Facebook’s ability to figure out the “people we might know” is sometimes eerie. Many a Facebook user has been creeped out when a one-time Tinder date or an ex-boss from 10 years ago suddenly pops up as a friend recommendation. How does the big blue giant know?
While some of these incredibly accurate friend suggestions are amusing, others are alarming, such as this story from Lisa*, a psychiatrist who is an infrequent Facebook user, mostly signing in to RSVP for events. Last summer, she noticed that the social network had started recommending her patients as friends—and she had no idea why.
“I haven’t shared my email or phone contacts with Facebook,” she told me over the phone.
The next week, things got weirder.
Most of her patients are senior citizens or people with serious health or developmental issues, but she has one outlier: a 30-something snowboarder. Usually, Facebook would recommend he friend people his own age, who snowboard and jump out of planes. But Lisa told me that he had started seeing older and infirm people, such as a 70-year-old gentleman with a walker and someone with cerebral palsy.
“He laughed and said, ‘I don’t know any of these people who showed up on my list— I’m guessing they see you,’” recounted Lisa. “He showed me the list of friend recommendations, and I recognized some of my patients.”
She sat there awkwardly and silently. To let him know that his suspicion was correct would violate her duty to protect her patients’ privacy.
Another one of her female patients had a friend recommendation pop up for a fellow patient she recognized from the office’s elevator. Suddenly, she knew the other patient’s full name along with all their Facebook profile information.
“It’s a massive privacy fail,” said Lisa. “I have patients with HIV, people that have attempted suicide and women in coercive and violent relationships.”
Lisa lives in a relatively small town and was alarmed that Facebook was inadvertently outing people with health and psychiatric issues to her network. She’s a tech-savvy person, familiar with VPNs, Tor and computer security practices recommended by the Electronic Frontier Foundation–but she had no idea what was causing it.
She hadn’t friended any of her patients on Facebook, nor looked up their profiles. She didn’t have a guest wifi network at the office that they were all using. After seeing my report that Facebook was using location from people’s smartphones to make friend recommendations, she was convinced this happened because she had logged into Facebook at the office on her personal computer. She thought that Facebook had figured out that she and her patients were all in the same place repeatedly. However, Facebook says it only briefly used location for friend recommendations in a test and that it was just “at the city-level.”
I tried to help Lisa figure out what could be causing this and reached out to Facebook about the case. Unfortunately, due to health privacy reasons, Lisa was not able to put me in touch with her patients directly.
When Lisa looked at her Facebook profile, she was surprised to see that she had, at some point, given Facebook her cell phone number. It’s a number that her patients could also have in their phones. Many people don’t realize that if they give Facebook access to their phone contacts, it uses that information to make friend recommendations; so if your ex-boss or your one-time Tinder date or your psychiatrist is a contact in your phone, you might start seeing them pop up in the “People You May Know” list.
That’s my guess as to how this happened. All these patients likely have Lisa’s number in their phones, so an algorithm analyzing this network of phone contacts might reasonably assume all these people are connected. A phone number alone can be quite a revealing bit of information, which is why it’s so significant that WhatsApp is about to share its one billion users’ phone numbers with Facebook, where they too could be used to make friend recommendations (unless you opt out).
A Facebook spokesperson could not confirm this theory. He said the company didn’t have enough information to figure out why patients were recommended to one another as friends.
“People You May Know is based on a variety of factors, including mutual friends, work and education information, networks you’re part of, contacts you’ve imported and many other factors,” said the spokesperson by email. “Without additional information from the people involved, we’re not able to explain why one person was recommended as a friend to another.”
This is totally reasonable, but also frustrating in that it leaves this mystery unsolved.
Lisa’s medical community has started recommending that patients concerned about privacy not log into Facebook or other social media accounts at medical offices, or even leave their phones in their cars during appointments. That’s likely good advice, but it doesn’t stop Facebook from mining their phone numbers.
* To protect her patients’ privacy, Lisa asked we not use her real name.
Facebook’s ability to figure out who you know in real life can sometimes be unnerving. The “People You May Know” list can be uncanny, leading many users to ask, “How do they know I know that person!?”
Well, it’s possible that you actually told Facebook yourself. If at some point in the past you uploaded your email or phone contacts to the social network, it can link them to Facebook accounts and figure out you know someone.
You may not remember doing this. You may be convinced you’d never do that. But you may be wrong.
I discovered 7 random email addresses that I’d uploaded in 2009. One of my colleagues discovered he had over 200 email addresses and phone numbers that were taken from his phone. He doesn’t recall having chosen to upload them, but must have clicked a button at some point handing them over.
As Facebook explains: “Only you will be able to see your contacts and info about them, but Facebook will use the info you’ve uploaded about your contacts to make friend suggestions for you and others and to help us provide a better service for everyone.”
Note the “and others,” which may support my hypothesis that a psychiatrist’s patients were recommended to one another as friends because they all have her number in their phones.
If you’re not happy about Facebook knowing all these contacts, there’s a handy “Delete All” button.
And you probably want to go to the settings on your Facebook Messenger app if it’s on your phone. Go to “Me” and then “People” and turn off Contact Syncing.
If your list is completely empty, congrats! You’re better at data hygiene than most. However, you’re not in the clear. If anyone has uploaded your email address or phone number to their own list, then Facebook knows you know them.
As one Twitter user eloquently put it, “in a two-way relationship, Facebook only needs one person to give up the goods.”
Here are the two sites to check out:
In 2014, when Facebook bought messaging platform WhatsApp for $21.8 billion, many people were worried about the privacy implications. But the companies promised that nothing would change and that WhatsApp would “remain autonomous and operate independently.” Well, this week, things changed. WhatsApp will now start sharing data from its one billion users with its equally behemoth parent company.
WhatsApp won’t share messages that people write or who is messaging who, but it will share people’s phone numbers as well as analytics information, like how often they open the app, their operating system, screen resolution, and their mobile carrier. That information could be used by Facebook to, for example, target people with ads and make friend recommendations.
If that freaks you out, there’s some good news: You can opt out… kind of. Facebook is getting this data no matter what, but you have 30 days to tell Facebook that you don’t give them permission to use the data to “improve its ads and product experiences.” In other words, if it doesn’t already have your mobile phone number, it won’t be able to use it to help advertisers who know that number use it to target you with ads on Facebook properties or recommend you friend someone who has your number in their contacts.
As WhatsApp explains in a blog post, to stop the sharing from happening, you can unclick the box below when WhatsApp hits you up with its new terms and conditions:
Or, if you rapidly click past that screen and miss the tiny little box, you can go into your WhatsApp settings and turn off the sharing.
Facebook has to give people this option because of its standing settlement with the Federal Trade Commission over deceiving consumers by not keeping privacy promises. In 2014, the FTC reminded Facebook that when it came to WhatsApp, “it must get consumers’ affirmative consent before making changes that override their privacy settings.” (I guess a little checked box that you have to click multiple times to find counts as “affirmative consent.”)
The bad news: Even if you opt out of the data sharing, “the Facebook family of companies will still receive and use this information for other purposes such as improving infrastructure and delivery systems, understanding how our services or theirs are used, securing systems, and fighting spam, abuse, or infringement activities,” according to the WhatsApp blog. So Facebook will still link your Facebook and WhatsApp accounts to fight spam; it just won’t use anything it learns to make friend recs or serve ads.
If you’re still freaked out by Facebook’s creeping data empire, you could stop using WhatsApp altogether. There’s always Signal, an encrypted messaging app from the crypto-anarchist who helped build end-to-end encryption into WhatsApp two years ago, which helped get Facebook into all kinds of trouble with the government in Brazil.
Facebook CEO Mark Zuckerberg is protecting his privacy with tape
On Tuesday, Facebook CEO Mark Zuckerberg posted a cutesy photo to Facebook celebrating Instagram’s now having half a billion users. It featured Zuck posing inside an IRL Instagram frame. It also featured, in the background, what we can assume is Zuck’s computer. And it features a couple of paranoid add-ons, as noted by Twitter user Chris Olson.
Indeed. His Macbook has tape on it.
One of these is well-placed tape; the other, not necessarily.
Putting tape over your webcam is a great idea and EVERYONE should do it. Even the FBI director does it. If a hacker manages to get into your computer, it will be hell for you, but this is a super simple way to keep them from taking photos of you, especially naked ones that could later be used to embarrass, harass or blackmail you. (It won’t prevent them from stealing existing photos from your computer, however, so make sure you’re encrypting your naked selfies.)
So, good job, Zuck. It almost makes us forgive your alleged mistake of using the password “dadada” on multiple accounts.
However, putting tape over your microphone jack is not going to be effective in making your computer hacker-proof. That’s just going to keep someone from plugging their headphones into your machine. If Olson is wrong, and Zuck has in fact put tape over the mic holes, though, that will muffle the computer’s hearing ability, per a test conducted in our office.
If you’re really paranoid and want to completely kill the omnidirectional microphone, you’d actually need to do some computer surgery.
“The paranoid people I know either cut the wire or use hot glue,” said ACLU technologist Chris Soghoian via Twitter direct message. Try at your own risk.
It’s more likely that Zuckerberg has tape over the mic holes, because tape alone over the mic jack is just going to make it annoying for you to listen to music privately, not make it impossible for hackers to listen to you.
On Friday, and again on Monday, Facebook told me that it uses smartphone location data to recommend new friends to its users. After I reported this, lots of people said that this explained why certain people had popped up in their “People You May Know” box on Facebook.
But on Monday night, after lots of negative feedback, Facebook reversed course. A spokesperson told me that the company had dug into the matter further and determined that “we’re not using location data, such as device location and location information you add to your profile, to suggest people you may know.”
I have reportorial whiplash. I’ve never had a spokesperson confirm and then retract a story so quickly. So here’s how we got here.
Last week, I met a man who was concerned that Facebook has used his smartphone location to figure out people he might know. After he attended a gathering for suicidal teens, Facebook recommended one of the other parents there as a friend, even though they seemingly had nothing else in common but being in the same place at the same time. He asked me whether Facebook was using location to figure out if people knew each other.
I was skeptical, because that seemed like such an egregious violation of privacy. On Friday, I emailed Facebook:
A Facebook user told me that he attended an event last week with people he’d never met before. The next morning, one of the people at the event came up as a suggested friend. They had no other ties beyond being in the same room the night before. Could their shared location have resulted in the suggestion?
A spokesperson responded, saying that location is one of the signals for “People You May Know.” I was surprised, since this could lead to all kinds of negative outcomes—unmasking strangers, for instance, who wanted to stay anonymous at a gathering for alcoholics. Security technologist Ashkan Soltani pointed out that using shared phone location to figure out people’s real world associations was a technique used by the NSA, as revealed in 2013.
I called the spokesperson on Monday morning to talk about those potential negative outcomes, whether Facebook disclosed in any way that it was using location for friend suggestions, and what users could do to prevent this from happening. The spokesperson said that location alone would never result in a friend suggestion, and sent me the following statement:
“We often suggest people you may know based on things you have in common, like mutual friends, places you’ve visited, or the city you live in. But location information by itself doesn’t indicate that two people might be friends. That’s why location is only one of the factors we use to suggest people you may know.”
Thus I reported that “Facebook is using your phone’s location to suggest new friends—which could be a privacy disaster.” The story garnered lots of negative feedback, with people upset about Facebook using their location information this way without telling them.
Then, on Monday night, the Facebook spokesperson reached out again, saying the company had dug into the matter and found that location isn’t currently used. She sent an updated statement:
“We’re not using location data, such as device location and location information you add to your profile, to suggest people you may know. We may show you people based on mutual friends, work and education information, networks you are part of, contacts you’ve imported and other factors.”
We do know that Facebook is using smartphone location for other things, such as tracking which stores you go to and geotargeting you with ads, but the social network now says it’s not using smartphone location to identify people you’ve been physically proximate to.
If Facebook were using smartphone location that way, it may well have violated its agreement with the Federal Trade Commission, which requires that the company get affirmative consent from its users to use their information in new ways and requires the company “to protect the privacy and confidentiality of consumers’ information.” Outing users’ identities to strangers because they were near each other for an extended period of time might be frowned upon.
As for how Facebook is able to figure out people we know with whom we’ve only shared physical space, that remains a bit mysterious. There are other ways that they could divine this information beyond using your phone’s GPS coordinates, such as looking at shared use of a wireless network or looking at the IP address you are signing in from. IP addresses can be geographically mapped, sometimes precisely and sometimes imprecisely. The FTC recently fined a mobile advertising company $4 million because it was figuring out the location of people who had not given it location privileges by looking at the wireless networks they were near.
To know for sure, Facebook would need to spell out the “other factors” that go into their suggestions for people we may know. But for now, the company considers that proprietary information.
The fabulous almost-famous life of (the other) Mark Zuckerberg
A few years back, Mark Zuckerberg became a star overnight.
The movie “The Social Network,” had just come out and suddenly, every time he offered up his credit card to pay for something or called to make a restaurant reservation, people wanted to know, “Is it really you?”
The 53-year-old Indiana bankruptcy attorney was annoyed. Of course it was him! Who else would it be?
In 2011, Facebook shut down his profile on the suspicion that he was impersonating “the real Mark Zuckerberg,” Facebook’s boy-wonder founder and CEO. The elder Zuckerberg bought the domain IAmMarkZuckerberg.com and went on a media rampage, lamenting to the world just how hard it was to share a name with the younger, more famous Zuck.
Zuckerberg had been practicing law in Central Indiana for nearly two decades before Facebook even existed. He was a regular on the bankruptcy-law speaking circuit and on occasion was even featured on NPR.
“If you had Googled Mark Zuckerberg in 2004, you would have found me,” he wrote on his site. “No one else.”
But since then, his sour grapes have turned sweeter. Being Facebook founder Mark Zuckerberg’s doppelgänger comes with some serious perks.
There was the one time, a year or so ago, when he made reservations at a hip restaurant in Naples, Florida while on vacation and was treated like a Silicon Valley star. He says throngs of other diners waited in the lobby, but when he arrived, the restaurant’s manager immediately whisked him away to the best table in the house and presented him with a fine bottle of complimentary champagne.
Apparently the restaurant wasn’t very familiar with what Mark Zuckerberg the younger actually looks like. (Though often, upon discovering that Zuckerberg the attorney is not Zuckerberg the social network founder, people remark that the bankruptcy expert resembles an older version of the Facebook CEO.)
“Now I look at it all as a big joke,” Zuckerberg said in a phone interview. “It’s more entertaining than watching TV.”
One time, while he was paying for something in a store, the saleswoman started screaming, overwhelmed by the brush with someone she presumed was famous. Another time, a saleswoman turned completely white upon seeing his name. He’s received VIP tickets to see David Letterman, discounts on rental cars and more reservations at fully-booked restaurants than he can recall. At his central Indiana law firm, he frequently receives phone calls intended for the other Zuckerberg and sometimes even packages, most of them from Facebook fans abroad perhaps unfamiliar with American geography. Recently, he filmed a commercial for his law firm that played off of the fact that he shares a name with someone famous.
When he checked his account Tuesday, he logged in to find he’d received more than 1,200 Facebook friend requests — sometimes he even receives requests from celebrities. When I tried to friend Zuckerberg myself, I was informed, “This person has reached the friend request limit and can’t accept any more.” Culling the requests has become a frequent ritual.
Part of the confusion, he assumes, stems from the fact that Zuckerberg just isn’t a very common American last name. In fact, before “The Social Network” came out,” people would usually call him Zuckerman instead, a name that is much more common. That’s an upside too. “Now people actually get my name right,” he said.
On Facebook, there appears to be only these two Mark Zuckerbergs. Google searching reveals only one more among the top results, an Israeli entrepreneur originally named Rotem Guez who changed his name to Mark Zuckerberg as part of a bizarre strategy while fighting a legal battle with the social network. Zuckerberg suspects that he and the Facebook CEO may actually be distantly related — his great grandfather long ago broke off from the rest of the family after a tiff. (Facebook did not respond to a request about the two Zuckerbergs’ potential relations.)
Zuckerberg’s long-term girlfriend, Lois Benjoya, says she might not have started dating him if not for the shared name. Benjoya and Zuckerberg live three hours apart — her sister introduced them, after teasing her for a long time that she was going to set Benjoya up with her friend Facebook CEO Mark Zuckerberg. Perhaps it was the joke, the idea of going out with a Mark Zuckerberg that inspired her to make the three-hour drive for their first date three years ago.
“It’s a fun thing,” she said. “It’s become a blessing.”
Every time Zuckerberg pulls out his driver’s license or credit card, the two shoot each other a look, curious to see how the person reading his name will react. Because she is tagged in photos with Zuckerberg, she too now gets hundreds of requests for friends on Facebook. Benjoya’s kids think it’s hilarious. Her son likes to brag to his friends at school that his mom is “dating Mark Zuckerberg.”
The downside of the shared name is being constantly compared to the 31-year-old — and found lacking. He remembers one time, when he got off the plane at the airport, he arrived to find his limo driver waiting with a sign that said “Mark Zuckerberg,” surrounded by dozens of people. When he came down the escalator and walked up to the driver, the crowd immediately dispersed, visibly let down.
There is an almost exact replica of the scene in an old ESPN commercial following an older white man who just happens to share a name with NBA legend Michael Jordan. Zuckerberg says his life is that commercial on a loop. He is still wistful for the days when he was the number one Zuckerberg to appear in a Google search, when he was known simply for being himself.
Zuckerberg said he would love to meet his namesake, and compare notes on what it’s like to be Mark Zuckerberg.
“He’s created something that’s changed people’s lives,” he said. “I would love to have invented something that impacted so many people.”
In a way, occasionally living in his shoes has made Zuckerberg the lawyer look up to Zuckerberg the Facebook CEO.
“I just hope when he has kids, he doesn’t name them the same thing as mine,” he added.