Updates

A few things to get off my chest, which have been sitting there since early December, when my costly unfettered freedom ended.

Facebook Privacy Concerns Deepen:

There are three kinds of concerns here:

1.  Your mom might see a post where you complain about Christmas dinner and assume its about her.  (Alternatively, your significant other may wonder why your "new friend" was kissing you in that picture taken at the ski lodge last weekend.)
2.  Someone might break into your account, figure out your credit card number, and steal your identity. 
3.  Someone might aggregate all the data entered through an application like Facebook or LinkedIn and figure out where individuals live or what they like to do, for nefarious purposes.



The first concern has always been a concern.  Technology may exacerbate it, but misinterpreted complaints have been an issue at least since people got started getting drunk around the fire after dinner.  Saving people from their own stupidity and/or cupidity is not something we can really do much about; we can legislate general scenarios to protect the young, and maybe someday figure out the social-media equivalent of helmets (e.g. email can't be sent for at least an hour), but we can't stop people from misunderstanding things.

The second concern is endemic to ecommerce.  But its also, frankly, endemic to detached single-family-home living, or to people who drive cars.  If you leave your door unlocked - or use abc123 as a password - then don't be surprised if someone walks into your house and takes stuff.  If they break in, then we have laws to deal with that; similarly, if someone breaks into Facebook despite your strong password, then we should have laws to deal with that.  And we do, so I'm not too worried about that.  But again, worrying about identity theft off your social media accounts is very very similar to worrying about theft of your possessions, for which you more or less take appropriate precautions.

The third concern riles everyone up.  Its the kind of thing that worries both liberals and conservatives who consider themselves well informed.  And I won't deny there are powerful, principled reasons to be worried about the possibility of, first, a privacy-destroying aggregation rich in implication, and second, a bad actor obtaining that aggregation.

But, and I speak from experience here, it requires significant talent, skill and strategic foresight to get to the first possibility.  There is a cultural divide - nay, a gulf, wide as the Gulf of America - between the people who design the applications that capture the data, the Application Architects, and the people - the Data Architects - that design (among other things) the systems to get the data out of the those application repositories, consolidate them, and do the aggregation that might then be identified by the evil amongst us to support their evil plans for evildoing.  Your nearly-devoted blogger's career more often than not has entailed the latter sort of work, and so I am, to be honest, on the front lines protecting your security, dear reader, ever single day. 

Despite what the average end-user out there in the world might think, though, consolidation is hard.  It may appear to be easy; after all, everyone who works for a living has suffered through an implementation of a branded ERP, or CRM, or case- or time-management application, or whatever, designed to store the data they generate in a database.  So you'd think that everyone who implemented an Oracle ERP or Seibel CRM system could easily have all their data consolidated easily - after all, this is happening in literally hundreds of companies every day all around the world, just for ERP systems alone, and ERP implementations are notorious for putting companies into a conceptual straitjacket.

But they don't.  Each packaged application is always customized on implementation, usually heavily.  No one, in my experience, ever implements the thing out of the box, which is usually referred to derisively as the vanilla version.  Now, this is irritating in the extreme to the application architects who designed the package, who have their expansive vision tampered with by inexperienced and untalented locals; but its an exciting opportunity for other application architects, who must adapt the inexperienced and limited design of the packaged application to the unique and specific needs of their own vision for the company.  So the eventual implementation may share a few, high level structural details with other implementations of the same product, but any application architect worth his/her badge will make sure its as different as possible.  Its their signature, after all.

And its worse for stuff built from scratch, the way the social media apps were of necessity built.  In companies like Facebook or Linked it may be that their Finance-department-driven ERP implementations are reasonably similar, even though it'd still take a couple of years to get the data out.  But the application that you use when you login are from different planets, designed by alien intellects trying to understand why we have 35 words for snow.  And frankly, the designers don't care about getting lots of data out at once; they want to get your last ten posts, which is not a lot of data, and so they design for that.  They don't care in the least if someone in say, Marketing, wants to get all the people who've posted on something particular, say where they listed their address and net worth and ALSO whether they habitually leave the door unlocked because they trust their neighbors.

It may seem there's not much difference between the two, but think of your own filing system.  You may have stacks of tax forms from years past.  You know how to rifle through them to find a particular year.  But now imagine you have everyone's tax forms.  Its easier to find someone's specific forms when they ask than it is to pull out everyone from a specific zipcode, or everyone with the last name Obama.  But by and large its the former organizational approach that's taken at social media companies: they stack.  The may be able to pull your posts, or hers, if you ask for them, but a bunch?  Well why would you want that? 

But see, the application architect will say, we don't need to: the application just needs to show your posts, not everyone else's.  Don't be silly.  If you think I diminish the foresight of application architects, I have not, yet.  Getting the data out is really the least of their concerns.  I suppose we should cut them some slack for their place in the ecosystem, but it doesn't mean we can't still wonder at their arrogance.

And so the data is just not easily organized in a way that makes nefarious uses possible - at least on anything but a nearly civil scale.  You could commit crime with it, but not lots of crime. 

So there is, certainly, a strong principled reason to worry about bad actors getting to your data.  But Zuckerberg and his guys are largely application architects, and so they're struggling with caring about getting that data out.  You can pretty much bet that if smart rich arrogant people don't care about a problem, its unlikely they'll do much to solve it.

And so I'm not worried about Facebook's privacy issues, in the aggregate.  They don't care much about privacy, but they're also constitutionally disinclined to enable its violation.