Nomination for the Australian Privacy Foundation ‘Big Brother Awards’ 2011
BBA2011 FINALIST

Criteria for a BBA2011 Award
The purpose of these Awards is to publicise privacy-abusive behaviour.  A responsible approach is adopted.  
As appropriate for the particular Award Category the nominee should be a public or private sector individual or organization, a government program or initiative, or a private sector business activity:
•	in or associated with Australia
•	responsible for a truly outstanding abuse (or defence) of privacy.
For a nominee to be considered, they need to be identified, their acts or behaviours that warrant an Award need to be briefly described, and some evidence needs to be provided, preferably both some originating with the nominee itself, and some from other sources such as the media. The deed for which they are nominated should have at least partially been put into practice – they lose points for just planning or announcing something!  Further details about BBA2010-11 are available at http://www.privacy.org.au/bba/.

A.   Name of Nominee 

Facebook

B.   Award Category: Privacy Abuser Categories for an “Orwell” Award -

Worst Corporate Invader – for a corporation that has shown a blatant disregard for privacy.

C.   Description
Award is for blatant and continual disregard of the privacy of users and the personal data of all individuals, including third parties who have not given permission for personal information to be submitted to Facebook.

Facebook is a very popular social networking site with over 500 million active users [1]. Half of those users log on to Facebook each day and users of the site spend collectively over 700 billion minutes per month on Facebook [1]. Over 20 million software applications are installed each day which are developed in more than 190 different countries [1]. Facebook has a considerable social presence on the Internet and is a collector, handler and user of vast amounts of personal information. Facebook has received, and continues to receive, much criticism regarding its privacy invasive activities. Yet Facebook continues to 'push the envelope' regarding the implementation and use of privacy protections for its users. For example:
-  In late 2007, Facebook released a feature called Beacon that enabled third-party websites (particularly commercial sites) to gather data about users and pass it to Facebook, for automatic publication [2]. Facebook was eventually forced by a class-action lawsuit to abandon the Beacon program in November 2009 and pay a $US 9.5 million settlement [3].
-   In December 2009, Facebook unilaterally declared particular information, including 'lists of friends', to be "publicly available", with no privacy setting [4]. This breached prior undertakings to users, and created physical danger for those who lived in countries subject to repressive regimes.  
-   In August 2010, Facebook announced a new service called 'Places' which makes user location routinely available to other users [5]. Places allows users to "check in" at locations which will then be shared with their friends.  The use of location data can cause safety and privacy concerns [6]
-   At the beginning of 2011, Facebook amended a dialogue box to invite users to approve their home addresses and phone number being accessible by third-party developers [5].  Commentators saw this as part of an attempt by Facebook to succeed where other initiatives had failed (such as Microsoft Passport) and become the dominant identity management hub. Strong negative reactions forced the company to backtrack within a few days [7] 
 
Throughout this time, Facebook's privacy policy has been constantly criticized for its unnecessary complexity and its gradual erosion of privacy protections for users, as amply demonstrated by a historical timeline of the policy constructed by the Electronic Frontier Foundation (EFF) [8].

Finally, the details of an instant messaging transcript that took place in 2004 which involved Facebook's creator Mark Zuckerberg were released without authorisation. The transcript revealed that Zuckerberg considered Facebook users as 'Dumb fucks' for trusting him [9].

[1] http://www.facebook.com/press/info.php?statistics
[2] http://news.cnet.com/8301-13577_3-9826664-36.html
[3] http://arstechnica.com/web/news/2009/09/facebook-beacon-shines-for-last-time-as-part-of-settlement.ars
[4] http://news.cnet.com/8301-19518_3-10416524-238.html
[5] http://epic.org/privacy/facebook/
[6] http://www.guardian.co.uk/technology/2010/aug/19/facebook-places-location-tool-unveiled
[7] http://developers.facebook.com/blog/post/447
[8] http://www.eff.org/deeplinks/2010/04/facebook-timeline/
[9] http://www.theregister.co.uk/2010/05/14/facebook_trust_dumb/

D.   Evidence of the Actions and References
1.	Criticisms of Facebook have been so numerous and substantial that the Wikipedia editors have accepted the need for a specific page on the topic: http://en.wikipedia.org/wiki/Criticism_of_Facebook
2.	The Electronic Privacy Information Center has catalogued numerous privacy concerns in relation to Facebook: http://epic.org/privacy/facebook/#intro
3.	An overview of the succession of issues 2004-10: http://www.rogerclarke.com/DV/PrivCorp.html#FB

E.  Why the Nominee Deserves the Award
Scope
Facebook is probably the most popular social networking site on the Interent with hundreds of millions of users. An absence of privacy protection by Facebook impacts a vast number of individuals. Yet despite its position as a behemoth of social networking, Facebook has continued to erode privacy protections for its users. For example, Facebook has frequently imposed new features on users without prior notice or consent that include:
-     non-conservative default settings, such as the incorporation of full email address books [5]
-	inadequate granularity in privacy settings [10]
-	complex and unhelpful user interfaces for managing privacy settings [11]
-	unannounced, arbitrary changes variously to privacy settings, the user interfaces whereby they can be managed, and the effects of the settings that users have already 
-	lack of clarity about whether and how data can actually be deleted [12]
-	implementation of non-member search facilities, without user consent, that opened up limited 'public profiles' to search engines such as Google.
[10] http://www.nytimes.com/2010/05/13/technology/personaltech/13basics.html?_r=1
[11] http://www.stevenmansour.com/writings/2007/jul/23/2342/2504_steps_to_closing_your_facebook_account
[12] http://www.cs.virginia.edu/felt/privacy/

Seriousness
The continuing presence and growth of Facebook on the Internet means the site is effectively becoming a source of social checking. Facebook is used as an information validation service even though information provided on Facebook is often subsequently used out of context, For example, a recent study of HR departments conducted by Microsoft found that 70% of US employers rejected potential employees because of information found about them online [13]. 43% of US HR departments had also turned down a potential employee based on inappropriate comments written by friends or relatives [14]. Individual Internet users are effectively being judged by comments on Facebook that are not even their own. Facebook must develop and implement meaningful privacy protection. At the very least, those that operate Facebook should understand that individuals exist in a world separate to their Facebook identity and both Facebook users and the information they provide need to be treated with respect and dignity.
[13] http://blogs.technet.com/b/privacyimperative/archive/2010/01/27/microsoft-releases-a-study-on-data-privacy-day.aspx
[14] http://www.concurringopinions.com/archives/2010/03/googling-employees-why-your-online-reputation-matters.html

F.  Other Comments (including Nominee Response)

On 21 March 2011 this nomination form was FAXED to the Facebook Corporation’s head office in Palo Alto for the attention of the Vice President of Advertising and Global Operations for comment by 8 April 2011. We used a fax because we were unable to find an email address for the Vice President or for the head office of Facebook. A copy of the form was also emailed to a Manager within Facebook.  No response to the fax or email was received by the Coordinator of BBA2011 by 9 April 2011.