Why privacy scandals don’t scare us off social media

Facebook knows who we message, the calls we make and the contacts in our phones, so why aren't we all closing our accounts? Max Towle investigates.

Have you ever tried deleting your private messages? Mark Zuckerberg did, once. Not just so he could no longer see them, but so the recipients of the messages couldn't either. On a non-descript day in 2015, college pals, friends and colleagues found their old conversations with Facebook's co-founder and chief executive had vanished. They could see their own messages, but nothing from the Zuck. Was he embarrassed about immature comments he had made in the past? Or, more likely, had he realised the importance of privacy? At least his own.

Since 2015, Zuckerberg has been blasted for the lack of security around people's personal data. Early last year it was revealed that Cambridge Analytica, a political consulting company, had harvested personal data from millions of people's Facebook profiles. And in September 2018, another security breach allowed hackers access to almost 50 million accounts. Then in December, internal documents revealed Facebook had given digital giants like Microsoft, Spotify, Netflix and Amazon greater access to people's data than it had disclosed. Netflix and Spotify had been given the ability to read users' private messages.

Around the time Zuckerberg was wiping away his digital footprint, Auckland software engineer Rafael Fonseca tried the same trick. A Brazilian emigrant, Fonseca joined Facebook to keep in touch with family and friends he had left behind. Over the next few years, it seemed like he was being asked for more and more personal information - his phone number, his address, his contacts book - he was uncomfortable giving.

As someone who works in IT, Fonseca says he knows more than most about "how the sausage is made," and so when incredibly specific adverts started appearing on his Facebook newsfeed, he was alarmed.

"These weren't even ads that were similar to things I had searched, some were related to private message conversations I was having, and even conversations in real life. That's when it got really creepy." Despite his knowledge of the "sausage," he felt there were privacy invasions happening he didn't fully understand, and the lack of transparency worried him. He deleted his account.

Fonseca remains, however, a frequent user of the messaging and calling app WhatsApp. "Pretty much everyone in Brazil uses WhatsApp, including my family. It's just the easiest tool to use - everyone in my family has a phone number and it's free to call. For some, it's the only way I can keep in contact."

Yet it means the privacy-minded software engineer hasn't entirely escaped Facebook. WhatsApp is owned by Facebook, and there is some sharing of data with its parent company. "I do feel iffy about being on WhatsApp, but it's a necessity thing. I need to be able to reach out to my family," says Fonseca. "It's the evil I've accepted."

Zuckerberg changes tack

Last week, Zuckerberg did an extraordinary pivot. In a lengthy blog he outlined his vision for the next few years: to transform Facebook into a "privacy-focused platform." He suggested the social network of the future would focus on more one-to-one interactions - including different forms of secure private messaging - rather than the traditional public newsfeed.

Eventually, he said, the company would unify its three most popular products - WhatsApp, Messenger and Instagram. For instance, someone on WhatsApp would be able to message someone on Instagram. In terms of increasing people's privacy, Zuckerberg said users would be given the option of deleting their message history after a period of time of their choosing. What he didn't make clear was whether Facebook would stop collecting data about people's browsing behaviour.

In the digital community, there was a collective rolling of the eyes. Some viewed Zuckerberg's manifesto as an apology of sorts, or a glorified public relations exercise. The tech king is known for making grand pronouncements that never amount to anything. In 2014 he announced an anonymous login feature. Last year he announced a function that would allow people to completely clear their browsing history. Neither has yet eventuated.

Security breaches aside, 2018 was a bad year for Facebook and Zuckerberg. The company's stock lost more than a fifth of its value as the threat of regulation from various governments loomed. Facebook is also on the cusp of a multi-billion dollar fine following a year-long investigation by the Federal Trade Commission into its privacy practices.

What Google and Facebook know about you

The "evil" we've accepted, as Rafael Fonseca puts it, is vast. At InternetNZ's headquarters in central Wellington, the organisation's outreach and engagement director, Andrew Cushen, has his Facebook page open on his laptop. He is demonstrating how much information the site stores about him. "I hope nothing embarrassing comes up as we do this."

He navigates his way to an advertising profile page Facebook has created, based on what he's previously clicked on. (These insights are sold to advertisers.) "Apparently, I would be interested in products made by Barkers and Rockstar Games, and I'm interested in British pop music," Cushen says.

He opens Google and there's a map that shows locations he's visited around the world. Another privacy-minded person, Cushen has his location history turned off, yet Google can ascertain places he's visited by other means. "It shows I visited Planet Hollywood in the US - that's probably because I uploaded a photo from there at some stage." He also has his browser history turned off, yet he notices it recorded that he watched a Foo Fighters video yesterday. "That must mean Google is connected to my TV," he realises. "I must disable that tonight."

The frightening store of information both Facebook and Google keep seems endless. For instance, Google knows everything you've ever searched and every app you use, including how often you do so. It also knows with whom you interact, your YouTube history, which events you've attended, and just about every photo you've taken and every email you've sent. The personal data it stores about you would fill millions of Word documents.

Facebook, too, knows every message you've ever sent or been sent, the contacts in your phone, how you shop, the games you play, the music you listen to; it even knows every sticker you've ever sent, including that cute one of Olaf from Frozen chilling by a pool.

"All of these similar companies have different ways of collecting data on us," says Cushen. "And to be fair, we've never had more control over protecting our data. Yet that control can be difficult [to execute]."

He points out how his advertising profile is buried a few menus deep, and how a recent study found if the average person tried to read all the terms and conditions of every service they used, it would take dozens of work days every year.

Whether we like it or not, Cushen says most of us understand we've made a deal. By gaining access to free sites like Facebook, we're paying by giving up our information. "There's no such thing as a free lunch," he says. Facebook's entire revenue model is based on advertising. Google provides a free worldwide mapping service that costs billions of dollars to run. "The Cambridge Analytica scandal shocked us so much partly because it wasn't how we thought the deal worked, and every time we think we've wrapped our heads around it, the deal changes."

Where's the mass exodus?

Despite the privacy scandals, there hasn't been a mass exodus from Facebook. According to the site, the number of people who logged in at least once a month jumped 9 percent last year to 2.32 billion people. The company's stock is rebounding, while the popularity of WhatsApp and Instagram is still growing.

Yet, it would be unfair to say people don't care about their online privacy. Earlier this year, research commissioned by InternetNZ found 94 percent of people are concerned about the security of personal data. But 9 in 10 people said the positives of the internet outweigh the negatives.

Dr Ethan Plaut, a lecturer in media and communication at the University of Auckland, says most people know they're haemorrhaging data, but many don't know how to protect themselves. "A lot of people also intuitively believe they should disconnect from social media, but that's just not realistic." He says disconnection is a luxury, and something that's less practical for people in lower socio-economic positions. "Who is actually going to great lengths to protect their privacy? Usually, it's the more informed, and those with the means of finding and paying for alternatives."

Another popular response when it comes to online privacy is the "I have nothing to hide," argument, he says, which again comes from a position of privilege. "I'm a bourgeois white man living in a democratic country. What I, for instance, have to hide is of far less concern than someone living in a dictatorship, or even people of colour, LGBTQ people and other vulnerable groups."

Victoria University professor Dr Kathleen Kuehn, who has researched digital privacy issues, says the consequences of people giving up their personal data seem innocuous because, as one of her students once put it, "there are no dead bodies."

There are those like Rafael Fonseca and Andrew Cushen who frequently notice when ads appear that seem too familiar, but they're in the minority. "People rarely experience an apparent violation of their privacy," she says. "When it comes to online privacy they're far more worried about someone tagging them in a photo they don't want to be tagged in, or their banking details being kept safe."

The monopolisation of the internet

Kuehn is bored of having the same conversation - doing the same interview - over and over. Online privacy. Do we care? Why should we care? Why don't we care enough? "Am I still going to be answering the same questions in 10 years time? I don't know, probably." She says the more pressing concern is the increasing monopolisation of the internet, or "platform capitalism."

By connecting Facebook, Instagram and WhatsApp, Zuckerberg is continuing to create an internet within the internet, where platforms like Facebook are the new infrastructure. "The platform is becoming the dominant business model," she says. "Facebook connects advertisers, it connects businesses, it connects game developers, it connects academics and not-for-profit organisations. Facebook is becoming a marketplace and it's right there monitoring and collecting the data."

She says an outcome of this is the site can determine what access we have to certain resources. Facebook is just one example, she says, of a platform driven by data that gives it advantages over competitors. Amazon, once known as an online shopping site, is now the largest e-commerce marketplace. Late last year the EU began investigating how it was gathering information on sales made by competitors and whether it was creating an edge when it sells to customers. Google has invested in ventures unrelated to its search engine, such as ecommerce, self-driving cars and, of course, social media.

In an essay on the subject, King's College London lecturer Nick Srnicek cites John Deere as an example of a smaller, burgeoning platform that now "links together farmers, seed producers, chemical producers, equipment sensors, tractors, and more. All the while John Deere itself extracts the data and uses it to improve its services to customers (such as making better predictions about when and where to plant a particular crop) [and] to improve its products".

Most small businesses can't afford to avoid Facebook so end up surrendering their data, says Kuehn. Buying and selling is often easiest on the site. "As the online world trends towards platforms, we're left with fewer alternatives and fewer choices, but what are we supposed to do - go live in a hole somewhere?" The issue is still privacy and data, but in a less obvious way, and people aren't asking the right questions, says Kuehn. "The biggest concern is what's going to happen to this endless mine of information in the future? The purpose right now seems to be for advertising and sales, but we can't predict what will happen in five, 10 or 15 years' time, when these platforms have generated profiles of almost our entire lives."

Who's watching the watchers?

In June 2006, then-US Senator Ted Stevens made pop culture history when he referred to the internet as a "series of tubes". The quote went viral. There's even a Wikipedia page for it. What made his limited understanding of the internet so funny was the fact he, at the time, headed a committee charged with regulating the internet.

Fast-forward to April last year, when Mark Zuckerberg was called to face questions from the US Senate on privacy and data mining following the Cambridge Analytica scandal. While no one described Facebook as a series of tubes, the ignorance was equally apparent. "How do you sustain a business model in which users don't pay for your service?" Zuckerberg was asked. "Senator, we run ads," he replied. "Why am I suddenly seeing chocolate ads all over Facebook?" another asked. Their average age was 62. These are the US lawmakers tasked with regulating Facebook.

"They were clueless," says Kuehn. "But to be fair to them, regulating Facebook is probably quite low down in the list of things they need to worry about." She says the end goal is regulation, "but the technology is evolving too quickly for regulators, and our current antiquated policies don't protect us the way they should. Politicians, especially in the US and Silicon Valley, where many of these companies originate from, need to think about a fundamental change in the sale and retention of date."

Here in New Zealand, Facebook doesn't operate within the Privacy Act (written in 1993), even if the Privacy Commissioner believes it should. A Privacy Bill that would require organisations to notify the public about any privacy breaches is currently before a select committee.

Internationally, the ball is starting to roll. Last May, the European Union implemented a new regulation that aims to give more control to people regarding their personal data. One of the changes requires Facebook to be more upfront about data collection. But almost a year on, Facebook and the EU are still clashing about how the regulation is implemented.

World Internet Project director Jeff Cole says Zuckerberg's announcement last week was an admission that Facebook's current way of doing things is unsustainable. He says the site is swiftly losing the trust of international governments, advertisers and its users.

"Consumers have an enormous amount of power and have to be listened to." The simple act of updating your privacy settings on social media is important, he says. Cole predicts a reckoning for Facebook, and eventually the other "big five" (Apple, Amazon, Google and Microsoft). "We think governments around the world are going to crack down very soon on Facebook and there will be stronger regulation. Once that gets going, it will be a domino effect."

What else is under the carpet?

The data scandals of last year didn't lead to an "I told you so" moment for Rafael Fonseca. While they did validate his suspicions which drove him to delete his account, he says he is more concerned about what else is under the carpet. "If this was happening, what else might there be that we're not aware of? What came out is just what they were caught for."

In 2014, during his TED Talk on why privacy matters, journalist Glenn Greenwald described a tongue-in-cheek challenge he had devised for skeptics - send him their email passwords and allow him to read, and possibly publish, whatever he wanted. He said all of us have things to hide - we know what we want to share and what to keep to ourselves. Yet the ramifications of knowing the latter isn't happening can be massive. "Mass surveillance creates a prison in the mind that is a much more subtle, though much more effective, means of fostering compliance with social norms … and is much more effective than brute force could ever be."

In response to the same question Greenwald posed, Andrew Cushen playfully bristles. "Of course I'm not going to show you my messages with my wife, not because I have anything to hide, but because it's none of your goddamn business. Just because people have nothing to hide, doesn't mean they should accept external companies rummaging through their digital sock draws."

In his manifesto, Zuckerberg promises to protect the privacy of the sock draws of more than 2.3 billion people. "Privacy gives people the freedom to be themselves and connect more naturally, which is why we build social networks," he wrote, echoing Greenwald. "I believe we should be working towards a world where people can speak privately and live freely knowing that their information will only be seen by who they want to see it and won't all stick around forever."

Whether this happens will likely be determined as much by Facebook itself - a platform that's only accruing more power - as regulators belatedly going after the data-collecting ad business.