4 ms·

I agree with the EFF 100% in the article. But it's not always so clear. What if I agree to developer Terms of Service that say I can't disseminate users' infor

by lukev 17y ago

I agree with the EFF 100% in the article. But it's not always so clear. What if I agree to developer Terms of Service that say I can't disseminate users' information, then publish a Identity Theft Target List with information pulled from the Facebook API? Seems like that should be a criminal violation, even though I "only" violated a TOS.

paulbaumgart 17y ago
What's an "Identity Theft Target List"? A list of information about people to make identity theft easier? In that case, publishing a list like that should be the crime (if it isn't already), not the TOS violation that got you the data.
- lukev 17y ago
  Not necessarily. If it's public information that I could obtain by visiting their page, I can't get in trouble for collating it and publishing it. Having access to Facebook's API makes it practical to scrape massive amounts of data, however.
  - paulbaumgart 17y ago
    If the data are public already, you're not really changing much by gathering them in one place. More important is the case of private data that are gathered by having a user enter their credentials. Using the private data in a way to which the user expressly agrees, regardless of TOS, should be legal. The problem arises when the data are used in a way counter to the user's wishes: like pretending to offer social network aggregation and instead publishing it without consent. That should probably be illegal. I agree that it's not so clear-cut. Like a lot of legal matters, intent is also relevant, in addition to the actual effect.
_delirium 17y ago
I could see specific kinds of agreement violations being legally enforceable, but it seems safer if it was "opt-in" on the government's part which kinds of agreements can be enforceable that way, as opposed to letting anyone who writes a TOS be able to invent arbitrary new criminal offenses on the fly. For example, there could be a law saying that anyone who disseminates information they agreed to keep private is guilty of an offense. That would make certain kinds of TOS related to information confidentiality legally enforceable. Of course, Facebook might then themselves be guilty of that offense with their retroactive privacy-policy changes...
scott_s 17y ago
I don't think your list would be substantially different from a phone book.
- lukev 17y ago
  The way Facebook is going, and with how many people absolutely fail to understand what security settings it does provide, it'd be pretty easy to cull a list of all residences in the past 5 years, city of birth, mother's maiden name, favorite band, favorite pet, first boyfriend's name, and a decent photo.
  - paulbaumgart 17y ago
    That sounds like a case for educating people better about privacy settings and the threat of identity theft, not for getting the law involved. If people publish something online that they probably shouldn't, it's hard to protect them from themselves without a lot of unintended consequences.
  - jrockway 17y ago
    You should do it! Remember that Palin's Yahoo! mail account was hacked because someone figured out the answer to her security questions. Security questions are a dumb idea. Send me a fucking SecureID...
    - paulbaumgart 17y ago
      Would the impact of such a list really outweigh the risk of aiding and abetting identity theft? There's probably way to accomplish the same effect without making the aggregated data public. Maybe sharing the results with some news outlet?
      - jrockway 17y ago
        Wikileaks?

by lukev 17y ago

paulbaumgart 17y ago

What's an "Identity Theft Target List"? A list of information about people to make identity theft easier? In that case, publishing a list like that should be the crime (if it isn't already), not the TOS violation that got you the data.

lukev 17y ago
Not necessarily. If it's public information that I could obtain by visiting their page, I can't get in trouble for collating it and publishing it. Having access to Facebook's API makes it practical to scrape massive amounts of data, however.
- paulbaumgart 17y ago
  If the data are public already, you're not really changing much by gathering them in one place. More important is the case of private data that are gathered by having a user enter their credentials. Using the private data in a way to which the user expressly agrees, regardless of TOS, should be legal. The problem arises when the data are used in a way counter to the user's wishes: like pretending to offer social network aggregation and instead publishing it without consent. That should probably be illegal. I agree that it's not so clear-cut. Like a lot of legal matters, intent is also relevant, in addition to the actual effect.

_delirium 17y ago

I could see specific kinds of agreement violations being legally enforceable, but it seems safer if it was "opt-in" on the government's part which kinds of agreements can be enforceable that way, as opposed to letting anyone who writes a TOS be able to invent arbitrary new criminal offenses on the fly. For example, there could be a law saying that anyone who disseminates information they agreed to keep private is guilty of an offense. That would make certain kinds of TOS related to information confidentiality legally enforceable. Of course, Facebook might then themselves be guilty of that offense with their retroactive privacy-policy changes...

scott_s 17y ago

I don't think your list would be substantially different from a phone book.

lukev 17y ago
The way Facebook is going, and with how many people absolutely fail to understand what security settings it does provide, it'd be pretty easy to cull a list of all residences in the past 5 years, city of birth, mother's maiden name, favorite band, favorite pet, first boyfriend's name, and a decent photo.
- paulbaumgart 17y ago
  That sounds like a case for educating people better about privacy settings and the threat of identity theft, not for getting the law involved. If people publish something online that they probably shouldn't, it's hard to protect them from themselves without a lot of unintended consequences.
- jrockway 17y ago
  You should do it! Remember that Palin's Yahoo! mail account was hacked because someone figured out the answer to her security questions. Security questions are a dumb idea. Send me a fucking SecureID...
  - paulbaumgart 17y ago
    Would the impact of such a list really outweigh the risk of aiding and abetting identity theft? There's probably way to accomplish the same effect without making the aggregated data public. Maybe sharing the results with some news outlet?
    - jrockway 17y ago
      Wikileaks?