Facebook Is Building Shadow Profiles of Non-Users

An anonymous reader writes "As noted previously, Max Schrems of Europe Versus Facebook has filed numerous complaints about Facebook's data collection practices. One complaint that has failed to draw much scrutiny regards Facebook's creation of Shadow Profiles. 'This is done by different functions that encourage users to hand personal data of other users and non-users to Facebook... (e.g. synchronizing mobile phones, importing personal data from e-mail providers, importing personal information from instant messaging services, sending invitations to friends or saving search queries when users search for other people on facebook.com). This means that even if you don't use it, you may already have a profile on Facebook.'"

Comments

who's data

[MikeB0Lton]

Who's data is it? While it may be your phone number and your birthday, it is really just the data of the user who entered it. You gave it to the person without restrictions.

Re:who's data

[MikeB0Lton]

Apparently I fail at using who's/whose. My apologies to the grammar nazis.

Re:who's data

[Anonymous Coward]

Don't worry, your grammatical lapse is only the first layer of stupidity evident in your post.

Re:who's data

[QuasiSteve]

What the article is in part talking about is what a lot of people have been saying for years now.

People say if you don't want facebook to know anything about you, then you shouldn't post there.
So others reply that it doesn't matter that you didn't give the data to facebook, one of your friends might.

So now the statement is that if you don't want facebook to know anything about you, then you shouldn't tell your friends, colleagues, etc. anything - after all, they may enter it on facebook.

But this still makes the presumption that you actually gave that information, knowingly and willingly, to that person - and that it it's reasonable to assume that facebook will then collect it as well.

Let's say you went to Slashdot High. So did some other person. That other person tells facebook to look for MikeB0Lton who attended Slashdot High. Now facebook has a reasonable assumption that you went to Slashdot High.
You didn't give facebook that data. And you didn't really give that data to that person - it's just information that accumulates simply by existing. You could fo for a "well you could have chosen to be homeschooled" sort of retort, but setting aside that most people here went to highschool long before facebook even existed, that's of course asking for ridiculous steps to take just to prevent anybody from collecting data about you.

Now obviously pandora's box on this was opened a very long time ago and there's really no way that it'll ever change. Even if facebook were to be forced to kill all collected data beyond that required for direct facebook operations, there's plenty of companies and shady organizations who are not targeted and who will gladly not even bother with waiting for users to provide the data and instead crawl sites and official records for it.

But the suggestion that facebook only has data on you because you gave it to them - and now that it has it because you gave it to somebody else - seems to be putting some level of blame with people when really they needn't even do/say anything.

Re:who's data

[Anonymous Coward]

When you install FB onto your smart phone, you are allowing FB access to every nook and cranny about your phone, its data, etc, even if you opt-out to not 'connect' with people in your contacts.

What FB is essentially doing, is they are looking at your contacts, the names you have of them, their number and email, and creating a 'profile' if that person doesn't already exist.

The problem here is that those persons did not give consent to FB (ie. installing FB on their phone or creating a profile). Another major problem is that FB could be alreay selling that shadow profile's info to marketers... that's not right.

Re:who's data

[Tsingi]

Because ignorance and refusal to follow simple rules of grammar are just as inborn and innate as one's race or sexuality.

But how about those French people?

They use a different word for EVERYTHING!

Re:who's data

[MightyMartian]

Well, you certainly can't put it back in the box, but governments could always criminalize it with destructive fines so that if a company is discovered doing it, they have to pay, and pay big.

Re:who's data

[Xest]

That doesn't wash under UK law, nor in most of Europe. It is against the DPA for a business to hold data on you unless there is a mutually agreed reason for them to do so between the two of you or unless they fall under one of the specific exemptions provided by the act such as for law enforcement, or health provisioning. Facebook falls under none of this, so without a doubt is in breach of British law and similar laws in much of Europe.

Whether anything will be done is a different story, our ICO is a toothless waste of space, so I imagine they'll be able to get away with it regardless.

Re:who's data

[rufty_tufty]

Not really, if I was under the mistaken impression that the sun burned petrol to fuel its light then you'd hopefully correct me. If I made a more minor error say for example I talked about how the 68000 processor was clearly copied from the 386 architecture then again I'd hope you'd put me right.
If I misused grammar so my meaning was unclear for example I mistyped "I helped my Uncle Jack off a Horse" Then again you should say something.
Personally whenever I see someone misuse their/there/they're my internal language processor seg-faults.
So while I have no time for abusive grammar nazis I personally like to be as correct and clear as I can so I welcome feedback. However I try to only give it when invited or in really bad abuses where I'm not sure what the person was trying to say. YMMV

Re:who's data

[Richard_at_work]

So while everyone is taking issue at Facebook doing this, whats really needed is a Personal Information Control Act aimed at individuals rather than corporations?

Rather like (as i am in the UK) a Data Protection Law aimed at everyone, rather than just what businesses and organisations can do with data collected?

Or are we going to try and stick a band aid on it by limiting what companies can collect from people willing to offer?

Re:who's data

[fast turtle]

The only way to ensure anything stays secret is to Nottell it to anyone else. Otherwise, it's not longer a secret. Then you have to Nuke them From Orbit to ensure the prompt and complete removal of that secret.

Re:who's data

[Anonymous Coward]

I would say what needs to happen is people need to learn about the concept of "a matter of public record" and get used to the fact that while historically actually searching for public records was difficult it no longer is.

In short privacy is obsolete, our culture needs to adapt to this. Because ultimately all this information has always been available (high school yearbooks, for example have done much the same things as Facebook in the GP's example) the only thing that has changed is the barrier to accessing that information has lowered, with the automation of the collection and correlation of the data.

Re:who's data

[justin12345]

What exactly is the second layer? I'm curious, and I don't want to infer anything you don't mean to say. What exactly do you find so ridiculous?

It's strange that so many people that use this site can understand the intricacies of a programming language but can't sound-out a misspelled word. I appreciate proper spelling and grammar, but is it really worth derailing a thread just to mock someone's mistake?

Re:who's data

[networkBoy]

FWIW I prefer "Let's eat grandpa!" as my commas being important sample sentence.

Re:who's data

[c0d3g33k]

Is that you, Steve Martin*?

* Thought nobody would remember, eh Tsingi?
http://www.brainyquote.com/quotes/quotes/s/stevemarti163457.html

Re:who's data

[MikeB0Lton]

I'm MikeB0Lton too. We should have beers and stuff.

Re:who's data

[Gilmoure]

I'm MikeB0lton and so's my wife!

Re:who's data

[ksd1337]

Let's say you went to Slashdot High.

People visit Slashdot when they're high? That'd explain a lot of comments! ;-)

Re:who's data

[Tsingi]

Is that you, Steve Martin*?

* Thought nobody would remember, eh Tsingi? http://www.brainyquote.com/quotes/quotes/s/stevemarti163457.html

Nah, it's OK. I'm not embarrassed to say that I rip off humour. It's still funny.
Mind you it is a little embarrassing to get caught ripping off Steve Martin.

Re:who's data

[justin12345]

How does UK law deal with companies like whitepages.com or mylife.com? Are they considered search engines or data repositories, or does the law not make a distinction?

Re:who's data

[Tsingi]

Centurion!
We were told that we would be crucified in an area where there were no MikeB0lton!

Re:who's data

[he-sk]

Personal data, i.e. data that is linked to a person, belongs to the person it is about.

This is the law in the EU. The US seams to have a similar view when it comes to medical data.

Re:who's data

[Eponymous Hero]

QED

Re:who's data

[NotSanguine]

Mind you it is a little embarrassing to get caught ripping off Steve Martin.

Not so. "Shithead! Come here Shithead!" That's actually relevant here :) :) :)>/p>

Re:who's data

[NotSanguine]

If you don't have it, get it!

Re:who's data

[prostoalex]

Ive was told the prablim with spellling is zat its hard to bee taking srsly

Re:who's data

[MysteriousPreacher]

Who's data is it? While it may be your phone number and your birthday, it is really just the data of the user who entered it. You gave it to the person without restrictions.

Nope the data do not belong to the provider (at least in the EU). It comes down to who's being personally identified by that data. If I upload your contact details to Facebook, they will be obliged to disclose that to you if you should make a subject access request. They're obviously they are not required to tell you who owns the address book in which your details are found. In theory you could even ask that your details be removed from my account. Of course removal may be refused, but Facebook would be obliged to explain why, and risk legal action if they can't provide a good reason for why they would need to retain your data.

I'm not sure how this works across Europe, but even data given to individuals may be subject to protections. Restrictions could be based either on a legal agreement or the expected norm for the use of the data. For example, if I post my data on your Facebook Wall it would then be difficult to argue that I wanted it kept secret. If on the other hand I send it privately I would have more of a basis for a complaint if you should then post it on your wall. Data protection gets kind of murky at the individual level or when the data controller is little more than some guy running a forum.

I'm not a lawyer and I welcome corrections here. It's based on some limited exposure I've had to data protection compliance in the EU.

Re:who's data

[Captain Splendid]

but is it really worth derailing a thread just to mock someone's mistake?

Derailing?

Mock?

This. Is. SLASHDOT!!!!

Re:who's data

[houghi]

People visit Slashdot when they're high? That'd explain a lot of comments! ;-)

They visit it when they are not?

Re:who's data

[BitterOak]

It's strange that so many people that use this site can understand the intricacies of a programming language but can't sound-out a misspelled word. I appreciate proper spelling and grammar, but is it really worth derailing a thread just to mock someone's mistake?

You fail to take into account the fact that it was the original poster himself who pointed out his own mistake, and the subsequent discussion of that grammatical error were in response to that particular self-response. So nothing was derailed really. There is a lively discussion in direct response to the original post.

Re:who's data

[TheRaven64]

Why not just add something to the data protection act about receiving information about third parties. It is already illegal to pass on personal information to a third party. The problem is that you'd have to be a complete dick to sue your friends (or even report them to the information commissioner) for tagging you on a Facebook photo or for allowing Google to harvest your email address from their address book. It would be simple to fix it my making receiving and storing personal information from third parties without explicit consent illegal. So, if a person signs up to Facebook and agrees to the T&Cs that say that they give permission for everyone to stalk them, that's fine, but if they don't then it is illegal for Facebook to retain any information about that person.

Re:who's data

[muridae]

At what point is a public knowledge fact, like Mike B0lton went to Slashdot High a piece of information that needs to be kept private? You probably didn't object to being listed in the year book. Or the phone book, for that matter.

Now, a person might reasonably suggest that a privacy law be enacted that would protect them from having a third party, like Facebook, link any information about them without their permission. An "opt-in" law, of sorts. But, that means a few changes to the database structure of something like Facebook, instead of linking all of the known facts to Mr B0lton, just link the name B0lton to a school, workplace, phone company of choice, and possibly address grid reference. I can see the phone call now "Mr Facebook tech, I would like you to remove all information about me, Mike B0lton." "We're sorry, we have no information about an individual with that name. Would you like to provide some other details so we can delete any information others have entered, like a work place, phone number, mother and father's names, where you live, or other details like that?" *click*

Face it, even before the digital age, most of the details they can collect this way are no more than I could collect with a name and home town. Searching yearbooks in your home town (they are at the library), I could find the year you graduated. Graduation gives me age, age lets me narrow the search of public birth records. For those old enough, time of birth and area is enough to get a guess on a social security number (first digits by state and area). Ask around town to find people from your graduating class, and see what rumors they are willing to share, maybe some of them remember you mentioning where you work at the last school reunion. From there, find your current town, and look through public records for land sales to find any property you own (renting makes that harder, but I know your name and some of your social, what about a credit check to see what you've bought lately). Paid taxes? Some of that data is publicly available, so I look around to see what vehicle or property you own. All of this with public information and, save for lying to your former classmates to get them to talk more, without any fraud.

You've never had privacy. I don't like the fact any more than I like these shadow profiles. But face it, some information is just easily available. If a bunch of people who were in the same high school and now have different locations start talking about 'hey, remember Mike B0lton' then it's a good bet they were in school together. Why not add that to an information web?

Re:who's data

[Dogtanian]

Because ultimately all this information has always been available (high school yearbooks, for example have done much the same things as Facebook in the GP's example) the only thing that has changed is the barrier to accessing that information has lowered, with the automation of the collection and correlation of the data.

Thus providing a good example of how a change in quantity (i.e. the speed at which we are able to gather *and* process publicly-available data) fundamentally alters the nature and implications (i.e. the *quality*) of that process. In general, this is why the old rules and expectations about public information and public behaviour- which were arrived at long before computers and such automation came along- should not automatically be applied to the same things done many magnitudes faster than before- at least not without discussion about what society wants.

Re:who's data

[muridae]

so you beat up your phone company for providing your name and phone number to the white pages?

Re:who's data

[ubrgeek]

Or the FBI goes to FB and gets whatever records it has about the profile with which you were never involved and have no idea exists.

Re:who's data

[Rich0]

Well, the issue was that in the past security by obscurity actually worked (or maybe we should call it privacy by obscurity). Your photo in a yearbook didn't make identifying you in a photo array on the other side of the country any easier, and your fingerprint on a card in Memphis didn't make you a suspect for a crime in Seattle.

Today databases are becoming so ubiquitous that it is getting to the point that if anybody knows anything, then anybody else who is determined can find it out unless it is kept very carefully controlled.

I think that privacy ultimately will just have to go away. It isn't unlike what has happened with weapons - once upon a time unless you were Zorro your chances of slashing up a whole crowd of people with your sword before being incapacitated were remote, but today anybody can buy a gun or improvise explosives. Perhaps some day somebody will invent the Star Trek replicator and anybody can make their own nuclear bombs. Technology marches on and all we can do is cope...

Re:who's data

[tqk]

I would be pretty angry to find out someone had betrayed my trust and did give my information out without my consent. Angry enough to beat the shit out of them.

Why? I've never understood this. So what if you get a couple of unsolicited emails a day? So what if you get a call on your cell that you didn't want? You've never heard of spam filtering, or Caller ID, or Delete, or Don't Answer?

I can understand not wanting intimate details of your private life bandied about willy nilly (who would?), but an email address or ph. no?!? What is it that you think that level of obscurity gets you? Seriously.

Re:who's data

[wickedskaman]

~:-O That's mean!

Re:who's data

[wickedskaman]

*slow clap... into thunderous applause*

Re:who's data

[GodfatherofSoul]

What, and stifle innovation?

Re:who's data

[Rubinstien]

>> You gave it to the person without restrictions.

You are making an incorrect assumption. On the rare occasion that I do give away an email address or telephone number, I state that the information is not to be shared. People do it anyway, often inadvertently. Most people have such a poor idea about how the internet functions that they don't think that entering an email or telephone number into a web form and clicking 'Submit' to 'Share this article with your friends' is disclosing anything. My father-in-law did this with my daughter's email address when she was two years old, sending her links to kids pages on some web sites about animals. Within a week she was getting SPAM from a dozen different environmental and anti-hunting groups. I had to read him the riot act about his mistake, and change her address. The email account was strictly meant to be used so that family could send her notes and photographs -- nothing else. My mother-in-law has been worse about this, and she honestly just forgets. She puts addresses in CC: instead of BCC: and then tons of people have the address. Recently, one of her great aunts chose to share her address book with Facebook and LinkedIn. My daughter got SPAM from both, inviting her to join. I never even gave the aunt her address; it was in her address book because she copied it there from an email she had been CC'd on. My daughter is a teenager now and there are dozens of photos of her on Facebook, though she does not have (or want) an account. Friends post them and 'tag' her in the photo, sometimes when they already know she doesn't want them posted. She has often asked to have them removed, and gets treated like a weirdo as a consequence. My 8-year-old is dealing with the same issue, from teachers posting photos with everyone in the class labeled, to other parents, to her own friends who are 7 or 8 years old and have their own Facebook accounts.

I don't share *anyone's* email address or other personal information without explicit permission, nor do I use information I happen to come across (in something like a CC field, for example) without obtaining permission first. This is the only fair assumption to make.

Re:who's data

[Blakey Rat]

Pay for someone searching "hey I want to see if my buddy John who went to my high school signed up?" You're literally saying Facebook should be fined by the Government if one of their users attempts to see if someone they used to know is on the service?

Are... are you serious? I can't even tell.

Re:who's data

[codeAlDente]

Facebook isn't looking to prove that MikeB0lton is a terrorist - they just want him to deny it.

Re:who's data

[batkiwi]

They're saying that if facebook:
-stores the fact that you have a friend named John B
-from crawling one of John B's actual friend's phones, stores his phone number and estimates the city from the area code
-from another friend searching "John B - Plymouth High School" stores which school he went to

And this is the important bit:

-aggregates all of those into a "ghost profile" for John B with his high school, city, and phone number

Then perhaps they should be fined. It's the final step, not the accepting the data to begin with.

Re:who's data

[Wolfrider]

You insensitive clod, I went to Tromaville High and my girlfriend got mutant-baby pregnant!

FALCON----punch!

Sincerely,

Gene Masseth

Re:who's data

[whereiswaldo]

I've been logging in as little as possible for awhile now, just responding to direct messages and giving people my email address if they want to have a deeper conversation. I figure if enough people stop adding content to Facebook, the rest will get tired of talking to themselves.

Re:who's data

[BitZtream]

Why? I've never understood this. So what if you get a couple of unsolicited emails a day? So what if you get a call on your cell that you didn't want? You've never heard of spam filtering, or Caller ID, or Delete, or Don't Answer?

Why? Well, I guess at the most basic of levels you could say its because I value my time way more than you value yours. I have things I want to do and someone cold calling me or sending me an unsolicited email is just fucking rude, inconsiderate and annoying.

I could choose to ignore the problem, in which case it will continue to be profitable for the assholes who do it, or I could choose to inflict as much deterrent on them as I possibly can so they learn that I do not appreciate the way they treat me and that it is a cost for them to waste my time.

If enough people did the same, instead of being idiots such as yourself, there would be a lot less spam (both email, phone and snail mail) and a lot fewer people getting ripped off by those scams.

The 'Why' you're looking for is because I choose to not be part of the problem like you choose to be part of the problem.

Re:who's data

[MightyMartian]

I don't think Facebook should be merely fined, I think it should be fined so vastly that it's very existence is put in doubt. I think CEOs, boards of directors and shareholders should be absolutely terrified to the point of pissing their pants if they create an aggregate database of people who have not given explicit permission to be in such a database. I want them to wake up in the middle of the night in cold sweats at the very thought that anyone in their data centers might even be doing it. I want them to spend a fair portion of every day worrying about it.

Re:who's data

[Anonymus]

The subsequent discussion wasn't about his grammatical error, it was about the stupidity contained in the comment itself. However, the author misinterpreted that as another critique of his grammatical error.

Re:who's data

[Anonymus]

That depends on your phone. On a Blackberry, and I'm assuming also an Android, you can set permissions for what an app is allowed to access.

Re:who's data

[Xest]

I don't know anything about these sites, but if it's just things like phone books then you can choose to opt out of them in the UK and by law companies must honour this.

There are some exemptions on what is classed as private date too however, it's not so much about protecting people from having their name stored by a company, but protecting them from having things like their date of birth, sex, religion, race, job, income, address and so forth.

I doubt Facebook is simply storing names judging by TFA, so I can't see how they or the data they hold would fall under any such exemption.

Doh!

[bigredradio]

See this is why I don't use facebook..... er...damn it!

Re:Doh!

[Abstrackt]

See this is why I don't use facebook..... er...damn it!

To be fair, it sounds more like Facebook is using you.

Re:Doh!

[treeves]

The example in the summary of searching for someone ON Facebook followed by a claim of "I don't use Facebook!" is pretty stupid.

Re:Doh!

[Rob the Bold]

The example in the summary of searching for someone ON Facebook followed by a claim of "I don't use Facebook!" is pretty stupid.

I think you misread that rather rambling, run-on sentence in the summary

'This is done by different functions that encourage users to hand personal data of other users and non-users to Facebook... (e.g. synchronizing mobile phones, importing personal data from e-mail providers, importing personal information from instant messaging services, sending invitations to friends or saving search queries when users search for other people on facebook.com).

The searcher and the non-user are different people. The searcher is the non-user's (real life) friend, and just entered data about the non-user to try to find him on facebook. FB keeps that piece of data in non-user's "shadow profile", or more appropriately, "dossier".

So John Smythe doesn't have a facebook profile, but his friend just searched for John Smythe from Washington High School. Now they know that. Another friend looks for John who lives in Busytown. And so it goes.

The only way to avoid it would be not to have now (and have never had) any real life friends or colleagues who might now (or might have, or might in the future) join facebook.

For some Slashdotters, that might not be so big of a problem . . .

Re:Doh!

[treeves]

You're right.
So a Facebook user searching, on Facebook, for someone who happens not to be a Facebook user, tells Facebook what? That the person named may exist, and that Facebook user is interested in him? Doesn't sound like much of an issue to me, but then I don't spend much (enough?) time worrying about what FB is doing with all the personal data it has.

Re:Doh!

[BitZtream]

Because you're looking at it from an extremely simplistic view. You're looking at it from a single incident perspective, and thats not what it is. Its all sorts of little incidents like that one that add up, and then somehow get linked to you specifically, maybe through an invitation email with images that happen to autoload and slap you with a cookie.

You don't realize how much can be gathered via correlation when you collect EVERYTHING about EVERYONE and let computers sort it out.

Re:Doh!

[knorthern knight]

> Its all sorts of little incidents like that one that
> add up, and then somehow get linked to you
> specifically, maybe through an invitation email
> with images that happen to autoload and slap you
> with a cookie.

I've blocked all emails allegedly "from Facebook" for quite some time. This isn't paranoia, but rather because I got sick and tired of spammers (who assume everybody's on Facebook), filling my inbox with messages saying "Alice has left a message for you on Facebook". Those were probably poison URLs linking to autoloading exploits. Since I don't do Fecesbook, I don't have to worry about about any real messages from them.

Re:Sex Offenders

[Moheeheeko]

" and reputation" I think that went out the window when they became a registered sex offender.

Oh, really?!

[jaminJay]

Good to see this is getting some wider exposure! They used to send a courtesy mail to tell you they had your information and suggest you get an account so you can see it. Do they not still do that?

Re:Oh, really?!

[vlm]

Good to see this is getting some wider exposure! They used to send a courtesy mail to tell you they had your information and suggest you get an account so you can see it. Do they not still do that?

That was the classmates.com people, sending weekly if not daily emails, if I recall correctly. Nothing a little spam filter can't clean up.

Re:Oh, really?!

[ackthpt]

Good to see this is getting some wider exposure! They used to send a courtesy mail to tell you they had your information and suggest you get an account so you can see it. Do they not still do that?

That was the classmates.com people, sending weekly if not daily emails, if I recall correctly. Nothing a little spam filter can't clean up.

I keep getting prods from FB, I have updates. To heck with them, I don't care. I'm not here to enrich these people.

I also found the source of the little pop-ups which want me to finish filling in all my personal information or when they want me to take a tour of something they've added or changed. FB is about as annoying as Windows with all those damn balloons popping up. Sure-fire way to drive me out, keep bugging me.

Re:Oh, really?!

[medv4380]

I think you're right, but I've received creepy email invites from Facebook saying "You might know these people come join us" followed by 9 profile images some of close friends and some of acquaintances that happened to attend an event that I've gone to from time to time. It was creepy and is the main reason I want nothing to do with facebook.

Re:Oh, really?!

[jaminJay]

It was Facebook telling me I'd been tagged in some photos. They solicited the information from the users they already had and then sought to widen their net even further. I'd been shown Facebook months before that happened and until then had happily avoided it. Now there are 'Like' buttons on as much of the internet as Google's Ads.

But I never licensed this.

[Anonymous Coward]

Even if I let people know my data, I never licensed it for resale like fb is doing. Couldn't this create legal issues for fb?

Re:But I never licensed this.

[icebraining]

Facts aren't copyrightable. You don't need a license to store them.

Besides, even if they accessed copyrighted content (let's say, a text you sent someone using email and they copied to their FB wall) the liable person would probably be the people who posted it, not Facebook.

Re:But I never licensed this.

[mmcuh]

But in most cases, in many legislations, you _do_ need permission to store personal information about someone.

Re:But I never licensed this.

[TheRaven64]

Copyright is irrelevant. The EU Data Protection Directive (implemented by things like the Data Protection Act in the UK) explicitly cover storing personal information, independently of copyright. You may not legally share personal information that you have collected about a person, unless you have their explicit permission. If you give your telephone number to a company and they then sell it on to telemarketers, for example, then they have broken the law.

Re:It can't possibly be that hard to avoid...

[icebraining]

Like buttons everywhere -> Requests to FB's servers with your "shadow" user ID (from cookies) and the referrer URL -> full web history available to Facebook.

Rock and a hard place

[Coisiche]

So, sign up and have some control of the details they hold (maybe that should be illusion of control) or don't sign up and have no control of the details they hold on you.

Re:Rock and a hard place

[Bucky24]

I highly doubt that if someone signs up, that facebook removes the shadow profile on them. I think you mean control over what other USERS see (though as has been discussed on /. before, the usage of the term "users" to describe people who go on facebook may not be entirely accurate).

Re:Rock and a hard place

[pakar]

So if i sign up i need to agree to their TOS.... and that enables them to sell my information... If i dont sign up and agree to their TOS they distribute my information in whatever way they seem fit....

Seems fair...

Monetize that....

[Narnie]

What is unfortunate, Facebook might be willing to sell this data to 3rd parties without your consent... as your friends/coworkers/family have already consented to releasing the contact information for you. Even without Facebook selling it, it's only a data breach away from some the unscrupulous hands.

Re:Monetize that....

[Baloroth]

Even without Facebook selling it, it's already in some unscrupulous hands.

FTFY

Re:Monetize that....

[The Man]

What is unfortunate, Facebook might be willing to sell this data to 3rd parties without your consent... as your friends/coworkers/family have already consented to releasing the contact information for you. Even without Facebook selling it, it's only a data breach away from some the unscrupulous hands.

I don't know that there's anyone more unscrupulous than facebook. The mobsters and fraud rings out there really just want to use your identity to take money from banks. They're annoying but not really that dangerous to ordinary people (nor to the banks, who treat low-level activity as a cost of doing business). The law is also firmly entrenched against them, and they are occasionally caught and punished. Facebook and their ilk, however, sell humans as products to thousands of corporations around the world, and they do so with impunity. They are a direct and real threat to every individual person alive today and countless unborn yet to come. If you put a gun to my head and told me I had to give all my personal information to either Mark Zuckerberg or a Russian gangster, I'd give it to the gangster every time. Then I can go file a police report, close all my accounts, and start over with no loss but a few hours of my time. Eventually the gangsters will be caught and imprisoned or perhaps killed in a war with other gangsters. There's no such happy ending possible if facebook gets its hands on my data; even if I change my name, move to a different state, and start a new career, sooner or later facebook will get my new data too. There's apparently nothing I can do about it, and the law won't help me.

Bottom line: a "facebook data breach" would mean nothing to us, since everything in their database was already for sale; it would only harm facebook, who will have given away what they were previously selling.

Re:Monetize that....

[indyogb]

No mod points or I'd mod you up. Excellent comment.

Facebook wants to be Google

[concealment]

Google's problem is that search engines can be easily fooled. Since the user indexes his or her own data by what is published to the web page, people tend to list all sorts of keywords which in turn create false results. Google's solution was PageRank, or picking the most popular sites. This doesn't work because all language is contextual, and as a result, a search term can mean many things.

What both Google and Facebook have realized is that unless they figure out who the user is, and what types of things they are looking for, there is no way to impose a type or context to the search. Without typed searching, search results become more irrelevant with the number of pages published to the web.

Both of them have hit on the same solution. Users aren't going to log in to a search engine, but they will log in to Gmail or Facebook, and that allows these companies to keep track of who you are (Google Plus is more an extension of Gmail than a separate app). Why else do you think both of them are manic about trying to get you to "validate" your account with a phone number?

Re:Facebook wants to be Google

[Tsingi]

Why else do you think both of them are manic about trying to get you to "validate" your account with a phone number?

Manic is a good choice of words.

Google: You should give us your phone number. (for the 12th time)
Me: Fuck off and quit asking me for my damned phone number you fucking asshats! You aren't getting it! !@$#%^%%$@#%$

Mania is infectious.

Re:Facebook wants to be Google

[cos(0)]

Everyone can afford a phone number. T-Mobile sells prepaid SIM cards with 100 minutes of airtime for $10. In fact, most prepaid providers sell refills as small as $10. You usually have at least three months to use them. Who cannot afford $3.33 a month for cell phone service?

Re:Facebook wants to be Google

[jwhitener]

Or they could do what IBM did with Watson and have a more sophisticated search routine.

Re:It can't possibly be that hard to avoid...

[dragonhunter21]

One of the ways it gets data is from reading contact book information when people use their email address book to find Facebook friends. Feeding false information there doesn't really help you. I suppose if they put you in as "John" rather than your full name it's obscured, but it only takes one full entry to put it all together.

Is this really news to anyone?

[themightythor]

So, when I finally bit the bullet and joined FB this year, I had a bunch of pending friend requests that I'd previously ignored waiting for me. How else would this have been accomplished if not for the so-called shadow profile? It struck me as a no-brainer at the time.

Re:Is this really news to anyone?

[SeeSp0tRun]

So this got me thinking...
Start a FB Profile, which is to assume you are taking ownership of your profile (and subsequently personal info). The delete your FB, and request they remove your profile and information from their servers.

99% sure this won't work, but 1% of me had the idea.

Re:Is this really news to anyone?

[treeves]

Out of curiosity, how did you ignore friend requests before you joined Facebook? How did you get the friend requests?

Re:Is this really news to anyone?

[Bucky24]

I suspect OP means that they ignored the emails FB sent them with the friend requests.

Re:Is this really news to anyone?

[TheRaven64]

Facebook will send you an email saying 'someone wants to friend you on Facebook, click here to create an account and accept the request'. This has a 'never email me again you' link on it. I clicked on that about five years ago and haven't heard anything from them since. Well, except a job interview request (which surprised me - maybe their recruiters agree with their CEO that anyone with a Facebook account is a moron and use that as a first line filter...)

Block

[sakdoctor]

Who uses adblock/noscript yet doesn't block those pointless facebook and twitter buttons?
Even if you don't care about the privacy angle, it really cuts down on useless traffic.

Here's a new one you may not have got around to adding yet: apis.google.com/js/plusone.js

Re:Block

[Anonymous Coward]

Use Ghostery - it kills web bugs in web sites just like Adblock kills ads.

Re:Block

[sakdoctor]

Good call.

Re:Block

[icebraining]

Yes, I know they can be blocked. Yes, I have them blocked. But the question is whether we should be forced to block it if we don't want to be spied on.

Re:Block

[adonoman]

You're not being forced. You're certainly allowed to not consume content on any website that chooses to add facebook/twitter/google tracking... If you dislike it that much, contact the content provider and let them know. Websites add these since people sharing links on fb, etc.. can be a major source of incoming traffic. If they thought that the links might be a net loss in traffic, they'd be gone in a second. It just takes enough people to complain.

Re:Block

[c0d3g33k]

Here are a few variants to illustrate the fallacy of your thinking:

"Yes, I know doors to my house can be locked. Yes, I have them locked. But the question is whether we should be forced to lock our doors if we don't want to be stolen from."

Or the ever popular car analogy:

"Yes, I know my car can be locked. Yes, I have my car locked. But the question is whether we should be forced to lock our cars if we don't want them to be stolen."

Simply wanting your personal habits/information or belongings to be secure and thinking that others (with different motivations and self-interests) to honor that is a bit naive. It's your responsibility to protect that which is yours, not those from whom you wish to protect it.

Re:Block

[The Man]

Who uses adblock/noscript yet doesn't block those pointless facebook and twitter buttons?
Even if you don't care about the privacy angle, it really cuts down on useless traffic.

Here's a new one you may not have got around to adding yet: apis.google.com/js/plusone.js

I don't really think adblockers are sufficient in light of how devious facebook and others are known to be. Using those techniques amounts to participating in an arms war between these companies and other software engineers. Instead, or in addition, one should redirect their entire domains to localhost and blackhole all known netblocks they use. You can't do enough to keep yourself safe from these thieves and predators; they are the modern-day slavers and you, once again, are their product. While there may be no measure strong enough to prevent the kind of theft this article highlights, that serves only to point out that no available measure should be overlooked in the effort to shut down the flow of data into their systems.

Re:Block

[causality]

You're not being forced. You're certainly allowed to not consume content on any website that chooses to add facebook/twitter/google tracking... If you dislike it that much, contact the content provider and let them know. Websites add these since people sharing links on fb, etc.. can be a major source of incoming traffic. If they thought that the links might be a net loss in traffic, they'd be gone in a second. It just takes enough people to complain.

Never depend on the dumb masses to do the right thing, especially not when it would cause them even the slightest inconvenience. It will fail. It's like expecting water to flow uphill by itself. Marketers and charismatic leaders view them as little more than playthings for good reason: that is what they have chosen to be. The path of self-education and self-awareness was long ago deemed "too hard" by them. It makes them malleable addicts to any promise of convenience.

You should find an individual action you can take instead, like refusing to participate. Masses of people want some pointless shiny and are willing to cede information, and thus power, over their lives to have it? Okay. We tried to warn them. They didn't want to listen. Let them do it. I'm not their leader or their dictator, no matter how Faustian their bargain is. It seems most people want to learn things the hard way. At some point you have to respect their decision, however foolish. But I won't be joining them.

Re:Block

[Kharny]

Wrong, it's more like, yes my house is locked, but should i be forced to lock my dad's house, my neighbours house and my friend's houses, just to prevent my stuff from being stolen?

Re:Block

[icebraining]

That's not a fallacy. Those variants are still right. Yes, I do lock my house and would be a fool not to, but the thief is still a thief regardless.

I don't want to rely on their honor no more than I want to rely on the honor of the car thief. Just like for the thief, I want them to be punished by the judicial system.

Re:Block

[icebraining]

I have no idea if they have such trackers before loading their website, and then it's too late. Complaining won't change it - FB already has my data. So yes, I do have to block them if I don't want to be spied on. And while I do block it, I shouldn't have to.

And by the way, being profitable is not enough by itself to allow something - scams are also profitable, doesn't mean they should be illegal - and besides, websites can simply do what that German news site does: put links with *self-hosted images* to the social networks, and only if the user clicks them is content loaded from Facebook/Twitter/G+/etc servers.

Re:It can't possibly be that hard to avoid...

[gringer]

I use a pseudonym and only friend people who I trust enough not to to stupid overly exposing shit.

I think you're missing the point. If you're friending people, then you probably already have a facebook profile. This is about people who don't have a profile, but still have a record of their existence in the facebook system.

It may be that you also have a shadow profile that is (depending on how cautious you are) linked or not linked to your actual profile. This would contain information about you that is generated by those people who you don't trust (i.e. those who do overly exposing shit).

Re:Slander.

[tepples]

Playing along:

It is absolutely false to say that my client is building "shadow profiles" on "non-users". [My client admits] compiling dossiers on non-aligned-persons; but that is an entirely distinct matter.

If it's so distinct, would you kindly explain to those gathered here the difference between a "shadow profile" and a "dossier" and between a "non-user" and a "non-aligned person"?

Rare opportunity.

[Arancaytar]

In Soviet Russia, Facebook has profile on YOU.

Re:Rare opportunity.

[medv4380]

My friends have been defecting to Soviet Russia?

Re:Rare opportunity.

[treeves]

Yes. Not only are they giving away information about you, they're time traveling and didn't invite you along. Don't you feel bad?

Re:Rare opportunity.

[TheRaven64]

It would probably work better as: In America, you use Facebook to find parties. In Soviet Russia, the party uses Facebook to find you.

Except that the CIA also uses Facebook to find you, so it doesn't really need the Soviet Russian component...

People have no clue what's watching them

[FyberOptic]

Go on various people search websites, like Spokeo, and search for yourself. Go ahead, I'll wait.

You're probably already on the web. And tracking companies like DoubleClick already know all about your browsing habits. If you're paranoid about privacy, then you better stay off of the internet, don't use cellphones, credit/debit cards, shopper discount cards, etc, because profiling you is what makes companies extra money nowadays.

If you think they're going to pass up the opportunity to make money just for the sake of your privacy, when there's no law to stop it, you're sadly mistaken.

Re:People have no clue what's watching them

[hedwards]

And that there's the problem, I don't want them to have access to that information, but there's a lot of online services that I need to use in order to go about my daily life. Many of which have equivalents that are offline and not completely inconvenient. But, there are things which don't have an offline equivalent or where doing it offline wouldn't be feasible.

I've tried to block random 3rd party javascript, but at the end of the day, the web is so fundamentally broken at this point that you never know what scripts are necessary and which ones are just for the purposes of spying on you.

Re:People have no clue what's watching them

[FyberOptic]

You also have no idea if your ISP is collecting information on the sites you visit, either through DNS queries or by parsing the content of pages you visit, and creating a profile about you to sell. And once that profile exists, if even one website out there is connected to that company's profile database and can associate your visit and a particular account as being you, then suddenly they've attached a name to an otherwise anonymous profile. It can only grow from there.

The point I was trying to make is that unless there are privacy laws and strict rules on what data networks and companies are allowed to take and sell about you, then it's simply never going to stop.

The other point I was making is that Facebook is far from the only company doing this, and people shouldn't be wasting their time focusing on just one of them.

Re:People have no clue what's watching them

[Oswald McWeany]

Spokeo is amusing in how BAAAD it is- looking up myself it has more things wrong than right.

Scary that it gets anything right- but Spokeo just makes silly guesses based on, who knows what.

Re:People have no clue what's watching them

[satuon]

You also have no idea if your ISP is collecting information on the sites you visit, either through DNS queries

That's why I'm using Google's DNS at 8.8.8.8 IP. That way my ISP doesn't know about where I go unless they do packet sniffing. And I changed my default search engine in Chrome to https://encrypted.google.com/

Re:People have no clue what's watching them

[FyberOptic]

I checked the privacy policy on Google's DNS, and they do state that they don't use your queries to correlate who you are in relation to other Google products. To be honest I was surprised to see that, since I would have bet money that they did the opposite and hence why they offered the service to start with. Google is good at building advertising profiles, after all.

They do log data though, both temporary and permanent, but we'll have to take their word that it's just for debugging and service quality reasons.

I tend to just use 4.2.2.2. It's faster than my ISP's DNS ironically, despite being a public server. Though my ISP's DNS servers implement that recommended searches junk when a DNS request fails, and I opted out of that, so it likely takes longer while their servers realize who I am and whether I'm opted out. Which is still bullshit, since I'm paying them for service and they shouldn't have any right to be trying to push ads on me and disrupt the normal operation of the internet in the process, but what can you do.

Re:People have no clue what's watching them

[matthewv789]

What you can do is find yourself, create an account, then "correct" your personal info until it's meaningless and no longer identifies you. (This seemed to work on MyLife, and might also work on Spokeo and others, but I haven't tried yet.)

Re:People have no clue what's watching them

[satuon]

I assume they probably log information about me, but the good thing about Google is that they use the information for themselves. I don't care if they improve their search algorithms or target ads at me, so long as it's not up for sale or given to government agencies upon demand. And since I don't live in the US, I assume Google will be less cooperative with my government than my neighbourhood ISP.

We should have a "Tell Lies to Facebook Day"

[Picass0]

Facebook is becoming the new Microsoft to me.

Re:We should have a "Tell Lies to Facebook Day"

[Zibodiz]

IMHO, Facebook passed MS a long time ago. And that's saying something. At least MS is primarily evil because of their thirst for money and control -- Facebook sees that and raises them the desire to know absolutely everything about everyone on earth, then sell it to anyone who wants it. If Zuckerberg were CEO of MS, registering Windows would be mandatory, and would require everything down to your underwear size and medical history. And there'd be text ads on the start menu that would be chosen based on what websites you visited last night or what medications might appeal to you.

Re:We should have a "Tell Lies to Facebook Day"

[Oswald McWeany]

Facebook is waaaaaaay more evil than Microsoft.

Microsoft is the bumbling idiot politician who maybe steals a little bit of public money on the side- but tries to make good policies and move things along.

Facebook is like an evil genious- hell bent on world domination and destroying anything that gets in its way- turning innocent people into mindless zombies along the way.

Re:We should have a "Tell Lies to Facebook Day"

[imsabbel]

I have come to peace with microsoft long ago.

They just want my money. I can live with that. Google and facebook, otoh, give me stuff "for free" in order to sell me.

Re:We should have a "Tell Lies to Facebook Day"

[Anomalyst]

Holy Evil Genius Batman! FACEBOOK is the beginning of the Great Zombie Apocalypse!

What is it that makes it so great? You mention nothing about blackjack, hookers or blow.

Re:We should have a "Tell Lies to Facebook Day"

[TheRaven64]

Most of Microsoft's evil was directed at their competition. They were rarely evil to their customers, lock-in aside, just incompetent. With things like lawsuits over FAT patents and demanding $15 for every Android phone sold, they're still just as evil to their competitors, but they seem to be a lot less incompetent to their customers (I've not used it, but I've heard good things about Windows 7).

In contrast, Facebook is evil to its users.

Re:We should have a "Tell Lies to Facebook Day"

[tompaulco]

Instead of a tell lies to facebook day, everyone should just go give their info for free to all and sundry. Before long, facebook would be out of business.

Re:Sex Offenders

[The Moof]

I think that went out the window when they became a registered sex offender.

You'd be surprised what could get you on the registered sex offender list. When I purchased my house, I checked the list. Apparently, a guy down the street had a physical relationship with a 17 year old when he was 20. He's now on the list for life because of a vindictive parent, bad breakup, etc.

Another benefit of blocking Facebook domains

[realmojo]

As a former Facebooker, I already block all Facebook domains to keep the stupid Like buttons and other debris off of the websites I do visit. This is just another reason to do so.

It's amazing how much faster it is to load pages when there are no calls to Facebook.com or their content delivery domains.

Re:Another benefit of blocking Facebook domains

[Pope]

Do you have a quick and dirty list to post? I sense additions to /etc/hosts coming on...

Re:Another benefit of blocking Facebook domains

[realmojo]

127.0.0.1 www.facebook.com
127.0.0.1 facebook.com
127.0.0.1 static.ak.fbcdn.net
127.0.0.1 www.static.ak.fbcdn.net
127.0.0.1 login.facebook.com
127.0.0.1 www.login.facebook.com
127.0.0.1 fbcdn.net
127.0.0.1 www.fbcdn.net
127.0.0.1 fbcdn.com
127.0.0.1 www.fbcdn.com
127.0.0.1 static.ak.connect.facebook.com
127.0.0.1 www.static.ak.connect.facebook.com

Re:Another benefit of blocking Facebook domains

[Bucky24]

I use AdBlock Plus and Ghostery. Together they're pretty good at blocking all facebook stuff.

Re:Another benefit of blocking Facebook domains

[Anomalyst]

As a former Facebooker

Wouldnt the prositution of your personal information make that Facehooker

Re:Another benefit of blocking Facebook domains

[the_brobdingnagian]

http://floorter.blogspot.com/2011/05/protecting-your-privacy-with-adsuck.html

Re:Another benefit of blocking Facebook domains

[schwit1]

What do you do when nytimes.com or wsj.com or some other favorite site refuses to load because the facebook ads or scripts can't load first? I'm seeing this more and more. BTW, I use the MVP hosts file http://winhelp2002.mvps.org/hosts.htm

Re:Another benefit of blocking Facebook domains

[SmurfButcher Bob]

You make a decision, and either decide you want their crap, or you decide to stop using their service.

Re:Facebook

[gtall]

What about FB compiling information about people who do not have FB accounts is it that you do not understand?

Just automate everything

[ironjaw33]

It's going to get to the point where Facebook users (and non-users) won't even have to do anything to add information about themselves. Data mining techniques can suss out each user's personal information from the internet and aggregate it on the profile page. People with smartphones will have their locations and current activities automatically updated to their news feeds. Camera phones will automatically snap pictures and upload them to Facebook where people in them will be tagged via facial recognition algorithms.

At this point, why even bother allowing Facebook users to modify their own information? Why even bother with accounts and logins?

Re:Just automate everything

[vlm]

It's going to get to the point where Facebook users (and non-users) won't even have to do anything to add information about themselves. Data mining techniques can suss out each user's personal information from the internet and aggregate it on the profile page. People with smartphones will have their locations and current activities automatically updated to their news feeds. Camera phones will automatically snap pictures and upload them to Facebook where people in them will be tagged via facial recognition algorithms.

At this point, why even bother allowing Facebook users to modify their own information? Why even bother with accounts and logins?

How would you automate virtual farming and mafia waring? Not much of a grind game, when the grind is removed.

Re:Facebook

[o'reor]

I'm so tired of reading ./ers bitching without reading the articles first.

It's about non-users who HAVE NEVER USED THE DAMN THING and yet are being profiled and harrassed by FB. (like "Hey, these guys are on FB, we know they're your friends, why don't you join ? Oh, and we know where you live and what school your kids go to. Just saying.")

Re:Facebook

[alen]

then don't give your information to anyone. you giving me your name, address and phone means i can share it with anyone i wish

Called it

[GameboyRMH]

I figured they'd been doing this for years, I was just waiting to see when they'd start setting up visible profiles automatically and saying "Join up to claim your profile now! Or let the information continue to flow completely uncontrolled..."

Re:Facebook

[ProbablyJoe]

You seem to be missing the point. The problem is that people who are not using Facebook, and have never accepted any agreement with them, are having their data gathered by Facebook

As for actually reading the book-length terms, that's not exactly likely, though admittedly you do sign over any rights you thought you had when you tick that box. But regardless, that's not the problem being discussed here. This is all happening without any terms being accepted.

Others can list your hometown for you

[Hadlock]

I had a weird notification this morning. Facebook wanted me to confirm that someone else said my hometown was X city. So now if you don't list this information, they're asking others to rat you out, despite your best efforts to keep that information off of the web. I'm not sure you can opt out of other people's disclosures in the same way you can opt out of listing your city/state/employer etc.

Re:Others can list your hometown for you

[sherriw]

You can't I've looked. What's also bad is when FB tells you someone told them your hometown/highschool/relationship/etc is ABC you don't have an option to deny or delete that factoid. The best you can do is not show it on your profile. But FB still assumes it's true and saves it.

I got in a long drawn out debate with friends about this recently. I politely asked people not to tell FB info about me. I was shocked how many friends argued with me... even after I gave links to articles about what FB does with the info. Like hello... I don't care what you tell FB about yourself... but you're upset that I want you to refrain from telling it about ME? Geez.

Re:Others can list your hometown for you

[EnergyScholar]

I called it, too! From my post in May 2011:

I wish to second the 'Ghost Profile' concept mentioned above by another poster. It's probably already done. This has the clever effect of using citizens who are still foolish enough to use FB to act as informants against those people who have realized that FB, as it currently exists, is a very bad idea.

Re:Others can list your hometown for you

[DigitAl56K]

Just a few months back I could not find a way to stop others from listing my employer on my own profile. I had to repeatedly delete this information as more and more people started entering it.

As far as I can tell, only very recently did Facebook add an option to let me approve these associations. Even so, this may still be information I don't want Facebook to store on me (I have no idea what they may use it for or how secure their data is), and it's not clear given their other practices whether that information is actually erased when I remove/disapprove it or simply not added to my public profile.

Re:Others can list your hometown for you

[Hadlock]

I generally alternate between Barbados and Sweden. Your line of work shows up in your public profile (I think) which is the first thing potential employers look at.

Re:Slander.

[Anonymous Coward]

Your labwork just came back. You might want to sit down for this...

You got trolled. Hard.

Violation of the Data Protection Act

[Wattos]

How is this not a violation of the data protection act? I quote from Wikipedia (http://en.wikipedia.org/wiki/Data_Protection_Act_1998)

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless- [...]

Personal data should only be processed fairly and lawfully. In order for data to be classed as 'fairly processed', at least one of these six conditions must be applicable to that data (Schedule 2).

        The data subject (the person whose data is stored) has consented ("given their permission") to the processing;
        Processing is necessary for the performance of, or commencing, a contract;
        Processing is required under a legal obligation (other than one stated in the contract);
        Processing is necessary to protect the vital interests of the data subject;
        Processing is necessary to carry out any public functions;
        Processing is necessary in order to pursue the legitimate interests of the "data controller" or "third parties" (unless it could unjustifiably prejudice the interests of the data subject).[8]

Is any of the above true? I certainly did not consent for my data to be processed when I am not on Facebook. Also note, it is not important who has given the data to Facebook, the DPA talks about the data subject -> The person the data is about.

Re:Violation of the Data Protection Act

[Neil]

The Data Protection Act is UK legislation. If Facebook do hold this sort of information then they probably don't process it on servers located in in the UK (or in other European countries where the EU Data Protection Directive applies).

Re:Violation of the Data Protection Act

[BeardedChimp]

Except that the data protection act also states

Personal data shall not be transferred to a country or territory outside the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

Re:Violation of the Data Protection Act

[Culture20]

The last one. Facebook's business is built around collecting and analysing vast amounts of profile data. Collecting and storing that data isn't just in their legitimate interests, it *is* their legitimate interest.

(unless it could unjustifiably prejudice the interests of the data subject).[8]

I think the legal obligation holds more weight. There's probably a law somewhere that says FB must process this data for U.S. three letter agencies.

Re:Violation of the Data Protection Act

[mrbester]

Facebook is not the data subject, so that argument doesn't apply.

Re:Violation of the Data Protection Act

[ITMagic]

How is this not a violation of the data protection act? I quote from Wikipedia (http://en.wikipedia.org/wiki/Data_Protection_Act_1998)

Firstly, because the D.P.A. 1998 is *UK* law, which (as far as I can see) has no relevance to FB (usual IANAL applies). Try looking at the D.P.A. 1988 & the Amendment Act 2003. If you're interested, keep your eyes posted on the outcome of the Irish Data Protection Commissioner's report into FB.

Secondly, if you believe that the Data Protection Act has anything at all to do with the *Protection* of your personal data, in regard to it's distribution to other parties, then you are a complete and utter naive fool. At least as far as the UK Act is concerned, it serves to

• legalise the practice of data retention and distribution;
• Allow recourse for you to correct inaccurate data; and
• allow the Government to make money by "registering" any company that needs to store data.

Forgive my cynicism, but it is simply another method of extracting 'Tax' from companies who need to store client details, and does almost nothing about protecting the availability of data that you may consider to be personal.

Re:Violation of the Data Protection Act

[Rob the Bold]

Except that the data protection act also states

Personal data shall not be transferred to a country or territory outside the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

So? They didn't transfer the data (or at least you can't prove it). You transferred it, or your friends did. You told somebody or somebody else told somebody in the US or China or wherever something personal about yourself. Total plausible deniability.

And what it you can prove it? Good luck getting the RAF to launch a drone attack on Zuckerberg.

Re:Violation of the Data Protection Act

[Schmorgluck]

Actually, for everyone outside USA and Canada, the relevant company is Facebook Ireland Ltd. Which means it falls under the Irish Data Protection Act, and the EU/46/95 Directive, whichever protects private persons the most.

Facebook may actually take a huge blow in this affair. Its case is pretty much impossible to exculpate.

Re:Facebook

[MightyMartian]

Unless, of course, it is given to you on the understanding that you're not supposed to give it out (ie. here's my phone number, but it isn't listed, so don't give it out). In which case you're in breach of contract if Facebook gets their hands on it.

Re:It can't possibly be that hard to avoid...

[icebraining]

I have. But you shouldn't need to secure it.

A thief is no less of a thief just because the car was unlocked.

I joined LinkedIn the same way

[1_brown_mouse]

I already a searchable stub of my name and places I had worked. I guess they mined corporate websites and mailing lists over the years.

GRRRRRRRRR!

[poofmeisterp]

I read the comments on this article, go back to main page, and "Become a fan of Slashdot on Facebook" pops up as the dialogue next to the ./ logo.

Irony.

Re:It can't possibly be that hard to avoid...

[Anonymous Coward]

I use a pseudonym and only friend people who I trust enough not to to stupid overly exposing shit.

Even if you ARE being tracked and aware of it, an easy solution is to intentionally feed bad or misleading information into the system. Noisy data isn't very useful.

Remember - information about individuals is worthless. It's the large-scale aggregate data that has value.

In the aggregate, no problem.

In the individual, there is a problem. I follow the similar rules as you do for participating in social networking: I don't have a use for it, because I have email for people I give a shit about.

My problem is that my shadow profile is based solely on people who don't follow those sorts of practices. In other words, the only people who've tried to contact me through Failbook are a few people I hung out with in college who have either on to become either derpy wingnut fundies, and one moron that went on to be a commie.

At the individual level, that's a problem. When it comes time to round up the freaks, I'm guilty by association. A smart investigator would say "Hmm, he has no interest in speaking to these morons, he's not part of the problem". A dumb investigator would come to the opposite conclusion: "The only people who've ever tried to contact him through Failbook are enemies of the state. And he has no profile himself! What's he hiding?"

There are a lot of smart investigators out there. Unfortunately, there are a lot of dumb ones. If you're unlucky enough to know anyone who was caught in a fishing expedition for politically-unreliable elements, you need to be lucky enough to have your file land on the desk of one of the smart investigators.

In the aggregate, the data is still valuable for marketing, but the problem with shadow profiling is in the individual case, where bad data - if it's all you've got - is worse than no data at all.

Nothing new at all

[NumenMaster]

4-5 years ago, my friends were always asking me to stop inviting them to facebook, because they were already members. It was funny because I wasn't even a member myself. Yet, somehow they were getting invited by me to join. Cut to a few years later, I joined facebook only because I wanted to see how well integrated it worked with my palm pre. It integrated really well. A few days into my membership, I got an friend request from a college buddy. There was a shadow profile, but I had figured that he hadn't filled his profile out yet. So I accepted. The next day he told me he said f*ck it and joined on my invitation. So, he wasn't a member and hadn't done a friend request. I felt so stupid for falling for it. My acceptance of his friend request generated an invite to join FB from me. I should have known better. Needless to say, I researched how to delete my account. Funny enough, there's still a shadow profile of me naturally. My buddy, on the other hand, lives on the site. I guess he can blame me once he wakes up from his FB daze.

Re:Nothing new at all

[demonbug]

4-5 years ago, my friends were always asking me to stop inviting them to facebook, because they were already members. It was funny because I wasn't even a member myself. Yet, somehow they were getting invited by me to join.

Cut to a few years later, I joined facebook only because I wanted to see how well integrated it worked with my palm pre. It integrated really well. A few days into my membership, I got an friend request from a college buddy. There was a shadow profile, but I had figured that he hadn't filled his profile out yet. So I accepted. The next day he told me he said f*ck it and joined on my invitation. So, he wasn't a member and hadn't done a friend request. I felt so stupid for falling for it. My acceptance of his friend request generated an invite to join FB from me. I should have known better. Needless to say, I researched how to delete my account. Funny enough, there's still a shadow profile of me naturally. My buddy, on the other hand, lives on the site. I guess he can blame me once he wakes up from his FB daze.

I've had similar experiences where Facebook outright lied about where an invitation came from (just as your case above), and about one friend adding another friend who was not on my Facebook. That was a strange one - it told me that my cousin was friends with a person I knew in grad school, which seemed very unlikely seeing as how they live 2,500 miles apart and didn't seem to have any reason to know each other. But hey, it's a small world, so I checked my cousin's profile - turned out Facebook was lying, just trying to get me to add the person I knew in grad school by claiming an unlikely relationship existed that would presumably pique my interest and get me to add them to say, "OMG! How do you know my cousin?!?!?!" No real reason not to add them (though I generally limit my Facebook usage to responding to other people's friend requests), I just found it really odd that Facebook would lie about them knowing each other in an attempt to generate interest and get me to add additional people... does it really benefit them that much to map out (and potentially create) relationships?.

Re:Nothing new at all

[rwa2]

Hmm, very interesting... didn't classmates.com get sued by a class-action suit for always spamming people with fake "someone is searching for you" emails? This doesn't seem any different, actually worse if anything :P

Peer pressure FTW.

Fake peer pressure even better.

Simple Solution

[BlackLungPop]

Sign up for facebook and fill it with lies. Soon their information won't be worth jack shit.

Re:Simple Solution

[Oswald McWeany]

I've never joined facebook or wanted to.

Now I'm tempted to- just to create a bunch of BS so that it is confused about my real data.

Fill in a bunch of fake data- connect via a proxy- then unregister myself before people start giving me friend requests.

Just stay on long enough to screw up FB's data on me.

Re:Simple Solution

[rwa2]

Heh, when they first rolled out their Groups feature, I thought, yay, finally a way to separate my real friends and coworkers from all of my misc Mafia Wars, uh, "partners in crime". Then I was surprised when the creation of all these Groups created notifications on everyone's walls. Stopped using that feature real quick.

I came pretty close to putting some people into an "Idiots and Assholes" group. Pretty close :-P
But now and again I'm tempted to do it anyway, you know, for the lulz.

I've wondered about this for years

[techishly]

I very carefully avoid giving Facebook information [like my cell phone numbers and most of my email addresses, etc] that I don't want them to have [or by subsequent TOS change, share with the world]. But I can't prevent my gullible sister-in-law from uploading it all to them anyway through her careless use of Facebook's iPhone app or her blithe acceptance of having her address book vacuumed up in the alleged search for alleged friends. So even if I don't give it to them, it's too late. They have it already. And as we all know, once they have it they are never deleting it. Facebook can't be the only one guilty of this, Google and Microsoft must do it as well. Unfortunately, it would seem that if you’ve ever told anyone anything about yourself that they might have put in their address book [and that includes the note field] it is probably on the cloud now.

Re:GNAA

[Jeremiah Cornelius]

How do we destroy Facebook, in its entirety?

This should be the dedicated calling of our younger generation. Complete data-loss.

Re:Just When You Thought...

[bigredradio]

I was thinking the same thing.

Re:Slander.

[Threni]

Slander? But it's in writing, in a more or less permanent form. I'd go for the upgrade...

You don't own facts about yourself. Get over it.

[evilandi]

For heaven's sake, get it into your head: You do not "own" facts about yourself. You never did. It has never been, and will never be, illegal for someone to look at you in the bus queue and observe what clothes you're wearing, what your height is, what your hair colour is, or what number bus you're queuing for. Nor is it illegal for someone to listen to you chatting to your friend and hear your name or where you live.

Even before the widespread use of computers, people were compiling databases about individuals. In the Victorian and Edwardian era there were still card indexes of potential customers' names and addresses.

What is different here is the *interconnectedness* . I don't mind people complaining about interconnectedness - I mean, it's pointless and they've missed the boat by at over 20 years, but it is at least a valid argument. The ability of this information to spread at lightning speed between billions of people using thousands of databases, yes, that is relatively new. But complaining about somebody else knowing facts about you, that's dumb.

In England we've had this for well over 950 years, since the Domesday Book in 1089AD which listed every landowner in the country. Most likely the Roman empire kept a similar directory over two thousand years ago.

If you visit a company's website and they record the facts of your visit, that is NOT illegal. It's not even immoral. It only becomes controversial when they pass this information on to an entity which was not otherwise involved with your visit.

Hilarious

[neiras]

I note that many of the people loudly complaining about Facebook in this matter have Gmail addresses. What do you think Google does with all those contacts they scrape from your messages and that you enter into your Android phone? Especially when correlated with what OTHER people put into their Google Contacts?

Whether you actively participate in the "graph" (FB, Goog, any entry point) or not, you have a node representing you. Even if your node has some wrong information, most of it is probably accurate. Heck, I could write some dumb scripts, spawn a bunch of EC2 instances and scrape a social graph from all the public info that's out there. So could anyone else.

Short of changing your name and starting over while studiously avoiding big centralized services, there is nothing you can do about this.

Re:GNAA

[trum4n]

And if it paid as well as not caring, i'd be all in.

FB Halloween Story

[peter303]

Last weekend I when logged in FB it tried to friend every contact from my huge hotmail contact list it could match in its profiles. Fortantely I was able to halt this before it happened. Scary.

Re:FB Halloween Story

[dropadrop]

How did it get access to your hotmail contact list?

Re:GNAA

[Tsingi]

you create a service that does the exact same thing to facebook that they are doing to you.

ROFL!
Let's see how long it would take them to sue you for using their data. That would be an interesting case.

Re:Facebook

[rufty_tufty]

Not in polite society no.
I trust my friends to not give my phone number to that crazy person at the end of the street.
I trust my friends not to use the information about my address and DOB to perform ID theft and get credit cards in my name.
I trust my friends not to burgle my house when they know I'll be on holiday.

If I get a friend's phone number or they tell me in the pub that they are about to go on holiday i do not then share that information with anybody because that would be inviting trouble for my friend. In fact in polite society you don't pass on information you've been given to just anybody otherwise we'd all have crazy ex-girlfriends after us.
If you would share your friends information with anyone and everyone i worry for your friends.

Propagate false data?

[LoudMusic]

Surely someone better at programming than myself has either produced or is working on a simple set of software that will fill these databases with false information, rendering the whole thing unreliable. This actually seems like an appropriate task for an organization which refers to itself as anonymous .

Even if human interaction is needed (or better at than software) to create the accounts (answer captchas), once the couple million accounts are up and running they could randomly friend and unfriend each other, get involved in various groups, produce believable profiles, and become pollutants in the databases of companies such as Google and Facebook. Before long there rises the question, "is this profile real or fake? can't answer that? can't consider it real". The fakes could even base their profile on real profiles, altering things like school graduation year, and selecting a subset of contacts from various 'friends' of the real profile. With just a few 'friends' on Facebook an account rapidly begins receiving suggestions from Facebook itself on who might also be a known friend. It would be self propagating.

This may already be in action. I've had a few people/accounts that I did not know on Facebook send me a friend request, but were friends with several of my friends. Before accepting I asked our mutual friends if they knew who this person was. More often than not my friends said they didn't know them but since we went to high school together they didn't want to be rude. NO THANKS! Just as easily as this could be a data pollutant account it could also be a 3rd party mining Facebook for private information. Social engineering has always been a more powerful method than security hacking.

Anyway, I just think that rather than fighting for privacy the better approach is to corrupt their data through their own system. It seems more wicked.

Re:Propagate false data?

[ironjaw33]

Surely someone better at programming than myself has either produced or is working on a simple set of software that will fill these databases with false information, rendering the whole thing unreliable. ... The fakes could even base their profile on real profiles, altering things like school graduation year, and selecting a subset of contacts from various 'friends' of the real profile.

This particular technique has been proposed in research circles as a way to maintain privacy in participatory applications and social networking. However, instead of the fake information being used to throw off the aggregate trends, the fake information is generated based on the real data. The idea is that with enough fake profiles mixed in with the real ones, it is difficult or impossible to identify which users are real and which are not.

You can even go a step further and use the aggregated fake and real information from other users to perturb data of individual users and make it less personally identifiable but keep the general trends intact.

Re:Propagate false data?

[Requiem18th]

This. Data Mining is like spam, a technical solution is preferable than one that requires the cooperation of the offending parties.

Re:Propagate false data?

[slasho81]

A new job market is created: Facebook Engine Optimizers. They'll take care of any usefulness that may come from Facebook's extensive graph data.

Also: Shadow connections

[Arancaytar]

When both users are registered, Facebook is able to extract relationship data from somewhere. I have received friendship suggestions for people who once sent a single email to an alternate email account I used years ago, which I never put on Facebook. Even assuming all these people are fucking idiots who gave Facebook access to their email accounts, this shows Facebook harvests far more data than it lets on.

In this case, it firstly stores your email contact lists even if you decline to manually send these people contact requests. It secondly is able to form (from other sources, maybe other people's email accounts) a link between different email addresses you have used.

Re:Also: Shadow connections

[Culture20]

They loaded their contact list up to FB, and had all your email addresses associated with one contact. Probably along with your phone number, address, birthday, photo, nicknames, and associations.

Re:Also: Shadow connections

[The Other White Meat]

The other day, Facebook suggested I friend someone that I literally have had no contact with for over thirty years. We are talking childhood friends who never went to the same schools, I have had absolutely no recent contact with this person or their family. My only explanation is that Facebook knows every home I have ever lived at, every home they ever lived at, and made the connection that we might have been childhood friends.

Amazing data mining; I'm sure CIA/NSA/FBI are jealous (I kid; I'm sure they have a fully supported back door.)

Spam facebook?

[Anonymous Coward]

Solution - spam facebook with fake accounts and fake friends and fake information. Disinformation is good. We need a fake friends networks :)

Solution

[Anonymous Coward]

Don't have friends.

Re:Solution

[Eponymous Hero]

we should create an anti-social network. we all know people sign up for stupid shit blindly, so let them sign up for the anti-social network. upon signing in, all you will see is the list of all members' email addresses and passwords, and any corresponding facebook data that can be accessed by matching email/passwords (since we all know the majority of people use one password for everything). we'll place links to the most popular webmail and online banking services on each record displayed, with the added convenience of auto-signing them in. fuck privacy, right?

Re:GNAA

[pixelpusher220]

You can't sue Facebook for that...but you can sue the friend. But then, I'm doubtful you had your friend sign a non-disclosure agreement to the data you gave to them...

Re:Sex Offenders

[MightyYar]

Also getting drunk and peeing in public: indecent exposure. Or being a teenager and sexting. Crazy laws.

I KNEW it!

[Culture20]

I just didn't expect to be "proven" correct so quickly. http://yro.slashdot.org/comments.pl?sid=2456514&cid=37586174

Re:GNAA

[Tsingi]

you're an idiot.

LOL!
I don't think you're qualified to make that judgement, I was more or less agreeing with you.

Re:You don't own facts about yourself. Get over it

[satuon]

I was waiting for someone to point this out. Very true, sir. This has nothing to do with computers specifically. What Facebook is doing is called 'asking around' about you. That would have been the way you found out about someone before computers, or even writing, had existed - you went around and asked people about him.

Like 'Hey, I'm looking for this guy, I hear he's living in this village, could you point me to his house? Is he at his home right now, do you know?' and so on. The fact is, you're not the only one who knows about you. There are people who know about you, and they can give information about you just as good as you can.

Re:It can't possibly be that hard to avoid...

[c0d3g33k]

And one is no less of a fool for making it as easy as possible to steal by leaving the car unlocked. A car is no less stolen because it was illegal to do so.

Re:It can't possibly be that hard to avoid...

[Anonymous Coward]

You've certainly secured that arrogant cock up your ass.

Resistance is futile...

[mrops]

...you will be assimilated.

Re:It can't possibly be that hard to avoid...

[Pieroxy]

BTW, is there a chrome and FF extension that basically prevents EVERYTHING on a webpage that is not from the same domain than said webpage?

I have the "Block third-party cookies from being set" ticked on Chrome, but that doesn't work for other resources - any resource. I want to block scripts, images, CSS, everything. I want the browser to make requests only to the domain name I see on the address bar.

That's actually basically all I need. Of course, there should be a white listing capabilities.

Re:Slander.

[Bucky24]

Can't slander be in writing? Or more properly said, can't writing be slanderous?

Re:GNAA

[TheSpoom]

Facebook wouldn't allow such an application. To export the data, you'd need a Facebook application. To make a Facebook application, you have to agree to their Terms of Service (Facebook likes to call it a "Statement of Rights and Responsibilities").

3. Safety
We do our best to keep Facebook safe, but we cannot guarantee it. We need your help to do that, which includes the following commitments: ...

3.2. You will not collect users' content or information, or otherwise access Facebook, using automated means (such as harvesting bots, robots, spiders, or scrapers) without our permission.

Believe me, it's been tried. Facebook is quick to respond and threaten a lawsuit if you continue.

Re:this should be a good thing not a bad thing

[Culture20]

People tend to be scared to post things to facebook because of the negative ways that your family/friends/employer might take the content... but since facebook is now making you an optional participant in filling out your own profile, it takes a lot of accountability away from the person who is scared of accountability. So next time someone fires someone else for having a political view or some random information that their company doesn't like, they can conveniently point to facebook's data mining process and there is the reasonable doubt that you may or may not have put that there personally. I like this idea. The less accountability placed on me based on my online personality, the better.

Reasonable doubt is a great cerebral defense in a legal argument. It does nothing to defend against emotional responses. Defendants who are found not guilty based on reasonable doubt are given wide berth by everyone afterward.

Re:GNAA

[taoareyou]

Perhaps he thinks you are an idiot for agreeing with him? But apparently he just ends all his replies with "You're an idiot."

Re:You don't own facts about yourself. Get over it

[Anonymous Coward]

Good thing you don't live in Canada or Germany. Because use of personal information like this, is illegal. In both countries.

Re:GNAA

[Tsingi]

So it appears. Every single one of his posts is modded to -1. And I agreed with him?

oops.

Re:Slander.

[tepples]

Playing along:

You got trolled. Hard.

Is it still being trolled if I troll back?

Re:You don't own facts about yourself. Get over it

[ironjaw33]

I was waiting for someone to point this out. Very true, sir. This has nothing to do with computers specifically. What Facebook is doing is called 'asking around' about you. That would have been the way you found out about someone before computers, or even writing, had existed - you went around and asked people about him.

Like 'Hey, I'm looking for this guy, I hear he's living in this village, could you point me to his house? Is he at his home right now, do you know?' and so on. The fact is, you're not the only one who knows about you. There are people who know about you, and they can give information about you just as good as you can.

The troublesome part is that this is aggregating knowledge about you from essentially everyone who ever met you or knew about you. It's not asking one person who knew of you, it's asking everyone who knew of you simultaneously and instantaneously. One person can only give a few small fragments but a collective can paint an entire picture of your life, inside and out.

Many inferences can now be made about people that were not possible when information was incomplete (finding and asking everyone about you in person or via email would be impossible).

facebook fears

[bigdavex]

Any minute now one of these shadow accounts is going to ask me to donate a virtual cow or something.

Re:You don't own facts about yourself. Get over it

[Rob the Bold]

In England we've had this for well over 950 years . . . Most likely the Roman empire kept a similar directory over two thousand years ago.

I read a story about that somewhere . . .

Re:Slander.

[compro01]

No, slander is defamatory speech.

Defamatory writing is libel.

Re:Slander.

[Bucky24]

Aha, good to know. Thanks!

Re: Wroooong!

[Anonymous Coward]

Sorry to disappoint you, but collecting personal information on an database without user consent is not allowed under the European Data Protection Directive. You might not like it, but your personal image is in the category of personal information. Facebook having your personal information without your consent is quite against said directive. So please stop spreading misinformation.

Re:Slander.

[TheRaven64]

No, if it's written then it's libellous.

Re:It can't possibly be that hard to avoid...

[tomtomtom]

BTW, is there a chrome and FF extension that basically prevents EVERYTHING on a webpage that is not from the same domain than said webpage?

Request:Policy for Firefox. Don't know if there's something similar for Chrome.

Dr. Strangelove or:

[tommy8]

How I Learned to Stop Worrying and Love the Facebook

Re:You don't own facts about yourself. Get over it

[satuon]

Yes, Facebook has found a way for automating the process, unfortunately.

Re:You don't own facts about yourself. Get over it

[firewrought]

You do not "own" facts about yourself. You never did. It has never been, and will never be, illegal for someone to look at you in the bus queue and observe what clothes you're wearing, what your height is, what your hair colour is, or what number bus you're queuing for.

Yes, but it's also true that if a creepy man staked out a bus stop for months on end recording data about people, the police could get him to "move along sir". And if that creepy man was following you around all day, day in and day out, you could get a restraining order against him. Somehow I think getting a restraining order against FaceBook, Google, etc. will be a little more difficult despite the fact that they are stalking the entire world. What's needed is for the legislature to come to the rescue.

Technology

[msobkow]

You can fear it or embrace it, but like the future, it is inevitable.

I'm not happy about this

[hrrY]

I was always wondering when this was going to come up... For starters, I am the ONLY person with my name, first and surname combination; in the world(I know, hard to believe but true nonetheless) I have never had a facebook account(and never will), but *yet* for some odd reason there is a faux profile of me(I shit thee not) is listed on it with some odd similarities including but not limited to race, sex, location, and activities that I'm into(again I shit you not). I have seen this profile and it has a picture of some loser getting high or doing whatever the hell he's doing WITH MY NAME. Now let's say for example, that I'm looking for a job and the potential employer does a Facebook search which I believe is SOP these days in the job market and that profile pops up. What then is the chance of me being looked at as suitable candidate?! Or let's say for another example I am contracting and the client wants to do some background research on me(which I feel is reasonable) and then again, THAT SHIT POPS UP All I'm saying is that this "feature" has the potential to do a lot of irreparable, long lasting, "digital" damage(i.e. the wayback machine) to a person that has never, nor has any intent, of being on "The Facebook". Sooo, is the only way I(or anyone else with this problem) can protect myself is to sign-up with a real profile in an attempt to set the digital record straight?! Truthfully, if I never get a job or contract again after a background check I fully and indelibly have no one but Facebook to blame...

The solution

[HalAtWork]

The solution is that everyone should have a Facebook profile, simply enter as much erroneous and false information as possible. Become Facebook friends with strangers, and upload doctored pictures that are a collage of various unrelated things.

Credit agencies

[stabiesoft]

I am much less concerned about FB than experian et al. I wish I could put a block on any request for my credit info without my prior authorization. The only way it appears I can do anything but a tempoary block is to have already been the victim of a crime.

Re:It can't possibly be that hard to avoid...

[Rubinstien]

Remember - information about individuals is worthless. It's the large-scale aggregate data that has value.

Another false assumption.

Remember 'Total Information Awareness"?: http://en.wikipedia.org/wiki/Information_Awareness_Office

Officially, that died on October 1, 2003, when President Bush signed the defense budget in which Congress axed the program after its existence caused a public uproar. Read through the various programs under that umbrella, including "Scalable Social Network Analysis". Zuckerberg released his first "social network" project (Facemash) on October 28, 2003, only 27 days after TIA was officially put down and split up between different agencies. For some reason, Harvard saw fit to drop their proceedings against Zuckerberg to have him expelled for hacking into the student ID databases to obtain the photographs he initially used to populate his site. He was then able to rapidly expand his project and get venture capital funding. Given that this all occurred well after the dot-com bubble burst, it seems that selling the associated data to advertisers would be a weak financial foundation to rapidly build such a project on, particularly when the principal leader of the project is a college undergrad, and its membership was limited to colleges at the time. I think the underlying idea may really have been to privatize parts of TIA all along. In particular, while the US government is bound by the Freedom of Information Act and the Privacy Act amendments, later amendments weakened the original acts in favor of protecting corporations, so the government is not required to reveal information that is considered a "trade secret" of a third party. See the article from a few days ago ( http://yro.slashdot.org/story/11/10/13/1938241/facebook-the-law-says-you-cant-have-your-data ), where Facebook is claiming this exact protection.

One related point is that the FOIA gives you standing to find out what records the government is keeping about you, to challenge the accuracy of it, and to sue the government for abusing it; the Privacy Act limits how they can share it, even between agencies. Data held outside the government is exempt from all that, at least in the U.S.

Viewed in that light, the individual information is the *most* valuable and unique; not worthless at all. Now, pair the social network information with all of the photographs that are pumped into FB and tagged by individual... Take a look at cheap software such as http://http//www.facegen.com/ (even has a free version) and http://www.youtube.com/watch?v=BsFj1-fvbkA&noredirect=1 (first couple of relevant Google links I could find, I sure the three-letter agencies have access to better). Even if you aren't on FB, you are probably tagged somewhere in a photo, unless you are a total hermit. If the authorities were looking for you and had access to parametric data about your facial and body structures from this database, as well as access to the National Facial Recognition Network discussed recently ( http://yro.slashdot.org/story/11/10/07/2342240/fbi-plans-nationwide-face-recognition-trials-in-2012 ), they have a solution that would make the Stasi drool. You have everyone snitching on everyone else, documenting their comings and goings, providing up-to-date photographs, etc., and it is all there in one place, already tagged and organized.

The advertising revenue may just be the gravy on top of the government contracts.

Re:GNAA

[RazorSharp]

without our permission.

That's the scary part.

Is it even worth setting up a profile?

[failedlogic]

I've lived in a few different cities and I know a few people I'd like to keep in contact with. I think I could probably reconnect with others from college and so on.

I keep reading about new privacy problems with FB every week either on /. or some other site. FB also changes rules or way that info is used (like this).

I can see tremendous (or possible) benefits of using FB. But I'm creeped it by the sort of stuff I'm reading about here.

My other concern is there is someone with the same name as me (and my real name is not common) who had some fairly serious criminal charges. I would hope having a good FB profile would at least help me separate myself from this person.

And I know without digging around much there's quite a bit of stuff (all positive) about me in FB. Just from hanging out with friends all who are active on FB.

I just wonder .... is it worth it anymore? Has anyone felt more benefits than negatives?

Re:You don't own facts about yourself. Get over it

[failedlogic]

I'd agree. I might even consider bringing up a case with the Canadian Privacy Minister.

They've fought with FB on several occasions and I think FB had to change their ways not just for Canadians but the impact was global or North America wide or similar.

Re:It can't possibly be that hard to avoid...

[BitZtream]

Nor is it any less illegal to steal it because it was easy to steal.

Your logic isn't. You're arguing that we shouldnt' expect privacy because we take precautions against those who try to steal our identity.

All your statement does is makes you like ignorant and unintelligent, not clever.

There are already millions ...

[jabberwock]

... more likely, tens of millions of fake profiles. People have multiple profiles to play games, for work and for play, for doing things on facebook or on the web that they don't want anyone who knows them to know about.

All it takes to get a Facebook account going is an email address.

If you think that a couple of dozen Facebook police are able to enforce using "real" information on 500 million accounts ...

Okay, good. Now you don't think that.

Stop caring

[muirnin]

As a licensed private investigator, I can tell you - no matter what you do, you leave data all over the place. The question is not "how do you stop this"... it's "how do you stop caring". This horse bolted YEARS ago, and the fact that people are only now noticing that the gate is open is hilarious to those of us in the know.

Lie like a bastard

[SciBoy]

The solution is to lie about everything in your Facebook profile. Wrong home town, wrong school (use ACME High School or something like that obviously not true). No one at Facebook has the time to check whether the information is correct, but if you leave it blank they can get it elsewhere.

Re:You don't own facts about yourself. Get over it

[swillden]

Somehow I think getting a restraining order against FaceBook, Google, etc. will be a little more difficult despite the fact that they are stalking the entire world.

No need for an order against Google. Go look at Google's privacy tools page (there's a link on the bottom of the search page). You can see everything Google is tracking about you and Google provides ways to opt out of all tracking and even tools to ensure that your opt-outs don't get lost. Try it. You'll see that you start seeing more generic advertising and your search result quality will decline a little.

Fill it with imaginary people...

[Kazoo the Clown]

Seems to me this sort of thing leaves FB vunerable to the creation of massive amounts of bogus information. Might a flood of the right inputs overflow their databases with erroneous info on non-existent people, imaginary interests, etc. I started seeing those "you might be interested in" links to stuff, and just as a thougt experiment started having conversations with a friend full of nonsense words, thinking that it might be possible to fool Facebooks intelligence into thinking some of the nonsense are up and coming items of interest that it might start offering to others. One might be able to confuse it further by referring to legit websites but treating random phrases found on the site as if they were people's names, in order to get FB to think the website is referring to an individual when it's talking about something else-- "I'm going over to Crude Oil's house today. Crude has a new motorcycle I want to check out.". And now, every website talking about crude oil in existance can be used as further verification that a person named "Crude Oil" exists and is involved in lots of stuff...