Privacy and Online Social Networking Websites Richard Goettke Joseph Christiana Computer Science 199r Special Topics in Computer Science Computation and Society Privacy and Technology Professors Prof Michael D Smith Dr Jim Waldo Dr Alon Rosen Allan Friedman May 14 2007 I Introduction Social networking sites while not an entirely novel phenomenon have become increasingly more popular in recent years Networking sites such as myspace com and Facebook com have become a significant part of adolescent American culture Facebook com alone is accessed by over 23 millions users 1 There is a tension between the lucrative business side of social networking sites where huge monetary gains can be made through online advertising and the companies resolve to ensure a basic level of privacy for its users From this tension users receive privacy setting recommendations from social networking sites whose default settings are rarely altered or even questioned The privacy problems that ensue stem from the fact that individuals are unaware of the amount of personally identifiable information they have provided to an indeterminate number of people The purpose of this paper is to explore the threats to privacy that arise when users lack a sense of privacy awareness and concern when accessing social networking sites We explore past literature and previous empirical studies of privacy implications for online social networking We will also draw conclusions from our own study to determine how much information a typical user of a social networking site makes widely available both knowingly and unknowingly while also classifying social networking sites based on the privacy protection they offer Then we will illustrate the concern for privacy that users should have and the implications and privacy threats that may arise if they fail to do so II Past Literature Past studies have attempted to determine the reasons why social network users are unconcerned and unaware of the privacy concerns associated with their online practices but the reasons prove to be numerous and varied Ralph Gross and Alessandro Acquisti in their report Information Revelation and Privacy in Online Social Networks consider the privacy implication that arise from social networking sites upon their transition from niche phenomenon to mass adoption 2 To do this they observed the online behavior of over 4 000 students attending Carnegie Mellon University While the reasons for joining such networking sites range from business interests to purely pleasure the reasons behind the alarming amount of information people allow others to acquire are more ambiguous The real privacy concerns arise when users allow people they do not know and normally would not trust to have access to the personally identifiable information they have made available Certainly such an exchange of information would not ensue in a real life scenario but occurrences such as these occur in high frequency on social networking sites Gross and Acquisti explain that it may in fact stem from a lack of privacy concerns That is people allow a precarious amount of information about themselves to be available on these social networking sites because they are unaware of the large number of people who are allowed to view this information and the implications associated with these viewings 1 Facebook Facebook Overview http harvard facebook com press php Cited 11 May 2007 Gross Ralph and Acquisti Alessandro Information Revelation and Privacy in Online Social Networks p 71 2 1 As a result of this lack of privacy concern Gross and Acquisti explain that a minimal percentage of users change the highly permeable privacy preferences that are set as a default for these social networking sites Subsequently users profiles become intimate portraits of themselves and their lives 3 Privacy expectations may not be met by privacy reality and this is where users run into trouble and privacy implications arise 4 While the perceived benefit of selectively revealing data to strangers may appear larger than the perceived costs of possible privacy invasions 5 Gross and Acquisti explain that such practices allow third parties to create digital dossiers of their behavior 6 In addition when providing real and accurate information users contribute to the ease with which stalkers can target and victimize individuals as well as a prime contributor to the number of identity theft occurrences in the United States 7 However users are not the only ones to blame and many researchers are much quicker to point the finger of blame towards the websites themselves According to Harvey Jones and Jos Solton Facebook is undermined by three principal factors users disclose too much Facebook does not take adequate steps to protect user privacy and third parties are actively seeking out end user information using Facebook 8 Not only are privacy protection default settings inadequate social networking sites often discourage users from altering default settings Myspace com warns its users that altering default settings may make it more difficult for them to network with their friends Thus the use of real names to re present an account profile to the rest of the online community may be encouraged This is because social networking sites aspire to connect participants profiles to their public identities 9 Part of the research conducted by Gross and Acquisti involved determining if Facebook com users provided real and accurate information They found that 89 of users use their real name and after considering a multitude of variables they concluded that users are by large quite oblivious unconcerned or just pragmatic about their personal privacy 10 If users were concerned about their privacy and aware of the alteration that could be made to the default privacy settings many social networking websites would be able to provide a substantially higher level of privacy protection When considering the capabilities of Facebook com to offer user protection Jones and Solton explain that From a systems perspective there are a number of changes that can be made both to give the user a reasonable perception of the level of privacy protection available and to protect against disclosure to intruders 11 However since the main goal of social networking sites is to maintain a connection between users profiles and their real world identities for the purpose of networking the responsibility of privacy protection often falls solely on the individual As a