How Facebook Outs Sex Workers (gizmodo.com)

An anonymous reader shares a Gizmodo report: Leila has two identities, but Facebook is only supposed to know about one of them. Leila is a sex worker. She goes to great lengths to keep separate identities for ordinary life and for sex work, to avoid stigma, arrest, professional blowback, or clients who might be stalkers (or worse). Her "real identity" -- the public one, who lives in California, uses an academic email address, and posts about politics -- joined Facebook in 2011. Her sex-work identity is not on the social network at all; for it, she uses a different email address, a different phone number, and a different name. Yet earlier this year, looking at Facebook's "People You May Know" recommendations, Leila (a name I'm using in place of either of the names she uses) was shocked to see some of her regular sex-work clients. Despite the fact that she'd only given Facebook information from her vanilla identity, the company had somehow discerned her real-world connection to these people -- and, even more horrifyingly, her account was potentially being presented to them as a friend suggestion too, outing her regular identity to them. Because Facebook insists on concealing the methods and data it uses to link one user to another, Leila is not able to find out how the network exposed her or take steps to prevent it from happening again. "We're living in an age where you can weaponize personal information against people"Kashmir Hill, the reporter who wrote the above story, a few weeks ago shared another similar incident.

Comments

The real problem is

[Anonymous Coward]

criminalizing prostitution.

Re:The real problem is

[Anne Thwacks]

criminalizing prostitution.

No.

The real problem is that privacy rules are not protected by jail terms for company directors.

Re:The real problem is

[Opportunist]

Both are real problems.

Re:The real problem is

[sittingnut]

analyzing and publishing public information is not an invasion of privacy, even when done on a massive detailed scale using new technology.

facebook is a public place, created to exploit user information for facebook investors' advantage, with no privacy whatsoever, don't use it. don't put yourself at the mercy of exploiters running facebook, if you care for privacy.

case would be different when non facebook users are exploited by zuck and gang, that too happens. that should be criminalized with prison. .

Re:The real problem is

[gweihir]

Both are pretty serious problems and ones that massively would benefit society if changed. Of course that would require people to a) get over religion and b) get over the quasi-religious belief that people with a lot of money are somehow "good".

Re: The real problem is

[ZorinLynx]

A big issue here though is that the right-wing viewpoint is usually "This is forbidden! We will NEVER change that!".

If prostitution were regulated, with mandatory heath examinations, licensing of facilities and a framework that prevents these women from taken advantage of, we could have it both ways: People who want to pay for sex would be able to, with less risk to themselves and their "partner".

A good fictional example is the Companion Guild in the Firefly TV series. In that world they solved the problem through regulation and also elevating the trade so that it's considered prestigious, rather than scandalous.

Re: The real problem is

[rickb928]

Kind of.

As a self-identified right-winger, my first concern with prostitution is the inherent risk of abuse, first due to the social stigma, which puts the sex worker at risk of abuse by law enforcement, pimps and other rent-seekers, and clients. Removing the stigma is, or should be, out of scope for government intervention. Government can reflect society and culture, but when it is used to dictate or shape society or culture, it is no longer freedom, and our nation has become something it was not intended to be.

This is why, as described in a recent incident, police officers defending engaging in sex with anyone other than their spouses (or partner) while on duty as innocuous are flat-out lying. Being a police officer, on duty, they have an inescapable position of authority, and there can be no consensual interaction with any citizen without the obvious risk of becoming an enforced interaction. The gun on their person forces that. Even taking the gun and badge off solves nothing, however, because they can defer that forced interaction until 'later'. A police officer on duty, and probably even off duty, can use their position of authority to force others to comply with virtually any demand, and their only risk is not exposure, for we see too many reports of this happening, but the unfortunately rare imposition of undesirable consequences. these happen too rarely to be a deterrent on many forces...

And this is only the law enforcement risk to sex workers. their clients can take advantage of a real imbalance of power. Until society removes the various stigma associated with the work, this is a risk where the work is held in such low esteem.

Now, the question of whether prostitution is a moral or ethical profession is one to be left to the culture and society. resolving that could make the work safer.

Re:The real problem is

[dgatwood]

Close. The real problem is carrying a cell phone with the Facebook app on it, signed in with your account, while doing things you don't want Facebook knowing about. All they have to do is correlate the GPS locations from multiple devices to detect that two people are repeatedly in the same location at the same time.

Re: The real problem is

[vux984]

Hmm... as a self-identified left-winger; I'd say you nailed my position more or less perfectly as well. So I'm not sure the split her is left vs right at all.

I do generally favor legalization; for practical reasons. It is going to happen whether its legal or not, and they are already in a highly vulnerable occupation at the best of times... explicitly making them criminals too just makes them more vulnerable.

Simple fix

[Train0987]

Don't use Facebook.

Re:Simple fix

[Anonymous Coward]

That's not a fix anymore. They have managed to build profiles on almost anyone. How do they know your bank account information if you don't have a FB account? How do they know it if you do and have never used your bank account with it? This has gone beyond scary.

Re:Simple fix

[networkBoy]

My ex did a paper as part of her masters about sex workers. A surprising percentage of private room bookings did not involve a sex act so much as a counseling session. These girls were discreet and honestly cheaper than a shrink.

Re:Facial Recognition

[Anonymous Coward]

Who in their right mind (client or sex worker) would post a picture online of them being together? It is much more likely that the Facebook App used location data, and saw these two people together for a certain time on a certain location. Which is exactly what the article suggested.

AC, because I moderated already.

Their app reads your contacts...

[emil]

...and this is how it knows who you associate with. In later versions of Android (and perhaps in iOS), you can deny permissions to read your contacts, but the app will likely work hard to get around that.

If you have contacts on your phone that you don't want Facebook to know about, then you must not load their app

- only access them through a dedicated, privacy-focused web browser (or an equivalent sandboxing app).

I like FaceSlim on F-Droid. I would never, ever run their app. That thing is a monster.

Re:Their app reads your contacts...

[Anonymous Coward]

Wrong. I have two accounts. One which I've used for years on my personal laptop, and a second one I recently created behind a VPN and which I've only used from a separate laptop, within a private Chrome tab, with no personal details at all. There is absolutely no link between the two accounts, other than my own eyes looking at both. No pics, no FB app, nothing.

Two weeks after I created the new account, FB started suggesting friends from my old account. I'm not sure how they do it but it's truly terrifying.

Re:Their app reads your contacts...

[AmiMoJo]

They might be using canvas fingerprinting. There are add-ons to block it. I use CanvasFingerprintBlock.

Canvas fingerprinting works in incognito mode, works with ad-blockers, works if you block cookies, works if you use a VPN... And if you install a blocker you will quickly find that a large proportion of sites are trying to use it.

this isn't new

[Cederic]

A decade ago Facebook sent me an email, suggesting that I create an account (as I didn't have one) and also telling me that I probably knew three different people - one that I worked with, one that I socialised with and one family member.

None of those people had the same email address for me.

I wonder if the UK DPA or upcoming GDPR legislation will let me force Facebook to reveal their matching algorithm - see Article 15 paragraph 1(h) of the regulation (PDF at http://eur-lex.europa.eu/legal... )

Had the exact same effing thing happen to me

[Anonymous Coward]

I come from a middle eastern Muslim country. My views about religion and other issues will surely anger people I know. To vent, I made two accounts on facebook, one for my friends, and one where I express my views including religious ones under a separate identity.

On the 'anonymous' account, I just put my first name and at worst, extremely general hints about my life , since I assumed no one I know will see it. I used a separate, anonymous, e-mail for this account, and used to access it from a separate browser. The only link was probably my IP address / user agent, or maybe I tried to view my profile from the other account, but that's it.

I was once chatting with a real-life Muslim friend and she started making hints about statuses I post on my other account. Nothing serious happened, since shes a terrible Muslim herself, but this could have easily put my life in danger had this been known to other people. I learned to NEVER trust facebook with my privacy ever since this happened.

In other words...

[Noryungi]

Stop being on Facebook.

Except Facebook will remember you even if you delete your account.

Except Facebook will remember you even if you have separate accounts.

Except Facebook will find out who you are if you have friends and family on Facebook. Especially if they mention you by name in a Facebook post.

Except Facebook is probably tracking you right now because of all those little "like" buttons you can see everywhere.

Except Facebook... Oh, fsck it, I give up.

Frankly, who needs the NSA when you have Facebook? Oh, wait, they are probably working together right now.

Wasn't there a story about that creep Zuckerberg wanting to become President of the United States of Facebook?

Correlated Positions and Movements

[GoRK]

Facebook makes suggestions based on correlated movements and positions. If you arrive and depart from the same location at the same time as another person a few times it may suggest them as a friend. There isn't really any mystery to this (unless you are someone like a journalist or Facebook user who never read any of the agreements you accepted).

We could have a debate as to whether or not this should be opt-in, or legal, or whatever, but there shouldn't really be any debate that it is an effective method of determining people who might know each other, and there shouldn't be any mystery that it's done when it has all been plainly discussed before. You can at least opt out of some of it, or adjust your privacy settings to prevent it.

Just imagine that Facebook is your mom and every time you load up the app it's like calling your mom and telling her where you are. And everyone else around you is also calling your mom and telling them they are there too, and you and everybody else are constantly calling back every 10 minutes to give her updates. Provided your mom has a lot of time on her hands and takes really good notes, pretty soon she's going to figure out who you are hanging out with.

Re:And now skype

[fisted]

When I was going to install signal because of all the good things I heard about it, my phone presented me with a *massive* list of permissions the Signal app wants:
- read sensitive log data
- find accounts on the device
- read your own contact card
- modify your own contact card
- read calendar events plus confidential information
- add or modify calendar events and send email to guests without owners' knowledge
- find accounts on the device
- read your contacts
- modify your contacts
- approximate location (network-based)
- precise location (GPS and network-based)
- read your text messages (SMS or MMS)
- receive text messages (MMS)
- receive text messages (SMS)
- send SMS messages
- edit your text messages (SMS or MMS)
- directly call phone numbers
- directly call any phone numbers
- modify phone state
- reroute outgoing calls
- read call log
- read phone status and identity
- write call log
- read the contents of your USB storage
- modify or delete the contents of your USB storage
- read the contents of your USB storage
- modify or delete the contents of your USB storage
- take pictures and videos
- record audio
- view Wi-Fi connections
- read phone status and identity
- send WAP-PUSH-received broadcast
- receive data from internet
- view network connections
- create accounts and set passwords
- pair with Bluetooth devices
- send sticky broadcast
- change network connectivity
- connect and disconnect from Wi-Fi
- disable your screen lock
- full network access
- change your audio settings
- read sync settings
- run at startup
- set wallpaper
- use accounts on the device
- control vibration
- prevent device from sleeping
- toggle sync on and off

Needless to say, I backed out.

PUNISH PEOPLE I DON'T APPROVE OF

[Thud457]

data analytics that would make even the STASI say, "whoa, that's going a little too far"...

Re: And now skype

[rworne]

Not only IP addresses.

Facebook connected me with someone I had brief contact with from back in the late 1980â(TM)s and FIDO BBSâ(TM)s. Predating my time on the Internet, this was puzzling to me.

It turned out I contacted them once via hotmail and that was it.

Yet somehow Facebook has this information, and to this day continually lists them in the âoepeople you may knowâ section.

Re:Dump Facebook

[richardellisjr]

Your missing the point, even if you have never created a facebook account one exists for you they created. Thus if someone uploaded a picture of you to facebook and tagged your name in it, then they can tag your name on every picture uploaded to them with you in, even if they don't automatically tag those pictures they sure as hell know who you are and your name and relationships at a minimum. At this point there are probably very few people in the world that haven't had a picture of them uploaded and tagged.

Re:And now skype

[Anonymous Coward]

There WASN'T two accounts-- she DID NOT HAVE an account for her professional work.

Seriously, how hard is it to read a damn article before taking the know-it-all route.

Re:Signal permissions

[fisted]

Thanks for that link, Einstein. I traveled back in time and included it in my own post.

And in no way do they *need* all that. They *want* it to offer fancy functionality which is the *last* thing I want in an allegedly highly secure system. Just think of all the code that is required for those fancy features, and when it does get compromised, the attacker can pretty much do anything they want because they have all the permissions. Fuck that. They've lost their credibility to me by pulling off that incredibly stupid mode.

Re:And now skype

[Lord Kano]

According to the summary(That you obviously didn't read), she only has a FB account that's linked to her real life identity.

Her sex-work identity is not on the social network at all

There is no other account for FB to conclude is owned by the same person.

Whatever is happening isn't what you think is.

LK

Re:Signal permissions

[DNS-and-BIND]

That's what they SAY they need it all for. Do you really believe the cover story? Come on. All that data is valuable and can be sold. That's why there are ten zillion permissions.

Dude, talking about getting it completely wrong

[wonkavader]

The criminalization of prostitution doesn't fix any of those negative aspects. Decriminalization allows us to tax it. When we tax something we keep records and make requirements/offer services to the workers in that industry. Those requirements/services would be aimed at reducing the issues you're speaking of above. There will still be illegal prostitution, but legalization would greatly diminish that.

Prohibition didn't solve the evils of alcohol, they exacerbated them. The war on drugs hasn't stopped drug us, it's simply exacerbated the negative affect it had on society.

The first-order vs. higher-order stuff you're prattling about above is not directly connected with party affiliation. Stupid people only think about first-order affects. There are stupid people on either end of the spectrum.

Meanwhile, please point me to one member of congress presenting a "proper solution that provides far more balance and tries to avoid unintended side effects" for the ills of sex workers and their clients. By which I mean a solution other than "more prison, bigger guns."

Re:And now skype

[rpresser]

John has exchanged email with leila_sexworker
John's emails contain headers which include leila's IP address
John lets Facebook see his emails
There are several, perhaps many Johns
Facebook sees that all these Johns have leila_sexworker in common
Facebook sees leila's IP address and matches it with its own records
Facebook sees leila_clean logging in to Facebook from the same IP address, repeatedly
Facebook makes the connection

Re:And now skype

[Rob Y.]

Which begs the question - why does Facebook suggest 'people you might know' based on anything other than their being Facebook friends of your Facebook friends? And how would it hurt them to let you opt out of that?

The weird thing is that, having put enough effort into this particularly creepy kind of 'connection', the actual 'search for people you know' functionality on Facebook is horrible. You can search by name - that's it. Useless for any kind of common name - and even when the person you're searching for shows up in the list, you can't narrow it down by searching on location or any other keywords, so if you don't recognize their photo, you're out of luck.