SXSW: Privacy Parts

Got back a few days ago from my annual trip to Austin for the SXSW Interactive conference–learned a lot of cool stuff and met a lot of cool people, as always. I’ll be posting a few of my observations over the next few days, but before I do, I wanted to point you guys to the transcript from Danah Boyd’s excellent keynote address on Internet privacy and social norms.

Give it a read–the issues she’s addressing affect literally every Web user. In my former life as a tech blogger and security editor at PCMag.com, I came to realize a few things:

1) Your data is not as private as you thing

2) Your data is much more valuable than you think

3) The companies that collect data on you are using it

4) A huge subset of Web users are completely clueless. About everything. It might not even be a subset…it might be a majority.

5) It’s almost impossible to enforce any kind of privacy norms, because everyone (myself included) checks that little box that says “I agree to the terms and conditions” without reading the terms and conditions. And most of us choose the privacy defaults that we’re presented with. And most of us are completely clueless.

Obviously, Google is the most extreme privacy bugaboo. I like a lot of what Google does, but man, they know EVERYTHING. Ever wonder why those ads in Gmail are so incredibly aligned with your own interests? When I’m reading an email from someone I know from church, the ads around the email are for mormon stuff (even if the email has nothing to do with our church affiliation). Think of the implications: that means Google not only crawls the email from Joe that I’m reading right now, but it remembers the email Joe sent me last week, and knows that we tend to talk about church stuff.

Even more troubling, when Google CEO Eric Schmidt was grilled on Google’s tendency to downplay privacy concerns, he replied (on CNBC): “If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place.”

A beautiful thought, and a nice goal to work toward, but what the eff is Eric Schmidt talking about? Google is neither Jesus nor Santa Claus, yet they know just as much about your naughty and nice habits. It was enough to drive Mozilla, that bastion of open-sorcery, to endorse Bing’s privacy policies over Google’s. And if an issue is worrisome enough to drive Mozilla to side with Microsoft, you better take note of it. CNET’s genius reporter Ina Fried points out that the differences between Google’s cavalier approach and Microsoft’s more measured approach could stem from the years of regulatory and consumer backlash that Microsoft has gone through. Google’s still learning how to piss users and government officials off (but they’re proving adept at it).

Interestingly, Google’s former head of global policy is now working as a Web Privacy Czar at the white house. His name’s Andrew McLaughlin, and he participated in a fascinating SXSW panel on individual ownership of personal data. He said the most protected data you have is your VHS rental records. During Robert Bork’s Supreme Court vetting, the opposition got their hands on his video rental history and went public with it. Congress FREAKED OUT, worrying that their own records might be made public, and passed a very strong law barring anyone from accessing video tape rental history (there’s some ambiguity about whether the law also covers DVD rentals).

Anyway, read the Danah Boyd keynote address. There are lots of interesting bits in it, like the difference between “public” information and “publicized” information. For instance, your Facebook data might be viewable by your friends (public, in a sense). But then Facebook invented the News Feed, in which your data is <i>pushed</i> to your friends’ homepage (publicized). Big difference.

Here’s a real-world corollary: My office building has a huge atrium in the middle, surrounded by offices with windows overlooking it. My desk looks out over the atrium, and I’m right by the glass elevators, so I can see everyone going up or down, or heading to lunch, or sitting at their window-facing desk 3 floors up, or checking in at the front security desk. And they can all see me. We’re public, and I think it’s a good social-networking metaphor. Anyone can see what I do all day at the office. But what if someone wanted to stand at a window across the atrium and stare at me all day? Is that a violation of my privacy? What if that person started taking notes on my work habits? What if I started tracking who went where for lunch at what time? Does the open access become a privacy violation when we use it to track one another?

There’s also the idea of different social norms for different forums. My Twitter account is linked to my Facebook account, but I treat the accounts very differently. I don’t tweet pictures of my baby, or even use her name on Twitter. I avoid mentioning Corinne’s name on Twitter, and I usually don’t tweet about her at all without showing it to her first. But I have no problem bragging about my baby and listing Corinne as my wife on Facebook–Facebook is for friends, but I don’t even know most of my Twitter followers. They could be anybody, and my family members have the right to control how they are presented to those people.

I’ll also frequently go into Facebook and delete tweets from my wall that wouldn’t interest my Facebook friends. My Twitter feed is geeky and full of tech stuff, which I assume most of my Facebook friends aren’t interested in. What’s meat on Twitter is spam on Facebook.

And this blog is starting to get into spam territory, so I’ll wrap it up. Go read that speech. We need more informed web users out there.

***Full disclosure: I work for an ad agency that works closely with Microsoft, but the ideas expressed here are completely my own, and were not written for or in conjunction with my day job. My writings and ideas about Microsoft, Google, Twitter, and Facebook long predate my current employment, and you can still read them at PCMag.com, AppScout.com, Gearlog.com, and on this blog***