An Investigation on Social Media for Privacy Violations

This report investigates the pervasive issue of privacy violations stemming from the use of social media platforms. It begins with an introduction that highlights the intertwined nature of security and privacy breaches, emphasizing that privacy concerns don't necessarily require security failures. The report delves into a comprehensive literature review, defining privacy in various contexts, including online personal information and social network privacy, and also includes a look at youth's understanding of privacy. It explores the inherent risks associated with online activity and discusses methods of protection. The methodology chapter outlines research objectives, scope, and design, detailing the research methods, sample, and data analysis techniques. The report then presents data analysis and findings, offering results and conclusions based on the research conducted. The report concludes by discussing the potential for social media to violate the privacy of users.

[Type the company name]
An investigation on use of social media for violating privacy of others
[Type the document subtitle]
Student
[Pick the date]
[Type the abstract of the document here. The abstract is typically a short summary of the contents of
the document. Type the abstract of the document here. The abstract is typically a short summary of
the contents of the document.]

Contents
Chapter1: Introduction.....................................................................................................................2
Chapter 2: LITERATURE REVIEW.............................................................................................6
Definitions of privacy..................................................................................................................6
Online personal information privacy...........................................................................................7
Online social network privacy...................................................................................................12
Youth and the Concept of Privacy.............................................................................................14
Online privacy risks...................................................................................................................16
Online privacy protection..........................................................................................................18
Chapter 3: Research Methodology...............................................................................................21
Research objectives...................................................................................................................21
Purpose of research....................................................................................................................21
Scope of research.......................................................................................................................22
Research Design........................................................................................................................23
Research Methods......................................................................................................................24
Research Sample and Instruments used.....................................................................................27
Data analysis technique.............................................................................................................29
Limitations.................................................................................................................................32
Chapter 4: Data analysis and Findings..........................................................................................33
Research analysis and results.....................................................................................................45
REFERENCES..............................................................................................................................52
1

Chapter1: Introduction
When it comes to privacy and security issues on social networks, "the sites most likely to suffer
from issues are the most popular ones," Graham Cluley, Chief Technology Officer at UK tech
security firm Sophos says. But security issues and privacy issues are entirely two different
beasts. A security issue occurs when a hacker gains unauthorized access to a site's protected
coding or written language. Privacy issues, those involving the unwarranted access of private
information, don't necessarily have to involve security breaches. Someone can gain access to
confidential information by simply watching you type your password. But both types of breaches
are often intertwined on social networks, especially since anyone who breaches a site's security
network opens the door to easy access to private information belonging to any user. But the
potential harm to an individual user really boils down to how much a user engages in a social
networking site, as well as the amount of information they're willing to share. In other words, the
Facebook user with 900 friends and 60 group memberships is a lot more likely to be harmed by a
breach than someone who barely uses the site.
Security lapses on social networks don't necessarily involve the exploitation of a user's private
information. Take, for example, the infamous "Samy" MySpace XSS worm that effectively shut
the site down for a few days in October 2005. The "Samy" virus (named after the virus' creator)
was fairly harmless, and the malware snarkily added the words "Samy Is My Hero" to the top of
every affected user's MySpace profile page. A colossal inconvenience, naturally, but nobody's
identity was stolen and no private information was leaked. In the end, the problem galvanized the
MySpace team to roll up their sleeves and seriously tighten the site's security. Result: no major
break-ins since. Unfortunately, these kinds of breaches, purely for sport in "Samy's" case, are
rare.
2

The reason social network security and privacy lapses exist results simply from the astronomical
amounts of information the sites process each and every day that end up making it that much
easier to exploit a single flaw in the system. Features that invite user participation — messages,
invitations, photos, open platform applications, etc. — are often the avenues used to gain access
to private information, especially in the case of Facebook. Adrienne Felt, a Ph.D. candidate at
Berkeley, made small headlines last year when she exposed a potentially devastating hole in the
framework of Facebook's third-party application programming interface (API) which allows for
easy theft of private information. Felt and her co-researchers found that third-party platform
applications for Facebook gave developers access to far more information (addresses, pictures,
interests, etc.) than needed to run the app.
This potential privacy breach is actually built into the systematic framework of Facebook, and
unfortunately the flaw renders the system almost indefensible. "The question for social networks
is resolving the difference between mistakes in implementation and what the design of the
application platform is intended to allow," David Evans, Assistant Professor of Computer
Science at the University of Virginia, says. There's also the question of whom we should hold
responsible for the over-sharing of user data? That resolution isn't likely to come anytime soon,
says Evans, because a new, more regulated API would require Facebook "to break a lot of
applications, and a lot of companies are trying to make money off applications now." Felt agrees,
noting that now "there are marketing businesses built on top of the idea that third parties can get
access to data on Facebook."
The problems plaguing social network security and privacy issues, for now, can only be resolved
if users take a more careful approach to what they share and how much. With the growth of
social networks, it's becoming harder to effectively monitor and protect site users and their
3

activity because the tasks of security programmers becomes increasingly spread out. Imagine if a
prison whose inmate count jumped from a few dozen to 250 million in less than five years only
employed 300 guards (in the case of MySpace). In response to the potential threats that users are
expose to, most of the major networks now enable users to set privacy controls for who has the
ability to view their information. But, considering the application loophole in Facebook,
increased privacy settings don't always guarantee privacy. But even when the flawed API was
publicly exposed, "Facebook changed the wording of the user agreement a little bit, but nothing
technically to solve the problem," says Evans. That means if a nefarious application developer
wanted to sell the personal info of people who used his app to advertising companies, he or she
could.
Yet users still post tons of personal data on social networks without batting an eye. It's only
natural. Anonymity and the fact that you're communicating with a machine instead of an actual
person (or people in the case of social networking) makes sharing a lot easier. "People should
just exercise common sense online, but the problem with common sense is that it's not very
common. If you wouldn't invite these people into your house to see your cat, you certainly
wouldn't let them see pictures from holiday," says Cluley.
In the end, the only tried and true solution to social network privacy and security issues is to
limit your presence altogether. Don't post anything you wouldn't mind telling a complete
stranger, because in reality that's the potential for access. Be careful who you add as a "friend,"
because there's simply no way of verifying a user's actual identity online. Cluley compares it to a
rep from your company's IT deparprivacyent calling to ask for your login password — "Most
people will give it over" with no proof of the IT rep actually existing. The caller might be your
IT rep, or she might not. "This kind of scam happens all the time," says Cluley. Friends on social
4

networks should know that real friends should know personal information already, negating the
need to post it online.
Will there ever be a security breach-free social network? Probably not. "Any complex system has
vulnerabilities in it. It's just the nature of building something above a certain level of
complexity," says Professor Evans. According to Felt, the best idea is a completely private social
network. "It simply requires that there's no gossip in the circle, by which I mean one person who
sets their privacy settings so low that third parties can use them to get to their friends."
"Social networks are great fun, and can be advantageous but people really need to understand
that it's complicated world and you need to step wisely," Cluley says.
5

Chapter 2: LITERATURE REVIEW
Currently, in the era of advanced internet technology, Social Network becomes incredibly
popular tool on the internet and becomes widely used around the world. It is powerful tool in any
ages of people especially among teenagers and young adults in the propose of communication
and self-expression [1], and it is easy mean of sharing information with other users who has a
common interest such as photos, likes, dislikes, interests, relationship status, job details, current
town details, political views, religious views etc. [2] [3] [4].Social networking sites and
associated privacy concerns is one of the most debated topic nowadays as participation in such
sites has increased dramatically. A number of journals and articles come up with this issue that
how the increase in the usage of social networking sites is leading to various online crimes.
Unfortunately, though this technology most of users are not aware of the privacy risk associated
whenever they shared sensitive information in the internet [4], so that privacy concern will be
raised among those online interactions if their personal information has been shared to other
people [3] [5].
Definitions of privacy
The word privacy has many subtly different meanings, ranging from personal privacy (which
includes seclusion and bodily privacy) to information privacy, each with their own definition.
Privacy on the Web in general revolves mostly around Information Privacy, as defined below in
the IITF wording that Kang uses: Information Privacy is “an individual’s claim to control the
terms under which personal information–information identifiable to the individual–is acquired,
disclosed or used.”Palen and Dourish classify three privacy boundaries with which individuals
are struggling. 1. The disclosure boundary (managing the tension between private and public), 2.
The identity boundary (managing self representation with specific audience, e.g. one will behave
6

differently at work than when among friends), 3. The temporal boundary (managing past actions
with future expectations; user behavior may change over time).
Online personal information privacy
Protecting the privacy of personal information is one of the biggest challenges facing website
developers, especially social network providers. Several researchers have discussed the issue of
privacy. Bae and Kim (2010) suggested that, in order to achieve a high level of privacy, the user
should be given the authority to control the privacy settings when he/she receives or requests a
service related to his/her personal information. The authors noted the importance of designing a
privacy policy to protect personal information by blocking some people from seeing all or part of
the user’s personal information. They also designed a privacy model using mobile agents.
Dötzer (2006, p.4) stated that “once privacy is lost, it is very hard to re-establish that state of
personal rights.” This shows that privacy is essential to the construction of all communication
systems, particularly mobile systems. The concept of self-representation enables users to interact
and introduce themselves based on the data placed on profile pages such as name and pictures
with others. Privacy is an important aspect of self-representation on online social networks since
people share certain information with the public and receive information or comments from
others. The nature and complexity of the Internet cause some threats to web privacy
(Bouguettaya&Eltoweissy 2003). According to Wang and Cui (2008), privacy is a state or
condition of limited access to a person. Privacy regulations can be defined as a set of rules or
policies set by users to achieve a certain level of privacy. In terms of location privacy, privacy
regulations restrict access to information on a user’s location. Each privacy rule or policy can
include some restrictions (Sadeh& Hong 2009). Although there is no policy mandating online
personal information privacy, some types of privacy solutions do exist (Passant et al. 2009).
7

These solutions can be classified into: protective technologies, social awareness and legislative
support. Protective technologies, such as strong authentication and access control, have
developed quickly and have evolved over time. These rely on encryption as a way to solve
privacy concerns. The second type of solution, social awareness, involves educating people
about the possible risks of personal information misuse when they provide data such as their
home address and mobile phone number. Lastly, legislation can be enacted to clarify aspects of
the agreement with users to protect the collection of personal information under the framework
of the law (Campisi, Maiorana&Neri 2009).
Since the inception of the first social networking site, SixDegrees.com at 1997 (Boyd and
Ellison, 2008), the social networking craze has grown beyond all expectations. Data privacy is a
fundamental problem in today's information era. Enormous amounts of data are collected by
government agencies, search engines, social networking systems, hospitals, financial institutions,
and other organizations, and are stored in databases. Those stored information is very crucial for
individuals, people might misuse this information. The problems that exist in the real world such
as theft, fraud, vandalism also exists in online Web 2 environments an identity thief.
According to consumer security risks survey 2014, is done by B2B International in conjunction
with Kaspersky Lab shown that even using social networking is worldwide, but however there
are minority of them understanding the risks of using social networking especially in terms of
using mobile device to access the sites. Correspondingly, more than 78% of correspondents did
not concern their information to be targeted by cyber-attacks or cyber-crime and they though that
no any dangerous with any activities on their social network. The survey also found that one of
ten has ever conversed to anonymous person about personal information, while 15% sending
personal information which has not been exposed anywhere before through social network.
8

Furthermore, 12 % of correspondents using public Wi-Fi to fill online account information, but
only 18% of them who concerned that their personal information disclosure is excessive or not
and 7% seriously considered their communicating through social networking is one of major
factor which information will be lose [6]. Every social network sites ask users to accomplish a
profile which contains privacy information including name, address, email and so on. Through
this information is claim to be danger which can be easily accessed by unexpected person [7] [8],
but what is happening today, most of social network users tend to public real identity and post
private information where privacy will be raised [9]. Accordingly, [3] [4] [7] [8] [10], they
described that online social networking data is of great help to the researchers, analysts, and any
kind of third party who has opportunity to mine and use data for particular purposes such as
spamming, fishing, targeted advertising and so on [4]. This is because sensitive information and
their interaction are stored in social OSN server are not always honest and transparent due to the
nature of OSN allows third parties to collect and analyze easily [9]. Raji and her colleagues
demonstrated that there are some principle privacy problems in social network like Facebook.
For instance, Users used their real information to create an account profile to the rest of the
Facebook users, The default privacy settings are not enough in Facebook, so users expose too
much information to others users, Users do not change the OSN default privacy settings that are
provided, and Sometime it is unavailable to adjust the privacy setting which is offered by
Facebook such as the users can see the whole his or her shared information whenever users add
his or her to be in friend list [9].
However, sometime there is a must to users to reveal personal information in particular reason,
as demonstrated by [7]. They also illustrated that users have to reveal the personal information
on social network in order to be effective and do this for maturing their identities. In reality,
9

online communication can bring them to be intensive revelation compared to face to face
communication. Furthermore, in the face of information of behavior of users are able to
conceptualize as continuum which describes as information privacy protection behavior. This
means information can disclose accurately in one side, but it is not for other sides. By the way,
users can participate all and can protecting their personal information at the same time by partly
disclosing of them.
A blog in a website DashBurst clearly mentions that “with the rise of social media, privacy
concerns have taken a backseat in recent years (Trenchard, 2013).” It talks about the potential
dangers that a young user may likely face while using the social networking site. Thus it
becomes very important for one to read the privacy policies and measures offered by these sites
in order to have a safe online networking. Further, the blog also states the privacy policy changes
brought out by the popular sites like Facebook and Twitter and how it has affected the users. One
of the main reasons cited by experts and research studies for such tremendous popularity of the
social networking sites is the emergence of sites that offer the scope of connectivity in this
virtual world almost at any time of the day. People get in touch with near and dear ones with the
services like Facebook, Twitter, Orkut, LinkedIn, MySpace, etc (Dutton, 2004). In social
networking sites, sharing of private information and giving updates of day to day happening is a
latest trend. These sites heavily caters to the young brigade especially the age group between 15
to 25 years. Sometimes it has been observed that youngsters use these sites for sharing news or
any information rather than sharing it personally. Even if they meet in the morning in college,
information is shared mostly through the social media sites. It shows the growing dependency on
such sites (Kabay, 2010). It is strange enough to note that communication process is hugely
getting affected through the advancement of the internet. With the controversial changes made
10

by the popular social networking site Facebook in 2009, it had beome quite impossible to
maintain a safe invisible account (Trenchard, 2013). By analysing the personal information
revelation behaviour of the users, it has been mainly found out that this factor mainly revolves
around hobbies and interests although it also has other directions. Like for insance, semi-public
information may include schooling or employment details, whereas personal information may
include drinking or drug habits or sexual orientation, etc (Gross & Acquisti, 2005). The apparent
openness of users of the social networking sites calls for unncessary attention from strangers
quite possibly leading to online victimization. It is very easy to join a social networking site. But
without proper knowledge of the security measures, one can be a easy trap for the third parties
like the hackers (Gross & Acquisti, 2005).
Most social networks offer privacy settings that are simple to use, but coarse. They often require
the user to set the visibility for each profile item to either private, friends only, or public.
Sometimes a few more options are given. In the end it boils down to a list of items and check
boxes to either opt-in or opt-out of disclosing these items to certain groups, limiting user control.
Gross and Acquisti show in a case study that most users do not change the default privacy
settings as provided by the OSN. Furthermore these users share a large amount of information on
their profile. Tufecki [27] concludes in his case study that privacy-aware users are more reluctant
to join social networks. However once a privacy aware user joins he is willing to disclose a lot of
information and a user’s privacy is regulated mostly through visibility, i.e. the privacy settings of
the OSN (Online Social Networks). This privacy aware user aims to remain in control.
Furthermore users are more pre-occupied with the current visibility of their information and do
not look towards future implications. It seems that users implicitly trust social network providers
to handle user data in a fair and conscientious way.
11