Slashdot Mirror
Google Researchers Warn of Automated Social Info Sharing
holy_calamity writes "Researchers from Google have written a paper about how social networks can undermine privacy. The most interesting scenario they discuss is 'merging social graphs' — when correlating multiple social networks makes it possible to reveal connections that a person has intentionally kept secret (PDF). For example, it may be possible to work out that a certain LinkedIn user is the same person as a MySpace user, despite their attempting to keep their profiles separate. The Google solution is to develop software that screens new data added to a social network, attempting to find out if it could be fodder to such data mining."
how many people will be surprised about Google being the champion of privacy?
The most exciting phrase to hear in science, the one that heralds new discoveries, is not 'Eureka!' but 'That's funny...
I thought Google would be the ones undermining privacy in this case...
1's and 0's should be free.
Also in the "what do you expect?" vein, you're putting lots of personal information on various websites that are publicly available worldwide. What kind of privacy are you expecting?
Hell, I maintain totally different personas on several sites and in many cases have different lies about my identity on each site, and I can still see how people would put the pieces together.
This is a case where multiple pieces of information, that individually do not compromise one's privacy, can actually do so when aggregated and correlated together.
This sort of pattern is why something like Google Street View subverts the privacy laws that we have. Yes, a photo taken from a public location of things viewable from that location, by itself, does not violate privacy, and privacy law has been developed so that each individual photo that Google takes and publishes does not, on its own, violate anybody's privacy. What the law fails to capture is that putting a vast number of such photos together, correlating them with a geographical information system, yellow page listings, satellite imagery, internet search results, and offering it to the general public to use for free, without any restrictions of purpose, does massively violate privacy. So the standard response to privacy challenges to Street View ("the law allows you to take photos of any public place you want") just massively misses the point.
Are you adequate?
Just look at any long thread here on Slashdot and you see a pattern of convergence to a disgruntled, socially frightened, and overworked IT/programmer guy named Anonymous Coward.
On second thought, looks like that applies to most other UIDs here as well. ;-)
On a more serious level, makes me wonder. If such a tool was used to narrow down a suspect in a crime or malfeasance, would constitutional guarantees against self-incrimination come into play? Could one argue that intentional postings of information pseudo-anonymously are implicitly protected from meta-analytical incrimination?
Not that I have any thing to, umm, hide, mind you....
While that is a completely fair thing to point out, there is a very important thing that it misses: other people can put information about you online, without your permission, and that information is just as subject to analysis as what you put up.
The two best examples that come to mind right away:
Notice that both of these acts are perfectly legal, and while the second arguably should be regulated and restricted by law (the aggregation, correlation and publication parts, not the picture-taking part), the first one ought not to.
Are you adequate?
I don't have a LinkedIn profile. I had a MySpace, but I killed it. My Facebook account does have political rants and opinions, but I don't have any pictures that could prove embarrassing. Google my name, and you'll find political rants I've posted on Yahoo! Groups and similar.
However, I currently have something that can't hold a candle to being careful on Facebook: an employer that doesn't care what I do off the clock. As long as I stay out of trouble with the law and notify my employer if I'm moonlighting, all they care about is that I show up for work and do my job. Should I get on-call duties in the future, I'll be held to a written SLA, and as long as I can respond to calls within an allotted time, they don't care what I was doing. I can even apply for other jobs without fear.
I used to be a K-12 teacher--if you ever think you're being spied on off the job, just be glad you're not a teacher.
- Twice, I was indirectly threatened with termination for looking for other jobs.
- The local newspaper photographed a teacher with a group of animal-rights protesters when the circus came to town. Parents started complaining to the principal saying they didn't want their children in that teacher's class.
- Some students found a picture online of a naked woman who closely resembled--but wasn't--a high school teacher. They took the picture to the school's principal, and the teacher wound up having to defend her teacher certification against revocation--fortunately, she won. I'm not even sure if there's a rule against teachers posing naked, as long as it doesn't directly involve students.
Granted, should I ever find myself looking for a job, a potential future employer might Google me and decide that I'm too liberal (or too something-else) to work there. But the question here is: do I really want to work somewhere they hold employees' personal, legal, off-the-clock lives under a microscope?
If you are concerned about your identity, do you think your domain registrar would give it up if somebody claimed that massive spam was coming out of that interface?
Well sure, but that's a bit of a different issue. That's a question of whether companies that you have private transactions can be trusted to keep your information private. My point was that with social networking sites, you're posting information in a public forum and then expecting privacy-- which doesn't make a lot of sense.
Google warning of privacy issues is like an arsonist holding a can of gas and a lit match shouting FIRE in an already burning theater.
Since the inception of the web, I have been wondering how much longer privacy could last.
People who have grown up with the web tell everything about themselves freely on sites like MySpace. I don't know if this is because they are just stupid from youth or if it is a different paradigm than the old folks had.
But in any event it is clear that privacy is diminishing rapidly. Look at cameras. Everyone carries a camera in their pocket now. Anyone can set up a wifi-connected miniature webcam with very little effort or cost. It's not even very difficult to listen through walls (or especially windows) nor to see at least heat traces through walls. And of course, there are satellites watching everything we do at least outside of walls.
Then think about things like grocery store cards, credit cards, online accounts... And how many people here use a plethora of Google accounts with the blind faith that a mere slogan (Do No Evil) will somehow protect their privacy? Really?
Then think about how cheap data storage is and how everything is not only logged but archived. It might not be used today, but it can be accessed ten years from now, or twenty, or fifty. After all, computers of a decade from now will be able to eat petabytes like Tic-Tacs.
Expecting to maintain an old-school sense of privacy is probably not realistic in this, um, brave new world we live in.
They've ALREADY opened Pandora's box, now they're trying to get some publicity on how they can fix the problem they (at least helped) create.
I don't hate Google, I think they tend to go "Oh, cool, we can do this!" without thinking through the implications of it... much like other clever people in history have done.
A Man's ethical behavior should be based effectually on sympathy, education, and social ties -- Albert Einstein
But that's the whole point: the picture of your house, taken from a public road, as one isolated token of information, does not posit much risk to your privacy at all. Tons of individual people in our society own cameras, and take photos in public places that depict other people's property, and everybody agrees that the owners of said property should not have a right in general to prevent others from taking such photos. The privacy laws we have are built to protect individuals' rights in that sort of isolated case.
The problem is when a corporation starts taking such photos systematically, aggregating them all together and correlating them with other systematic data sets. In that situation, a photo that just happens to contain your house is no longer just that; it's a piece of information that can be used to access many other pieces of information that may allow somebody to infer facts about you that you would rather prefer they couldn't.
Google Street View is only the start. Just wait for the day when digital cameras commonly include GPS units and automatically tag each photo with a precise location and time, which can then be cross-indexed with a geographical information system like Google Maps. I can imagine it already: your wife carelessly forgets to close the window shades one day when they're changing. A neighbor takes a photo of her naked, and posts it to 4chan. Thousands of folks copy the photo all over the web. The photo has GPS information in the EXIF tags. Creepy /b/tards start stalking your wife. You give a resume to a potential employer with your residential address in it; they look up the address in Google Maps, click on the link to show image search results taken nearby, and are treated to a naked picture of your wife.
That's an example where the photo in question is probably illegal to take, but other examples may be concocted where the picture, by itself, is fine. The point of the example isn't the photo; it's how the technologies that we have today for associating one item of information to others make it too easy for people to find out more about you than they should be able to.
To sum up, the privacy laws we have today are laws that were designed to protect people's privacy in yesterday's, pre-computer world. Because of this, they primarily address things like whether somebody had the right to take a given individual photo, and not whether somebody is empowering others to infer facts about you by correlating many individually innocuous items of information.
Are you adequate?
Wow. I hope my Facebook girlfriend doesn't find out about my MySpace girlfriend.
"Live as if you'll die tomorrow." Ridiculous. You could die later today.
A few years ago, Many of us got our first MySpace/Facebook/Friendster etc. Shortly after that, we started to contact and be contacted by all of our old, obscure buddies from high school and whatnot. We plastered our psychological profile and unflattering pictures all over the place as much as we could, with our thousands of "friends" and our "pimped" profiles.
Then we got the E-mail and the phone numbers of the people who we actually gave a shit about, then we realized the folly of our obnoxious seizure-inducing profiles and toned 'em down. Some of us even said "fuck MySpace" only to come back with a barebones profile just in case. Many of us relalized that 96% of our "friends" didn't even respond to us and so we deleted them to remove cruft. An additional 2% did contact us only to leave trite "happy hump day" posts on our profiles -- they eventually became the ones leaving ads and phish links after they were (heh)"hacked". The remaining 2% of them are buddies who we still talk to using old-fashioned methods like voice and E-mail.
Whomever still bites into that "social networking" crap is either an attention-starved teen or a pedophile who wants one.
Don't create accounts for all these social sites in the first place.
But that's not the issue here. The problem is that other people will continue to create social network accounts and can put information in there that violates my privacy.
There's no point in protecting my identity strongly online if all it takes is one person to attribute one of my email addresses to my real name in their Facebook contacts.
This may be the best common ground. The internet made "leveraging the genius" the thing of the 2nd decade (give the world another year to rest & prepare).
Now all any organization has to do is locate one of some 10,000 people worldwide with the knack at seeing ultra-patterns. Most of us aren't that interesting to bother with, so a little camoflage to avoid 5 second name searches is usually enough. But what the real point of the Mrs. S. effect is, "if you annoy the collective Net, they'll borrow a pattern expert and pulverize you".
Web 2.0 and 2.1 are about Sharing.
Web 3.0 and 3.11 will be about privacy.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
All. Everyone will have everyone's information. There's no way it can be removed from everywhere. We learned that if you try to nuke the top ten sites, it just floats around the 100 second tier sites you'll never find.
All we can do is resign ourselves to it and be boring enough not to really be worth the time.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine