12

I'm job hunting at the moment and I've come across several potential employers that have PDF's that you would download, fill in, and then email to them. I feel EXTREMELY uncomfortable sending my personal information such as name, address, phone number, work history...etc through such insecure methods, never mind my SSN or similar sensitive information.

I feel like this is a major personal security risk for myself. Is it? If so, how can I make that clear to them while still maintaining my eligibility for employment?

Improve this question

2 Answers 2

Reset to default
10

I feel like this is a major personal security risk for myself. Is it?

It may be. You may not be targeted specifically, but "email is a private as a postcard". (Not enough reputation for a link, but it's googleable.)

If so, how can I make that clear to them while still maintaining my eligibility for employment?

I would've called my contact person and explained that I'm a security conscious person and that I don't feel comfortable with sending all that information over the Internet. I would then ask if there is another way for them to recieve it, or if they could wait until an in-person interview.

It may also be illegal for them to require you to send it over unecrypted email, depending on which state you are in. I'm neither a US citizen or a lawyer, but this came to mind:

See http://consumersunion.org/news/state-laws-restricting-private-use-of-social-security-numbers/ and for example California civil code

1798.85. (a) Except as provided in this section, a person or entity may not do any of the following: [...] (3) Require an individual to transmit his or her social security number over the Internet, unless the connection is secure or the social security number is encrypted.

Improve this answer
6

An address and phone number is one thing. In certain cases, this might be considered public information, think about a telephone book.

I agree with you that submitting your SSN is a bit tricky, to say the least. I can imagine that once you're hired you are required to submit this information.

In my opinion there is no need to supply this kind of sensitive information up front. I suggest to tell the possible employer(s) that this information will be given in person if it comes to a contract.

In addition, try to explain to them that if this kind of information falls in to the wrong hands, it can be used to perform identity theft. Try saying it in a way where you don't say that you don't trust them, but that you don't trust sending this information over the internet.

Is this a major security risk?

I think the likelihood of your traffic being sniffed is quite low. Apparently you're quite security aware. In addition, you could tell the employer(s) you only want to send this information encrypted by using PGP (or GPG) for example.

My personal concern would be where this information is stored. I've done some research about CV's and passports being stored on web servers, the results are scary.

Improve this answer
1
  • 3
    Really, it seems a bigger concern that the employer might not secure the data on their end. Eg, what if some secretary is printing out all these forms and just leaves them where ever? But this flaw is also there if you were to submit the form in person. It's just not really avoidable. So there's the question of how big of a risk a traffic sniffer (or a bad email provider) is vs the business itself not having good security practices. It's easy to imagine the latter being much more likely.
    – Kat
    Jun 30, 2015 at 23:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .