Previously:

• Version 1
• Version 2
• Version 3

Source: Ruder Finn

PR firm Ruder Finn recently announced the Ruder Finn Intent Index, a new study of online behavior. The data is interesting and and the graphics are snazzy, but I was underwhelmed by the data point they led with in the press release.

More than 4 in 5 people (80%) go online to socialize, which is twice as many as those who go online to shop or do business.

Surprise! People like to socialize more than shop. Surely it isn’t news that people don’t think of the Internet as a giant shopping mall.

Once you get to the actual charts, the results are interesting and it’s refreshing to see data about how people pass time* online.

These items struck me.

• 21% want to influence people’s opinions and 11% use a blog to raise their profile
• 9% go online to be someone different and 5% create a secret or anonymous identity

I would have expected the former to be greater and the latter to be less. Fascinating.

1. * 100% go online to pass time.

According to the press release :

Effective at 12:00 p.m. today, Friday June 19, 2009, the City of Bozeman permanently ceased the practice of requesting candidates selected for City positions under a provisional job offer to provide user names and passwords for the candidate’s internet sites.

They said in a memo to the mayor and city commission that it was an honest mistake and that they believed it was consistent with their core values. I believe them. And I give them some credit for realizing the severity of the situation they created for themselves and acting quickly to fix it.

But they still don’t get it. City Manager Chris Kukulski made a point that only certain staff had access. They still don’t appear to understand the risks associated with asking for that information, using it or securing it. Which brings me to…

After reading the press release and the memo I was also concerned that they were still not addressing how the information they already have on hand is stored and secured, but that concern is addressed in the video of the press conference (WMV) with City Manager Chris Kukulski.

“Yes, that is protected, confidential information and it is held in the same cabinet, in the same information where all other protected human resource or personnel items are.”

The information is safe in the cabinet. I guess I’m relieved. But I hope it’s a sturdy cabinet.

Ars Technica reports that the city of Bozeman, Mont. is asking job applicants for their user names and passwords to all web services and communities in order to perform pre-employment screening.* Applicants are required to sign a form that says:

“Please list any and all, current personal or business websites, web pages or memberships on any Internet-based chat rooms, social clubs or forums, to include, but not limited to: Facebook, Google, Yahoo, YouTube.com, MySpace, etc.”**

This is a monumentally bad idea.

Under U.S. law, employers must not discriminate against members of several protected classes. Having direct access to a prospective employee’s account gives access to a limitless supply of risky information.

Everything is connected.

You can use your Google, Yahoo or Facebook*** account with to log in to countless web sites, so even if the city of Bozeman isn’t explicitly asking for access, they would have the credentials to access a mind-boggling amount of personal information.

Let’s say you apply for a job and give your prospective employer your Google login information. That gives them access to your e-mail, including access to any correspondence with other prospective employers, your chat history, your search history, your image library, your calendar, your address book, the RSS feeds you subscribe to, the locations you’ve mapped, your health information,**** administrative control of your blog, your news alerts….

There’s no end to the number of ways that one account could be abused. The city of Bozeman wants access to all your accounts.

“One thing that’s important for folks to understand about what we look for is none of the things that the federal constitution lists as protected things, we don’t use those,” city attorney Greg Sullivan told KBZK. We don’t use those? I’d like to hear how that argument stands up when the first discrimination suit is filed.

That’s not all.

Bozeman is asking for access to current business web sites as well. Can they really be asking applicants who are employed elsewhere to give the city access to their company business systems? If they are, then the the city is selecting employees based in part on their willingness to violate their employment agreements and provide unauthorized access to confidential business information.

According to KBZK, city attorney Sullivan said that no one has ever removed his or her name from consideration for a job due to the request. It appears that the city of Bozeman wants to hire people who are absolutely clueless about data privacy and no regard for confidentiality — and put them in charge of protecting applicants’ login data.

This can’t end well.

But wait, there’s more.

There’s nothing on the form to suggest that the city of Bozeman is asking for passwords to access to online banking or other financial data, but by asking for account data like Google and Yahoo that gives access to e-mail, they’re essentially asking for the ability to obtain personal financial data. With access to e-mail, someone can take over your bank account and transfer your funds elsewhere before you realize what’s happening.

But let’s assume for a moment that all city employees are beyond reproach. By compiling user names and passwords, they’re creating a honey pot for identity thieves. Let’s hope the city of Bozeman has world-class data security programs in place***** because that much personal information is sure to attract unwanted attention.

I have to stop. I’m stunned by the staggering lack of judgment behind the city of Bozeman’s decision and the potential spiderweb of unintended consequences.

Photo credit: Mirko Macari

1. * Local TV station KBZK broke the story. The Associated Press has picked it up as well.
2. ** Heh. Three lines for any and all logins. Three pages, maybe?
3. *** Among others. I wonder if they’re asking for OpenID credentials as well.
4. **** Assuming anyone actually uses Google Health. Bear with me. I’m making a point.
5. ***** I know this is a stretch, since it appears that the city only wants to hire rubes who don’t know or care about privacy or data security.

From GeekChart.com

In an attempt to horn in on the love developers are heaping on Twitter, Facebook has introduced the new Open Stream API, which lets third party applications display your Facebook news stream. To their credit, Facebook has addressed privacy controls up front.

Consistent with our previous steps toward greater openness, we believe users must have full control and choice and that’s exactly how we’ve designed Facebook Platform and the Open Stream API. All Facebook Platform terms governing data use apply and an application or Facebook Connect site can only access a user’s view of the stream if the user gives the application permission.

A tremendous amount of personal information is being poured into Facebook, and CEO Mark Zuckerberg thinks  that will accelerate.

“I would expect that next year, people will share twice as much information as they share this year, and next year, they will be sharing twice as much as they did the year before,” he said. “That means that people are using Facebook, and the applications and the ecosystem, more and more.”

TheNextWeb gets right to the point.

There’s an enormous difference between Facebook and Twitter which Facebook appears yet to realise, or has simply forgotten. Facebook stores an incredible amount of information from peoples daily lives, including media, personal and contact information. Whenever any of this changes, it appears on your friends news streams BY DEFAULT.

It’s likely that most Facebook users don’t realize that they can change their privacy settings and won’t immediately recognize that their information can now flow out of Facebook without their explicit consent.

Zee predicts a basklash. I think he’s right.

Bonus: 10 Privacy Settings Every Facebook User Should Know

Ars Technica reports that two University of Texas researchers can “de-anonymize” Twitter accounts based on the structure of online social network connections. They point out that “anonymity is not sufficient for privacy.”

Their newest paper, “De-anonymizing social networks,” is yet another attack on the idea that data can be easily anonymized by stripping out a few bits of personally identifiable information (PII). Much of their work over the last few years is built on the premise that PII extends far beyond names and addresses; in many datasets, the very structure of the data provides all sorts of clues that can be deciphered with only a few bits of information.

I confess to only having skimmed the paper , as it’s outside the scope of my geekiness, but the implications are serious.

We show that a third of the users who are verifiable members of both Flickr and Twitter can be recognized in the completely anonymous Twitter graph with only 12% error rate,* even though the overlap in the relationships for these members is less than 15%!

Anonymity isn’t what it used to be. Your words are going to be online for a long time, so choose them wisely.

1. * Granted, a 12% error rate is huge. Think of it as a 88% success rate. Either way, the results are significant.

The Online Media from RealWire on Vimeo.

© 1993 The New Yorker

You’ve probably heard the expression, “On the Internet, nobody knows you’re a dog.”

That was then. The days of online anonymity are behind us. Hundreds of millions of people routinely share information about themselves online, and public records are online for hundreds of millions more. Now, everybody knows you’re a dog — and they know a lot of other things about you too.

But do they know the things you want them to know about you? Do you act the same and share the same information with everyone in your life? Probably not. Family, friends, neighbors, business associates, all see different sides of your personality and know different things about you.

But that’s not how it is online. There’s a a fundamental disconnect between our online and offline identities. Pew Internet & American Life Project’s Amanda Lenhart comments:

Our offline identities and the manner in which we manage them are complex. Even with advances in privacy controls we still do not have perfect online analogs for the subtleties of offline interactions and relationships.

Most social networks, which are increasingly becoming the centers of our online identity management, do a very poor job at allowing us to segregate the various facets of our online identity. Plaxo has made some steps in that direction, but it doesn’t seem to be too well integrated into the service, other than as built-in categories. (And who really uses as Plaxo their primary social network, anyway?)

And even in the age of fine-grained privacy tools, those tools do not eliminate the complexity of figuring out how to best present oneself in a multi-use public space, particularly for those who have personal, professional and family contacts on these sites. Not only that, on Facebook, how others use the site through comments, wall posts and tags and how that information is connected to you via that other person’s feed, also adds additional layers of complexity to online identity management.

Until you can reasonably control what personal information you share and who you share it with, do you censor yourself online?