San Francisco Employers: Time to Revise Employment Applications, Background Check Rules, as Supervisors "Ban the Box"

"Ban the box" means to get rid of boxes on employment applications asking for criminal history. The idea is so that employers don't automatically reject applicants with criminal convictions if they might otherwise be qualified to hold a job.

A number of jurisdictions have "banned the box," mainly in public sector employment.  Now, the San Francisco Board of Supervisors have passed an ordinance drastically limiting employers' reliance on criminal convictions.  No more criminal history information can be requested on the application.
 Even better, employers will have to comply with procedural requirements that differ from the Fair Credit Reporting Act when they do check criminal history.

We'll have an article soon with a more detailed analysis.  But the ordinance is here.  It's a big file.  The ordinance itself is long and hard to read.  A summary is on pages 55-58 of the linked  PDF.

This ordinance may take effect in a month or so.  The mayor theoretically could veto this ordinance. So, stay tuned.

Oh and YES, there will be another poster!  There may be a new ordinance requiring employers to build more walls soon.  Sure, laugh now.

Good luck out there.

U.S. Senate Considering Ban on (Nearly) All Credit Checks

I just read that the U.S. Senate, via Senator Elizabeth Warren, is introducing a bill to ban the use of pre-employment credit checks altogether.  The proposed bill is here.

The bill (as introduced) simply would amend the Fair Credit Reporting Act to make it illegal for employers to rely on credit reports to take adverse actions.  Employees would no longer be able to consent to disclosure.

Any exceptions?  Certainly.  For example, credit checks will still be allowed when the position involves national security.  Wait a minute there.  How could credit checks possibly be relevant to national security?  Could it be that an applicant's credit report has something to do with integrity?  Well, Senators, maybe that's why employers find credit checks relevant to employer security.  Another exception - when credit checks are required by law.  Why would credit checks be required by law?  The EEOC says credit checks are discriminatory.  How could something discriminatory be required by law?

Anyway, that's it for exceptions. As written, this bill does not expressly create any exception for positions involving cash handling, banking, etc.  If this bill is passed, unless the job is one of "national security" or unless a credit check is "required by law," the rest of you employers will be out of luck.

Employers may desire to run investigative consumer reports, credit reports and criminal background checks in part to verify information that applicants provide on their applications.  Application fraud appears to be a big problem, according to surveys discussed here, and here, and here.  Hey - perhaps the Senate will also introduce a bill making it illegal for applicants to lie on their employment applications!  Fat chance.

This bill may not make it through either house, or it could be amended.  But the trend among state and local governments is to get rid of credit checks, criminal background checks, and other pre-employment tools that help employers determine who is a financial or other risk.   So, employers should keep abreast of this trend, and make plans to alter hiring practices as the law evolves.

Enjoy your holidays!  Humbug.

Court of Appeal: State Anti-Hacking Criminal Statute Applies to Employee

Childs was a senior engineer for the City and County of San Francisco.  Via a series of events, he assumed significant control over a major part of the city's IT infrastructure, against the wishes of management.  I'm oversimplifying here.  The opinion contains all the gory IT details, and there are many.

At different times, management attempted to retrieve network passwords, which Childs refused to provide.  He claimed certain network configurations were his intellectual property, and he claimed that there would be a risk of disclosure of the passwords.  He also stored the passwords in such a way that they would be erased if the network had a power outage, resulting in the need to entirely reconfigure the system.

By the time Childs was fired, he had assumed total control of the network.  He became threatening and combative when another employee came to his offices to conduct an inventory.  After many meetings, the city naturally fired  attempted to reassign Childs to another job.  Management and the police met with him to recover the passwords.  He refused to provide them, with policy "pleading" with him for cooperation.

The city was locked out of its own computer system for several weeks.  Childs ultimately returned the correct passwords via his attorney, directly to the Mayor at the time.

Childs eventually was convicted under California Penal Code Section 502.  As told by the Court,

Section 502, subdivision (c)(5) makes it a crime for any person who “[k]nowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.”

One of Childs's many arguments was that he was an authorized user because the City employed him. Therefore he was not acting "without permission."  The Court of Appeal affirmed the conviction:

It appears that subdivision (c)(5) may properly be applied to an employee who uses his or her authorized access to a computer system to disrupt or deny computer services to another lawful user.

The opinion contains details about how the employee was able to take over the city's computer system.  Employers: don't let this happen to you. Ensure you have outside help to create secure "back doors" and fail safe ways of accessing the system. The employment law upshot is:  employers should ensure there are policies for IT engineers defining what is authorized and unauthorized access / permission. Then, if an IT employee goes off the rails, it is easier to raise the issue of criminal prosecution.  

Criminal Background Check

Here's another interesting part of this case.   I say interesting because of all the negative attention the government is giving to employers conducting criminal background checks.  Perhaps this case will serve as a reminder that criminal background checks could be a good idea for positions such as Childs's.

Childs lied on his employment application, because he had been convicted of several crimes out of state but did not list the convictions.  

More than once during his employment, Childs was asked to undergo a background check:

In February 2005, a San Francisco County sheriff told Childs that he needed to undergo a criminal background check. Childs offered both his California and Kansas driver‟s licenses to the sheriff, prompting an out-of-state inquiry. The sheriff discussed his findings about Childs‟s criminal history with his supervisor, who agreed that Childs could work on the project. Months later, the sheriff acknowledged to Childs that he knew of this criminal history when he praised the network engineer for “turning his life around.”

Oops. Then, 

By the end of 2007, the city was planning how to connect the city‟s law enforcement functions on FiberWAN. The combined system would allow users access to state and federal databases. For security reasons, all DTIS employees had to pass a criminal background check in order to have access to the law enforcement system. Childs had adult felony convictions that he had not revealed when he applied to work for the city.8 When asked to submit to a voluntary background check, Childs balked. Instead, he made a temporary arrangement with Tong and law enforcement officials to have Ybanez—who had passed his background check—escort him when Childs was required to work on the law enforcement network. This procedure continued to be used through July 9, 2008.

So, he said "no background check" for me - and they went for it.  

Long after Childs refused to provide the passwords to his supervisor, and after there were discussions about how to rein in Childs, a manager pondered...

Robinson knew that Childs had not passed his background check. He sought out more information about the engineer‟s criminal history. Reviewing the reports that Childs gave during the hiring process, Robinson saw the discrepancy between his initial job application reflecting no prior convictions and his time-of-hiring forms in which he admitted that he had once been convicted as an adult. Tong believed that Childs had suffered a juvenile conviction, but Robinson learned that Childs had been convicted of a criminal offense as an adult. The adult conviction and the perjured filing of personnel records were both grounds for dismissal.

And they still did not fire him for lying or because the convictions rendered him unfit.  Anyway, that's a slice of personnel management in San Francisco.

The case is People v.  Childs and the opinion is here.

 

EEOC Again Goes After Criminal Background Checks

The EEOC is still filing lawsuits against employers who conduct criminal background checks as shown in this June 11 press release.  States are limiting criminal background checks too.  Based on the government's current hostility, it is important to review your background check policies and procedures frequently in all states in which you do business.