Managing Technology

Leaving 'Friendprints': How Online Social Networks Are Redefining Privacy and Personal Security

A generation is growing up with social networking web sites such as Facebook and MySpace, casually posting accounts of their lives for their friends -- and the world -- to see. Few of these users realize that the information they post, when combined with new technologies for gathering and compiling data, can create a fingerprint-like pattern of behavior. The information provides opportunities not only for legitimate business purposes, but also for the nefarious aims of identity thieves and other predators, according to faculty at Wharton and elsewhere.

"The way privacy has traditionally been defined is being challenged," according to Wharton legal studies professor Andrea Matwyshyn, who earlier this year organized the Information Security Best Practices Conference at Wharton. Among other topics, the conference addressed security and safety issues raised by the social networks.

Research on online social networking and how it may alter privacy norms is just beginning, according to technology observers. "Our kids today will give everything [in terms of personal information] away, but it's not at all clear how this will shake out in the long run," says Wharton marketing professor Peter S. Fader. "Privacy is a moving target."

Mining the Data

Lance Hoffman, a George Washington University computer science professor who spoke at the Wharton conference, noted that by giving up such information as their name, birth date, and a list of their network of friends, users are revealing far more than they know. Third-party applications, he argued, can take that data outside of the friendly confines of a social networking site and combine it with data from other sources to piece together enough information to steal a person's identity. Just a person's name and birth date -- routinely found on a Facebook profile -- can be a useful lever for an identity thief, said Hoffman.

At the conference, Hoffman illustrated how social connections are made online and the ease with which a stranger can become part of a network. He noted that he is regularly added to mailing lists and invited to become a friend -- or "friended" in the social network parlance -- of businesses that use the sites as a marketing tool. Indeed, pages used by businesses on Facebook were recently redesigned to look more like those of individuals.

In addition, the line between professional networking on a site such as LinkedIn, and social networking on sites such as Facebook, "has become very thin," said Hoffman. Many Facebook users might create a more casual persona for themselves on that site than they would on LinkedIn, where they would include nothing but professional information. But both sites can be seen by potential employers and clients -- and complications can ensue. One such complication: When a business contact from the LinkedIn world wants to become your friend on Facebook, do you accept the invitation, giving them access to the photos on your Facebook profile from last summer's rowdy beach party?

And what about the person you don't really know who wants to be your friend because you have some friends in common? According to Hoffman, that new friend may just be mining your social circle for information. As networks grow and more friends of friends (and their friends) are accepted by users, it's unclear who can be trusted.

Ultimately, social networking security rests with each user of the service (those friend invitations can always be declined). Hoffman recommended that social network denizens know the privacy policies -- governing, among other things, how the information you provide can be used -- of the sites they frequent.

Private Here, Not There

Research conducted by Alessandro Acquisti, a Carnegie Mellon University professor of public policy and management who also spoke at the conference, has found that individuals' notions of privacy are malleable depending on the context of an interaction. According to Acquisti, people are more likely to divulge key personal information -- their photo, birthday, hometown, address and phone number -- on social networking sites than they would on other web sites. His 2005 study highlighted privacy concerns such as online and physical stalking.

"People [say] privacy [is] important to them, yet they engage in behaviors that indicate a remarkable lack of concern," Acquisti told the conference participants. "Privacy decision making and valuations are malleable," but it's unclear what factors lead to more disclosure. One of those factors might be a "herding effect," he said. In one study, Acquisti found that that people will divulge information when they see others doing so. That tendency, he believes, may explain why so many people are willing to dish out personal information on the networks.

Information gleaned from such sites is useful not only to identity thieves, but to marketers and other legitimate business interests. Sometimes, the information can be used to find thieves, according to research co-authored by Shawndra Hill, a Wharton professor of operations and information management, and AT&T researchers Deepak K. Agarwal, Robert Bell and Chris Volinsky. Hill says a person's pattern of behavior on various networks can reveal tell-tale signatures, similar to fingerprints -- or perhaps "friendprints" -- that can be used to solve a wide range of business challenges, from targeted marketing and advertising to fraud detection.

The study, titled "Building an Effective Representation for Dynamic Networks," originated as an approach to fraud in the telecommunications industry. The authors were interested in the problem of identifying phone service subscribers who repeatedly default on their bills by signing up for service under an alias. The problem is not new. However, the focus of the paper was to show how to clearly identify a customer's social network signature and match it to signatures created by customers who had previously defaulted. "Repetitive defaulters may be identified despite their aliases over time by their 'social network signature,'" according to the paper.

"In other words, consumers are who they call, e-mail or IM," says Hill. "Though it is not difficult to sign up under an alias, it is extraordinarily difficult to change one's friends and family." Large telecommunications firms, Internet providers and social networking sites such as MySpace and Facebook may have rich sets of data in which social network signatures can be identified. Hill says the technique is still being perfected; its accuracy rate is currently about 95%.

Click here to read an expanded version of this article.