Are Your Facebook Friends Revealing Secrets?

NOTE: This post has been updated in consideration of Matt McKeon’s desire to have only a single image posted from his infographic.

A lot has been made about Facebook’s flirting relationship with member privacy. Controls are much improved, but now the greatest challenge is users understanding of all those settings.

This issue came to my attention while drafting an e-mail to an individual who I have never met that works on a different continent. I use Outlook 2010 for an e-mail client with the Outlook Social Connector plugin. Much to my surprise, the Outlook Social Connector status panel displayed all of this individual’s Facebook status updates, plus, as an added bonus, wall postings authored by others.

Could this person, holding a technical position with a large global travel technology company, be a complete moron when it comes to social network privacy practices?”

After a little research, I came to the stark realization that my own Facebook privacy settings were configured to provide this same degree of insecurity for my friends’ wall posts. Considering myself an enlightened, social media-aware, privacy-conscious geek, I had paid considerable attention to the security settings impacting my wall posts, but apparently paid considerably less attention to the privacy of wall posts made by others.

Oblivious Exhibitionists
Below is a screenshot of the Outlook Social Connector data caught my eye. As far as I can tell, this is a great example of how Facebook privacy for the “Things Others Share” by setting “Can See Wall Posts By Friends” to “Friends of Friends” suddenly enables wall posts to be viewed by the author’s “Friends of a Friend’s Friends” as well.

Nothing too salacious going on on David’s wall, but I was able to discover that his birthday was September 11, his age, and that on September 3, he was planning a night out with his wife. The problem of course, is what happens when something that should remain private gets posted and winds up being viewed by the wrong audience. If one has complete control over the actions of their highly responsible friends, there is nothing to worry about… Now, back to reality…

A Process Only Rube Golberg Could Love
The obvious question is if there is some method to view a friend’s privacy settings for posts made on their walls. You can guess the answer.

There is not a Facebook function that presents that information – ironically, revealing that information would violate the friend’s privacy.

There is one method – actively testing the privacy settings by entering temporary wall posts and evaluating the outcome. To prepare for testing, you will need to set up:

• One bogus Facebook account with you as the only friend (creating an artificial Friend of Friend relationship)
• A second bogus Facebook account with no friends (producing a generic Facebook Member relationship)
• A separate browser to anonymously interrogate that friend’s Facebook pages (serving as a proxy for an Internet User)

I can’t imagine anyone wanting to go through this process to evaluate where their wall post would be visible – it would be much easier to a) not care, or b) not to post at all.

The Root of All Evil
The All Facebook blog described the issue most succinctly: Wall Posts Were Meant To Be Public. The problem is that from my perspective, most Facebook users either don’t agree or understand the ramifications of that statement.

Contributing to the confusion is Facebook’s ongoing “upgrades” to its privacy policies. In April 2010, the default setting for viewership of a “public” wall post changed from Friends of Friends to Everyone (technically, not really Everyone, just all Internet users, so the total is only about 2 Billion people.)

Thanks to the great work by Matt McKeon, the evolution of Facebook’s Default Privacy Settings have been documented.

Matt created an animated version of the infographic, but below is a summary of each iteration:.

• 2005 – Original default Facebook privacy settings –
  – Only Friends see Contact Info, Birthday & Other Contact Data
  – Friends of Friends Only see Wall Posts and Photos
  – All Facebook Users see Name, Picture, Gender & Networks
• 2007 – Birthday and Other Profile Data get expanded to include Friends of Friends
• 2009 November – Name, Picture, Gender & Networks are expanded to entire Internet. Friends extended to all Facebook Users. Likes introduced & published to Friends of Friends
• 2009 December – Friends & Likes get expanded to entire Internet

Now distribution of Facebook information using the default settings looks like this:

In summary, if one signs up for a new Facebook account, by default, the distribution of only their contact information is limited to Friends. Birthdays are only shared with Friends of Friends (unless like my non-friend, Dave, you have lots of people posting birthday wishes on your wall…) Everything else flows out unabated to the Internet.

Tags – Protection for Socially Active Facebookers
It is clear that the privacy of posts to friends walls are subject to the recipient’s personal peccadilloes and that it may be difficult to discern if they are socially selective or depraved.

Fortunately, there is one technique to take control over the distribution of your posts. The secret is to use tagging to apply privacy settings to posts for friends’ walls.

The process is simple – Those familiar with Twitter will see some marked similarities:

• Use your own Facebook Status Update to create the post – that will give you access to privacy settings on the post (look for the little lock icon next to the Share button – If there isn’t one, you are writing directly on your friend’s wall – go back to your own wall.)
• Type an “@” and you will be able to tag a friend to start the post. Then write the post.
• Click the Lock Icon to set the desired privacy level.
• Share the post – It will appear on both your wall and your friend’s wall, but your security settings will override the ones governing your friend’s wall.

This approach provides the same post-specific privacy control for posts to a friend’s wall as one’s own wall.

For inexplicable reasons, this All Facebook video describes the process, but uses the ridiculous example of sending a post that can only be viewed by the recipient – Isn’t that exactly what Sending a Message does?

Regardless, the same process works for sending a message that may only be viewed by the recipient and Friends, so pretend he is using that scenario for the example.

Enhancement Requests
A simple way for Facebook to clear up the confusion surrounding privacy for posts on friend’s walls would be for Facebook to include the privacy padlock functionality to the friend’s wall. The default setting could be pulled from the friend’s privacy settings and the author could easily override the setting as they deemed appropriate.

True, this may put a damper on the concept of Wall Posts Are Meant To Be Public, but it dramatically enhances user privacy controls in a non-invasive manner.

Finally, ReclaimPrivacy.org had a cool little Facebook privacy scanner, but the volunteer effort has not been updated yet to accommodate the new Facebook privacy settings – hopefully they will be able to get it back online soon – it was a very helpful tool.