Facebook Privacy Watch

Facebook to unveil new privacy controls

2010-05-24T07:25:00.002+01:00

Facebook will respond to privacy concerns with new, simpler settings, executive Mark Zuckerberg writes in a Washington Post column today.

He says: "The biggest message we have heard recently is that people want easier control over their information. Simply put, many of you thought our controls were too complex. Our intention was to give you lots of granular controls; but that may not have been what many of you wanted. We just missed the mark."

Zuckerberg says the controls will be introduced in the coming weeks, and there will be an easy way to turn off "all third-party services".

He also explains Facebook's principles –

You have control over how your information is shared.
We do not share your personal information with people or services you don't want.
We do not give advertisers access to your personal information.
We do not and never will sell any of your information to anyone.
We will always keep Facebook a free service for everyone.

Quit Facebook Day - 31 May

2010-05-19T15:49:00.003+01:00

A website has been created where you can pledge to quit Facebook on 31 May. To date, more than 5,000 people have committed themselves to shutting down their accounts. What's interesting are the comments posted on the site. Infosolutionwiz writes, "Change your settings, don't put up your personal information, and stop complaining. If you don't want people to have personal information about you, DON'T POST IT IN A PUBLIC FORUM. In addition, there is no privacy on the internet in any case... Anonymity is an illusion" In response, meh says that's not necessarily true if you have apps installed. The reply to that, naturally, is not to install apps.

It's an interesting conundrum - I think people generally understand that their information on Facebook could be made public, but there's a difference between it automatically propagating all over the internet like a virtual billboard, and information appearing only if you look hard enough, like the classifieds section of a newspaper. Clearly there's a demand for information to be as private as possible, and for that information to be handled with care. Furthermore, while it's true that the internet is "public", we do do private transactions every day when we shop and bank online (although some of our information might be used by marketers or credit reference agencies). So why can't we trust our Facebook information be treated as such? Right now, it appears a lot of us can't.

Update: More than 13,000 people have now signed up.

Facebook to introduce "simplistic" privacy bands

2010-05-18T23:39:00.000+01:00

After the huge backlash regarding Facebook's confusing privacy settings, Facebook is poised to introduce "simplistic" settings that show privacy bands. But will it work? And would they have done this if there wasn't a huge fuss?

In a radio interview, head of public policy Tim Sparapani said that: "Now we’ve heard from our users that we have gotten a little bit complex. I think we are going to work on that. We are going to be providing options for users who want simplistic bands of privacy that they can choose from and I think we will see that in the next couple of weeks."

During the interview Sparapani defended Facebook's privacy settings and said that it was better than having none at all, and the reason why there were so many settings was because every element of information could be adjusted to a certain level of privacy.

Reclaim Privacy - the Facebook widget

2010-05-18T23:22:00.001+01:00

Reclaim Privacy
I noticed a great little widget that you can use on Facebook that tells you what information you might be sharing with others. Simply go to www.reclaimprivacy.org and click and drag the "scan for privacy" link to the widget to your bookmark bar (if you're unsure, the site has some great help files). Then log into Facebook and click the bookmark. You'll see in the grab below that thankfully I'm protected from a lot of my information being made public. The "caution" amber field tells me to beware of a few settings. In this example, some of my contact information is exposed to the whole internet. You can access and fix the relevant privacy settings, then click and re-scan. Easy. Already 30,000 people have become a fan of the Reclaim Privacy page on Facebook.

Facebook: the privacy backlash

2010-05-18T23:18:00.004+01:00

Facebook has gone rogue. Facebook has had its MySpace moment. Facebook is becoming too big for its own boots. You cannot expect your profile to be private anymore without a degree in Facebook privacy settings. It's time for an open alternative to Facebook as this Wired article proposes.

http://www.wired.com/epicenter/2010/05/facebook-rogue/

The sad truth mentioned in the article is that the reason Facebook has made so many privacy settings open by default is because you can't be online and expect things to be private anymore. Facebook founder Mark Zuckerberg said it himself to a live audience this year. His exact words were:

People have really gotten comfortable not only sharing more information and different kinds, but more openly and with more people. That social norm is just something that has evolved over time.
"We view it as our role in the system to constantly be innovating and be updating what our system is to reflect what the current social norms are."A lot of companies would be trapped by the conventions and their legacies of what they've built, doing a privacy change - doing a privacy change for 350 million users is not the kind of thing that a lot of companies would do. But we viewed that as a really important thing, to always keep a beginner's mind and what would we do if we were starting the company now and we decided that these would be the social norms now and we just went for it."

Although everything is out in the open, the excuse is misguided. These "norms" have formed, arguably, because of sites like Facebook that make it so easy for us to share information, and people don't always assume that this information can be read by anyone. They don't necessarily want these to be the "norm". Facebook has forced the norm upon us.

Facebook's bewildering privacy options: in graphic form

2010-05-15T13:03:00.001+01:00

The New York Times recently attempted to explain the plethora of privacy options available on Facebook and how this has changed over the years. As I blogged earlier, the privacy policy has more words than the US Constitution. Flickr, the photo sharing site, only has about 350 words in its privacy policy; Facebook has upwards of 5,000.

Even if you lock your privacy policy down, your friends can still share some of your information with third-party applications: check to see exactly what's being shared. I don't recall which ones of these are ticked/checked by default but some of the information includes relationship status and political views.

http://www.nytimes.com/interactive/2010/05/12/business/facebook-privacy.html

Public status updates - how much is out there?

2010-05-15T12:55:00.002+01:00

This proof of concept site, called Openbook, shows just how much information Facebook users leave open to the world.

http://willmoffat.github.com/FacebookSearch

As the creators of Openbook explain, Facebook "do not go a good job of indicating how public each piece of information you share on the site will be. Second, they change the rules far too often. If you understood Facebook's privacy settings two years ago (or even six months ago) that information would be worse than useless with today's bewildering settings."

Take a look at the information people share - whether they like it or not.

Facebook in crisis mode

2010-05-14T09:46:00.002+01:00

A report this week by the New York Times revealed that Facebook's privacy policy has 50 different settings and 170 options. The paper also found that the policy is longer than the US Constitution with 5,830 words.

Facebook's employees have been holding meetings after many people have begun complaining of the way it's been handling members' data lately, the BBC reports. This isn't the first time of course that Facebook has been the brunt of criticism from privacy campaigners and everyday folk concerned about Facebook's privacy policies. But recently, things have been particularly fraught.

Last week, TechCrunch reported how a security hole – which was quickly patched – allowed you to view your friends' live chats (ironically via a privacy feature that let you view how your page looks to other people).

And a couple of weeks back, Facebook announced a major initiative which would link your profile to the underlying architecture of the web using the "Like" feature, thus extending its reach and power beyond the walls of its web page. Businesses and other organisations can put the "Like" widget onto their web pages, and people can instantly become a Facebook fan of the said product/person/organisation. But a security setting within Facebook lets third party websites use your info for marketing and "personalisation" services. You can choose to "allow select partners to instantly personalise their features with my public information when I first arrive on their websites". Some people I know had this box already ticked!!

We're back - kind of

2010-05-12T19:18:00.000+01:00

It's been more than a year since I've updated this blog, and that is an absolutely massive length of time in the world of the web. And particularly in the world of Facebook and its privacy policy!

In the past year we've seen Facebook make some massive changes to the way people interact with it. I'll try and find an opportunity to resurrect this blog soon!

The evolution of privacy on Facebook

2010-05-12T19:14:00.000+01:00

This makes for fascinating reading: how much private data on Facebook has become available to everyone else. Go check your privacy settings!

http://mattmckeon.com/facebook-privacy

Users vote for Facebook control

2009-04-24T16:50:00.002+01:00

After a week-long vote, Facebook members have voted overwhelmingly in favour of a new set of terms and conditions that give them the right to ask Facebook to delete personal data retained on the site after they leave the site.

Facebook gets another makeover

2009-03-12T02:44:00.006Z

Facebook has revamped its interface yet again. Initial observations are as follows:

1. The site's news feed now follows a three column-layout. The far right column features 'highlights' - such as what groups your friends have joined, who or what they've become fans of, who was tagged, and so on. These no longer appear jumbled up in the news feed - instead, the middle column consists soley of status updates! The left column is a list of main apps like photos, videos, events, public profiles and so on.
2. Profile thumbnails are no longer square, they have rounded edges. Is this meant to make you feel all warm and fuzzy?
3. Twitter (I have the Twitter app installed) has automatically appeared in my sidebar - clearly, Facebook is feeling the threat.
4. Status updates ask you: What's on your mind? (See point 3)
5. Public Profile updates, like Barack Obama's, now appear in your news feed. You can choose to 'hide' these.
6. Default text is much larger but chat text is still very small.

Facebook founder speaks to BBC

2009-02-28T17:59:00.006Z

Facebook founder Mark Zuckerberg has spoken to the BBC in a rare video interview about the recent concerns surrounding the company's privacy issues.

He said: "The person who's putting the content on Facebook always owns the information... They want to share it with only a few people and it's important that the information only goes to those people."

He added: "We're not going to sell or share the information except with the people that they've asked it to be shared."

Zuckerberg said that the advertising on the site has grown quickly and that is how it will make its money. And would not sell people's information on in order to do so. But to a lesser degree, Facebook is providing demographic information - not personally identifiable, but still personal information nonetheless - to advertisers.

Online advertisements need to be targeted to relevant markets. Let's look at how GMail works, for instance. I know my information remains personal, but the site still scans my emails for keywords and displays relevant advertisements down the site of the page that relate to those keywords. Effectively, my information is still being used for profit. The same thing happens on Facebook but to a greater degree. I've used its ad service, and have managed to narrow down demographics in order to buy targeted ads, and narrow down the number of targeted users by interest, age, relationship status and more.

Like I said, this isn't personally identifiable. But it means that your information is still being used for advertising, whether you like it or not.

Facebook: privacy vs advertising

2009-02-25T18:01:00.003Z

The kerfuffle over Facebook's privacy policy continues.

PC World magazine has a good summary of the whole saga, along with interviews with the Electronic Privacy Information Center, who was about to lodge a formal 25-page complaint with the Federal Trade Commission before Facebook said it would revert to its old terms. Excecutive director Marc Rotenberg said: "We've been in this situation before with other companies that have really dug in their heels and tried to fight it out in the courts and the media. I think Facebook did the right thing."

Another interesting point from Rotenberg is how Facebook is meant to make money. Of course, it's with our data.

One new concern already on the horizon comes with Facebook's updated advertising models. The site is now utilizing APIs [application program interfaces] to pull user data off of status updates, Rotenberg says, then use it within ads placed on the page.

"People ... who care about privacy on Facebook typically don’t install applications, because they know that applications are pulling down a lot of their data. But if you're not installing applications and you learn that the information that you're putting in your status updates is being provided for advertising, you might be a little upset," Rotenberg says.
Source: PC World

Couple that with the column from Reuters; where the author discusses how Facebook, a private company, needs to make money through advertising, which is possibly at odds with people's privacy expectations. MySpace is not as popular these days as Facebook, but its garish straight-up advertising (which it does not need to spell out) - and its profitability - make it a good model for social networks.

Facebook's bill of rights and responsibilities

2009-02-22T12:20:00.002Z

Facebook's new Bill of Rights and Responsibilities group (80k members and counting) which was set up to debate how it should communicate its terms of service to users is a positive step. On the group, Facebook has responded to the most common questions asked by members:

1. You own your information. Facebook does not. This includes your photos and all other content.

2. Facebook doesn't claim rights to any of your photos or other content. We need a license in order to help you share information with your friends, but we don't claim to own your information.

3. We won't use the information you share on Facebook for anything you haven't asked us to. We realize our current terms are too broad here and they make it seem like we might share information in ways you don't want, but this isn't what we're doing.

4. We will not share your information with anyone if you deactivate your account. If you've already sent a friend a message, they'll still have that message. However, when you deactivate your account, all of your photos and other content are removed.

5. We apologize for the confusion around these issues. We never intended to claim ownership over people's content even though that's what it seems like to many people. This was a mistake and we apologize for the confusion.

Your own worst enemy

2009-02-22T11:59:00.003Z

The hysteria over Facebook's terms of service and what it can do with your content largely ignores the most obvious and important thing:

You and your friends are the ones with the capability to post information about you online, not Facebook. The trail of stuff that you leave behind on Facebook (like the 'random 25 things about me' meme going around at the moment), is left voluntarily. Do you trust your friends not to post embarrassing personal details on your Wall about what you got up to last night? Take a look at most of the archived entries in this blog: the vast majority of privacy issues have nothing to do with Facebook's terms of service. Privacy issues have all happened because people haven't understood how Facebook works. The dynamic of the online world is significantly different than the online world, in that a digital footprint remains and if you don't follow the rules, your content may be seen by people you don't want.

In addition to not opening your heart on to Facebook, use the privacy settings that are provided within Facebook - check out the 10 Privacy Settings Every Facebook User Should Know.

Facebook backtracks on Terms of Service

2009-02-18T09:38:00.003Z

After a huge community backlash about the fuzzy nature of Facebook's terms of service, the social networking website has reverted to its old Terms of Service while it figures out what to do.

While Facebook is hardly going to use your data any which way it pleases, it's certainly a step forward to try and make its Terms of Service clear.

Upon logging in, the following message appears:

Terms of Use Update
Over the past few days, we have received a lot of feedback about the new terms we posted two weeks ago. Because of this response, we have decided to return to our previous Terms of Use while we resolve the issues that people have raised. For more information, visit the Facebook Blog.

If you want to share your thoughts on what should be in the new terms, check out our group Facebook Bill of Rights and Responsibilities.

Does Facebook 'own' your data?

2009-02-17T04:47:00.004Z

Facebook quietly updated its terms of service last week, sparking outcry among consumer advocates who interpreted the changes as meaning that Facebook can do what it wants with your data at any time. Forever. Even when you leave the service.

The Consumerist weblog (it's part of the non-profit conusmer rights publication Consumer Reports) cited some pretty scary changes that Facebook made to its terms, which are the conditions you agree to when you use it. The Consumerist wrote:

'Facebook's terms of service used to say that when you closed an account on their network, any rights they claimed to the original content you uploaded would expire. Not anymore.
'Now, anything you upload to Facebook can be used by Facebook in any way they deem fit, forever, no matter what you do later. Want to close your account? Good for you, but Facebook still has the right to do whatever it wants with your old content. They can even sublicense it if they want.'

Facebook has since responded and defended itself, saying that the changes don't, apparently, give it carte blanche to do what it likes with your content, and if you deactivate your account, it will respect the privacy settings you had put in place prior.

What it does mean though is that your content won't be deleted from, say, a friend's Wall when you delete your Facebook account, in the same way that an email you send a friend won't be deleted when you delete your email account. A representative from Facebook told The Industry Standard:

'We are not claiming and have never claimed ownership of material that users upload. The new Terms were clarified to be more consistent with the behavior of the site. That is, if you send a message to another user (or post to their wall, etc...), that content might not be removed by Facebook if you delete your account (but can be deleted by your friend). Furthermore, it is important to note that this license is made subject to the user's privacy settings. So any limitations that a user puts on display of the relevant content (e.g. To specific friends) are respected by Facebook. Also, the license only allows us to use the info "in connection with the Facebook Service or the promotion thereof." Users generally expect and understand this behavior as it has been a common practice for web services since the advent of webmail. For example, if you send a message to a friend on a webmail service, that service will not delete that message from your friend's inbox if you delete your account.'

After the outcry from Facebook users, who set up protest groups such as 'FACEBOOK OWNS YOU: Protest the new changes to the TOS!', founder Mark Zuckenberg responded on the official company blog, clarifying that the terms were changed to make it clearer that information may appear in two places, such as when a person sends a message to a friend.

'We think this is the right way for Facebook to work, and it is consistent with how other services like email work,' he wrote, adding that 'in reality, we wouldn't share your information in a way you wouldn't want. The trust you place in us as a safe place to share information is the most important part of what makes Facebook work. Our goal is to build great products and to communicate clearly to help people share more information in this trusted environment.'

What Zuckenberg acknowledged was that, 'We're at an interesting point in the development of the open online world where these issues are being worked out. It's difficult terrain to navigate and we're going to make some missteps, but as the leading service for sharing information we take these issues and our responsibility to help resolve them very seriously.'

The interesting thing about all this is that Facebook hasn't amended the terms of service to make it clearer to users. Why doesn't it just give an example like the one they mentioned about about how your content might still stay on their system? Why does the fine print have to include so much legalese? Google has a privacy page that gives examples in plain English about how your data is used, and why.

Also, the way Facebook works isn't just like someone's inbox - it has public parts, semi-public parts, photos and applications. It's a completely different dynamic. All very interesting stuff!

Facebook vigilantes publish alleged arsonist's image

2009-02-16T13:52:00.004Z

This is one of the more interesting days when it comes to privacy and Facebook, as it opens whole new areas - that of internet publishing, the law, the right to a fair trial, free speech and people taking the law into their own hands.

Australia has had its worst bushfires for some time - 200 people have been killed, countless homes destroyed. The country's citizens are angry, particularly because some of the fires were deliberately lit. Who on earth could be responsible for such a horrific act?

Well, Victorian Police have arrested and named one man who is alleged to have been involved in the arson, Brendan Sokaluk. Australian publications are not allowed to publish his photo, in conjunction with court suppression orders. If they do, they could be deemed in sub judice contempt. And an 'Australian' publication means anything that is published in Australia, so it therefore extends to foreign-hosted websites.

However, as soon as he was named, vigilantes trawled his MySpace and found his photograph - a photo of a bulky, nondescript man with a small keyring digital camera aimed at a mirror. They copied the image, mirrored the page, sent it around and began setting up groups on Facebook all showing his image and sporting names such as:

"Brendan Sokaluk, the Victoian [sic] Bushfires Arsonist, must burn in hell." (Arguably such a knee-jerk reaction that they couldn't even spell Victorian correctly.)
"TOURTURE [sic] AND KILL Brendan Sokaluk GIPSLAND ARSONIST!!!" (Again, another typo as the fuming vigilante sweats over the keyboard, with caps lock down.)
"make it know [sic] Brendan Sokaluk is the man who was arrested for arson."

Some of these groups are attracting 3,000 or more members, and the descriptions of what they want to do to the alleged arsonist are quite vile. What the 'vigilantes' fail to realise is that by venting their anger in this way they could actually stop Sokaluk from receiving a trial altogether, because it would arguably mean they could not find any objective jurors. In a worst-case scenario, Sokaluk may not even go to trial, if his defence lawyers apply for a trial to be stopped for this reason.

Individuals may also be in contempt of court; as the law does not necessarily apply just to publishing companies.

The other issue the existence of these groups raise is what Facebook should be doing in terms of the content it allows on its site. As it is important to encourage free speech and debate where does one draw the line when it comes to inciting violence? At the moment Facebook is keeping quiet and the groups remain online.

Wife finds out about divorce on Facebook

2009-02-06T16:10:00.004Z

"Neil Brady has ended his marriage to Emma Brady," read the Facebook update, broadcast to all of Neil's friends.

Neil, filing for divorce from Emma, had changed his relationship status in his Facebook settings.

Public humiliation? Or a misjudged privacy setting? We may never know, but Emma Brady only found out what was happening to her marriage when a friend told her!

Someone in Canada had even commented on Neil's status update, saying he was 'better off out of it'.

Emma said she was 'shell-shocked' at the revelation.

Source: Daily Mail

How your private photos Facebook can be made public

2009-02-01T13:51:00.007Z

A few months back we discussed Facebook photo album privacy settings and how you can make sure your bosses don't see those Christmas party shots, for instance. And a few days ago we explained what content is viewable when you are logged out, including photos.

But there are still a couple of ways in which your photo albums - and your friends' pics - can be seen by people outside your immediate circle (including ones who refuse to join Facebook) regardless of privacy settings. You would think that if you set your album to be viewed only by 'friends' that no one else could see them.

This isn't necessarily true.

Unique album URL method:
When logged in and viewing your photos, there's a special album URL (web address) displayed at the bottom of the screen. It takes the form (where the Xs represent random numbers/letters):

http://www.facebook.com/album.php?aid=xxxxx&l=xxxxxx&id=YOURFACEBOOKIDNUMBER

This is a unique URL and if people don't know it they won't be able to access your album (there was a loophole last year, now fixed, that allowed people to easily circumvent this by guessing the string of characters the Xs represented). However, anyone who has the URL will be able to view the album even if they aren't on Facebook -- yes, even if you only wanted friends to view the album. So, if you email an album's address to 20 mates and they send it to all their friends, a lot more people than you intended could be viewing the album.

So, before we send that unique URL to our friends, we will consider who else might be told about it and the implications not only for ourselves, but for our friends.

Image URL method:
Go to anyone's album and click on an image thumbnail. Right-click the image and choose to copy the image's URL. You can paste the address (ctrl+V) into the address bar and view it even when logged out. You can also embed the image so it appears on other websites.

Oh, and here's a little 'Easter egg' - delete everything up to any forward slash in the image's URL, and you get this guy wearing a "Little Celtics Fan" bib. Now what's all that about?

Deleting my own content from Facebook

2009-02-01T13:25:00.004Z

What irritates me about Facebook is there's:

1) no easy way to delete my own content apart from clicking Edit > Delete on every post. When you have literally hundreds and possibly thousands of posts, this is more than a chore. You might be tempted to recruit professional Facebook Deleters to do the job for you.

2) no way to track the reams of content I've posted beyond my own profile. If I make a comment on Dave's profile or on the Muppets message board that I later think is inaccurate, how can I find a list of messages I've written and delete them? And what if someone is an impressionistic 16-year-old who forms some dangerous opinions which, in hindsight, they realise are ignorant and detrimental to future employment prospects? How can they find out where they posted the content so it won't be tied to their profile?

Facebook makes it so hard to do, and there is barely any information on deleting posts. So what can we do? Any suggestions on easy ways to manage where our own content is going and where?

Facebook content viewable when logged out

2009-01-27T16:18:00.008Z

Go to Facebook's simple, uncluttered homepage and you'd be forgiven for thinking that you can't see any of the content within the site unless you log in. Not so. A lot of information on Facebook is actually accessible through a web search (such as Google).

You'd be surprised at just how much information on Facebook is available to the wider public. While logged out of Facebook, I was able to find the following:

People's search results page (see above). This may include a list of your friends, as well as your photograph. Not only that, but you may be able to see the things that person is a "fan" of - there are a number of Facebook "Pages" dedicated to musicians, movies, brands and so on, and whatever Page you've joined is listed here. You can tell Facebook not to include your name and photo in search engine results via the privacy settings, and you can also choose not to have your friends and fan Pages viewable. But not all people do this.

Groups and Pages. Although surnames are not included in Groups and Pages when you click through to a search result, you can still view the content posted to a Group's website (such as the Jeff Buckley for Christmas Number 1 group). If people choose to let people find them via Google and the like, you can click through to their search results page (such as the one above), and this will include their surname.

Applications. Popular third-party widgets that people add to their Facebook profiles, such as games, are searchable. You can view the Application's Facebook page without having to log in, and see a list of fans. Again, if people's search results pages have been made public, you can click through to see their surname and possibly a list of their friends and fan Pages.

Photos. If you know the website address for a particular photo album, you'll be able to click through to view it without having to log in. This is not necessarily because the person creating the album has chosen to make it available to "Everyone" - I'll go into more detail on this later.

Trainee cops trawl web for knife gang evidence

2009-01-27T11:36:00.003Z

Rookie cops in Scotland have been scouring Facebook and other social networking sites to find pictures of youths wielding violent weapons like knives, in a bid to cut teen violence.

Much of the time the young people, evidently unaware that their acts of bravado are available to all and sundry, are posing in a public place such as a park, which is an illegal offence. If they are at home, the cops pay a visit to the teen and their parents.

Constable Holly McGee, 18, told BBC Newsbeat: "We're looking for anyone who is brandishing offensive weapons or blades. We take the date, the time, detail of what's in the photograph, [then] a copy of the photograph is printed out and thereafter it's all sent to the gangs task force unit."

Operation Access, as the project is called, has led to the questioning of 400 teenagers and has been declared a success.

Source: BBC Newsbeat

What Facebook collects about you

2009-01-09T21:11:00.005Z

Facebook's privacy policy is written in plain English, but there are still a few vague phrases kicking around. So, what stuff does Facebook hold on you?

Apart from the usual stuff all websites know about you when you visit (like the numerical identifier, called the IP address, that traces you back to your internet provider) Facebook says it holds personal information you "knowingly choose to disclose that is collected by us and Website use information collected by us as you interact with our Website". This essentially means everything you say and do on Facebook is collected, because everything you do on there is a knowing disclosure - right?

It also says "you provide us with certain personal information, such as your name, your email address, your telephone number, your address, your gender, schools attended and any other personal or preference information that you provide to us". Wow. I certainly haven't told it all of this stuff. I think I registered before you had to specify your gender, so it doesn't know this, either. If people make all of this stuff available for even close friends to view (and say a friend's account gets hacked), it's perfect fodder for an identity thief.

You also need to provide Facebook with your date of birth, because you need to say you're over 13 to use the service. I always provide my date of birth to identify myself when I call a bank.

Note: All this doesn't even apply to the third-party applications that you might have installed. As soon as you give them permission to install themselves on to your Facebook profile, they have access to your data, too. And in an earlier post we discussed Beacon, the feature that broadcast certain actions on third-party websites to your friends that you may have preferred to keep private.

Third parties that you haven't even given permission to access your profile can access aggregated information about you. It's not personally identifiable, but your actions are contributing to Facebook's bottom line. "We do this for purposes such as aggregating how many people in a network like a band or film and personalising advertisements and promotions so that we can provide you with Facebook. We believe this benefits you."

We believe this benefits Facebook, too, n'est-ce pas?

Oh, and most creepy of all, "We may use information about you that we collect from other sources, including but not limited to newspapers and Internet sources such as blogs, instant messaging services, Facebook Platform developers and other users of Facebook, to supplement your profile."

Huh? This is probably something Facebook will focus on more in the future, as information becomes more easily tied to individuals. Does this mean Facebook will be able to associate your profile with, say, a mention of you in a local newspaper? When you list your blog on your profile, will it scan the blog and tie it up with your likes/dislikes? And as Microsoft has a small stake in Facebook, and you list your Hotmail address to sign up - where will that end? Facebook says: "Where such information is used, we generally allow you to specify in your privacy settings that you do not want this to be done or to take other actions that limit the connection of this information to your Profile (e.g. removing photo tag links)."

What I don't like about Facebook is it doesn't make it easy to delete information about myself. If I need to delete things individually from my Wall, for instance - I can't do multiple deletes. Making it possible is one thing, but it's also quite difficult to do.

Madeliene mayhem

2009-01-09T20:58:00.002Z

Happy New year! The Facebook Privacy Watch team is back from their break and ready to share more stories for you.

Today's latest? A young UK Conservative party activist bragged on Facebook about dressing up as missing toddler Madeleine McCann at a New Year's bash.
Matthew Lewis was expelled from the political party and apologised "unreservedly" for his action, which may not have been widely discovered had he not boasted about it on the social networking site. His status update attracted many comments including: "Is this a cunning Baldrick style plan to obtain the reward money?"

A fool and their phone are soon parted...

2008-12-07T21:44:00.004Z

When I first joined Facebook I'd sometimes see people join groups with strange names such as: "I lost my digits!" or "Michael's phone got stolen... I need your numbers" or "Digits for Helen please" or "Like a drunken fool, I lost my phone."

I clicked on a few of these groups to see what they were about and invariably they would be about how someone had just been parted with their mobile/cell phone and needed to input everyone's numbers again. The groups would almost always be open and public.

On the surface you'd expect this to be a brilliant way to recruit your friends' numbers. But... all these groups can be seen by anyone! I have no idea who Rell is, but I know his friends and their numbers. Do a search for "lost phone" on Facebook and you'll see groups like: "Hey there I lost all yal numbers" - am loving the reply that says, "u never had mine but its 972-xxx-xxxx."

In the last year or so, I haven't see these groups pop up any more. I figured people had got the message. But today another friend joined a "lost phone" group.

Check it out for yourself. A few enterprising application developers have also conjured up third-party apps to make it "easy" for people to recruit numbers from friends, but I have two quick, ingenious and private ways for you to get those numbers back!

1. Back them up NOW... write them in a book, back up your sim... whatever.
2. If you and your phone get separated, maybe email your friends and get them to email your numbers to you.

Relax! :) Sounds obvious doesn't it. Not for the countless people who've joined someone's "lost phone" group and broadcast their number for you, me, and anyone else who cares to look.

Christmas party season means photo albums galore!

2008-12-06T21:39:00.003Z

Well, the Christmas party season has begun, and the images have started to pour into the Facebook photo album coffers. People, check them out! Not only for the brilliant gossip material, but for evidence of you looking a little worse for wear. No, that's not a Rorschach Blot - it is probably your bum from the office photocopier.

Had coffee today with a former work colleague. "Went to the office Christmas party," she told me. "You've probably seen the pictures that so-and-so put up?" Apparently, there were a few messy ones.

"No, she's not my Facebook friend."

Well, I didn't have to wait long to see her photos, as she'd tagged a mutual friend and her album was accessible by Friends of Friends!

Facebook notification settings reset: implications

2008-11-25T21:38:00.008Z

Today I received an email which may or may not have been from Facebook. It simply read:

Unfortunately, the settings that control which email notifications get sent to you were lost. We're sorry for the inconvenience. To reset your email notification settings, go to: http://www.facebook.com/editaccount.php?notifications
Thanks, The Facebook Team

I'm always on my guard when it comes to things like this, and feared it was a phishing scam where someone was trying to steal my details. After all, how could Facebook lose such important settings? Email notifications allow you to let Facebook send you alerts when something happens, so you don't have to constantly log into the site. But such alerts can be annoying -- you can get alerts for every tag, event or group invitation. So I've pretty much turned all of these off. Surely Facebook couldn't lose these settings?

Well, when I logged in to Facebook I got a similar message:

Logging into the notifications page, sure enough, most of my alerts had been reset so that I had to change THIRTY-TWO...(32) email alerts to "off".

Email alerts don't pose privacy problems as such; just annoying alerts (although if you use Facebook at work, such excessive alerts could be picked up by your IT/HR department so they can detect your activity). But the technical glitch does make you think of more serious scenarios, namely the loss of privacy settings. Does Facebook have these backed up? What if all privacy settings were suddenly reset and your profile was exposed to more people than you'd intended -- even though you, as a responsible and privacy-conscious Facebook user, had painstakingly set up your Facebook privacy profile?

I'm interested in hearing what Facebook has to say about it. In the meantime, I'm doing a screen shot or noting down my current privacy settings and double-checking a few things.

Teacher dismissed after Facebook faux pas

2008-11-24T11:19:00.005Z

A North Carolina teacher complaining on her Facebook profile of working "in the ghetto of Charlotte" was suspended last week and risks being dismissed. The move has prompted teachers in the area to revise their policies on staff's online behaviour. The teacher did not mean for her flippant remark to be viewed by all and sundry, but it was uncovered after a search of teachers in the area.

Juror dismissed after asking friends to help make a decision!

2008-11-24T11:03:00.001Z

All right, out of all the stupid things we've heard people do this week, this one takes the cake. A juror involved in a British child abduction and sexual assault case asked her Facebook friends to help make her decision!

Do these people not realise you aren't allowed to discuss these things even verbally, let alone on a public website? Geez!

Apparently, the woman said: "I don't know which way to go, so I'm holding a poll." She had not even turned on Facebook privacy settings.

Lady, check out the Facebook settings, sure, but don't risk contempt of court in the first place!

Inviting the whole world

2008-11-22T12:59:00.003Z

A girl's 16th birthday party was ruined when 60 youths gatecrashed the private event after reading about it on Facebook, The Daily Telegraph reports.

The owner of the south London Baba Foundation community centre - which doubles as a restaurant - said he was horrified when the massive gang appeared outside after reading about the party on Facebook.
Daniel Sisilu said he 'blamed himself' for the trouble last Saturday after putting only one bouncer on the door.
He said he only agreed to the party because he was friend's with the teenage girl's mother.
He said: "I blame myself and I totally regret this. But I've been totally had.
"If you put an invite on Facebook then you are inviting the whole world to come along."

Source: The Daily Telegraph

Events on Facebook are a handy way to coordinate parties and get-togethers. But many events are not made closed, meaning the details are technically readable by all and sundry. If you're a member of a network, your event may even be accessible via the network's home page!

Your friends' applications are sucking your data!

2008-11-21T00:16:00.008Z

Sounds like a long-winded B-grade horror movie title, doesn't it? Your friends' applications are sucking your data! But these third-party applications are very likely siphoning personal info from your profile, if you haven't adjusted privacy settings.

Confused? It's like this: each time your friends add an application, your info could be shared with developers whose applications you haven't even installed! This even extends to things like the type of relationship you're looking for, religious views, even your Wall!

Granted, not all these are on by default. But it shows how much Facebook developers can (and I hate this term but I'm going to use it) drill down to minute detail. Think of what marketers can do with this data!

To find out what info you're sharing, go to the Application Privacy page (under Privacy), and look at What Other Users Can See via the Facebook Platform. You can see a list of things that you can or can't share:

Share my name, networks, and list of friends, as well as the following information:
Profile Picture
Basic Info
Personal info (activities, interests, etc.)
Current location (i.e. town, city etc)
Education history
Employment history
Profile status
Wall
Notes
Groups I belong to
Events I'm invited to
My Photos
Photos of me
Relationship status
Online presence
What type of relationship I'm looking for
Which gender I'm interested in
Who I'm in a relationship with
Religious views

Tick or untick as appropriate. As you can see, you have no choice but to share your name, network and list of friends.

If you want absolutely nothing shared, then underneath this box, you may see "Do not share any information about me through the Facebook API". But very likely, if you've added any applications, this will be grayed out. Click on "Why can't I see this?" and you'll see this explanation:

You are unable to fully opt out of sharing information through Facebook Platform because you are currently using applications built on Platform. To enable this option, you need to remove any applications you have added, and remove your permissions to all external applications that you may have used.

Basically, this means you'll need to uninstall all the applications in order to turn off all sharing.

Deleting applications: Are they really gone?

2008-11-20T23:59:00.002Z

Facebook has lots of fun third-party applications you can add to your profile. Where you've travelled, IQ tests, movies and books you've read, games, quizzes and so on. If, for some reason, you no longer want these applications, you can click the Applications tab at the bottom of any Facebook page (once logged in) and delete or block as appropriate.

So, problem solved, huh? You won't get bombarded with vampire spam or endless quiz invitations. Well, not really. Every application I've uninstalled and then reinstalled, with no exception, has remembered my previous scores, settings and personal information I've inputted. The Trip Advisor map remembers the cities I've pinned, the IQ Test app remembers my IQ, even the Hatching Eggs remembers what eggs I've send and received. Nothing's really been deleted. It's the equivalent of deleting a desktop shortcut icon but not the application itself.

This is a serious risk to privacy. When you install third-party applications, you really are adhering to privacy policies outside of Facebook. Rather than add them willy-nilly, it's essential to read individual privacy policy statements. Can't find any? Then seriously think of the ramifications of adding the application. If it's just a game, then it's not so bad. But all the books and TV shows you've read and watched? Can that info be deleted?

Facebook's privacy policy states:

...third party developers who have created and operate Platform Applications ("Platform Developers"), may also have access to your personal information (excluding your contact information) if you permit Platform Applications to access your data. Before allowing any Platform Developer to make any Platform Application available to you, Facebook requires the Platform Developer to enter into an agreement which, among other things, requires them to respect your privacy settings and strictly limits their collection, use and storage of your information. However, while we have undertaken contractual and technical steps to restrict possible misuse of such information by such Platform Developers, we of course cannot and do not guarantee that all Platform Developers will abide by such agreements.

So, it can't guarantee your info will be used ethically. And each time you add an application you're allowing it to access your data; you have little choice.

Relationship status: aargh!

2008-11-08T15:09:00.008Z

On Facebook, there's a place where you can fill in profile information such as your relationship status.

By default, any change in the relationship status is relayed on the News Feed so everyone else is alerted to it. A friend was once surprised they hadn't heard about a change in relationship status because he "didn't see it appear on Facebook". This is because alerts had been turned off!

It's kind of sad that people think they can only find out about big upheavals in people's personal lives through the Facebook feeds. In a sad and recent case, which is not Facebook's fault, a man was sentenced to life after murdering his wife when she changed her status to 'single'. The man has been dubbed the 'Facebook killer', but I'm not keen on how the media portrays it as all Facebook's fault -- clearly, other dynamics were at work; the man was on drugs at the time, he was bitter, he had made threatening phone calls.

But you know, it's best to make sure those status updates aren't relayed to all and sundry (find it under Privacy > News Feed and Wall. Uncheck that box!). And if you don't get along with your ex, delete them from your friends list for goodness sake!

Bono and bikinis - another privacy warning

2008-11-08T14:51:00.006Z

Cheeky pictures of U2 lead singer Bono and several bikini-clad babes made their way around Facebook after one of the girls made all the photos available to everyone in her network. What was her 'network'? Oh, only one of the biggest cities on the entire planet... New York! That's why we don't recommend being in a Facebook network at all. When you join a network, Facebook changes your settings by default so that people in that network have access to your profile. Dip into the privacy settings to make sure only your friends can see the information you're disclosing on your profile.

Airline staff sacked after Facebook insults

2008-11-08T14:31:00.003Z

Thirteen staff at Virgin Atlantic were sacked for making disrespectful comments about passengers and derogatory allegations about poor safety standards on public areas of the Facebook social networking site. Less than a week later, British Airways staff were reprimanded for whingeing about "annoying" and "smelly" passengers.

The events highlight how companies are realising how powerful the web is at shaping reputations, as this Economist article, Losing Face, explains.

No doubt PR companies who specialise in mediating and monitoring how brands are represented by bloggers and denizens of social networking sites are jumping at the chance to promote their own 'damage control' services.

Clearly, companies haven't been doing more to let their staff know what is and isn't acceptable in the first place? Every workplace has an internet usage policy, but it seems that people assume it's switched off when they leave the office, or they forget that things they post online can be traced.

After the Virgin Atlantic sackings, the company posted on its official fan page:

"Virgin Atlantic has been made aware of some malicious comments that have been made on a social networking site by a small number of its staff. The airline has started an immediate disciplinary investigation. We do not tolerate any criticism of our passengers or industry-leading safety standards and we are taking this matter very seriously."

Keeping parents away from your friends list

2008-10-27T22:51:00.002Z

Randomly came across this opinion by a columnist in the Boston Herald about why parents should stay off Facebook.

Facebook might shock your family, but it can spur a self-esteem death spiral, too. Like if you’re always the connector, never the connectee. Or watching a request go ignored. And then there are the godforsaken status updates. Not only are they written in third person, so everyone sounds a little like Sesame Street’s Elmo: “Lauren is . . . making breakfast,” they border on passive-aggressive bragging: “Amy is . . . volunteering at soup kitchen and working on her screenplay.”
Not to mention everyone looks as though they’re re-creating the Miley Cyrus shoot by Annie Leibowitz.

So true. Coincidentally there was a recent Desperate Housewives episode where Felicity Huffman's character Lynette Scavo pretends to be a teenage girl and befriends her own son on a social networking site. Invariably Lynette's son falls in love with her, in the wrong kind of way. When Lynette sends a break-up email to her son she accidentally signs it "Love, Mom", in a modern-day version of the joke where the kid writes his own sick note and signs it "My mom".

When your boss is your Facebook friend... SICKIE WOO!

2008-10-24T23:31:00.002+01:00

So. You're sick. Sick of work, that is. And you don't want to come in. So, what do you do? You call your boss and say, "I can't come in this morning. I'm unwell."

In the old days, your boss would sigh and say, "I hope you feel better soon."

But these days, your boss doesn't feel sympathy. They know how to prove you were lying. It doesn't involve hiring a private investigator and having someone follow you to make sure you don't leave the house.

All they have to do is log on to Facebook. Now, this particular story may turn out to be urban legend, as the alleged e-mail exchange is denied by boss and culprit... but the story goes like this:

Kyle Doyle chucked a sickie, as they say in Australia, and on his Facebook status update were the immortal words,

Kyle Doyle is not going to work, fuck it i'm still trashed. SICKIE WOO!

When Kyle refused to give his boss a medical certificate, saying it was unnecessary, his boss then pasted the status update into an email as 'proof' of the deception.

True or not, the email illustrates rule number one: your current boss should never be your friend on Facebook. That's what LinkedIn is for. Rule number two you can work out for yourself...

Source: http://news.ninemsn.com.au/article.aspx?id=651937

Does anyone remember Beacon Ads?

2008-10-24T23:07:00.004+01:00

We aren't saying Facebook is bad. We use it. We're all about helping individuals make the most of it while still being aware of the level of personal information they, and their friends, are giving out.

Facebook exploded in mid-2007. It absolutely exploded. The company had to be seen as a commercial entity; one that could make money. Targeted advertising is the key!

In November 2007, there was a massive brouhaha about Facebook privacy –and rightly so. Project Beacon launched, and it broadcast certain user habits (primarily buying items) to other friends via the news feed without asking for permission. This ruined several people's Christmas shopping surprises. The Beacon feature tracked what you were doing on Facebook partner sites while still logged on to Facebook.

Initially, the Beacon feature was touted as being opt-in. That is, you would be asked if you wanted a certain action to be published to the news feed. But when Beacon launched, it was distinctly opt-out. People found their actions being broadcast to practically all and sundry – the equivalent of a camera behind your shoulder, recording your every move!

Around 44 partner sites, including ticket vendor Fandango and Coca-Cola, initially signed up to Beacon. Within days, there was a huge outcry. Without going into all the details, you can read the apology from Facebook founder Mark Zuckerberg. The company backtracked and made Beacon opt-in again, and also gave people the option to turn it off altogether.

However, the young company would not have backtracked were it not from the tens of thousands of people who caused a massive outcry –ironcically by joining a protest group on Facebook.

So, how to make sure your actions aren't being dispensed to everyone? For more of the dirt on Beacon, check out the FAQ and the Wikipedia entry ... make sure you have turned Beacon off by going to Privacy > Applications > Settings within Facebook.

Still avoiding Facebook? Our top 5 initiation tips

2008-10-24T17:15:00.005+01:00

We all know them. People who refuse to go on Facebook. I've got about four or five who just refuse to use it. I don't blame them, really, it's not like they're missing out on anything by not going on there. Some are concerned about how much information they'll have to give away by joining it, but they are still keen to check out what's going on.

One friend I had joined a group whose aim was to get some poor soul on to Facebook. Not only had they amassed about 20-odd people, but they'd also posted some rather embarrassing photos of the person who would never know their images were plastered all over the site...

If you haven't joined but feel your social life is suffering and only want to dip your toes in the water, then here are our top five tips. One of them does contravene Facebook policy, but in the great scheme of things, it's nothing much!

1. Don't use your real surname. This is our tip, but it violates Facebook's terms of service so prepare for your account to be deleted any time. However, we see plenty of people on there with bizarre names, and Facebook has tens of millions of users. It's not going to check to see whether your name is real or not. It has better things do to. So, just make your name believable and you should be fine. Not using your real name means that your full name needn't be revealed to the site, and besides, your friends will know it anyway.

2. Make your search listing and friends list private. There are several options to avoid people finding you on Facebook, and these are found in your privacy settings. You can do all or just one or two of the following:

Make it so your search result listing is not listed by search engines.
Make it so your profile picture is not viewable by people not on your friends list.
Let only friends of friends, find you on Facebook search, if you want to remain under the radar, or make it so no one can find you
Make it so non-friends can't view your friends list.

3. Never list personal information. This means your gender, address, mobile, workplace, interests, marital status and website. You can choose to have your e-mail address visible only to yourself, which is good. But filling in all the other information means it's open for use by third-party application, Facebook, and Facebook advertisers.

4. Don't use your regular e-mail address. If someone looking for you types your regular e-mail address into Facebook, they will automatically initiate a friend request for you if you are registered under that address. By all means, avoid the request if you wish, but you can avoid them in the first place by creating a free account from Hotmail or Gmail.

5. Make a limited profile. You can adjust your profile so that selected acquaintances don't need to see pictures of your big night out.

Has anyone got any other suggestions?

It's not just Facebook... applications know you, too!

2008-10-24T16:52:00.000+01:00

This blog, and others, focuses on Facebook settings and how to make them work for you. But there are thousands of third-party Facebook applications out there (games, quizzes, photo sharing, review sites, maps... the list goes on) that make money from you.

They'll do so mainly either via affiliate links or straight ad revenue. What does this mean? Here are some real-life examples.

Affiliate revenue: Say you've installed an application that allows you to list the books you've read. If a visitor clicks on the book title, they'll be taken to an online bookstore where they can buy a copy. If the visitor goes through with the sale, the application developer, who has set up a deal with the bookstore, will get a cut.

Ad revenue: You might see Google ads at the end of a game. Click on an ad and the app maker will get a cut. Many websites, including this one, display similar ads.

Sometimes an application has no ad links and is a brand awareness exercise. The agency will want to convince their clients that the application is helping the brand name get across.

To measure the effectiveness of these campaigns, application developers need to be able to see demographic information about the people who use their tools. They can use analysis tools from companies like Refresh Analytics, who allow developers to get stats about people who add their programs. Refresh Analytics' tool is described thusly:

The tool can be easily integrated into any Facebook app. It tracks users across 13 demographic and six interest categories: geography, gender, age, marital status, music, books, etc. The info is collected in aggregate to protect user privacy and respect Facebook rules. A daily snapshot of 1,000 users is provided, and historical reports can be generated for the past month, six months or two years.

So, although personal information about you is never revealed, if you have included information about where you're from, your age, marital status and interests, all this information can, and does, get pulled out and it's able to be broken down by app makers so they know, say, the average age of the person who plays their games.

That's why I've not listed any interests or even my gender in my profile. I don't need the advertisers to know all this information if I don't have to reveal it.

They're still out there: Facebook Applications

2008-10-24T16:16:00.001+01:00

The new-look Facebook does away with having to endure the tedious applications that plagued traditional profile layouts. In the past, you would see, quite literally in some cases, more than a hundred icons and boxes representing various apps that your friend may have added to their profile page. Now, all this crap is hidden behind a tab called Boxes, and under this tab you can choose to display chosen Applications or just access them via the Applications menu.

In 2007, the most popular apps included Scrabulous (the unofficial online version of Scrabble), and the ability to be bitten by a vampire. Flixster, Super Walls and slideshows were also the rage.

Although you may think your Applications are now gone for good, they've just been shoved under a mat and they do pop out from time to time. You will still need to make sure Applications like games don't harangue your friends every minute to try and beat your high score, or post updates to your profile every time you play. To do so:

Click Applications, located at the bar to the bottom of your screen, then Edit, to see a list of all your applications.

Next to the Application settings you want to view, click Edit.

For Geo Challenge, I see these options:

Allow Geo Challenge to publish one-line stories automatically, but prompt me for larger stories.

Prompt me before publishing any stories from Geo Challenge.

Never publish any stories from Geo Challenge.

Allow Geo Challenge to publish specific story sizes automatically without prompting.

Then there are the e-mail notifications. To adjust these, click Settings at the top of every Facebook page. Click Notifications, and right at the bottom, under Other Applications, you'll be able to select whether or not you want to be alerted on e-mail whenever something happens (whatever something is).

Facebook photo privacy settings

2008-10-24T15:31:00.000+01:00

Strangers are just friends you haven't met (but who've met you).

Facebook photos are all the rage. Practically every day, I see someone who's posted a photo of themselves or their friends. And when I go out with my camera, my friends are always scared I'll post a picture of them on Facebook. This does happen, but I'll always honor takedown requests.

What happens when you post a photo on Facebook is that you can choose to have the photo visible by either:

Friends (say you have 100 friends, then all 100 friends can see your album)
Friends of friends (if your 100 friends have 90 friends each, then 9,000 people could potentially see your album)
Everyone on Facebook (if your profile is public to your network, say, then anyone in that network can click through to your profile and your albums)

Click 'Customize' and you will also be able to specify further restrictions including:

Some Friends (if you only have a couple of people you want to see your photos)
Except these people (if you want everyone except your boss to see your photos)

Example: If you tag your friend Jim in a photograph and you've allowed Friends of Friends to see it, then when Jim's friend Pete gets a notification that Jim's been tagged in a photo, Pete can click through to the photo Jim's been tagged in.

But that's not all! Pete can now browse through your entire album even if Jim isn't in any more photos. In the past week I've seen plenty of albums belonging to people I don't know. Random babies, honeymoons to Uluru in Australia, Singaporean weddings, decadent parties with 19 year old girls posing seductively to the camera... and so on. And I have no idea who these people are.

So when you create your album you need to think of the parameters you're applying to the entire album, not the individual photos. Flickr allows you to edit privacy settings for each photo, but for Facebook you need to do it for each album.