Wednesday, October 17, 2007
Facebook ordered to get tougher on privacy for children
In response to a spate of issues involving sexual predators using MySpace, Facebook began promoting itself as a safe online environment for children. To test their claims, investigators from the New York Attorney General’s office posed as teenagers and within a matter of days after posting their profiles on Facebook, had received numerous sexually suggestive messages from adults. Their complaints, registered using Facebook’s online form, went unanswered for weeks.As a result of their investigation, New York state prosecutors accused Facebook of false advertising and the New York Times reports that yesterday, Facebook was ordered to immediately post stronger warnings about the risks to children using the site and to provide a quicker response to thousands of complaints daily about inappropriate sexual messages.
The changes are part of a settlement with the New York attorney general, Andrew M. Cuomo, whose office last month announced that it had been investigating whether the Web site misled users by promoting itself as a place where minors were safe from sexual predators.
Mr. Cuomo said the settlement would serve as a “new model” under which law enforcement and Internet companies could work together to protect children and recognize that they share responsibility to police illegal activity online.
By using consumer-protection laws to tackle the thorny problem of Internet safety, Mr. Cuomo appears to be building on the tactics of his predecessor, Gov. Eliot Spitzer, who used state laws to prosecute fraud on Wall Street.
“Any site where you are attracting young people, you must assume you are simultaneously attracting those who would prey on young people,” Mr. Cuomo said in an interview. “Whether you are a shoe company or you’re an Internet company, consumer protection laws apply.”
Chris Kelly, Facebook’s chief privacy officer, stood beside Mr. Cuomo to announce the deal and called the settlement part of the company’s effort to grow while maintaining users’ sense of safety and community. “We actually think we’ll end up attracting more people” because of the new measures, he said.
The settlement also requires Facebook to hire an independent company to track its responses to complaints and to report twice a year to Facebook and the attorney general.
In an earlier post, I expressed concern about Facebook’s default “wide-open” privacy settings and their announcement that profiles would be made available to third parties and eventually over the Internet using an automatic opt-in model. I complained to Facebook about this practice and my particular concern about the risks to minors. While their response was timely, coming within a few days of my original complaint, it completely skirted my concerns about using a negative opt-out, as well as the issue of putting children at risk:
We appreciate your feedback and will take it into consideration moving forward. Please keep in mind that a public search listing is simply a basic search result that allows people to know that you have a Facebook profile even if they do not yet use the site. Your public search listing will only be available if you allow “Everyone” to search for you on Facebook and have the “Allow anyone to see my public search listing” checkbox toggled on. You can adjust these settings from the Search section of the Privacy page.If Facebook truly cared about their users' privacy, and particularly the privacy of minors, their user profiles would default to allow maximum privacy, allowing users to choose to opt in to make their profiles available for searching on the Web. In light of these kinds of policies and their response to valid privacy concerns, it’s encouraging to see the privacy practices of social-networking sites like Facebook coming under closer scrutiny, particularly with respect to the safety of children.
Also note that people who do not yet use Facebook will not be able to interact with you or view your full information without registering with the site. Your public search listing will not affect any of your normal Search privacy settings. A non-Facebook user viewing your result would see the same search result if they registered with the site.
Your public search listing will also eventually appear in search engine indexes, making it even easier for your friends to connect with you. To change this option, please go to the Search section of the Privacy page and deselect the option to “Allow my public listing to be indexed by external search engines.”
By more efficiently connecting people, we hope that we can make your experience more meaningful on the site. Let me know if you have any further questions.
Thanks for contacting Facebook,
Kristjan
Customer Support Representative
Thursday, September 6, 2007
Facebook uses negative opt-out to make profiles public
Facebook users received notifications this week that the company is planning to make user profiles available to non-users and eventually make them searchable on the Internet, as reported today by the BBC:The function will initially allow anyone who is not registered with the site to search for a specific person. More controversially, in a month's time, the feature will also allow people to track down Facebook members via search engines such as Google.
The firm said that the information being revealed is minimal.
… The public search listing will show the thumbnail picture of a Facebook member from their profile page as well as links allowing people to interact with them. But, in order to add someone as a friend or send them a message, the person will have to be registered with Facebook.
Users who want to restrict what information is available to the public or
opt out of the feature altogether can change their privacy settings. They have a
month to do so.
Now, Facebook is pulling down the walls of their environment and allowing anyone, anywhere to see its users’ profiles – unless users choose to opt out. The negative opt-out technique means that if users do not respond, Facebook will assume they have granted permission for their profiles to be made public.
Roger’s Cable in Canada tried the negative option technique in the mid-90’s, delivering a package of new speciality services with automatic increased costs to customers’ bills. Customers were outraged, the company backed away from their plan and by 1999, Canadian parliament outlawed the practice.
The negative opt-out is at best unfair and at worst a huge violation of trust:
It presumes that everyone will read the opt-out notification within the month – there are purportedly 39 million Facebook accounts, a large percentage of which have likely become inactive or are used infrequently, so those users’ information will probably go public without their knowledge or consent.
It takes advantage of a low response rate. Studies have shown that only about 15% of users will respond to a negative opt-out. Facebook stands to make a greater profit using this method than requiring users to opt in.
It takes advantage of the relationship developed between service provider and customer. Facebook is presuming that it can use its customers’ information in whichever way it deems fit, with a minimum of input from users.
It puts users – including minors – at risk by exposing their profile information to the wider world. Many Facebook users are not well-informed about the myriad of privacy settings required to lock down one’s profile. Many users leave their entire profile, including date of birth, workplace, residential neighbourhood and status (e.g. “I’m vacationing in Aruba all week!”) open to entire networks of thousands of members to view. While users’ entire profiles will not be available to search on the Web - not yet, anyway – it opens the door for greater abuse.
In using the negative opt-out technique, Facebook is violating the trust and the privacy of millions of loyal users. If users and regulators allow Facebook to proceed with this tactic - what's next? What other web services do you use that may decide to share your personal information or web history with a third party, assuming that your silence to a negative option grants them your "permission"?
Thursday, May 3, 2007
Government Bans Facebook … but MySpace is still okay
Employees with the Ontario government who tried to log in to their Facebook accounts this morning were met with an “access denied” message. Even most members of parliament and cabinet ministers have been blocked from Facebook, which joins a list along with online gambling and porn sites. The ban took everyone by surprise, including Public Infrastructure Minister David Caplan, one of the few cabinet ministers with a Facebook page.The rationale for the ban was rather vague:
When even the Canadian Prime Minister has a page on Facebook, it obviously is considered an important way for politicians to get their message out. Any employer has the right to restrict the sites that employees access from employer networks and governments are accountable to taxpayers for ensuring that employees are productive on the job. Most public sector employers have policies in place which outline appropriate use of the Internet, and in many cases, employees are required to sign a document that goes into their permanent record."The staff determined it's not as directly related to the workplace as we'd like it to be so we're restricting access to it," Government Services Minister Gerry Phillips told the Toronto Star.
"Our IT (information technology) people are pretty broadly familiar with the marketplace and they said, `Here's a website that's going to be increasingly more popular for the OPS (Ontario public service). Is this an appropriate website to be spending time on?'" he said.
"It's the ministry making these decisions on trying to ... restrict access to ones that are inappropriate and then to anticipate where one may grow in popularity and we may end up with a lot of OPS time being taken (up) on it."
The vague rationale for this ban and the fact that other social networking sites, including MySpace, are still accessible to government employees and ministers does raise questions. One has to wonder if the Ontario government was really concerned about the amount of time that employees and elected officials were spending on Facebook or if they were actually more concerned about what information might be shared on a popular public forum.
Either way, it seems that it will become increasingly difficult for employers to stay on top of the many ways that employees can become distracted by online activities from the work they’re paid to do. In the meantime, I suspect many employees will move along to MySpace or other social networking sites … until the Ontario government denies access to those as well.
Tuesday, May 1, 2007
Facebook: Student lessons on libel
Some students in Toronto are getting a primer on libel and ethics this week, as they were banned from a class trip as punishment for making false accusations about a teacher on Facebook. In the most recent incident, a group of Grade 8 students jokingly accused a teacher of masturbating in class. There have been two similar incidents in Ontario in recent months, according to this Canadian Press story:"The principal implemented our progressive discipline policy, and so no, there are no new developments," Robert Dunn, superintendent of the York Region District School Board, said when asked if the punishment was being re-thought. The action follows two other recent high-profile incidents in the province.
Five teenagers were suspended last month from Toronto's Birchmount Park Collegiate for writing inappropriate remarks about staff. In February, 19 students who blamed their principal for school policies on cellphone use, and took their gripe online, were suspended from Robert F. Hall Catholic Secondary School in Caledon East, northwest of Toronto.
Part of the problem may lie in the expectations students have of the Internet. "Kids don't think of those places as public places," said Annie Kidder of the group People for Education. In a recent Ipsos-Reid poll conducted for Microsoft Canada, 70 per cent of respondents aged 10 to 14 said they believe the information they put online is private.
Defamation was well described in a 1970 British Columbia Court of Appeal decision called Murphy v. LaMarsh: (Defamation is where) a shameful action is attributed to a man (he stole my purse), a shameful character (he is dishonest), a shameful course of action (he lives on the avails of prostitution), (or) a shameful condition (he has smallpox). Such words are considered defamatory because they tend to bring the man named into hatred, contempt or ridicule. The more modern definition (of defamation) is words tending to lower the plaintiff in the estimation of right-thinking members of society generally.
The major points of defamation law in Canada are as follows:
- Defamation is a "strict liability" tort. In other words, it does not matter if the defamation was intentional or the result of negligence. Defamatory material is presumed to be false and malicious. "Whatever a man publishes", according to one case, "he publishes at his peril."
- Defamation must be a direct attack on an actual reputation, not an alleged reputation that a "victim" believes they deserve. A judge will assess the statement against the evidence of the victim's reputation in their community.
- The remarks must be harmful (i.e. "defamatory") and this will be assessed on a case-by-case basis. Some statements are clearly defamatory. Other statements would only be defamatory to the person targeted by the remarks. What may be a nonsensical or mildly offensive remark to one person may constitute serious defamation to another. The judge will consider the situation of the person defamed in assessing the claim of defamation.
- The defamatory remark must be clearly aimed at the plaintiff. General, inflammatory remarks aimed at a large audience would not qualify as the remarks must be clearly pointed at a specific person.
- The defamatory remarks must be somehow conveyed to a third party. Private defamation just between two parties causes no reputation damage to reputation because there are no other persons to be impacted by the remarks. With libel, the damage is presumed as it is published.
Posting these kinds of accusations on Facebook or in a blog is no different from publishing them in a book or a newspaper. So, I think that teaching administrators are taking the right approach by suspending the privileges of students who make these kinds of false accusations, in order to help them and other students understand the seriousness of their actions and the potential consequences to individuals who are the target.
In Canada, teacher-librarian associations have been advocating for over a decade for an Information Literacy curriculum to provide students with the knowledge and skills to understand the opportunities and risks of web-based information. Students need to understand their rights to free speech, as well as their legal obligations, and based on these incidents, they need it early.
