Is Facebook founder Mark Zuckerberg Tone Deaf About Privacy?

5/23/10 Cartoon by Atlanta Journal Constitution's Pulitzer Prize winning Michael Luckovich, used by permission (blog including bio, email)

*

Remember the uproar when Facebook made your list of friends, pages you are a fan of, gender, geographic region and networks publicly available to everyone? Now, the social networking behemoth has silently enabled facial recognition software without your permission under the rather benign tag "Suggest photos of me to friends." Even if you choose to disable the option, Facebook still will have the technical ability to connect your name with your image.

Mark Zuckerberg might say his company is just evolving on privacy – witness his comments in this video interview that:

We view it as our role in the system to constantly be innovating and be updating what our system is to reflect what the current social norms are.

Contrast this with his former claims that privacy is "the vector around which Facebook operates".

Imagine if, in the name this vector, his company had labelled the new feature "facial recognition photo tags" and required users to opt in, rather than disable it after the fact. Methinks Zuckerberg would have had fewer takers.

But already, the deck is stacked against privacy. As media activist Cory Doctorow noted in a TED lecture, Facebook employs 

very powerful game-like mechanisms to reward to disclosure – it embodies BF's Skinner's famous thought experiment, the notion of the Skinner box … lavish[ing] you with attention from the people that you love … in service to a business model that cashes in the precious material of our social lives.

Is this new feature really designed to make the site more useful to users or to boost its commercial value as it nears an initial public stock offering?

As Joan Goodchild, senior editor of CSO (chief security officer) Online, noted to me:

Many privacy advocates feel Facebook needs to do a better job of educating folks about what the new feature is, what it does, and how to opt in or out. Many also feel a user should always be opted out of new features automatically, and should then have to opt in themselves. But it is often the other way around when Facebook rolls out these features.

My concerns go deeper: once data is available to third parties, however temporarily, the cat is out of the bag and beyond retrieval. And it's not just this constant meddling with our settings that's releasing our information – there are also security holes, not to mention scams and release of our data by third-party apps, which the Wall Street Journal found "were sending Facebook ID numbers to at least 25 advertising and data firms, several of which build profiles of internet users by tracking their online activities". More recently, Facebook was adding apps to our profiles that we hadn't requested and which we were unable to permanently disable.

And I'm also concerned about the front doors – also back doors--available for governments, including our own, which has been surveilling such security "risks" as the Quakers and calling Virginia opponents of mountaintop removal "terrorists" (pdf) (while excluding the Ku Klux Klan). There are already huge government-controlled facial databases: your photo on your driver's licence, government-issued identity card, travel visa and passport ends up in a government office. If the government wants to see a photo of your face, it often wouldn't need Facebook to get it. But Facebook's facial recognition feature certainly adds data points and a social graph. As Bruce Schneier, chief security technology officer of BT wrote me:

"Right now, Facebook has the largest collection of identified photos outside of governments. I don't think we know what the ramifications of that will be."

All this reminds me of Steven Spielberg's Minority Report: the 2002 film, based on a 1958 short story by Philip K Dick, featured law enforcement preventing "precrimes" and corporations bombarding passersby with holographic advertisements which crawled up the sides of walls, addressing them by name. 

Goodchild recently listed some of the hidden dangers of Facebook. And this is nothing new. As early as 2005 (the year after Facebook's rollout), MIT students were already detailing (pdf) what they saw as Facebook's threats to privacy:

"Users disclose too much, Facebook does not take adequate steps to protect user privacy, and third parties are actively seeking out end-user information using Facebook."

Facial recognition on Facebook arrived with no notice in the US, unless you kept up with the social network's blog last December. The feature came to general light last week, when Facebook extended the feature to other countries and European regulators started investigating.

In the US, Congressman Edward Markey (Democrat, Massachusetts), co-chairman of the bipartisan congressional privacy caucus, has complained:

"Requiring users to disable this feature after they've already been included by Facebook is no substitute for an opt-in process … If this new feature is as useful as Facebook claims, it should be able to stand on its own, without an automatic sign-up that changes users' privacy settings without their permission."

Marc Rotenberg, executive director of the Electronic Privacy Information Centre (Epic), spearheaded a complaint with the Federal Trade Commission on 10 June that Facebook's deployment of facial recognition software rises to the level of "unfair and deceptive trade practices". Joining Epic were the Centre for Digital Democracy, Consumer Watchdog and the Privacy Rights Clearinghouse, all of which asked (pdf) 

the commission to investigate Facebook, determine the extent of the harm to consumer privacy and safety, require Facebook to cease collection and use of users' biometric data without their affirmative opt-in consent, require Facebook to give users meaningful control over their personal information, establish appropriate security safeguards, limit the disclosure of user information to third parties, and seek appropriate injunctive and compensatory relief.

Facebook provides valuable ways to stay in touch with our friends and families, to network with our colleagues and customers and to coordinate activism. But is hypervisibility really in our best interest, and shouldn't we be the ones making the decisions about what to disclose? Markey submitted legislation in May outlawing the tracking of children online. He might need to add something for adults.

 *

UPDATE:  This piece was originally commissioned by the Guardian and appeared with minor changes as "What Facebook fails to recognise: Facebook has form for being cavalier with users' privacy, but its new facial recognition software has truly dangerous implications."  In response to its publication, FB issued this statement on the FTC complaint: 

We have heard the comments from some regulators about this product feature and we are providing them with additional information which we are confident will satisfy any concerns they will have."