Digital Identity Blog

Thought leadership for cybersecurity, fraud and digital channel professionals

What You Say on Facebook Stays on Facebook…Maybe. Lawsuit Accuses Company of Mining Private Messages for Advertisers.

By ThreatMetrix
ThreatMetrix®, The Digital Identity Company®, is the market-leading cloud solution for authenticating digital personas and transactions on the Internet. Verifying more than 20 billion annual transactions supporting 30,000 websites and 4,000 customers globally through the ThreatMetrix Digital Identity Network®, ThreatMetrix secures businesses and end users against account takeover, payment fraud and fraudulent account registrations resulting from malware and data breaches.
Follow ThreatMetrix ThreatMetrix's Most Recent Posts:

In mining private messages, has Facebook dug itself a hole? That’s what a federal court is going to have to decide. The question is clear cut. Should a social media user, who pays nothing for the service which earns revenue selling user information to advertisers, have a right to expect his/her information will be kept private?

And, while the question is clear cut, the answer is anything but. Writing on, Antone Gonsalves tackles a case, which one day might end up before the Supreme Court.

The lawsuit filed in federal court in Northern California seeks class-action status for all Facebook users allegedly duped into believing that they could send confidential messages. Specifically, the suit says Facebook has violated the federal Electronics Communications Privacy Act and California privacy laws.

Facebook has allegedly gone wrong by scanning private messages containing links to websites and searching the destinations for clues about the sender that it can sell to advertisers, marketers and other data aggregators.

The plaintiffs argue that Facebook implied the opposite when it launched its integrated email and messaging service in November 2010.

“Facebook telegraphs through the use of the words ‘privately’ and ‘private’ that when a user sends a private message to another party, only the user and the intended recipient will be privy to the contents of that communication,” the suit says.

Plaintiffs Matthew Campbell, Pulaski County, Ark., and Michael Hurley, North Plains, Ore., are seeking the greater of either $100 a day for each day of violation or $10,000 for each affected user, plus damages under California law.

Facebook denies any wrongdoing. “We believe the allegations are without merit and we will defend ourselves vigorously,” the company said in a statement emailed to Computerworld.

Expecting privacy from an ad-driven Web site that needs to check all posted links for malware and spam is ludicrous, Anton Chuvakin, research director for security and risk management at Gartner, said. “Frankly, this is an idiotic suit,” he said. “If the message is really private, as in secret, use encrypted email or hand-deliver it. Why is it on Facebook?”

Of course, the social network has the responsibility of clearly explaining what it does with all user-generated content, so the courts will have to decide whether Facebook was misleading in the use of the word private with its email service.

In the meantime, experts say the suit should remind companies that all business communications should be done through corporate email. Essentially, only information meant to be public should go out on a social network on behalf of the company.

“All social networking companies at this point are making their revenue via advertising and all are using data mining techniques to target ads in one way or another,” Jody Brazil, president and chief technology officer for security management company FireMon, said. “As such, communication must be considered semi-public regardless of how it is posted.”

For easier monitoring of social media use, companies need to have a strict policy that only authorized employees can post content on behalf of the business, privacy expert Rebecca Herold said. In addition, posted content should never contain information about a company’s intellectual property, employees, customers or partners.

“All organizations, in all industries, need to have social media policies in place for not only Facebook, but also for all other social media sites,” Herold said.

By ThreatMetrix Posted