Resumes on Net pose a privacy risk

NEW YORK -- A few weeks after Susan posted her resume on an Internet job board, the move appeared to be paying off.

First came a flurry of calls from recruiters who cited the research technician's posting on BiotechCareers.com. But then six employers she applied to individually said they'd already received her resume from companies she hadn't heard of -- and one complained of getting three different versions.

Soon after, she received the first of two dozen e-mails and letters at her Michigan home from activists lambasting her for doing animal research, a fact noted on her resume.

"Everything, my name, telephone number and address were all out there," said the chemist. She blames her problem on the job board, which she used last July and is now defunct. She asked that her last name not be used to avoid additional harassment.

In a downturn that has left many people anxious to find work, few question the Internet's power to put resumes in front of innumerable employers and recruiters. But many job seekers presume a degree of privacy and control over who sees their resume online -- and that may be assuming too much.

The episode involving BiotechCareers.com, accused in a recent lawsuit of looting thousands of resumes from competing sites, points to growing problems for job seekers and for Internet employment boards in securing the resumes that are their most valuable asset.

Many of the resumes on BiotechCareers.com were allegedly taken from biotech job board MedZilla.com, which filed the suit in federal court in Seattle, and competing sites including HireHealth.com. The suit contends that BiotechCareers also bought other resumes from another site, Hotresumes.com, without job seekers' knowledge, to further bolster its database.

MedZilla said it reached a settlement with BiotechCareers last month in which the latter agreed to erase its database and turn over its domain name to MedZilla. The owner of BiotechCareers.com, Jason Monastra, could not be reached for comment and his lawyer declined to comment. Executives at Hotresumes.com did not return calls for comment.

"The halcyon days of being trusting on the Web ... those days are behind us," said Peter Weddle, an Internet recruiting consultant. "Putting a resume on the Internet is the equivalent of buying one big billboard for all the jobs you see. You wouldn't put all sorts of private information on a big billboard, so why would you put it on the Internet?"

It's difficult to gauge the extent of the problem. Online job boards, led by industry heavyweights Monster.com and HotJobs.com, exploded in popularity in recent years and there are now as many as 10,000 such sites, including niche industry boards and employers' own recruitment forums.

Many boards have built-in features allowing users to limit the information on their resumes that can be viewed, and say they've taken strong measures to control access to legitimate recruiters and employers.

But Frank Heasley, president and CEO of MedZilla, said job boards need to look more closely at measures they take to protect personal information. The problems with BiotechCareers.com followed two other suspicious episodes of resume downloading from MedZilla, he said.

On a niche board like MedZilla, with a database of 10,000 resumes, operators can closely track user traffic and took note when the owner of BiotechCareers.com downloaded 2,399 resumes, Heasley said.

"There were a lot of resumes going to this fellow and it began to raise our suspicions, and then we got a call from another job board and they had noticed the same thing," he said. "We were not surprised to find someone doing this. It had happened before."

Some job seekers whose resumes appear to have been obtained by BiotechCareers.com, said they found it troubling, but believe the damage was probably limited to having their personal information sent to unsuitable recruiters and employers.

"My biggest concern is that recruiters and/or pharmaceutical HR departments did not get my resume batched to them like so many fish in the sea," said Jeff Casart, an unemployed pharmaceutical sales representative in El Paso, Texas, who was alarmed when BiotechCareers asked him to update a resume he'd never posted on the site.

Susan, the research technician who received hate e-mail, said she had signed up with BiotechCareers believing the site would only disclose her personal information to legitimate employers and recruiters. She believes BiotechCareer's own recruiting arm sent her resume out to employers without her knowledge and did not adequately screen those who had access to its site.

Theft of resumes from Internet job boards and, more commonly, sale of resumes and the e-mail addresses they contain has long been whispered about in the business, said Pam Dixon, a research fellow at the Denver-based Privacy Foundation who studies the employment sites.

"This is very common," said Dixon, pointing to a surge in unwanted spam e-mail some job board users report after posting their resumes on such sites. "People assume this is innocent, but it's not."

But the BiotechCareers.com case is one of the first times such suspicions have been at least partially confirmed, she said. Documents filed in the suit include e-mails sent to confused job seekers and other items, including an invoice for $1,459.55, marked paid, for Hotresumes.com's sale of 4,941 resumes to BiotechCareers.com.

Some job seekers compound the risk of their resumes ending up in the wrong hands by not using existing safeguards on job boards or by using fee-based resume distribution services. These promise to e-mail resumes to thousands of choice recruiters, but are not always as selective as promised, experts on Internet job searching say.

"People are just so desperate now they're not being careful," said Susan Joyce, who runs Job-Hunt.org, an online employment resource directory.

Charles Palmer, a computer systems administrator from Sterling, Va., said he paid $79 last summer to sign up with a distribution service called BlastMyresume.com after going without a job for seven months.

The only response came from a man who said he had received Palmer's resume even though he was not a recruiter. He posted it to an online discussion board as an example of unwanted spam e-mail.

"My name, my e-mail, my phone number, my address, none of them should've made available to the general public," said Palmer. His resume was one of several posted to the discussion forum.

BlastMyresume's president, Wesley Williams, said in an interview that the complaint was justified. The problem occurred when people posing as recruiters signed up to receive resumess sent out by the company, he said. BlastMyresume.com asked all the recruiters and companies on its list to reapply, and screened them to weed out impostors, he said.

Palmer got a refund but is still rankled. He notes that his resume remains posted on the discussion board and that he is still out of work -- with no promising leads.