Information

Revelation

and

Privacy

in

Online

Social

Networks

Participation

in

social

networking

sites

has

dramatically

increased

in

recent

years

Services

such

as

Friendster

Tribe

or

the

Facebook

allow

millions

of

individuals

to

create

online

profiles

and

share

personal

information

with

vast

networks

of

friends

and

often

unknown

numbers

of

strangers

In

this

paper

we

study

patterns

of

information

revelation

in

online

social

networks

and

their

privacy

implications

We

analyze

the

online

behavior

of

more

than

Carnegie

Mellon

University

students

who

have

joined

a

popular

social

networking

site

catered

to

colleges

We

evaluate

the

amount

of

information

they

disclose

and

study

their

usage

of

the

site

's

privacy

settings

We

highlight

potential

attacks

on

various

aspects

of

their

privacy

and

we

show

that

only

a

minimal

percentage

of

users

changes

the

highly

permeable

privacy

preferences

K.

-LSB-

Computer

and

Society

-RSB-

Public

Policy

Issues-Privacy

Human

Factors

In

recent

years

online

social

networking

has

moved

from

niche

phenomenon

to

mass

adoption

Although

the

concept

dates

back

to

the

-LRB-

with

University

of

Illinois

Plato

computer-based

education

tool

see

-LSB-

-RSB-

-RRB-

viral

growth

and

Permission

to

make

digital

or

hard

copies

of

all

or

part

of

this

work

for

personal

or

classroom

use

is

granted

without

fee

provided

that

copies

are

not

made

or

distributed

for

profit

or

commercial

advantage

and

that

copies

bear

this

notice

and

the

full

citation

on

the

first

page

To

copy

otherwise

to

republish

to

post

on

servers

or

to

redistribute

to

lists

requires

prior

specific

permission

and/or

a

fee

WPES

November

Alexandria

Virginia

USA

Copyright

ACM

commercial

interest

only

arose

well

after

the

advent

of

the

Internet

The

rapid

increase

in

participation

in

very

recent

years

has

been

accompanied

by

a

progressive

diversification

and

sophistication

of

purposes

and

usage

patterns

across

a

multitude

of

different

sites

The

Social

Software

Weblog

now

groups

hundreds

of

social

networking

sites

in

nine

categories

including

business

common

interests

dating

face-to

face

facilitation

friends

pets

and

photos

While

boundaries

are

blurred

most

online

networking

sites

share

a

core

of

features

through

the

site

an

individual

offers

a

profile

a

representation

of

their

sel

-LSB-

ves

-RSB-

-LRB-

and

often

of

their

own

social

networks

-RRB-

to

others

to

peruse

with

the

intention

of

contacting

or

being

contacted

by

others

to

meet

new

friends

or

dates

-LRB-

Friendster

Orkut

-RRB-

find

new

jobs

-LRB-

LinkedIn

-RRB-

receive

or

provide

recommendations

-LRB-

Tribe

-RRB-

and

much

more

It

is

not

unusual

for

successful

social

networking

sites

to

experience

periods

of

viral

growth

with

participation

expanding

at

rates

topping

a

month

Liu

and

Maes

estimate

in

-LSB-

-RSB-

that

well

over

a

million

self-descriptive

personal

profiles

are

available

across

different

web-based

social

networks

in

the

United

States

and

Leonard

already

in

reported

in

-LSB-

-RSB-

that

world-wide

-LSB-

s

-RSB-

even

million

people

have

accounts

on

Friendster

-LSB-

-RSB-

Two

million

are

registered

to

MySpace

A

whopping

million

are

supposed

to

have

registered

on

Tickle

for

a

chance

to

take

a

personality

test

The

success

of

these

sites

has

attracted

the

attention

of

the

media

-LRB-

e.g.

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-RRB-

and

researchers

The

latter

have

often

built

upon

the

existing

literature

on

social

network

theory

-LRB-

e.g.

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-RRB-

to

discuss

its

online

incarnations

In

particular

-LSB-

-RSB-

discusses

issues

of

trust

and

intimacy

in

online

networking

-LSB-

-RSB-

and

-LSB-

-RSB-

focus

on

participants

strategic

representation

of

their

selves

to

others

and

-LSB-

-RSB-

focus

on

harvesting

online

social

network

profiles

to

obtain

a

distributed

recommender

system

In

this

paper

we

focus

on

patterns

of

personal

information

revelation

and

privacy

implications

associated

with

online

networking

Not

only

are

the

participation

rates

to

online

One

of

the

first

networking

sites

SixDegrees.com

was

launched

in

but

shut

down

in

after

struggling

to

find

a

purpose

for

-LSB-

its

-RSB-

concept

-LSB-

-RSB-

social

networking

staggering

among

certain

demographics

so

also

are

the

amount

and

type

of

information

participants

freely

reveal

Category-based

representations

of

a

person

's

broad

interests

are

a

recurrent

feature

across

most

networking

sites

-LSB-

-RSB-

Such

categories

may

include

indications

of

a

person

's

literary

or

entertainment

interests

as

well

as

political

and

sexual

ones

In

addition

personally

identified

or

identifiable

data

-LRB-

as

well

as

contact

information

-RRB-

are

often

provided

together

with

intimate

portraits

of

a

person

's

social

or

inner

life

Such

apparent

openness

to

reveal

personal

information

to

vast

networks

of

loosely

defined

acquaintances

and

complete

strangers

calls

for

attention

We

investigate

information

revelation

behavior

in

online

networking

using

actual

field

data

about

the

usage

and

the

inferred

privacy

preferences

of

more

than

users

of

a

site

catered

to

college

students

the

Facebook

Our

results

provide

a

preliminary

but

detailed

picture

of

personal

information

revelation

and

privacy

concerns

-LRB-

or

lack

thereof

-RRB-

in

the

wild

rather

than

as

discerned

through

surveys

and

laboratory

experiments

The

remainder

of

this

paper

is

organized

as

follows

We

first

elaborate

on

information

revelation

issues

in

online

social

networking

in

Section

Next

we

present

the

results

of

our

data

gathering

in

Section

Then

we

discuss

their

implications

in

terms

of

users

attitudes

and

privacy

risks

in

Section

Finally

we

summarize

our

findings

and

conclude

in

Section

While

social

networking

sites

share

the

basic

purpose

of

online

interaction

and

communication

specific

goals

and

patterns

of

usage

vary

significantly

across

different

services

The

most

common

model

is

based

on

the

presentation

of

the

participant

's

profile

and

the

visualization

of

her

network

of

relations

to

others

such

is

the

case

of

Friendster

This

model

can

stretch

towards

different

directions

In

match-making

sites

like

Match.com

or

Nerve

and

Salon

Personals

the

profile

is

critical

and

the

network

of

relations

is

absent

In

diary/online

journal

sites

like

LiveJournal

profiles

become

secondary

networks

may

or

may

not

be

visible

while

participants

online

journal

entries

take

a

central

role

Online

social

networking

thus

can

morph

into

online

classified

in

one

direction

and

blogging

in

another

Patterns

of

personal

information

revelation

are

therefore

quite

variable

First

the

pretense

of

identifiability

changes

across

different

types

of

sites

The

use

of

real

names

to

-LRB-

re

-RRB-

present

an

account

profile

to

the

rest

of

the

online

community

may

be

encouraged

-LRB-

through

technical

specifications

registration

requirements

or

social

norms

-RRB-

in

college

websites

like

the

Facebook

that

aspire

to

connect

participants

profiles

to

their

public

identities

The

use

of

real

names

may

be

toler-ated

but

filtered

in

dating/connecting

sites

like

Friendster

that

create

a

thin

shield

of

weak

pseudonymity

between

the

public

identity

of

a

person

and

her

online

persona

by

making

only

the

first

name

of

a

participant

visible

to

others

and

not

her

last

name

Or

the

use

of

real

names

and

personal

contact

information

could

be

openly

discouraged

as

in

pseudonymous-based

dating

websites

like

Match.com

that

attempt

to

protect

the

public

identity

of

a

person

by

making

its

linkage

to

the

online

persona

more

difficult

However

notwithstanding

the

different

approaches

to

identifiability

most

sites

encourage

the

publication

of

personal

and

identifiable

personal

photos

-LRB-

such

as

clear

shots

of

a

person

's

face

-RRB-

Second

the

type

of

information

revealed

or

elicited

often

orbits

around

hobbies

and

interests

but

can

stride

from

there

in

different

directions

These

include

semi-public

information

such

as

current

and

previous

schools

and

employers

-LRB-

as

in

Friendster

-RRB-

private

information

such

as

drinking

and

drug

habits

and

sexual

preferences

and

orientation

-LRB-

as

in

Nerve

Personals

-RRB-

and

open-ended

entries

-LRB-

as

in

LiveJournal

-RRB-

Third

visibility

of

information

is

highly

variable

In

certain

sites

-LRB-

especially

the

ostensibly

pseudonymous

ones

-RRB-

any

member

may

view

any

other

member

's

profile

On

weaker-pseudonym

sites

access

to

personal

information

may

be

limited

to

participants

that

are

part

of

the

direct

or

extended

network

of

the

profile

owner

Such

visibility

tuning

controls

become

even

more

refined

on

sites

which

make

no

pretense

of

pseudonymity

like

the

Facebook

And

yet

across

different

sites

anecdotal

evidence

suggests

that

participants

are

happy

to

disclose

as

much

information

as

possible

to

as

many

people

as

possible

It

is

not

unusual

to

find

profiles

on

sites

like

Friendster

or

Salon

Personals

that

list

their

owners

personal

email

addresses

-LRB-

or

link

to

their

personal

websites

-RRB-

in

violation

of

the

recommendation

or

requirements

of

the

hosting

service

itself

In

the

next

sub-section

we

resort

to

the

theory

of

social

networks

to

frame

the

analysis

of

such

behavior

which

we

then

investigate

em-pirically

in

Section

Social

Network

Theory

and

Privacy

The

relation

between

privacy

and

a

person

's

social

network

is

multi-faceted

In

certain

occasions

we

want

information

about

ourselves

to

be

known

only

by

a

small

circle

of

close

friends

and

not

by

strangers

In

other

instances

we

are

willing

to

reveal

personal

information

to

anonymous

strangers

but

not

to

those

who

know

us

better

Social

network

theorists

have

discussed

the

relevance

of

relations

of

different

depth

and

strength

in

a

person

's

social

network

-LRB-

see

-LSB-

-RSB-

-LSB-

-RSB-

-RRB-

and

the

importance

of

so-called

weak

ties

in

the

flow

of

information

across

different

nodes

in

a

network

Network

theory

has

also

been

used

to

explore

how

distant

nodes

can

get

interconnected

through

relatively

few

random

ties

-LRB-

e.g.

-LSB-

-RSB-

-LSB-

-RSB-

-LSB-

-RSB-

-RRB-

The

privacy

relevance

of

these

arguments

has

recently

been

highlighted

by

Strahilevitz

in

-LSB-

-RSB-

Strahilevitz

has

proposed

applying

formal

social

network

theory

as

a

tool

for

aiding

interpretation

of

privacy

in

legal

cases

He

suggests

basing

conclusions

regarding

privacy

on

what

the

parties

should

have

expected

to

follow

the

initial

disclosure

of

information

by

someone

other

than

the

defen-dant

-LRB-

op

cit

p.

-RRB-

In

other

words

the

consideration

of

how

information

is

expected

to

flow

from

node

to

node

in

somebody

's

social

network

should

also

inform

that

person

's

expectations

for

privacy

of

information

revealed

in

the

network

However

the

application

of

social

network

theory

to

the

study

of

information

revelation

-LRB-

and

implicitly

privacy

choices

-RRB-

in

online

social

networks

highlights

significant

differences

between

the

offline

and

the

online

scenarios

First

offline

social

networks

are

made

of

ties

that

can

only

be

loosely

categorized

as

weak

or

strong

ties

but

in

reality

are

extremely

diverse

in

terms

of

how

close

and

intimate

a

subject

perceives

a

relation

to

be

Online

social

networks

on

the

other

side

often

reduce

these

nuanced

connections

to

simplistic

binary

relations

Friend

or

not

-LSB-

-RSB-

Observing

online

social

networks

Danah

Boyd

notes

that

there

is

no

way

to

determine

what

metric

was

used

or

what

the

role

or

weight

of

the

relationship

is

While

some

people

are

willing

to

indicate

anyone

as

Friends

and

others

stick

to

a

conservative

definition

most

users

tend

to

list

anyone

who

they

know

and

do

not

actively

dislike

This

often

means

that

people

are

indicated

as

Friends

even

though

the

user

does

not

particularly

know

or

trust

the

person

-LSB-

-RSB-

-LRB-

p.

-RRB-

Second

while

the

number

of

strong

ties

that

a

person

may

maintain

on

a

social

networking

site

may

not

be

significantly

increased

by

online

networking

technology

Donath

and

Boyd

note

that

the

number

of

weak

ties

one

can

form

and

maintain

may

be

able

to

increase

substantially

because

the

type

of

communication

that

can

be

done

more

cheaply

and

easily

with

new

technology

is

well

suited

for

these

ties

-LSB-

-RSB-

-LRB-

p.

-RRB-

Third

while

an

offline

social

network

may

include

up

to

a

dozen

of

intimate

or

significant

ties

and

to

ac-quaintances

or

interactions

-LRB-

see

-LSB-

-RSB-

and

-LSB-

-RSB-

-RRB-

an

online

social

networks

can

list

hundreds

of

direct

friends

and

include

hundreds

of

thousands

of

additional

friends

within

just

three

degrees

of

separation

from

a

subject

This

implies

online

social

networks

are

both

vaster

and

have

more

weaker

ties

on

average

than

offline

social

networks

In

other

words

thousands

of

users

may

be

classified

as

friends

of

friends

of

an

individual

and

become

able

to

access

her

personal

information

while

at

the

same

time

the

threshold

to

qualify

as

friend

on

somebody

's

network

is

low

This

may

make

the

online

social

network

only

an

imaginary

-LRB-

or

to

borrow

Anderson

's

terminology

an

imagined

-RRB-

community

-LRB-

see

-LSB-

-RSB-

-RRB-

Hence

trust

in

and

within

online

social

networks

may

be

assigned

differently

and

have

a

different

meaning

than

in

their

offline

counterparts

Online

social

networks

are

also

more

levelled

in

that

the

same

information

is

provided

to

larger

amounts

of

friends

connected

to

the

subject

through

ties

of

different

strength

And

here

lies

a

paradox

While

privacy

may

be

considered

conducive

to

and

necessary

for

intimacy

-LRB-

for

-LSB-

-RSB-

intimacy

resides

in

selectively

revealing

private

information

to

certain

individuals

but

not

to

others

-RRB-

trust

may

decrease

within

an

online

social

network

At

the

same

time

a

new

form

of

intimacy

becomes

widespread

the

sharing

of

personal

information

with

large

and

potential

unknown

numbers

of

friends

and

strangers

altogether

The

ability

to

meaningfully

interact

with

others

is

mildly

augmented

while

the

ability

of

others

to

access

the

person

is

significantly

enlarged

It

remains

to

be

investigated

how

similar

or

different

are

the

mental

models

people

apply

to

personal

information

revelation

within

a

traditional

network

of

friends

compared

to

those

that

are

applied

in

an

online

network

Privacy

Implications

Privacy

implications

associated

with

online

social

networking

depend

on

the

level

of

identifiability

of

the

information

provided

its

possible

recipients

and

its

possible

uses

Even

social

networking

websites

that

do

not

openly

expose

their

users

identities

may

provide

enough

information

to

identify

the

profile

's

owner

This

may

happen

for

example

through

face

re-identification

-LSB-

-RSB-

Liu

and

Maes

estimate

in

-LSB-

-RSB-

a

overlap

in

of

the

major

social

networking

sites

they

studied

Since

users

often

re-use

the

same

or

similar

photos

across

different

sites

an

identified

face

can

be

used

to

identify

a

pseudonym

profile

with

the

same

or

similar

face

on

another

site

Similar

re-identifications

are

possible

through

demographic

data

but

also

through

category-based

representations

of

interests

that

reveal

unique

or

rare

overlaps

of

hobbies

or

tastes

We

note

that

information

revelation

can

work

in

two

ways

by

allowing

another

party

to

identify

a

pseudonymous

profile

through

previous

knowledge

of

a

sub-ject

's

characteristics

or

traits

or

by

allowing

another

party

to

infer

previously

unknown

characteristics

or

traits

about

a

subject

identified

on

a

certain

site

We

present

evaluations

of

the

probabilities

of

success

of

these

attacks

on

users

of

a

specific

networking

site

in

Section

To

whom

may

identifiable

information

be

made

available

First

of

all

of

course

the

hosting

site

that

may

use

and

extend

the

information

-LRB-

both

knowingly

and

unknowingly

revealed

by

the

participant

-RRB-

in

different

ways

-LRB-

below

we

discuss

extracts

from

the

privacy

policy

of

a

social

networking

site

that

are

relevant

to

this

discussion

-RRB-

Obviously

the

information

is

available

within

the

network

itself

whose

extension

in

time

-LRB-

that

is

data

durability

-RRB-

and

space

-LRB-

that

is

membership

extension

-RRB-

may

not

be

fully

known

or

knowable

by

the

participant

Finally

the

easiness

of

joining

and

extending

one

's

network

and

the

lack

of

basic

security

measures

-LRB-

such

as

SSL

logins

-RRB-

at

most

networking

sites

make

it

easy

for

third

parties

-LRB-

from

hackers

to

government

agencies

-RRB-

to

access

participants

data

without

the

site

's

direct

collaboration

-LRB-

already

in

LiveJournal

used

to

receive

at

least

five

reports

of

ID

hijacking

per

day

-LSB-

-RSB-

-RRB-

How

can

that

information

be

used

It

depends

on

the

information

actually

provided

which

may

in

certain

cases

be

very

extensive

and

intimate

Risks

range

from

identity

theft

to

online

and

physical

stalking

from

embarrassment

to

price

discrimination

and

blackmailing

Yet

there

are

some

who

believe

that

social

networking

sites

can

also

offer

the

solution

to

online

privacy

problems

In

an

interview

Tribe.net

CEO

Mark

Pincus

noted

that

-LSB-

s

-RSB-

ocial

networking

has

the

potential

to

create

an

intelligent

order

in

the

current

chaos

by

letting

you

manage

how

public

you

make

yourself

and

why

and

who

can

contact

you

-LSB-

-RSB-

We

test

this

position

in

Section

While

privacy

may

be

at

risk

in

social

networking

sites

information

is

willingly

provided

Different

factors

are

likely

to

drive

information

revelation

in

online

social

networks

The

list

includes

signalling

-LRB-

as

discussed

in

-LSB-

-RSB-

-RRB-

because

the

perceived

benefit

of

selectively

revealing

data

to

strangers

may

appear

larger

than

the

perceived

costs

of

possible

privacy

invasions

peer

pressure

and

herding

behavior

relaxed

attitudes

towards

-LRB-

or

lack

of

interest

in

-RRB-

personal

privacy

incomplete

information

-LRB-

about

the

possible

privacy

implications

of

information

revelation

-RRB-

faith

in

the

networking

service

or

trust

in

its

members

myopic

evaluation

of

privacy

risks

-LRB-

see

-LSB-

-RSB-

-RRB-

or

also

the

service

's

own

user

interface

that

may

drive

the

unchallenged

acceptance

of

permeable

default

privacy

settings

We

do

not

attempt

to

ascertain

the

relative

impact

of

different

drivers

in

this

paper

However

in

the

following

sections

we

present

data

on

actual

behavioral

patterns

of

information

revelation

and

inferred

privacy

attitudes

in

a

college-targeted

networking

site

This

investigation

offers

a

starting

point

for

subsequent

analysis

of

the

motivations

behind

observed

behaviors

Many

users

of

social

networking

sites

are

of

college

age

-LSB-

-RSB-

and

recent

ventures

have

started

explicitly

catering

to

the

college

crowd

and

in

some

cases

to

specific

colleges

-LRB-

e.g.

the

Facebook.com

but

also

Universitysingles.ca

CampusNetwork.com

iVentster.com

and

others

-RRB-

College-oriented

social

networking

sites

provide

opportunities

to

combine

online

and

face-to-face

interactions

within

an

ostensibly

bounded

domain

This

makes

them

different

from

traditional

networking

sites

they

are

communities

based

on

a

shared

real

space

-LSB-

-RSB-

This

combination

may

explain

the

explosive

growth

of

some

of

these

services

-LRB-

according

to

-LSB-

-RSB-

the

Facebook

has

spread

to

campuses

and

million

users

-LSB-

-RSB-

-LSB-

I

-RSB-

t

typically

attracts

percent

of

a

school

's

undergraduate

population

as

well

as

a

smattering

of

graduate

students

faculty

members

and

recent

alumni

-RRB-

Also

because

of

this

college-oriented

networks

offer

a

wealth

of

personal

data

of

potentially

great

value

to

external

observers

-LRB-

as

reported

by

-LSB-

-RSB-

for

example

the

Pentagon

manages

a

database

of

US

youth

data

containing

around

million

records

and

continuously

merged

with

other

data

for

focused

marketing

-RRB-

Since

many

of

these

sites

require

a

college

's

email

account

for

a

participant

to

be

admitted

to

the

online

social

network

of

that

college

expectations

of

validity

of

certain

personal

information

provided

by

others

on

the

network

may

increase

Together

with

the

apparent

sharing

of

a

physical

environment

with

other

members

of

the

network

that

expectation

may

increase

the

sense

of

trust

and

intimacy

across

the

online

community

And

yet

since

these

services

can

be

easily

accessed

by

outsiders

-LRB-

see

Section

-RRB-

and

since

members

can

hardly

control

the

expansion

of

their

own

network

-LRB-

often

a

member

's

network

increases

also

through

the

activity

of

other

members

-RRB-

such

communities

turn

out

to

be

more

imagined

than

real

and

privacy

expectations

may

not

be

matched

by

privacy

reality

The

characteristics

mentioned

above

make

college-oriented

networking

sites

intriguing

candidates

for

our

study

of

information

revelation

and

privacy

preferences

In

the

rest

of

this

paper

we

analyze

data

gathered

from

the

network

of

Carnegie

Mellon

University

-LRB-

CMU

-RRB-

students

enlisted

on

one

of

such

sites

the

Facebook

The

Facebook

has

gained

huge

adoption

within

the

CMU

student

community

but

is

present

with

similar

success

at

many

other

colleges

nationwide

It

validates

CMU-specific

network

accounts

by

requiring

the

use

of

CMU

email

addresses

for

registration

and

login

Its

interface

grants

participants

very

granular

control

on

the

searchability

and

visibility

of

their

personal

information

-LRB-

by

friend

or

location

by

type

of

user

and

by

type

of

data

-RRB-

The

default

settings

however

are

set

to

make

the

participants

profile

searchable

by

anybody

else

in

any

school

in

the

Facebook

network

and

make

its

actual

content

visible

to

any

other

user

at

the

same

college

or

at

another

college

in

the

same

physical

location

At

the

time

of

writing

the

geography

feature

which

Age

Percentage

of

Profiles

Male

Female

Figure

Age

distribution

of

Facebook

profiles

at

CMU

The

majority

of

users

-LRB-

-RRB-

falls

into

the

age

bracket

The

Facebook

is

straightforward

about

the

usage

it

plans

for

the

participants

personal

information

at

the

time

of

this

writing

its

privacy

policy

-LSB-

-RSB-

reports

that

the

site

will

collect

additional

information

about

its

users

-LRB-

for

instance

from

instant

messaging

-RRB-

not

originated

from

the

use

of

the

service

itself

The

policy

also

reports

that

participants

information

may

include

information

that

the

participant

has

not

knowingly

provided

-LRB-

for

example

her

IP

address

-RRB-

and

that

personal

data

may

be

shared

with

third

parties

Access

Tools

In

June

we

separately

searched

for

all

female

and

all

male

profiles

for

CMU

Facebook

members

using

the

website

's

advanced

search

feature

and

extracted

their

profile

IDs

Using

these

IDs

we

then

downloaded

a

total

of

profiles

virtually

the

entire

CMU

Facebook

population

at

the

time

of

the

study

Demographics

The

majority

of

users

of

the

Facebook

at

CMU

are

undergraduate

students

-LRB-

or

of

all

profiles

see

Table

-RRB-

This

corresponds

to

of

the

total

undergraduate

population

at

CMU

-LSB-

-RSB-

Graduate

students

staff

and

faculty

are

represented

to

a

much

lesser

extent

-LRB-

and

of

the

CMU

population

respectively

-RRB-

The

majority

of

users

is

male

-LRB-

vs.

-RRB-

Table

shows

the

gender

distribution

for

the

different

user

categories

The

strong

dominance

of

undergraduate

users

is

also

reflected

in

the

user

age

distribution

shown

in

Figure

The

vast

majority

of

users

-LRB-

-RRB-

falls

in

the

age

bracket

Overall

the

average

age

is

years

erates

networks

based

on

physical

location

is

by

default

not

available

to

undergraduate

students

However

the

status

of

a

profile

can

easily

be

changed

to

e.g.

graduate

student

for

which

the

feature

is

accessible

Table

Distribution

of

CMU

Facebook

profiles

for

different

user

categories

The

majority

of

users

are

undergraduate

students

The

table

lists

the

percentage

of

the

CMU

population

-LRB-

for

each

category

-RRB-

that

are

users

of

the

Facebook

-LRB-

if

available

-RRB-

Profiles

of

Facebook

Profiles

of

CMU

Population

Undergraduate

Students

Alumni

Graduate

Students

Staff

Faculty

Table

Gender

distribution

for

different

user

categories

Profiles

of

Category

of

CMU

Population

Male

Overall

Female

Male

Undergraduate

Students

Female

Male

Alumni

Female

Male

Graduate

Students

Female

Male

Staff

Female

Male

Faculty

Female

Types

and

Amount

of

Information

Disclosed

The

Facebook

offers

users

the

ability

to

disclose

a

large

and

varied

amount

of

personal

information

We

evaluated

to

which

extent

users

at

CMU

provide

personal

information

Figure

shows

the

percentages

of

CMU

profiles

that

disclose

different

categories

of

information

In

general

CMU

users

of

the

Facebook

provide

an

astonishing

amount

of

information

of

profiles

contain

an

image

of

users

reveal

their

birth

date

list

a

phone

number

-LRB-

including

of

profiles

that

contain

a

cellphone

number

-RRB-

and

list

their

current

residence

The

majority

of

users

also

disclose

their

dating

preferences

-LRB-

male

or

female

-RRB-

current

relationship

status

-LRB-

single

married

or

in

a

relationship

-RRB-

political

views

-LRB-

from

very

liberal

to

very

conservative

-RRB-

and

various

interests

-LRB-

including

music

books

and

movies

-RRB-

A

large

percentage

of

users

-LRB-

-RRB-

that

list

a

relationship

status

other

than

single

even

identify

their

partner

by

name

and/or

link

to

their

Facebook

profile

Note

that

as

further

discussed

below

in

Section

Facebook

profiles

tend

to

be

fully

identified

with

each

participant

's

real

first

and

last

names

both

of

which

are

used

as

the

profile

's

name

In

other

words

whoever

views

a

profile

is

also

able

to

connect

the

real

first

and

last

name

of

a

person

to

the

personal

information

provided

that

may

include

birthday

or

current

residence

Across

most

categories

the

amount

of

information

revealed

by

female

and

male

users

is

very

similar

A

notable

exception

is

the

phone

number

disclosed

by

substantially

more

male

than

female

users

-LRB-

vs.

-RRB-

Single

male

users

tend

to

report

their

phone

numbers

in

even

higher

frequencies

thereby

possibly

signalling

their

elevated

interest

Summer

Job

Favorite

Movies

Favorite

Books

Favorite

Music

Interests

Political

Preference

Relationship

Partner

Relationship

Status

Dating

Interests

Highschool

AIM

Screenname

Phone

Address

Home

Town

Birthday

Profile

Image

Percentage

of

Profiles

Figure

Percentages

of

CMU

profiles

revealing

various

types

of

personal

information

in

making

a

maximum

amount

of

contact

information

easily

available

Additional

types

of

information

disclosed

by

Facebook

users

-LRB-

such

as

the

membership

of

one

's

own

network

of

friends

at

the

home

college

or

elsewhere

last

login

information

class

schedule

and

others

-RRB-

are

discussed

in

the

rest

of

this

paper

Data

Validity

and

Data

Identifiability

The

terms

of

service

of

the

site

encourage

users

to

only

publish

profiles

that

directly

relate

to

them

and

not

to

other

entities

people

or

fictional

characters

In

addition

in

order

to

sign

up

with

the

Facebook

a

valid

email

address

of

one

of

the

more

than

academic

institutions

that

the

site

covers

has

to

be

provided

This

requirement

along

with

the

site

's

mission

of

organizing

the

real

life

social

networks

of

their

members

provides

incentives

for

users

to

only

publish

accurate

information

We

tested

how

valid

the

published

data

appears

to

be

In

addition

we

studied

how

identifiable

or

granular

the

provided

data

is

In

general

determining

the

accuracy

of

the

information

provided

by

users

on

the

Facebook

-LRB-

or

any

other

social

networking

website

-RRB-

is

nontrivial

for

all

but

selected

individual

cases

We

therefore

restrict

our

validity

evaluation

to

the

measurement

of

the

manually

determined

perceived

accuracy

of

information

on

a

randomly

selected

subset

of

profiles

Profile

Names

We

manually

categorized

the

names

given

on

Facebook

profiles

as

being

one

of

the

the

following

Real

Name

Name

appears

to

be

real

Partial

Name

Only

a

first

name

is

given

Fake

Name

Obviously

fake

name

Table

shows

the

results

of

the

evaluation

We

found

of

all

names

to

be

realistic

and

likely

the

true

names

for

the

users

-LRB-

for

example

can

be

matched

to

the

visible

CMU

email

address

provided

as

login

-RRB-

with

only

of

names

obviously

fake

The

percentage

of

people

that

choose

to

only

disclose

their

first

name

was

very

small

Table

Categorization

of

name

quality

of

a

random

subset

of

profile

names

from

the

Facebook

The

vast

majority

of

names

appear

to

be

real

names

with

only

a

very

small

percentage

of

partial

or

obviously

fake

names

Category

Percentage

Facebook

Profiles

Real

Name

Partial

Name

Fake

Name

In

other

words

the

vast

majority

of

Facebook

users

seem

to

provide

their

fully

identifiable

names

although

they

are

not

forced

to

do

so

by

the

site

itself

As

comparison

of

the

profiles

that

include

a

birthday

actually

report

the

fully

identified

birth

date

-LRB-

day

month

and

year

-RRB-

although

again

users

are

not

forced

to

provide

the

complete

information

-LRB-

the

remaining

of

users

reported

only

the

month

or

the

month

and

day

but

not

the

year

of

birth

-RRB-

Assessing

the

validity

of

birth

dates

is

not

trivial

However

in

certain

instances

we

observed

friends

posting

birthday

wishes

in

the

comments

section

of

the

profile

of

a

user

on

the

day

that

had

been

reported

by

the

user

as

her

birthday

In

addition

the

incentives

to

provide

a

fake

birth

date

-LRB-

rather

than

not

providing

one

at

all

which

is

permitted

by

the

system

-RRB-

would

be

unclear

Identifiability

of

Images

on

Profile

The

vast

majority

of

profiles

contain

an

image

-LRB-

see

Section

-RRB-

While

there

is

no

explicit

requirement

to

provide

a

facial

image

the

majority

of

users

do

so

In

order

to

assess

the

quality

of

the

images

provided

we

manually

labelled

them

into

one

of

four

categories

Identifiable

Image

quality

is

good

enough

to

enable

person

recognition

Semi-Identifiable

The

profile

image

shows

a

person

but

due

to

the

image

composition

or

face

pose

the

person

is

not

directly

recognizable

Other

aspects

however

-LRB-

e.g.

hair

color

body

shape

etc.

-RRB-

are

visible

Group

Image

The

image

contains

more

than

one

face

and

no

other

profile

information

-LRB-

e.g.

gender

-RRB-

can

be

used

to

identify

the

user

in

the

image

Joke

Image

Images

clearly

not

related

to

a

person

-LRB-

e.g.

cartoon

or

celebrity

image

-RRB-

Table

shows

the

results

of

labelling

the

profile

images

into

the

four

categories

In

the

majority

of

profiles

the

images

are

suitable

for

direct

identification

-LRB-

-RRB-

Overall

of

images

contain

at

least

some

information

useful

for

identification

Only

a

small

subset

of

of

all

images

are

clearly

not

related

to

the

profile

user

We

repeated

the

same

evaluation

using

randomly

chosen

images

from

Friendster

where

the

profile

name

is

only

the

first

name

of

the

member

-LRB-

which

makes

Friendster

profiles

not

as

identifiable

as

Facebook

ones

-RRB-

Here

the

percentage

of

joke

images

is

much

higher

-LRB-

-RRB-

and

the

percentage

of

images

suitable

for

direct

identification

lower

-LRB-

-RRB-

Friends

Networks

The

Facebook

helps

in

organizing

a

real-life

social

network

online

Since

Facebook

users

interact

with

many

of

the

other

users

directly

in

real-life

often

on

a

daily

basis

the

network

of

friends

may

function

as

profile

fact

checker

potentially

triggering

questions

about

obviously

erroneous

information

Facebook

users

typically

maintain

a

very

large

network

of

friends

On

average

CMU

Facebook

users

list

friends

at

CMU

and

friends

at

other

schools

of

users

have

or

more

CMU

friends

whereas

of

profiles

show

or

more

non-CMU

friends

See

Figure

for

histogram

plots

of

the

distribution

of

sizes

of

the

networks

for

friends

at

CMU

and

elsewhere

This

represents

some

effort

since

adding

a

friend

requires

explicit

confirmation

Data

Visibility

and

Privacy

Preferences

For

any

user

of

the

Facebook

other

users

fall

into

four

different

categories

friends

friends

of

friends

non-friend

users

We

note

that

Friendster

's

profiles

used

to

be

populated

by

numerous

fake

and/or

humorous

profiles

also

called

Fakesters

-LRB-

see

-LSB-

-RSB-

-RRB-

Friendster

management

tried

to

eliminate

fake

profiles

and

succeeded

in

significantly

reducing

their

number

but

not

completely

extirpating

them

from

the

network

Based

on

our

manual

calculations

the

share

of

fake

Friendster

profiles

is

currently

comparable

to

the

share

of

fake

Facebook

profiles

reported

above

Table

Categorization

of

user

identifiability

based

on

manual

evaluation

of

a

randomly

selected

subset

of

images

from

both

Facebook

and

Friendster

profiles

Images

provided

on

Facebook

profiles

are

in

the

majority

of

cases

suitable

for

direct

identification

-LRB-

-RRB-

The

percentage

of

images

obviously

unrelated

to

a

person

-LRB-

joke

image

-RRB-

is

much

lower

for

Facebook

images

in

comparison

to

images

on

Friendster

profiles

-LRB-

vs.

-RRB-

Category

Percentage

Facebook

Profiles

Percentage

Friendster

Profiles

Identifiable

Semi-Identifiable

Group

Image

Joke

Image

Percentage

of

Profiles

Number

of

CMU

Friends

Listed

Percentage

of

Profiles

Number

of

Non-CMU

Friends

Listed

-LRB-

a

-RRB-

Network

of

CMU

friends

-LRB-

b

-RRB-

Network

of

Non-CMU

friends

Figure

Histogram

of

the

size

of

networks

for

both

CMU

friends

-LRB-

a

-RRB-

and

non-CMU

friends

-LRB-

b

-RRB-

Users

maintain

large

networks

of

friends

with

the

average

user

having

friends

at

CMU

and

friends

elsewhere

at

the

same

institution

and

non-friend

users

at

a

different

institution

By

default

everyone

on

the

Facebook

appears

in

searches

of

everyone

else

independent

of

the

searchers

institutional

affiliation

In

search

results

the

users

full

names

-LRB-

partial

searches

for

e.g.

first

names

are

possible

-RRB-

appear

along

with

the

profile

image

the

academic

institution

that

the

user

is

attending

and

the

users

status

there

The

Facebook

reinforces

this

default

settings

by

labelling

it

recom-mended

on

the

privacy

preference

page

Also

by

default

the

full

profile

-LRB-

including

contact

information

-RRB-

is

visible

to

everyone

else

at

the

same

institution

Prior

research

in

HCI

has

shown

that

users

tend

to

not

change

default

settings

-LSB-

-RSB-

This

makes

the

choice

of

default

settings

by

website

operators

very

important

On

the

other

hand

the

site

provides

users

a

very

granular

and

relatively

sophisticated

interface

to

control

the

searchability

and

visibility

of

their

profiles

Undergrad

users

for

example

can

make

their

profiles

searchable

only

to

other

undergrad

users

or

only

users

who

are

friends

or

users

who

are

friends

of

friends

or

users

at

the

same

institution

or

combinations

of

the

above

constraints

In

addition

visibility

of

the

entire

profile

can

be

similarly

controlled

Granular

control

on

contact

information

is

also

provided

Sociological

theories

of

privacy

have

noted

how

an

individual

may

selectively

disclose

personal

information

to

others

in

order

to

establish

different

degrees

of

trust

and

intimacy

with

them

-LRB-

see

-LSB-

-RSB-

-RRB-

In

light

of

these

theories

we

tested

The

Facebook

recently

introduced

a

new

relationship

category

based

on

user

location

e.g.

Pittsburgh

which

we

did

not

consider

in

this

study

how

much

CMU

Facebook

users

take

advantage

of

the

ability

the

site

provides

to

manage

their

presentation

of

sel

-LSB-

ves

-RSB-

By

creating

accounts

at

different

institutions

and

by

using

accounts

with

varying

degree

of

interconnectedness

with

the

rest

of

the

CMU

network

we

were

able

to

infer

how

individual

users

within

the

CMU

network

were

selecting

their

own

privacy

preference

Profile

Searchability

We

first

measured

the

percentage

of

users

that

changed

the

search

default

setting

away

from

being

searchable

to

everyone

on

the

Facebook

to

only

being

searchable

to

CMU

users

We

generated

a

list

of

profile

IDs

currently

in

use

at

CMU

and

compared

it

with

a

list

of

profile

IDs

visible

from

a

different

academic

institution

We

found

that

only

of

users

-LRB-

female

male

-RRB-

made

use

of

this

privacy

setting

Profile

Visibility

We

then

evaluated

the

number

of

CMU

users

that

changed

profile

visibility

by

restricting

access

to

CMU

users

We

used

the

list

of

profile

IDs

currently

in

use

at

CMU

and

evaluated

which

percentage

of

profiles

were

fully

accessible

to

an

unconnected

user

-LRB-

not

friend

or

friend

of

friend

of

any

profile

-RRB-

Only

profiles

-LRB-

-RRB-

in

total

did

not

fall

into

this

category

Facebook

Data

Access

We

can

conclude

that

only

a

vanishingly

small

number

of

users

change

the

-LRB-

permissive

-RRB-

default

privacy

preferences

In

general

fully

identifiable

information

such

as

personal

image

and

first

and

last

name

is

available

to

anybody

registered

at

any

Facebook

member

network

Since

the

Facebook

boasts

a

average

participation

rate

among

undergraduate

students

at

the

hundreds

of

US

institutions

it

covers

and

since

around

of

our

CMU

subset

provides

identifiable

face

images

it

is

relatively

easy

for

anybody

to

gain

access

to

these

data

and

cheap

to

store

a

nation-wide

database

of

fully

identified

students

and

their

IDs

In

other

words

information

suitable

for

creating

a

brief

digital

dossier

consisting

of

name

college

affiliation

status

and

a

profile

image

can

be

accessed

for

the

vast

majority

of

Facebook

users

by

anyone

on

the

website

-LRB-

To

demonstrate

this

we

downloaded

and

identified

the

same

information

for

a

total

of

users

at

Harvard

University

-RRB-

Additional

personal

data

such

as

political

and

sexual

orientation

residence

address

telephone

number

class

schedule

etc.

are

made

available

by

the

majority

of

users

to

anybody

else

at

the

same

institution

leaving

such

data

accessible

to

any

subject

able

to

obtain

even

temporary

control

of

an

institution

's

single

email

address

It

would

appear

that

the

population

of

Facebook

users

we

have

studied

is

by

large

quite

oblivious

unconcerned

or

just

pragmatic

about

their

personal

privacy

Personal

data

is

generously

provided

and

limiting

privacy

preferences

are

sparingly

used

Due

to

the

variety

and

richness

of

personal

information

disclosed

in

Facebook

profiles

their

visibility

their

public

linkages

to

the

members

real

identities

and

the

scope

of

the

network

users

may

put

themselves

at

risk

for

a

variety

of

attacks

on

their

physical

and

online

persona

Some

of

these

risks

are

common

also

in

other

online

social

networks

while

some

are

specific

to

the

Facebook

In

this

section

we

outline

a

number

of

different

attacks

and

quantify

the

number

of

users

susceptible

based

on

the

data

we

extracted

See

Table

for

an

overview

Stalking

Using

the

information

available

on

profiles

on

the

Facebook

a

potential

adversary

-LRB-

with

an

account

at

the

same

academic

institution

-RRB-

can

determine

the

likely

physical

location

of

the

user

for

large

portions

of

the

day

Facebook

profiles

include

information

about

residence

location

class

schedule

and

location

of

last

login

A

students

life

during

college

is

mostly

dominated

by

class

attendance

Therefore

knowledge

of

both

the

residence

and

a

few

classes

that

the

student

is

currently

attending

would

help

a

potential

stalker

to

determine

the

users

whereabouts

In

the

CMU

population

profiles

fall

into

our

definition

of

this

category

-LRB-

female

male

-RRB-

in

that

they

disclose

both

their

current

residence

and

at

least

classes

they

are

attending

Since

our

study

was

conducted

outside

of

the

semester

-LRB-

when

many

students

might

have

deleted

class

information

from

their

profiles

-RRB-

we

speculate

this

number

to

be

even

higher

during

the

semester

A

much

larger

percentage

of

users

is

susceptible

to

a

form

of

cyber-stalking

using

the

AOL

instant

messenger

-LRB-

AIM

-RRB-

Unlike

other

messengers

AIM

allows

users

to

add

buddies

to

their

list

without

knowledge

of

or

confirmation

from

the

buddy

being

added

Once

on

the

buddy

list

the

adversary

can

track

when

the

user

is

online

In

the

CMU

population

of

all

profiles

list

an

AIM

screen

name

for

a

total

of

more

than

users

Re-identification

Data

re-identification

typically

deals

with

the

linkage

of

datasets

without

explicit

identifiers

such

as

name

and

address

to

datasets

with

explicit

identifiers

through

common

attributes

-LSB-

-RSB-

Examples

include

the

linkage

of

hospital

discharge

data

to

voter

registration

lists

that

allows

to

re-identify

sensitive

medical

information

-LSB-

-RSB-

Demographics

re-identification

It

has

been

shown

previously

that

a

large

portion

of

the

US

population

can

be

re-identified

using

a

combination

of

ZIP

code

gender

and

date

of

birth

-LSB-

-RSB-

The

vast

majority

of

CMU

users

disclose

both

their

full

birthdate

-LRB-

day

and

year

-RRB-

and

gender

on

their

profiles

-LRB-

-RRB-

For

of

users

-LRB-

total

of

-RRB-

the

combination

of

birthdate

and

gender

is

unique

within

CMU

In

addition

list

their

current

residence

for

which

ZIP

codes

can

be

easily

obtained

Overall

of

users

list

birthday

gender

and

current

residence

An

adversary

with

access

to

the

CMU

section

of

the

Facebook

could

therefore

link

a

comparatively

large

number

of

users

to

outside

de-identified

data

sources

such

as

e.g.

hospital

discharge

data

Face

Re-Identification

In

a

related

study

we

were

able

to

correctly

link

facial

images

from

Friendster

profiles

without

explicit

identifiers

with

images

obtained

from

fully

identified

CMU

web

pages

using

a

commercial

face

recognizer

-LSB-

-RSB-

The

field

of

automatic

face

recognition

has

advanced

tremendously

over

the

last

decade

and

is

now

offering

a

number

of

commercial

solutions

which

have

been

shown

to

perform

well

across

a

wide

range

of

imaging

conditions

-LSB-

-RSB-

As

shown

in

Section

a

large

number

of

profiles

contain

high

quality

images

At

CMU

more

than

profiles

fall

in

this

category

Potential

de-identified

data

sources

include

other

social

networking

sites

-LRB-

e.g.

Friendster

-RRB-

or

dating

sites

-LRB-

e.g.

Match.com

-RRB-

that

typically

host

anonymous

profiles

Social

Security

Numbers

and

Identity

Theft

An

additional

re-identification

risk

lies

in

making

birthdate

hometown

current

residence

and

current

phone

number

publicly

available

at

the

same

time

This

information

can

be

used

to

estimate

a

person

's

social

security

number

and

exposes

her

to

identity

theft

The

first

three

digits

of

a

social

security

number

reveal

where

that

number

was

created

-LRB-

specifically

the

digits

are

determined

by

the

ZIP

code

of

the

mailing

address

shown

on

the

application

for

a

social

security

number

-RRB-

The

next

two

digits

are

group

identifiers

which

are

assigned

according

to

a

peculiar

but

predictable

temporal

order

The

last

four

digits

are

progressive

serial

numbers

When

a

person

's

hometown

is

known

the

window

of

the

first

three

digits

of

her

SNN

can

be

identified

with

probability

decreasing

with

the

home

state

's

populousness

When

that

person

's

birthday

is

also

known

and

an

attacker

has

access

to

SSNs

of

other

people

with

the

same

birthdate

in

the

same

state

as

the

target

-LRB-

for

example

obtained

from

the

SSN

death

index

or

from

stolen

SSNs

-RRB-

it

is

possible

to

pin

down

a

window

of

values

in

which

the

two

middle

digits

In

fact

of

profiles

have

images

out

of

which

are

estimated

to

be

of

sufficient

quality

for

re-identification

See

and

Table

Overview

of

the

privacy

risks

and

number

of

CMU

profiles

susceptible

to

it

Risk

CMU

Facebook

Profiles

CMU

Facebook

Profiles

-LRB-

Female

-RRB-

-LRB-

Female

-RRB-

Real-World

Stalking

-LRB-

Male

-RRB-

-LRB-

Male

-RRB-

Online

Stalking

Demographics

Re-Identification

Face

Re-Identification

-LRB-

estimated

-RRB-

are

likely

to

fall

The

last

four

digits

-LRB-

often

used

in

unpro-tected

logins

and

as

passwords

-RRB-

can

be

retrieved

through

social

engineering

Since

the

vast

majority

of

the

Facebook

profiles

we

studied

not

only

include

birthday

and

hometown

information

but

also

current

phone

number

and

residence

-LRB-

often

used

for

verification

purposes

by

financial

institutions

and

other

credit

agencies

-RRB-

users

are

exposing

themselves

to

substantial

risks

of

identity

theft

Building

a

Digital

Dossier

The

privacy

implications

of

revealing

personal

and

sensitive

information

-LRB-

such

as

sexual

orientation

and

political

views

-RRB-

may

extend

beyond

their

immediate

impact

which

can

be

limited

Given

the

low

and

decreasing

costs

of

storing

digital

information

it

is

possible

to

continuously

monitor

the

evolution

of

the

network

and

its

users

profiles

thereby

building

a

digital

dossier

for

its

participants

College

students

even

if

currently

not

concerned

about

the

visibility

of

their

personal

information

may

become

so

as

they

enter

sensitive

and

delicate

jobs

a

few

years

from

now

when

the

data

currently

mined

could

still

be

available

Fragile

Privacy

Protection

One

might

speculate

that

the

perceived

privacy

protection

of

making

personal

information

available

only

to

members

of

a

campus

community

may

increase

Facebook

users

willingness

to

reveal

personal

information

However

the

mechanisms

protecting

this

social

network

can

be

circumvented

Adding

to

this

the

recognition

that

users

have

little

control

on

the

composition

of

their

own

networks

-LRB-

because

often

a

member

's

friend

can

introduce

strangers

into

that

member

's

network

-RRB-

one

may

conclude

that

the

personal

information

users

are

revealing

even

on

sites

with

access

control

and

managed

search

capabilities

effectively

becomes

public

data

Fake

Email

Address

The

Facebook

verifies

users

as

legitimate

members

of

a

campus

community

by

sending

a

confirmation

email

containing

a

link

with

a

seemingly

randomly

generated

nine

digit

code

to

the

-LRB-

campus

-RRB-

email

address

provided

during

registration

Since

the

process

of

signing

up

and

receiving

the

confirmation

email

only

takes

minutes

an

adversary

simply

needs

to

gain

access

to

the

campus

network

for

a

very

short

period

of

time

This

can

be

achieved

in

a

number

of

well-known

ways

e.g.

by

attempting

to

remotely

access

a

hacked

or

virus-infected

machine

on

the

network

or

physi-cally

accessing

a

networked

machine

in

e.g.

the

library

etc.

Manipulating

Users

Social

engineering

is

a

well-known

practice

in

computer

security

to

obtain

confidential

information

by

manipulating

legitimate

users

-LSB-

-RSB-

Implementation

of

this

practice

on

the

Facebook

is

very

simple

just

ask

to

be

added

as

someone

's

friend

The

surprisingly

high

success

rate

of

this

practice

was

recently

demonstrated

by

a

Facebook

user

who

using

an

automatic

script

contacted

users

of

the

Facebook

across

the

country

and

asked

to

be

added

as

their

friend

According

to

-LSB-

-RSB-

users

accepted

thirty

percent

of

Facebook

users

are

willing

to

make

all

of

their

profile

information

available

to

a

random

stranger

and

his

network

of

friends

Advanced

Search

Features

While

not

directly

linked

to

from

the

site

the

Facebook

makes

the

advanced

search

page

of

any

college

available

to

anyone

in

the

network

Using

this

page

various

profile

information

can

be

searched

for

e.g.

relationship

status

phone

number

sexual

preferences

political

views

and

-LRB-

college

-RRB-

residence

By

keeping

track

of

the

profile

IDs

returned

in

the

different

searches

a

significant

portion

of

the

previously

inaccessible

information

can

be

reconstructed

Online

social

networks

are

both

vaster

and

looser

than

their

offline

counterparts

It

is

possible

for

somebody

's

profile

to

be

connected

to

hundreds

of

peers

directly

and

thousands

of

others

through

the

network

's

ties

Many

individuals

in

a

person

's

online

extended

network

would

hardly

be

defined

as

actual

friends

by

that

person

in

fact

many

may

be

complete

strangers

And

yet

personal

and

often

sensitive

information

is

freely

and

publicly

provided

In

our

study

of

more

than

CMU

users

of

the

Facebook

we

have

quantified

individuals

willingness

to

provide

large

amounts

of

personal

information

in

an

online

social

network

and

we

have

shown

how

unconcerned

its

users

appear

to

privacy

risks

while

personal

data

is

generously

provided

limiting

privacy

preferences

are

hardly

used

only

a

small

number

of

members

change

the

default

privacy

preferences

which

are

set

to

maximize

the

visibility

of

users

profiles

Based

on

the

information

they

provide

online

users

expose

themselves

to

various

physical

and

cyber

risks

and

make

it

extremely

easy

for

third

parties

to

create

digital

dossiers

of

their

behavior

These

risks

are

not

unique

to

the

Facebook

However

the

Facebook

's

public

linkages

between

an

individual

profile

and

the

real

identity

of

its

owner

and

the

Facebook

's

perceived

connection

to

a

physical

and

ostensibly

bounded

community

-LRB-

the

campus

-RRB-

make

Facebook

users

a

particularly

interesting

population

for

our

research

Our

study

quantifies

patterns

of

information

revelation

and

infers

usage

of

privacy

settings

from

actual

field

data

rather

than

from

surveys

or

laboratory

experiments

Still

the

relative

importance

of

the

different

drivers

influencing

Facebook

users

information

revelation

behavior

has

to

be

quantified

Our

evidence

is

compatible

with

a

number

of

different

hypotheses

In

fact

many

simultaneous

factors

are

likely

to

play

a

role

Some

evidence

is

compatible

with

a

signalling

hypothesis

-LRB-

see

Section

-RRB-

users

may

be

prag-matically

publishing

personal

information

because

the

benefits

they

expect

from

public

disclosure

surpass

its

perceived

costs

Yet

our

evidence

is

also

compatible

with

an

interface

design

explanation

such

as

the

acceptance

-LRB-

and

possibly

ignorance

-RRB-

of

the

default

permeable

settings

-LRB-

see

Section

-RRB-

Peer

pressure

and

herding

behavior

may

also

be

influencing

factors

and

so

also

myopic

privacy

attitudes

-LRB-

see

-LSB-

-RSB-

-RRB-

and

the

sense

of

protection

offered

by

the

-LRB-

perceived

-RRB-

bounds

of

a

campus

community

Clarifying

the

role

of

these

different

factors

is

part

of

our

continuing

research

agenda

We

would

like

to

thank

Anne

Zimmerman

and

Bradley

Ma-lin

for

first

bringing

the

Facebook

to

our

attention

We

would

also

like

to

thank

danah

boyd

Lorrie

Cranor

Julie

Downs

Steven

Frank

Julia

Gideon

Charis

Kaskiris

Bart

Nabbe

Mike

Shamos

Irina

Shklovski

and

four

anonymous

referees

for

comments

This

work

was

supported

in

part

by

the

Data

Privacy

Lab

in

the

School

of

Computer

Science

and

by

the

Berkman

Fund

at

Carnegie

Mellon

University

-LSB-

-RSB-

A.

Acquisti

Privacy

in

electronic

commerce

and

the

economics

of

immediate

gratification

In

Proceedings

of

the

ACM

Conference

on

Electronic

Commerce

-LRB-

EC

-RRB-

pages

-LSB-

-RSB-

B.

Anderson

Imagined

Communities

Reflections

on

the

Origin

and

Spread

of

Nationalism

Verso

London

and

New

York

revised

edition

-LSB-

-RSB-

S.

Arrison

Is

Friendster

the

new

TIA

TechCentralStation

January

-LSB-

-RSB-

J.

Black

The

perils

and

promise

of

online

schmoozing

BusinessWeek

Online

February

-LSB-

-RSB-

J.

Brown

Six

degrees

to

nowhere

Salon.com

September

-LSB-

-RSB-

D.

Cave

to

Pentagon

has

your

number

and

more

The

New

York

Times

June

-LSB-

-RSB-

d.

boyd

Reflections

on

friendster

trust

and

intimacy

In

Intimate

-LRB-

Ubiquitous

-RRB-

Computing

Workshop

Ubicomp

October

Seattle

Washington

USA

-LSB-

-RSB-

d.

boyd

Friendster

and

publicly

articulated

social

networking

In

Conference

on

Human

Factors

and

Computing

Systems

-LRB-

CHI

-RRB-

April

Vienna

Austria

-LSB-

-RSB-

J.

Donath

and

d.

boyd

Public

displays

of

connection

BT

Technology

Journal

-LSB-

-RSB-

S.

Gerstein

Intimacy

and

privacy

In

F.

D.

Schoeman

editor

Philosophical

Dimensions

of

Privacy

An

Anthology

Cambridge

University

Press

Cambridge

UK

-LSB-

-RSB-

M.

Granovetter

The

strength

of

weak

ties

American

Journal

of

Sociology

-LSB-

-RSB-

M.

Granovetter

The

strength

of

weak

ties

A

network

theory

revisited

Sociological

Theory

-LSB-

-RSB-

R.

Gross

Re-identifying

facial

images

Technical

report

Carnegie

Mellon

University

Institute

for

Software

Research

International

In

preparation

-LSB-

-RSB-

R.

Gross

J.

Shi

and

J.

Cohn

Quo

vadis

face

recognition

In

Third

Workshop

on

Empirical

Evaluation

Methods

in

Computer

Vision

-LSB-

-RSB-

K.

Jump

A

new

kind

of

fame

The

Columbian

Missourian

September

-LSB-

-RSB-

A.

Leonard

You

are

who

you

know

Salon.com

June

-LSB-

-RSB-

S.

Li

and

A.

Jain

editors

Handbook

of

Face

Recognition

Springer

Verlag

-LSB-

-RSB-

H.

Liu

and

P.

Maes

Interestmap

Harvesting

social

network

profiles

for

recommendations

In

Beyond

Personalization

IUI

January

San

Diego

California

USA

-LSB-

-RSB-

W.

Mackay

Triggers

and

barriers

to

customizing

software

In

Proceedings

of

CHI

pages

ACM

Press

-LSB-

-RSB-

S.

Milgram

The

small

world

problem

Psychology

Today

-LSB-

-RSB-

S.

Milgram

The

familiar

stranger

An

aspect

of

urban

anonymity

In

S.

Milgram

J.

Sabini

and

M.

Silver

editors

The

Individual

in

a

Social

World

Essays

and

Experiments

Addison-Wesley

Reading

MA

-LSB-

-RSB-

K.

Mitnick

W.

Simon

and

S.

Wozniak

The

art

of

deception

controlling

the

human

element

of

security

John

Wiley

Sons

-LSB-

-RSB-

A.

Newitz

Defenses

lacking

at

social

network

sites

SecurityFocus

December

-LSB-

-RSB-

P.

Phillips

P.

Flynn

T.

Scruggs

K.

Bowyer

J.

Chang

K.

Hoffman

J.

Marques

J.

Min

and

J.

Worek

Overview

of

the

face

recognition

grand

challenge

In

IEEE

Conference

on

Computer

Vision

and

Pattern

Recognition

June

San

Diego

California

USA

-LSB-

-RSB-

P.

Samarati

and

L.

Sweeney

Protecting

privacy

when

disclosing

information

k-anonymity

and

its

enforcement

through

generalization

and

cell

suppression

Technical

report

SRI

International

-LSB-

-RSB-

I.

Sege

Where

everybody

knows

your

name

Boston.com

April

-LSB-

-RSB-

L.

J.

Strahilevitz

A

social

networks

theory

of

privacy

The

Law

School

University

of

Chicago

John

M.

Olin

Law

Economics

Working

Paper

No.

-LRB-

Series

-RRB-

December

-LSB-

-RSB-

L.

Sweeney

k-Anonymity

a

model

for

protecting

privacy

International

Journal

on

Uncertainty

Fuzziness

and

Knowledge-based

Systems

-LRB-

-RRB-

-LSB-

-RSB-

L.

Sweeney

Uniqueness

of

simple

demographics

in

the

U.S.

population

Technical

report

Carnegie

Mellon

University

Laboratory

for

International

Data

Privacy

-LSB-

-RSB-

The

Facebook

Privacy

policy

August

-LSB-

-RSB-

University

Planning

Carnegie

Mellon

Factbook

Carnegie

Mellon

University

February

-LSB-

-RSB-

D.

Watts

Six

Degrees

The

Science

of

a

Connected

Age

W.W.Norton

Company

facebook
online privacy
social networking sites
data visibility
information revelation
online social networking
online behavior
privacy
social network theory
college
stalking

privacy risk
re-identification
privacy perference
information relevation