Thursday, April 29, 2010

Facebook privacy

Many people are outraged about Facebook's recent changes that further erode the ability of Facebook users to control the information that they share. Others are not convinced that it's important. I would argue that it's very important, and that if Facebook wants to stay in business, they'll figure out how to make money and respect people's privacy at the same time.

First, a quick recap of the changes. These changes have occurred over the past months. The changes are not easily understood. This is my best effort at understanding how things work now.

1. "Instant Personalization" - Facebook is now partnering with sites that will yank your publicly available information and use it to immediately personalize their site for you. The first three sites in this program are Pandora (Internet radio), Yelp (local business listings and reviews), and Microsoft Docs (Microsoft's answer to Google Docs). Even if you opt out of Instant Personalization, your information may end up in Microsoft's hands anyway if one of your friends uses MS Docs. You have to block each "Instant Personalization" individually to prevent this from happening.

2. Facebook is now encouraging websites to put Facebook "Like" buttons on their sites. Instead of "sharing" things you find on the web that you think will interest your friends, you indicate that you "like" them, your friends will see that, and that information will be added to your Facebook profile. When you click "Like," you will see how many Facebook users have already done the same - including the names and photos of any of your friends who have already done so. If what you "Like" fits into a certain category, it will be added to your profile - so movies that you "Like" end up in the "Movies" section of your profile.

3. Facebook users no longer become "fans" of celebrities, products, organizations, etc, that they are, well, fans of. Instead, they are also "Likes." The Pages that represent these "non-user entities" are "public" now - you cannot hide them. In Facebook's own words, if you don't want to be known to be connected with something or someone, you should "un-Like" it. So if you don't want anyone to know that you really, really like pancakes, your only option is to indicate that you don't "Like" pancakes anymore.

4. On one's Facebook profile, prior to recent changes, the "Info" tab would be filled out by users. It contained their hometown, work and education history, as well as their interests - preferred music, movies, television shows, etc. That, too, is all gone. Instead of filling out a text profile, everything is filled in with your "Likes." Your hometown, work, education history, and interests are all connected to Pages now.

Your existing text-based connections (like the college you went to) and your interests are converted to connections with related Pages - so if you had Nirvana listed as a favorite band, you now "Like" the Facebook page for Nirvana.

If one of your entries doesn't already have a related Facebook Page, you are connected to a filler page with Wikipedia data (if available). For example, entering "Prefer to Forget" under "High School" (as I did) no longer works, because I was connected to a Facebook Page for "Prefer to Forget."

5. All of your "Connections" - everything that you "Like" - is public information. It may not show up on your profile, depending on your settings, but you will be listed as "Liking" that Page on that Page's data. If you "Like" pancakes, your name will show up on the "Pancakes" page. In Facebook's own words, if you don't want to be known to be connected with something or someone, you should "un-Like" it. So if you don't want anyone to know that you really, really like pancakes, your only option is to indicate that you don't "Like" pancakes anymore.

For more information, see the EFF's helpful "Facebook-to-English" translator:
http://w2.eff.org/deeplinks/2010/04/handy-facebook-english-translator/

And for help in changing your privacy settings, see the EFF's handy guide:
http://www.eff.org/deeplinks/2010/04/how-opt-out-facebook-s-instant-personalization

The anger about Facebook's changes has been loud enough to enter the mainstream, including ABC News, CBS News, National Public Radio, the Huffington Post, the ACLU, the EFF, MoveOn, and four U.S Senators. But not everybody is convinced that these changes are a problem, or that they are worth debating or worrying about.

One comment argument is that Facebook is free to users. I don't think that excuses anything. Facebook makes money through targeted ads - and that's fine! But constantly eroding user's privacy and ability to control their own information is unacceptable, particularly when it's opt-out instead of opt-in. And Facebook already has a history of eroding privacy.
http://w2.eff.org/deeplinks/2010/04/facebook-timeline/

Others have argued that if you don't like it, don't complain - just don't use Facebook anymore. I don't like that argument either, because it basically boils down to either accepting whatever Facebook wants to do, or cutting yourself out of the loop completely. Facebook has proven to be a fun and useful tool for a lot of people. It helps people with certain disabilities engage with others when they normally wouldn't be able to do so. It helps people connect with others for any number of great reasons - political, cultural, social. No longer using Facebook is not a good option. I think there's a middle ground available - forcing Facebook to behave more ethically.

The third common argument I have seen is that if you're concerned, you should remove anything on your profile that you don't want people to see. The problem I see with this argument: social networking is, at least in part, about finding other people who like the same sort of things that you do and being able to communicate about them. Facebook has proven to be a boon to political campaigns and social movements. But sometimes you don't want the whole world to know about your political and social activities. Do you give up using social networking - do you give up the power of this great tool - or do you control it so that you can use it without the whole world knowing everything about you?

There are three things that bother me about the recent developments on Facebook.

1. Facebook asked users what they thought about the new privacy policy. The users were strongly against it, but Facebook did what they wanted to do anyway.

After Facebook's previous efforts to change crashed and burned in response to public outcry, Facebook took a wise step: instituting a Site Governance page and pledging to run future changes by users before implementing them. Regrettably, I feel that Facebook is ignoring the feedback that they get. During the comment period on the changes to the privacy policy that made these changes possible, Facebook received thousands of comments from users. Almost all of the comments were negative, but Facebook implemented the changes anyway, and they barely acknowledged the feedback that they had received. The feedback that Facebook received on its Site Governance page and blog after the changes were implemented appears to have been nearly uniformly negative as well, but Facebook is not flinching.

2. Unless you take a series of steps to turn it off, your activities around certain parts of the web will become public knowledge.

People don't necessarily want everything they do available to the world, but the combination of making Pages public with making everything into a Page means that you cannot partake in any activity on Facebook without it being indexed and visible via a Google search. Further, Facebook's partnerships ("Instant Personalization") is opt-out instead of opt-in. In other words, in order to prevent Microsoft, Pandora, or Yelp from finding out anything about me, a user has to take a number of steps. The EFF put together a handy guide:
http://www.eff.org/deeplinks/2010/04/how-opt-out-facebook-s-instant-personalization
But as the EFF writers note, this procedure will have to be repeated each time Facebook adds a new partner.

Facebook has promised that their partners have to honor user's privacy settings and be compatible with Facebook's privacy policy. Given how easily - cavalierly -these settings and policies are changed, some folks might not find that reassuring. There are probably many Facebook users who have a strong aversion to Microsoft - Apple users, Netscape loyalists, Linux or Unix users - and without following a series of steps, there's precious little in the way of stopping Microsoft from getting information about them.

3. Your Facebook profile can no longer contain any information of value about you that you want your friends to know, because it's all gone public. If you leave the information there then anyone can find out all sorts of things about you, and then use that information against you.

This, in my opinion, is the biggest problem with Facebook's recent changes. In the United States (I cannot speak to other countries), it is completely legal for organizations and companies to discriminate against people based upon political ideology, political affiliation, and political expression. It is legal in most of the United States to discriminate against people on the basis of sexual orientation, gender identity, and gender expression. It is completely legal to discriminate against people based upon perfectly legal activities that they may engage in, like enjoying a beer after work, or what people do during "sexy time." This issue has been well-documented by Lewis Maltby, the former ACLU Director of Employment Rights. See his website:
http://www.cantheydothatbook.com

In other words, folks - there's nothing stopping your current or future employer from looking you up on Facebook (or finding your Facebook profile on Google), finding out that your politics don't match theirs, and then firing you or denying your job application. This sort of thing is already happening - employers are admitting that they check Facebook as part of a "background check."

There's nothing to stop the Boy Scouts from refusing to accept your kids if they find out via Facebook that you sympathize with LGBT issues. There's nothing to stop Sam's Club from denying you membership (or yanking your membership) if they find out that you "like" the AFL-CIO or the Teamsters. If your Facebook account includes your views on abortion rights - either way - that information could be used against you. Your views on any number of things - if you have them on Facebook - could be used against you when:

*You are seeking help from a charity
*You are seeking help from government
*You want to join the Armed Forces
*You want to donate to or volunteer for a charity
*You want to join a community group or club
*And who knows what else?

So what are your options? You could delete your Facebook account. You could stop using Facebook for political or social movements. You could wipe your Facebook clean.

Or maybe…just maybe…you like Facebook. You could put up a fight. You could tell Facebook to do a better job of listening to their users. You could tell your elected representatives that you don't think it's fair that people can be fired or denied jobs based on legal activities that people do in their private lives. You could *fix* Facebook and make it more safe and more free.

What do you think? What do you want to do?

See also:
MoveOn's petition to Facebook to respect user privacy:
http://www.facebook.com/group.php?gid=114387775262356

A Facebook user group: "We hate the new profile page…please change it back!"
http://www.facebook.com/pages/We-hate-the-new-profile-pageplease-change-it-back/115583841796328?ref=ts&v=wall

Huffington Post article: "Zuckerberg's Privacy Stance: Facebook CEO 'Doesn't Believe in Privacy'
http://www.huffingtonpost.com/2010/04/29/zuckerberg-privacy-stance_n_556679.html

Facebook group: "How to permanently delete your facebook account."
http://www.facebook.com/group.php?gid=16929680703

EFF article: "Facebook's 'Evil Interfaces'"
http://www.eff.org/deeplinks/2010/04/facebooks-evil-interfaces

PopMatters article - "Mandatory social networking" by Rob Horning
http://www.popmatters.com/pm/post/124799-mandatory-social-networking

Article at LawyersandSettlements.com Blog:
http://www.lawyersandsettlements.com/blog/facebook-can-take-instant-personalization-and-you-know-what-it-03487.html

NPR's All Tech Considered: Debate Continues Around Facebook Privacy Changes
http://www.npr.org/blogs/alltechconsidered/2010/04/29/126394012/npr-listeners-react-to-facebook-privacy-changes

Politico: Senators' letter to Facebook
http://www.politico.com/news/stories/0410/36406.html

Design Doc: "Figuring Out Facebook" by Melissa A. Venable
http://mvenable.wordpress.com/2010/04/23/figuring-out-facebook/

EDIT:
Made all the URLs into hyperlinks

Also:
Senators urge Facebook to protect user privacy - LA Times Comments Blog
http://latimesblogs.latimes.com/comments_blog/2010/04/senators-urge-facebook-to-protect-user-privacy.html

9 comments:

Alexander Matheson said...

Eloquently said—I'm in agreement with position you've thoughtfully expressed; that Facebook may remain a powerful and worthwhile social and political tool without infringing upon user's privacy—and furthermore, that it is the obligation of users and the site to make every effort to accomplish that goal.
Peace be, and be well.

mschristina said...

Nice. Thanks for putting it so well.

Spekkio said...

Important update - this is what "Connections" can do to expose you.

http://www.facebook.com/pages/And/10150153988765438

Spekkio said...

See also:
http://news.cnet.com/8301-13577_3-20003928-36.html

Apparently FB isn't budging yet.

Mary said...

Thanks for the helpful information. It would be a perfect world if we could post information and expect it to remain private. Hopefully, Facebook will take ation to assist in achieving this ideal.

I do take exception to one line of thought on your site. I do not believe that employers in the private sector are discriminating when they consider an individuals political or social ideology in making hiring decisions. Believing in certain social or political ideology does not make one a part of a protected group. As an example; if I were an employer, I would reserve my right to refuse to hire a Nazi. I realize that this particular group espouses an inflamatory and widely disliked ideology. I use this example to make a point. There is no violation of rights in my choosing not to hire a Nazi or in my choosing not to hire any person whom I do not wish to hire, based upon that person's political ideology.

I firmly believe in the anti-discrimination laws. No one who is a member of a proteced group should exerience any sort of discrimination relative to that status. There is no law, nor should there be, that restricts employers in the private sector from eliminating a candidate for employment based upon that indidivuals political ideology. Please note that I am referring to the private sector.

I would also like to make the point that while social networking sites should not promote unauthorized sharing of information, it is entirely naive to think that anything one posts anywhere on the internet is secure. The very definition of social networking implies exponential sharing of information.

Bottom line: if you are not comfortable with putting it out there.... don't put it out there.

Spekkio said...

Mary, thank you for reading and thank you for your comment. However, I must disagree. Bringing up the specter of Nazism is a Reductio ad absurdum argument - a logical fallacy.

As you will note at cantheydothatbook.com and the associated National Workrights Institute (workrights.org), there are a number of recorded incidents of people losing their jobs for 'normal' (i.e. non-fascist, non-communist, non-anarchist) off-the-job political activity. See specifically here:
http://www.workrights.org/issue_lifestyle.html

One person was fired for having a John Kerry bumper sticker on their car. Another was fired for attempting to ask questions of President Bush at a political rally. A third was fired for refusing to donate to his boss' preferred political party. A fourth was fired for participating in an anti-war protest. IBM put out blogging guidelines for their employees in 2005 that included cautions against blogging about politics. (These guidelines were for off-work blogging!)

That site also discusses several states that have laws prohibiting employers from making decisions based upon politics - so your assertion that there are no laws is also incorrect.

Finally, re: the "naïvité" of keeping information on a social network private - one of the major problems with Facebook is that they have gradually eroded privacy protections on their site. People who conscientiously set their privacy settings have repeatedly had to scramble to patch the holes that Facebook keeps adding. (There is a link in my original post that demonstrates this well.)

And I'm sorry, but "if you're not comfortable with putting it out there" means that people cannot use the power of Facebook to its full potential. As I have already demonstrated, people can be discriminated against for participating in perfectly legal (and moderate!) political and social activities, and this discrimination takes the form of inability to gain or keep employment. Employers are increasingly using Facebook as a form of "background check." (Google "Facebook background check" and you'll come across a number of articles.)

Corporate America has more than enough power over the American people as it stands; they don't need the ability to control their employees' political activities, too.

Laura said...

Not to mention any ex's or wannabe stalkers can now see anything you post or do on FB. I really don't want my ex husband to know everything I like to do, read, watch, etc. I don't want to share my political and religious ideas with a court as I am engaged in a custody battle. I removed everything from my fb. My friends will now have to get to know me the old fashioned way: through conversation. But it makes me sad because that's something I liked about fb in the past. :( It's not that I have anything to hide, it's just that there are things I don't want the entire world to know just by searching for my name on fb. It's easy to judge someone when you don't have all the facts: just a few pictures and likes.

Spekkio said...

Laura, thank you for sharing your perspective. I didn't even think about relationships or custody battles, but what you say makes perfect sense.

There was a case in the news recently where a family was not permitted to adopt a child because they don't allow pork in their home - religious reasons. Most reasonable people would say that a kid can be raised perfectly well without frickin' pork chops, and it would be better to have an adopted family than be somewhere where you can have a nice ham. I can just imagine some overzealous lawyer or social worker deciding that your interests (as determined via Facebook) indicate that you might be a bad parent.

Your comment re: context is also a very good one, and it's another reason why I'm inclined to think that we need to increase federal protections so that we can enjoy our private lives without fear of harm or retribution. I vaguely recall someone being denied a teaching job because there was a picture of them online with a plastic cup of beer. Oh gasp, a teacher drinking beer. Oh no. The horror. The horror.

julie said...

Great article. I think you hit the major points and your links were very helpful. Thank you.