How Facebook Figures Out Everyone You've Ever Met (gizmodo.com)

"I deleted Facebook after it recommended as People You May Know a man who was defense counsel on one of my cases. We had only communicated through my work email, which is not connected to my Facebook, which convinced me Facebook was scanning my work email," an attorney told Gizmodo. Kashmir Hill, a reporter at the news outlet, who recently documented how Facebook figured out a connection between her and a family member she did not know existed, shares several more instances others have reported and explains how Facebook gathers information. She reports: Behind the Facebook profile you've built for yourself is another one, a shadow profile, built from the inboxes and smartphones of other Facebook users. Contact information you've never given the network gets associated with your account, making it easier for Facebook to more completely map your social connections. Because shadow-profile connections happen inside Facebook's algorithmic black box, people can't see how deep the data-mining of their lives truly is, until an uncanny recommendation pops up. Facebook isn't scanning the work email of the attorney above. But it likely has her work email address on file, even if she never gave it to Facebook herself. If anyone who has the lawyer's address in their contacts has chosen to share it with Facebook, the company can link her to anyone else who has it, such as the defense counsel in one of her cases. Facebook will not confirm how it makes specific People You May Know connections, and a Facebook spokesperson suggested that there could be other plausible explanations for most of those examples -- "mutual friendships," or people being "in the same city/network." The spokesperson did say that of the stories on the list, the lawyer was the likeliest case for a shadow-profile connection. Handing over address books is one of the first steps Facebook asks people to take when they initially sign up, so that they can "Find Friends." The problem with all this, Hill writes, is that Facebook doesn't explicitly say the scale at which it would be using the contact information it gleans from a user's address book. Furthermore, most people are not aware that Facebook is using contact information taken from their phones for these purposes.

Comments

LinkedIn Also.

[Hylandr]

LinkedIn Also does this.

It's just more in your face about it.

Re: LinkedIn Also.

[Hylandr]

Facebook is just where AOL escaped to.

Re: LinkedIn Also.

[dreamchaser]

It is the bastard child of AOL and Myspace.

Re:LinkedIn Also.

[hackwrench]

The lawyer is stupid though. It doesn't take much to figure if you are both lawyers in the same town you MAY know each other. No email scanning required. Frankly, I'm surprised it hasn't yet told me I may know Kevin Bacon.

Re:LinkedIn Also.

[datavirtue]

The point is that no one fucking knows how it happened....not even Facebook.

Re: LinkedIn Also.

[arglebargle_xiv]

facebook is good for kids and retired ones.

I can understand that it's the perfect medium for stalking and grooming kids, but retired people? They're old, and smell of mothballs.

Or is it so you can rob them?

Thanks, cell provider, for baking it in

[magarity]

I disable the FB app that the cell provider baked into the Android rom so even though it spouts dire warnings about the system not working properly if that's done. I assume that's enough to prevent it from sucking out my info but who knows for certain anymore and what about people who don't disable it?

Re:Thanks, cell provider, for baking it in

[spaceman375]

I disabled facebook on my android phone. I can go back and look at it anytime I want to verify that it says disabled. Funny how it also lets me "Force Stop" the running app, within 2 days of having killed it. With no reboot, no launching or asking permission from anywhere, it just "mysteriously" keeps re-launching, disabled or not.

Re:Thanks, cell provider, for baking it in

[Zaelath]

I spent the first 10 hours of owning an Android device back in 2011 working out how to root it so I could remove Facebook. Even then I had to use a backup program to 'trick' it into uninstalling. On the upside, that returned 20% of my battery per day and extended the useful like of the phone for a year.

It should be regulated

[Baron_Yam]

Time for new privacy laws, I guess.

Private companies should not be permitted to collect data on people not in a business relationship with them just because someone else shares it with them.

Let my sister mention my email address on her Facebook wall - Facebook shouldn't be able to do anything with it unless I am already a Facebook user and have provided that same email address.

Legislate them into purging any such mapped relationships from their databases, legislate them to ban rebuilding those relationship maps.

Just because privacy isn't important to someone else doesn't mean I should have to surrender mine.

Re:It should be regulated

[geekmux]

Time for new privacy laws, I guess.

New privacy laws would imply that there is a society that actually wants it.

Our society doesn't give a shit about privacy. Hasn't for a very long time now.

Sadly, those that still fight for privacy have now become an anomaly, so you stand out even more.

Re:It should be regulated

[lengel]

No, it is more like that magic phrase "Terms of Service". By signing up for an account you give consent to all this. In the real world you are not giving explicit consent to be stalked so the law is on your side.

That is why I never have had nor do I ever plan on having an account there.

Re:It should be regulated

[jgullstr]

New privacy laws are coming, at least in the EU. According to the General Data Protection Regulation, EU residents will, among others, have options to access and purge information collected about them come May 28th, 2018. How this will work in practice remains to be seen.

Re:It should be regulated

[gnick]

That is why I never have had nor do I ever plan on having an account there.

You never signed up for an account there. I'd be shocked if you didn't have one. Did you sign up for Experian?

Re:It should be regulated

[ffreeloader]

I'm not too sure that a lot of people just don't realize the scale of the abuse. I've talked to people I know about online privacy and how their information is used against them. Most of those I've talked to think I'm paranoid and they could care less that their privacy is compromised.

My wife doesn't get it and doesn't care, and she and I have had this conversation many times. She is so addicted to Facebook she can't stay off it for more than a couple of hours at a time. Me? I don't even have an account. Never have had.

She gives out her email address and cell phone number for any "free" stuff she sees an ad for, and then wonders why she gets several hundred spam emails and a half dozen phone calls a day from people wanting to sell her stuff. Tells me once again I'm paranoid when I tell her why she is getting so much spam.

She isn't stupid about things in physical life, but she is techonology-challenged big time. She insists she never uses the internet even while she's connected to Facebook. She thinks if she doesn't open her browser she's not online even though I've told her dozens of times that she is when she's on Facebook. She can't get it through her head that the only way to reach Facebook is on the internet. She thinks it is on her phone. Physically on her phone. She's just as helpless with a desktop or laptop too. Computers are just a big black box to her. Her brain was never wired to understand technology. I've seen a lot of people like her. Talked to, and helped, hundreds of people with post graduate degrees who couldn't program their own thermostats, (I worked in the HVAC trade) and were just as ignorant about how to use a computer. Some intelligent people's brains just do not function in any way related to techology.

Strange game...

[TWX]

Only winning move is not to play.

Re:Strange game...

[dmomo]

This is apparently untrue, because to "not play" requires the ability to choose not to play. There is no opt-out on shadow profiling.

Re:Strange game...

[citylivin]

"Only winning move is not to play."

And have none of your friends play, or your work colleagues, or your landlord, or anyone who you have ever given your phone number to.

I don't use facebook, but i'm sure i have quite the impressive shadow profile considering my wife, my son, my dad, and pretty much every other person i've ever met does use it. The article talks about how facebook uses your phone number as a unique identifier, and other peoples non-consensual contact sharing of your information, to build a shadow profile of you.

So no, its not as simple as not playing the game. You have been entered into the game if you have your phone number in anyones phone book, and come on, that's everyone. Who doesn't have a phone, either at work or at home. Unless you solely communicate with disposable burner phones, (and no one adds those numbers and your name into their phone book :P), then you are just as vulnerable. They probably even have your picture that someone helpfully tagged.

Its pretty depressing that they can get away with this, and that people don't really care and willingly help them.

 

Another possibility...

[zarmanto]

The info that you (and other Facebook users) provide voluntarily is certainly the primary source, but I think it's reasonable to speculate that it is by no means the sole source of Facebook's "connections" capabilities. Just like anyone else who wants to know something about someone, Facebook almost certainly Google's you. In this particular situation, it's worth mentioning that court cases are typically public record, and many of those records have been made available online. Therefore, a comprehensive search of the web would likely eventually turn up a record which includes the names of the two counsels on each side of any given case, as well as other people who were involved in that case. Cross-reference those names against the Facebook user list, and there you have it: several new potential connections.

Unintended consequences

[rsilvergun]

reminds of that story where a father found out his teenage daughter was pregnant because Target sent her a coupon for baby powder or some such based on her purchase history. I understand it's a big problem in the closeted LBGTQ community and among sex workers because they'll have two FB profiles for their double lives and FB will constantly link the two.

Geolocation

[Albanach]

I'm expect that using the system tools to block access to the address book is probably sufficient on Android and iOS - so long as it's done before the app is ever launched.

What surprises me more is that people don't consider geolocation. Many many facebook users share their location with Facebook. It's then trivial for facebook to see that you are repeatedly in the same location at the same time as another person.

That lawyer might have met defense counsel at a couple of mediation hearings in a lawyer's office, then they went to the same court house at the same time every day for a week. It's easy to suppose they know each other.

Similarly for the sex worker who meets the same client at a handful of different hotels. Both their phones arrived at the hotel at the same time on the same days. Then they left together. Again, the connection is trivial.

At least with Google, you are paid for this data with better traffic reports and better directions. You can decide if that is worth it or not. With Facebook it seems you get nothing in return while they amass a huge amount of information you thought was private.

Re:Geolocation

[nine-times]

What surprises me more is that people don't consider geolocation. Many many facebook users share their location with Facebook. It's then trivial for facebook to see that you are repeatedly in the same location at the same time as another person.

I've actually been suspicious for a while that Facebook is doing something with geolocation.

I have a Facebook account. The main reason I have it because of friends and family who expect you to have it. I look at it sometimes, but almost never post anything. A couple of years ago, Facebook got pretty aggressive in sending notifications suggesting that I "friend" people that I might know-- not like I was looking for people that I might know, but they were actively sending me notifications. At first, it gave me a bunch of people that I did in fact know, and I friended some of them and it all seemed normal.

But then, within about a month, they got even more aggressive with the notifications, and a lot of the notifications were for people that I did not know. It seemed odd to me. Of the ones that I didn't know, some of them did seem a little familiar, like maybe I'd met them before. I was looking at the profile picture for one of those suggestions, and it clicked: It was someone who worked in the same building as I do. Not the same company, or on the same floor, but it was someone I'd seen in the elevator multiple times.

I looked through the other suggestions again, and realized some lived in the same apartment building. Over the next couple of weeks, I seemed to get a lot of suggestions to be friends with people who lived or worked in areas that I frequently visited. There was a girl who worked at a coffeeshop near my office, and a guy I sometimes saw walking around my neighborhood.

I spent a while trying to figure out how it would have made the connection, and the only thing I could think of was location. There were no Facebook friends in common, and no other connection I could find. I hadn't put my work or home address into Facebook. I'm pretty sure it had to be going off the GPS, noticing that I spent a lot of time in the same location they had, and made a connection that way. I'm still convinced that must be the explanation.

What's a bit disturbing to me is that I don't use the Facebook app much, and like I said, I almost never post anything. It's possible that the couple of things that I've posted were posted at home and at work, and it made the link based on that, but I'm still left wondering when Facebook is gathering location information. Does it gather information whenever you look at Facebook, whether you post or not? Does it gather location information from your phone, even when the Facebook app isn't open?

Re:Geolocation

[tlhIngan]

Well, I don't use facebook much at all - maybe I login a total of once a month (on average - I usually go 6+ months without logging in at all - enough so Facebook sends me emails about how to get back online). I don't have any photos up other my profile photo, which is a scan of an actual photo that was taken ages ago. I didn't have an electronic copy of it.

I didn't install the facebook app on my phone (I don't use it often enough to justify it), neither my iPhone, nor my iPad, nor any of the Android phones I have (which are Nexus models and thus do not come preloaded with it).

And yet, earlier this year, it came up with a really uncanny recommendation - it actually found my flight instructor, someone who I lost contact with about a decade and a half ago when he went on to pursue an airline career (typical pilot career progression - you're a student, then you get your private, you work on your commercial license, then you become a flight instructor until you can get hired by a regional, etc).

Sure, he's active on Facebook, but not only am I not, we have absolutely nothing in common - no mutual friends, etc. Heck, I'm pretty sure I didn't even put the name of the flight school I went to in my facebook profile. And the scanned photo has no geolocation information so it was a scan.

Yet one day I get an email saying he was the top #1 pick of someone I might know.

The photo I have was of my solo - so it's just me, in front of a Cessna 172 (i.e., one of the most generic airplanes out there). I'm not really sure how Facebook put us together, but given the limited data set it can be fairly shocking.

Re:Geolocation

[h4ck7h3p14n37]

Does it gather information whenever you look at Facebook, whether you post or not? Does it gather location information from your phone, even when the Facebook app isn't open?

Do you really have to ask? Of course the app is cyber stalking you!

If you have to use Facebook from your phone I would recommend using the website. It's still tracking you, but it won't be able to access the data on your phone. You should also consider turning off GPS. Do you really want someone to be able to easily determine your daily routines?

I hate sounding like a Luddite since I got into computers when I was a little kid, but technology has turned the Internet and our electronic devices into a pervasive surveillance system. The only way to resist is to not participate.

Re:Geolocation

[Albanach]

Here's some stuff discussing Target's ability to identify customers who are expecting. This is, apparently, big business.

It's just meta-data -- what's the problem?

[sandbagger]

Orwell never thought that the noose that would go around peoples' necks would come from the private sector.

Re:You are being tracked ...

[JaredOfEuropa]

a) Might make an interesting case. We have a law that gives anyone the right to demand from companies all the personal information they have stored. That does not cover some other person simply giving my phone number to FB, but it seems to me that it should cover any cross correlated file they have on me, i.e. a shadow profile. That profile might not have my name attached to it yet, but phone or email ought to be sufficient to identify it. It'll be interesting to see if I can get FB to cough up my shadow profile.

Personally I agree with an earlier posted who said there ought to be a law forbidding companies from collecting data on people with whom they do not have a business relation. That might be overly broad as it covers a lot of perfectly valid use cases. They should perhaps be allowed to collect such data, but they are only allowed to store it in aggregated, anonymized form (and no: age + zip code is not anonymous anough), and correlating it with other data sets should be expressly prohibited.

There's plenty of people that care about this issue, but it's rather low down on their list compared to taxes, national security, the cost of health care, education, highways and public transportation, etc. And thus over here it always ends up being political pocket change, something to be traded away in return for other political concessions.

Re:Stop using Facebook and smartphones

[Rick Schumann]

There is no value to using Facebook. Why not use email to keep in touch with these people you apparently aren't all that close to? Why do you NEED Facebook? Rhetorical question, you do not need Facebook at all. Stop trading your privacy for mere convenience and leave Facebook behind. Oh and if you're actually using your real name on Facebook then I guess you're screwed -- I never did use my real name, and I deleted all the entries and the account 10 years ago, and nobody I know ever referred to me using my real name anyway, so then so much for your theory about Facebook knowing anything about me; it does not and never will.

Not necessarily...

[joh]

"We had only communicated through my work email, which is not connected to my Facebook, which convinced me Facebook was scanning my work email."

Well, but the other person may have had this work email in his address book that Facebook pilfers completely. When I still had a Facebook account it often suggested people from which I knew they had my email address I used for my Facebook account.

It's hopeless, you may stay as far away from FB as you want: If you interact in any way with people who ARE Facebook users FB will learn a lot of you. Just as with WhatsApp: You may not use it and not upload all your contacts to WhatsApp, but other WhatsApp users do this (WhatsApp uploads all contacts) and so WhatsApp knows who has your address in his contacts, so they know who's connected to you even if you don't interact with WhatsApp in any way yourself.

They all may not see you, but they see a you-shaped hole in the network.

Re:Stop using Facebook and smartphones

[jareth-0205]

Urgh. I know imagination is not a valued trait here but you could atleast try. Repeat after me: "other people have lives that work differently"

If you haven't been on the site for 10 years then it's difficult to take your assessment seriously. If it had no value then people wouldn't use it. You're right, nobody *needs* it. But that doesn't mean it doesn't have value.

And I don't know why you're being so superior, if you use email then who's to say that all that information hasn't been captured and processed by Google or whoever? I suppose you encrypt your emails and share keys too? No I didn't think so. If you do then you are in an extremely narrow group who is able to impose that palaver on your friends.

If enough of your friends have uploaded their phone contacts, or email address book, then they already have your name, and who you are in contact with. That without even going into what can be done with facial recognition on their photos of you. Again, to get out, it's not just up to you, you have to persuade everyone you know to quit also.

Shadow Profile

[XXongo]

If you read the article: https://gizmodo.com/how-facebo... Facebook is constructing a "shadow profile" of you, taken from other people sharing information.

Here are some of the cited links:
http://mashable.com/2013/06/26/facebook-shadow-profiles/
http://www.zdnet.com/article/anger-mounts-after-facebooks-shadow-profiles-leak-in-bug/
http://www.zdnet.com/article/firm-facebooks-shadow-profiles-are-frightening-dossiers-on-everyone/
https://splinternews.com/facebook-recommended-that-this-psychiatrists-patients-f-1793861472

Re:Shadow Profile

[Hylandr]

If you had a LinkedIn account you would understand that's a no-shit sherlock moment. LinkedIn *is more obvious* about what it does, in the same way.

It's no secret. It's not new. The Facebook crowd is *just now* understanding how the tech they been using works.

You must recall that Facebook pretty much sums up the least common denominator in the Internet society.

Why I don't use social media

[RightwingNutjob]

Adds no value and creates more work for me to have to manage my reputation.