• Employers and schools that are demanding usernames and passwords are engaging in a very particular form of voyeurism rather than in any useful applicant vetting process.
• A geolocation app that allows users to map the presence of prospective paramours with publicly available facebook profiles of Facebook.
• Facebook handed over lists with lists of the suspect's friends, IP logins, photos, tags, and messages. Given that facebook won't reveal how many subpoenas they've responded too, we have no way of knowing how often domestic law enforcement or other less savory entities are pouring through our social data.

Facebook is Dangerous

How Does Facebook Collection Differ From Other Internet Uses

Examples of the Disturbing Uses of Facebook

The Dangers of Facebook Reflect Broader Internet Hazards

What Can Users Do?

First, by default, your ISP only tracks and logs the address (location) of everyone's transmissions, not the content of those transmissions. It can track the content but it is difficult for an ISP to do that on a large scale since it involves processor-intensive packet-sniffing. If your ISP was targeting you specifically, I have no doubt they could discover the content of your transmissions, unless you encrypted them (discussed shortly). But it is simply not realistic for an ISP to eavesdrop on the content of everyone's internet usage simultaneously. Facebook does not have this limitation. It does not need to resort to packet sniffing since you are accessing it's domain and it can easily match the location of your transmission to the content. It knows that www.facebook.com/profile=1234420 is Kieran's profile since it designed the URL matching scheme. It knows how long you spent on Kieran's page since the asynchronous Javascript on the page is in constant communication with Facebook's servers. Your ISP does not have these shortcuts and must inspect the content of every packet you send to get a meaningful idea of what you're doing on the internet. It can do it, but it cannot do it for everyone at once. Therein lies the danger of Facebook: it can record all this information about everyone at once, and it does.

Second, when you access your bank or, say, Gmail, your communication is encrypted through something called SSL. That means it is mathematically very, very difficult for an ISP to snoop on your communication to discover what you are doing on that website. It knows roughly what domains you're accessing (e.g. bankofamerica.com) but it cannot decrypt the content that's been sent to your browser. It cannot discover your bank balance, since the information is garbled by encryption until reaches your web browser on your computer, outside the eyes of the ISP. Again, Facebook has no such limitation. It should be obvious why: it is not a third party relaying information like your ISP is, it is actually the server you're communicating with. It knows what it's sending you, even if it encrypts it before sending it.

People keep getting this wrong. It's not about what you place on the internet. It's about where you go, what you look at, how long you look at it. What you intentionally place on the internet is trivial compared to information on the profiles you looked at, the photos you spent the most time on and the people that were tagged in them.

That's the real interesting information that is being collected about you, not the fact that you listed Twilight as your favorite movie.

Nevertheless, I was still shocked by the vast scale of information provided in this social-media subpoena that the Boston Police Department delivered to Facebook in the course of their investigation of the "Craigslist Killer." Facebook handed over lists with lists of the suspect's friends, IP logins, photos, tags, and messages. Given that facebook won't acknowledge how many subpoenas they've responded too, we have no way of knowing how often domestic law enforcement or other less savory entities are pouring through our social data.

People keep getting this wrong. It's not about what you place on the internet. It's about where you go, what you look at, how long you look at it. What you intentionally place on the internet is trivial compared to information on the profiles you looked at, the photos you spent the most time on and the people that were tagged in them. That's the real interesting information that is being collected about you, not the fact that you listed Twilight as your favorite movie.

Nevertheless, I was still shocked by the vast scale of information provided in this social-media subpoena that the Boston Police Department delivered to Facebook in the course of their investigation of the "Craigslist Killer." Facebook handed over lists with lists of the suspect's friends, IP logins, photos, tags, and messages. Given that facebook won't acknowledge how many subpoenas they've responded too, we have no way of knowing how often domestic law enforcement or other less savory entities are pouring through our social data.

-- KieranCoe - 07 Apr 2012

I just read an article about a fairly disturbing Facebook application, and thought I'd post it here: http://www.cultofmac.com/157641/this-creepy-app-isnt-just-stalking-women-without-their-knowledge-its-a-wake-up-call-about-facebook-privacy/

The author of the article encourages readers to see the application as instructive regarding internet privacy and protecting ourselves on social networking sites like Facebook.

I, too, like Skylar feel like I've been letting much of this discourse about privacy and the internet pass me by. As Moglen mentioned in class the other day, it very much has been this passive "If I'm not doing anything wrong, what does it matter," attitude on my part. But I also grow frustrated when I try to discuss this topic with people who are adamantly anti-Facebook and other forms of social-networking, because I often do feel that users of these platforms are not given enough credit. I also get the impression that these people assume that Facebook's only uses are for stalking friends and colleagues as entertainment, curing boredom, or for narcissistic, superficial over-sharing. There's little acknowledgement of what a powerful form of community-building it can be, or that our ideas of what imaginary communities we are a part of, and can be active in, has largely shifted as a consequence of these networks. I've long been interested in migration and diaspora communities, and social networking has drastically changed the way people in diaspora communities perceive themselves and their communities. It's not merely the ease of keeping in touch that's important- it is that act of sharing daily thoughts and experiences that's extremely powerful from the perspective of identity formation, remittances, empathy-building, and even planting the seeds for activism.

I realize whether Facebook and similar forms of social networking can be useful is a different question from whether or not Facebook is dangerous from a privacy perspective. I just wish those who frame the debate would more often acknowledge that there are real and immediate positive social interests at stake, beyond 20-somethings wanting to show off their party pictures, that contribute to the complacency some people feel regarding these potential long-term consequences. Maybe if those championing internet privacy gave more credit to those who really do want to find a way to balance behavior in the cyber-realm that contributes to certain positive ends with making a stand for internet re-empowerment, it would go a long way towards making people wake up.

-- RumbidzaiMaweni - 01 Apr 2012

Essentially what I attempted to get at with my question is the idea of people taking action, in any form, to demand changes in the way their information is being used. I think that by attending the SOPA lunch time discussion you were taking a step in the right direction. I too have been inspired to attempt to better understand the internet's communication architecture and will be taking a one day workshop on coding and building a website during spring break.

Elvira, this article is shocking and went well beyond my knowledge of how the government, employers, and schools can use Facebook. A lawyer quoted in the article, Bradley Shear, made a strong point in regards to the privacy infringement of the government, employers, and schools actions, Shear said, "A good analogy for this, in the offline world, would it be acceptable for schools to require athletes to bug their off-campus apartments? Does a school have a right to know who all your friends are?"

On the other hand, the article also noted that when Maryland's Department of Corrections forced applicants to surrender their user names and passwords during the interview, that out of 2,689 applicants, they identified 7 applicants whose social media applications had pictures of gang signs. Is there ever an appropriate time for agencies and schools to demand that individuals share their social media information, prior to being found in violation of any crime or policy? Surrendering the privacy of 2,689 individuals to find 7 alleged gang affiliates, seems a hefty price to pay.

I just never was particularly concerned about the possible ramifications of having a Facebook because I always felt as though A) everyone has a Facebook and what is on mine can't be that much worse than anyone else's and B) I wouldn't want to work at or go to school at a place that did not want me based on the content on my Facebook. To me it seems that employers and schools that are demanding usernames and passwords are engaging in a very particular form of voyeurism rather than in any useful applicant vetting process.

In response to your question Abiola - I don’t know what it will take for people to take to the streets and demand internet re-empowerment but I think the first step is certainly being vocal. I believe one benefit of the recent SOPA debate is that it moderately raised the public awareness of the fact that we are clients of the internet. I am not a technology whiz either, but after listening to Professor Moglen talk about SOPA and ACTA in class I have started to pay more attention. Yesterday I went to the lunchtime debate re: SOPA, Protect IP, and OPEN. I know it was basically listening to the equivalent of two live advertisements alternatively for or against anti-piracy laws, but attending an event re: current events, and actually taking an active role in obtaining knowledge about a technological current event is huge for me. I don’t understand most technology and mostly it scares me how pervasive it is.

I approach most technology with the idea that one day we will turn into a form of the world described by Gary Shteyngart’s in Super Sad True Love Story. If you’ve never read the book, Shteyngart depicts a futuristic dystopia where everybody has apparatii (essentially iphones) through which they conduct all activity (social interactions, shopping, reading, playing games, listening to music, etc.). Because all human activity is conducted via these electronic instruments, large companies collect and combine the data with their marketing expertise to subversively psychologically influence America.

What scares me most about our recent discussions in class is my participation in/passive acceptance of injustice and/or the terrifying things I see and hear about the world. Thus far my approach to my fear of technological dystopia I see us heading towards, is to remain as unaware of it as possible. Aside from gmail, facebook, and the occasional Wikipedia search, I legitimately do not use the internet, and pride myself on how little I understand it. But it’s happening without me and eventually it will effect me. Even though the result of the SOPA debate was moot, its prevalence in the news, combined with the fear elicited in me via our discussions in Law in Contemporary Society sparked me to start paying attention. Going to a debate in a law school classroom is far from going to the streets, but it’s at least a step.

-- SkylarPolansky - 29 Feb 2012

I do agree with Harry's point that the world needs another option. But I think more likely what will happen is that just as some may say that Facebook took over MySpace? , there will be another tech company that takes over Facebook, rendering Facebook obsolete and still leaving us with one popular option. In Moglen's Freedom in the Cloud speech, he said, "It's not a pretty story...We haven't lost. We've just really bamboozled ourselves. And we're going to have to unbamboozle ourselves really quickly or we're going to bamboozle a bunch of innocent people who didn't know we were throwing away their privacy for them forever." I believe this quote sheds light on the importance of properly educating individuals about the extent to which their collected information is used. But at what point should we hold users accountable for performing due diligence, and at least putting in some effort to find out how their information is used?

I am not a tech wiz, and from reading Moglen's speech I was assured of how naive my understanding of the web is. Moglen's Freedom in the Cloud speech gave me an abbreviated history of how technology has gotten to the point where it is now. But more importantly, Moglen's speech left me wondering, if the extent of the problem is so vast, when will people demand more transparency? Beyond protesting against wars and violent crimes, when will people take to the streets to demand that as internet "clients" we be re-empowered?

I think this analysis is largely correct, though I think, for reasons I will be discussing in my other course in coming weeks, the Facebook coverage has been anemic and uninformative in the extreme, and your relative indifference to this among other privacy problems is misplaced. Your point, however, that Facebook is merely part of a larger failure in the Net to be robust against attacks on privacy and freedom is surely correct. Hence I agree with you that solving the Facebook problem is one necessary rather than the sufficient condition for remediation of the problem overall. For my diagnosis of the problem overall, and the beginning of my working through a possible solution, see my Freedom in the Cloud.

I may be in the minority on this, but I've always felt the Facebook coverage was a bit sensationalistic. If you have privacy concerns, yes, the best move is to get off Facebook, deactivate (and try to delete) your account, and convince everyone you know to stop using it. The problem is that most of these privacy issues aren't relegated to Facebook. They permeate almost all of the web as we know it. I will concede that Facebook does a particularly (and perhaps intentionally) poor job at offering clear, easy-to-use privacy settings.

First, this is in the realm of "truth vs. accuracy," but it feels relevant to note that Photo DNA (by Microsoft) is not the same as facial recognition (which Facebook also has). Photo DNA allows Facebook to track versions of the same photo, not people. As deployed now, it finds and tracks known images of child pornography when posted on Facebook. Obviously, Facebook does have facial recognition software that raises privacy concerns - you see it every time you tag a photo and it suggests your friends for you - but I'm not aware of any evidence that it is being used for a nefarious purpose (or to aid law enforcement). It may have been, I'm just not aware of it.

Second, Facebook is hardly the only data privacy problem on the web. To free yourself of similar risks, you'd pretty much need to change the way you interact with the Internet altogether. For one, the majority of us use free hosted email (Gmail, predominantly, I'd imagine). I'd venture to guess that more private, relevant data is exchanged through email than through Facebook, especially given that most people see Gmail as a completely private place and Facebook as at least a somewhat public place. Outside of running your own email server (which isn't feasible for a sizable segment of users), there's little way to prevent email providers from doing the same things with your data that Facebook could. Even if you did, you'd still likely be emailing people who have Gmail or Yahoo mail accounts, and your data would still end up on their servers.

I'm running a bit late for school today, so I'll stop here and try to finish this this afternoon, but the general point is that getting off Facebook doesn't seem to cure any real privacy issues. Is it better? Sure. Is it a solution? Not really.

-- SanjayMurti - 08 Feb 2012

Facebook is Dangerous

At the end of the article, the author Dan Tynan challenges Eben's metaphor. I disagree with Tynan, and I want to quickly respond to his points.

Dan Tynan: A true MITM attack happens without either party knowing about it. When’s the last time you used Facebook without knowing about it, or been forced to use it against your will?
Every day. Every mainstream news website, most blogs, and virtually all shopping websites have Facebook "Like" buttons which can be used to track your activity on that site even if you don't touch the "Like" button. You can't go anywhere on the internet without accessing Facebook's servers, whether or not you even have a Facebook account.

Dan Tynan: You have no control over the data the MITM attacker collects. You have some controls over what Facebook collects.
No, you have the illusion of control. Just because you can turn off what you 'share' on your account doesn't mean that Facebook isn't collecting the data and turning it over to anyone who requests it without a warrant.

Action

One way we can start to solve this problem is by refusing to use Facebook to send out event invitations. Can the Student Senate can create a policy that their events will not be publicized on Facebook? Are there Senators in this class that can make this happen? Let's take action to reduce the utility of Facebook on our campus and make it easier for people to deactivate their accounts.

If you think that you can just deactivate your own account and everything will be fine, you are wrong: the scariest part about what Facebook is becoming is their "Photo DNA" which identifies people by pictures that are uploaded of you even if you are not tagged and even if you don't have a Facebook account. That's why it's important to get everyone to deactivate their accounts or at the very least stop uploading pictures to Facebook.

Maybe you don't care if Facebook or law enforcement can track where you are at any given moment. But if the world someday becomes a place where you do care, by then it might be too late to do anything about it.

-- HarryKhanna - 07 Feb 2012