Google Researchers Warn of Automated Social Info Sharing

holy_calamity writes "Researchers from Google have written a paper about how social networks can undermine privacy. The most interesting scenario they discuss is 'merging social graphs' — when correlating multiple social networks makes it possible to reveal connections that a person has intentionally kept secret (PDF). For example, it may be possible to work out that a certain LinkedIn user is the same person as a MySpace user, despite their attempting to keep their profiles separate. The Google solution is to develop software that screens new data added to a social network, attempting to find out if it could be fodder to such data mining."

Comments

Aggregation and correlation destroy privacy

[Estanislao Mart�nez]

This is a case where multiple pieces of information, that individually do not compromise one's privacy, can actually do so when aggregated and correlated together.

This sort of pattern is why something like Google Street View subverts the privacy laws that we have. Yes, a photo taken from a public location of things viewable from that location, by itself, does not violate privacy, and privacy law has been developed so that each individual photo that Google takes and publishes does not, on its own, violate anybody's privacy. What the law fails to capture is that putting a vast number of such photos together, correlating them with a geographical information system, yellow page listings, satellite imagery, internet search results, and offering it to the general public to use for free, without any restrictions of purpose, does massively violate privacy. So the standard response to privacy challenges to Street View ("the law allows you to take photos of any public place you want") just massively misses the point.

Other people may publish information about you

[Estanislao Mart�nez]

Also in the "what do you expect?" vein, you're putting lots of personal information on various websites that are publicly available worldwide. What kind of privacy are you expecting?

While that is a completely fair thing to point out, there is a very important thing that it misses: other people can put information about you online, without your permission, and that information is just as subject to analysis as what you put up.

The two best examples that come to mind right away:

1. Facebook allows users to tag photos with the names of the people who appear in them.
2. Google Street View puts photos of your residence without asking you for permission, and correlates it to a bunch of other stuff like geographic information, satellite images, yellow page listings, web search results, etc..

Notice that both of these acts are perfectly legal, and while the second arguably should be regulated and restricted by law (the aggregation, correlation and publication parts, not the picture-taking part), the first one ought not to.

For me...

[Anonymous Coward]

I don't have a LinkedIn profile. I had a MySpace, but I killed it. My Facebook account does have political rants and opinions, but I don't have any pictures that could prove embarrassing. Google my name, and you'll find political rants I've posted on Yahoo! Groups and similar.

However, I currently have something that can't hold a candle to being careful on Facebook: an employer that doesn't care what I do off the clock. As long as I stay out of trouble with the law and notify my employer if I'm moonlighting, all they care about is that I show up for work and do my job. Should I get on-call duties in the future, I'll be held to a written SLA, and as long as I can respond to calls within an allotted time, they don't care what I was doing. I can even apply for other jobs without fear.

I used to be a K-12 teacher--if you ever think you're being spied on off the job, just be glad you're not a teacher.

- Twice, I was indirectly threatened with termination for looking for other jobs.

- The local newspaper photographed a teacher with a group of animal-rights protesters when the circus came to town. Parents started complaining to the principal saying they didn't want their children in that teacher's class.

- Some students found a picture online of a naked woman who closely resembled--but wasn't--a high school teacher. They took the picture to the school's principal, and the teacher wound up having to defend her teacher certification against revocation--fortunately, she won. I'm not even sure if there's a rule against teachers posing naked, as long as it doesn't directly involve students.

Granted, should I ever find myself looking for a job, a potential future employer might Google me and decide that I'm too liberal (or too something-else) to work there. But the question here is: do I really want to work somewhere they hold employees' personal, legal, off-the-clock lives under a microscope?

You're missing the point

[Estanislao Mart�nez]

I'm not sure I understand why a picture of your house, taken from a public road, constitutes an invasion of privacy.

But that's the whole point: the picture of your house, taken from a public road, as one isolated token of information, does not posit much risk to your privacy at all. Tons of individual people in our society own cameras, and take photos in public places that depict other people's property, and everybody agrees that the owners of said property should not have a right in general to prevent others from taking such photos. The privacy laws we have are built to protect individuals' rights in that sort of isolated case.

The problem is when a corporation starts taking such photos systematically, aggregating them all together and correlating them with other systematic data sets. In that situation, a photo that just happens to contain your house is no longer just that; it's a piece of information that can be used to access many other pieces of information that may allow somebody to infer facts about you that you would rather prefer they couldn't.

Google Street View is only the start. Just wait for the day when digital cameras commonly include GPS units and automatically tag each photo with a precise location and time, which can then be cross-indexed with a geographical information system like Google Maps. I can imagine it already: your wife carelessly forgets to close the window shades one day when they're changing. A neighbor takes a photo of her naked, and posts it to 4chan. Thousands of folks copy the photo all over the web. The photo has GPS information in the EXIF tags. Creepy /b/tards start stalking your wife. You give a resume to a potential employer with your residential address in it; they look up the address in Google Maps, click on the link to show image search results taken nearby, and are treated to a naked picture of your wife.

That's an example where the photo in question is probably illegal to take, but other examples may be concocted where the picture, by itself, is fine. The point of the example isn't the photo; it's how the technologies that we have today for associating one item of information to others make it too easy for people to find out more about you than they should be able to.

To sum up, the privacy laws we have today are laws that were designed to protect people's privacy in yesterday's, pre-computer world. Because of this, they primarily address things like whether somebody had the right to take a given individual photo, and not whether somebody is empowering others to infer facts about you by correlating many individually innocuous items of information.

Social networking bigamy

[Valacosa]

Wow. I hope my Facebook girlfriend doesn't find out about my MySpace girlfriend.