Privacy suit against Facebook a warning for businesses

Lawsuit accuses social networking site of mining private messages for info for advertisers

A lawsuit accusing Facebook of mining private messages for information it can pass on to advertisers stands as a reminder to businesses that privacy is a relative word on a social network, experts say.

[Facebook legal skirmish highlights user privacy risks]

The lawsuit filed in federal court in Northern California seeks class-action status for all Facebook users allegedly duped into believing that they could send confidential messages. Specifically, the suit says Facebook has violated the federal Electronics Communications Privacy Act and California privacy laws.

Facebook has allegedly gone wrong by scanning private messages containing links to websites and searching the destinations for clues about the sender that it can sell to advertisers, marketers and other data aggregators.

The plaintiffs argue that Facebook implied the opposite when it launched its integrated email and messaging service in November 2010.

"Facebook telegraphs through the use of the words 'privately' and 'private' that when a user sends a private message to another party, only the user and the intended recipient will be privy to the contents of that communication," the suit says.

Plaintiffs Matthew Campbell, Pulaski County, Ark., and Michael Hurley, North Plains, Ore., are seeking the greater of either $100 a day for each day of violation or $10,000 for each affected user, plus damages under California law.

Facebook denies any wrongdoing. "We believe the allegations are without merit and we will defend ourselves vigorously," the company said in a statement emailed to Computerworld.

Expecting privacy from an ad-driven Web site that needs to check all posted links for malware and spam is ludicrous, Anton Chuvakin, research director for security and risk management at Gartner, said.

"Frankly, this is an idiotic suit," he said. "If the message is really private, as in secret, use encrypted email or hand-deliver it. Why is it on Facebook?"

Of course, the social network has the responsibility of clearly explaining what it does with all user-generated content, so the courts will have to decide whether Facebook was misleading in the use of the word private with its email service.

In the meantime, experts say the suit should remind companies that all business communications should be done through corporate email. Essentially, only information meant to be public should go out on a social network on behalf of the company.

"All social networking companies at this point are making their revenue via advertising and all are using data mining techniques to target ads in one way or another," Jody Brazil, president and chief technology officer for security management company FireMon, said. "As such, communication must be considered semi-public regardless of how it is posted."

[Slideshow: Six steps to better Facebook privacy management]

For easier monitoring of social media use, companies need to have a strict policy that only authorized employees can post content on behalf of the business, privacy expert Rebecca Herold said. In addition, posted content should never contain information about a company's intellectual property, employees, customers or partners.

"All organizations, in all industries, need to have social media policies in place for not only Facebook, but also for all other social media sites," Herold said.

Copyright © 2014 IDG Communications, Inc.

7 hot cybersecurity trends (and 2 going cold)