Facebook’s Wonky Privacy Controls Now Outing LGBT Youth Without Their Consent

http://betabeat.com/2012/10/facebooks-wonky-privacy-controls-now-outing-lgbt-youth-without-their-consent/

by iProject • 14 years ago

87 102 14 years ago

jgrahamc4• 14 years ago

If you have something that needs to be private don't put it on a web site. And certainly don't put it on a web site that is designed for sharing things with the people you are connected to.

capisce• 14 years ago

They didn't, someone else did.

bmelton2• 14 years ago

I second that, and think a fairly obvious extension to it should be "... and DEFINITELY don't put it on Facebook."

At this stage, I think it should be a given that anything you put on Facebook (and perhaps any other web service) will eventually end up public to the world.

LaGrange• 14 years ago

And what would that achieve in that case? Nothing!

Just as not being on Facebook achieves nothing — you'll just be completely defenseless if someone tags you in an image (which is horrifying — as far as I'm concerned, the only acceptable solution is to allow only tagging of actual users, and only the ones who consented to that).

varikin• 14 years ago

Please read the article. They didn't do anything. Someone else added them to a group called Queer Choir. They were not prompted to join. Then it was added to all their friends' timelines that they were now in this group, including parents. At no time, did the student do anything. In fact, they had privacy controls setup to not show have updates posted to their parents timeline be default.

mindstab• 14 years ago

RFTA

They did not do that. What happened is it appears a friend who did know added them to a group and before they connected to joining that showed up on their feed. They did nothing. They were passive, and they were still outed because facebook didn't ask for permission and broadcast that they had been added by a third party to a group to their wall.

jgrahamc4• 14 years ago

I did read it and I was making (poorly) a different point: the problem here is that you see the solution as technical ("Facebook should have better privacy controls") whereas I see the solution as personal ("Do not use Facebook"). I do not believe that it will be feasible for Facebook to both add functionality over time and preserve privacy and so the only solution is not to use Facebook at all.

smokinjoe• 14 years ago

This comment appears fairly too frequently in response to this article.

At least that gives away all those people who didn't read it.

jmilloy3• 14 years ago

In the context of what actually happened in the article (did you read it?), your advice amounts to "If there is anything about you that needs to be private, don't have an online presence."

greenyoda• 14 years ago

You don't have to give up all forms of online presence to maintain your privacy. You just have to avoid being on a site where information about you can be leaked without your consent. For example, writing a blog doesn't open you up to the kind of privacy breach described in the article. Neither does posting on Hacker News, for that matter.

antihero• 14 years ago

This basically illustrates one of the biggest issues with the privacy debate. Generally, "enforced transparency" advocates (who are against things like pseudonyms, like that Google CEO) are often privileged people who have little to lose through not being private, and cannot understand or appreciate the need for privacy by people, for instance, activists who's identity who is kept private to shield them from personal attack, people with a sexuality that isn't accepted by people they know - transparency advocates forget that we don't live in a perfect world and that everyone has the right to shield themselves from irrational people who would destroy them on finding out certain things about them.

Evbn• 14 years ago

The solution is to this is to build, as I was asked to design once in a job interview at a major tech company(!) a communal dossier that collects sighting reports and tracks the movements and details of these people, and see how they react to a site like whereiseric.com that shares his life details with us as much as Google snarfs our details.

mikeash• 14 years ago

I speculate that, in a world of total transparency, things like this will become much less important as everyone realizes how weird nearly everyone is. I think that, to an extent, everybody thinks that the general population is much cleaner and more "normal" than they really are, and that in an environment where everybody can know everything about everybody, revelations like this will cease to be interesting.

However, I certainly could be wrong, and I'm certainly not advocating for anything in particular here.

derleth7• 14 years ago

> I speculate that, in a world of total transparency, things like this will become much less important as everyone realizes how weird nearly everyone is.

We've done this before and it doesn't work that way.

Back in Colonial New England, say Massachusetts in the latter 1600s, nearly everyone in a given small town would be essentially 'transparent' to pretty much everyone else. There was so little room, and so few people, that there wasn't space to have much privacy.

And social norms were horrible. You couldn't get away with being of the wrong religion, with being suspected of adultery, or a lot of things that are either ignored or not considered problems now.

People didn't learn to accept others. They forced others to conform. And the revelations never stopped being interesting to those who enforced conformity.

jonnathanson• 14 years ago

"I speculate that, in a world of total transparency, things like this will become much less important as everyone realizes how weird nearly everyone is."

Seems like very wishful thinking. It seems to be hard-wired into human nature to be suspicious of, and consequently antagonistic toward, noticeable differences. Forcing those differences out into the open probably won't significantly alter the impulse toward hostility. It seems just as likely that the differences will come out into the daylight, but the prejudices will sneak into hiding. I'm not sure if those prejudices are more dangerous when they're naked, or when they're cloaked.

I think you raise an interesting point, of course. I guess I just have a more cynical and pessimistic view of the result.

hkmurakami• 14 years ago

I can't imagine a world where I'd be comfortable with publicly displaying the entirety of my Google search history.

I guess this is complicated by the fact that our actions don't necessarily reflect our beliefs or identity, and a public display of actions or even just words (posts) can present a misconstrued image of ourselves to the world (or at least one that is ripe for misinterpretation).

zerostar07• 14 years ago

Quite the opposite. By summing up people with different traits together, what you get is a normal distribution around the "completely average person" (central limit maybe?), and that's what people compare everyone with. As others stated, that's what happens in small towns where everyone knows everyone. You lose the sweet anonymity of the city.

SwellJoe• 14 years ago

Your relative normalcy gives you the privilege of thinking how weird "nearly everyone is", and that having no privacy wouldn't be such a big deal.

There are many groups of people who still experience tremendous bigotry...for example, having everyone be completely transparent doesn't make transgender folks any less rare, or any less subject to prejudice and hostility. On the whole, having everyone "come out" about whatever it is that takes them outside of "normalcy" might be good for society. But, for an individual who isn't ready to be out, or who has safety concerns about being out, the total transparency argument is pretty hollow.

I know you're not campaigning for anything here, so I'm not really arguing with you. But, I am highly mistrustful of Facebook, and consider some of their tactics and goals deeply unethical, so I wanted to point out that what many are viewing as a neutral "technology marches ever onward" sort of thing is really more a situation of a few companies extracting value from exposing people's private lives, and constantly being on the look out for more ways to extract that value and more ways to profit from that erosion of privacy. It isn't neutral and it isn't accidental. Facebook (and Google to a lesser degree) wants to own your private life and sell it to the highest bidder.

rjd• 14 years ago

You are totally ignore physical and psychological violence that people throw out towards others for very baseless and primal reasons, often for just acting differently, disrupting a social pattern, making another feel less secure in there world view.

People are often hiding aspects of there life not for embarrassment, but for protection. Then there is always the entire "blame the X" that precedes many great atrocities.

You may like to think the world is a utopia or not far off it but genocides are going on right this minute, its the last thing the world needs is more exposure to vulnerable people.

EwanToo• 14 years ago

Pretty depressing story, both Facebook and the group owner have their own faults here.

In this case I don't know why the group owner didn't think it was more appropriate to ask people "Hey, want to join our facebook group?", not to sign them up in bulk, given that it's obviously a touchy subject for some people.

nicolethenerd• 14 years ago

That may have been exactly what the group owner thought they were doing. I'm not sure when Facebook switched over to "Add People to Group" instead of "Invite People to Group," but I vaguely recall that Facebook groups used to do the latter, which is a behavior that, at least to me, makes a lot more sense.

Peroni• 14 years ago

I'm missing something here, I'm aware you can invite people to join a group but I didn't realise you could force add people to your group.

randomchars6• 14 years ago

If you "invite" someone they're automatically added.

btown• 14 years ago

How is this different from Mr. Acosta tweeting "Welcome Ms. Duncan to the Queer Chorus!"? Sure, it was explicitly messaged to the father... but what if that tweet had gone viral somehow, or otherwise found its way to the father?

Facebook is clearly wrong for making it unclear that group membership was publicly available information, that it is in essence a tweet of that information. But is it wrong for understating the fact that publicly available information can be publicly distributed to interested parties at any time? People need to know that this is the direction in which Facebook (and the Internet) is moving, and that they should just assume that anything they publicly post will be distributed to interested parties (of which the father surely counts). Sure, a lot of the blame falls on Facebook, but not all of it - if you don't want to be outed, tell your friends to make sure that anything they post about you is explicitly marked as a private share (which group membership is not).

Semaphor4• 14 years ago

Because you do not have a choice about being added to groups. The article talks about facebooks privacy settings but those are essentially fine. What's not is their completely fucked up group system.

You can only opt out of groups but everyone / allowed members can add you to it.

Even better, get added to a very active group and wake up to 700 notifications.

I could create a FB group called "Gay hackernews users" and add you to it (provided I have you in my friendlist) and it would be published to your friends. You could leave it afterwards, but first you'd join and it'd be published.

TWAndrews4• 14 years ago

In that case it would just be Mr. Acosta being insensitive/inconsiderate. Twitter is understood to be public. Facebook is (wrongly) believed to be private to some degree.

darkarmani4• 14 years ago

Don't apologize for Facebook's broken group mechanism. Everyone knows it is a broken model.

raimondious2• 14 years ago

The issue isn't Facebook's controls, it's user behavior, and there's little anyone can do about it.

I don't use Facebook because of this. There's not much the company can do to prevent people from making things public about you that you'd rather keep among friends. How is Facebook to know the implications of you being at one party vs another? Sharing is sharing. Just because you keep your profile locked down doesn't matter when someone else can share whatever they like with whomever they like. I understand not having a profile doesn't completely prevent this, but it helps make it a lot less public. Nobody will receive a notification linked to my profile that I was tagged in a photo because there's no profile to associate. We're past the point of being able to prevent this entirely, but I'm not going to make it any easier.

jeremyarussell• 14 years ago

The only issue is there is no real technical reason why individual A's friends need messaged when individual B took the action.

mgkimsal3• 14 years ago

Ummm...

the issue is facebook's controls.

If I add you to my group (without you even knowing), the system should not be sending out notices to all of your contacts that you 'joined' my group. You didn't join, you were added - there's a huge difference.

hnriot3• 14 years ago

* the system should not be sending out notices to all of your contacts that you 'joined' my group*

- that's up to Facebook, and the parent is quite correct, if you don't your private life out there for all to see, don't put it on a social networking site because you don't have any control, other that what Facebook feel is in their interest to have. You give up that control when you put it online.

I have no sympathy for people that get found out because they put the information on Facebook and someone they didn't want to know saw it. People have to start taking responsibility for their own privacy and not crying to Facebook whenever this sort of thing happens. Also I tend not to believe most people because its an easy way to tell a burning secret without actually doing it, the confessors version of suicide by police.

tl;dr - don't put your secrets in the hands of facebook's whims because they aren't your best friend, they are a commercial business and your privacy isn't their concern, except when it suits them to be.

raimondious2• 14 years ago

I agree this particular feature should be fixed, however fixing it doesn't solve the core issue of your contacts sharing information about you. This is the core functionality of Facebook I can't agree with, no matter how their privacy controls work.

Ntrails• 14 years ago

Whilst I find this whole privacy setting issue unpleasant and frustrating, I am continually amazed that people would be Facebook friends with parents and relatives - from whom they would prefer to keep things hidden.

I would not let my parents sit in the room whilst I chatted with friends, or listen in on phone calls. I would not let them go through the photos on my phone, nor those of me on the phones of friends.

I think the point of a social network is to stay connected to people with whom you are comfortable being yourself.

I feel incredibly sorry for the people in question though.

randomchars6• 14 years ago

    > I think the point of a social network is to stay connected to people with whom you are comfortable being yourself.

The problem is that people you barely know add you, and if you reject the friend request you're indeterminately labeled as an asshole. This has happened to me several times to an extent where I was called out on it in person. My rule of thumb was that I don't add people from whom I wouldn't appreciate a call at 3am.

I had to break this because apparently the fact that it says "friend" doesn't repel people who I haven't seen in years. SO right now I'm using lists and I've put tons of people in 'restricted' but still, this mentality is annoying as hell.

Regarding family: I'm friends with my grandmother and I hate it. She doesn't understand most of the stuff that I post about but she still comments stupid things on my posts and pictures. Well now she's on restricted but if she'd ever found out I'd be in trouble.

lurker143• 14 years ago

I can't imagine wanting to be in the company of someone who who (a) you don't want on your facebook, and (b) would bitch at you for it.

fafner• 14 years ago

I guess the biggest problem is that Facebook is now the place where everything comes together. You suddenly end up having your boss, parents, coworkers as friend along with the guy you used to do drugs with during your teen years and that trashy ex-girlfriend. And it's not easy to keep those things apart with the real name policy facebook has. It's also not easy to reject a lot of friend requests. Sure somebody you haven't seen in ages you can easily ignore but with coworkers it can get unpleasant. I'm glad that my parents are too old for facebook but for a lot of especially young people rejecting a parents' friend request is probably impossible as well.

Sure you can try to have different profiles. But they easily spill over. And facebook collects a lot of data. The worst thing are probably the phone and address books of your friends. Someone has stored your email address or phone number associated with your real name on his phone and installs the facebook app and suddenly they now. Or people are stupid enough to give facebook access to their email account. They even started to ask friends of you what your real name is.

I recently had to delete my account because they realised I was using a fake name. I don't know if somebody "squealed on me" or they got the information elsewhere.

In the past your online identities were easily separated because everything was in a different place and it was easier to be anonymous. You could have several IM profiles for friends and family separated. With other people you'd only communicate through one of your many email addresses.

Tipzntrix5• 14 years ago

If you read back to a few other posts about Facebook and parents, there were a lot of "Your parent is your friend or it's banned" posts.

tzs• 14 years ago

> Whilst I find this whole privacy setting issue unpleasant and frustrating, I am continually amazed that people would be Facebook friends with parents and relatives - from whom they would prefer to keep things hidden.

> I would not let my parents sit in the room whilst I chatted with friends, or listen in on phone calls. I would not let them go through the photos on my phone, nor those of me on the phones of friends.

Same with most people. Most people have different personas for different groups--they have their family persona that they present to their parents and other relatives, their casual friend persona they present to most of their friends, their intimate persona they present to close friends and lovers, their work persona for co-workers, and often others.

Facebook has purposefully decided to ignore that, and insist that you have a single Facebook persona. That gives you a couple poor choices for how to use Facebook. You can pick one of your personas and make that your Facebook persona, and do not "friend" anyone with it who does not belong with that persona. This is hard to explain to those groups that you use the other personas with.

Or you can try to use Facebook's poorly designed, poorly implemented, poorly documented, frequently changing, and laughably inadequate privacy controls to try to beat their "one size fits all" persona approach into something approximating the reality of any normal person's life--and if you ever trip up, you have a good risk of blowing up some aspect of your life.

Tipzntrix5• 14 years ago

I remember the first time I got tagged in a picture by a friend on Facebook. I deactivated my account immediately because it felt really unsettling that people were "checking me in and tagging" me at places I didn't even know I was being tracked at. Alas, given enough peer pressure in my circle I reactivated it simply because it was easier "to invite all friends at once to parties and other events", and I was missing out on most of then unknowingly without even getting an invite. One might say I need better friends, but I sympathize that when you have 25 people to invite or more, that you are going to miss people. The tagging still unnerves me.

brown9-2• 14 years ago

I believe there are settings for both photo tagging and location tagging that allow you to review the tag that a friend makes before it is public.

Tipzntrix5• 14 years ago

9 Sep 2011 [1] seems to be the date at which they introduced that. I have since set that setting as you recommend, but I was definitely on Facebook before that. I guess the unsettling feeling (combined with this and all the incidents where changing an arcane library of settings is quite often bound to leave an open passage) has just stayed around since then.

[1] http://www.huffingtonpost.com/2011/09/09/the-new-facebook-pr...

EDIT: Just made a double-check now, guess what? An open passage:

Note: You can still be tagged, and tags may appear elsewhere on Facebook. I can't review the tags if they are found on someone else's timeline.

TWAndrews4• 14 years ago

Yes, and it's pretty surprising that the same mechanism isn't used for group affiliation.

The default behavior should be that other people can't release information about you without your approval, whether it's photos, location, group membership, reading habits, etc. This shouldn't be a tough concept for FB.

lurker143• 14 years ago

Since this seems to be so unclear:

Facebook has a feature (and apparently there is no way to opt-out), wherein anyone you are friends with can post a tweet-sized message to all your friend walls by creating an appropriately group and adding you to it.

(1) this is basically the same as those email hack/viruses that email a spam link to everyone in your address book.

(2) how is this not already massively abused for spam? it is nearly identical workflow to the email use case: Gain control of an account, create a group, send message to all the vector's contacts.

leoedin• 14 years ago

It's not going to post to your friends walls. If a friend of yours adds you to a group, it will appear on your wall (and so also on the news feeds of anyone who hasn't chosen to not see your activity) that "John Doe was added to XXX group" or similar. (I don't want to spam a friend by testing the functionality myself, but I'm certain that there's no way you can trigger a post on friends of friends walls)

The issue is that if you (as the LGBT youth) have your father as a friend, they can view your wall and will probably see that activity appear in their newsfeed.

In fact, facebook does have two different methods of reducing what someone can see. Either placing a contact in the "acquaintances" category and then only allowing "friends except acquaintances" to view posts on your wall, or manually adding an individual to the "restricted" list, which quietly blocks them from seeing anything you haven't explicitly made public would work.

tokenadult• 14 years ago

This is blogspam of an article reported by professional journalists.

http://online.wsj.com/article_email/SB1000087239639044416580...

The original article was submitted to HN yesterday.

http://news.ycombinator.com/item?id=4649551

gmisra• 14 years ago

This comment thread is a perfect example of the problem with fb's privacy control system. HN readers are generally tech-savvy and privacy-aware, especially relative to the typical fb user. Yet this thread is full of many comments exhibiting confusion as to how these settings behave under difference circumstances.

When working with unheralded amounts of potentially publicly consumable personal information, the bar for appropriate privacy handling that most of us expect is very high. And our bar is clearly higher than facebook's internal bar.

Yet, we usually conflate these discussions with asides about their motivations - financial gain, genuine ideological belief in open identity, or just mistakes from product leadership. Those are distractions, in that they often lead to speculative discussions that can make stakeholders revert to defensive positions. I would rather focus on functionality - pretty much every action a user takes on fb has potential privacy consequences, so we should be asking: * How obvious are those during the action flow? (pretty much not at all - and clearly the culprit here) * When building features, at what point and in what detail are the privacy consequences analyzed? (currently unknown but the impression continues to be that some privacy issues are intentionally reactively)

Aside: my personal experience with facebook employees is one of tremendous socio-economic homogeneity. I do wonder if the culture their building internally is qualified to handle the real diversity of 1B+ people. (If someone were to quote Danah Boyd's subaltern vs. hegemon model of social network interaction here, I would begrudgingly not cringe, just this once).

Facebook’s Wonky Privacy Controls Now Outing LGBT Youth Without Their Consent

Related Stories