Chris Peterson

There are many ways in which Facebook might know your phone number. The easiest (and most common) way is to give it to them, by including it in your profile so that your Facebook Friends can look it up when they need to give you a ring.

So your Friends have your number, but that makes sense – after all, they probably already had your number, or could’ve gotten it easily. And Facebook has your number, and while I don’t think it makes sense to “trust” Facebook anymore, I think users can trust in the fact that even Facebook is not so colossally stupid as to do something like sell your phone number to used car hucksters.

But who else has access to your number?

Think no one? Think again. Are you sure that only your Friends have access to your profile info?

What about those Groups and Events – you know, the ones that start “I dropped my phone in a pond, send me your numbers!” Have you posted in them? Do you know their privacy settings? Have the privacy settings changed since you posted?

The ever entertaining Tom Scott – creator of invaluable Internet entertainment such as StupidFight – has just produced the privacy equivalent of a horror film. It’s called – simply and appropriately enough – “Evil”.

As Scott explains:

This site randomly displays the private phone numbers of unsuspecting Facebook users.

…

There are uncountable numbers of groups on Facebook called “lost my phone!!!!! need ur numbers!!!!!” or something like that. Most of them are marked as ‘public’, or ‘visible to everyone’. A lot of folks don’t understand what that means in Facebook’s context — to Facebook, ‘everyone’ means everyone in the world, whether they’re a Facebook member or not. That includes automated programs like Evil, as well as search engines.

…

Evil uses the graph API to search for groups about lost phones. It picks them at random, extracts some of the phone numbers, and then shows them here.

Here is Scott’s screencast of what Evil looks like when it is working:

So what should you do? Scott says:

Go into all the “lost number” groups you’ve ever joined. Ever. Delete your posts. (You might want to try searching for your own phone number on Google, too; it might turn up in unexpected places.)

The thing to remember here is that the fault doesn’t lie with the users. That is to say, the fault doesn’t like with the users any more than someone can be faulted for stepping on what appears to be a solid deck only to have it collapse under their feet because it wasn’t built to code.

It is patently ridiculous and unreasonable to argue that all of these users wanted their cell phone numbers and names to be accessible to the entire Internet. But that’s what has happened, because of stupid, unsafe, and (indeed) “evil” design.

(h/t Ian Brown and PVN)

My blog is getting a lot of traffic right now from people Googling for YourOpenBook.org. If you’re one of these folks:

1) Welcome,
2) yes, I’m afraid it is that bad, and
3) here is a wonderful tool that can help you fix it (along with these).

Best of luck!

From his Op/Ed in WaPo today:

The biggest message we have heard recently is that people want easier control over their information. Simply put, many of you thought our controls were too complex. Our intention was to give you lots of granular controls; but that may not have been what many of you wanted. We just missed the mark.

…

We have also heard that some people don’t understand how their personal information is used and worry that it is shared in ways they don’t want. I’d like to clear that up now. Many people choose to make some of their information visible to everyone so people they know can find them on Facebook. We already offer controls to limit the visibility of that information and we intend to make them even stronger.

Here are the principles under which Facebook operates:

— You have control over how your information is shared.

— We do not share your personal information with people or services you don’t want.

— We do not give advertisers access to your personal information.

— We do not and never will sell any of your information to anyone.

— We will always keep Facebook a free service for everyone.

This is garbage. Facebook designs a confusing environment, intentionally removes the ability of users to make certain information private, and uses the power of the default to shoehorn users into “Instant Personalization” and other expansive programs – and then responds with a wide-eyed, “who, us?” denial and misleading protestations of innocence and earnestness.

These are crocodile tears.

Update: visitors, welcome – and read YourOpenBook – And How To Close It

YourOpenBook:

What is Openbook?

Openbook draws attention to the information Facebook makes public about its users via its search API. Facebook exposed this service on April 21st, 2010.

Our goal is to get Facebook to restore the privacy of this information, so that this website and others like it no longer work.

And they may have a better shot at their goal than anyone else. YourOpenBook just draws status updates (and gender) from Facebook’s public firehose.

I don’t feel comfortable posting screenshots because it makes me feel sick and complicit. But you have to go try it for yourself. It’s sickening and fascinating.

Perhaps more importantly: it’s proof positive that Facebook users don’t understand their privacy preferences. Try searching “openbook” and you’ll see people posting about how they discovered their profiles were open by laughing at folks on the site and then seeing their own statuses pop up.

Great tool:

danah boyd – the goddess of all things social media – has had a couple of really good posts about Facebook privacy in the last few days, posts that are definitely worth reading and thinking about.

First, in “Radical Transparency”, danah brings up a really great point that had not occurred to me before: that the transparency Facebook encourages in its users does not align with the lack of transparency of Facebook’s counterintuitive design:

Over and over again, I find that people’s mental model of who can see what doesn’t match up with reality. People think “everyone” includes everyone who searches for them on Facebook. They never imagine that “everyone” includes every third party sucking up data for goddess only knows what purpose. They think that if they lock down everything in the settings that they see, that they’re completely locked down. They don’t get that their friends lists, interests, likes, primary photo, affiliations, and other content is publicly accessible.

If Facebook wanted radical transparency, they could communicate to users every single person and entity who can see their content. They could notify then when the content is accessed by a partner. They could show them who all is included in “friends-of-friends” (or at least a number of people). They hide behind lists because people’s abstractions allow them to share more. When people think “friends-of-friends” they don’t think about all of the types of people that their friends might link to; they think of the people that their friends would bring to a dinner party if they were to host it. When they think of everyone, they think of individual people who might have an interest in them, not 3rd party services who want to monetize or redistribute their data. Users have no sense of how their data is being used and Facebook is not radically transparent about what that data is used for. Quite the opposite. Convolution works. It keeps the press out.

Emphasis mine. And this is the key here. I talked a lot in Losing Face about how the counterintuitive design of Facebook stymies and waylays privacy practices by preventing people from appreciating the consequences of their actions. And danah is absolutely correct that Facebook is deceitful and unethical in demanding radical transparency of its users while not practicing it themselves.

In a followup, “Facebook is a utility; utilities get regulated”, danah points out that Facebook markets itself as a social utility and IS a utility in the most basic sense of the term, but that we regulate utilities precisely because they wield such control over our lives:

Your gut reaction might be to tell me that Facebook is not a utility. You’re wrong. People’s language reflects that people are depending on Facebook just like they depended on the Internet a decade ago. Facebook may not be at the scale of the Internet (or the Internet at the scale of electricity), but that doesn’t mean that it’s not angling to be a utility or quickly becoming one. Don’t forget: we spent how many years being told that the Internet wasn’t a utility, wasn’t a necessity… now we’re spending what kind of money trying to get universal broadband out there without pissing off the monopolistic beasts because we like to pretend that choice and utility can sit easily together. And because we’re afraid to regulate.

…

If Facebook is a utility – and I strongly believe it is – the handful of people who are building cabins in the woods to get away from the evil utility companies are irrelevant in light of all of the people who will suck up and deal with the utility to live in the city. This is going to come down to regulation, whether we like it or not.

Emphasis mine, again. This is another point I discuss in “Losing Face” – Facebook is anticompetitive. Social network sites are complementary, not substitute, services. The network effects are keeping people there, not the quality of the service, and that’s the functional (if not legal) definition of a monopoly.

As a historical footnote, this question (of whether Facebook is a monopoly) was the first thing Ethan Katsh (my thesis advisor) and I talked about doing for the thesis project that eventually ended up being “Saving Face.” We ended up deciding to do privacy rather than monopoly because when the Friends Lists came out I thought it would be cool to explore the idea of contextual integrity and Friends Lists. It obviously expanded from there, and I think it’s gone interesting places, and I’m very proud.

But frankly, the monopoly question may end up being the really important question in the long one. And it may be our best hope.

Today is “National Kill Your Facebook Day.”

(not sure why its organizers felt confined by the geopolitical boundaries of the United States, but so it goes)

I asked – on my Facebook status, of course – my friends if they’d been thinking about it. Many, many had.

According to Google, so is everyone else:

Julian Dibbell asked the other day if Facebook had jumped the shark. In some ways yes, in some ways no. Casual references to the Fonz aside, whether or not Facebook has become socially obsolete, a overplayed, overhyped, etc is another question.

The important thing is that increasingly Facebook users continue to use the site because they feel they have to in order to be social, not because they want to or like to. And when a company subsists on network effects, rather than the trust and goodwill of its users, to survive, that’s not good for anyone.

Nothing stems the flow of the Facebook privacy catastrophe.

The sustained blowback from the Facebook community has been as powerful as I’ve ever seen it, which is really quite inspiring.

AllFacebook calls for Facebook to “make instant personalization opt-in immediately”, calling its practices “unethical” otherwise:

It’s pretty outrageous to watch Facebook defend something which is obviously unethical. I’m talking about the company’s “Instant Personalization” program which the company forces users into, whether they like it or not. Despite the ongoing public criticism about the service, and a number of other products, Facebook is standing strong, arguing that users “love” what Facebook is doing.

…

Not only is [Facebook’s position that users love the service] a complete lie, but it’s a violation of the trust of the hundreds of millions of users who support the service.

Plus, Matt McKeon has a great graphic illustrating the EFF’s timeline of how Facebook has opened up.

Don’t want to leech his graphic, so click through and check it out.

As Vonnegut would say – strong stuff.

A lot has tumbled out of the woodwork about Facebook privacy over the last week, so here’s a quick review:

• via PCWorld: Facebook’s New Features Secretly Add Apps To Your Profile.
  

  If you visit certain sites while logged in to Facebook, an app for those sites will be quietly added to your Facebook profile. You don’t have to have a Facebook window open, you don’t need to be signed in to these sites for the apps to appear, there’s no notification, and there doesn’t appear to be an option to opt-out anywhere in Facebook’s byzantine privacy settings.

• via AllFacebook: Why Is Facebook Dead Set On Pushing Limits of Privacy?
  

  Does this mean that this is the way the world is going? Or does it simply mean this is the way that internet startups have chosen to “innovate”? I’d argue that it’s the latter and ultimately, Facebook will win when users have complete control of all their information.

  While sharing information has become an integral component of our daily communication, who we share that information with differs from person to person. With close to 450 million users, Facebook has plenty of opportunities to make money while simultaneously releasing new innovative technologies. None of this need to violate users’ privacy.

  Despite this, Facebook continues to release products that violate the users’ trust and ultimately, that’s going to be more damaging to the company than anything else.

  Nick is totally correct about this, and I think it’s telling that AllFacebook – which for a long time has seemed to be a simple fan front for Facebook – is calling them out pretty hard here.

• via AllFacebook: Chris Kelly Does Not Like “Instant Personalization”
  

  Facebook’s former Chief Privacy Officer, Chris Kelly, made a public statement against Facebook’s new “Instant Personalization” service, days after the program came under attack from a number of Senators. In a public statement, Chris Kelly distanced himself from Facebook saying, “Facebook’s recent changes to its privacy policy and practices with regard to data sharing occurred after I left the company.”

  Even Chris Kelly – who was in charge of privacy during Beacon – thinks this goes too far.

• via DeObfuscate: Facebook’s Anti-Privacy Monopoly

The biggest response I get from people when I point out these arguments is that “you can just delete your account”. But really, no, I can’t. Nor do I want to. I like using Facebook too much, and not having an account would feel like being a hermit. Facebook use is becoming a somewhat integral part of our society. But that doesn’t mean I can’t argue and fight against what I see as harmful anticompetitive conduct that destroys the bargaining relationship between Facebook users and Facebook, Inc.



• Rocket.ly and PrimeVector on why they (and you) should cancel your Facebook account.
• PeteSearch on how Facebook threatened to sue him for revealing some of their data practices.