Google Researchers Warn of Automated Social Info Sharing

holy_calamity writes "Researchers from Google have written a paper about how social networks can undermine privacy. The most interesting scenario they discuss is 'merging social graphs' — when correlating multiple social networks makes it possible to reveal connections that a person has intentionally kept secret (PDF). For example, it may be possible to work out that a certain LinkedIn user is the same person as a MySpace user, despite their attempting to keep their profiles separate. The Google solution is to develop software that screens new data added to a social network, attempting to find out if it could be fodder to such data mining."

Comments

I Wonder...

[ITEric]

how many people will be surprised about Google being the champion of privacy?

Re:I Wonder...

[ITEric]

I know most people here don't, but try reading the actual paper. Clearly they were analyzing the risks and suggesting ways to put privacy back in the hands of the people.

Re:Well.

[nine-times]

Also in the "what do you expect?" vein, you're putting lots of personal information on various websites that are publicly available worldwide. What kind of privacy are you expecting?

Hell, I maintain totally different personas on several sites and in many cases have different lies about my identity on each site, and I can still see how people would put the pieces together.

Aggregation and correlation destroy privacy

[Estanislao Mart�nez]

This is a case where multiple pieces of information, that individually do not compromise one's privacy, can actually do so when aggregated and correlated together.

This sort of pattern is why something like Google Street View subverts the privacy laws that we have. Yes, a photo taken from a public location of things viewable from that location, by itself, does not violate privacy, and privacy law has been developed so that each individual photo that Google takes and publishes does not, on its own, violate anybody's privacy. What the law fails to capture is that putting a vast number of such photos together, correlating them with a geographical information system, yellow page listings, satellite imagery, internet search results, and offering it to the general public to use for free, without any restrictions of purpose, does massively violate privacy. So the standard response to privacy challenges to Street View ("the law allows you to take photos of any public place you want") just massively misses the point.

Other people may publish information about you

[Estanislao Mart�nez]

Also in the "what do you expect?" vein, you're putting lots of personal information on various websites that are publicly available worldwide. What kind of privacy are you expecting?

While that is a completely fair thing to point out, there is a very important thing that it misses: other people can put information about you online, without your permission, and that information is just as subject to analysis as what you put up.

The two best examples that come to mind right away:

1. Facebook allows users to tag photos with the names of the people who appear in them.
2. Google Street View puts photos of your residence without asking you for permission, and correlates it to a bunch of other stuff like geographic information, satellite images, yellow page listings, web search results, etc..

Notice that both of these acts are perfectly legal, and while the second arguably should be regulated and restricted by law (the aggregation, correlation and publication parts, not the picture-taking part), the first one ought not to.

Re:Other people may publish information about you

[Creepy Crawler]

--While that is a completely fair thing to point out, there is a very important thing that it misses: other people can put information about you online, without your permission, and that information is just as subject to analysis as what you put up.

Absolutely true. However, this information also falls under libel laws in cases which it false and harms the subject.

---The two best examples that come to mind right away:
---1. Facebook allows users to tag photos with the names of the people who appear in them.

It may be a stretch to call it this, but posting stories and pictures usually is a form or journalism, regardless the content and methodology of dissemination. Also, photographers need a release whenever the photo is not taken in a public area, or accessible from a public area of a person who does not consent. It is not a crime to fail to get a release, but a nice tort claim.

---2. Google Street View puts photos of your residence without asking you for permission, and correlates it to a bunch of other stuff like geographic information, satellite images, yellow page listings, web search results, etc..

Google, as long as they obey the law in terms of public/private property, they have full legal standing, and shouldn't be regulated. However, they did get in trouble when they went down private roads, with nice posted NO TRESPASSING signs peppered all over, which the GooCam dutifully captured.

---Notice that both of these acts are perfectly legal, and while the second arguably should be regulated and restricted by law (the aggregation, correlation and publication parts, not the picture-taking part), the first one ought not to.

Sounds like Google-Hatred. Somehow we should just make a law for Google, because they spy on us!! Guess what: You have as much access to the same pictures as I do. And if there is any sort of law, it's that I'd like posting on who (specific names/residences) viewed some area in high resolution. You know, watch the watchers. Sous-veilance.

Re:Other people may publish information about you

[Estanislao Mart�nez]

However, this information also falls under libel laws in cases which it false and harms the subject.

It may not have come across, but I was assuming that the information in question was true, and, taken on its own, largely trivial and harmless. I'm not thinking of a case where, for example, somebody says on their blog that you committed incest with your aunt. I'm thinking of cases like, for example, a hypothetical social networking application that allows people to list you as somebody they know, without requiring your authorization. An application like that would be just as much subject to the kind of analysis detailed in the article, which could easily uncover lots of information about people who never volunteered any of it.

It may be a stretch to call it this, but posting stories and pictures usually is a form or journalism, regardless the content and methodology of dissemination. Also, photographers need a release whenever the photo is not taken in a public area, or accessible from a public area of a person who does not consent. It is not a crime to fail to get a release, but a nice tort claim.

So, what's really the essential difference between these three acts?

1. Showing your friends, in person, a printed-out photo of some people at your party, and pointing out which of them is Joe Smith.
2. Uploading the photo to your Facebook page, and tagging it with Joe Smith's name.
3. Publishing a hard copy book or newsletter that shows the photo, and label the photo with Joe Smith's name.

The law was created to make a distinction between informal sharing and dissemination of the first sort, and "publication" of the third sort. You don't need any model release for #1, and the journalism or modeling arguments are largely irrelevant.

The problem here is that case #2 falls squarely between #1 and #2. Should it be subject to the law for informal sharing, the law for printed publications, or some new, yet-to-be-developed body of law? (And would the court system be able to handle the caseload that treating informal online sharing always as "publication" would imply? People share stuff informally all the time, and they increasingly do it online.)

Google, as long as they obey the law in terms of public/private property, they have full legal standing, and shouldn't be regulated.

"As long as Google obeys the current law, they're obeying the current law, and therefore, we shouldn't change the law."

Um, what? That's a transparently bad argument. This is an argument about whether the law should be changed. Whether Google is following the current law correctly is completely irrelevant. You can't defend againt an argument that the law is wrong by saying that the acts allowed by the law are allowed by the law!

Guess what: You have as much access to the same pictures as I do.

Transparently bad argument too. "It's ok if I have access to these photos that I shouldn't have access to, because you also do have access to them."

For me...

[Anonymous Coward]

I don't have a LinkedIn profile. I had a MySpace, but I killed it. My Facebook account does have political rants and opinions, but I don't have any pictures that could prove embarrassing. Google my name, and you'll find political rants I've posted on Yahoo! Groups and similar.

However, I currently have something that can't hold a candle to being careful on Facebook: an employer that doesn't care what I do off the clock. As long as I stay out of trouble with the law and notify my employer if I'm moonlighting, all they care about is that I show up for work and do my job. Should I get on-call duties in the future, I'll be held to a written SLA, and as long as I can respond to calls within an allotted time, they don't care what I was doing. I can even apply for other jobs without fear.

I used to be a K-12 teacher--if you ever think you're being spied on off the job, just be glad you're not a teacher.

- Twice, I was indirectly threatened with termination for looking for other jobs.

- The local newspaper photographed a teacher with a group of animal-rights protesters when the circus came to town. Parents started complaining to the principal saying they didn't want their children in that teacher's class.

- Some students found a picture online of a naked woman who closely resembled--but wasn't--a high school teacher. They took the picture to the school's principal, and the teacher wound up having to defend her teacher certification against revocation--fortunately, she won. I'm not even sure if there's a rule against teachers posing naked, as long as it doesn't directly involve students.

Granted, should I ever find myself looking for a job, a potential future employer might Google me and decide that I'm too liberal (or too something-else) to work there. But the question here is: do I really want to work somewhere they hold employees' personal, legal, off-the-clock lives under a microscope?

Re:For me...

[Anonymous Coward]

I've got a friend who used to be a great teacher. She loved her job and her students, did lots of volunteer work for students and parents, and volunteered to coach sports. The principal slept with a student, admitted it, resigned and was arrested.

When the police were interviewing students about the principal, one student said he slept with my friend. She was arrested and her mug shot went up all around the world. He later said he was kidding. The police still investigated, as well they should, and dismissed charges.

Problem is, she can't teach anymore. She's easily googleable and you find her mug shot.

Ah, the web.

Shout FIRE

[retech]

Google warning of privacy issues is like an arsonist holding a can of gas and a lit match shouting FIRE in an already burning theater.

So when do we give up on privacy?

[Toe, The]

Since the inception of the web, I have been wondering how much longer privacy could last.

People who have grown up with the web tell everything about themselves freely on sites like MySpace. I don't know if this is because they are just stupid from youth or if it is a different paradigm than the old folks had.

But in any event it is clear that privacy is diminishing rapidly. Look at cameras. Everyone carries a camera in their pocket now. Anyone can set up a wifi-connected miniature webcam with very little effort or cost. It's not even very difficult to listen through walls (or especially windows) nor to see at least heat traces through walls. And of course, there are satellites watching everything we do at least outside of walls.

Then think about things like grocery store cards, credit cards, online accounts... And how many people here use a plethora of Google accounts with the blind faith that a mere slogan (Do No Evil) will somehow protect their privacy? Really?

Then think about how cheap data storage is and how everything is not only logged but archived. It might not be used today, but it can be accessed ten years from now, or twenty, or fifty. After all, computers of a decade from now will be able to eat petabytes like Tic-Tacs.

Expecting to maintain an old-school sense of privacy is probably not realistic in this, um, brave new world we live in.

Re: don't need fancy data-mining tools for that

[nine-times]

If such a tool was used to narrow down a suspect in a crime or malfeasance, would constitutional guarantees against self-incrimination come into play?

No, the right against incriminating yourself basically amounts to "you have the right to remain silent". The police aren't allowed to punish you for not telling them about your crimes. However, anything you do tell them can (and will) be used against you.

(IANAL, but I'm pretty sure I'm right)

You're missing the point

[Estanislao Mart�nez]

I'm not sure I understand why a picture of your house, taken from a public road, constitutes an invasion of privacy.

But that's the whole point: the picture of your house, taken from a public road, as one isolated token of information, does not posit much risk to your privacy at all. Tons of individual people in our society own cameras, and take photos in public places that depict other people's property, and everybody agrees that the owners of said property should not have a right in general to prevent others from taking such photos. The privacy laws we have are built to protect individuals' rights in that sort of isolated case.

The problem is when a corporation starts taking such photos systematically, aggregating them all together and correlating them with other systematic data sets. In that situation, a photo that just happens to contain your house is no longer just that; it's a piece of information that can be used to access many other pieces of information that may allow somebody to infer facts about you that you would rather prefer they couldn't.

Google Street View is only the start. Just wait for the day when digital cameras commonly include GPS units and automatically tag each photo with a precise location and time, which can then be cross-indexed with a geographical information system like Google Maps. I can imagine it already: your wife carelessly forgets to close the window shades one day when they're changing. A neighbor takes a photo of her naked, and posts it to 4chan. Thousands of folks copy the photo all over the web. The photo has GPS information in the EXIF tags. Creepy /b/tards start stalking your wife. You give a resume to a potential employer with your residential address in it; they look up the address in Google Maps, click on the link to show image search results taken nearby, and are treated to a naked picture of your wife.

That's an example where the photo in question is probably illegal to take, but other examples may be concocted where the picture, by itself, is fine. The point of the example isn't the photo; it's how the technologies that we have today for associating one item of information to others make it too easy for people to find out more about you than they should be able to.

To sum up, the privacy laws we have today are laws that were designed to protect people's privacy in yesterday's, pre-computer world. Because of this, they primarily address things like whether somebody had the right to take a given individual photo, and not whether somebody is empowering others to infer facts about you by correlating many individually innocuous items of information.

Social networking bigamy

[Valacosa]

Wow. I hope my Facebook girlfriend doesn't find out about my MySpace girlfriend.