- CyberCrime Center
January 17, 2014
In mining private messages, has Facebook dug itself a hole? That’s what a federal court is going to have to decide. The question is clear cut. Should a social media user, who pays nothing for the service which earns revenue selling user information to advertisers, have a right to expect his/her information will be kept private?
And, while the question is clear cut, the answer is anything but. Writing on csoonline.com, Antone Gonsalves tackles a case, which one day might end up before the Supreme Court.
The lawsuit filed in federal court in Northern California seeks class-action status for all Facebook users allegedly duped into believing that they could send confidential messages. Specifically, the suit says Facebook has violated the federal Electronics Communications Privacy Act and California privacy laws.
Facebook has allegedly gone wrong by scanning private messages containing links to websites and searching the destinations for clues about the sender that it can sell to advertisers, marketers and other data aggregators.
The plaintiffs argue that Facebook implied the opposite when it launched its integrated email and messaging service in November 2010.
“Facebook telegraphs through the use of the words ‘privately’ and ‘private’ that when a user sends a private message to another party, only the user and the intended recipient will be privy to the contents of that communication,” the suit says.
Plaintiffs Matthew Campbell, Pulaski County, Ark., and Michael Hurley, North Plains, Ore., are seeking the greater of either $100 a day for each day of violation or $10,000 for each affected user, plus damages under California law.
Facebook denies any wrongdoing. “We believe the allegations are without merit and we will defend ourselves vigorously,” the company said in a statement emailed to Computerworld.
Expecting privacy from an ad-driven Web site that needs to check all posted links for malware and spam is ludicrous, Anton Chuvakin, research director for security and risk management at Gartner, said. “Frankly, this is an idiotic suit,” he said. “If the message is really private, as in secret, use encrypted email or hand-deliver it. Why is it on Facebook?”
Of course, the social network has the responsibility of clearly explaining what it does with all user-generated content, so the courts will have to decide whether Facebook was misleading in the use of the word private with its email service.
In the meantime, experts say the suit should remind companies that all business communications should be done through corporate email. Essentially, only information meant to be public should go out on a social network on behalf of the company.
“All social networking companies at this point are making their revenue via advertising and all are using data mining techniques to target ads in one way or another,” Jody Brazil, president and chief technology officer for security management company FireMon, said. “As such, communication must be considered semi-public regardless of how it is posted.”
For easier monitoring of social media use, companies need to have a strict policy that only authorized employees can post content on behalf of the business, privacy expert Rebecca Herold said. In addition, posted content should never contain information about a company’s intellectual property, employees, customers or partners.
“All organizations, in all industries, need to have social media policies in place for not only Facebook, but also for all other social media sites,” Herold said.
ThreatMetrix secures Web transactions against account takeover, payment fraud, identity spoofing, malware, and data breaches. The ThreatMetrix Global Trust Intelligence Network, which analyzes 500 million monthly transactions, provides context-based authentication and Web fraud prevention to help companies accelerate revenue, reduce costs and eliminate friction. ThreatMetrix protects more than 1,900 customers and 9,000 websites across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government, and insurance. For more information, visit www.threatmetrix.com or call 1-408-200-5755.
Posted by Dan Rampe
Tags: Account Takeover, Account Takeover Fraud, Bank Fraud, CNP fraud, Cookieless Device Identification, Cookies, Credit Card Fraud, Cyber attacks, Cyber Warfare, Data Breach, Device Detection, Device Fingerprint, Device Fingerprinting, Device ID, Device Identification, Facebook, Fraud Prevention, Hacking, Identity Spoofing, Identity theft, Malware, Malware Detection, Malware Protection, Man-in-the-Browser Detection, MitB, Mobile fraud, Online Fraud, Phishing, Phishing Detection, PII, Privacy, ThreatMetrix, ThreatMetrix Cybercrime Index, ThreatMetrix Global Trust Intelligence Network, ThreatMetrix Web Fraud Map, TrustDefender Cybercrime Protection Platform, Web Fraud