Facebook Privacy - Friends Using Applications Like Mafia Wars Can Allow Access To Your Information

"Watch out for Facebook applications - the thousands of programs and services made available through the site. If you play a Facebook game like the popular Mafia Wars, you’re providing a lot of basic personal data to Zynga Game Network Inc., which runs the game. In addition, if a friend uses an application, he shares information about all his friends, including you. Click on “Applications and Websites’’ to block friends from passing data to strangers."
- Boston Globe - Privacy still a nagging concern on Facebook

I have always been deeply suspicious about games and applications on Facebook. It didn't make a lot of sense to me to click "allow" when it comes to "answer 20 questions about your friend". Why does answer 20 questions need access to my pictures or my videos? Why do the applications need access to my personal information - unless they are going to use it somehow. Even though I click on NO to most everything for external applications, my friends don't. And I'm friends with my young teen daughter and some of her friends. They click on every application you can think of. Until the new privacy settings came along a month or two ago my information was fully exposed to all their fun...

I didn't ever think of Facebook as private. As a computer and internet guy for 27 years, personally, I would trust half the porn sites out there to keep my information private before I would trust Facebook or any of the applications running on it.

So I have always treated anything I put on Facebook as essentially an open book. That someone I don't know and/or don't really want looking at my shit will be looking at it or have access to it. That anything I put on Facebook will eventually become public. And that any privacy settings I define are only about as useful as a low picket fence around my yard is to keep out intruders.

The bottom line? Anything you put on Facebook is not private. Don't put anything you would want to keep private on Facebook. Assume anything on Facebook is open to the entire world. Period. Full stop.

Oh, and another thing, the article I have linked to above says:

"Of course, many of my “friends’’ are indeed strangers, techies, and business folk I barely know. I’m probably telling them too much about myself. Too late, I’ve discovered a solution - Facebook’s “limited profile’’ feature. This lets you create a special category of friends who get much less access to your information. You set it up on the main Friends page, then go to Privacy to pick out which bits of data to conceal."

I just spent 20 minutes looking through all my privacy settings for the limited profile settings and couldn't find it. I will be emailing the author to get directions - if you find it - let me know please.

CBC Quotation Police - And Some Thoughts Of The Supreme Court of Canada On Copyright

I am including in this post a number of excerpts from a Supreme Court of Canada ruling that I think are relevant: CCH Canadian Ltd. v. Law Society of Upper Canada, [2004] 1 S.C.R. 339, 2004 SCC 13. I AM NOT A LAWYER.

This ruling discusses the fact that "...the fair dealing exception is perhaps more properly understood as an integral part of the Copyright Act than simply a defence. Any act falling within the fair dealing exception will not be an infringement of copyright."

Thank-you to folks who pointed the CBC quotation police story out. I have removed the only CBC quotes from my blog. This is a sad day for the CBC and for Canada. Someone over at the CBC obviously doesn't understand how the web works, or how traffic gets pointed to major sites through aggregators and secondary sources. The CBC needs to understand shopping mall economics and needs to embrace it's role as the information anchor tenant of Canadian news - that the boutique operations (like our blogs) can cluster around.

"48 Before reviewing the scope of the fair dealing exception under the Copyright Act, it is important to clarify some general considerations about exceptions to copyright infringement. Procedurally, a defendant is required to prove that his or her dealing with a work has been fair; however, the fair dealing exception is perhaps more properly understood as an integral part of the Copyright Act than simply a defence. Any act falling within the fair dealing exception will not be an infringement of copyright. The fair dealing exception, like other exceptions in the Copyright Act, is a user’s right. In order to maintain the proper balance between the rights of a copyright owner and users’ interests, it must not be interpreted restrictively. As Professor Vaver, supra, has explained, at p. 171: “User rights are not just loopholes. Both owner rights and user rights should therefore be given the fair and balanced reading that befits remedial legislation.”"

"56 Both the amount of the dealing and importance of the work allegedly infringed should be considered in assessing fairness. If the amount taken from a work is trivial, the fair dealing analysis need not be undertaken at all because the court will have concluded that there was no copyright infringement. As the passage from Hubbard indicates, the quantity of the work taken will not be determinative of fairness, but it can help in the determination. It may be possible to deal fairly with a whole work. As Vaver points out, there might be no other way to criticize or review certain types of works such as photographs: see Vaver, supra, at p. 191. The amount taken may also be more or less fair depending on the purpose. For example, for the purpose of research or private study, it may be essential to copy an entire academic article or an entire judicial decision. However, if a work of literature is copied for the purpose of criticism, it will not likely be fair to include a full copy of the work in the critique."

"70 The availability of a licence is not relevant to deciding whether a dealing has been fair. As discussed, fair dealing is an integral part of the scheme of copyright law in Canada. Any act falling within the fair dealing exception will not infringe copyright. If a copyright owner were allowed to license people to use its work and then point to a person’s decision not to obtain a licence as proof that his or her dealings were not fair, this would extend the scope of the owner’s monopoly over the use of his or her work in a manner that would not be consistent with the Copyright Act’s balance between owner’s rights and user’s interests."

Supreme Court of Canada

http://www.canlii.org/en/ca/scc/doc/2004/2004scc13/2004scc13.html

This post copyright frozen... used to be: "Report: Grade School Age Kids Actively Subvert Privacy Protection"

This post used to have a link to a story from CBC about how kids actively subvert privacy protection on Club Penguin and other kid-oriented websites.

This post used to have quotes from the CBC story showing how kids got around the rules of the kids sites - even to the point of using rhyming words like mine for nine in order to ask age questions - because the sites software would filter numbers in chat sessions.

This post used to encourage you to go to CBC and read their quality content.

Except now, the CBC has hired an American firm to hunt down people who quote the CBC. As I learned from the blog "Buckdog", I could get fined or sued for quoting the CBC:

"The Canadian Broadcasting Corporation has signed up with iCopyright, the American copyright bounty hunters used by the Associated Press, to offer ridiculous licenses for the quotation of CBC articles on the web (these are the same jokers who sell you a "license" to quote 5 words from the AP)" - BoingBoing

Buckdog also provided a link to a facebook page: Canadians against CBC's iCopyright DRM

So I will be pulling all CBC derived content from this blog, and not using or linking to any CBC content until this is all settled.

----

[the editorial from the original post]

EDITORIAL COMMENT: I'VE NEVER TRUSTED NETWORK BLOCKERS OF ANY VARIETY

Remember - these are nine, ten, eleven, twelve year old kids...

I have never trusted network blockers or filters. I have always tried to be around my kids when they are online and to encourage an open dialogue on what they encounter. I have been shocked at some of the material they have seen and shared with me that they have seen, because they are still my kids, but there is little choice - their ability to get around network blocks that I might throw into place is fairly good. I have taught them about computers and the internet since a very young age. I know that they can crack or get around most anything I put up if they really want. I would literally have to padlock/steel enclosure our household network access to even be able to try to limit their access. Except they would use any of a number of encrypted proxy tunneling services to get around even that...

So the better path, in my opinion, and my case, is to try to discuss what they have seen and to help them interpret it and guide them through the ugly rather than block it.

I should also note that many of their friends have unblocked networks because of lack of skill and will on the part of their friends' parents - so my kids would have access elsewhere anyway (just like when I was a kid my parents wouldn't let us play with toy guns - so we did it at our friends' places).

For better or for worse...

Confusion Over Facebook Changes To Defaults Exposes More Information Than Before

"Back in December, Facebook changed the default settings for all 350 million users to 'encourage' them to share more content publicly. The reality of the situation was that many people were confused by the new settings and that a lot more content is now public than before.

Earlier this month, Facebook's Mark Zuckerberg said that the age of privacy is over, and that we should all get used to it."

Computer Weekly - Privacy is not dead

"False Terrorism Emergencies": FBI Violated US Electronic Communications Privacy Act

"The Federal Bureau of Investigation (FBI) has violated US laws by collecting over 2,000 telephone records under the Bush administration.

The Washington Post said Tuesday it obtained emails that showed the 'spy agency' created false terrorism emergencies between 2002 and 2006 in order to collect information concerning its citizens.

According to the report, the FBI admitted that it had violated the Electronic Communications Privacy Act by doing so."

Press TV - Report: FBI violated phone conversation privacy

Microsoft Does As Little As It Possibly Can To Meet Privacy Demands

"Microsoft will eliminate all data collected on Bing users after six months. The software giant said it sent a letter to the Article 29 Data Protection Working Party, a collection of the EU's top minds on data protection and privacy issues, today notifying it that the company would reduce the amount of time it stores IP addresses from searchers from 18 months to six months before deleting them.

Currently, Bing takes search data and separates the user's account information (such as e-mail or phone number) from the non-personal information (such as what the query was) and only after 18 months does Microsoft take the additional step of deleting the IP address and any other cross session IDs associated with the query. The only difference with the new policy is that the IP address will be removed completely at six months to provide greater user privacy protection; the rest of the process will remain the same, since Microsoft says it needs the data to make search better for consumers."

Ars Technica - Microsoft to delete Bing users' IP addresses after 6 months

Privacy Struggle Reflected in Microsoft BING Data Retention Policy Change

"Microsoft responded to privacy concerns of the Article 29 committee, an organization made up of data protection officers from the countries of the European Union, by announcing that it will change its Bing search data retention policies and purge IP address data after six months."

"If search providers like Microsoft and Google could operate in a privacy vacuum, they would retain as much data as the storage capacity of their data centers could hold. Historical data of search habits and patterns is like gold to a search provider"

"The more search providers can retain and analyze search result information, the more they can tweak the algorithms used to deliver search results.

If the provider can determine your interests and inclinations based on your Web surfing habits, and you past searches, and which results you have actually clicked on, it can use that information to present you with search results that are uniquely suited for you. When it comes to online advertising, it would make sense to only bombard you with banner, display, and pop-up ads that are at least related to products or topics you are interested in."

"Perhaps a prominent businessman is considering pursuing political office. Maybe a famous entertainer has a drug problem. Bringing it down to mere mortals, maybe a wife is cheating on her husband and considering divorce, or a spouse frequents fetish porn sites.

Any one of those scenarios involves an expectation of privacy. The individuals would not want future search results--which may be done with others present--to reflect the Web surfing and online searches conducted previously in private."

PCWorld - Bing Data Retention Shift a Sign of Privacy Struggle

Body Scanners Risk To Privacy, May Possibly Produce Illegal Images

"The UK's equality watchdog has written to the home secretary expressing concerns about plans to use body scanners at airports.

The Equality and Human Rights Commission (EHRC) said the devices risked breaching an individual's right to privacy under the Human Rights Act."

"The British prime minister has pledged to introduce full body scanners at British airports, and they are due to be in operation at Heathrow Airport by the end of this month.

They produce "naked" images of passengers, and civil rights groups warn they could generate illegal images of children and images of celebrities that could be leaked online."

"Dylan Sharpe, campaign director of Big Brother Watch, said the government had not considered privacy in its "desperation to be seen to be doing something"."

BBC - Body scanners risk right to privacy, says UK watchdog

US Supreme Court Looks At Employee Privacy Rights

"An Ontario, Calif., police officer sued the city for violating his privacy rights when it went through personal messages sent from his department-issued pager. The Supreme Court is taking up the case."

"The US Supreme Court has agreed to take up a case examining to what extent employees have an expectation of privacy in personal communications conducted on employer-issued communications equipment.

Workplace privacy is becoming an increasingly thorny issue with a broadening array of office technology used to aid efficiency and job performance but that can also provide a paper trail of intimate and potentially embarrassing details of a worker’s personal life.

That’s what happened to Police Sgt. Jeff Quon.

As a member of the Ontario, Calif., Police Department’s SWAT team he was issued a digital pager.

The city maintains a policy for computer, Internet, and e-mail use that barred personal use. It says employees should have no expectation of privacy or confidentiality.

When the city purchased pagers in April 2002, it announced that they, too, would be covered by the city’s e-mail policy. But this instruction was not expressed as a formal amendment to the written policy.

Instead, day-to-day practice evolved into an informal policy on the use of pagers. The contract with the city’s service provider allowed 25,000 characters of use each month. If an officer went over that limit, a department official would contact the officer and obtain payment for any overage.

This informal policy suggests that the city understood and accepted the fact that many department members were using their official pagers to send and receive personal messages.

Then in August 2002, the police chief, without notice, ordered an audit of pager use. The city contacted the pager service and requested transcripts of communications from pagers that had exceed the 25,000 character limit. Sergeant Quon’s was among them."

Christian Science Monitor - Supreme Court to look at employees' privacy rights

Facebook Pushing Users To Stop Being So Private

"Facebook is pushing users to stop being so private with their information, and from the looks of it, founder Mark Zuckerberg is leading the charge by sharing photos of himself at parties and with his girlfriend.

Facebook execs have in the past largely kept their profiles locked down, even as 80 percent of Facebook users stick with the default privacy settings that have long made all pictures public. But now Facebook wants to push users into a brave new Twitter-like world with changes to its privacy settings rolling out this week. The more public profiles are intended to help Facebook outstrip Google as the net’s top information source and, of course, bring in more ad revenue.

In a bit of very interesting timing, Zuckerberg’s photos have been made public to the entire internet, mostly through a post from gossip blog Gawker, after Kashmir Hill at True/Slant discovered and reported that Zuckerberg was sharing photos with a wide circle — friends of friends — and his event calendar with everyone."

Wired - Facebook’s Zuckerberg Becomes Poster Child for New Privacy Settings

UK: 7 In 10 Parents Want Compulsory Online Privacy Lessons

"Parents would like the government to introduce lessons to improve young people’s understanding of online privacy and the value of their personal reputation, with 69 per cent of parents calling for compulsory lessons to be introduced as part of compulsory school lessons, according the Digital Literacy Report 2009.

There is a growing concern among parents about their children’s online activities , according to the YouGov poll of 2,050 adults.

Almost half (48 per cent) said they were worried that their children’s online actions of social networking sites like Facebook , Bebo and YouTube will “destroy their future chances of getting into a chosen university or getting their first job” and more should be done by the government and schools to help young people safeguard their future prospects."

Telegraph - Seven in 10 parents demand compulsory online privacy lessons

----

EDITORIAL COMMENT: LAZY DIPSHIT PARENTS SHOULD LEARN HOW TO USE A COMPUTER AND TEACH THEIR KIDS THEMSELVES

As above.

I've taught an awful lot of adult computer education courses and one the things that strikes me the most is how lazy adults are about learning how to use the 2 most profoundly affecting tools of our time: computers and the internet.

- J. Burton

Swiss Data Protection Authority Sues Google

"Swiss officials said Friday that they had sued Google to try to require it to tighten privacy safeguards on its Street View online service. It is the latest of a series of European objections to the company’s handling of personal information.

The Swiss data protection authority said it had filed a complaint with the Federal Administrative Court after Google balked at its demand for additional measures to make obscure the images of people who appear in Street View, particularly in areas around hospitals, schools and prisons.

Street View provides ground-level panoramas of streets across the United States, Europe and other regions, searchable via Google’s mapping service. Google compiles the scenes with camera-equipped cars."

"Google said it had met with the data protection commissioner, Hanspeter Thür, before the introduction of the Swiss version of Street View and received “the green light to launch the product” in August. After the authorities raised objections, Google said it had offered other protective measures, but said the commissioner rejected them as inadequate."

New York Times - Swiss Say Google’s Street View Is Too Revealing

Unified Google Control Panel Said To Increase Privacy Control

"In conjunction with the 31st International Conference of Data Protection and Privacy Commissioners, which occurred this week in Madrid, Spain, both Google and Microsoft took steps to express their respective commitment to privacy.

Microsoft's announcement took the form of a policy paper that said the company's established privacy principles would apply to cloud computing and called for regulatory harmony around the globe.

Google introduced Google Dashboard, a Web page that provides a summary of the information Google users have stored online and a set of links for modifying data storage settings.

"In an effort to provide you with greater transparency and control over [your] own data, we've built the Google Dashboard," a Google blog post explains. "Designed to be simple and useful, the Dashboard summarizes data for each product that you use (when signed in to your account) and provides you direct links to control your personal settings."

The Dashboard provides data details for over 20 Google services, including Gmail, Calendar, Docs, Web History, Orkut, YouTube, Picasa, Talk, Reader, Alerts, Latitude, Profiles, and Voice, among others. "

Information Week - Google Dashboard Enhances Privacy Control

Google Latitude Location-Sharing Service: Gift To Stalkers?

"Google's new Latitude location-sharing service "could be a gift to stalkers, prying employers, jealous partners, and obsessive friends," Privacy International warned Thursday.

Google introduced Latitude on Wednesday. It's a new Google Maps feature that lets users share location data with friends, using either a mobile phone or Google Gears-equipped computer."

"To dispel anticipated privacy concerns, Vic Gundotra, VP of engineering on Google's mobile team, tried to reassure potential Latitude users that Google designed the service so that users are in control. "Fun aside, we recognize the sensitivity of location data, so we've built fine-grained privacy controls right into the application," he said. "Everything about Latitude is opt-in. You not only control exactly who gets to see your location, but you also decide the location that they see."

Nonetheless, Privacy International said it had identified "a major security flaw in Google's global phone tracking system.""

"Privacy International concedes that Google had made some effort to address privacy concerns. But it considers these safeguards useless "if Latitude could be enabled by a second party without a user's knowledge or consent."

As the organization puts it, the "danger arises when a second party can gain physical access to a user's phone and enable Latitude without the owner's knowledge.""

Information Week - Google Latitude Spurs Privacy Backlash

US Homeland Security Privacy Office Seen To Be Enabling, Not Curbing Privacy Violations

"Privacy advocates have asked lawmakers to investigate the Department of Homeland Security office in charge of protecting Americans' privacy, saying it has shown "an extraordinary disregard" for its duty.

In a letter sent Friday to the House Homeland Security Committee, 21 organizations and seven people belonging to the Privacy Coalition say the department's chief privacy officer has seen its role as enabling, rather than curbing, government surveillance and intelligence programs.

"The job of Chief Privacy Officer is not to provide public relations for the Department of Homeland Security," stated the coalition letter, whose signers included the American Civil Liberties Union, Gun Owners of America, former congressman Robert L. Barr Jr. (R-Ga.) and libertarians inspired by Rep. Ron Paul (R-Tex.), a former presidential candidate. The Electronic Privacy Information Center, a public interest group in Washington, organized the coalition. "

Washington Post - Probe of Homeland Security privacy office sought. Group says chief is enabling, not curbing, surveillance

"Privacy and the Patriot Act"

"In the aftermath of 9/11, legislators cut legal corners to protect the nation. Congress should amend that now by revising certain expiring provisions of the law.
October 25, 2009

Along with the Guantanamo Bay detention facility and the Bush administration's illegal eavesdropping on U.S. citizens, the USA Patriot Act came to symbolize the excesses of the post-9/11 war on terrorism. Now, as it weighs the extension of three expiring provisions, the Democratic-controlled Congress has an opportunity to restore key privacy protections that were forgotten in the aftermath of the attacks."

"The Patriot Act's greatest threat to personal privacy lies not in any of the provisions set to expire but in the law's expansion of the use of national security letters, subpoenas that allow the FBI to obtain records without a warrant. In 2008, the FBI issued 24,744 letters involving the records of 7,225 people. Not surprisingly, there have been abuses. In 2007, after an investigation of four FBI offices, the Justice Department's inspector general found irregularities in 22% of documents related to the issuance of national security letters."

"The other problem with national security letters is that the companies or other institutions that receive them are not allowed to reveal that fact publicly, though they can appeal them in a closed hearing in federal District Court."

LA Times Editorial - Privacy and the Patriot Act

Healthcare IT Complaint: Senior Management Does Not View Privacy And Data Security As A Priority

"Healthcare providers aren't adequately protecting patient privacy in implementing e-health records, according to a recent survey of healthcare IT managers. Some 80% of healthcare organizations have experienced at least one incident of lost or stolen health information in the past year.

The study from security management company LogLogic and the Ponemon Institute, which conducts privacy and information management research, found that patient privacy is at risk in the nationwide push to implement e-health records.

"The majority of IT practitioners in our study don't believe that their organizations have adequate resources to protect patients' sensitive or confidential information," said Dr. Larry Ponemon, chairman and founder of The Ponemon Institute, in a statement about this month's study, released Tuesday. "The lack of resources and support from senior management is putting electronic health information at risk."

Some 70% of IT managers surveyed said that senior management does not view privacy and data security as a priority. [my bold]"

Information Week - E-Health Records Put Patient Privacy At Risk

----

EDITORIAL COMMENT: SENIOR MANAGERS, LIKE MANY PARENTS, ARE TOO LAZY OR FRIGHTENED TO INFORM THEMSELVES OF THE DATA AND TECHNOLOGY ISSUES THEY ARE FACED WITH

In my experience IT personnel pull the rabbit out of the hat one too many times for senior managers that just don't give a shit about things like data security.

IT people often give that extra bit of effort for managers that chronically under resource data safety, fixing problems that should have never happened in the first place. Managers who make decisions on IT based on the colour of the computers and whether or not it matches their decor. Managers who think that having the biggest monitor is a sign of their technological prowess.

Data security is unsexy. I can only hope a few criminal charges and lawsuits from now managers will start to get with the program.

- J. Burton

Does The Lack Of Privacy Rule Out Public Office For Many?

"Our belief that senior politicians have forgone their right to privacy makes leadership impossible in a modern democracy"

"That’s the life of the modern democratic leader for you, as illustrated by two statesmen in the space of a fortnight. You start off your career by being given the Nobel Peace Prize, and you finish up being quizzed about whether or not you pop pills."

"Gordon Brown came to it on The Andrew Marr Show, to my suprise. Although I knew there was loose-ish optimistic talk about his eyesight being used as a pretext for resignation, I had somehow not registered the flood of rumours about the Prime Minister’s supposed pill dependency. In Marr’s words: “Let me ask you about something else which everybody has been talking about out there in the Westminster village, which is a lot of people in this country use prescription painkillers and pills to help them get through. Are you one of those people?” No, said Mr Brown.

The journalistic world divided over Marr’s question. Some said he shouldn’t have asked it, some said it was a valid line of inquiry. Had not David Owen recently written a book in which he argued (and remember that Dr Owen is a proper stethoscope Dr and not a John Reid read-my-thesis kind of Dr) that we have had bad decisions as a result of undiagnosed or undisclosed illnesses on the part of leading politicians going back a ways?"

"An unsubstantiated allegation, but so what? It’s a reasonable thing to ask you, Mr Brown, to which you may answer yes or no, because the public have an interest in knowing. As they do in such questions as: do you drink? Did you have your son immunised? How much does your wife earn? Do you get depressed? Is there a history of depression in your family? Did your spouse rent an adult movie and claim it back on expenses, unwittingly or not? What movie was it? Was it arousing? Do the children know about it? (Well, they do now.) And because it’s you, none of the privacy protection people turn a hair. You are fair game. You don’t have privacy. Your lack of it is the price you pay for power, the equivalent of, in Patrick Marber’s words, the “fame tax” that celebrities pay." [my bold]

Times Online - The price of the ‘power tax’ is far too high

Dark Side Of Social Networking And Intelligent Usage Tracking

"There is a dark side to some of the impressive new online technologies that are appearing, from social networking to behavioural advertising to RFID 'smart chips', the European Commission's internet chief has warned.

While such technologies offer great vistas of opportunity, the commission is monitoring their development "closely" for the very real potential threats to privacy they contain, information society commissioner Viviane Reding said on Monday at a debate on the future of the internet in Brussels."

"...she worries about all users of social networking, not just children, and fears that most users of such sites are unaware of the dangers to their privacy.

"Social networking has a strong potential for a new form of communication and for bringing people together, wherever they are," she said. "But is every social networker really aware that all pictures and information uploaded on social networking profiles can be accessed and used by anyone on the web?""

"The EU's internet chief also said that behavioural advertising – those ads that appear that seem to know exactly the sort of books or vacations or concerts you would be interested in – was "another privacy concern repeatedly mentioned to the European Commission these days."

Behavioural adverts are able to do this by keeping track of internet users' web browsing to better target them with advertisements."

Business Week - Future Internet Privacy Worries Europe

Facebook Changes Privacy Policy

"Facebook has agreed to make worldwide changes to its privacy policy as a result of negotiations with Canada's privacy commissioner.

Last month the social network was found to breach Canadian law by holding on to users' personal data indefinitely.

Facebook has now agreed to make changes to the way it handles this information and be more transparent about what data it collects and why.

It will also make it clear that users can deactivate or delete their account."

BBC - Facebook changes privacy policy