Dana Boyd, SXSW and Privacy Feudalism

I'm beginning to like dana boyd No, seriously, I first came across her stuff a few years ago and found it a bit too "Social media right on" - Teen Brave New World laced liberally with Kool Aid - the sort of academic stuff Posy Simmonds would send up most wittily. But I think moving to Microsoft has been the making of her as she has started to embrace the real world outside academia and the Teen. In other words, I find myself agreeing with her more and more

SXSW this year (to me) has seen the scary trend of a vicious competition between various privacy-busting location based services for (ahem) Buzz. Thus this piece from SXSW by dana on Privacy is rather good - here are some highlights:

DEAR ERIC SCHMIDT, PRIVACY IS NOT DEAD. KTXBY.

No matter how many times a privileged straight white male technology executive pronounces the death of privacy, Privacy Is Not Dead. People of all ages care deeply about privacy. And they care just as much about privacy online as they do offline. But what privacy means may not be what you think.

Fundamentally, privacy is about having control over how information flows. It's about being able to understand the social setting in order to behave appropriately. To do so, people must trust their interpretation of the context, including the people in the room and the architecture that defines the setting. When they feel as though control has been taken away from them or when they lack the control they need to do the right thing, they scream privacy foul.

To get at the challenges around privacy, let's consider a recent privacy FAIL: Google Buzz. What the outrage around Google Buzz showed us is that people care deeply about privacy and control. Don't get me wrong - plenty of people will use the service and it will be extremely popular, but this doesn't mean Google didn’t screw up. They’re taking a hit in terms of trust, because not everyone benefited from what they did.

Hear hear. And then there is this:

THE BINARIES OF PUBLIC AND PRIVATE

It's easy to think that "public" and "private" are binaries. We certainly build a lot of technology with this assumption. At best, we break out of this with access-control lists where we list specific people who some piece of content should be available to. And at best, we expand our notion of "private" to include everything that is not "public." But this binary logic isn't good enough for understanding what people mean when they talk about privacy. What people experience when they talk about privacy is more complicated than what can be instantiated in a byte.

To get at this, let's talk about how people experience public and private in unmediated situations. Because it's not so binary there either.

First, think about a conversation that you may have with a close friend. You may think about that conversation as private, but there is nothing stopping your friend from telling someone else what was said, except for your trust in your friend. You actually learned to trust your friend, presumably through experience.

Learning who to trust is actually quite hard. Anyone who has middle school-aged kids knows that there's inevitably a point in time when someone says something that they shouldn't have and tears are shed. It's hard to learn to really know for sure that someone will keep their word. But we don't choose not to tell people things simply because they could spill the beans. We do our best to assess the situation and act accordingly.

Quite - we have been saying for 5 years that the trust seeking systems in Real Life are far more nuanced than a few puffs of whuffie, and that online systems are still very risky as they are so crude in ability to divine intentions - especially given the economic motives of some of the major players. She sums up with:

CHANGING THE RULES

Let's think of this in terms of a second privacy FAIL: Facebook's changes in December. For those who missed it, Facebook asked users to reconsider their privacy settings. The first instantiation of the process asked users to consider various types of content and choose whether to make that content available to "Everyone" or to keep their old settings. The default new choice was "Everyone." Many users encountered this pop-up when they logged in and just clicked on through because they wanted to get to Facebook itself. In doing so, these users changed all of their settings to public, many without realizing it. When challenged by the Federal Trade Commission, Facebook proudly announced that 35% of users had altered their privacy settings when they had encountered this popup. They were proud of this because, as research has shown, very few people actually change the defaults. But this means that 65% of users changed their settings to public.

If one believes that no one cares about privacy, one might think that Facebook users consciously made their content public. But I've spent a lot of time browsing Facebook's "Everybody" feed since the privacy setting debacle in December and I don't think a lot of what I'm seeing is meant to be public. [Picture of some "public" status updates on Facebook.] So I started asking non-techy users about their privacy settings on Facebook. I ask them what they think their settings are and then ask them to look at their settings with me. I have yet to find someone whose belief matched up with their reality. That is not good news. Facebook built its name and reputation on being a closed network that enabled privacy in new ways, something that its users deeply value and STILL believe is the case. Are there Facebook users who want their content to be publicly accessible? Of course. But 65% of all Facebook users? No way.

And she concludes with Five key issues:

PRIVACY DISCONNECTS

When thinking about privacy in a digital context, there are five main things you need to know.

First, you must differentiate between PII and PEI. If you've spent any time thinking about privacy, you've probably heard of PII - "Personally Identifiable Information." All too often, we assume that when people make PII available publicly that they don't care about privacy. While some folks are deeply concerned about PII, PII isn't the whole privacy story. What many people are concerned about is PEI - "Personally Embarrassing Information." This is what they're brokering, battling over, and trying to make sense of.

Second, we're seeing an inversion of defaults when it comes to what's public and what's private. Historically, a conversation that you might have in the hallway is private by default, public through effort. It's private because no one bothers to share what's being said. The conversation may be made public if something worth spreading is said. Even though the conversation took place in a public setting, the conversation is private by default, public through effort.

Third, people regularly calculate both what they have to lose and what they have to gain when entering public situations. Having control over a situation is extremely important, but it must be weighed against the opportunities that one might have to gain a friend or have a new experience by being public. The equations people use differ depending on where they are at in their life. Most generalizably, youth focus on all that they have to gain when entering into public spaces while adults are thinking about all that they have to lose. Part of the challenge in this is figuring out where someone's at and what their expectations are.

Fourth concept. Keep in mind that people don’t always make material publicly accessible because they want the world to see it. Consider this quote from 17-year-old Bly Lauritano-Warner:

"My mom always uses the excuse about the internet being "public" when she defends herself. It's not like I do anything to be ashamed of, but a girl needs her privacy. I do online journals so I can communicate with my friends. Not so my mother could catch up on the latest gossip of my life."

Finally, I want to come back to what I keep raising briefly but not properly addressing. Just because something is publicly accessible does not mean that people want it to be publicized. Making something that is public more public is a violation of privacy.

All very good stuff and I urge you to tread the whole original. But I want to leave you with an observation of my own, which is that the people who are heading the companies espousing Public Living the most, are also ensuring their own privacy the most - to the extent that I think we are seeing the emergence of "Privacy Feudalism" - there is a risk that in the future only the rich/powerful will have privacy, life will be lived in a public bubble except for those who can live behind the gated online communities.