Editor's Note: The controversy over Facebook's aggressive attempts to cash in on information about its members is heating up. The San Francisco Chronicle reports that "anti-Facebook sentiment is surfacing in highly visible places, from the halls of Congress to the blogs and podcasts of influential technology experts like 
"Earlier this month, the Electronic Privacy Information Center and 14 other privacy and consumer organizations filed a complaint against Facebook with the Federal Trade Commission, accusing the popular social network of "unfair and deceptive trade practices" and violating users' expectations of privacy and consumer protection laws. And last month, Sen. Chuck Schumer, D-N.Y., asked the FTC to develop guidelines instructing social networks on how private information can be used. All of this comes in the wake of the company's launch of a new "open" social platform designed to bring Facebook features, such as its Like button, to other Web sites, and an experimental Instant Personalization feature that gives certain Web sites the ability to access a member's name, profile picture, sex and network of friends. The company also launched community pages that made topics in a member's profile more public."
Erik Hayden's article below from Miller-McCune explores the results of a new study that suggest that privacy on Facebook is probably impossible:
***
On Facebook, You Are Who You Know
Even if you do have a mostly private Facebook profile, others can glean vital information about you — just by looking at your friend list.
by Erik Hayden, Miller-McCune.com
Remember the golden days when Facebook used to be for just college students? It was a quainter site — with a much different set of rules.
Drunken party photos used to be unceremoniously splayed out in public, privacy settings were almost nonexistent, wall posts weren’t status updates and there was little need to filter regrettably off-color comments. After all, the only people (you assumed) who saw that stuff were college buddies who were also posting the same incriminating photos of themselves on the site.
Now, after the Facebook explosion, users are more aware of privacy issues than ever before and the new rule of thumb has become “curb public access to your profile as best you can.”
New research suggests that this is nearly impossible.
In a study conducted by Alan Mislove of Northeastern University and his colleagues at the Max Planck Institute for Software Systems, researchers tested an algorithm that could accurately infer the personal attributes of Facebook users by simply looking at their friend lists. The research culled profile information from two detailed social-network data sets: one from a sample of almost 4,000 students and alumni on Facebook at Rice University and another from more than 63,000 users in the New Orleans regional network.
Researchers developed an algorithm to see if they could accurately infer attributes like high school or college, department of study, hometown, graduation year and even dormitory by dissecting these users’ friend lists. The study cut to the core of the debate surrounding the social-networking site: Is your personal profile your own or, to paraphrase anti-Facebook crusader Leif Harmsen, is it the site’s profile about you?
“The current privacy debate that’s going on concerning Facebook is essentially covering explicitly provided attributes [i.e. information uploaded by you onto your profile],” Mislove wrote. “We see our work as pointing out that there exist many implicitly provided attributes that aren’t even being discussed.” Namely, that your friend’s profile can usually divulge more information than you think.
According to the study, only about 5 percent of users in each network had changed their privacy settings to make their friend list inaccessible. (To hide it, enter your Facebook profile, click on the edit icon above your friends and unclick the blue box marked “Show Friend List to everyone.”) In the New Orleans network, personal profiles remained largely accessible to researchers. Some 58 percent of users disclosed university attended, 42 percent disclosed employers, 35 percent disclosed interests and 19 percent gave the public access to their location.
Because of this information given, Mislove explained that it was relatively easy for his algorithm to accurately pinpoint attributes such as geography (dormitory or hometown) or education background (which high school or college users attend) for a specific user.
In the New Orleans regional network, the algorithm unsurprisingly found that users were 53 times more likely to share the attribute of the same high school with those on their friend list than with other random users in the network. At Rice, the algorithm accurately predicted the correct dormitory, graduation year and area of study for the many of the students. In fact, among these undergraduates, researchers found that “with as little as 20 percent of the users providing attributes we can often infer the attributes for the remaining users with over 80 percent accuracy.”
While marketing companies who specialize in targeted advertising may rejoice, these results may be troubling for those who’ve held out hope that Facebook could provide adequate privacy controls. Not to seem alarmist (“privacy” on the Web has always been overrated), but if these researchers could develop a limited algorithm that can infer rudimentary attributes off locked profiles, the possibilities seem endless for others to harness advanced software that could render current privacy controls completely useless.
“The privacy story on these sites is more complicated that we like to think, as your privacy is not just a function of what you provide, it’s a function of what your friends and community members provide as well,” Mislove elaborated.
Researchers concluded that it wasn’t “sufficient” to just give users access to privacy controls for their own profiles; the option to censor friend lists should be given to make sure that private information cannot be inferred.
As the title of the study states, on Facebook, you are who you know.
May 15, 2010
