Archiv der Kategorie Social Networks

Reasons for Privacy-by-Design Social Networks

This presentation held by Miles Rochford from Nokia at the last IA Summit in Miami/Florida has some excellent arguements for a privacy-by-design approach that should be adopted by social network providers. Ultimately, some very relevant arguements for the information architecture framework I am developing for privacy-enhanced social network applications.

Social Network Applications Among Most Popular Internet Sites

Getting actual usage numbers on social network applications isn’t easy. While most surveys and studies only represent the U.S. market, the actual numbers of social network profiles on the Internet can only be estimated by statistics reported by social network application providers such as Facebook, MySpace, Xing, and others.

An interesting insight can be gained, though, when periodically studying the Global Top 500 Internet sites reported by the web information company Alexa. The following pure social network sites are listed as of today amongst the 100 most popular online sites visited globally:

  • MySpace ( Rank 6 )
  • Facebook ( Rank 8 )
  • Orkut ( Rank 11 )
  • QQ ( Rank 17 )
  • Hi5 ( Rank 19 )
  • V Kontakte ( Rank 30 )
  • Friendster ( Rank 40 )
  • Skyrock ( Rank 41 )
  • Oduoklassniki ( Rank 44 )
  • Mixi ( Rank 62 )
  • PerfSpot ( Rank 76 )

Interesting to see that the Chinese social network “QQ” is now ranked 17th amongst the most popular Internet sites and is expected to outgrow Facebook and MySpace pretty soon. The Russian social network sites “Oduoklassniki” and “V Kontakte” have also made it amongst the Top 100.

I would be interested in seeing some numbers for the social network profiles existing on the Internet and possibly also the maturity, depth, and authenticity of those profiles. Maybe someone has some hints on information sources providing such information.

Why bother about our privacy on social networks?

It was an inspiring roundtable of speakers and some good discussions at the Interdisciplinary Centre for Law & Information Technology (ICRI) of the Katholieke Universiteit Leuven this past Thursday where I gave a guest lecture on my expert research. One arguement that I took away for my work and I have to mention here in my blog is the work of Franck Dumontier, researcher at the Centre de Recherches Informatique et Droit (CRID). Thinking of the questions that I always face when talking about the risks for our information privacy in social networks argueing that users give their personal information willingly and, therefore, we should not bother at all. Franck Dumontier brought it to the point: It is the risk of de-contextualization of our personal information we should be concerned about. Social network users want their information to be displayed openly and are willing to share it with a large group of people publicly. However, it is when this information is used out of context that the privacy issues start. Dumontier sees the risk of de-contextualization especially in online social networks because of the simplification of social relations on these sites, the large information dissemination implied by online social networks, and because of the network globalization and normalization effects of social network applications. Think of your own personal information being displayed in your social network profiles. When do you start getting worried? Maybe never but what if someone used this information in a completely different context and made judgements about yourself? Think about it. 

Rome Memorandum

The International Working Group on Data Protection in Telecommunications, the so-called Berlin Group, has released a report and guidance on privacy in social network services. After listing some of the major risks to the information privacy of social network users, the report draws up some preliminary guidance for privacy and data protection regulators, for social network application providers and also for users. The Rome Memorandum is available for free.

A Fairy Tale

This fairly tale is about a girl called Little Red Surfing Hood. The girl one day is surfing through the Internet and through some of her social network profiles. She actually plans to visit her grandmother later that day. All of a sudden, a message pops up on her screen from a user with the profile name “wolf”. He plans to discover as much about the girl and her grandmother as possible and pretends to be a very cute boy going to the same school as Little Red Surfing Hood. He asks all kinds of questions, sends her a link request and asks for a picture of her. She naïvely links him to her profile and also sends him a picture. Little Red Surfing Hood is really happy to have made a new friend. In the meantime, wolf assembles various credentials about Little Red Surfing Hood making use of details revealed on her profile, pictures, and personal details such as her address, Email, a mobile phone number and the route she always takes to go to her grandmother. With those credentials, he goes to the girl’s grandmother’s house, gains entry by pretending to be the girl. The rest of the fairy tale is known. The wolf eats the grandmother and later on the girl as well. There are different story endings how the girl and her grandmother were rescued by a hunter. But that is not the point of the story here. We don’t even know who the hunter was, how he found out about the wolf in the grandmother’s house and for what purpose he was into this.

Information privacy in social network applications means more than allowing certain people to see your profile. First, it means to have a way to really know the true identity of the person talking or connecting to you. Secondly, it means to have full transparency over what you and what others are doing. What happens if you upload a certain piece of data to your social network profile? Who can see which part of your profile data, who is connected to it and who uses your data for which purpose? This, of course, includes the service providers and any third parties (including the hunter). And finally, it means to determine for yourself, how your personal data is linked, exported, assembled and analyzed in which context and by whom.

Data Portability and Information Privacy


DataPortability - Connect, Control, Share, Remix from Smashcut Media on Vimeo.

An interesting and well-done video on the data portability project done by Michael Pick from Smashcut Media. The project spells out as one of its principles the protection of user rights and privacy. Yet, assigning access rights to certain pieces of personal data will only cover the data protection aspect of privacy but it will not cover the required accountability and self-control over personal data in various contexts. It should be interesting to see how the project work evolves in this respect. Certainly, more work is necessary on enhancing social network users’ privacy especially when their data increasingly gets transferred and exported to other applications.

Webb/Butterfield/Smith Model for Social Software

I am currently working on a paper for the PET Symposium trying to build a privacy threat model for social networking applications. The Webb/Butterfield/Smith Model for Social Software seems to be an appropriate way to visualize the main functional elements of social networking apps. Webb/Butterfield/Smith Model for Social SoftwareLet’s see how this model can be extended to information privacy and the personal data being collected and processed in social networking applications…

Lessons in Social

Recommended lessons to privacy-respecting design of social software by Kosmar.

Facebook invades privacy

When you buy a book or movie online–or make a political contribution–do you want that information automatically shared with the world on Facebook?

Most people would call that a huge invasion of privacy. But this week, Facebook began doing just that. People across the country saw private purchases they made on other sites displayed on their Facebook News Feeds.

Facebook encourages companies to get “word-of-mouth promotion for your business” to “millions” by using the feature that makes this happen. But left behind are the rights of Facebook users.

Let’s get Facebook to stop invading our privacy. Sign the petition at

http://civ.moveon.org/facebookprivacy/?r_by=-8696858-Ebg7DE&rc=confemail

Then join the Facebook group “Facebook, stop invading my privacy!” and tell your friends.

http://www.moveon.org/r?r=3181

Thanks!

Linking Digital Identities (German version)

The Independent Center for Data Protection of the State of Schleswig-Holstein (ULD, see: www.datenschutzzentrum.de) in cooperation with the Technical University of Dresden has just published a very interesting research report on “Linking Digital Identities”. The study was done for the German Federal Ministry of Education and Research in order to see and evaluate the possible effects of linking digital identities on society and an individual. For now, the report is only available in German (with an executive summary in English) but parts will be translated soon. The study analyzed the status quo of linkage in the context of public administration, business, and communities.