Privacy is in the Eye Pocketbook of the Beholder

Facebook sues to protect its users’ privacy from phishing spammers while being struck with a complaint by EPIC for reducing its users’ privacy. This is not so much about upholding privacy but rather deciding who makes money from personal information.

On 12/14/09 Facebook filed a lawsuit against alleged spammers (PDF):

This action arises from … theft and misuse of the usernames and passwords of Facebook users to gain unauthorized access … and send … (SPAM) to Facebook Users. Defendants’ SPAM directs unsuspecting recipients … to third-party commercial websites that pay Defendants for driving traffic to their websites.

On 12/17/09 The Electronic Privacy Information Center (EPIC) filed a complaint with the FTC (PDF):

Facebook’s changes to users’ privacy settings disclose personal information to the public that was previously restricted. Facebook’s changes to users’ privacy settings also disclose personal information to third parties that was previously not available. These changes violate user expectations, diminish user privacy, and contradict Facebook’s own representations.

I recently wrote a blog on Facebook’s new privacy settings and “Transition Tool” where I urged users to NOT take the default “Everyone” settings.

Of course, why did Facebook make these changes? Making Facebook “more open and connected” plus Facebook's agreement with Search Engines drives more traffic to Facebook webpages. This results in more advertising dollars for Facebook.

Not that Facebook’s and the spammers’ actions are the same, but in the end it comes down to others gaining financially from a reduction in users’ privacy.

Look for further “improvements” (read: reduction) in privacy from Facebook in the future, and in general carefully consider what information you share in any social networking/media site.

Facebook's New “Transition” Tool and Privacy

12/9/09 Facebook launched “new privacy settings and tools to give you greater control over the information you share on Facebook”. For many users this may be their first exposure to Facebook privacy settings, and while it’s better than nothing, it can be improved greatly.

The three components of this launch are:

• Transition Tool
• Changes in how Security/Privacy works
• Publisher Security

But I think the key change is the definition of Everyone. As I suspected back on 10/7/09 Take Control of your Facebook security & privacy settings, Facebook’s Everyone now means Everyone on the internet:

Remember, any information that's visible to Everyone may be seen by everyone on the internet. It will be visible to anyone viewing your profile, and Facebook-enhanced applications and websites that you use will be able to access it. Additionally, it may be visible in search engines or through RSS feeds.

(note that link only works AFTER you've completed the transition)

You may have noticed Google’s new real-time search (demo video) and may have heard about Facebook’s agreement with to feed data to Google. Currently, all this includes is Public Page updates, not Profile Posts. But Microsoft’s Bing DOES have access. Other search engines who knows. It’s only a matter of time until all of your Facebook Everyone-shared content is available by the search engines, possibly in real-time.

Transition Tool
The Transition tool will be required for all ALL users to review and update their privacy settings. On your next login you’ll go through the transition process.

Warning: Do NOT take Facebook’s recommendations for Everyone!

I don’t like Facebook’s recommended settings – they are too permissive. For instance, there’s direct Identity theft issues such if you’ve specified your Family Members in Facebook, someone may be able to find your mother’ maiden name. Less directly, they could use your information to answer any of those security questions that financial websites tend to give (“Where city were you born in?”, “What is the name of your first pet?”, etc.) Then there’s just personal info such as your “Looking For”, your Photos, Status Updates, etc.

Warning: If you’ve already done substantial changes to privacy be very careful to select “Old Settings” or you might have to go back and, for example, change all your photo album security manually.

Facebook has a video to guide you:

How do I use the transition tool? [HD]

On your next login you’ll be prompted to run the Transition Tool, or “skip for now”.

You’ll get to review the changes they’re making. For each category on the left, there’s radio button in the middle for the FB recommended, and one on the right for your old settings. It will automatically probably (I've heard it's not in some cases, so verify!) select the option (by pre-selecting the radio button) of the more restrictive setting. The recommended settings are those Facebook has determined are commonly used.

• To understand which category means, click on the small question mark to its right.
• The Privacy setting is shown above the radio buttons for each grouping of categories.
• To see what your old settings are, hover over the radio button.
• To choose a different setting, you’ll have to change the settings later through your privacy settings.

Next save your settings.

Finally, review your settings, organized by level of privacy, and confirm them.

Overview (only available to users AFTER you’ve gone through the transition)

Changes in how Security/Privacy Works
There are quite a few changes. Look for a forthcoming blog on the details.

Overview of changes:

• “A simpler Privacy Settings page.”
• You’ll need to enter your password prior to making changing any Privacy Setting.
• Location (Regional) Networks are gone, leaving only School and Work Networks.
• Your location is shown as your Current City/Region Field from your Profile
• “Tool to control the audience for each and every post you create.” See Controlling the Audience of Each Publisher Post below.
• The “Basic Set” of publically visible info now includes: Name, Profile Photo, Gender, Location, Networks, Friend list, and Pages. This info is only visible to those with Facebook accounts, Applications, and Website that connect to Facebook.
• “Social Ads” Settings have moved to your Account settings. The settings haven’t changed, just where to find them has.
• Apps will have to ask to have more permissions than the “Basic Set” of info.
• Differences for minors (those under 18): 1) Everyone means: Friends, Friends of Friends, and Networks. 2) No public search engine results. Note that Facebook does not permit profiles for uderage users (those under 13) and will delete these accounts if they are notified.

Controlling the Audience of Each Publisher Post
Previously known as the “Beta Publisher” which was available to those of you who had your profile open to Everyone, it now will be standard for all users.

Publisher is the “What’s on your mind?” box on your profile where you can share your Status, Photos, Videos, Events, Links, and more.

Now it will have the standard Facebook “padlock” security icon from which you can control the audience for your post. Options included are the familiar Everyone (anyone on or OFF of Facebook), Friend and Networks, Friends of Friends, and Custom. The default action for this is controlled by the “Posts by Me” Privacy Setting.

Further Reading

• Facebook Privacy using Friend Lists
• Facebook Application and Content Creation Privacy

Changes
12/10/09 Updated Transition Tool discussion because I've had reports of it not pre-selecting the user's previous settings.

Facebook Application and Content Creation Privacy

While Take Control of your Facebook Security & Privacy Settings (part 1 of this series) provided an overview of Application Privacy, this is a deeper dive and explains how Built-in Apps control some basic functions and default security of Facebook. This is the third in a series, the previous being Facebook Privacy using Friend Lists.

Finding and Setting your Application Settings

1. Hover over Settings (top right of screen)
2. Click Applicaon Settings
3. From the "Show" drop-down (top-right) select "Authorized"

Application settings have to be set for EACH ONE – so it’s better to have fewer than more! For each application, you can "Edit Settings", see its "Profile" (the Facebook page describing the application), or delete it using the "X".

It will take three clicks (“X”, “Remove”, “Okay”) to remove each application, so carefully consider next time you’re offered to add a new application.

Built-in Applications:

• Events
• Gifts
• Groups
• Links
• Notes (should set “new note” defaults)
• Photos (does NOT seem to set “new album” defaults)
• Video (does NOT seem to set “new album” defaults)

Note: there is NO control for (Fan) Pages!

Most Application Settings have three tabs:

• Profile Tab: Checkboxes if the app should be shown on your personal Wall/Info page as a “Box”, and/or if it should be shown as a “Tab”. There’s also Privacy settings that have been described previously in this series.
• Bookmark Tab: Checkbox. Not important to security/privacy.
• Additional Permissions Tab: Items specific to that Application. Most also have a checkbox for “Publish to streams” which means the application can publish to the “wall of a user or a Facebook Page, group, or event connected to the user.” This is similar to “Publish recent activity (one line stories) to my wall” option. You’ll want to carefully consider what applications you allow to create posts for you. Other applications have options on which events (not a formal Event, but specific activities) that should trigger an email to you.

Controlling Privacy when Creating Content
Creating content in each built-in Application is discussed below:

Events – Creating:
Step 1, Privacy:

• Open: “Anyone can see this Event and its content. Anyone can RSVP or invite others to this Event.”
• Closed: “Anyone can see this Event, but its content is only shown to guests. People will need to be invited or request invitations to RSVP.”
• Secret: “Only people who are invited can see this Event and its content. People will need to be invited to RSVP.”

Step 2, Event Options:

• Options on if there’s a wall, what content can be posted, if only admins can post, and control over invites and visibility.

Note: if you create them from your “What’s on your mind?” via Attach: Event, you don’t have the same privacy control.

Gifts - Giving:
Part 4. Method of Delivery:

• Public: “People will see your gift and message. The gift will go in the recipient's gift box and the wall.”
• Private: “People will see the gift but only the recipient will see your name and message. The gift will go in the recipient's gift box but not the wall.”

(Fan) Pages – Creating:
Outside the scope of this article.

Groups – Creating:
Outside the scope of this article.

Links – Creating:
There’s no way to adjust the Privacy of an individual Link as you create it, nor afterward.

Note: You don’t have to create a Link from your “What’s on your mind?” via Attach: Link. Facebook will automatically recognize the URL and create the Attach:Link. You can click the right-side “X” to delete the Attach:Link and while the URL will remain, this update will be simply a status update.

Notes – Creating:
Note Privacy: set the privacy different from the default if you choose.

Photo – Creating a new Album:

Privacy: set the privacy. The default seems to be “Everyone” – this is not changed by the Photo Application settings.

Photo’s created from the “What’s on your mind?” via Attach: Photo end up in different Albums according to how they were created. “Upload a Photo” places it in “Wall Photos” and privacy can not be set at that time (you may have previously set, and can subsequently set privacy). “Take a photo” places it in “Webcam Photos” (you may have previously set, and can subsequently set privacy). “Create an Album” allows privacy settings as usual.

Photo’s created via a Mobile upload go an album called “Mobile Uploads” (you may have previously set, and can subsequently set privacy).

Warning: Like all Facebook Albums, “Wall Photos”, “Webcam Photos”, and “Mobile Uploads” are all restricted to 100 photos. When this limit is reached, a new album with the SAME name is created and its Privacy is defaulted to Everyone. This will not be obvious unless you check. For Mobile upload photos this can be problematic since you are presumably away from your computer, you may not get to (or forget to) change their Privacy for some time.

Videos – Creating:
Privacy: set the privacy. The default seems to be “Everyone” – this is not changed by the Video Application settings.

Video’s created from the “What’s on your mind?” via Attach:Video default to Everyone.

Warning: Mobile upload videos default to Everyone, and since you are presumably away from your computer, you may not get to (or forget to) change their Privacy for some time.

Take Control of your Facebook security & privacy settings: step by step

Revised 2009/10/7.
What Changed?
While this is primarily in response to Facebook's new beta Publisher (their name for how content is shared), it is also good practice to understand and control how your info is shared and used within and external to Facebook. As of 6/24/09 only those who had previously ‘chose to set their profile and status privacy to "Everyone"’ are affected by this new policy and it is unknown yet when it rollout to all others. The “Transition Tool” for the new beta Publisher looks somewhat different than what is presented here but Facebook has stated “we've designed the Transition Tool to respect previous decisions to limit access to information.” So, if you correct it now it will probably stay correct.

What does it mean?
In a nutshell, I believe, anything set to "Everyone" will soon mean the WHOLE WORLD WIDE WEB, so we have to ensure we don't have that setting anywhere, and it's probably a good time to check everything else. Also “Networks” can be counter to your privacy as some can be vary large – although as of 6/2/09 they started phasing out “Regional” Networks (such as “Los Angeles, CA” although my membership still exists as of 10/7/09), so just Work, College and High School networks remain – each has specific criteria for joining.

Privacy Control
Facebook allows you finely control how many aspects of your information or content is shared.  It does this by allowing you to specify "Who can see this?"  "Who" can be anywhere between "No One" and "Everyone" available in the following ways - not all of which are available in all cases (as quoted from Facebook) or are available through the "Customize..." option:

• "Everyone: Anyone, on or off, of Facebook can see it." This is the setting we need to avoid!
• "Friends and (All of My) Networks: People you have confirmed as friends and people in any school or work networks that you've joined can see it."
• All of My Networks: people in any school or work networks that you've joined can see it.
• Some of My Networks: people in selected school or work networks that you've joined can see it.
• None of My Networks: unless they are otherwise friends (and allowed in some way), no people in any school or work networks that you've joined can see it.
• "Friends of Friends: Anyone who is friends with a friend of yours can see it."
• Some Friends: Select individual Friends or Lists can see it.
• "Only Friends: Only people you have confirmed as friends can see it."
• Only Me: Yup, only you can see it.
• No one: Not sure how this is different from "Only Me".
• Except These People: No selection of friend or friend list can see it.

In almost all cases, I would suggest selecting either “Only Friends” or “Friends of Friends”.  You may consider a more complex control by using the ”Customize...” option and then narrowly allowing access.

Profile Privacy Settings

1. Hover over Settings (top right of screen)
2. Click Privacy Settings
3. Click Profile
4. Basic tab (default)

For each item, look at the brief description shown when you click on the “[?]” to the right of each item, then decide who can see this by selecting from the availble options. Personally, I have all mine set to just "Friends".

Click Save Changes (bottom, don't forget!)

1. Click Contact Information tab

For each item decide who can see this by selecting from the availble options. Personally, I have all mine set to just "Friends" except for Email address which I have set to "Only Me"

Click Save Changes (bottom, don't forget!)

Photo Album Privacy Settings

1. Hover over Settings (top right of screen)
2. Click Privacy Settings
3. Click Profile
4. Basic tab (default)
5. Click Edit Photo Album Privacy Settings (middle, under "Photos Tagged of You")

Review each album and decide who can see this by selecting from the availble options. Pay attention to "Wall Photos" and "Mobile Uploads" which are created automatically.

Click Save Changes (bottom, don't forget!)

Search Privacy Settings

1. Hover over Settings (top right of screen)
2. Click Privacy Settings
3. Click Search

Review each item and decide who can see this by selecting from the availble options.  Here's some additional guidance on what these items mean:

• Search Visibility (for Facebook users): this is your own choice: be found, or hidden?
• Search Result Content: Select the items you'd like anyone who isn't a Friend to see if they find you in a search.  Consider deselecting "Pages I am a fan of" - are you a fan of any pages you don't want to be public?
• Public Search Listing: for outside of Facebook, meaning the whole Web.  The resulting page will look as specified under "Search Result Content":

Note: At the end of "Create a public search listing for me and submit it for search engine indexing" open the "see preview" link in another browser to see what this looks like.

Click Save Changes (bottom, don't forget!)

News Feed and Wall Privacy Settings

1. Hover over Settings (top right of screen)
2. Click Privacy Settings
3. Click News Feed and Wall
4. Actions within Facebook tab (default)

Review each item and select those you'd wish to show up in other's News Feeds, your friend's Home Pages, and your Wall. These are your choice.

Click Save Changes (bottom, don't forget!)

1. Click Facebook Ads tab

Review each item and decide who can see this by selecting from the availble options. Here's some additional guidance on what these items mean:

• Allow ads on platform pages to show my information to: Set to "No One". This is an interesting setting as currently it does nothing because "Facebook does not give third party applications or ad networks the right to use your name or picture in ads. If this is allowed in the future, this setting will govern the usage of your information."  Facebook has removed some Advertising networks who were in violation of their policies.  I believe a common example of these were those "(your friend Bob)'s  is 134 - What's your IQ?" (with Bob's picture) ads.

Click Save Changes (right under this setting - there's two "Save Changes" on this page!)

• Show my social actions in Facebook Ads to: Set to "No One". The distinction between these two settings is easily misunderstood: the second ("... Facebook ...") will only show you are a Fan of something that is being advertised.

Click Save Changes (bottom, don't forget!)

Application Privacy Settings

1. Hover over Settings (top right of screen)
2. Click Privacy Settings
3. Click Applications
4. Overview tab (default)

You'll probably want to read this, but good luck with that!

1. Click Settings tab

Review each item and decide who can see this by selecting from the availble options. Here's some additional guidance on what these items mean:

• What Other Users Can See via the Facebook Platform: UNcheck all those, except perhaps (your choice) Profile Picture and Basic Info (click on the "What's this?" link for more info).
• Facebook Connect Applications: UNcheck.  This is an offshoot from Beacon (below) and allows 3rd party sites to share your profile data. More info here.
• Beacon Websites: UNcheck. This nasty little privacy disaster resulted in a class-action lawsuit and will be shut down.

Click Save Changes (bottom, don't forget!)

Application Permisions

1. Hover over Settings (top right of screen)
2. Click Applicaon Settings
3. From the "Show" drop-down select "Authorized"

This shows ALL of your apps I believe. I have over 360!

FOR EACH application, you can "Edit Settings", see it's "Profile", or delete it "X". Typical settings - they vary by appication:

• Profile tab / Box: Control whether this app is "Available" to be or has been “Added” to your Profile to displayed in a “box”.
• Profile tab / Tab: Control whether this app is "Available" to be or has been “Added” to your Profile to displayed in a “tab”.
• Profile tab / Info Section: Control whether this app is "available" to be or has been “added” to your Profile to displayed in the “Info Section”.
• Profile tab / Privacy: defines who can see the Box or Tab. Does NOT matter (I believe) if neither are "Added"
• Bookmark tab / Bookmark …: I believe "Bookmark" is for your own convenience only.
• Additional Permissions tab / Access my data even when I'm not using the application: your choice.
• Additional Permissions tab / Publish recent activity (one line stories) to my wall: your choice.
  

Click Okay (to save)

That was easy, wasn't it!!

See the next article in this series: Facebook Privacy using Friend Lists.

Question & Answer

Q. When is the new beta Publisher in effect?
A. As soon as you see the "lock symbol" to the left of the "Share" button (for the "What's on your mind?" status question)

Q. What will change?
A. Two things: 1) The "Everything" security setting will then mean "Everyone: Anyone, on OR OFF, of Facebook can see it.", and 2) you can change the security setting of your wall post PER ITEM.

Q. Will they change any of our security settings?
A. I don't believe so, BUT, once you see that "lock symbol", double check!