Is Your Facebook Profile As Private As You Think?
A Facebook quiz called "What Do UR Hands Tell About YOU???" - As you answer questions for a quiz on Facebook, do you know what it could be doing in the background?
Second in a four-part series
Much has been made in recent years of the so-called Facebook generation, which supposedly consists of 20-somethings who like to go online and spill their guts without regard for privacy. The reality is more complex.
Yes, social network users post a lot of personal information. But they're sharing it within a circle of online "friends." And they fiercely resist outsiders' attempts to get a peek.
Last summer, city administrators in Bozeman, Mont., began requiring job applicants to provide usernames and passwords to their social networking accounts, as part of the background check. The new requirement caused such an uproar, the city manager held a press conference to apologize.
Social network users assume a degree of privacy within their circle of friends — but it's not a safe assumption to make.
A Facebook Quiz About Facebook Quizzes
A social network account can be seen by the company that runs the service, of course, but there's also the possibility of third-party snooping.
Chris Conley of the American Civil Liberties Union of Northern California is particularly concerned about the quizzes that circulate on Facebook.
"These quizzes are very common," Conley says. "If you go on Facebook you see all your friends have taken a quiz or several quizzes, depending on how much time they spend online."
What people often don't realize, Conley says, is that these quizzes are applications. Just like games and other entertainment, they're programs that run in a user's Web browser.
"You think that all you're doing is answering a few innocent questions," Conley says. "But in fact, you're opening up your entire profile and almost all your personal information to whoever wrote the quiz."
To demonstrate, Conley wrote his own Facebook quiz. When you run it, it gathers your information, then shows you, the user, what it got.
That means your photos, political views, even sexual preferences can be sent back to the stranger who wrote the quiz application.
Facebook Responds
Facebook is not pleased with Conley's quiz.
"It is technologically possible for anyone who writes an application to write an application that abuses a user's privacy," says Tim Sparapani, director of public policy at Facebook.
But Sparapani says such a quiz would violate Facebook's rules.
"When that happens, we find out about it, and we take action to enforce our terms of service, and then we take legal action to scrape back data that's been unlawfully or inappropriately gathered from our users," Sparapani says.
He won't cite a specific case of such enforcement, but he says it has happened. And he says that enforcement makes Facebook applications safer than applications downloaded from the open Internet.
Computer security experts doubt the effectiveness of this policing given the vast number of people creating applications for use on the Facebook platform. Facebook itself estimates there are more than 1 million developers for the Facebook platform worldwide.
This year, Canada's privacy commissioner complained about the "information scraping" potential of third-party applications, threatening to take action against Facebook. The company agreed to give users more information about what an application might be able to "see" in their personal accounts and to give them more chances to deny applications permission to look around.
Facebook says some of these changes could take a year to complete. And Sparapani says they'll end up limiting some of the functionality of Facebook applications.
But the questions about social network privacy go beyond Facebook.
Your Social Life Is Big Business
Nathan Hamiel of the Hexagon Security Group has demonstrated how third-party programs could also collect information from MySpace accounts.
To him, the real problem is the false assumption of security on social networks.
"There's a perceived safety," he says. "People are a lot more loose with their information because they don't realize the trust they're putting into this application developer."
People tend to open up about themselves on social networks, and that kind of candor is worth money. There are now companies that mine social sites for data to sell to marketers.
For example, Rapleaf, a company in San Francisco, looks at blogs, forums, discussion boards, social networks and review sites. "All those things combined can give you a really good picture of a person," says Auren Hoffman, Rapleaf's CEO.
He says Rapleaf's computers crawl only the public parts of the social Web. Even so, Rapleaf claims it has what it calls "insights" into almost 400 million people worldwide. Those insights are sold to marketers.
Hoffman says it's valuable information that adds to the supply of data that make modern life possible.
"If we didn't have data, our world wouldn't work," Hoffman says. "You'd have to put money down to get like a cable television or a cell phone or any of those things that we take for granted today."
The question is, are people prepared to have their daily commercial transactions affected by their online social lives? It's enough to give even the Facebook generation pause.
9(MDAyNzUwMDI2MDEyNTA3MTU5NzcyNTQyNA004))
ROBERT SIEGEL, host:
This is ALL THINGS CONSIDERED from NPR News. I'm Robert Siegel.
MELISSA BLOCK, host:
And I'm Melissa Block.
Now the second story in our series The End of Privacy. We're taking closer look at whether privacy is still possible in the digital age. And we're joined once again by NPR's Martin Kaste here at NPR West. Martin, welcome.
MARTIN KASTE: Oh, thank you.
BLOCK: Martin, yesterday we were talking about a notion that you call privacy fatalism.
KASTE: Yeah. I was talking about this notion that I've gotten from a lot of the people I interview for stories about privacy, about sort of a resignation, a sense that a lot of people have that things are spinning out of control. They can't really control their privacy anymore in this high-tech era.
But I should add that not everyone feels that way and especially when you talk to younger people, you get a very different message. For instance, this is Seattle's nightclub district where I recently went to talk to some 20-somethings about their privacy. We're outside some bars there, and I stopped a couple and asked them about their privacy and they said they weren't worried about it. And all of them, every single one of them gave the same reason.
Mr. COEN METTER(ph): Facebook.
Mr. BRIAN LISTON: Yeah.
(Soundbite of laughter)
Mr. METTER: It's the social trend of today. Giving out information is social.
BLOCK: So, who are these young people, Martin?
KASTE: Well, that's Coen Metter and his friend Brian Liston(ph). And I know that we've heard a lot about this so-called Facebook generation, how everybody under a certain age is an online exhibitionist and so on. The thing is they're not really. Listen carefully to how Brian Liston talks about their online exposure.
Mr. LISTON: You know, I bet you if you walk up and down the street, I bet you 75 to 85 percent of the people will be - have a Facebook account. And if they're in the Seattle network, anybody else in the Seattle network, as long as their account's not private, can view their information.
KASTE: Did you catch that - as long as their account's not private? There's an assumption there. The assumption is if you set your privacy options right, you can limit your exposure to just your friends. That's part of the appeal of social networks. But the thing is, it's not always true.
(Soundbite of electronic phone ring)
Mr. CHRIS CONLEY (American Civil Liberties Union of Northern California): Hello, this is Chris.
KASTE: I made an Internet phone call to Chris Conley at the American Civil Liberties Union of Northern California. He wanted to show me one way that a stranger might peek at your private social network: The Facebook quiz.
Mr. CONLEY: These quizzes are very common. If you go on Facebook, you see all of your friends have taken a quiz or several quizzes, depending on how much time they might spend online.
KASTE: A quiz isn't just a quiz. It's a program written by some company or stranger you've never heard of. Programs can be programmed. In this case, they can be programmed to look at your account while you're busily answering questions.
Mr. CONLEY: Maybe it's what superhero is my dog? You think that all you're doing is answering a few seemingly innocent questions, you know, can he catch a Frisbee, does he wear a cape. But, in fact, you're opening up your entire profile and almost all of your personal information to whoever wrote the quiz.
KASTE: To demonstrate this, Conley wrote his own Facebook quiz. When you run the quiz, it scrapes your information, then it shows you what it got.
Mr. CONLEY: On my profile, I can see my name, my hometown, my birthday, my religious and political views.
KASTE: Harvard ballroom alumni. You're a ballroom dancer?
Mr. CONLEY: Yes.
(Soundbite of laughter)
KASTE: Facebook is not pleased with Conley's quiz.
Mr. TIM SPARAPANI (Director, Public Policy, Facebook): So, I guess what I can say is it is technologically possible to write an application that abuses users' privacy, as does the ACLU's quiz.
KASTE: Tim Sparapani is director of public policy at Facebook.
Mr. SPARAPANI: But when that happens, we find out about it and we take action to enforce our terms of service. And then we take legal action to scrape back data that's been unlawfully or inappropriately gathered from our users.
KASTE: Sparapani won't cite a specific case. But he says this kind of policing actually makes Facebook safer than the plain Internet. Still, the company has promised, under pressure from Canada's privacy commissioner, to give users more control over what kind of information the quizzes get. But computer security expert Nathan Hamiel says Facebook quizzes are almost beside the point. The real issue, he thinks, is the false assumption of privacy that people have on social networks.
Mr. NATHAN HAMIEL (Security Expert, Hexagon Security Group): When you're talking about using social networks, there's a perceived safety. So, people are a lot more loose with their information because they don't realize the trust they're putting in to this application developer.
KASTE: So, people open up more on social networks. And that kind of candor is worth money. Auren Hoffman is CEO of Rapleaf, a company whose computers are constantly searching what he calls the social Web.
Mr. AUREN HOFFMAN (CEO, Rapleaf): We look at lots of different piece of data on the Internet, those include things like blogs and forums and discussion boards, social networks, review sites. All those things combined can give you a really good picture of a particular person.
KASTE: Rapleaf's computers crawl only the public parts of social Web sites. Even so, it claims to have enough information to have insights on almost 400 million people worldwide. Those insights, as they call them, are sold to marketers. And Hoffman says that's a good thing. Information, whether it's credit scores or blog postings, makes the economy go.
Mr. HOFFMAN: If we didn't have data, our world wouldn't work. You'd have to put money down to get, like, a cable television or a cell phone or to get any of those things that we take for granted today.
KASTE: But do we want those things affected by information from the social Web? Those photos of you on Facebook, for example, smoking and drinking at parties. What effect will they have someday on, say, your health insurance premiums or your car loans? It's a question that gives even some 20-somethings pause, like Coen Metter outside that bar in Seattle.
Mr. METTER: If one day I can't get an anonymous drink anymore, I think that'll be sad.
KASTE: For now, that anonymous drink is still possible, just pay with cash and don't mention it online.
Martin Kaste, NPR News. Transcript provided by NPR, Copyright National Public Radio.
