Facebook Security Issues - July 18th 2009

FACEBOOK HAS TO ADAPT OR DIE

Not so many years ago, my far flung family used to communicate with each other using general newsletters enclosed with the Christmas card and followed this up with the occasional phone call. Later, this changed to round robin e-mails and more recently, to Facebook. Even my 80 year old mother got a Facebook account, not because she thought it a particularly brilliant piece of technology, but because the rest of the family were using it and if she wanted to keep up with what was going on, that was where it was at.

We were all a little concerned to try and make sure basic security was observed, not because our family has any dark secrets, but because of what criminals can glean from even innocuous seeming personal information. Banks still rely on security questions such as "What is your mother's maiden name"? "What is your pet's name"? "What is your date of birth"? All this information is often all too easy to find on Facebook accounts, or to work out from the chit-chat. And what about the younger members of the family? They need to be protected from paedophiles and others that may wish them harm.

And what do Facebook do to ensure that their users are protected? Almost nothing! In fact, Facebook deliberately make it difficult to discover exactly what their security policies are, how information is stored and who has rights to it. Are you aware for example that when you upload a photograph, you give Facebook a licence to use it however they want? Did you know that when you delete your account, Facebook does not delete your information? Did you know that if you are tagged in a photograph, that tag remains even after you delete your account? It now transpires that at least some of these things are in conflict with Canadian privacy laws and Canada is acting against Facebook to ensure some changes are made. That's excellent news but it's only the tip of the iceberg.

The whole essence of Facebook is the sharing of information. It is relatively easy to find old friends who you have lost contact with because their real names and actual photographs are part of the publicly available information you can search through. If that were not the case, Facebook wouldn't be as useful as it is. In part, Facebook is successful because it's so easy to find friends. However, there's no reason why they should make so much of your information publicly available, or even available to friends of friends. It's the difficulty of controlling what happens to information on Facebook and of knowing who has access to the information that has significantly reduced my family's use of it. Those in the family who have not cancelled their accounts have tightened up every part of their personal security and would prefer to tighten it further than Facebook's current policies allow for.

So if Facebook is going to survive, it has to make changes, lots of them. Here's my list of what I think they need to do:

1. By default, make all information private. The only information that should be public is your name, approximate location (city, country) and profile photo. This still allows people to find you and you to find them but makes sure that no other information is shared.
2. Lists of "Friends" should be abandoned and replaced by private groups. Private groups could be families, like minded friends, workplaces or clubs. Users can belong to more than one private group. Outside users can be invited to join these private groups but their acceptance must be agreed by a majority (or some significant number) of the current members of that group. Only members in a private group can see personal information, photos, walls, applications, etc. explicitly posted for viewing by that group. Information can be published to more than one private group of which you are a member but that has to be an explicit action for each group, not a default. Group members can be expelled from a private group as and when necessary. By controlling your input to each private group, you can say things to your friends or to your family that are not appropriate for sharing with your workmates.
3. Public groups such as campaigns, city groups, etc. can still exist but members of those public groups can see no more of its members than their public profile as described in point 1. above. Information published to a public group must be explicitly published via that route and the user must be made made aware of the implications of doing so.
4. Ownership of information and full control over that information must reside with the copyright owner. Personal information taken from a private group and published to a public group or elsewhere then becomes a copyright infringement which can be actioned. Groups and individuals can backup their information using Facebook facilities, but Facebook will not make their own backups and will delete all information and backups immediately when a user deletes their account.

Only then can Facebook regain some of its lost credibility, conform to privacy and copyright requirements and be more acceptable to me and my family. If these changes are not made and made quickly by Facebook then perhaps I'll start up my own version of a social networking site that does do these things.

Comment by Annette on July 21st 2009

I think that is a wonderful idea. If only for the use of the family as we are like you point out all over the globe.