Privacy

Hi. We're your new overlords.


Hi. We're Apple.


We are delighted to inform you that regulations require you to carry a device that:

a. Tells us where you are at all times;

b. Records who you talk with, and for how long;

c. Can be used to record exactly what you say, and the responses of other participants in these conversations;

d. Collects email and text messages sent by you and to you.

You will never be informed when this information is examined by anyone.

Buy a phone. It's cool.


You must tell us everything you do, no matter how trivial. Identify your friends and acquaintances, and how you know them. We expect you to check in with us at least several times a day, every day.


Install apps for Facebook, Twitter, and Foursquare.


Tell us everything you are curious about.


Install apps for Google and/or Bing.


Pay us, because tracking you and sorting through all the information you give us takes time and we need to pay people to do it. Additionally, we need to sell your data to advertisers, marketers, or possibly just hand it over to law enforcement regardless of whether or not they have any legal right to have it, and your data doesn't package itself. Your data is worth money, and you must pay us because we value your data. We value it so much that we will sell it, because that lets us make more money. So pay us. We need to continue watching you.


You will be charged a reasonable monthly fee for these services.

Thank you,

Your new overlords

In a recent listserv conversation, a participant asked about the steps schools are taking to monitor student computer use. One question dealt with the frequency with which browser histories on student machines were parsed, not as part of any examination into any suspected incidents, but as part of routine supervision and oversight of students.

I've seen more threads like this than I can count. Much of the impetus behind the more intrusive forms of supervision comes from a good motive: the desire to keep kids safe. High profile cases power calls for more supervision, as do "consultants" who conduct seminars tailored for the fears of parents and administrators (as an aside, if I remember the research correctly, scare tactics have been shown to have limited effectiveness for a short time period with students at or around middle school age. Scare tactics don't do much for older students. If any of my three readers knows better info on this, please share it in the comments).

But -- as people who work in and with schools, as people who help kids develop the skills to make rational, meaningful decisions about the world in which they live -- when do we have a responsibility to push back against well-intentioned but misguided efforts that conflate security with supervision?

Within the last two weeks, there have been news stories about the FBI wanting access to geolocation data obtained from cell phones, and the FBI wanting to require ISP's to retain web browsing records for two years. As we have seen before, even access to anonymized search records show an incredible amount of information about an individual. In the recent past, there was some outcry against the government requesting borrowing records from public libraries, and the entire question of warrantless wiretapping raised some hackles.

But the outcry against intrusions on privacy takes place against a backdrop where it's normal to share a steady stream of details about your life. My concern is that, if we make our schools into places where "normal" means having your browsing history tracked daily, people will take that level of supervision for granted. For a child born in 2002, a government that uses warrantless wiretapping is part of the fabric of their lives.

As teachers, as parents, as people who run schools, as people who care about kids: how are we empowering kids to develop their distinct interests, to take informed risks, to explore freely, and to know that it's okay to have hopes, fears, and dreams that are private, and intrinsically theirs until they choose to share?

I was at Educon 2.2 a little while back, and at that meetup we spent a lot of time talking about what school can and should be. I have been working on a follow-up post about the session, but I sense that as I try to make some sense about what learning can be within a context where there is a growing tension between constructive guidance and overbearing observation, part of what we all need to learn is how to deconstruct the myth that being observed and tracked makes us safer.

All of the recent discussion about Facebook's change to its privacy policy obscures one frequently minimized point: privacy doesn't really exist on Facebook. While there is minimal control over what appears onscreen, this should not be confused with real, actual privacy, or the ability to control what is known about you. Facebook has your information, and by virtue of using their site, you have provided them a degree of control over your personal information.

This becomes particularly apparent when looking at Third Party Application developers. These external applications can access data in ways that are not immediately obvious to the end user, and in some cases this seems to work against people's obvious desires. In short: third party applications get the same access as the account that installed them, so if your privacy settings are set to friends only, and a third party app installed by a friend requests your information, it can get it. So, your privacy is as good as your least discrete friend's judgment.

But issues around abusing privacy aren't new for Facebook. They have these types of issues a few times a year, every year. Flash back to the launch of Beacon:

"Facebook still collects your data. Whether or not they show it onscreen or not is only marginally relevant. They have records of how you have used their site, and that information is valuable to people who want to sell you things."

Facebook has a well worn track record of disastrous handling of user data. In the beginning of 2009, Facebook pre-emptively changed their ToS. People were not happy, but people should not be surprised, as this is normal behavior for Facebook.

And Facebook's current "privacy policy" has some gems -- really, there are too many to list, but my favorite is probably from Section 3: Information You Share With Third Parties: "We take steps to ensure that others use information that you share on Facebook in a manner consistent with your privacy settings, but we cannot guarantee that they will follow our rules." Translation: People will get your information through our site, and we don't really have much/any control over what they do with your information.

And, of course, Facebook can change their privacy settings at will, thus eliminating the illusory value of these settings in the first place, as illustrated by this very conversation.

Some other good reads on this:

• The Facebook Blog: http://blog.facebook.com/blog.php?post=197943902130
• Electronic Frontier Foundation: http://www.eff.org/deeplinks/2009/12/facebooks-new-privacy-changes-good-...
• From ReadWriteWeb: http://www.readwriteweb.com/archives/facebooks_privacy_move_violates_con...

Some thoughts after reading this piece in Wired (although this actual blog post could have been written anytime in the last few years).

Let's imagine that the US Government announced that they had started a web site. On this site, you needed to enter your personal information, including an address, and various interests. Once this was done, you could tell the government – via the web site – all about your day to day activities: what you read, where you were going, what movies you like, etc. Then, you could identify your friends, and upload pictures and video of these friends.

This is a small subset of what Facebook users do every day, by choice. Facebook is probably the single largest opt-in surveillance program ever seen. If any government ever tried to build a site like this – even with an ostensibly worthwhile goal, like mapping public services to people based on interest, geographic location, and perceived need – the outcry would be deafening.

Facebook's "services" – and I'm thinking specifically of Facebook Connect – extend that surveillance to what people do on sites outside of Facebook. However, Facebook's internal search – powered by their deal with Microsoft – will provide an enormous amount of raw data about what individual people want. Given that these searches will be conducted by people logged in to Facebook, the search strings used can be mapped to specific individuals. As we have seen before, even a little bit of information about search strings can lead to some awkward revelations.

When people get a glimpse of how much Facebook knows about them, they generally freak out. Yet, the freak outs subside, and people keep plugging away, adding more data into the system.

Okay, time to go. Need to update my status:

Adjusted my tinfoil hat. It had tilted precariously back, exposing most of my frontal lobe.

I came across another discussion on the use of Google Apps within K12 organizations -- this is a lightly edited version of my reply in that thread:

With Google Apps, the real value for Google isn't in "owning" your content. The value for them is in mining it, and then using that information to hone their business selling ads and working with affiliate advertisers -- and their privacy policy expressly states that your data will be used in this way.

From Google's Privacy Policy, at http://www.google.com/privacypolicy.html

Log information – When you access Google services, our servers automatically record information that your browser sends whenever you visit a website. These server logs may include information such as your web request, Internet Protocol address, browser type, browser language, the date and time of your request and one or more cookies that may uniquely identify your browser.

So, they can track a request for a specific web site to a specific user, and can keep track of what an individual does over time.

Affiliated Google Services on other sites – We offer some of our services on or through other web sites. Personal information that you provide to those sites may be sent to Google in order to deliver the service. We process such information under this Privacy Policy. The affiliated sites through which our services are offered may have different privacy practices and we encourage you to read their privacy policies.

The approximate translation: when using Google Apps, you might get sent to another site, and this site might have a different privacy policy, and this site might share a different set of your private information with us. You may or may not know when this is happening, but it's your responsibility to know when to check for the privacy policy of these sites.

Then, the policy goes on to list why Google is collecting this information:

• Providing our services, including the display of customized content and advertising;
• Auditing, research and analysis in order to maintain, protect and improve our services;

I've chosen a very small section of the privacy policy here, but the full policy goes into much more detail, including info about geographical data.

For a sense of what can be inferred from even very rough user data, take a look at the fallout that occurred when AOL released search data from it's userbase. This search data is nowhere near as precise as what Google collects, but it still revealed an astonishing range of information about its users.

So, when schools are using Google Apps, every member of that community is participating in unpaid marketing research. If you are buying Google Apps as part of a service, you are paying to participate in market research.

As a closing thought, I'd like to hear the conversation that ensued if a person walked into the head of school's/principal's office and said the following:

"I'd like to enroll all of our Middle School students in an unpaid marketing research program. They'll never know it's going on, and every facet of their online collaboration will be tracked as part of the study. Oh, and it comes with email."