Privacy Risks in Social Network Sites
Prioritization and Framework
David Riphagen

Social Network Sites?

Social Network Sites?
1.Personal profile

Social Network Sites?
1.Personal profile
2.Friends list

Social Network Sites?
1.Personal profile
2.Friends list
3.Ability to view other profiles

Social Network Sites?
1.Personal profile
2.Friends list
3.Ability to view other profiles
4.Membership rules

Severe Privacy Threats
for
Users of Social Network Sites

Prioritize Threats

Deconstruct Threats
by
1. Activities that cause damage
2. Reasons why activities are damaging

Threat?

Information Collection
Threat
“Joe”

Information Collection
Threat
“Joe”

Information Collection
Threat
“Joe”

Source: Riphagen, D., 2008. The Online Panopticon. Privacy Risks for Users of Social Network Sites. Identification and prioritizations of privacy rirks for users of Social
Network Sites and cosniderations for policy makers to minimize these risks. , 149. Available at:
www.davidriphagen.nl/Riphagen_2008_PrivacyRisksForUsersofSocialNetworkSites.pdf.

Source: Riphagen, D., 2008. The Online Panopticon. Privacy Risks for Users of Social Network Sites. Identification and prioritizations of privacy rirks for users of Social
Network Sites and cosniderations for policy makers to minimize these risks. , 149. Available at:
www.davidriphagen.nl/Riphagen_2008_PrivacyRisksForUsersofSocialNetworkSites.pdf.

Threat Collection
“Joe”

Threat Collection
Processing
“Joe”

Information Processing
Threat
Processing

Information Processing
Threat
Δ Processing
Joe changed his relationship
status from
‘in a relation’
to
‘invisible’

Threat Collection
Processing
“Joe”

Threat Collection
Processing
“Joe”
Dissemination

Information Dissemination
Threat
“If you use a service from a partner, the privacy
statement of that partner applies. Check their
privacy statement when visiting their website.”
Source: Hyves Prvacy Policy. Available at: http://www.hyves.nl/privacy/

Information Dissemination
Threat
Source: API Methods Hyves API. Available at: http://trac.hyves-api.nl/wiki/APIMethods

</info>
<userid>738a3e92186fe5e9</userid>
</blogs_getComments_result>
<visibility>superpublic</visibility>
APIMethods - hyves_api - Trac <created>1205496045</created>
</www>
Information Dissemination
returnvalues
<www> <totalresults>2</totalresults>
<wwwid>a08d0f76c34ea081</wwwid>
<totalpages>1</totalpages>
body, comment, commentid, created, currentpage, info, resultsperpage, running_millise
<emotion>Distracting Gorilla</emotion>
<resultsperpage>2</resultsperpage>
target_blogid, timestamp_difference, totalpages, totalresults, userid
Threat <where>jungle</where>
<currentpage>1</currentpage>
<userid>738a3e92186fe5e9</userid>
<running_milliseconds>281</running_milliseconds>
blogs.getForFriends <visibility>superpublic</visibility>
</info>
<created>1205496004</created>
</tips_getComments_result>
Retrieves the most recent blogs for the friends of the loggedin user.
</www>
<info>
Added: Apr 17, 2008
returnvalues <timestamp_difference>0</timestamp_difference>
Paginated <totalresults>3</totalresults>
body, comment, commentid, created, currentpage, info, resultsperpage, running_millisec
<totalpages>2</totalpages>
params <resultsperpage>2</resultsperpage>
target_tipid, timestamp_difference, totalpages, totalresults, userid
<currentpage>1</currentpage>
tips.getForFriends <running_milliseconds>297</running_milliseconds>
none
</info>
</wwws_getByUser_result>
Retrieves the most recent tips for the friends of the loggedin user.
responsefields
Added: Apr 17, 2008
returnvalues
This method supports the use of ha_responsefields. Acceptable values are a comma sep
Paginated
of 0 or more of the following:
created, currentpage, emotion, info, resultsperpage, running_milliseconds, timestamp_differe
totalpages, totalresults, userid, visibility, where, www, wwwid
params commentscount
respectscount
wwws.getForFriends
tipcategoryid --- Filter selecting tips by tipcategoryid.
tags
Optional
Retrieves the most recent www(Who What Where)s for the friends of the loggedin user.
sort
responsefields
Paginated
Sorted by age. The most recently created items are returned first.
This method supports the use of ha_responsefields. Acceptable values are a comma sep
params
of 0 or more of the following:
extra
none
commentscount to work, you need to supply a valid access token to oauth_token
Source: API MethodsFor this Available at: http://trac.hyves-api.nl/wiki/APIMethods
Hyves API. function
sort respectscount
For more information on oAuth, see APIoAuth and http://oauth.net/.

Collection
Processing
Dissemination

Incident?

Survey
Threat
• American privacy and Internet experts
Incident • Identify privacy incidents
• How much damage incurred?
• How many users affected?

!\"#$%$&'&()*+*,-.%/(*0%(\"&1*#2*!\"&3%/)*,4/&564(7
#\"!
$I $I
B C ?
'\"# D
G
A
'\"!
E
%I H $I
F
&\"#
869%(&36*,-.%/(*#4*:76\"7
&\"!
%I
@
%\"#
?I()*+,*-(./0,1,02(03./4,*5
@I(6553-5.0,7*(78(9.0.(:(;378,+-<(78(=<-3< ,
%\"! AI(>7(,*873?.0,7*(71-3(:(/7*037+(78(<-/7*9.32(=<-
BI(@0.+4-3<(:(;3-9.073<(:A=++,-<
CI(B9-*0,02(0C-80
$\"# DI*D71-3*?-*0(=<.5-(78(,*87
EI(@C.3,*5(:(<-++,*5(78(,*87(07(&39(;.30,-< J#(%'*,42#\"-%(&#4*?K%\"64677
FI(E*F.*0-9(9,<<-?,*.0,7*(07(70C-3<(:(537=;<
$\"! B&776-&4%(&#4*(#*L\"#495#6\"7
,I(G,<;+-.<=3-(837?(A-,*5(?7*,073-9
GI(G.?.5-(07(3-;=0.0,7*(A/(78(9,</+7<=3-
8#*A#4(\"#'*#36\"*,42#\"-%(&#4
!\"# HI*H7<0,*5(78(,*873?.0,7*(A2(70C-3<
$I JK;-30<(97(*70(.53--(7*(L;37A.A,+,02M
%I JK;-30<(97(*70(.53--(7*(L*-5.0,1-(,?;./0M
!
! !\"# $\"! $\"# %\"! %\"# &\"! &\"# '\"! '\"# #\"!
!\"#$%$&'&()*#2*;//<\"\"64/6*#4*%*=%\"96*>/%'6

Damage?

Collection
Processing
Dissemination

How is this Damaging?
Threat
Incident
Damage

How is this Damaging?
Threat
1. Information-based harm
Incident
Damage

How is this Damaging?
Threat
1. Information-based harm
Incident 2. Informational inequality
Damage

How is this Damaging?
Threat
1. Information-based harm
Incident 2. Informational inequality
3. Informational injustice
Damage

How is this Damaging?
Threat
1. Information-based harm
Incident 2. Informational inequality
3. Informational injustice
Damage
4. Restriction of moral autonomy /
Inability to create moral identity

Recovery?

MySpace. This information, and especially the final remark, was posted with
the intent to harm Megan. Solove (2008d) states that it is hard to prove that
these remarks led directly to the suicide. However, it is very clear that the
remarks were made to harm Megan, and therefore part of information-based
harm.
Threat
Information-based Information Informational Moral
harm inequality injustice autonomy and
identification
Information 3. Harmful remarks
collection towards Megan are
Incident
uploaded to
MySpace (collected).
Information
processing
Information 1. Disclosure of 2. An adult, from a
Damage dissemination Megan's profile ID different social
makes contacting sphere, contacts
her possible. Megan.
Table 7: Framework applied to Megan Meier case
Recovery With this analysis, I have showed that the specific harms in the Megan Meier case
derive from the possibilities that identity-relevant information is used for harm, and the
movement of this information through different spheres.

MySpace. This information, and especially the final remark, was posted with
the intent to harm Megan. Solove (2008d) states that it is hard to prove that
these remarks led directly to the suicide. However, it is very clear that the
remarks were made to harm Megan, and therefore part of information-based
harm.
Threat
Information-based Information Informational Moral
harm inequality injustice autonomy and
identification
Information 3. Harmful remarks
collection towards Megan are
Incident
uploaded to
MySpace (collected).
Information
processing
Information 1. Disclosure of 2. An adult, from a
Damage dissemination Megan's profile ID different social
makes contacting sphere, contacts
her possible. Megan.
Table 7: Framework applied to Megan Meier case
Recovery With this analysis, I have showed that the specific harms in the Megan Meier case
derive from the possibilities that identity-relevant information is used for harm, and the
movement of this information through different spheres.

MySpace. This information, and especially the final remark, was posted with
the intent to harm Megan. Solove (2008d) states that it is hard to prove that
these remarks led directly to the suicide. However, it is very clear that the
remarks were made to harm Megan, and therefore part of information-based
harm.
Threat
Information-based Information Informational Moral
harm inequality injustice autonomy and
identification
Information 3. Harmful remarks
collection towards Megan are
Incident
uploaded to
MySpace (collected).
Information
processing
Information 1. Disclosure of 2. An adult, from a
Damage dissemination Megan's profile ID different social
makes contacting sphere, contacts
her possible. Megan.
Table 7: Framework applied to Megan Meier case
Recovery With this analysis, I have showed that the specific harms in the Megan Meier case
derive from the possibilities that identity-relevant information is used for harm, and the
movement of this information through different spheres.

MySpace. This information, and especially the final remark, was posted with
the intent to harm Megan. Solove (2008d) states that it is hard to prove that
these remarks led directly to the suicide. However, it is very clear that the
remarks were made to harm Megan, and therefore part of information-based
harm.
Threat
Information-based Information Informational Moral
harm inequality injustice autonomy and
identification
Information 3. Harmful remarks
collection towards Megan are
Incident
uploaded to
MySpace (collected).
Information
processing
Information 1. Disclosure of 2. An adult, from a
Damage dissemination Megan's profile ID different social
makes contacting sphere, contacts
her possible. Megan.
Table 7: Framework applied to Megan Meier case
Recovery With this analysis, I have showed that the specific harms in the Megan Meier case
derive from the possibilities that identity-relevant information is used for harm, and the
movement of this information through different spheres.

MySpace. This information, and especially the final remark, was posted with
the intent to harm Megan. Solove (2008d) states that it is hard to prove that
these remarks led directly to the suicide. However, it is very clear that the
remarks were made to harm Megan, and therefore part of information-based
harm.
Threat
Information-based Information Informational Moral
harm inequality injustice autonomy and
identification
Information 3. Harmful remarks
collection towards Megan are
Incident
uploaded to
MySpace (collected).
Information
processing
Information 1. Disclosure of 2. An adult, from a
Damage dissemination Megan's profile ID different social
makes contacting sphere, contacts
her possible. Megan.
Table 7: Framework applied to Megan Meier case
Recovery With this analysis, I have showed that the specific harms in the Megan Meier case
derive from the possibilities that identity-relevant information is used for harm, and the
movement of this information through different spheres.

Severe Privacy Threats
for
Users of Social Network Sites

Prioritize Threats

Deconstruct Threats
by
1. Activities that cause damage
2. Reasons why activities are damaging

Privacy Risks in Social Network Sites
Questions?

Back-up

Research Activities

Research Activities
1 2 3 4
Facebook
Literature Desk Expert
Case
Review Research Survey
Study

Threat
“Joe”

Threat Collection
“Joe”

Collection
Privacy threats in Social Network Sites
should be conceptualized as
Processing
unwanted access to
Identity-Relevant Information
Dissemination

The main incident that puts the
Collection
privacy of users of SNS at risk is:
Processing
The collection of information from
secondary sources,
Dissemination
Which is used by the government

!\"#$%\"%&'()*+,-
!\"##$%&'\"()\"*)
\"+,$%&'-$)'(*\"./0&'\"(
!\"#$%\"%&'()*+.-
!(/'01 1(*\"./0&'\"()0(0#23'3
83%/9%&'()*+:- 0(4)(\"./0&'-$
$-0#50&'\"(
!(/'01 !(/'01
64$/#4#)&%&'()*+7- 2#3#/($4#)&*+5-

6#2-17+ !\"#$%&%'(\")*\"#+#(\",- 3#,-'%45#+
S*)1 2\"#3().*450)'*(
O4#P*F%( !\"#$%&'(')'*(#*+ M')%./)5.%#.%F'%8
>*:*F%
#',-*.)/()#0*(0%-)1 $%19#.%1%/.0B
Q'19#/(/:;1'1
6\"#7./,%8*.9 M')%./)5.%#.%F'%8
#+*.#/(/:;1'1 $%19#.%1%/.0B
./0$1\"(21\")*\"#+#(\",-
DAD#+./,%8*.9 M')%./)5.%#.%F'%8
<\"#=%;#+%/)5.%1
7/'.#3(+*.,/)'*( 7/0%N**9#A/1%#>)54;
#*+#>?>
H./0)'0%1 $%19#.%1%/.0B
O4#P*F%( @\"#A:/11'&'0/)'*( M')%./)5.%#.%F'%8
>*:*F% #*+#)B.%/)1 $%19#.%1%/.0B
.&0%\"%,($*\"#+#(\",-
$'1/E.%%,%() C\"#D%)B*4*:*E; M')%./)5.%#.%F'%8
,%/15.%,%() #*+#15.F%; $%19#.%1%/.0B
H*11'N':');#R#3,-/0) >5.F%;#/(4#'()%.F'%81
G\"#H.'F/0;#'(0'4%()1
,/).'K $%19#.%1%/.0B
O4#P*F%( I\"#JK/,-:%1#*+ M')%./)5.%#.%F'%8
>*:*F% #-.'F/0;#.'191 $%19#.%1%/.0B
T\"#Q%&:%0)'*(1
2L\"#A*(0:51'*(1#/(4
#.%0*,,%(4/)'*(1

!\"#$%& '(80#-%&*0(4)099$)&*0(:4
;#0)$55*(.:4+*55$-*(%&*0(
3#$1$(&*1$4
-$%56#$5
<54*+$(&*=*$+44>24$?;$#&5
'()*+$(& *(4)\"%;&$#4@
,$&$)&*1$4
-$%56#$5
A$%+54&04-0#%94#$%50(54&0
,%-%.$ #$5&#*)&4%))$554&04*(80#-%&*0(
70##$)&*1$4
-$%56#$5
/$)01$#2

!
!\"#$%&'()$*('+\",&-.$%()/\"$01(&-$&-02'32'(,&-.$,1&'4$
3(',&\"56
! 7!7$8(0&)&,(,\"$&-82'*(,&2-$4&55\"*&-(,&2-$,2$2,1\"'$/5\"'56
!
71('&-.$&-82'*(,&2-$9\",#\"\"-$,23:)\"%\")$42*(&-56
!\"#$%&'(&)* !
;&-(-0&()$(.'\"\"*\"-,$9\",#\"\"-$;<$(-4$='4$3(',&\"5
!
>-82'*(,&2-$02))\"0,&2-?$/5\"'@5$(0,&2-5$8'2*$($,1&'4:3(',A$
#\"95&,\"6
! >-82'*(,&2-$3'20\"55&-.?$4\",\"'*&-\"$,2$#12*$,2$5\"-4$,1\"$
&-82'*(,&2-B$3'23'&\",('A$().2'&,1*6
+,-##&.&$-(&)* ! >-82'*(,&2-$4&55\"*&-(,&2-?$,2$3\"23)\"$&-$8'&\"-45$)&5,6
!
!2$&-82'*\"4$02-5\"-,$#1\"-$02))\"0,&-.$&-82'*(,&2-?$9('\")A$
-2,&0\"(9)\"$23,:2/,$@,2(5,$323:/3@6
! !2-:,'(-53('(-,$3'20\"55&-.$28$&-82'*(,&2-$&-$($9)(0+$92C$
*24\")B$/5\"'$0(--2,$3(',&0&3(,\"$D$-2$(002/-,(9&)&,A6
/\"$0-*&#1# !
E&55\"*&-(,&2-$28$&-82'*(,&2-$9\"A2-4$/5\"'@5$02-,'2)6
! ;\"\")&-.$28$-2$02-,'2)$2%\"'$&-82'*(,&2-$02))\"0,&2-B$
/-3)\"(5(-,$5/'3'&5\"6
! F5\"'5$4&4$-2,$(-,&0&3(,\"$,1(,$,1\"&'$8'&\"-45$#2/)4$9\"02*\"$
(#('\"$28$3/'01(5\"4$3'\"5\"-,56
23($)1\"#

!\"#$%&'()*+,$-\"+.%+&
9\":.&;&<%=$#\"-),*.
1%\"-$0%.&,2&-(%& 1\")0*%..&&,2&5,*-0\"5-
+.?5(,#,=?
34%5)6)5&+0,8$5-
B\"/%&>(%,0? /$+'+#$'()/(\"0 D5,*,/)5. +,-%*-)\"# B\"/%&>(%,0?
C5-,0&C*\"#?.). !\"#$%&'(\")*
'$.-,/%0.
/(\"0)\"1)2\"\"34)5)!%-,$#%4
1%\"-$0%.&,2&-(%& >,4,#,=?
34%5)6)5&7%8)$/ 3,5)\"#&@%-:,0A&>(%,0?

!.\"1(%\" :&%\"& ;<'\"8=>.\"1, B#9%\"(5%(1@ ;<'\"8=>.\"1,
?%+&'1%& 7>>/'$.1'#( A%)C/.1#\"& 7>>/'$.1'#(
!\"#9'8%\"& !\"#9'8%\"&
D(1%\".$1*2'1< :&%\"&
4'&&%5'(.1%*1#
!\"#$%&&'()*+,
6#//%$1'#( -#$'./*0%12#\"3*-'1% 4'&&%5'(.1'#(
789%\"1'&'() 7$1'9'&1&@ 789%\"1'&'()
789%\"1'&%\"& 0%12#\"3& A%&%.\"$<%\"& 0%12#\"3&

The Online Panopticon
SNS restricts access to SNS leaves access to
information information open
User does not join SNS User: ( 0 ) - ( 0 ) = ( 0 ) User: ( 0 ) - ( 1 ) = ( -1 )
SNS: ( 0 ) - ( 1 ) = ( -1 ) SNS: ( 0 ) - ( 0 ) = ( 0 )
User does join SNS User: ( 1 ) - ( 0 ) = ( 1 ) User: ( 1 ) - ( 2 ) = ( -1 )
SNS: ( 1 ) - ( 1 ) = ( 0 ) SNS: ( 1 ) - ( 0 ) = ( 1 )
Table 1: options with pay-offs for Social Network Sites and users.
The model is based on game theory, a science that investigates options and
outcomes of multi-actor situations in the terms of alternatives with different pay-offs.
Users always derive benefits from joining a SNS in terms of increased social contact,
therefore this option always scores (1). However, users are also subject to ‘tagging’ of
their photographs and discussions about them if they are not members of SNS
(ENISA 2007). If a SNS restricts this form of information uploading without consent,

!\"#$%&'()$\"*
/%$.-00)\"1
+,,)(,\"#-%.
!\"#$%&'()$\"* /'(.#-0-1\"#-%.
+$,,-.()$\" /.*(12)-#3
42)A(-&&\".1( 4(1%.'\")356*(
/.#())%,\"#-%. 781&2*-%.
!\"#\"
$%&'()* !\"#$%&'()$\"*
2)00-&)\"'()$\"
9)(\"1:5%;5<%.0-'(.#-\"&-#3
!-*1&%*2)(
2'('*3456-.( 78=%*2)(
/.1)(\"*('5+11(**->-&-#3
9&\"1?@\"-&
+==)%=)-\"#-%.
!-*#%)#-%.

0
0.8
1.6
2.4
3.2
4.0
!\"\"#$\"#%&'%$(
3.35
)*+,%-&'%$(.$/.\"#%0&'1./&-'2
3.30
3#1&-4.$/.-$(/%51('%&,%'6
3.05
7&,21.,%84'
2.95
9%84'.'$.\"*+,%-%'6
2.65
:('#*2%$(
2.25
!\"#$%&'#()'(*'#'\"#'%(+(#,&$+#&--.(++#/.01&23#%&.4+5

0
2
4
6
8
10
!\"#$%&'()*#+,#-./0%.0/#&11201
3\"#4(&.#56)21#6.#7%&'()*#+,#-./0%.0/#&11201
8\"#4(&.#56)21#6.#7%&'()*#9:;#-./0%.0/#&11201
<\"#=&>.&5&)(./#0?70%&0.)0#6.#-./0%.0/#7%&'()*#&11201
@\"#,0)6>.&A0B#(1#(.#0?70%/#6.#-./0%.0/#7%&'()*#&11201

identity, but from controlling the dissemination of their identity to others.
Information- Information Informational Moral autonomy
based harm inequality injustice and
identification
Information 2. Information 1. Information
collection collection takes collected from
place without third-party
informed consent website, other
and this social sphere.
information could
be embarrassing
to users.
Information 4. Users are 3.Algorithm
processing unaware of how defines to whom
this algorithm the information
works.
will be
disseminated.
Information 6. Information 5. Information is 7. User not able to
dissemination could be used to being build his own
harm user, for disseminated to moral biography.
example friends, in
embarrassing various social
information. spheres.
Table 5: Framework applied to Beacon case

harm.
Information-based Information Informational Moral
harm inequality injustice autonomy and
identification
Information 3. Harmful remarks
collection towards Megan are
uploaded to
MySpace (collected).
Information
processing
Information 1. Disclosure of 2. An adult, from a
dissemination Megan's profile ID different social
makes contacting sphere, contacts
her possible. Megan.
Table 7: Framework applied to Megan Meier case
With this analysis, I have showed that the specific harms in the Megan Meier case
derive from the possibilities that identity-relevant information is used for harm, and the
movement of this information through different spheres.

Information- Information Informational Moral autonomy
based harm inequality injustice and identification
Information
collection
Information
processing
Information 1. More 2. Users cannot
dissemination information is expect that a birthday
disclosed than application gets access
needed to third to photos, because
parties, even this information
sensitive resides in different
information. social spheres.
Table 11: Framework applied to Facebook Third-party Applications case
The Facebook Third-Party Applications case shows that users' expectations of
privacy and expectations of an application’s function on Social Network Sites is very
different from what happens in reality. Also, it shows that SNS like Facebook do not
have the same standard of security on every part or function of their website.