Untitled.docx
- 1. FACEBOOK PRIVACY: YOUR LIFE FOR SALE Facebook describes its corporate mission as giving people the power to build community and bring the world closer together. In 2017 and 2018 these lofty objectives took a serious blow when it became known that Facebook had lost control of the personal information users share on the site. Facebook had allowed its platform to be exploited by Russian intelligence and political consultants with the intention of intensifying existing political cleavages, driving people away from community and from one another during the US presidential election of 2016. In January 2018, a founder and former employee of a political consulting and voter profiling company called Cambridge Analytica revealed that his firm had harvested the personal information of as many as 87 million users of Facebook, and used this information in an effort to influence the US presidential election of 2016. Facebook does not sell the personal information of its users, but it did allow third-party apps to obtain the personal information of Facebook users. In this case, a UK researcher was granted access to 50,000 Facebook users for the purpose of research. He developed an app quiz that claimed to measure users' personality traits. Facebook's design allowed this app to not only collect the personal information of people who agreed to take the survey, but also the personal information of all the people in those users' Facebook social networks. The researcher sold the data to Cambridge Analytica, who in turn used it to send targeted political ads in the presidential election. In a Senate hearing in October 2017, Facebook testified that Russian operatives had exploited Facebook's social network in an effort to influence the 2016 presidential election. More than 130,000 fake messages and stories had been sent to Facebook users in the United States using an army of automated software bots, built and operated by several thousand Russian-based hackers working for a Russian intelligence agency, the Internet Research Agency. (A bot is a software program that performs an automated task, and is often on the Internet for malicious purposes—see Chapter 8.) Using 75,000 fake Facebook accounts, and 230,000 bots, the Russian messages were sent to an estimated 146 million people on Facebook. The messages targeted people based on their personal 174 information collected by Facebook in the normal course of business, including users' religion, race, ethnicity, personal interests, and political views. The ads targeted groups who had opposing political views, with the intention of intensifying social conflict among them. How could all this happen? As it turns out, it was quite easy and inexpensive, given the design and management of Facebook. Once Facebook grants access to advertisers, app developers, or researchers, it has a very limited capability to control how that information is used. Third-party agreements and policies are rarely reviewed by Facebook to check for compliance. Facebook executives claimed they were as shocked as others that 87 million Facebook users had their personal information harvested by Russian intelligence agencies and used by Cambridge Analytica to target political ads. It gets worse: In early June 2018, several months after Facebook was forced to explain its privacy measures and pledge reforms in the wake of the Cambridge Analytica scandal, the New York Times reported that Facebook had data-sharing partnerships with at least 60 device makers, as well as selected app developers. Facebook allowed Apple, Samsung, Amazon, and other companies that sell mobile phones, tablets, TVs, and video game consoles to gain access not only to data about Facebook users but also personal data about their friends—without their explicit
- 2. consent. All of these practices were in violation of a 2012 privacy settlement with the FTC (Federal Trade Commission) in which Facebook agreed to stop deceiving users about their ability to control their personal data, and to stop sharing data with third parties without informing users. Facebook did not in fact change its behavior and instead deceived its users by claiming it could control their privacy. Senior managers at Facebook, including founder and CEO Mark Zuckerberg, were apparently aware of this deception according to company emails. In 2019 Facebook's privacy issues finally resulted in a record-breaking $5 billion dollar fine by the FTC for obviously and intentionally violating the 2012 settlement. Facebook also agreed to new oversight by regulators in privacy matters, and to develop new practices and policies for handling personal information. While $5 billion is a large sum of money, for a company with $56 billion Chapter 4: Ethical and Social Issues in Information Systems in annual revenue, the fine may not be enough to change its actual behavior. The fine was, in the words of critics, barely a dent in Facebook's revenue. There are no specific restrictions on its mass surveillance of users, and the new privacy policies will be created by Facebook not the FTC. The settlement also provided immunity to Facebook executives and directors from any personal liability for the past violations of the 2012 settlement, and of users' privacy, and shielded the company from any claims of past violations. In other words, the past was wiped clean. Facebook has a diverse array of compelling and useful features. It has helped families find lost pets and allows active-duty soldiers to stay in touch with their families; and it gives smaller companies a chance to further their e-commerce efforts and larger companies a chance to solidify their brands. Pserhaps most obviously, Facebook makes it easier for you to keep in touch with your friends, relatives, local restaurants, and, in short, just about all the things you are interested in. These are the reasons so many people use Facebook—it provides real value to users. But at a cost. The cost of participating in the Facebook platform is that your personal information is shared with advertisers and with others you may not know. Facebook's checkered past of privacy violations and missteps raises doubts about whether it should be trusted with the personal data of billions of people. Unlike European nations, there are no laws in the United States that give consumers the right to know what data companies like Facebook have compiled. You can challenge information in credit reports because of the Fair Credit Reporting Act, but until recently, you could not obtain what data Facebook has gathered about you. Think you own your face? Not on Facebook, thanks to the firm's facial recognition software for photo tagging of users. This "tag suggestions" feature is automatically on when you sign up, and there is no user consent. A federal court in 2016 allowed a lawsuit to go forward contesting Facebook's right to photo tag without user consent. This feature is in violation of several state laws that seek to secure the privacy of biometric data. A Consumer Reports study found that among 150 million Americans on Facebook every day, at least 4.8 million were willingly sharing information that could be used against them in some way. That includes plans to travel on a particular day, which burglars could use to time robberies, or 175 Liking a page about a particular health condition or treatment, which might prompt insurers to deny coverage. Credit card companies and similar organizations have begun
- 3. engaging in weblining, taken from the term redlining, by altering their treatment of you based on the actions of other people with profiles similar to yours. Employers can assess your personality and behavior by using your Facebook Likes. Millions of Facebook users have never adjusted Facebook's privacy controls, which allow friends using Facebook applications to transfer your data unwittingly to a third party without your knowledge. Why, then, do so many people share sensitive details of their life on Facebook? Often, it's because users do not realize that their data are being collected and transmitted in this way. A Facebook user's friends are not notified if information about them is collected by that user's applications. Many of Facebook's features and services are enabled by default when they are launched without notifying users, and a study by Siegel+Gale found that Facebook's privacy policy is more difficult to cornprehend than government notices or typical bank credit card agreements, which are notoriously dense. Did you know that whenever you log into a website using Facebook, Facebook shares some personal information with that site and can track your movements on that site? Next time you visit Facebook, click Privacy Settings and see whether you can understand your options. There are some signs, however, that Facebook might become more responsible with its data collection processes, whether by its own volition or because it is forced to do so. As a publicly traded company, Facebook now invites more scrutiny from investors and regulators. In 2018, in response to a maelstrom of criticism in the United States, and Europe's new General Data Protection Regulation (GDPR), Facebook changed its privacy policy to make it easier for users to select their privacy preferences; to know exactly what they are consenting to; to download users' personal archives and the information that Facebook collects and shares, including facial images; to restrict click bait and spam in newsfeeds; to more closely monitor app developers' use of personal information; and to increase efforts to eliminate millions of fake accounts. Facebook hired 10,000 new employees and several hundred fact-checking firms to identify and eliminate fake news. For the first time in its history, Facebook is being forced to apply editorial controls to the content posted by users and, in that sense, become more like a traditional publisher 176 Part I: Information Systems in the Digital Age and news outlet that takes responsibility for its content. Unfortunately, as researchers have long known, and Facebook executives understand, very few users—estimated to be less than 12 percent—take the time to understand and adjust their privacy preferences. In reality, user choice is not a powerful check on Facebook's use of personal information. Although US Facebook users have little recourse to access data that Facebook has collected on them, users from other countries have done better. In Europe, over 100,000 Facebook users have already requested their data, and European law requires Facebook to respond to these requests within 40 days. Government privacy regulators from France, Spain, Italy, Germany, Belgium, and the Netherlands have been actively investigating Facebook's privacy controls as the European Union pursues more stringent privacy protection legislation. While Facebook has shut down several of its more egregious privacy-invading features, and enhanced its consent process, the company's data use policies make it very clear that, as a condition of using the service, users grant the company wide latitude in using their personal information in advertising. The default option for users is "opt-in"; most users do not know how to control use of their information; and they cannot "opt out" of all sharing if they want to use Facebook. This is called the "control paradox" by researchers: even
- 4. when users are given controls over the use of their personal information, they typically choose not to use those controls. Although users can limit some uses of their information, extensive knowledge of Facebook data features is required. Facebook shows you ads not only on Facebook but across the web through its Facebook Audience Network, which keeps track of what its users do on other websites and then targets ads to those users on those websites. Critics have asked Facebook why it doesn't offer an ad-free service—like music streaming sites—for a monthly fee. Others want to know why Facebook does not allow users just to opt out of tracking. But these kinds of changes would be very difficult for Facebook because its business model depends entirely on the largely unfettered use of its users' personal private information, just as it declares in its data use policy. That policy states openly that if you use Facebook you agree to their terms of service, which enable it to share your information with third parties of their choosing. As Apple CEO Tim Cook noted, at Facebook, the product they sell is you. Sources: Mike Isaac and Natasha Singer, "On Wednesday, the Federal Trade Commission Placed New Conditions on Facebook for Privacy Violations," New York Times, July 24, 2019; "A $5 Billion Fine for Facebook Won't Fix Privacy," New York Times, July 25, 2019; Devin Coldewey and Natasha Lomas, "Facebook Settles with FTC: $5 Billion and New Privacy Guarantees," Techcrunch, July 24, 2019; John D. McKinnon, Emily Glazer, Deepa Seetharaman, and Jeff Horwitz, "Facebook Worries Emails Could Show Zuckerberg Knew of Questionable Privacy Practices," New York Times, June 12, 2019; Federal Trade Commission, "In the Matter of Facebook, a Corporation," FTC, July 24, 2019; Deepa Seetharaman and Kirsten Grind, "Facebook Gave Some Companies Access to Additional Data About Users' Friends," Wall Street Journal, June 8, 2018; Cecilia Kang and Sheera Frenkel, "Facebook Says Cambridge Analytica Harvested Data of Up to 87 Million Users," New York Times, April 24, 2018; Eduardo Porter, "The Facebook Fallacy: Privacy Is Up to You," New York Times, April 24, 2018; David Mayer, "Facebook Is Giving You New Privacy Options, But It's Clear What It Wants You to Choose," Fortune, March 19, 2018; Matthew Rosenberg, Nicholas Confessore, and Carole Cadwalladr, "How Trump Consultants Exploited the Facebook Data of Millions," New York Times, March 17, 2018; Georgia Wells and Deepa Seetharaman, "New Facebook Data Shows Russians Targeted Users by Education, Religion, Politics," Wall Street Journal, November 1, 2017; Hunt Allcott and Matthew Gentzkow, "Social Media and Fake News in the 2016 Election," Journal of Economic Perspectives, March 2017.