Senators call on FTC to tackle social-net privacy

This represents some real good news (possibly anyway). Last week I wrote about the recent study by researchers at UC Berkeley and the University of Pennsylvania indicating younger adults DO want increased privacy and have views similar to those of their elders, even with social networks encouraging them to share more online.

Perhaps this new information has been helpful in giving some legislators the cover they need to start making social networking sites like Facebook address the myriad of concerns, and violations if you ask me, of user privacy.

Before I get to the article about a new effort by some Democratic Senators to regulate these sites, let me highlight another recent study that tells the story about what Facebook, and other social networking sites are doing to undermine privacy (and which could be stopped immediately without effecting the general enjoyment one gets from using them).

The study found that the 43 leading sites made privacy control settings difficult to find and to understand; and the defaults were almost always set to allow maximum dispersal of data.

Privacy expert Bruce Schneier recently summed up the problem in Forbes:

In January Facebook Chief Executive, Mark Zuckerberg, declared the age of privacy to be over. A month earlier, Google Chief Eric Schmidt expressed a similar sentiment. Add Scott McNealy's and Larry Ellison's comments from a few years earlier, and you've got a whole lot of tech CEOs proclaiming the death of privacy--especially when it comes to young people.

It's just not true. People, including the younger generation, still care about privacy. Yes, they're far more public on the Internet than their parents: writing personal details on Facebook, posting embarrassing photos on Flickr and having intimate conversations on Twitter. But they take steps to protect their privacy and vociferously complain when they feel it violated. They're not technically sophisticated about privacy and make mistakes all the time, but that's mostly the fault of companies and Web sites that try to manipulate them for financial gain.

...

Here's the problem: The very companies whose CEOs eulogize privacy make their money by controlling vast amounts of their users' information. Whether through targeted advertising, cross-selling or simply convincing their users to spend more time on their site and sign up their friends, more information shared in more ways, more publicly means more profits. This means these companies are motivated to continually ratchet down the privacy of their services, while at the same time pronouncing privacy erosions as inevitable and giving users the illusion of control.

...

Facebook tried a similar control grab when it changed people's default privacy settings last December to make them more public. While users could, in theory, keep their previous settings, it took an effort. Many people just wanted to chat with their friends and clicked through the new defaults without realizing it.

Facebook has a history of this sort of thing. In 2006 it introduced News Feeds, which changed the way people viewed information about their friends. There was no true privacy change in that users could not see more information than before; the change was in control--or arguably, just in the illusion of control. Still, there was a large uproar. And Facebook is doing it again; last month, the company announced new privacy changes that will make it easier for it to collect location data on users and sell that data to third parties.

So now that we have an idea why Facebook - and sites like it - need to abide by some agreed upon rules when it comes to sharing our data, let's go to the article in C-Net detailing the proposals being made by various Senators, particularly Sen. Schumer:

A press release from Schumer's office announced that he has written to the FTC to ask that the agency "examine the privacy disclosures of social-networking sites to ensure they are not misleading or fail to fully disclose the extent to which they share information...(and) provide guidelines for use of private information and prohibit access without user permission."

This was prompted by the new products and services unveiled by Facebook CEO Mark Zuckerberg at the social network's annual developer conference, which took place in San Francisco last week. The big showcase at F8 was the "Open Graph," which aims to forge firmer channels of communication between multiple social-networking sites. In conjunction, Facebook rolled out something called "Instant Personalization," which lets users easily share the bulk of their personal profile information with third-party companies.

According to Schumer, frequent changes to social-networking privacy policies can be extremely confusing for users, and that the FTC currently does not regulate this at all.

...

"...As these sites become more and more popular, however, it's vitally important that safeguards are in place that provide users with control over their personal information to ensure they don't receive unwanted solicitations. At the same time, social-networking sites need to provide easy-to-understand disclosures to users on how information they submit is being shared."

...

Schumer's press release explains that "if the FTC believes it does not have the tools or authority to issue guidelines on privacy disclosures, he would be willing to offer legislation."

Is this the last straw? Security advocates and the occasional lawmaker have been complaining about Facebook's continual changes to its privacy controls for ages now, and yet the social network continues to forge ahead. It does, however, make changes here and there: late last year, controversy over Facebook's decision to make users' friends lists public resulted in a complaint to the FTC and ultimately a modification on Facebook's behalf.

Click here to read more.

In case you want a bit more information that proves Facebook and sites like it need to be regulated, consider more of the record. The company has been criticized for not allowing people to permanently delete their accounts and personal information from the site as well as their use of "Beacon" (no longer in use) - a technology that tracks user's online purchases and informs their friends.

Next, they released their new privacy settings, that were new, but were actually less private. There's more "publicly available information" that you can't control, there was the official "recommendation" that users should loosen their privacy settings, since Facebook's recommendations are less private than the previous default settings, most users have to click through to another page of privacy controls in order to strengthen their settings, and finally, the default settings are all set to the LEAST private setting

Even if your Facebook profile is "private," when you take a quiz or run any other application, that app can access almost everything in your profile: your religion, sexual orientation, political affiliation, pictures, and groups. And these apps may have access to most of the info on your friends' profiles too—which means if your friend takes a quiz, they could be giving away your personal information, even if you've never used an app!

The privacy settings that address this issue remain buried behind too many layers of menus and the new controls still fail to explain what applications can really see.

Then there's government and law enforcement access. Facebook reportedly receives up to 100 demands each week seeking information about its users

Facebook’s draft privacy policy states that we'll be able to opt-out of third party sites that they have chosen to share our information with. But by default, we're all in. Seems a bit inconvenient, no? Another immediate question I had was what personal information are they sharing?

Add it altogether, and there's a real strong case to pursue the kind of legislation, or action from the Federal Trade Commission.

Privacy and Consumer Groups Challenge Body Scanners

Unfortunately I haven't been able to post here for over a week (reasons I won't even go into), and couldn't for almost 10 days before that due to vacation (had the chore of swimming with dolphins and whales in the Sea of Cortez...work, work, work :).

So, I feel I'm really behind here and there's so many things I'd like to get to. But, the one I have to single out today is the consumer and privacy coalition - which we (Consumer Federation of California) are a member of - challenging the use of, and investment in, the airport digital strip searches that are coming to an airport near you. I speak of course of what has been coined as "Whole-Body-Imaging".

As I wrote in my article "The Politics of Fear and "Whole-Body-Imaging", these full-body scanners use one of two technologies - millimeter wave sensors or backscatter x-rays - to see through clothing, producing images of naked passengers.

As I lay out in detail, there are MANY reasons to oppose the widespread use of these scanners, from the obvious, privacy, to the less so, they won't make us any safer. In fact, if you define the word "safe" as also including being "safe" from government and corporate intrusiveness and fear peddling, than I would argue it makes us less so, not more.

A Review: Why Airport Body Scanners Should be Opposed

Before I get to the coalition petition urging Janet Napolitano to stop purchasing these machines until there's comprehensive public hearings on them (which is CRITICAL if we are to get a chance to make more Americans aware of the full story), I want to just quickly highlight the main arguments against their use.

Before embracing this latest "terror fix", we should consider the larger context at work here: for every specific tactic we target with a new, expensive, and often burdensome security apparatus, the terrorist's tactics themselves will change.

Risks can be reduced for a given target, but not eliminated. If we strip searched every single passenger at every airport in the country, terrorists would try to bomb shopping malls or movie theaters.

Before we all run for the hills screaming "the terrorists are coming", willfully give up our civil liberties and freedoms, support wars on countries that did nothing to us, and sign off on wasting HUGE amounts of money on ineffectual security systems, consider this: Your chances of getting hit by lightning in one year is 500,000 to 1 while the odds you'll be killed by a terrorist on a plane over 10 years is 10 million to 1.

Does this sound like a threat worthy of increasing the already long list of airline passenger indignities? Isn't suffering through longer and longer lines while being shoeless, beltless, waterless, and nail clipper-less enough? Now we've got to be digitally strip searched too?

Then there are the privacy concerns regarding how images could be stored...and just the basic guttural reaction of "screw you I'm not letting you see me naked for no reason" argument.

The Electronic Privacy Information Center, a public interest research group, published documents in January revealing that the machines can record, store and transmit passenger scans.

Are we really to believe the government won't allow these devices to record any data when the easy "go to" excuse for doing so will be the need to gather and store evidence? What about the ability of some hacker in an airport lounge capturing the data using his wi-fi capable PC - and then filing it to a Flickr album, and then telling of its whereabouts on Twitter?

For these reasons, privacy advocates continue to argue for increased oversight, full disclosure for air travelers, and legal language to protect passengers and keep the TSA from changing policy down the road. Again, what's to stop the TSA from using clearer images or different technology later?

Is the loss of freedom, privacy, and quality of life a worthwhile trade-off for unproven protections from a terrorist threat that has a 1 in 10 million chance of killing someone over a ten year time period?

Could all this hype be just another way to sell more security technologies, soften us up for future wars, increased spending on the military, and the evisceration of our civil liberties?Walking through a whole-body scanner or taking a pat-down shouldn't be the only two options for citizens living in a free society.

Now let's get to the article William Fisher of IPS:

Last year, the groups asked DHS Secretary Janet Napolitano to give the public an opportunity to comment on the proposal to expand the body scanner programme. She rejected the request. Since that time, the groups charge that evidence has emerged that "the privacy safeguards do not work and that the devices are not very effective".

...

The petition states that the body scanners are not effective and are not designed to detect the type of powdered explosive that was involved in the Dec. 25, 2009 "underwear bomber" incident. The petition also states that the privacy safeguards do not work and that the body scanners violate religious beliefs, principally among Muslims.

Despite concerns over costs and benefits, privacy, reliability and safety of airport body scanners, the federal government plans to deploy 500 advanced imaging technology units this ear, roll out 500 more in 2011 and operate a total of 1,800 units by 2014, according to recent testimony last to the House Transportation Security and Infrastructure subcommittee.

...

A signatory to the petition, Chip Pitts, president of the Bill of Rights Protection Committee, told IPS, "The full body scanners fall into the same misleading 'techno-utopian' mindset that focuses on the symptoms rather than the causes of terrorism and assumes that some new surveillance technology will somehow eliminate all risk of terrorist incidents."

"What happens instead is that companies push for and the government buys technology that merely fights the last war, produces new intrusions to fundamental freedoms like privacy, the presumption of innocence, and freedom from religious or other discrimination, while yielding only faux security instead of the genuine security promised," he said.

"In the meantime, as Huxley warned in Brave New World, the population becomes used to the new surveillance methods (such as these digital strip searches) that normalise invasions of dignity and serve mainly to enhance government control of the citizenry."

...

The group also contends that documents obtained by EPIC under the Freedom of Information Act "also appear to refute the agency's claims that the devices do not store and record images and that the public does not object to the programme."

...

The petitioners charge that "Deployment of Full Body Scanners in U.S. airports, as currently proposed, violates the U.S. Constitution, the Religious Freedom Restoration Act (RFRA), the Privacy Act of 1974 (Privacy Act), and the Administrative Procedures Act (APA)."

The petition says, "The FBS programme effectively subjects all air travelers to unconstitutionally intrusive searches that are disproportionate and for which the TSA lacks any suspicion of wrongdoing. The FBS Programme also violates the RFRA because it requires those of sincerely held religious beliefs to be subject to offensive intrusions by government officials."

Click here to read the article in its entirety.

Being that I'm a part of this petition, I will most certainly keep anyone interested in this issue up to speed on this blog...

Newsflash: New Study Indicates Young People DO Care About Privacy

Well isn't this good timing?! In my past few posts I have been asserting that people do, young included, care about privacy. The issue isn't that people aren't concerned with privacy, as corporate interests that profit off sharing and selling our private information would like us to all believe (I'm looking at you Google, Yahoo, Facebook, etc.), the issue is proper and user friendly standards do not yet exist on the web to make it easier to choose privacy and protect ones data.

Now, a new study by researchers at UC Berkeley and the University of Pennsylvania indicate younger adults DO want increased privacy and have views similar to those of their elders, even with social networks encouraging them to share more online.

In a recent post I compared this dilemma regarding privacy with that faced by those hoping the public will also become more environmentally conscious, writing:

"People want to, if enabled, to recycle, to drive more efficient cars, and to even use solar energy in their homes. BUT, not if its made overly difficult, or costly, and if "systems" aren't in place, usually through law, that make it easy, logical, and practical, they won't.

In the case of the environment, its the automakers, big oil, big coal, nuclear, and others.
When it comes to privacy, it’s the HUGE money that can be made off our data.

The fact is people want, if enabled, to protect their privacy and control their data. BUT, not if it’s made difficult, confusing, or time consuming.

And this is why new rules, laws are so desperately needed for cyberspace...If we are given an easy to use and understand "system" (i.e. laws) that allows us to protect our data, share it only through opting in, then we will. If it’s like solving a Rubik’s Cube to do so, we won't.

The good news is it takes very little to create such "systems" that enable us to make better life choices, for ourselves as individuals, and for the society as a whole. The fight is rarely in the practicality of the laws, or system itself, but rather in the corporate interests that are fighting change...because that change might undercut their profits.

So if we value privacy as a social good (which it is), and a fundamental liberty and right, then we MUST put rules and laws in place that protect it as such. We are told by the same interests that profit off our information that privacy is dead, and people don't care about it anymore. Well, that's easy to say when you are the ones developing the complicated and difficult to find privacy settings consumers have to deal with in order to make money off of that very "complication".

Now let's get to the study, as reported in the San Francisco Chronicle:

"The data show that they and older adults are more alike on many privacy topics than they are different," the researchers concluded.

For example, 82 percent of respondents ages 18 to 24 and 84 percent ages 25 to 34 said they have refused to provide information to a company because they thought it was too personal or not necessary. The percentage was 85 percent for people 65 and older.

And 84 percent of those 18 to 24 believed their permission should be sought before someone uploaded a photo or video of them, statistically close to the 88 percent or more for people older than 45 who had the same belief.

There were differences that showed up when respondents were asked whether a company should be fined more or less than $2,500 for illegally using personal information. While at least 76 percent of Americans 45 or older picked more than $2,500, only 54 percent of people 18 to 24 did the same.

"Public policy agendas should therefore not start with the proposition that young adults do not care about privacy and thus do not need regulations and other safeguards," the researchers said.

The results reflect how younger people are less likely to view institutions such as Facebook as a source of risk for privacy problems and may be less aware of privacy laws than older adults, Hoofnagle said.

Facebook, which has more than 400 million members, has particularly come under fire for changes in its privacy settings that placed more personal information in public.

Click here to read more.

What makes this study so important is its paramount that we shift the burden from the individual trying to protect his/her privacy and onto the company that is storing, sharing or selling it. While this seems like a no brainer, more and more, whether its the Smart Grid, behavioral marketing on the net, or social networking sites, the debate has centered on the opt-in versus opt-out principles, and which should be the rule of thumb.

Obviously this study makes it ABUNDANTLY clear that the opt-in standard isn't only right in terms of legal control over ones information, but its what people overwhelmingly WANT! Something to remember as we watch these privacy debates progress...particularly out there in cyberspace in the information age...

Privacy Advocates File Complaint to FTC on Behavioral Marketing

Some good news on the regulatory front: Privacy advocates plan to file a complaint with federal regulators against tracking and profiling practices used by Google, Yahoo, Microsoft and other Internet companies to auction off ads targeted at individual consumers in the fractions of a second before a Web page loads.

The complaint being filed is by the Center for Digital Democracy, U.S. PIRG, and the World Privacy Forum, charging that a "massive and stealth data collection apparatus threatens user privacy," and asks regulators to compel companies to obtain express consent from consumers before serving up "behavioral" ads based on their online history.

Internet companies will be asked to acknowledge that the data they collect about a person's online movements through software "cookies" embedded in a Web browser allows advertisers to know details about them, even if those cookies don't have a person's name attached.

As I said in a post last week, people want, if enabled, to protect their privacy and control their data. BUT, not if it’s made difficult, confusing, or time consuming. And this is why new rules, laws are so desperately needed for cyberspace...we need "systems" that will allow users to control their information in an easy, logical, and practical way.

The good news is it takes very little to create such "systems" that enable us to make better life choices, for ourselves as individuals, and for the society as a whole. The fight is rarely in the practicality of the laws, or system itself, but rather in the corporate interests that are fighting change...because that change might undercut their profits.

When it comes to privacy, it’s the HUGE money that can be made off our data. If we are given an easy to use and understand "system" (i.e. laws) that allows us to protect our data, share it only through opting in, then we will. If it’s like solving a Rubik’s Cube to do so, we won't.

So if we value privacy as a social good (which it is), and a fundamental liberty and right, then we MUST put rules and laws in place that protect it as such.

We are told by the same interests that profit off our information that privacy is dead, and people don't care about it anymore. Well, that's easy to say when you are the ones developing the complicated and difficult to find privacy settings consumers have to deal with.

As privacy expert Bruce Schneier recently wrote, "People, including the younger generation, still care about privacy. Yes, they're far more public on the Internet than their parents: writing personal details on Facebook, posting embarrassing photos on Flickr and having intimate conversations on Twitter. But they take steps to protect their privacy and vociferously complain when they feel it violated. They're not technically sophisticated about privacy and make mistakes all the time, but that's mostly the fault of companies and Web sites that try to manipulate them for financial gain.

Here's the problem: The very companies whose CEOs eulogize privacy make their money by controlling vast amounts of their users' information. Whether through targeted advertising, cross-selling or simply convincing their users to spend more time on their site and sign up their friends, more information shared in more ways, more publicly means more profits. This means these companies are motivated to continually ratchet down the privacy of their services, while at the same time pronouncing privacy erosions as inevitable and giving users the illusion of control.

There's no malice on anyone's part here; it's just market forces in action. If we believe privacy is a social good, something necessary for democracy, liberty and human dignity, then we can't rely on market forces to maintain it. Broad legislation protecting personal privacy, by giving people control over their personal data is the only solution.

With that, let's get to the article in the San Jose Mercury News regarding this new effort to establish some privacy rules of the road.

Mike Swift writes:

"This idea that a cookie is nonpersonal information no longer really applies in this digital age. You don't need to know a person's name to know a person - to understand their likes and their dislikes, the contents of what they read, what they put in their shopping cart. It's really personal now," Jeff Chester, executive director of the digital center, said in an interview. "There's a balance that needs to be set here," he added of the groups'complaint against so-called "real-time" and "behavioral" advertising. "We want online advertising to flourish, but there has to be some rules."

...

Behavioral advertising refers to the practice of tracking an individual's online movements and using the portrait that emerges to target advertising.

Google launched what it dubbed "interest-based advertising" about a year ago, saying it would make advertising more relevant and interesting by tracking users and categorizing their interests in topics such as sports, gardening, cars and pets. More recently, Google, Yahoo and other advertisers have built their capacity to provide "real-time" ads — adding the element of immediacy by targeting ads that take into account a person's up-to-the-minute behavior. Such real-time ads can be targeted in the 50 milliseconds or less between the time a person clicks on a Web site and the time the page appears.

...

The gist of the disagreement is that privacy advocates say Internet companies should obtain prior consent from users for behavioral advertising, while Yahoo, Google and other companies say the right policy is to allow consumers to opt out if they don't want to be tracked online.

Besides Google and Yahoo, the FTC complaint also names smaller online advertisers such as AppNexus, MediaMath, Rubicon Project and Rocket Fuel. Chester said he and other privacy advocates are particularly concerned that some online marketers are developing the ability to combine a person's Internet history with personal data from their offline life — such as the consumer's race, gender, profession and income — to fine-tune online ad targeting.

Click here to read more.

An article in News Factor ads some context and details to this issue.

Technologies that enable the real-time profiling, targeting and auctioning of consumer data are becoming commonplace as companies incorporate an array of outside data sources for sale online, warned PIRG's Ed Mierzwinski. "In just the last few years, a growing and barely regulated network of sellers and marketers has gained massive information advantages over consumers," he said. "Consumers will be most shocked to learn that companies are instantaneously combining the details of their online lives with information from previously unconnected offline databases without their knowledge, let alone consent," Mierzwinski said.

...

Ad targeting involves many sensitive areas that require scrutiny -- including medications and health services, the FTC complaint asserted. "For example, Google's DoubleClick Ad Exchange permits the targeting of a wide range of health and financial behaviors," the filers observed.

"These include arthritis, diabetes, GERD and digestive disorders, migraines, sleep disorders, pain management, credit cards, loans and insurance." According to Privacy Choice, any site in Google's vast AdSense network may carry ads placed by third-party ad companies, which Google calls "certified ad networks," the filing noted. "This is an important privacy development, as it means that more than 80 new companies may now use or collect user behavioral information through Google ad tags that are already installed on millions of web pages."

...

What's more, the groups believe that consumers ought to receive fair financial compensation for the use of their data. Additionally, they want the FTC to prepare a report that informs consumers and policy-makers in Congress about the privacy risks and consumer-protection issues involved.

Click here for more.

The Nation Editorial: The Surveillance Regime

I was happy to find an editorial by The Nation magazine today entitled "The Surveillance Regime" today. I say this not because its good news that Obama has been such a deep disappointment when it comes to issues related to privacy and civil liberties, but rather, because this fact has not received deserved attention, and condemnation, from the left.

The trend, on these issues, and others, paint a disturbing narrative, a narrative that points in one direction only: an increasingly intrusive surveillance state with an all powerful Executive Branch that is essentially above the law.

The editorial will lay out some of the specific ways in which the Obama Administration has, in some respects, doubled down on Bush Administration crimes and efforts to expand Executive power. First though, let me just explain why this is so important.

If we can all go back in time for a minute, and remember those dark days of the Bush Administration (i.e. all of them), we should also remember the consistent, vehement, and vocal opposition from the left of Bush assaults on privacy and the constitution, from eavesdropping, to indefinite detention, to state secrets, to the Patriot Act abuses, and so, and so forth.

This vehement opposition was of course warranted, and important. But now that Obama is President, and CONTINUING THESE POLICIES, the same outcry that once existed has become a whimper. No, I'm not talking about groups like the ACLU or EFF, but certainly Democrats in Congress, left wing talk radio, and even newspaper editorial boards.

And why is this silence so damaging? Because a so called "liberal" President, a constitutional scholar no less, has now codified what just a few years ago were rightly considered radical attacks on the Constitution and Rule of Law. Now those very same policies have not only been embraced by the new President, but has been accepted by the Democrats in Congress!! In other words, the ball has just moved WAY towards the neoconservative worldview, and their interpretation of an all powerful Executive Branch.

The idea that because Obama is more intelligent, measured, and schooled in constitutional law than Bush (all of which is true), that this somehow means we should entrust him with near unchecked powers, be it wiretapping, assassination of American citizens, or indefinite detention, is patently absurd. Even if it were true that he would use these powers wisely (which is impossible), what's to say the next President will too?

Glenn Greenwald articulated my point (one I've been making here for quite some time) perfectly in a post of his today, stating: Here again, we see one of the principal and longest-lasting effects of the Obama presidency: to put a pretty, eloquent, progressive face on what (until quite recently) was ostensibly considered by a large segment of the citizenry to be tyrannical right-wing extremism (e.g., indefinite detention, military commissions, "state secrets" used to block judicial review, an endless and always-expanding "War on Terror," immunity for war criminals, rampant corporatism -- and now unchecked presidential assassinations of American citizens), and thus to transform what were once bitter, partisan controversies into harmonious, bipartisan consensus...

With that, let's get to The Nation's editorial:

Ever since Barack Obama took office, accountability for rights violations during the "war on terror" has been thin. Victims of wrongful overseas detention, surveillance and torture have received no apology and no reparations. Despite an early commitment to close Guantánamo, 183 prisoners remain there. Indeed, Obama has released fewer detainees than Bush did during his last year in office. And despite an early promise to protect the First Amendment rights of Muslim charities, Obama has done nothing to change the onerous application of terrorism financing laws. Walker's decision is only the second to have ruled against the so-called Terrorist Surveillance Program. All other challenges--including one against the odious 2008 FISA Amendments Act (FAA), which The Nation has joined as a plaintiff--ultimately got booted at the courthouse door.

...

Continuity, not change, has characterized the conduct of Eric Holder's Justice Department. Walker documents, in his opinion, the government's persistent "refusal to cooperate with the court's orders," its improper use of procedural delays and even point-blank refusals to produce information. Yes, this was business as usual during the Bush era. But Walker was talking about events on Obama's watch.

Nor is Walker's experience unusual. In lawsuits by survivors of the CIA's "black sites" and Guantánamo's interrogation rooms, the government either keeps insisting that "state secrets" require outright dismissal or has stuck to the canard that noncitizens forcibly brought into US custody overseas lack all constitutional rights. In Guantánamo litigation, habeas lawyers complain about obfuscation, secrecy and delay not dissimilar from what they faced in the Bush era.

Click here to read more.

Bruce Schneier on Facebook and Google: "These companies say privacy erosion is inevitable-but they're making it so"

For anyone that reads my stuff regularly you'll know I quote Bruce Schneier whenever I get the chance. I guess the reason is self explanatory: the guy REALLY knows what he's talking about.

So, it was with great pleasure that I came across his op-ed in Forbes magazine that calls out both Google and Facebook (as I often do here) for their anti-privacy policies.

For a backdrop on the history of these behemoths abysmal record on privacy and their continuous oppositional stance towards it, I suggest you check out some of my past posts. I just posted a fairly extensive run down of Facebook on Friday, and here's a fairly recent one I wrote on Google.

Before I get to the article, that I will post nearly in full, let me highlight a recent study that tells the story about what Facebook, and other social networking sites are doing to undermine privacy (and which could be stopped immediately without effecting the general enjoyment one gets from using them).

The study found that the 43 leading sites made privacy control settings difficult to find and to understand; and the defaults were almost always set to allow maximum dispersal of data. That's just a taste of wherein lies the problem...check out my posts for more.

As I stated to the PUC two weeks ago, with Google lobbyists in the room no doubt, "...one Google product after another – from Google Buzz to Google Books - has been a virtual privacy train wreck. The company's refusal to make public how often information about their users is demanded by, or disclosed to the government, is all the more disconcerting."

Google’s CEO, Steve Schmidt recently stated "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place."

As you let that sink in, he also said:

"… the reality is that search engines including Google do retain this information for some time, and it's important, for example that we are all subject in the United States to the Patriot Act. It is possible that that information could be made available to the authorities."

Finally, I also quoted Scheier to the Public Utilities Commission, a quote I think deserves repeating: “…lack of privacy shifts power from people to businesses or governments that control their information. If you give an individual privacy, he gets more power…laws protecting digital data that is routinely gathered about people are needed. The only lever that works is the legal lever...Privacy is a basic human need…The real choice then is liberty versus control.”

With that, let's get to the man himself. Schneier writes in Forbes:

In January Facebook Chief Executive, Mark Zuckerberg, declared the age of privacy to be over. A month earlier, Google Chief Eric Schmidt expressed a similar sentiment. Add Scott McNealy's and Larry Ellison's comments from a few years earlier, and you've got a whole lot of tech CEOs proclaiming the death of privacy--especially when it comes to young people.

It's just not true. People, including the younger generation, still care about privacy. Yes, they're far more public on the Internet than their parents: writing personal details on Facebook, posting embarrassing photos on Flickr and having intimate conversations on Twitter. But they take steps to protect their privacy and vociferously complain when they feel it violated. They're not technically sophisticated about privacy and make mistakes all the time, but that's mostly the fault of companies and Web sites that try to manipulate them for financial gain.

...

People's relationship with privacy is socially complicated. Salience matters: People are more likely to protect their privacy if they're thinking about it, and less likely to if they're thinking about something else. Social-networking sites know this, constantly reminding people about how much fun it is to share photos and comments and conversations while downplaying the privacy risks. Some sites go even further, deliberately hiding information about how little control--and privacy--users have over their data. We all give up our privacy when we're not thinking about it.

...

Here's the problem: The very companies whose CEOs eulogize privacy make their money by controlling vast amounts of their users' information. Whether through targeted advertising, cross-selling or simply convincing their users to spend more time on their site and sign up their friends, more information shared in more ways, more publicly means more profits. This means these companies are motivated to continually ratchet down the privacy of their services, while at the same time pronouncing privacy erosions as inevitable and giving users the illusion of control.

You can see these forces in play with Google's launch of Buzz. Buzz is a Twitter-like chatting service, and when Google launched it in February, the defaults were set so people would follow the people they corresponded with frequently in Gmail, with the list publicly available. Yes, users could change these options, but--and Google knew this--changing options is hard and most people accept the defaults, especially when they're trying out something new. People were upset that their previously private e-mail contacts list was suddenly public. A Federal Trade Commission commissioner even threatened penalties. And though Google changed its defaults, resentment remained.

...

Facebook tried a similar control grab when it changed people's default privacy settings last December to make them more public. While users could, in theory, keep their previous settings, it took an effort. Many people just wanted to chat with their friends and clicked through the new defaults without realizing it.

Facebook has a history of this sort of thing. In 2006 it introduced News Feeds, which changed the way people viewed information about their friends. There was no true privacy change in that users could not see more information than before; the change was in control--or arguably, just in the illusion of control. Still, there was a large uproar. And Facebook is doing it again; last month, the company announced new privacy changes that will make it easier for it to collect location data on users and sell that data to third parties.

With all this privacy erosion, those CEOs may actually be right--but only because they're working to kill privacy. On the Internet, our privacy options are limited to the options those companies give us and how easy they are to find. We have Gmail and Facebook accounts because that's where we socialize these days, and it's hard--especially for the younger generation--to opt out. As long as privacy isn't salient, and as long as these companies are allowed to forcibly change social norms by limiting options, people will increasingly get used to less and less privacy.

There's no malice on anyone's part here; it's just market forces in action. If we believe privacy is a social good, something necessary for democracy, liberty and human dignity, then we can't rely on market forces to maintain it. Broad legislation protecting personal privacy, by giving people control over their personal data is the only solution.

Click here for the rest of the article (though I admittedly nearly posted all of it).

I can't agree with him more. I used to work, and still occasionally do (and will again in the future), on environmental issues, and the dilemma is very similar. People want to, if enabled, to recycle, to drive more efficient cars, and to even use solar energy in their homes. BUT, not if its made overly difficult, or costly, and if "systems" aren't in place, usually through law, that make it easy, logical, and practical, they won't.

The good news is it takes very little to create these "systems" that enable us to make better life choices, for ourselves as individuals, and for the society as a whole. The fight is never in the practicality of the laws, or system itself, its in the special, usually corporate interests that are fighting change...because that change might undercut their profits.

In the case of the environment, its the automakers, big oil, big coal, nuclear, and others. When it comes to privacy, its the HUGE money that can be made off our data, both through selling it and then utilizing it for marketing.

So the fact is, privacy is similar. If we are given an easy to use and understand "system" (i.e. laws) that allows us to protect our data, share it only through opting in, then we will. If its like solving a Rubic's Cube to do so, we won't. So we come down to the choice that Schneier articulates: if we value privacy as a social good (which it is), and a fundamental liberty and right, then we MUST put rules and laws in place that protect it as such.

Facebook Doubles Down on Disdain for Privacy

Before I get to the latest astonishingly bad privacy policy of Facebook, let's take a trip back through some of the companies greatest hits. Now, as I have written here in the past, with the explosion in popularity of social networking sites, the ability to protect ones personal privacy has become increasingly challenging.

Social networking sites like Facebook (which I use) reveal a considerable amount of information about a user's lifestyle, interests, and goals. Depending on the user's settings, co-workers, employers, and certain family members could have access to information about the user that may be better left unknown.

But it gets worse, a lot worse. A recent study found that the 43 leading sites made privacy control settings difficult to find and to understand; and the defaults were almost always set to allow maximum dispersal of data.

Recent Facebook flaps have highlighted the growing concern about the increasingly sophisticated technologies used to track online activities in an effort to more precisely target advertising. What has also become apparent is that these social networking sites have not exactly been forthcoming about how much user information they harvest, share, and with whom.

On the bright side, users have been becoming more and more conscious of privacy concerns, as Facebook has been criticized for not allowing people to permanently delete their accounts and personal information from the site as well as their use of "Beacon" (no longer in use) - a technology that tracks user's online purchases and informs their friends.

But Facebook didn't stop there. Next, they released their new privacy settings, that were new, but were actually less private.

There's more "publicly available information" that you can't control, there was the official "recommendation" that users should loosen their privacy settings, since Facebook's recommendations are less private than the previous default settings, most users have to click through to another page of privacy controls in order to strengthen their settings, and finally, the default settings are all set to the LEAST private setting

Even if your Facebook profile is "private," when you take a quiz or run any other application, that app can access almost everything in your profile: your religion, sexual orientation, political affiliation, pictures, and groups. And these apps may have access to most of the info on your friends' profiles too—which means if your friend takes a quiz, they could be giving away your personal information, even if you've never used an app!

The privacy settings that address this issue remain buried behind too many layers of menus and the new controls still fail to explain what applications can really see.

Then there's government and law enforcement access. Facebook reportedly receives up to 100 demands each week seeking information about its users. AOL reportedly receives 1,000 demands a month. In 2006, a U.S. Attorney demanded book purchase records of 24,000 Amazon.com customers. (In a show of loyalty to users, the company successfully fought back against the subpoena.)

As Nicole Ozer of the ACLU pointed out, "We shouldn't have to pay for these seemingly free online services with personal details about our lives."

With all that said, one would think that Facebook would have learned its lesson - or at least not come out with a plan that doubles down on its disdain for privacy. But that's exactly what they did last week (I was on vacation so couldn't post on it).

I gotta say, even I was a bit surprised by this brazen proposal. As Jared Newman of PC World notes, Under Facebook's current rules you're asked first if you want to share information (your name, photos and friends list) with third-party sites. The proposed policy, which Facebook hasn't implemented yet, would bypass asking you for approval when visiting some sites and applications Facebook has busines relationships with, sharing limited personal information automatically.

In other words, if Facebook deems a Web site or application trustworthy, it'll immediately grab your information when you visit or use it, provided you're logged into Facebook when that happens. Users will be able to opt-out, but it's not clear if this would happen on a user's settings page or by some other means. Facebook didn't get into specifics on when these changes will be made, why they're happening now or which sites will be participating.

...

Facebook users are understandably sensitive about what the site does with their personal data. In 2007, the site got into hot water over Beacon, which logged user activity on third-party sites even when they weren't logged into Facebook, and optionally published that activity to users' profiles. That resulted in a $9.5 million lawsuit settlement last December. This proposal differs from Beacon in that the user must be logged into Facebook to share data, and there's no indication that Facebook will log or publish what you do on those sites.

Facebook also retooled user privacy settings in December in hopes that people would make parts of their profiles public. That effort backfired when users realized their friends lists were made public even when the rest of their profiles were not, causing Facebook to relent and tweak its settings.

Click here to read more.

Facebook’s draft privacy policy states that we'll be able to opt-out of these sites, and we'll also be able to opt-out of these ‘pre-approved’ experiences entirely. But by default, we're all in. Seems a bit inconvenient, no?

Another immediate question I had was what personal information are they sharing? Here’s how Facebook defines the term ‘General Information’:

The term General Information includes your and your friends’ names, profile pictures, gender, connections, and any content shared using the Everyone privacy setting. We may also make information about the location of your computer or access device and your age available to applications and websites in order to help them implement appropriate security measures and control the distribution of age-appropriate content.

That's a lot of information if you ask me. As the PC World article notes, Facebook users aren't too happy about this new policy:

Right now, there are more than 900 comments on the blog post in which Facebook Deputy General Counsel Michael Richter announced the proposed changes. Most of them are negative (though more than 2000 people "like" the blog post itself). Users are particularly angry that the third-party data sharing is opt-out, meaning users will take part by default.

Let's hope a large enough outcry from users will suffice in Facebook rethinking this new policy...that really sets the bar for intrusiveness and bad privacy policy.

And, if you're like me, and had some problems figuring out Facebook's privacy settings, check out this two part video series explaining how to do it right...something I'm going to go over myself again tonight.

Watch Part 1.

Watch Part 2.