The Erosion of Privacy on Facebook: Read the News and Audit Your Account

Could Facebook have grown its community to hundreds of millions of users so quickly if it had not promised to protect the privacy of its users? I suspect the answer is "no." Users trusted Facebook, and they signed up in droves.

Evidently, the company feels it has grown big enough that it can rescind its earlier promises about data privacy and weather whatever micro-storm of protest ensues. As has been much reported, the company is changing its privacy policies and—just as importantly—its UI for controlling privacy settings.

The policies now lean toward disclosure rather than containment. The new UI controls require one to click, click, click with the perseverance of a busy switchboard operator to regain most of the privacy one enjoyed a few months ago. Alas, it's impossible to regain all of it.

Facebook wants to ensure that it and its partners have access to as much personal information as possible. That's how they'll make money.

Their loosey-goosey manner of opening the floodgates leaves users vulnerable to all sorts of hacks, exposing private data not just to Facebook and its partners, but also to any hacker or marketer with sufficient diligence and cunning. (See Wired Magazine's article, Rogue Marketers Can Mine Your Info on Facebook.)

Users, understandably, are unhappy. Fifteen organizations have banded together to file a complaint to the FTC. User defections are becoming more common and well publicized. Facebook management is scrambling to the respond.

For a quick summary of what's changed, what's new, and how exposed your own Facebook account is, consult the following.

Analysis

Electronic Frontier Foundation

Facebook's Eroding Privacy Policy: A Timeline

Updated: Facebook Further Reduces Your Control Over Personal Information

Quote from this second article:

Today, Facebook removed its users' ability to control who can see their own interests and personal information. Certain parts of users' profiles, "including your current city, hometown, education and work, and likes and interests" will now be transformed into "connections," meaning that they will be shared publicly. If you don't want these parts of your profile to be made public, your only option is to delete them. . . .

But even for an innocuous interest like cooking, it’s not clear how this change is meant to benefit Facebook's users. An ordinary human is not going to look through the list of Facebook's millions of cooking fans. It's far too large. Only data miners and targeted advertisers have the time and inclination to delve that deeply.

New York Times

Facebook Privacy: A Bewildering Tangle of Options (a chart showing the hierarchy of Facebook's new privacy settings)

Office of the Privacy Commissioner of Canada

Report of Findings into the Complaint Filed by the Canadian Internet Policy and Public Interest Clinic (CIPPIC) against Facebook Inc. Under the Personal Information Protection and Electronic Documents Act (2009)

Wired Magazine

Public Posting Now the Default on Facebook (December 2009)

Quote:

Facebook estimates that 80 to 85 percent of its users have stuck with the default privacy settings, which means hundreds of millions of users will soon be publishing to the entire net, by default when they type into their status box. The previous defaults for status updates were “Friends of Friends” and networks, including geographic ones with millions of users, while photos defaulted to everyone.

Audit Tools

Profile Watch: Scans your privacy settings and rates your exposure on a scale of 1 to 10.

ReclaimPrivacy.org: Scans your Facebook privacy settings and provides detailed analysis of your exposure, along with links to the Privacy Settings page on which you can make adjustments for a particular score.

If you know of other useful audit tools, please let me know.

Thanks to Sarah Evans for the link to Profile Watch and to Chris Marino for the link to Reclaim Privacy.

Photo credits:

http://www.flickr.com/photos/calliope/ / CC BY 2.0

Moore's Law for Data Integration

The year is 1999, and your company wants to customize its new CRM system so sales people can access contract records from the Finance department's database. The CRM system itself took 9 months to deploy. Everyone's tired of the training classes. The six consultants who implemented the CRM system have lost a few people and gained a few people. Looks like they'll be bringing in someone else to manage this customization, which should take 4-5 months, tops.

Flashforward to 2008. It's September, you're using SugarCRM as your CRM system. You'd like to, again, integrate your CRM system with your Finance system. This time you'd like to do it using MindTouch Deki, a popular open source wiki and collaboration platform, and SnapLogic, an open source data integration framework. Good choice: the entire project, from start to finish, is completed in under two weeks.

No big, expensive consulting contracts. No "tent village" of Big Four consultants camped out by the computer room. An IT manager conceives the project, and within two weeks, it's done.

There's a paradigm shift that's occurred in enterprise IT, and it promises to make the next few years genuinely exciting, despite the downturn.

Over the past decade, application vendors have learned the wisdom of first, opening their APIs, and second, eliminating the complexity of their APIs by adopting a RESTful Web services model for integration.

The result has been a increase in agility for business users and IT department that is proving to be as dramatic, in terms of applications deployments and end user experience, as Moore's law has been for hardware development. Moore's law, you'll recall, is Gordon Moore's observation, first made in 1965, that "the number of transistors that can be placed inexpensively on an integrated circuit has increased exponentially, doubling approximately every two years" (Wikipedia). Thanks to Moore's law, your bookbag can hold a laptop more powerful that a mainframe from a few decades ago. And you watch videos on your MP3 player, which is roughly the size of a pack of gum.

Open source and RESTful APIs (which make use of basic GETs and PUTs, rather than relying on more complex messaging schemes) give enterprise IT organization powerful building blocks for rapidly building new, powerful application solutions—applications that literally would have required man years of programming less than a decade ago.

A year ago, there was a lot of buzz about enterprise mashups that blended two or more data sources. Mashups are still exciting, but what's equally exciting is a kind of mashup occurring at the application level.

Today's announcement by Salesforce.com that its Force.com development platform would work with Facebook APIs, enabling Salesforce.com's 100,000-strong developer community to more easily access the vast library of applications built on Salesforce, is more evidence of this trend.

Other evidence of this trend:

• The ongoing success of the Web site, ProgrammableWeb, which serves as a portal for discovering application APIs and mashups. ProgrammableWeb now has 1,000 APIs in its API directory. Clearly, a lot of companies are publishing APIs.
  
• Once published, APIs often become the dominant channel for accessing an application. As ProgrammableWeb's John Musser points out in a blog post about the 1,000-API milestone:
  
  
  
  • 60% of eBay's listing come from their APIs, rather than through their browser-based interface.
    
  • Twitter's APIs carry 10x the traffic of its Web site.
    
  
  
• REST is becoming the dominant programming model for APIs. 63% of the APIs listed in ProgrammableWeb's directory are RESTful.
  
• New Content Management Systems, such as Alfresco Enterprise 3.0, feature REST interfaces so they can easily access business data from other IT systems.
  
• New applications, such as an increasingly popular network management/IT operations platform offered by an Indian company, use REST APIs to facilitate communication among components. RESTful integration enables one product, for example, a network troubleshooting tool, to easily pass information to a related component, such as a trouble-ticketing application used by a help desk.
  

Enterprise Management Associates analyst Dennis Drogseth is fond of saying that enterprise IT organizations know they need to move to a "lego world." No single IT system has a monopoly on vital data. Best practices call for the automated flow of information seamlessly from one system to another: from a network diagnostic tool to a help desk application, for example, or from a finance system into a wiki, which in turn is embedded in SugarCRM. The key to that flow is having components designed to fit together with other components, even from other vendors.

It sounds like a lot of work. It's dramatically less work than it used to be. Thanks to open APIs, REST, and Web-centric architectures, data integration and application development can beneft from a Moore's law of their own.