreement, and its expert dutifully opined that they were “typical of acquisition documents.”

[1] The Winklevosses argue that if these terms really are “required” and “typical,” then they must be material, and their absence from the Settlement Agreement renders it unenforceable. See Weddington Prods., Inc. v. Flick, 71 Cal. Rptr. 2d 265, 279-80 (Cal. Ct. App. 1998). But a term may be “material” in one of two ways: It may be a necessary term, without which there can be no contract; or, it may be an important term that affects the value of the bargain. Obviously, omission of the former would render the contract a nullity. See Citizens Utils. Co. v. Wheeler, 319 P.2d 763, 769-70 (Cal. Dist. Ct. App. 1958) (arms-length acquisition of a private company’s shares couldn’t proceed because price was omitted from the contract). But a contract that omits terms of the latter type is enforceable under California law, so long as the terms it does include are sufficiently definite for a court to determine whether a breach has occurred, order specific performance or award damages. See Elite Show Servs., Inc. v. Staffpro, Inc., 14 Cal. Rptr. 3d 184, 188 (Cal. Ct. App. 2004); 1 B.E. Witkin, Summary of California Law, Contracts § 137 (10th ed. 2005) [hereinafter Witkin on Contracts]; cf. Terry v. Conlan, 33 Cal. Rptr. 3d 603, 612-13 (Cal. Ct. App. 2005). This is not a very demanding test, and the Settlement Agreement easily passes it: The parties agreed that Facebook would swallow up ConnectU, the Winklevosses would get cash and a small piece of Facebook, and both sides would stop fighting and get on with their lives.

[2] The Settlement Agreement even specifies how to fill in the “material” terms that the Winklevosses claim are missing from the deal:

Facebook will determine the form & documentation of the acquisition of ConnectU’s shares [ ] consistent with a stock and cash for stock acquisition. (emphasis added).

California allows parties to delegate choices over terms, so long as the delegation is constrained by the rest of the contract and subject to the implied covenant of good faith and fair dealing. See Cal. Lettuce Growers, Inc. v. Union Sugar Co., 289 P.2d 785, 791 (Cal. 1955); see also 1 Witkin on Contracts § 139. Delegation isn’t necessary for a contract like the Settlement Agreement to be enforceable, as the court may fill in missing terms by reference to the rest of the contract, extrinsic evidence and industry practice. See 1 Witkin on Contracts § 139; Sterling v. Taylor, 152 P.3d 420, 428-29 (Cal. 2007). But the clause quoted above leaves no doubt that the Winklevosses and Facebook meant to bind themselves and each other, even though everyone understood that some material aspects of the deal would be papered later.

[3] The Winklevosses’ contractual delegation is valid because the Settlement Agreement obligates Facebook to draw up documents “consistent with a stock and cash for stock acquisition.” And, if Facebook should draft terms that are unfair or oppressive, or that deprive the Winklevosses of the benefit of their bargain, the district court could reject them as a breach of the implied covenant of good faith and fair dealing. See 1 Witkin on Contracts § 798. The district court got it exactly right when it found the Settlement Agreement enforceable but refused to add the stack of documents drafted by Facebook’s deal lawyers.

C. After signing the Settlement Agreement, Facebook notified the Winklevosses that an internal valuation prepared to comply with Section 409A of the tax code put the value of its common stock at $8.88 per share. The Winklevosses argue that Facebook misled them into believing its shares were worth four times as much. Had they known about this valuation during the mediation, they claim, they would never have signed the Settlement Agreement. The Winklevosses charge Facebook with violating Rule 10b-5, and they seek rescission of the Settlement Agreement under Section 29(b) of the Securities Exchange Act of 1934 (the Exchange Act).

[4] Rule 10b-5 prohibits fraud, whether by commission or omission, “in connection with the purchase or sale of any security.” 17 C.F.R. § 240.10b-5. We assume, without deciding, that a party negotiating an exchange of shares to settle a lawsuit could violate Rule 10b-5 by misstating or hiding information that would materially change the other side’s evaluation of the settlement. Cf. Green v. Ancora-Citronelle Corp., 577 F.2d 1380, 1382-83 (9th Cir. 1978); Foster v. Fin.Tech., Inc., 517 F.2d 1068, 1071-72 (9th Cir. 1975).

[5] Section 29(b) renders voidable “[e]very contract made in violation of any provision of [the securities laws] or of any rule or regulation thereunder, and every contract . . . the performance of which involves [such a] violation.” 15 U.S.C.§ 78cc(b); see Mills v. Elec. Auto-Lite Co., 396 U.S. 375, 387-88 (1970). If Facebook violated Rule 10b-5, the Winklevosses would be entitled to rescission of the Settlement Agreement. See Mills, 396 U.S. at 387-88; Royal Air Props., Inc. v. Smith, 312 F.2d 210, 213 (9th Cir. 1962).

[6] The Winklevosses are sophisticated parties who were locked in a contentious struggle over ownership rights in one of the world’s fastest-growing companies. They engaged in discovery, which gave them access to a good deal of information about their opponents. They brought half-a-dozen lawyers to the mediation. Howard Winklevoss—father of Cameron and Tyler, former accounting professor at Wharton School of Business and an expert in valuation—also participated.

A party seeking to rescind a settlement agreement by claiming a Rule 10b-5 violation under these circumstances faces a steep uphill battle. See Petro-Ventures, Inc. v. Takessian, 967 F.2d 1337, 1341-42 (9th Cir. 1992); see also Harsco Corp. v. Segui, 91 F.3d 337, 343-44 (2d Cir. 1996); Locafrance U.S. Corp. v. Intermodal Sys. Leasing, Inc., 558 F.2d 1113, 1115 (2d Cir. 1977); cf. Mergens v. Dreyfoos, 166 F.3d 1114, 1117-18 (11th Cir. 1999) (applying Florida law).

In Petro-Ventures, we distinguished between buyers of securities in the context of “an exclusively business relationship,” 967 F.2d at 1341, and those “acting in the adversarial setting that is characteristic of litigation,” id. at 1342. When adversaries “in a roughly equivalent bargaining position and with ready access to counsel” sign an agreement to “establish[ ] a general peace,” we enforce the clear terms of the agreement. Id. (citing Locafrance, 558 F.2d at 1115). Parties involved in litigation know that they are locked in combat with an adversary and thus have every reason to be skeptical of each other’s claims and representations. See Mergens, 166 F.3d at 1118; cf. Goodman v. Epstein, 582 F.2d 388, 403-04 (7th Cir. 1978) (holding that parties signing a release of claims have a “duty of inquiry”); Moseman v. Van Leer, 263 F.3d 129, 133-34 & n.3 (4th Cir. 2001) (same). They can use discovery to ferret out a great deal of information before even commencing settlement negotiations. They can further protect themselves by requiring that the adverse party supply the needed information, or provide specific representations and warranties as a condition of signing the settlement agreement. See Harsco, 91 F.3d at 344. Such parties stand on a very different footing from those who enter into an investment relationship in the open market, where it’s reasonable to presume candor and fair dealing, and access to inside information is often limited. There are also very important policies that favor giving effect to agreements that put an end to the expensive and disruptive process of litigation. See, e.g., Franklin v. Kaypro Corp., 884 F.2d 1222, 1229 (9th Cir. 1989) (“[I]t hardly seems necessary to point out that there is an overriding public interest in settling and quieting litigation.”). We analyze the Winklevosses’ securities claims in light of these inhospitable principles.

Release of claims. The Settlement Agreement grants “all parties” “mutual releases as broad as possible”; the Winklevosses “represent and warrant” that “[t]hey have no further right to assert against Facebook” and “no further claims against Facebook & its related parties.” The Winklevosses maintain that they didn’t discover the facts giving rise to their Rule 10b-5 claims until after they signed these releases. They argue that the releases don’t foreclose their challenge to the Settlement Agreement because Section 29(a) of the Exchange Act precludes a mutual release of unknown securities fraud claims arising out of negotiations to settle a pending lawsuit. See 15 U.S.C. § 78cc(a) (voiding “[a]ny condition, stipulation, or provision binding any person to waive compliance with” the securities laws).

[7] Petro-Ventures dealt with just such a settlement agreement. 967 F.2d at 1338-39. We held that parties possessing roughly equivalent bargaining strength could release all claims arising out of the transaction that gave rise to the litigation, even though they hadn’t yet discovered some of the securities claims when they signed the settlement. Id. at 1342. Such a release is valid if it “is unambiguous in conveying the intent of the parties to release all unknown claims.” Id. The Settlement Agreement the parties negotiated granted “releases as broad as possible.” As sophisticated litigants, the Winklevosses or their counsel should have been familiar with Petro-Ventures and understood that the broadest possible release includes both known and unknown securities claims. An agreement meant to end a dispute between sophisticated parties cannot reasonably be interpreted as leaving open the door to litigation about the settlement negotiation process. See Petro-Ventures, 967 F.2d at 1342 (discussing the parties’ “intent to end their various disputes . . . once and for all” (ellipses in original)). A release in such an agreement would be useless to end litigation if it couldn’t include claims arising from the settlement negotiations. Cf. Sander v. Weyerhaeuser, 966 F.2d 501, 503 (9th Cir. 1992).

[8] The Winklevosses point out that Facebook’s alleged securities law violations took place in connection with the settlement itself, whereas the unknown securities claim in Petro-Ventures arose out of facts that occurred prior to the settlement. This is a distinction without a difference: Both here and in Petro-Ventures the parties gave up securities law claims they didn’t know they had. If the release is effective in the one case, there’s no principled reason it shouldn’t be effective in the other. The district court correctly concluded that the Settlement Agreement meant to release claims arising out of the settlement negotiations, and that the release was valid under section 29(a). Securities fraud claims. In any event, the Winklevosses’ securities fraud claims fail on the merits. The Winklevosses make two related claims: that Facebook led them to believe during the settlement negotiations that its shares were worth $35.90, even though Facebook knew that its shares were, in fact, worth only $8.88; and that Facebook failed to disclose material information, namely the $8.88 tax valuation, during the negotiations. In support of these claims, the Winklevosses proffered evidence of what was said and not said during the mediation. The district court excluded this evidence under its Alternative Dispute Resolution (ADR) Local Rule 6-11, which it read to create a “privilege” for “evidence regarding the details of the parties’ negotiations in their mediation.” But privileges are created by federal common law. See Fed. R. Evid. 501. It’s doubtful that a district court can augment the list of privileges by local rule. Cf. In re Grand Jury Subpoena Dated Dec. 17, 1996, 148 F.3d 487, 491-93 (5th Cir. 1998) (examining whether a federal statute created an evidentiary privilege). In any event, the parties used a private mediator rather than a court-appointed one. See N.D. Cal. ADR L.R. 3-4(b) (“A private ADR procedure may be substituted for a Court program if the parties so stipulate and the assigned Judge approves.”). Their mediation was thus “not subject to the . . . ADR Local Rules,” including Local Rule 6-11. Id.

[9] Nevertheless, the district court was right to exclude the proffered evidence. The Confidentiality Agreement, which everyone signed before commencing the mediation, provides

that:

All statements made during the course of the mediation or in mediator follow-up thereafter at any time prior to complete settlement of this matter are privileged settlement discussions . . . and are nondiscoverable and inadmissible for any purpose including in any legal proceeding. . . . No aspect of the mediation shall be relied upon or introduced as evidence in any arbitral, judicial, or other proceeding. (emphasis added).

This agreement precludes the Winklevosses from introducing in support of their securities claims any evidence of what Facebook said, or did not say, during the mediation. See Johnson v. Am. Online, Inc., 280 F. Supp. 2d 1018, 1027 (N.D. Cal. 2003) (enforcing a similar agreement). The Winklevosses can’t show that Facebook misled them about the value of its shares or that disclosure of the tax valuation would have significantly altered the mix of information available to them during settlement negotiations. Without such evidence, their securities claims must fail. See In re Daou Sys., Inc., 411 F.3d 1006, 1014 (9th Cir. 2005); see also McCormick v. Fund Am. Cos., 26 F.3d 869, 876 (9th Cir. 1994).

The Winklevosses argue that if the Confidentiality Agreement is construed to defeat their Rule 10b-5 claims, it is void under section 29(a) of the Exchange Act as an invalid waiver. But section 29(a) “applie[s] only to express waivers of noncompliance,” Levy v. Southbrook Int’l Invs., Ltd., 263 F.3d 10, 14, 18 (2d Cir. 2001), with the “substantive obligations imposed by the Exchange Act,” Shearson/Am. Express, Inc. v. McMahon, 482 U.S. 220, 228 (1987). The Confidentiality Agreement merely precludes both parties from introducing evidence of a certain kind. Although this frustrates the securities claims the Winklevosses chose to bring, the Confidentiality Agreement doesn’t purport to limit or waive their right to sue, Facebook’s obligation not to violate Rule 10b-5 or Facebook’s liability under any provision of the securities laws. See McMahon, 482 U.S. at 230.

[10] Even if we were to construe the Confidentiality Agreement as a waiver of the Winklevosses’ 10b-5 claims, it wouldn’t violate section 29(a). Petro-Ventures expressly considered a section 29(a) argument in the context of a global settlement agreement between sophisticated parties engaged in litigation. 967 F.2d at 1341-43. The court distinguished an earlier case, Burgess v. Premier Corp., 727 F.2d 826 (9th Cir. 1984), which had applied section 29(a) to preclude the waiver of unknown claims by plaintiffs who were “not acting in the adversarial setting that is characteristic of litigation.” Petro- Ventures, 967 F.2d at 1342. Petro-Ventures held that “a totally different situation occurs where a plaintiff has affirmatively acted to release another party from any possible liability in connection with a transaction in securities.” Id. In such situations, the parties are “not so concerned with protecting their rights as investors as they [are] with establishing a general peace.” Id. We are bound by Petro-Ventures to conclude that the Confidentiality Agreement did not violate section 29(a). Cf. Locafrance, 558 F.2d at 1115.

* * *

The Winklevosses are not the first parties bested by a competitor who then seek to gain through litigation what they were unable to achieve in the marketplace. And the courts might have obliged, had the Winklevosses not settled their dispute and signed a release of all claims against Facebook. With the help of a team of lawyers and a financial advisor, they made a deal that appears quite favorable in light of recent market activity. See Geoffrey A. Fowler & Liz Rappaport, Facebook Deal Raises $1 Billion, Wall St. J., Jan. 22, 2011, at B4 (reporting that investors valued Facebook at $50 billion—3.33 times the value the Winklevosses claim they thoughtFacebook’s shares were worth at the mediation). For whatever reason, they now want to back out. Like the district court, we see no basis for allowing them to do so. At some point, litigation must come to an end. That point has now been reached.

AFFIRMED.

FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

The Social Network

masih inget film the social network?
film yang mengulas tentang perjalanan Mark Zuckerberg membangun "Facebook", since he dumped from his girlfriend, built "face mash", met Cameron dan Tyler Winklevoss  until he built facebook....
berikut beberapa pic film tersebut..

How Facebook mucks up office life....

Managing a workforce is already a challenging job; now Facebook and other social networks raise a host of sticky new situations.

April 30, 2009 (Computerworld) Imagine walking into a meeting and encountering not just your current co-workers, but all your colleagues and managers from jobs past, along with your spouse, your college drinking buddies, your Senior Prom date, and, off in a corner, your adolescent son, busy telling your boss how many hours he logs in every day playing Grand Theft Auto.

It's not a nightmare, it's Facebook.

If you're anything like the 200 million users on the burgeoning social network, you probably didn't give enough thought when you first signed on to which friend requests you accepted, or whom you invited via the Friend Finder. Now you've got a dangerously random group of friends and friends-of-friends sharing -- and over-sharing -- information, sometimes without your even being aware of it.

The "he told two friends, and they told two friends" syndrome can be embarrassing in your personal life, but potentially much more serious in the world of work.

Even if you're careful in posting work-related news in your status updates and comments on others' walls and feeds, are each and every one of your friends as cautious as you are? One buddy writing "Yo, how did the layoffs go down?" on your wall is enough to cause havoc in your office -- particularly if layoff day hasn't yet happened.

Even more troubling: the online behavior of your direct reports, who, demographically speaking, are likely to be both more enthusiastic and less discriminate in their use of Facebook and other social networks. "Younger people are using Facebook on a quasi-professional basis to build stronger relationships with people," says Michael Argast, director of Global Sales Engineering at security vendor Sophos Plc. "That means they're sharing a lot of information with a lot of people on a regular basis."

Again, if the information they're sharing is what five albums have most influenced their lives, fine. If the information they're sharing is that your division might miss its new product ship date "by a mile!!!!!!," that's not fine. Even more alarming, a new tool from Facebook lets users see their friends' activity streams from cell phones or computers without having to be logged into their Facebook home pages, which could potentially spread unwary users' updates and comments even faster than before.

In short, the more ubiquitous Facebook becomes, the greater its potential to muck up office life -- and make your job as a manager just that much more treacherous.

And these are just the accidents. The sea of information on Facebook is also starting to attract information pirates, identify thieves and malware distributors.

The best defense against these threats is awareness of the kinds of problems that can arise and how to head them off, coupled with a true understanding of the medium. Facebook does indeed offer tools (see Facebook's privacy options) to help its users better control the flow of information, but it's up to your employees -- perhaps with a little coaching from you -- to learn how to use them and then put them into play.

Until that happy day, here are some of the top inter-office challenges posed by Facebook:

Too many "friends"

All but the most cautious Facebook users wrestle with the problem of having too many disparate groups of people as "friends" -- co-workers, family members, drinking buddies, church colleagues and so forth. "Facebook has been relatively good about providing ways for users to separate friends into groups," says Argast, "but the tools are not that easy to find."

Separate from the social challenge is the issue of people, particularly younger Facebook users, becoming friends with people they don't know well, or even at all. "Facebook doesn't have our normal social mechanisms for validating someone," Argast points out -- and many users, especially people who use Facebook to network, are reluctant to turn down a friend request.

(This is less of a problem for older users who have "different social inhibition mechanisms," as Argast puts it -- in other words, they're not as comfortable with revealing personal information to online acquaintances.)

Even the cautious among us are likely to be friends with former colleagues who now work for competitors, and those innocuous relationships can potentially cause problems.

Imagine you've just had an innocent lunch with a former co-worker and discussed joining her fantasy baseball league. You come back to find a post on your wall that reads, "Great talking to you, and I'll be sure to let you know if there are any openings."

What kind of rumors will that start among your staff and colleagues?

Information travels too far

The currency of Facebook is the information that friends choose to share with one another -- status updates, wall posts, external Web links, photos, videos, survey results, application feeds, and comments on all of the above.

The unending flow of data from friends and supposed friends can easily get out of hand -- who among us hasn't 86ed a friend who cluttered our feeds with inane chatter about whether their baby was napping or awake?

But the real problem isn't the nature of the information but the fact that the structure of Facebook makes it easy for information to spread beyond the people it was intended for.

Say a Facebook user posts a funny picture of a cat. If one of her friends -- your employee, as it turns out -- comments "LOL," there's no harm done. But what if your employee instead writes, "thanks. i rilly needed a laugh this morning -- everyone here is freaking cuz our servers are down." Suddenly lots of people she may not know, and you certainly don't, are now aware of your company's technical difficulties, all in lightning-quick Internet time.

A simple change of settings can solve many vulnerabilities -- that is, choosing to show profile, basic info, personal info, photos and so forth only to "Friends" rather than Facebook's other options ("Friends of Friends," "My Networks and Friends," or the truly indiscriminate "Everyone.")

But the real problem with Facebook (and all social media), says Filiberto Selvas, a social media consultant and author of the Social CRM blog, is that people jump into using them without really understanding how they work.

If you or your employees haven't taken the time to explore the social network site's privacy controls, then "you don't have any idea of who is connected to whom on the other side," warns Selvas. "Once you put in the content, it may not be under your control any more."

The consequences of letting the wrong people see embarrassing photos or inappropriate postings have gotten a lot of attention in the media, but users' awareness may be lagging behind.

A March 2007 survey by the Ponemon Institute, a privacy and data-protection think tank, found that 23 percent of hiring managers checked social networking sites for data about job candidates. It's a trend that's not going away anytime soon, says Mike Spinney, an analyst with Ponemon. "The growing popularity of Google, awareness and rapid adoption of social networking utilities, and ongoing media attention strongly suggest that the practice is more widespread today than it was two years ago," he reports.

Nevertheless, a summer 2007 study by the workforce consulting firm Adecco found that "66 percent of Generation Y respondents were not aware that these seemingly private photos, comments and statements [on social networking sites] were audited by potential employers." (For more on the long life of your online reputation, see Deleting your digital past -- for good.)

Facebook encourages people to join Networks -- affiliations of users around shared interests and categories, either set up by the site itself (region, workplace, high school, or college) or created by other users. But Facebook's default setting is to make the profiles of network members visible to everyone in the same network. That means, unless they change their settings manually, your employees' wall posts, personal info, and photos can easily be viewed by others, whether they're direct friends or not.

Kim Goldberg, an insurance claims manager, discovered that connection the hard way. She relates: "I went on a job interview at a company I had worked for in the past. I was walking around the office visiting old friends, and one said, 'I heard you just made plane reservations to go to Florida.' I was shocked -- how could she know that? I hadn't talked to her in years, and the trip was still a surprise to my own kids!" Even more urgent, Goldberg certainly didn't want her prospective new employer to know she'd need time off so soon after coming on-board.

"I asked how she knew," Goldberg continues, "and she said she saw it on my husband's Facebook page. I was so confused. She and my husband were not even Facebook friends."

Goldberg eventually figured out that the former co-worker and her husband were both part of the same regional network on Facebook, and that was how she obtained access to his personal page. "My husband immediately changed his privacy settings," Goldberg concludes, "but the incident could have cost me the job."

In the era of corporate layoffs, stories abound of ex-employees using Facebook and Twitter as an instant support mechanism during and immediately after their downsizing.

But when news of layoffs happens in real-time -- spreading quickly to a wide group of interrelated people, sometimes before other employees have been formally notified of their fate -- the burden lands on corporate communications to stay ahead of the story, as executives from American Express and Serena Software discussed at an employee management conference late last year (see video).

Facebook blurs the line between worker and boss

Facebook can be a swamp for boss and employee alike as everything from romantic entanglements and political views to over-sharing about recreational substance use makes its way from the digital world to the physical office.

If your top programmer announces on Facebook that she's pregnant, but neglects to tell you in real life, is this information you now "know" for planning purposes or not? If a long-time contract programmer shares in his status update that he just got a contract to write a book, are you out of line in asking if he still has time for your projects?

Beyond discretion, there are potential legal issues as well. If one of your direct reports posts links on Facebook to "adult" YouTube videos, could another employee maintain that it creates a hostile workplace environment? Is it your responsibility to do something about it? As with workplace harassment issues from 20 years ago, the answer seems to be "nobody knows -- or at least not yet."

Given that uncertainty, managers are best off not "friending" current work colleagues, and definitely not subordinates, says Lynette Fallon, Executive VP HR/Legal at Axcelis Technologies, Inc. "You should tell your co-workers that it's nothing personal, it's just your policy not to mix friends on Facebook," she advises.

Beyond that, managers with active Facebook subordinates should at the very least encourage them to keep co-workers and outside friends on two different Friend Lists.

Facebook's apps and photos can leave you vulnerable

Even if you and your employees are careful not to share sensitive information in wall posts and status updates, it's still easy to inadvertently spill the beans. The Internet is chock-a-block with applications that bring data into Facebook from outside sources -- again, often without the user's realization.

As just one example, "There's a way to capture Delicious bookmarks to Facebook so that everything you bookmark gets posted to your feed," says Selvas.

If your research team is using Delicious to bookmark source pages and haven't checked their privacy settings, their work may be getting propagated on Facebook, giving friends and potentially competitors alike a pretty good idea of what your company's next big idea is going to be.

That goes for individuals too -- if you bookmarked several articles about becoming an IT consultant, that information should be for your eyes only, not all your work colleagues on Facebook.

Other applications display the books you're reading, the movies you just bought tickets to, and the stations you just set up on Pandora.

All this information is time-stamped when it's displayed. Even if you don't mind your boss knowing you bought tickets to I Love You, Man, do you really want her knowing you bought them while you were on the clock? If you're working on a non-company project on company time, same problem. Unless you -- or your co-workers -- know to turn on the controls, all your Facebook friends can see what you were really doing during that endless conference call.

Another concern, Selvas says, is the Facebook tool for tagging people who appear in posted photographs: what if someone tags your photo among the attendees at a conference, he asks, where your presence implies something about ventures your company might be considering or jobs you might personally be angling for? You can remove the tag yourself, but only after he fact. While you can protect yourself beforehand by using Facebook's privacy settings to restrict who gets to see photos you're tagged in, even an untagged photo of you can still cause problems if your face is recognizable.

further issue is the fact Facebook applications gain access to -- as the warning screen tells you -- "your profile information, photos, your friends' info, and other content that it requires to work," whether they need it or not.

In 2007, Adrienne Porter Felt, then a computer science student at the University of Virginia and now a student at U.C. Berkeley, and David Evans, an Associate Professor of Computer Science at the University of Virginia, did a survey of the top 150 Facebook applications and found that "90.7% of applications are being given more privileges than they need" to perform their intended functions.

The researchers haven't updated those earlier findings, but Evans says he suspects the results would be pretty similar. "If anything, the applications are getting more complex," he says. "And there is also an emerging model for third-party advertising networks embedded in applications, which has further privacy risks."

Facebook's policy does require application developers to delete user information after 24 hours, and, according to a Facebook spokesperson, the company has an enforcement staff to monitor compliance. Nevertheless, such wholesale acquisition of information illustrates the problem of retaining any kind of control over content you or your employees post.

And then there's the issue of how Facebook itself retains information posted by its users. The company stirred up a firestorm earlier this year when it made a change to its Terms of Service that gave the site ownership of all posted information, even after users had deleted their accounts. The immediate negative reaction forced Facebook to retract the policy and craft a new Terms of Service agreement, but again, it illustrates how volatile the data-ownership issue continues to be.

Security threats still apply

Part of the appeal of Facebook is that it offers an alternative to regular e-mail and its spam, scam, and phishing issues. If you get a message on Facebook, theoretically it's from someone you know, or at least a friend of someone you know. But that's changing, as scammers and malware distributors figure out how to adapt Facebook for their own ends.

One growing problem is with people pretending to be someone they're not. In January, for example, Silicon Alley Insider documented the efforts of a Nigerian scammer to convince a Facebook user to send money to him by posing as one of the victim's friends, whose Facebook account the scammer had managed to gain access to.

Similar approaches can be made without having to actually take over someone's account. A scammer could join a network or a group, for example, and start sending messages to everyone in the group. Since users are less suspicious of messages they receive on Facebook than they might be of an e-mail -- especially if the person on Facebook is part of their network -- they may be less guarded with their information.

Research by Sophos discovered that 41 percent of Facebook users "will divulge personal information -- such as e-mail address, date of birth and phone number -- to a complete stranger."

Even if such slips don't directly reveal information about a company, they can be useful in constructing a social engineering attack. The more bits and pieces of personal data about you and your staff a malefactor can acquire, the easier it would be for him to worm valuable company information out of them as well.

There have even been instances of Facebook being used as a way of distributing malware, says Argast. E-mails sent to Facebook groups or networks from apparent acquaintances have contained links to malware sites.

And last August, Sophos posted a warning about a message being left on Facebook users' walls urging them to watch a particular video. Clicking on the link took users to an outside Web page that urged them to download an executable to watch the movie. The executable turned out to be the Troj/Dloadr-BPL Trojan horse.

Should you ban Facebook from the office?

Many managers, faced with possible situations like these, might just throw up their hands and issue an edict: "No Facebook!" At least not in the office.

But the solution, Selvas says, isn't for employers to simply forbid employees from participating in social media; rather, they should educate workers not only as to what the dangers are, but on how to use the tools available on Facebook to control the propagation of information as much as possible.

He compares the situation with Facebook to the early days of e-mail. Remember when people would hit Reply All and then make a sarcastic comment about the boss's message? It took a while for people to develop proper e-mail etiquette, and similarly it will take a while for people to learn to navigate the perils on Facebook, Selvas says. Education can go along way toward making that happen. (See Social networks meet corporate policy, below, for some companies' internal guidelines.)

Bottom line? Facebook doesn't call for new principles, Selvas says, just smart application of the old ones. And the constant reminder that you and your employees are in public when you're on Facebook. As Selvas sums up, "Don't do anything on Facebook you wouldn't do in an airport."

San Francisco-based Jake Widman is a frequent contributor to Computerworld.