The bar can be pretty low. While some users end up on the list after repeated appearances on company property or long email threats, others might find themselves on the BOLO list for saying something as simple as "F— you, Mark," "F— Facebook" or "I'm gonna go kick your a–," according to a former employee who worked with the executive protection team. A different former employee who was on the company's security team said there were no clearly communicated standards to determine what kinds of actions could land somebody on the list, and that decisions were often made on a case-by-case basis.
The Facebook spokesman disputed this, saying that people were only added after a "rigorous review to determine the validity of the threat."
Awkward situations
Most people on the list do not know they're on it. This sometimes leads to tense situations.
Several years ago, one Facebook user discovered he was on the BOLO list when he showed up to Facebook's Menlo Park campus for lunch with a friend who worked there, according to a former employee who witnessed the incident.
The user checked in with security to register as a guest. His name popped up right away, alerting security. He was on the list. His issue had to do with messages he had sent to Zuckerberg, according to a person familiar with the circumstances.
Soon, more security guards showed up in the entrance area where the guest had tried to register. No one grabbed the individual, but security guards stood at his sides and at each of the doors leading in and out of that entrance area.
Eventually, the employee showed up mad and demanded that his friend be removed from the BOLO list. After the employee met with Facebook's global security intelligence and investigations team, the friend was removed from the list — a rare occurrence.
"No person would be on BOLO without credible cause," the Facebook spokesman said in regard to this incident.
It's not just users who find themselves on Facebook's BOLO list. Many of the people on the list are former Facebook employees and contractors, whose colleagues ask to add them when they leave the company.
Some former employees are listed for having a track record of poor behavior, such as stealing company equipment. But in many cases, there is no reason listed on the BOLO description. Three people familiar said that almost every Facebook employee who gets fired is added to the list, and one called the process "really subjective." Another said that contractors are added if they get emotional when their contracts are not extended.
The Facebook spokesman countered that the process is more rigorous than these people claim. "Former employees are only added under very specific circumstances, after review by legal and HR, including threats of violence or harassment."
The practice of adding former employees to the BOLO list has occasionally created awkward situations for the company's recruiters, who often reach out to former employees to fill openings. Ex-employees have showed up for job interviews only to find out that they couldn't enter because they were on the BOLO list, said a former security employee who left the company last year.
"It becomes a whole big embarrassing situation," this person said.
Tracked by special request
Facebook has the capability to track BOLO users' whereabouts by using their smartphone's location data collected through the Facebook app, or their IP address collected through the company's website.
Facebook only tracks BOLO-listed users when their threats are deemed credible, according to a former employee with firsthand knowledge of the company's security procedures. This could include a detailed threat with an exact location and timing of an attack, or a threat from an individual who makes a habit of attending company events, such as the Facebook shareholders' meeting. This former employee emphasized Facebook could not look up users' locations without cause.
When a credible threat is detected, the global security operations center and the global security intelligence and investigations units make a special request to the company's information security team, which has the capabilities to track users' location information. In some cases, the tracking doesn't go very far – for instance, if a BOLO user made a threat about a specific location but their current location shows them nowhere close, the tracking might end there.
But if the BOLO user is nearby, the information security team can continue to monitor their location periodically and keep other security teams on alert.
Depending on the threat, Facebook's security teams can take other actions, such as stationing security guards, escorting a BOLO user off campus or alerting law enforcement.