Facebook Figured Out a Family Secret and Won't Tell Me How(gizmodo.com)
gizmodo.com
Facebook Figured Out a Family Secret and Won't Tell Me How
http://gizmodo.com/facebook-figured-out-my-family-secrets-and-it-wont-tel-1797696163
43 comments
Create an anonymous account on Twitter.
Use the tags #firstname #lastname #fb and add public personal details about someone you know who works at Facebook.
Here is how:
1. Go to LinkedIn and search for people who work at FB 2. Go to Google and find everything you can about the person (bonus points for finding some embarrassing stuff) 3. Go to Twitter and use the tags and post the info
If enough people do it, it will give the folks who work at FB a real taste of what it feels like to be on the receiving end of such disconcerting revelations.
But it gets better - you can now use the tags to find intimate personal information about other people! Just search for folks who work at Facebook and go and look them up on Twitter. If you don't find anything juicy, then why not take a few minutes to add something? Since Mark himself has declared that we live in the age where "privacy is over", I am sure everyone he would be overjoyed to watch this unfold.
Besides, the aggregation of such information at a single place will allow us to slice and dice the data in interesting ways. Maybe we can ask the very smart fellas who work at FB to provide us some kind of open source tool to mine that information. I even have a suggestion for the name of such a tool: OpenDox
Use the tags #firstname #lastname #fb and add public personal details about someone you know who works at Facebook.
Here is how:
1. Go to LinkedIn and search for people who work at FB 2. Go to Google and find everything you can about the person (bonus points for finding some embarrassing stuff) 3. Go to Twitter and use the tags and post the info
If enough people do it, it will give the folks who work at FB a real taste of what it feels like to be on the receiving end of such disconcerting revelations.
But it gets better - you can now use the tags to find intimate personal information about other people! Just search for folks who work at Facebook and go and look them up on Twitter. If you don't find anything juicy, then why not take a few minutes to add something? Since Mark himself has declared that we live in the age where "privacy is over", I am sure everyone he would be overjoyed to watch this unfold.
Besides, the aggregation of such information at a single place will allow us to slice and dice the data in interesting ways. Maybe we can ask the very smart fellas who work at FB to provide us some kind of open source tool to mine that information. I even have a suggestion for the name of such a tool: OpenDox
Regardless of how egregious Facebook's behavior, encouraging behavior that increases exposure of people's personal details is not an appropriate response. If you think it's wrong for Facebook to do it, it's just as wrong for anyone else.
> such as when a psychiatrist told me that her patients were being recommended to one another, indirectly outing their medical issues.
Facebook keeps recommending to me (I'm over 45) a bunch of young women with anorexia. It's creepy as fuck, and I hate it. They do this because I visit different mental health hospitals.
It should be obvious: don't use hospitals as part of the recommendation algorithm.
Facebook keeps recommending to me (I'm over 45) a bunch of young women with anorexia. It's creepy as fuck, and I hate it. They do this because I visit different mental health hospitals.
It should be obvious: don't use hospitals as part of the recommendation algorithm.
How does FB know where you visit? Assuming you mean physically visit, not just browse to their FB page.
Every page you visit that has a like button on it, facebook knows you've visited that website.. porn, news, whatever.. they know what you're looking at on the internet.
Even if you don't have a facebook account, you still get a cookie so they follow you online and build a profile of your browsing habits.
Even if you don't have a facebook account, you still get a cookie so they follow you online and build a profile of your browsing habits.
I think it's fairly obvious your father probably has a number in his phone of your grandfather or one of the relatives and so does Rebecca so it joins the dots.
But how would Facebook know that, if her father doesn't use it?
Maybe her father has WhatsApp installed, or Instagram
> “People don’t always like some of their PYMK suggestions, so one action people can take to control People You May Know is to ‘X’ out suggestions that they are uninterested in,” the spokesperson wrote via email.
...providing Facebook with one more datapoint. I tried to use Facebook while limiting the amount of data it could gather, but quickly realised that it's pretty much impossible.
My current strategy is to add somewhat random datapoints, like hitting random keys and liking/attending those. Still, the results that come up that way are still pre-sorted by Facebook, and there's still a lot of high-quality data I provide Facebook with for them to deduct _a lot_. I guess it's just a simple step to make their work more difficult, having to also incorporate that their data might perhaps not be perfect.
...providing Facebook with one more datapoint. I tried to use Facebook while limiting the amount of data it could gather, but quickly realised that it's pretty much impossible.
My current strategy is to add somewhat random datapoints, like hitting random keys and liking/attending those. Still, the results that come up that way are still pre-sorted by Facebook, and there's still a lot of high-quality data I provide Facebook with for them to deduct _a lot_. I guess it's just a simple step to make their work more difficult, having to also incorporate that their data might perhaps not be perfect.
Someday we're going to get a WE/Lifetime thriller/suspense movie where families in some dead end murder case find their suspect through the "people you may know" feature, and are completely ignored by police "for reasons".
What do they mean they don't know how Facebook found out? Facebook imports your contacts and then it uses a combination of data you give it and public records data and it just builds linked lists it then walks.
A very creepy link is possible. For years, companies like Facebook have been compiling profiles on the habits of users browsing the web via tracking cookies. Additional data is collected over time until they know virtually everything about all kinds of people, even if they've never signed up for any website ever. It is very possible that just by browsing the web randomly built up Jim and James's profiles, and searching for the same funeral home created a weak (but potential) connection, which could then be strengthened by mapping other data between their mutual contacts.
But I suspect a simpler explanation exists:
"My father was adopted by a man whose last name was Hill, and he didn’t find out about his biological father until adulthood. [...] A few years ago, my father eventually did meet his biological father, along with two uncles and an aunt, when they sought him out during a trip back to Ohio for his mother’s funeral. [...] My father had met [Rebecca's] husband in person that one time, after my grandmother’s funeral. They exchanged emails, and my father had his number in his phone."
So Kashmir's grandmother died in Ohio, and her father knew her, and so did his biological father, and so did Rebecca's husband. If the grandmother ever had a Facebook, and her son's and her son's father's phone numbers, she would provide a link between Jim and James, and thus a path from Kashmir to Rebecca. Rebecca might also have had Kashmir's grandmother's phone number. If the grandmother and grandfather also were ever married, or lived at the same address, public records could link them.
Regardless of the connection, if you add enough data from enough people over time, even if they are 6 or 7 or 8 links away from each other, the connections can be made, without even creepy tracking stuff.
(Apologies in advance for the huge post)
'John Porter': { records: '1215 Wash Ave,Akron,OH, 555-0001', siblings: 'James Porter' }
'James Porter': { records: '1215 Wash Ave,Akron,OH, 555-8901, [email protected]', contacts: '555-0001, 555-1234', spouse: 'Rebecca Porter' }
'Rebecca Porter': { records: '1215 Wash Ave,Akron,OH, 555-1234, facebook.com/rebeccap, [email protected]', contacts: '555-8901' }
'Jim Hill': { records: '9030 Stine Blvd,Miami,FL, 555-5678, [email protected]', contacts: '555-2345', children: 'Kashmir Hill' }
'Kashmir Hill': { records: '9030 Stine Blvd,Miami,FL 555-2345, facebook.com/kashmirh, [email protected]', contacts: '555-5678' }
A very creepy link is possible. For years, companies like Facebook have been compiling profiles on the habits of users browsing the web via tracking cookies. Additional data is collected over time until they know virtually everything about all kinds of people, even if they've never signed up for any website ever. It is very possible that just by browsing the web randomly built up Jim and James's profiles, and searching for the same funeral home created a weak (but potential) connection, which could then be strengthened by mapping other data between their mutual contacts.
But I suspect a simpler explanation exists:
"My father was adopted by a man whose last name was Hill, and he didn’t find out about his biological father until adulthood. [...] A few years ago, my father eventually did meet his biological father, along with two uncles and an aunt, when they sought him out during a trip back to Ohio for his mother’s funeral. [...] My father had met [Rebecca's] husband in person that one time, after my grandmother’s funeral. They exchanged emails, and my father had his number in his phone."
So Kashmir's grandmother died in Ohio, and her father knew her, and so did his biological father, and so did Rebecca's husband. If the grandmother ever had a Facebook, and her son's and her son's father's phone numbers, she would provide a link between Jim and James, and thus a path from Kashmir to Rebecca. Rebecca might also have had Kashmir's grandmother's phone number. If the grandmother and grandfather also were ever married, or lived at the same address, public records could link them.
Regardless of the connection, if you add enough data from enough people over time, even if they are 6 or 7 or 8 links away from each other, the connections can be made, without even creepy tracking stuff.
(Apologies in advance for the huge post)
The more data we give FaceBook, Google, Amazon the more powerful they become. There is a good chance we don't even realize we are giving them data due to agreements in place between companies. I can totally seeing Facebook buying genetic data from 23&me, or family tree data from ancestry and using that to recommend people.
That is why I will NOT do ancestry.com's DNA testing kit. I fear WHO will get that information and WHAT they will do with it in the future. Maybe when I get older an insurance company will deny me health coverage because I showed a genetic marker for cancer or heart disease or ...
Let alone what government agencies may have access to this stuff.
I want to find out where I am from but not at the expense of privacy.
This stuff freaks me out and people are just like "la dee dah here is my DNA". blink
Let alone what government agencies may have access to this stuff.
I want to find out where I am from but not at the expense of privacy.
This stuff freaks me out and people are just like "la dee dah here is my DNA". blink
I actually did 23&me but I didn't use my real name. Paid with a prepaid card. They don't actually verify your personal identity, so at least there is that possibility.
Although, I'm sure if they tried, they could figure out who I am through connections of others and public records, they don't seem dead set on collecting personal details about me (unlike Facebook).
I am still curious how Facebook asks my friends details about me. If I chose not to share it, don't ask my dumb aquantances who will give up every detail they know about me.
Although, I'm sure if they tried, they could figure out who I am through connections of others and public records, they don't seem dead set on collecting personal details about me (unlike Facebook).
I am still curious how Facebook asks my friends details about me. If I chose not to share it, don't ask my dumb aquantances who will give up every detail they know about me.
Wrt dna testing, my feeling is this: I don't want to be a voyeur of my families past, i want to be its friend.
I wont ever give my dna simply because i want to keep family secrets secret. To honor their wishes. One of the worst cases is you find out your father isn't your father. Or gf or ggf etc..
This article [1] is an example.
Family secrets should be kept secret.
I can imagine matching dna to pregnancy terminations.
Just don't submit your dna at all.
[1] http://goo.gl/8RMztZ
I wont ever give my dna simply because i want to keep family secrets secret. To honor their wishes. One of the worst cases is you find out your father isn't your father. Or gf or ggf etc..
This article [1] is an example.
Family secrets should be kept secret.
I can imagine matching dna to pregnancy terminations.
Just don't submit your dna at all.
[1] http://goo.gl/8RMztZ
You're not alone. I refuse to 23&me for the same reason.
I looked into private sequencing, but decided to wait a few years until there were more companies in the market and the price came down. I believe at the time (a year ago?) it was USD$2-10k.
I looked into private sequencing, but decided to wait a few years until there were more companies in the market and the price came down. I believe at the time (a year ago?) it was USD$2-10k.
23andMe says they don't sell your data.
> We will not sell, lease, or rent your individual-level information (i.e., information about a single individual's genotypes, diseases or other traits/characteristics) to any third-party or to a third-party for research purposes without your explicit consent.
(https://www.23andme.com/about/privacy/)
I would really hope other sites like ancestry.com have the same policy.
> We will not sell, lease, or rent your individual-level information (i.e., information about a single individual's genotypes, diseases or other traits/characteristics) to any third-party or to a third-party for research purposes without your explicit consent.
(https://www.23andme.com/about/privacy/)
I would really hope other sites like ancestry.com have the same policy.
The thing is, if 23andMe ever goes bankrupt and/or gets sold to another company, that privacy policy won't mean squat. This isn't a theoretical concern either: data aggregators like Experian are constantly vacuuming up the corpses of failed startups for their data. Considering that once your generic profile is compromised, it's forever (not just for you, but for all your relatives and descendants) and there's nothing you can do, do you want to risk that 23andMe will exist, with no management changes that might undo the policy, indefinitely?
Yes, I think RadioShack is probably the most famous example for sceptics. The US legal system really is that bad.
Although Analemma_'s concerns of post-company sales are also on my mind, my major concern is alignment of interests.
Similar to Google, 23&me as a viable business operation is predicated on monetizing genetic information. They're performing testing at a loss in order to collect as much as possible.
Consequently, whatever their policy may be, I have little faith they'll make a privacy-centric decision for me as an individual when faced with a business choice. Their valuation essentially depends on their not doing so!
Similar to Google, 23&me as a viable business operation is predicated on monetizing genetic information. They're performing testing at a loss in order to collect as much as possible.
Consequently, whatever their policy may be, I have little faith they'll make a privacy-centric decision for me as an individual when faced with a business choice. Their valuation essentially depends on their not doing so!
FWIW 23&me reserves the right to sell anonymized aggregate data.
Also, when you say "I have little faith they'll make a privacy-centric decision when faced with a business choice", you make it sound like you think they'll intentionally violate their privacy policy in order to make money, but, and IANAL so maybe I'm wrong, I thought privacy policies like this were in fact legally binding, and if they decide to start selling PII info we can sue them?
Also, when you say "I have little faith they'll make a privacy-centric decision when faced with a business choice", you make it sound like you think they'll intentionally violate their privacy policy in order to make money, but, and IANAL so maybe I'm wrong, I thought privacy policies like this were in fact legally binding, and if they decide to start selling PII info we can sue them?
I have a marked lack of faith in contractual language's ability to safeguard privacy in cutting edge technical matters, where there is any gray area.
"We promise to anonymizing your data, but we will sell it" is a huge gray area.
Are there legal standards for anonymizing data? To what degree? What type of protections are required for the un-anonymized data 23&me holds on their servers? What about any mapping data that allows anonymous products to be deanonymized? What obligations is 23&me under in regards to any future data products they offer with remixed data? What happens if their data products are found to expose individuals via third party information unmasking or statistical attacks? Am I entitled to be made aware of products 23&me sells that include my anonymizing data? If not, and it's custom deals struck in a backroom, how am I able to ensure any anonymization meets my standards? Etc.
"We promise to anonymizing your data, but we will sell it" is a huge gray area.
Are there legal standards for anonymizing data? To what degree? What type of protections are required for the un-anonymized data 23&me holds on their servers? What about any mapping data that allows anonymous products to be deanonymized? What obligations is 23&me under in regards to any future data products they offer with remixed data? What happens if their data products are found to expose individuals via third party information unmasking or statistical attacks? Am I entitled to be made aware of products 23&me sells that include my anonymizing data? If not, and it's custom deals struck in a backroom, how am I able to ensure any anonymization meets my standards? Etc.
It's not just anonymized, it's aggregated. I suppose the phrasing is slightly ambiguous, but my impression is that they don't sell "anonymized OR aggregated" data but "anonymized AND aggregated".
It flip flops between the two phrasings depending on what portion of the document you're reading.
In general, I don't mean to say that 23&me has a bad privacy policy. They simply have one written by lawyers in the interest of the company's value and flexibility, while at the same time allay fears over information disclosure.
Personally, I'd like a higher standard for somewhere that stores my genetic information. Especially if a company's interests are at odds with mine ('If you're not paying, you are the product,' etc).
Phrasing like, "We may provide additional notice and ask for your consent if we wish to share your information with our commonly owned entities in a materially different way than discussed in this Privacy Statement" creeps the hell out of me.
Especially if they end up getting re-absorbed into the Google family as a backdoor to collecting genetic information with less risk to Alphabet.
In general, I don't mean to say that 23&me has a bad privacy policy. They simply have one written by lawyers in the interest of the company's value and flexibility, while at the same time allay fears over information disclosure.
Personally, I'd like a higher standard for somewhere that stores my genetic information. Especially if a company's interests are at odds with mine ('If you're not paying, you are the product,' etc).
Phrasing like, "We may provide additional notice and ask for your consent if we wish to share your information with our commonly owned entities in a materially different way than discussed in this Privacy Statement" creeps the hell out of me.
Especially if they end up getting re-absorbed into the Google family as a backdoor to collecting genetic information with less risk to Alphabet.
> I thought privacy policies like this were in fact legally binding...
This has never been tested in court and so the "bindingness" of privacy policies is ambiguous (see http://lawprofessors.typepad.com/contractsprof_blog/2010/08/...). Even in the best-case, if you wanted to have standing to sue for a privacy policy violation, you'd have to prove not just that it happened, but that you were materially harmed by it, which is a tough hurdle to clear.
But that's all moot anyway, since privacy policies can be changed at any time. If a company wants to violate their existing policy, they just change it first.
This has never been tested in court and so the "bindingness" of privacy policies is ambiguous (see http://lawprofessors.typepad.com/contractsprof_blog/2010/08/...). Even in the best-case, if you wanted to have standing to sue for a privacy policy violation, you'd have to prove not just that it happened, but that you were materially harmed by it, which is a tough hurdle to clear.
But that's all moot anyway, since privacy policies can be changed at any time. If a company wants to violate their existing policy, they just change it first.
It's easy to get someone's DNA though. Strand of hair, etc.
I have trouble thinking that even the most monopolistic of companies today would put in the effort to collect the DNA of literally everybody by finding strands of hair or the like. If you you send it to them, though, that's another story.
Google drove cars taking pictures of every street around the world and even sent people with camera backpacks up mountains and the like.
It's not hard to imagine them doing something similar with DNA, beginning in public spaces like restaurants and coffee shops, before pursuing further out nodes on the graph.
It's not hard to imagine them doing something similar with DNA, beginning in public spaces like restaurants and coffee shops, before pursuing further out nodes on the graph.
Physical access vs. Internet access - two very different things.
There's a big difference in obtaining someone's hair vs people paying to give you their dna.
She forgot about searches. If you search for someone, and browse to their timeline (I am not sure how many times this needs to happen), you will eventually be recommended to that person as "someone they might know,” and vice versa.
Unless you read something in the article that I missed this wasn't the case. The suggested person, Rebecca, appeared in her "people you might know" list and she didn't dig in to figure out who it was until after that happened.
What isn't clear to me is if the investigation into the PYMK suggestions was because of the appearance of Rebecca in Ms. Hill's list, or if she was discovered as a suggestion during the course of an unrelated investigation into how the PYMK suggestions list is generated. Owing to the types of research-driven journalism I've come in across from her in the past, it was probably the latter, but I didn't read anything that directly stated it (or if it was, I missed it).
What isn't clear to me is if the investigation into the PYMK suggestions was because of the appearance of Rebecca in Ms. Hill's list, or if she was discovered as a suggestion during the course of an unrelated investigation into how the PYMK suggestions list is generated. Owing to the types of research-driven journalism I've come in across from her in the past, it was probably the latter, but I didn't read anything that directly stated it (or if it was, I missed it).
Yeah, I bet this is source #1
I just assume if the Facebook app is on a phone it will use all resources - microphone, camera, GPS, contacts, email, and other contents - to make connections. It's all-pervasive and really inescapable.
I strongly believe that when online companies have a lot of personal information like FB they should not assume users will have a better overall user experience if the service uses offline data that the user doesn't explicitly authorize to be used in conjunction with their online account/profile.