Facebook: The New Look of Surveillance

When one of America's largest electronic surveillance systems was launched in Palo Alto a year ago, it sparked an immediate national uproar. The new system tracked roughly 9 million Americans, broadcasting their photographs and personal information on the Internet; 700,000 web-savvy young people organized online protests in just days. Time declared it "Gen Y's first official revolution," while a Nation blogger lauded students for taking privacy activism to "a mass scale." Yet today, the activism has waned, and the surveillance continues largely unabated.

Generation Y's "revolution" failed partly because young people were getting what they signed up for. All the protesters were members of Facebook, a popular social networking site, which had designed a sweeping "news feed" program to disseminate personal information that users post on their web profiles. Suddenly everything people posted, from photos to their relationship status, was sent to hundreds of other users in a feed of time-stamped updates. People complained that the new system violated their privacy. Facebook argued that it was merely distributing information users had already revealed. The battle -- and Facebook's growing market dominance in the past year -- show how social networking sites are rupturing the traditional conception of privacy and priming a new generation for complacency in a surveillance society. Users can complain, but the information keeps flowing.

Facebook users did not recognize how vulnerable their information was within the site's architecture. The initial protests drew an impressive 8 percent of users, but they quickly subsided after Facebook provided more privacy options. Today the feed is the site's nerve center. Chris Kelly, Facebook's chief privacy officer, said that when he speaks on campuses these days, students approach him to say that while they initially "hated" the feed, now they "can't live without it."

Still, Facebook hit a similar privacy snag in November after it launched Beacon, a "social advertising" program that broadcast users' profile pictures and private activities as advertising bulletins. When a Facebook user bought a product on one of dozens of other websites, for example, the information was sent to Facebook and distributed across the user's network as a "personal" ad. ("Joe Johnson rented Traffic at Blockbuster," for example.) Many users had their pictures and actions morphed into advertisements without their consent, turning private commerce into public endorsements. That could be an illegal appropriation, according to Daniel Solove and William McGeveran, two law professors who specialize in digital privacy and who blogged about the issue.

MoveOn.org formed a Facebook group to demand that Beacon switch to "opt-in" -- a default to protect uninformed users -- and allow people to reject the program in one click. The group drew less than .2 percent of Facebook members, far less than during last year's feed protest, but this time MoveOn helped the protest group press specific reforms, generate critical media attention and even rattle some advertisers, who backtracked on using Beacon.

Facebook buckled, agreeing to make the ads opt-in and allowing people to reject the whole program, for now. Facebook founder Mark Zuckerberg apologized to users on the company blog, explaining the problem in the language of the new privacy. "When we first thought of Beacon, our goal was to build a simple product to let people share information across sites with their friends," he wrote. "It had to be lightweight so it wouldn't get in people's way as they browsed the web, but also clear enough so people would be able to easily control what they shared."

Yet both Facebook and its privacy protesters largely operated within the same model of privacy control -- opt-in versus opt-out, sharing versus concealing. The traditional concept of privacy was largely absent from the debate: the premise that what people do on other websites should never be anyone else's business. After all, why would people want to browse the web with "lightweight" surveillance broadcasting their pictures and supposed endorsements of products they happen to buy? And why do people continue to give pictures and personal information to a company that reserves the right to use their photos -- and their very identities -- to sell more advertising, products and market targeting in the future?