Last December on TechCrunch, Rohit Khare posted an article called “Privacy Theater: Why Social Networks Only Pretend To Protect You.” In it, he deconstructed the data breach at RockYou, in which thirty-two million user accounts were exposed via a SQL injection attack. What’s notable is not the breach itself—these happen all too often—but that apparently RockYou downplayed the incident. More troubling was the discovery that all of the passwords were stored in the clear. As a result, RockYou was sued for failing to protect its users’ personally identifiable information.
Innovation as an ExcuseIn his article, Khare argues that in certain cases it’s actually desirable to share data between social media sites but that many times this is not possible due to privacy restrictions. The implication, of course, is that privacy demands that user data be highly protected. In reality though, according to Khare, this is only theater. Social media sites are not actually doing enough to safeguard your private information, mostly due to sloppy programming and bad architecture.
In reading the article, it occurred to me that many social media sites were started by very smart individuals who had a great idea. Eventually they attracted VC money and were ultimately launched as a business. As a former developer, I realize that in this world it is imperative that you build your product as quickly as possible so you can demonstrate the viability of your idea. But in doing so, are the traditional policies and governance ever put into place once you RTM? I mean, honestly, who does not know that you never store passwords in the clear?
While we’re on the subject of security, it’s well known that it is vastly more expensive (and less reliable) to “tack on” security once your application is built. Yet this is precisely what many developers do.
Security Is Not a Bad ThingA lifetime ago, I delivered training on threat modeling. The idea is to get in a room with your developers before a line of code is written and go through the entire application architecture, thinking of ways that security can be compromised. Once you’ve identified a threat, you redesign the offending module to mitigate the threat. Only when this process is complete do you begin coding. It’s not foolproof but it certainly can reduce the attack surface.
Poor architecture is not the only reason privacy is more myth than reality. In a well-publicized blog post, Mark Zuckerberg tried to explain why Facebook was changing its privacy settings—again. At first reading, it sounded like these changes were for the best and would be of benefit to all users. But as people drilled into the details, many realized that in fact these changes meant less privacy as your personal information is now more open to sharing without your knowledge or permission.
The main reason for the change? Supposedly to better accommodate Facebook’s lucrative partnerships with search engines like Google and Bing (see “Facebook’s New Privacy Push Concerns Experts”). In order to prevent unintended consequences, every user should go through each privacy setting to ensure that they are clear on how their data is being shared—something Zuckerberg recommends, to his credit. It’s my guess that most users will not take the time.
What Do Users Really Want?In the case of Facebook, does it matter that my list of friends, photos and posts about me can be shared with the world without my explicit permission? Well, it all depends on how much I value my privacy—or whether there is embarrassing information that I would rather not be available to search engines. A more insidious problem is the many Facebook apps that can potentially share (read “abuse”) this information beyond what I intended when I originally allowed the app to access my data.
Where does it all end? My sense is, the market will take care of itself—but only if people insist on their data being protected according to some universally agreed-upon set of standards (and, trust me, there are plenty of standards out there). To my knowledge there has not yet been a huge outcry against social media sites that are cavalier about protecting information. When that happens, practices will change.
What do you think? Do issues with privacy make you more reluctant to incorporate social media into your enterprise? Conversely, for marketing purposes, would you like access to the vast pool of rich user data that is now available courtesy of social media?
The opinions and views expressed in this blog are those of the author and do not necessarily state or reflect those of Microsoft.
Another excellent post Steven. You actually cover several different issues that fall into the broader category of security. Any one of them is worth a deeper dive.
I'm putting a lot of thought into privacy these days; asking tough questions. We need to be sure that we aren't making assumptions and then applying them wholesale. I think there is remarkable nuance to the subject.
For example: personal information is a currency. That is, you give some of it up to get something in return. If that return is worth it, then we'll happily do it. I believe that's the contract we have, for example, with Facebook and Google. We give them lots of our data and they give us stuff in return. Could that be considered bad? Remember, it's a conscious choice; nobody forced anyone to use Facebook or Google.
You could argue that a more personalized online experience is a preferred one. For that, you have to give marketeers something to work with. Most of us are prepared for some trade-off for that benefit.
Another example: Depends on what information is being shared. Most of the info that we give away is benign. I don't really care if a web site knows that I visited it more than once. But if I give my credit card number, that is data that is fundamentally more important to me. Bottom line: we can't treat all information the same way. Privacy must be defined in the context of data shared.
I think we overstate the privacy issue as if it is a new challenge. We've been giving away our information for a long time. For our society to function, it's necessary.
That's all I have for now. I will likely blog on the subject soon myself as it is really important and absolutely fascinating.
All the best.
Jonathan, thanks for the comments. I have been reading a lot lately about PII being social currency, and it’s an asset that most of us aren’t aware we can trade. As consumers become more educated, though, this will change and there will have to be some kind of acceptable model that works for everyone.
Simply put, you need to give something in order to get something. As you pointed out, though, this is not new. Maybe we just need to be reminded from time to time.