Sophos Cloud Optix
There is a David and Goliath tale unfolding in Silicon Valley. The Goliath is LinkedIn, the professional social network where approximately 500m people post their bios and resumes. The David is hiQ Labs, a San Francisco startup with 24 employees.
hiQ has two products, both dependent on access to the 500m LinkedIn member’s public profiles. The products are Keeper, which identifies which employees might be ripe for being recruited away, and Skills Mapper, which summarizes an employee’s skills.
They derive this information by harvesting LinkedIn’s publicly available profile section, information that anyone with a browser and a search engine would be able to see without being logged into LinkedIn. Their clients, according to hiQ, are mostly large companies (they identify eBay, Capital One and Go Daddy as current customers and are courting Chevron, Honeywell and IBM).
Every LinkedIn user’s public profile is different, based on what the individual wishes to make public. The profile consists of a number of areas, including a summary, work history, publications, groups and recommendations.
If you want to limit visibility of all or part of your profile, LinkedIn shows you how on its Help page. LinkedIn reminds users that “the public profile appears when anyone searches for you on Bing, Google, Duck Duck Go, etc”.
It’s not just individuals, though, who can search for you and see your public profile: businesses and intelligence agencies can search for you, too, as we were reminded by the UK’s MI5 when it sent a warning memo to government offices. Yes, the public profiles of LinkedIn are harvested regularly.
Did LinkedIn just stumble on hiQ and its business model? Apparently not: it appears LinkedIn has not only been witting of hiQ, but engaged with hiQ as evidenced by LinkedIn’s participation in hiQ’s Elevate Conference, which included LinkedIn’s director of business operations and analytics, Lorenzo Canlas, receiving hiQ’s 2015 Elevate Impact Award.
So what’s the beef?
LinkedIn apparently took exception to hiQ’s use of its products, and decided to put a stop to it. It sent a cease-and-desist order to hiQ in late May, alleging hiQ was violating the Computer Fraud and Abuse Act, Digital Millennium Copyright Act, and California Penal Code § 502(c). In the letter to hiQ, LinkedIn also noted that it had used technology to block hiQ from accessing its data.
Once LinkedIn blocked access to its publicly available data, hiQ’s ship was essentially dead in the water.
Following an exchange of letters, emails and phone calls, hiQ filed for relief in early June, asking for a temporary injunction and recommending that the parties take 30 days to discuss and come up with an amicable solution. LinkedIn went silent.
According to hiQ’s court filings and letters to LinkedIn, hiQ thinks LinkedIn is building its own capabilities in this space and is simply pushing hiQ out of what LinkedIn considers its playground.
US district judge Edward Chen noted his dim view of restricting access to publicly available information at the end of June, saying:
If restrictions are placed on that process, that has serious implications for future research, access and speech.
He then admonished the two parties to arrange a ceasefire or he would rule on hiQ’s request for a temporary restraining order. The two parties listened, and agreed to a standstill period. Their joint filing states:
During the standstill period, LinkedIn shall authorize hiQ to access and use public member profiles in a manner consistent with hiQ’s current business model in terms of both the quantity and type of data being utilized. LinkedIn will not assert that hiQ’s access to and use of the LinkedIn website during this standstill period was unauthorized. During the standstill period, hiQ will be able to access the LinkedIn site using the same technological means that it employed prior to LinkedIn’s cease and desist letter, and LinkedIn will withdraw its current IP address blocks. If for any reason hiQ is unable to access LinkedIn’s site at any time during the standstill period, hiQ can ask LinkedIn to rectify the situation and LinkedIn will promptly work toward restoring access.
The next instalment of this David and Goliath story will take place on July 20, when both parties will file simultaneous briefs, followed by simultaneous responses on July 27, to be followed by Judge Chen’s ruling on hiQ’s request for a preliminary injunction. We’ll be watching, as the implications this ruling may have on access to “public information” are very real.
Hmmm, then what’s the issue with Geofeedia and other tools used to garner “public” posts…
On the one hand, individuals provide public information for the purpose of enhancing the advancement of careers, which, it seems, would include attracting head hunters. On the other hand, LinkedIn is the collector and keeper of the data and has some responsibility to keep it secure. Were I the judge, I would, if it comes to that, rule in favor of hiQ as the only difference in what I might do as an individual HR person and what they appear to be doing is a matter of degree. In some lights the automated harvesting of data *might* be construed as hacking.
“US district judge Edward Chen noted his dim view of restricting access to publicly available information at the end of June, saying:
“‘If restrictions are placed on that process, that has serious implications for future research, access and speech.'”
What is Judge Chen thinking? These are not government records. They are records which are the property of LinkedIn, and are shared with anyone who has signed the EULA. You did remember accepting the EULA, don’t you?
LinkedIn has the right to withhold their information from anyone or any firm that’s using them in a manner they forbid, just as Amazon or eBay has the right to decline business to any customer with a bad record, e.g., too many returns or late payments.
Perhaps you’ve even been in a local comestibles or drink establishment which has a sign stating “We reserve the right to refuse service to anyone.” By analogy, LinkedIn has the right to withhold its information, which is, after all, its bread-and-butter.
The analogy of a restaurant to the internet does not make sense in terms of your use. If it were similar it would be a restaurant that was giving away free meals (profile data) through a side entrance (search engine) to anyone that said they were interested in a free meal without exception. In this case, they leave this info ungated to gain more search. IF this were a fair strategy, Google should have the right to close off Linkedin from using their search power to enhance Linkedin’s customer experience and traffic. Automating a process to gather freely distributed information and then transform it into a new use is what has built so much innovation and progress. Restricting this ability establishes a new valuation of information for specific persons, which is discriminatory. Linkedin keeps a paywall on particular informational items, though the terms are clear. This move feels predatory.
Hmm. This article explains a lot. I’ve got a couple of skills that are in short supply and high demand. I regularly get emails from LinkedIn. But last week I suddenly started getting emails from four other solicitation firms I had never heard of–and the jobs looked mostly alike.
By the way, the headline is deplorable. The information is NOT public. It was gathered by LinkedIn and they are free to put conditions on it.
LinkedIn might have a legal right to lock up user data, as everyone involved has agreed to EULAs and the like that says so, but I don’t think they have the moral right. The users involved have marked their profiles as public because they want them as widely visible as possible. LinkedIn are breaking their implied agreement with those users if it restricts access to information that those users want to be public.
The public/private privacy dynamic on LinkedIn is quite different from other social networks like Facebook. People are not posting pictures of their children, or their drunken antics that will come back to haunt them. They are posting their employment history, their professional achievements, and perhaps the occasional blog post or article that is carefully written for a like an audience of professionals in their industry. Unless you work for some sort of top secret government agency, you want you work history to be public because it can only do you good.
Good stuff Christopher!! Shall be interesting to see the outcome of this….
“In the letter to hiQ, LinkedIn also noted that it had used technology to hiQ from accessing its data.”
Did you miss a word in here? I assume it should be “…used technology to stop hiQ…” or “…used technology to prevent hiQ…”.
Thanks for the eagle eye – there was indeed a word missing; it now reads “… to block hiQ”. Cheers!
I agree with Linkedin. Our site has a lot of stuff available for free download, but I found it so annoying to see scripts running cURL, Wget, zgrab etc and sucking up everything in sight, that I added a function to our IPS, which dropped the connection, when it saw this happen.
I imagine it’s not just Linkedin, but that most companies host websites intended to be visited by humans.
“The next instalment of this David and Goliath story will take place on 20 July 20, …”
So are they waiting three years, or did someone get confused between UK and US date formats? 🙂
Thanks – fixed!
The International Standards Organisation has created ISO 8601 for dates and times. The extended version for a date is YYYY-MM-DD, e.g. 2017-07-10, recognisable to anyone, I suggest. I suppose it will take as long as Esperanto did, to become universal.
Thanks for reminder. Since my funemployment ended, time to make my linkedin profile very private again.