Privacy issues of social networking sites

The advent of the Web 2.0 has caused social profiling and is a growing concern for internet privacy.^[1] Web 2.0 is the system that facilitates participatory information sharing and collaboration on the Internet, in social networking media websites like Facebook and MySpace.^[1] These social networking sites have seen a boom in their popularity starting from the late 2000s. Through these websites many people are giving their personal information out on the internet.

These social networks keep track of all interactions used on their sites and save them for later use.^[2] Issues include cyberstalking, location disclosure, social profiling, 3rd party personal information disclosure, and government use of social network websites in investigations without the safeguard of a search warrant.

History

Prior to the social networking site explosion over the past decade, there were early forms of social network technologies that included online multiplayer games, blog sites, news groups, mailings lists and dating services. These all created a backbone for the new modern sites, and even from the start of these older versions privacy was an issue. In 1996, a young woman in New York City was on a first date with an online acquaintance and later sued for sexual harassment, after her date tried to play out some of the sexual fantasies they had discussed while online. This is just an early example of many more issues to come regarding internet privacy.^[3]

Issues

Cyberstalking and location disclosure

With the creation of sites like Facebook, many people are giving their personal information out on the internet. Most users are not aware that they can modify the privacy settings and unless they modify them, their information is open to the public. Sites such as Facebook and Twitter have grown popular by broadcasting status updates featuring personal information such as location. Some applications border on "cyberstalking." This has redefined the role of Internet privacy as overlapping with that of security.

Some applications are explicitly centered on "cyberstalking." An application named "Creepy" can track a person's location on a map using photos uploaded to Twitter or Flickr. When a person uploads photos to a social networking site, others are able to track their most recent location. Some smart phones are able to embed the longitude and latitude coordinates into the photo and automatically send this information to the application. Anybody using the application can search for a specific person and then find their immediate location. This poses many potential threats to users who share their information with a large group of followers.^[4]

Facebook "Places," is a Facebook service, which publicizes user location information to the networking community. Users are allowed to "check-in" at various locations including retail stores, convenience stores, and restaurants. Also, users are able to create their own "place," disclosing personal information onto the Internet. This form of location tracking is automated and must be turned off manually. Various settings must be turned off and manipulated in order for the user to ensure privacy. According to epic.org, Facebook users are recommended to: (1) disable "Friends can check me in to Places," (2) customize "Places I Check In," (3) disable "People Here Now," and (4) uncheck "Places I've Visited.".^[5] Moreover, the Federal Trade Commission has received two complaints in regards to Facebook’s "unfair and deceptive" trade practices, which are used to target advertising sectors of the online community. "Places" tracks user location information and is used primarily for advertising purposes. Each location tracked allows third party advertisers to customize advertisements that suit one’s interests. Currently, the Federal Trade Commissioner along with the Electronic Privacy Information Center are shedding light on the issues of location data tracking on social networking sites.^[5]

Social profiling and 3rd party disclosure

The Privacy Act of 1974 states:

"No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains [subject to 12 exceptions]." 5 U.S.C. § 552a(b).

Disclosure in this context refers to any means of communication, be it written, oral, electronic or mechanical. This states that agencies are forbidden to give out, or disclose, the information of an individual without being given consent by the individual to release that information. However it falls on the individual to prove that a wrongful disclosure, or disclosure in general, has occurred.^[6] Because of this social networking sites such as Facebook ask for permission when a third-party application is requesting the users information.

Although The Privacy Act of 1974 does a lot to limit privacy invasion through third party disclosure, it does list a series of twelve exceptions that deem disclosure permissible:

1. For members of an agency who need such information "in the performance of their duties".

2. If the Freedom of Information Act requires such information

3. If the information that is disclosed "is compatible with the purpose for which it was collected".

4. If the Bureau of Census needs such information to complete a particular census.

5. If the third party explicitly informs the individual that the information collected will serve only as a form of "statistical research" and is not "individually identifiable".

6. If it is historically relevant to be added to the National Archives and Records Administration.

7. If such information was requested by a law enforcement agency.

8. If such information is deemed beneficial to the "health or safety of an individual".

9. If such information is requested by the House of Congress or by one of its subcommittees.

10. If such information is requested by the head of the General Accountability Office or by one "of his authorized representatives".

11. If such information is requested through a court order.

12. If such information is requested through the Debt Collection Act.^[6]

Social profiling allows for Facebook and other social networking media websites of filtering through the advertisements, assigning specific ones to specific age groups, gender groups, and even ethnicities.^[1]

Data aggregation sites like Spokeo have highlighted the feasibility of aggregating social data across social sites as well as integrating it with public records. A 2011 study ^[7] highlighted these issues by measuring the amount of unintended information leakage over a large number of users with varying number of social networks. It identified and measured information that could be used in attacks against what-you-know security.

Studies ^[8][9] have also pointed to most social networks unintentionally providing 3rd party advertising and tracking sites with personal information. It raises the issue of private information inadvertently being sent to 3rd party advertising sites via Referrer strings or cookies.

Invasive privacy agreements

Another privacy issue with social networks is the privacy agreement. The privacy agreement states that the social network owns all of the content that users upload. This includes pictures, videos, and messages are all stored in the social networks database even if the user decides to terminate his or her account.^[10]

Preteens and early teenagers

The most vulnerable victims of private-information-sharing behavior are preteens and early teenagers. There have been age restrictions put on numerous websites but how effective they are is debatable. Findings have discovered that informative opportunities regarding internet privacy as well as concerns from parents, teachers, and peers, play a significant role on impacting the internet user’s behavior towards online privacy.^[11][12] Additionally, other studies have also found that the heightening of adolescents’ concern towards their privacy will also lead to a greater probability that they will utilize privacy-protecting behaviors.^[13] In the technological culture that society is developing into, not only adolescents’ and parent’s awareness should be risen, but society as a whole should acknowledge the importance of online privacy.

Law enforcement prowling the networks

The FBI has dedicated undercover agents on Facebook, Twitter, MySpace, LinkedIn. The rules and guidelines to the privacy issue is internal to the Justice Department and details aren't released to the public. Agents can impersonate a friend, a long lost relative, even a spouse and child. This raises real issues regarding privacy. Although people who use Facebook, Twitter, and other social networking sites are aware of some level of privacy will always be compromised, but, no one would ever suspect that the friend invitation might be from a federal agent whose sole purpose of the friend request was to snoop around. Furthermore, Facebook, Twitter, and MySpace have personal information and past posts logged for up to one year; even deleted profiles, and with a warrant, can hand over very personal information. One example of investigators using Facebook to nab a criminal is the case of Maxi Sopo. Charged with bank fraud, and having escaped to Mexico, he was nowhere to be found until he started posting on Facebook. Although his profile was private, his list of friends was not, and through this vector, they eventually caught him.^[14]

In recent years, some state and local law enforcement agencies have also begun to rely on social media websites as resources. Although obtaining records of information not shared publicly by or about site users often requires a subpoena, public pages on sites such as Facebook and MySpace offer access to personal information that can be valuable to law enforcement.^[15] Police departments have reported using social media websites to assist in investigations, locate and track suspects, and monitor gang activity.^[16][17]

'Mob rule'

In the UK, Lord Justice Leveson, author of the Leveson Report on the ethics of the British press, has drawn attention to the need to take action on protecting privacy on the internet, which he describes as having become a global megaphone for gossip: "There is not only a danger of trial by Twitter, but also of an unending punishment, and no prospect of rehabilitation, by Google".^[18]

Social networks

Facebook

Facebook has been scrutinized for a variety of privacy concerns due to changes in its privacy settings on the site generally over time as well as privacy concerns within Facebook applications. When Facebook first began in 2004, it was focused on universities and only those with .edu address could open an account. Furthermore, only those within your own university network could see your page. Some argue that initial users were much more willing to share private information for these reasons. As time went on, Facebook became more public allowing those outside universities, and furthermore, those without a specific network, to join and see pages of those in networks that were not their own. In 2006 Facebook introduced the News Feed, a feature that would highlight recent friend activity. By 2009, Facebook made "more and more information public by default." For example, in December 2009, "Facebook drastically changed its privacy policies, allowing users to see each others’ lists of friends, even if users had previously indicated they wanted to keep these lists private". Also, "the new settings made photos publicly available by default, often without users’ knowledge." ^[19]

Facebook recently updated its profile format allowing for people who are not "friends" of others to view personal information about other users, even when the profile is set to private. However, As of January 18, 2011 Facebook changed its decision to make home addresses and telephone numbers accessible to third party members, but it is still possible for third party members to have access to less exact personal information, like one’s hometown and employment, if the user has entered the information into Facebook . EPIC Executive Director Marc Rotenberg said "Facebook is trying to blur the line between public and private information. And the request for permission does not make clear to the user why the information is needed or how it will be used."^[20]

Breakup Notifier is an example of a Facebook "cyberstalking" app that has recently been taken down. Essentially, the application notifies users when a person breaks up with their partner through Facebook, allowing users to instantly become aware of their friend's romantic activities. The concept became very popular, with the site attracting 700,000 visits in the first 36 hours; people downloaded the app 40,000 times. Just days later, the app had more than 3.6 million downloads and 9,000 Facebook likes.^[21]

It was only in 2008, four years after the first introduction of Facebook, that Facebook decided to create an option to permanently delete information. Until this point in time, it was only an option to deactivate a Facebook which still left the user's information within Facebook servers. After thousands of users complaints, Facebook obliged and created a tool which was located in the Help Section but later removed. To locate the tool to permanently delete a user's Facebook, he or she must manually search through Facebook's Help section by entering the request to delete the Facebook in the search box. Only then will a link be provided to prompt the user to delete his or her profile.^[22]

These new privacy settings enraged some users, one of whom claimed, "Facebook is trying to dupe hundreds of millions of users they’ve spent years attracting into exposing their data for Facebook’s personal gain." However, other features like the News Feed faced an initial backlash but later became a fundamental and very much appreciated part of the Facebook experience. In response to user complaints, Facebook continued to add more and more privacy settings resulting in "50 settings and more than 170 privacy options." However, many users complained that the new privacy settings were too confusing and were aimed at increasing the amount of public information on Facebook. Facebook management responded that "there are always trade offs between providing comprehensive and precise granular controls and offering simple tools that may be broad and blunt."^[19] It appears as though users sometimes do not pay enough attention to privacy settings and arguably allow their information to be public even though it is possible to make it private. Studies have shown that users actually pay little attention to "permissions they give to third party apps."^[23]

Most users are not aware that they can modify the privacy settings and unless they modify them, their information is open to the public. On Facebook privacy settings can be accessed via the drop down menu under account in the top right corner. There users can change who can view their profile and what information can be displayed on their profile.^[10] In most cases profiles are open to either "all my network and friends" or "all of my friends." Also, information that shows on a user's profile such as birthday, religious views, and relationship status can be removed via the privacy settings.^[24] If a user is under 13 years old they are not able to make a Facebook or a MySpace account, however, this is not regulated.^[10]

Although Zuckerberg, the Facebook CEO, and others in the management team usually respond in some manner to user concerns, they have been unapologetic about the trend towards less privacy. They have stated that they must continually "be innovating and updating what our system is to reflect what the current social norms are." Their statements suggest that the Internet is becoming a more open, public space, and changes in Facebook privacy settings reflect this. However, Zuckerberg did admit that in the initial release of the News Feed, they "did a bad job of explaining what the new features were and an even worse job of giving you control of them."^[19]

Facebook’s privacy settings have greatly evolved and are continuing to change over time. Zuckerberg “believes the age of privacy is ‘over,’ and that norms have evolved considerably since he first co-founded the social networking site.” ^[25] Additionally, Facebook has been under fire for keeping track of one’s Internet usage whether users are logged in to the social media site or not. A user may notice personalized ads under the 'Sponsored' area of the page. “The company uses cookies to log data such as the date, time, URL, and your IP address whenever you visit a site that has a Facebook plug-in, such as a ‘Like’ button.”.^[26] Facebook claims this data is used to help improve one’s experience on the website and to protect against ‘malicious’ activity. Another issue of privacy that Facebook uses is the new facial recognition software. This feature includes the software to identify photos that users are tagged in by developing a template based on one’s facial features.

Similar to Rotenberg’s claim that Facebook users are unclear of how or why their information has gone public, recently the Federal Trade Commission and Commerce Department have become involved. The Federal Trade Commission has recently released a report claiming that Internet companies and other industries will soon need to increase their protection for online users. Because online users often unknowingly opt in on making their information public, the FTC is urging Internet companies to make privacy notes simpler and easier for the public to understand, therefore increasing their option to opt out. Perhaps this new policy should also be implemented in the Facebook world. The Commerce Department claims that Americans, "have been ill-served by a patchwork of privacy laws that contain broad gaps,".^[27] Because of these broad gaps, Americans are more susceptible to identity theft and having their online activity tracked by others.

Internet privacy and Facebook advertisements

The illegal activities on Facebook are very wild, especially "phishing attack" which is the most popular way of stealing other people’s passwords. The Facebook users are led to land on a page where they are asked for their login information, and their personal information is stolen in that way. According to the news from PC World Business Center which was published on April 22, 2010, we can know that a hacker named Kirllos illegally stole and sold 1.5 million Facebook IDs to some business companies who want to attract potential customers by using advertisements on Facebook. Their illegal approach is that they used accounts which were bought from hackers to send advertisements to friends of users. When friends see the advertisements, they will have opinion about them, because "People will follow it because they believe it was a friend that told them to go to this link," said Randy Abrams, director of technical education with security vendor Eset.^[28] There were 2.2232% of the population on Facebook that believed or followed the advertisements of their friends.^[29] Even though the percentage is small, the amount of overall users on Facebook is more than 400 million worldwide. The influence of advertisements on Facebook is so huge and obvious. According to the blog of Alan who just posted advertisements on the Facebook, he earned $300 over the 4 days. That means he can earn $3 for every $1 put into it.^[30] The huge profit attracts hackers to steal users’ login information on Facebook, and business people who want to buy accounts from hackers send advertisements to users’ friends on Facebook.

Spokeo

Spokeo is a "people-related" search engine with results compiled through data aggregation. The site contains information such as age, relationship status, estimated personal wealth, immediate family members and home address of individual people. This information is compiled through what is already on the internet or in other public records, but the website does not guarantee accuracy.

Spokeo has been faced with potential class action lawsuits from people who claim that the organization breaches the Fair Credit Reporting Act. In September, 2010, Jennifer Purcell claimed that the FCRA was violated by Spokeo marketing her personal information. Her case is pending in court. Also in 2010, Thomas Robins claimed that his personal information on the website was inaccurate and he was unable to edit it for accuracy. The case was dismissed because Robins did not claim that the site directly caused him actual harm.^[31] On February 15, 2011, Robins filed another suit, this time stating Spokeo has caused him "imminent and ongoing" harm.^[32]

Twitter

In January 2011, the USA government obtained a court order to force the social networking site, Twitter, to reveal information applicable surrounding certain subscribers involved in the WikiLeaks cases. This outcome of this case is questionable because it deals with the user’s First Amendment rights. Twitter moved to reverse the court order, and supported the idea that internet users should be notified and given an opportunity to defend their constitutional rights in court before their rights are compromised.^[33]

Twitter’s privacy policy states that information is collected through their different web sites, application, SMS, services, APIs, and other third parties. When the user uses Twitter’s service they consent to the collection, transfer, storage, manipulation, disclosure, and other uses of this information. In order to create a Twitter account, one must give a name, username, password, and email address. Any other information added to one’s profile is completely voluntary.^[34] Twitter’s servers automatically record data such as your IP address, browser type, the referring domain, pages visited, your mobile carrier, device and application IDS, and search terms. Any common account identifiers such as full IP address or username will be removed or deleted after 18 months.^[35]

Twitter allows people to share information with their followers. Any messages that are not switched from the default privacy setting are public, and thus can be viewed by anyone with a Twitter account. The most recent 20 tweets are posted on a public timeline.^[36] Despite Twitter’s best efforts to protect their users privacy, personal information can still be dangerous to share. There have been incidents of leaked tweets on Twitter. Leaked tweets are tweets that have been published from a private account but have been made public. This occurs when friends of someone with a private account retweet, or copy and paste, that person’s tweet and so on and so forth until the tweet is made public. This can make private information public, and could possibly be dangerous.^[37]

Another issue involving privacy on Twitter deals with users unknowingly disclosing their information through tweets. Twitter has location services attached to tweets, which some users don’t even know are enabled. Many users tweet about being at home and attach their location to their tweet, revealing their personal home address. This information is represented as a latitude and longitude, which is completely open for any website or application to access.^[38] WeKnowYourHouse is an example of a website that has taken this information and posted it online for anyone to see. They provide Twitter user’s names and personal addresses. The owner of the site stated that he created it as a warning to show how easy it is to find and reveal personal information without the right precautions.^[38] People also tweet about going on vacation and giving the times and places of where they are going and how long they will be gone for. This has led to numerous break ins and robberies.^[39] Twitter users can avoid location services by disabling them in their privacy settings.

Teachers and MySpace

Teachers’ privacy on MySpace has created controversy across the world. They are forewarned by The Ohio News Association^[40] that if they have a MySpace account, it should be deleted. Eschool News warns, "Teachers, watch what you post online."^[41] The ONA also posted a memo advising teachers not to join these sites. Teachers can face consequences of license revocations, suspensions, and written reprimands.

The Chronicle of Higher Education wrote an article on April 27, 2007, entitled "A MySpace Photo Costs a Student a Teaching Certificate" about Stacy Snyder.^[42] She was a student of Millersville University of Pennsylvania who was denied her teaching degree because of an allegedly unprofessional photo posted on MySpace, which involved her drinking with a pirate's hat on and a caption of "Drunken Pirate". As a substitute, she was given an English degree.

Other sites

Sites such as Sgrouples and Diaspora have attempted to introduce various forms of privacy protection into their networks, while companies like Safe Shepherd have created software to remove personal information from the net.^[43]

Internet privacy and Blizzard Entertainment

On July 6, 2010, Blizzard Entertainment announced that it would display the real names tied to user accounts in its game forums. On July 9, 2010, CEO and cofounder of Blizzard Mike Morhaime announced a reversal of the decision to force posters' real names to appear on Blizzard's forums. The reversal was made in response to subscriber feedback.^[44]

Academic studies

As technology continues to blossom in our current society, the critical issue of internet user’s privacy and private-information sharing behavior has been thoroughly researched. The global threat of internet privacy violations should expedite the spreading of awareness and regulations of online privacy, especially on social networking sites. Currently, studies have shown that people’s right to the belief in privacy is the most pivotal predicator in their attitudes concerning online privacy.^[45]

Facebook friends study

A study was conducted at Northeastern University by Alan Mislove and his colleagues at the Max Planck Institute for Software Systems, where an algorithm was created to try and discover personal attributes of a Facebook user by looking at their friend’s list. They looked for information such as high school and college attended, major, hometown, graduation year and even what dorm a student may have lived in. The study revealed that only 5% of people thought to change their friend’s list to private. For other users, 58% displayed university attended, 42% revealed employers, 35% revealed interests and 19% gave viewers public access to where they were located. Due to the correlation of Facebook friends and universities they attend, it was easy to discover where a Facebook user was based on their list of friends. This fact is one that has become very useful to advertisers targeting their audiences but is also a big risk for the privacy of all those with Facebook accounts.^[46]

Several issues pertaining to Facebook are due to privacy concerns. An article titled, Facebook and Online Privacy: Attitudes, Behaviors, and Unintended Consequences, examines the awareness that Facebook users have on privacy issues. This study shows that the gratifications of using Facebook tend to outweigh the perceived threats to privacy. The most common strategy for privacy protection – decreasing profile visibility through restricting access to friends – is also a very weak mechanism; a quick fix rather than a systematic approach to protecting privacy.^[47] This study suggests that more education about privacy on Facebook would be beneficial to the majority of the Facebook user population.

The study also offers the perspective that most users do not realize that restricting access to their data does not sufficiently address the risks resulting from the amount, quality and persistence of data they provide. Facebook users in our study report familiarity and use of privacy settings, they are still accepting people as "friends" that they have only heard of through other or do not know at all and, therefore, most have very large groups of "friends" that have access to widely uploaded information such as full names, birthdates, hometowns, and many pictures.^[47] This study suggests that social network privacy does not merely exist within the realm of privacy settings, but privacy control is much within the hands of the user. Commentators have noted that online social networking poses a fundamental challenge to the theory of privacy as control. The stakes have been raised because digital technologies lack "the relative transience of human memory," and can be trolled or data mined for information.^[48] For users who are unaware of all privacy concerns and issues, further education on the safety of disclosing certain types of information on Facebook is highly recommended.

See also

• Unauthorized access in online social networks

References