Harvard's Privacy Meltdown

An anonymous reader writes "A team of Harvard researchers has been accused of breaching students' privacy in a project that involved downloading information from some 1,700 Facebook profiles. The case shines a light on emerging ethical challenges faced by academics researching social networks and other online environments."

Comments

Isn't this how Facebook started?

[Chrysocolla]

Maybe one day, they will have a movie about themselves.

I don't get it.

[John R. Isidore]

Was this research into of how Facebook was founded?

Facebook privacy?

[SEWilco]

So privacy was violated by reading what the students chose to publish on Facebook? Just think of all the privacy violations the students do when they read the college course descriptions!

Re:Facebook privacy?

[ceoyoyo]

Human research labours under very strict ethical requirements. Animal research as well. Sociologists get off easy, but apparently some people decided they shouldn't get off quite THAT easily.

Re:Facebook privacy?

[NSN A392-99-964-5927]

Most universities require a review by an ethical board before doing any experimentation. In this case, the researchers passed the review, and gave Facebook (and got permission) notice about what they intended to do.

This research was done several years ago, but apparently now some people wanted to see the data, since they wrote papers about it, and so they released it. Then people complained about the released data. That's it.

To further bolster your post. It shows Facebook will violate and get away with flouting and completely disregard privacy laws.

The moment /. gets off face book I will donate.

Re:Facebook privacy?

[t2t10]

Everybody knows who they are affiliated with. And if they publish under a pseudonym, they might as well not publish at all, since one of the major points of publishing these days is to advance your career.

Re:Facebook privacy?

[Hognoxious]

Huh? Why would they?

You must be new here.

Re:Facebook privacy?

[Thiez]

> An explorer discovers a whole freaking CONTINENT quite a long distance away. But, because you have never tried to move an entire population before, you just dismiss the idea of moving to the continent as "irrational".

You failed to mention that the other continent is millions/billions of miles away through a vacuum and has conditions so inhospitable that you cannot survive for more than a few weeks once you arrive there anyway. It is reasonable to assume that even if the volcano we live on erupts, it is still easier to live on it than on the 'continent' that was discovered.

Try again with a better analogy because yours is crap.

Public or private data?

[pushing-robot]

The article fails to mention whether this information from FB profiles was shared or private.

If it's the latter, the crime lies with the person who gave the researchers free access to it in the first place.

If it's the former, I'm off to violate thousands of people's privacy by reading my phone book's white pages.

Re:Public or private data?

[Anonymous Coward]

Deep within TFA:

But here's where things get sketchy. Mr. Kaufman apparently used Harvard students as research assistants to download the data. That's important, because they had access to profiles that students might have set to be visible to Harvard's Facebook network but not to the whole world

So, probably a mix of world-public and Harvard-network-public. Friend-public data wouldn't have been included.

Re:Public or private data?

[ohnocitizen]

Its the latter:

But here's where things get sketchy. Mr. Kaufman apparently used Harvard students as research assistants to download the data. That's important, because they had access to profiles that students might have set to be visible to Harvard's Facebook network but not to the whole world, Mr. Zimmer argues in a 2010 paper about the case published in Ethics and Information Technology. The assistants' potentially privileged access "should have triggered an ethical concern over whether each student truly intended to have their profile data publicly visible and accessible for downloading," Mr. Zimmer says in an e-mail.

So students who might have posted photos, updates, notes, political commentary, expecting it to be shown only to friends, friends of friends, or people in their network, might suddenly find ALL of that data, plus extrapolations about what it says about them, displayed publicly.

Sounds like a clear cut privacy violation, they were right to pull the data.

Re:Public or private data?

[pushing-robot]

Thanks for finding that; I had skimmed the article and searched it for some keywords but apparently missed that section.

Still, IMHO giving 40,000 students, faculty and staff access to a piece of information should count as "displaying it publicly".

It's as if I put a billboard on campus; then, when a photo of it started circulating on the Internet, I claimed that my privacy was being violated—the billboard was intended to be viewed by Harvard students, faculty, staff, visitors, random people walking aimlessly by, and squirrels...but NO ONE ELSE!

Re:Public or private data?

[deeceefar2]

Harvard got it wrong. It was made public when the friends who had the right to publish the information published it.

There was no implied or actual restrictions on the data the students pulled from their own facebook network, and if anything, this should have stood as a lesson to people sharing information on social networks. I won't go so far as to say they posted it in public, but they did consent to having their "friends" use that information however they saw fit. When that happened they gave up their rights to dictate how that information spread from their friends.

Example:
Sussy posts a status update that she is pregnant. Sussy's friend Sally is still friends with Sussy's ex-boyfriend Kevin who Sussy unfriended. Kevin hears from Sally that Sussy is pregnant, and posts on his wall that his ex-girlfriend has loose morals because she is already pregnant after they just broke up. It is Sussy's fault Kevin knows, and she might as well have made it public, because Sally can tell whomever she wants the "secret."

In this case these people posted the information on their public secret sharing place with nothing preventing anyone with access to this information from taking it and using it however they wanted. I would say it is their friends right to make the information public as there was nothing implied or otherwise to tell them not. In giving it to the researchers they made the information public. So the researchers were fine in using the information as far as the privacy policy was concerned.

This was already approved

[lavagolemking]

But Mr. Kaufman talks openly about another controversial piece of his data gathering: Students were not informed of it. He discussed this with the institutional review board. Alerting students risked "frightening people unnecessarily," he says.

Basically, the IRB (also sometimes referred to as "ethics review committee") signed off on this. Now, once he's about to publish the results, they pull the plug.

Putting aside the university's hypocrisy (believe me, I can think of far worse privacy breaches), give me one good reason why collecting this kind of aggregate, anonymized data is ok for an advertiser who is studying how to most effectively manipulate people into buying something and generally won't even let people opt out of tracking, but it's not ok for a sociologist to publish aggregate statistical data from mined Facebook profiles. Advertisers are a lot less ethical about it than academic researchers.

Re:This was already approved

[calmofthestorm]

> give me one good reason why
> Advertisers are a lot less ethical about it than academic researchers.
You answered your own question.

The difference is that we hold ourselves to a higher standard. The IRB tradition comes in the wake of shockingly immoral research conducted by scientists who didn't see anything wrong with it (Milgram's "just following orders" torture experiment, baby Albert's conditioning, etc). The lesson here is that scientists cannot be trusted to judge the ethical implications of their own experiments, which is why we have the IRB, even for cases that seem to researchers to be perfectly reasonable (just giving a multiple-choice survey)

You are, however, correct that if IRB approval was sought and given, the mistake was theirs. If he used research assistants' facebook accounts to glean the data, as is alleged, there's no way that should have passed IRB.

human research standards

[Anonymous Coward]

As a trained researcher, here's a quick overview of the research and the relevant restrictions: Publicly posted information is available for research. This data set was problematic from the beginning, as it dated from the Harvard student body in the early days of Facebook, and includes data which was only visible to other Harvard students. The research was conducted by using other Harvard students to download the data, then make it available to researchers. The Review Board should probably have turned down the research proposal at the beginning. The board apparently only insisted on "anonymizing" the data so the students and their college couldn't be identified. The data was anonymized, but it has been publicly proven that private information can be derived from the information that was released. I hope this helps.

Re:You put your stuff out in plain view

[lucm]

Sound argument. Just like: "you have an easy PIN on your debit card, why are you surprised someone stole your money" or "you were wearing a short skirt at the office, why expect your boss will not harass you".

It is important to refuse unacceptable behavior even if no sufficient safeguards are in place, so the people and organizations learn what they can and can't do. It's like seeing someone slapping his/her kid in a restaurant - if you complain they may snap back at you and tell you to mind your own business, but the impact of a stranger telling them that what they do is wrong is very likely to prevent them from doing it again. This is part of the social contract.

What they did in this case was wrong, and it's a good thing to make a fuss about it and not let people think that privacy is only something that takes place in a doctor's office.

Re:Who cares

[arkenian]

The greasy wheel gets the kick!