This time the "feature" is Instant Personalization, a quaint moniker that fuzzes the fact that the sites you visit and interact with might suddenly be broadcast for everyone to see, even if you unselect the box to participate.
More specifically, these sites "may access any information you have made visible to Everyone ... as well as your publicly available information. This includes your Name, Profile Picture, Gender, Current City, Networks, Friend List, and Pages." On Monday, Facebook announced a transition where a "new type of Facebook Page" will make the "current city, hometown, education and work, and likes and interests sections of your profile" publicly available after you go through the transition tool (or those items will be deleted).
By default, the "Allow" checkbox for Instant Personalization is checked on your privacy settings. If you don't want the websites that you or your Facebook friends visit to know your information, you must opt out. Since this process is a bit complicated, we have made a quick video showing step by step how to do so.
Thankfully, EFF has put together a handy video that helps walk folks through not only opting out of this new feature, but specifically blocking the three applications that are currently participating.
The downside is that there's no easy way to automatically block new sites as they begin to participate, so bookmark the help page demonstrated in the video and check back from time to time in order to manually block additional apps as they come online.
Regular readers of this site are familiar with my thoughts on social networking sites - their limited benefits, and more important, the significant risks they introduce as people struggle to understand how much sharing is too much.
The Electronic Frontier Foundation (full disclosure: I'm a member of EFF) has released documents detailing how law enforcement is mining data from social networking sites for them to use during their investigations.
Not only are agencies using this freely-available information, but formal training is occurring to teach investigators how to better use the tools that exist on the Internet.
It's not only the things that you share that could trip you up or provide critical investigative elements. Your online "friends" could post things about you - items that you might never post yourself - and agencies could piece together these nuggets in an attempt to get a better overall view of your activities, behaviors, and lifestyle.
No worries though, right? The government has no history of over-reaching or misusing intelligence data, either foreign or domestic.
Due to the potential for misuse and abuse, training that includes clearly-articulated codes of conduct requirements for social networking investigations should be mandatory. Can an investigator set up a fake profile or misrepresent themselves in the quest to obtain information? What sort of evidence would be considered acceptable? These are just two specific areas that need to be considered and monitored for violations.
As a new generation of Internet users moves online with a completely different attitude about sharing their lives as they unfold, it will become much easier to build huge repositories of intelligence that can be mined by investigative agencies.
It's imperative that we have an understanding what's being done, the controls in place to limit and identify misuse of social networking data, and clearly-defined policies and procedures for agencies to follow and for citizens to leverage in the event disagreements arise about allowable uses of the data collected.
Have you ever seen a sleight-of-hand artist at work? A pickpocket, or perhaps a magician who steals your watch as he looks you in the eye then ogles your girlfriend?
Google is doing something similar, and they proudly showcased it during their recent Super Bowl advertisement. Sadly, few are distressed.
Here's the ad:
Don't you find it a little bit creepy that an entire life arc can be reconstituted via Google search queries? And if not, why?
There are significant privacy alarms this very scenario confirms: Nameless searches are anything but anonymous, and intimate details of a person's existence can (and are) reconstructed more quickly and easily than the general public realizes.
There are two sides to this dissimulation. First, it's laughingly simple to overlook the correlative ability of major search engines, and to misjudge their capacity to connect the dots from seemingly random instances of an individual rummaging through the scads of data available at the click of a mouse.
Second, the retention of this associated information means that it's available for review by law enforcement, evil doers, and lawyers engaged in discovery proceedings - not to mention the search engine organization themselves.
Is there money to be made by sharing search patterns with titans of finance and industry? Of course. Do Google, Yahoo, Bing, et al have any interest in generating more income? Please.
This is valuable stuff we're talking about here. What's lacking is transparency into how this data is being stored, shared, and protected.
So watch the ad, and marvel. Then kiss your privacy goodbye, because it's going away, and it's never coming back.
I've written often about the practice of web sites salting your browser with cookies in order to track your movements as you surf here and there on the interweb. I've also suggested some privacy settings and browser tips and tricks to help protect you from the scourge of targeted advertising cookies that continuously invade your privacy, often without your knowledge or consent.
Now comes word that many sites are serving up flash cookies, using Adobe Flash, that aren't affected by your browser's privacy settings and that often evade browser add-ons, like TACO for Firefox.
Behavioral advertising on the web is becoming much more aggressive as the number of people using the Internet rises, and as advertisers look for more effective ways to increase click-throughs to generate ad revenue and hopefully sales down the line.
Rather than showing you random ads and hoping for a 1% success rate, it makes sense for advertisements to be targeted toward your specific interests, where the odds that you'll click on the ad would be much higher.
What better way to determine what you like than to track the kinds of websites you visit and what kind of articles you read. If you add a couple of appliances to your wish list on Amazon, that's valuable information for them to have. Capturing your location, browser type, operating system, and so on from your browser string helps, too. Microsoft users in Michigan using Internet Explorer 8 have different purchasing habits than Linux users in Dallas running Firefox, or Mac users in New York loading pages in Safari, or via an iPhone.
Firefox does have a separate extension that will help with Adobe Flash cookie blocking, called BetterPrivacy. If you're a Firefox devotee, you'll want to check it out.
For more information, it's worth your time to read more about this in Wired.
I've always found that the amount of hot singles in my area expressing interest in a middle-aged, balding, overweight man tends to be pretty much nonexistent, but that doesn't stop social networking sites from serving those ads up to me anyway, obviously hoping that I click through and generate a little revenue. I never do, but I admire their tenacity.
A Lynchburg, VA man found himself in a similar situation, one that he would similarly ignore, except for one detail - the face in the advertisement that popped up on Facebook belonged to someone he knew.
His wife.
Facebook has long been a privacy punching bag, and for good reason. The breadth and depth of data they capture about users and their usage history is staggering, and how that information is used (and abused) is well documented.
Cheryl Smith's picture had been used to generate the ad after it was captured by a third party that was cranking out advertising for Facebook, who claimed that the company had violated its' policies in how the whole thing transpired. But it does bring up an interesting point. With millions of us posting our pictures on the web these days, what's to keep any of us from becoming an unwitting model for some online dating service? And what if our spouses don't have the same sense of humor and level of trust as Cheryl's?
In this case, even if you implemented the granular privacy settings that Facebook provides, you wouldn't have been protected in all cases. Third party applications that you use via Facebook aren't always covered by the privacy toggles. Sleep on that, people.
After the kerfuffle about the warrantless spying by agencies under the Bush administration, coupled with the numerous stories concerning the FBI overreaching their authority and other law enforcement officials trampling on the privacy rights of individuals all in the name of safety and security, one would surmise that any new initiatives that had privacy implications would be greeted with a skeptical, if not hostile, response.
So why does Baltimore Transit want to install microphones to record all conversations on their buses and trains?
Set aside for a moment the cinema-concept that criminals have migrated to city public transportation to meet with Lex Luthor to plan how to bring Metropolis to its' knees. What are the odds that someone will be listening at the exact moment some criminal act is mentioned, and that they will be able to action it in a sufficient timeframe as to prevent the crime in the first place? Sounds a bit like a recent Tom Cruise movie. And not a good one, either.
What about the privacy aspects? Do I give up all expectations to privacy while on a city bus? How about the person on the other end of my cell phone call - do I need to warn them that my half of the call is being recorded and archived for an unknown amount of time? And how usable will the recordings be, especially if twenty people are talking at the same time, mixed with the usual sounds that accompany mass transit?
This is a stupid idea that wastes precious financial resources in a time of crushing fiscal circumstances. It will neither reduce crime nor will it accomplish anything except lining the coffers of those vendors who will sell, install, and maintain the recording systems.
I'd lose my job if I spent money this way without showing significant results. Baltimore should be held to the same standard.
City officials, after being crushed in an avalanche of negatively publicity, decided that they would cease asking for this information, admitting that it was probably a mistake. Still to be explained is why it took worldwide outrage for them to come to the same conclusion the rest of us did within seconds of learning about the practice.
Original Post
Things are tough all over, and finding a job is at the top of the list. Lines are long just for the privilege of applying for a position. If you're lucky enough to get past the first hurdle, and you're applying for a city job in Bozeman, Montana, your problems are just beginning.
City officials are requiring applicants to provide both usernames and passwords for all social media accounts, forums, and blogs. They claim to be doing this to ensure quality background checks.
From Montana's News Station:
"Please list any and all, current personal or business websites, web pages or memberships on any Internet-based chat rooms, social clubs or forums, to include, but not limited to: Facebook, Google, Yahoo, YouTube.com, MySpace, etc.," the City form states. There are then three lines where applicants can list the Web sites, their user names and log-in information and their passwords.
This is a terrible idea on many fronts, not the least of which is the incredible invasion of personal privacy that's involved. To add insult to injury, sharing your login information may actually breach the terms of service to which you agreed when you signed up for many of these sites. Talk about being between a rock and a hard place.
I'm fully supportive of the concept that people should be held accountable for their online writing and the content of their social networking sites. To me, if you're dumb enough to put stuff out there that would disqualify you for any sort of employment, you deserve what you get.
But I draw the line at providing inside information for these twits to be able to go in and snoop around. Feel free to spider the web searching for traces of me, and if it's publicly available, it's fair game. Unless city officials are willing to give me copies of their tax returns, bank account statements, and video rental histories so I can make an informed decision about the quality of the city management staff so I can feel comfortable that these folks are stable, adjusted, and without vice.
Privacy Digest passes along the laments of several folks who have lost their jobs and then found themselves missing their personal contact lists and family photos when the IT group wiped the former-employees computers and Blackberry devices.
I take this as a rather serious indictment of our efforts to get people to realize that company technology assets belong to the firm, not to the employee, and therefore anything you load on them also belongs to the corporation.
As we become more and more dependent on technology to keep our lives in order, finding a secure way to maintain this information somewhere other than on an employer's network should be a valuable marketing niche.
I'm particularly careful to keep my personal and professional appointments separate, with placeholders where needed to ensure my two calendars are in sync. But I don't transfer the information about business meetings and contacts to my personal calendar, and I limit personal events placed on my corporate calendar to only those placeholders needed to ensure I don't schedule over a personal event.
I also don't keep personal documents, photos, and other similar items on my work laptop or Blackberry. If I need those materials to be portable and available, they either go on my iPhone or on an encrypted USB drive that I carry around for exactly that purpose.
Technology makes it easy to blur the line for convenience sake. It takes proactive focusing to ensure you don't fall into the same trap as those in the article.
Very few people are aware that as you browse the web, hopping from site to site, tiny little chunks o' data are placed on your computer that allow all sorts of tracking of your activity - where you've visited, what you have viewed, and so on.
One of the up-and-coming online trends is behavioral advertising, where marketing and media companies use these little data files, also known as cookies, to target the advertising you see based on your browsing habits.
Global regulators and privacy organizations are rapidly moving to curtail some of the most onerous of these practices, but laws and regulations vary from country to country, and in the US, from state to state.
So far, the best consumer protection has been awareness. Once you know, you can take steps to block these cookies from being placed and/or read from your computer.
The Network Advertising Initiative has a site that allows you to review the various member companies engaged in behavioral advertising and to alert you to which of them you've already opted out. There's a little radio button you can click to opt out of the ones you haven't already.
Problem is, these opt outs or blocks are usually erased when you clear your history and cookies in your browser. If you clear your cookies, history, and cache regularly, you may want to consider installing one of the browser-based cookie blockers, like TACO for Firefox. Google, Yahoo, and many other search behemoths also offer cookie opt out programs.
If you don't mind these folks knowing where you visit, and you prefer advertising that's tailored to your interests, then by all means, don't do anything. For everyone else, take proper steps.
If you have any questions, drop me a note at RedGeckoBlog@gmail.com
Bruce Schneier, writing in his Schneier on Security blog, details the work of two University of Texas at Austin scientists who have developed an algorithm that allows them to take anonymous social networking data and use it to pull out actual names and addresses.
So much for the anonymity. Social graphs from Twitter, Flickr and Live Journal were used in the research.
The pair found that one third of those who are on both Flickr and Twitter can be identified from the completely anonymous Twitter graph. This is despite the fact that the overlap of members between the two services is thought to be about 15%.
The researchers suggest that as social network sites become more heavily used, then people will find it increasingly difficult to maintain a veil of anonymity.
