Facebook privacy settings 'could mean users give away personal information'
Cambridge study says social networking site's public profiles could be used to access private details
Millions of Facebook users could be unwittingly giving away personal information because of the way in which the social networking website's privacy settings work, researchers said this week.
In a study presented to a conference in Nuremberg, a team from the University of Cambridge's computer laboratory showed how Facebook public profiles could be used to find out personal information despite appearing to contain only a few details.
The researchers used a computer programme to sift through tens of thousands of public profiles – visible to internet search engines such as Google – in order to build detailed maps of people's relationships.
In the paper, called Eight Friends Are Enough, the Cambridge team pointed out that it was possible to reconstruct somebody's friends list – which Facebook calls the "social graph" – in a way that could allow marketers, governments and even criminals to understand the private relationships between different people.
"People don't even think this graph data, these connections between people, is private information, but it's very useful for certain kinds of individual," Joseph Bonneau, the paper's lead author, told the Guardian.
"It's something the intelligence services realised some time ago – when they wiretap a phone, the most useful information is who calls who, not what's actually said."
Identity fraudsters and phishers – scammers who pose as one of their target's friends, encouraging them to click on a message that downloads a virus onto a computer – are among the prime candidates for abusing such information.
"If you have a person you're targeting, you can use the Facebook public listing to look at their friends, compromise them and then see your target's information," Bonneau said.
"It's a good way for marketers to get hold of your information: not your complete social graph, but enough to do what they want."
In the early days of Facebook, it remained closed off to non-members, reducing the chance that unsavoury elements could guess their information.
But as it has sought more users and financial success, the site – which now boasts almost 200 million members worldwide – has slowly introduced more public-facing aspects.
Since the middle of 2007, it has automatically made some parts of a user's profile publicly available.
The resulting pages are accessible to anybody on the internet and contain a user's name, eight of their friends and details about the products and organisations they use.
Although members can opt out of the scheme, their accounts are automatically made public by default.
As a result, the paper suggests, just a tiny percentage of users choose to remain private and protect themselves from the attacks it describes.
However, Bonneau said it was not in Facebook's business interests to change the way the system worked.
"If people weren't automatically opted in, then very few of them would choose to make themselves public – it's a useless feature for people who are already on the site," he said.
"They really want that feature because it encourages people who aren't members to sign up and, in the social networking world, growth is king."
Regardless of Facebook's policies, however, the idea of privacy on social networks could be entirely moot in some cases.
According to >recent reports, the British government is planning to force internet providers and websites to retain huge swathes of online information, including the data stored on social networking sites.
"What we want to monitor is that so-and-so is logged on to that site and spoke to so-and-so," a Home Office spokesman told the Guardian.
"It's the who, when and where, not the content."
Bobbie Johnson
Thursday 2 April 2009 10.53 BST
guardian.co.uk © Guardian News and Media Limited 2009
Cambridge study says social networking site's public profiles could be used to access private details
Millions of Facebook users could be unwittingly giving away personal information because of the way in which the social networking website's privacy settings work, researchers said this week.
In a study presented to a conference in Nuremberg, a team from the University of Cambridge's computer laboratory showed how Facebook public profiles could be used to find out personal information despite appearing to contain only a few details.
The researchers used a computer programme to sift through tens of thousands of public profiles – visible to internet search engines such as Google – in order to build detailed maps of people's relationships.
In the paper, called Eight Friends Are Enough, the Cambridge team pointed out that it was possible to reconstruct somebody's friends list – which Facebook calls the "social graph" – in a way that could allow marketers, governments and even criminals to understand the private relationships between different people.
"People don't even think this graph data, these connections between people, is private information, but it's very useful for certain kinds of individual," Joseph Bonneau, the paper's lead author, told the Guardian.
"It's something the intelligence services realised some time ago – when they wiretap a phone, the most useful information is who calls who, not what's actually said."
Identity fraudsters and phishers – scammers who pose as one of their target's friends, encouraging them to click on a message that downloads a virus onto a computer – are among the prime candidates for abusing such information.
"If you have a person you're targeting, you can use the Facebook public listing to look at their friends, compromise them and then see your target's information," Bonneau said.
"It's a good way for marketers to get hold of your information: not your complete social graph, but enough to do what they want."
In the early days of Facebook, it remained closed off to non-members, reducing the chance that unsavoury elements could guess their information.
But as it has sought more users and financial success, the site – which now boasts almost 200 million members worldwide – has slowly introduced more public-facing aspects.
Since the middle of 2007, it has automatically made some parts of a user's profile publicly available.
The resulting pages are accessible to anybody on the internet and contain a user's name, eight of their friends and details about the products and organisations they use.
Although members can opt out of the scheme, their accounts are automatically made public by default.
As a result, the paper suggests, just a tiny percentage of users choose to remain private and protect themselves from the attacks it describes.
However, Bonneau said it was not in Facebook's business interests to change the way the system worked.
"If people weren't automatically opted in, then very few of them would choose to make themselves public – it's a useless feature for people who are already on the site," he said.
"They really want that feature because it encourages people who aren't members to sign up and, in the social networking world, growth is king."
Regardless of Facebook's policies, however, the idea of privacy on social networks could be entirely moot in some cases.
According to >recent reports, the British government is planning to force internet providers and websites to retain huge swathes of online information, including the data stored on social networking sites.
"What we want to monitor is that so-and-so is logged on to that site and spoke to so-and-so," a Home Office spokesman told the Guardian.
"It's the who, when and where, not the content."
Bobbie Johnson
Thursday 2 April 2009 10.53 BST
guardian.co.uk © Guardian News and Media Limited 2009
