SEKE 2012 Proceedings - Knowledge Systems Institute

How Social Network APIs Have Ended the Age of Privacy
Derek Doran, Sean Curley, and Swapna S. Gokhale
Dept. of Computer Science & Engineering
University of Connecticut, Storrs, CT, 06269
{derek.doran,smc08002,ssg}@engr.uconn.edu
Abstract
Online Social Networks (OSNs) have captured our imagination
by offering a revolutionary medium for communication
and sharing. Skeptics, however, contend that these
OSNs pose a grave threat to privacy. This paper seeks to examine
the veracity of this skepticism by analyzing the APIs
of six popular OSNs for their propensity to violate user privacy.
Our analysis lends substantial support to this skepticism
by finding that OSNs: (i) facilitate an extensive collection
of user information; (ii) provide default access to information
of new users; (iii) do not seek comprehensive permissions;
(iv) request these permissions ambiguously; and
(v) offer privacy settings that enable only limited control.
1 Introduction and Motivation
Online Social Networks (OSNs) are now tightly knit
into the fabric of our society. People are overwhelmingly
participating in these OSNs regardless of their age, socioeconomic,
and demographic status [10]; approximately 50%
of all U.S. adults, and over 90% of all Gen-Y members use
OSNs. Moreover, the growth in the user base is staggering,
and is occurring in unconventional segments; recent data
suggests a 90% increase in users over 50 years old, while
only a 13% increase in users aged 18 to 29 [9].
OSNs can be designed for a variety of purposes. Some
such as Facebook and Orkut offer a platform to stay connected
with friends and acquaintances. Microblogging sites
such as Twitter provide a modern news ticker to simultaneously
stream current events and friends’ updates [4].
OSNs also offer portals to share opinions and recommendations
about products and brands; and users vastly aff rm
their trust in these peer recommendations over advertisements
[1]. Many organizations thus seek to harness OSNs
to raise brand awareness, build reputation, and stay relevant.
Besides their commercial potential, OSNs can also serve as
channels of societal transformation; the recent Egyptian political
unrest may have been precipitated with the support of
social media such as Facebook and Twitter [13].
The API of an OSN is a collection of public and open
access methods for third parties to interact with the OSN.
These APIs can be used to systematically harvest user information,
and hence, commercial organizations exploit these
APIs to collect user data for several purposes [2, 4, 14].
Most APIs also expose methods to enhance the usability of
OSN services; the Twitter API enables posts from mobile
devices, the YouTube API allows integration with TVs, and
the Facebook API facilitates photo uploads directly from
digital cameras. OSNs design their APIs to attract third parties
to harvest user data or to integrate their social features
into commercial products. Thus, through these APIs, OSNs
seek to embed themselves deeper into the daily experiences
of their users. These APIs thus need to be sophisticated for
third parties to collect meaningful information to offer novel
services. However, the higher the porosity of the APIs, the
greater is the chance that third parties will misuse them to
acquire unnecessary personal data and compromise user privacy.
OSNs thus have to balance the conf icting priorities of
providing a rich API against protecting user privacy.
OSNs balance these competing concerns through a careful
consideration of three aspects in the design of their APIs.
First, they build these APIs to expose a wealth of user information.
However, they then cede control back to their users
by offering a range of privacy settings on their accounts, and
by requiring third parties to seek permissions from users before
collecting their information. Users can protect their privacy
through these settings and permissions by limiting the
information that third parties can retrieve. Figure 1 shows
how privacy settings and permissions form a protective barrier
between access queries and user information.
Most users, especially certain groups such as seniors and
minors, are very fascinated by the novel communication capabilities
of OSNs, and do not appreciate their wide reach
and impact [5]. They do not realize that their shared information
may be used to their detriment by various agencies
(law enforcement, insurance, and employers) and even criminals.
For example, the Center for American Progress suggests
that had the Egyptian movement been unsuccessful,
the same OSNs that supported this movement would have
provided adequate information to track down and persecute
the protesters [13]. Even worse, they do not acknowledge
the necessity to adjust and benef t from the privacy settings
on their accounts [12]. Finally, third parties usually seek
400