Identity Management for IBMers on Facebook Joshua Scribner Social Software Advocate IBM SWG, BlueIQ [email_address] @joshscribner Version 1.3, Updated 10/15/2009

Enterprise Benefits of a Social Network Maintain your most valuable asset: your network Efficiently manage inbound and outbound information from your network Create an online identity to represent yourself as an expert or client contact Grow your network through existing contacts

Maintain your most valuable asset: your network

Efficiently manage inbound and outbound information from your network

Create an online identity to represent yourself as an expert or client contact

Grow your network through existing contacts

Personal Benefits of a Social Network Reconnect with old friends and contacts Efficiently manage inbound and outbound information from your friends and family Create an online identity to represent yourself as a person Grow your network through existing contacts Find people with whom to share interests, activities, etc.

Reconnect with old friends and contacts

Efficiently manage inbound and outbound information from your friends and family

Create an online identity to represent yourself as a person

Grow your network through existing contacts

Find people with whom to share interests, activities, etc.

A Facebook dramatization… … I apologize in advance for the crude language. http://www.youtube.com/v/nrlSkU0TFLs This video gives you an idea of the Facebook dilemma:

Risks of a Social Network Information shared between your network circles may influence other’s opinion of you “ Wolf’s club: Let’s all go howl at the moon tonight!” “ I’m Bob’s friend; I eat butterfly wings” Indiscrete over-sharing may influence other’s opinion of you “ Here are my sexy photos from Spring Break” “ I need a mental health day… at Disneyworld!” Some information aids identity thieves “ My favorite color is lime and my hometown is San Francisco” 10/31/08: “Happy 30 th Birthday, Maria!”

Information shared between your network circles may influence other’s opinion of you

“ Wolf’s club: Let’s all go howl at the moon tonight!”

“ I’m Bob’s friend; I eat butterfly wings”

Indiscrete over-sharing may influence other’s opinion of you

“ Here are my sexy photos from Spring Break”

“ I need a mental health day… at Disneyworld!”

Some information aids identity thieves

“ My favorite color is lime and my hometown is San Francisco”

10/31/08: “Happy 30 th Birthday, Maria!”

Scary! Should I use Facebook? Yes. The benefits make it worth using, but you must mitigate the risks. It’ll take about 30 minutes to set up. That’s a worthwhile investment.

Yes.

The benefits make it worth using, but you must mitigate the risks.

It’ll take about 30 minutes to set up. That’s a worthwhile investment.

Objectives Create groups for your friends, family, hobby and professional networks Distribute profile access selectively to different groups, disable default access to your profile Retain control of your own data: Facebook applications and functions to avoid Now log into Facebook and let’s get started

Create groups for your friends, family, hobby and professional networks

Distribute profile access selectively to different groups, disable default access to your profile

Retain control of your own data: Facebook applications and functions to avoid

Create Groups Write down a list of the groups you will create. Think about the people who would make up that group. An individual can exist in multiple groups. Define each group so that you know its purpose. Examples: Family – Mom, Sister, Son, Husband, Grandpa. People I am closely related to. BestFriends – Jill, Jack, Jane. People I trust with anything, and would share anything. MoreFriends – Sally, Maria, Marco, Neha. People I’ve know for a while. IBMers – Mr. Chu, Mr. Palmisano, Mrs. Arbusto. My Colleagues at IBM. Professional – Bob from my last job, Kim from the Java class. People in my professional network. InternetAcquaintances – firefighter345, southernbelle. People I don’t know but friended. Also consider: school networks, hobby groups, societies Objective 1

Write down a list of the groups you will create.

Think about the people who would make up that group. An individual can exist in multiple groups.

Define each group so that you know its purpose.

Examples:

Family – Mom, Sister, Son, Husband, Grandpa. People I am closely related to.

BestFriends – Jill, Jack, Jane. People I trust with anything, and would share anything.

MoreFriends – Sally, Maria, Marco, Neha. People I’ve know for a while.

IBMers – Mr. Chu, Mr. Palmisano, Mrs. Arbusto. My Colleagues at IBM.

Professional – Bob from my last job, Kim from the Java class. People in my professional network.

InternetAcquaintances – firefighter345, southernbelle. People I don’t know but friended.

Also consider: school networks, hobby groups, societies

Create Friend Lists from your Groups For each of your groups (Facebook calls them “Friend Lists”)… Pull down Friends > All Friends , then click Type in the group’s name, then hit enter: Tip: Enter all groups before adding people Tip: Made a mistake? Click on the list’s name then click “Delete this list” at the bottom Objective 1

For each of your groups (Facebook calls them “Friend Lists”)…

Pull down Friends > All Friends , then click

Type in the group’s name, then hit enter:

Tip: Enter all groups before adding people

Tip: Made a mistake? Click on the list’s name then click “Delete this list” at the bottom

Create Groups: Assign contacts For each of your Friend Lists… Click on the Friend List name (at left) Click at the top Click on each contact you want in this Friend List. Don’t forget to click: Objective 1

For each of your Friend Lists…

Click on the Friend List name (at left)

Click at the top

Click on each contact you want in this Friend List.

Don’t forget

to click:

Create Groups: Assign contacts Go back to All Friends . For each of your contacts… Look to the right of each name to see if they are on a list. Click on the list counter (1 list, 2 lists, etc, or “Add to List”) to see which lists they are in. To add or remove them from a Friend List, select that list. If you realize you forgot a list, you can create a new one by typing in its name. You can add contacts to multiple Friend Lists. Your goal is to have every contact in a list. Objective 1 Alternative

Go back to All Friends . For each of your contacts…

Look to the right of each name to see if they are on a list.

Click on the list counter (1 list, 2 lists, etc, or “Add to List”) to see which lists they are in.

To add or remove them from a Friend List, select that list.

If you realize you forgot a list, you can create a new one by typing in its name.

You can add contacts to multiple Friend Lists.

Your goal is to have every contact in a list.

2 - Control Access - Basics Pull down Settings > Privacy Settings then click Profile . There are two tabs here, “Basic” and “Contact Information;” for all items on each tab: Objective 2 Decide if everyone in your “Network and Friends” or “Only Friends” can see the information (and select one of them), or if you want to control the information item by Friend List. To control the information item by Friend List, select “Customize,” checkmark “Some Friends” then start entering the name of the Friend List. You can add multiple lists. To hide this information item from certain Friend Lists, enter them into the “Except These People” field. When you’re done, click Okay

Pull down Settings > Privacy Settings then click Profile .

There are two tabs here, “Basic” and “Contact Information;” for all items on each tab:

Decide if everyone in your “Network and Friends” or “Only Friends” can see the information (and select one of them), or if you want to control the information item by Friend List.

To control the information item by Friend List, select “Customize,” checkmark “Some Friends” then start entering the name of the Friend List. You can add multiple lists.

To hide this information item from certain Friend Lists, enter them into the “Except These People” field.

When you’re done, click Okay

Control Access - Advice Don’t trust the “Network” -- you can’t control it and it doesn’t offer the safety of IBM’s intranet. Create a group to parallel each Network, add/accept friends selectively, and then Customize access to your different groups. “ Basic” tab: Be sure to restrict the following: Status & links – set your status Custom and select personal friends, family, etc, not your colleagues. Now you can use it for personal information. You should never have been using it for IBM information. Photos tagged of you , Videos tagged of you – when others “tag” you in a photo or video, it is added to a list of photos on your profile. You can control who can see that list, set your status to Custom and select personal friends and family only, do not include colleagues or internet acquaintances. You cannot control the fact that others added your name to a photo, but you can make them hard to find. Objective 2

Don’t trust the “Network” -- you can’t control it and it doesn’t offer the safety of IBM’s intranet. Create a group to parallel each Network, add/accept friends selectively, and then Customize access to your different groups.

“ Basic” tab: Be sure to restrict the following:

Status & links – set your status Custom and select personal friends, family, etc, not your colleagues. Now you can use it for personal information. You should never have been using it for IBM information.

Photos tagged of you , Videos tagged of you – when others “tag” you in a photo or video, it is added to a list of photos on your profile. You can control who can see that list, set your status to Custom and select personal friends and family only, do not include colleagues or internet acquaintances. You cannot control the fact that others added your name to a photo, but you can make them hard to find.

Control Access - Advice “ Basic” tab: Be sure to restrict the following (continued): Friends – set your access to Custom and decide who should, and should not, be able to see your network of friends. Do you want surferdude! friending your coworkers? Do you want them seeing the guy who eats butterfly wings? Wall Posts – set your access to Custom and decide who should, and should not, be able to see and post to your “Wall.” These comments about you may not be the best way to share with everyone, and you do not have full control over what they say. An alternative is to install several Wall applications (like SuperWall) and give friends access to one and colleagues access to the other. Work Info – set this access to “Only people at IBM” Objective 2

“ Basic” tab: Be sure to restrict the following (continued):

Friends – set your access to Custom and decide who should, and should not, be able to see your network of friends. Do you want surferdude! friending your coworkers? Do you want them seeing the guy who eats butterfly wings?

Wall Posts – set your access to Custom and decide who should, and should not, be able to see and post to your “Wall.” These comments about you may not be the best way to share with everyone, and you do not have full control over what they say. An alternative is to install several Wall applications (like SuperWall) and give friends access to one and colleagues access to the other.

Work Info – set this access to “Only people at IBM”

Control Access - Advice “ Contact Information” tab: Be sure to restrict the following: Mobile Phone , Other Phone – this is a really easy way to provide friends and colleagues with a phone number, but you should restrict it to select groups. Set your access to Custom and decide who should, and should not, be able to see your phone number. Current Address – set this to no one, or perhaps only to your closest friends. There is no reason for this information to be more widely available on the internet; you don’t need an internet acquaintance making a surprise visit. Website – if your website is a professional one, such as a blog like “8-bar,” restrict it to colleagues and clients – your professional network. If it is a personal site, restrict it to friends. E-mail – set this to “no one.” People can contact you by private message, or they already have your e-mail address. When you’ve finished saving the settings, look at your Profile Privacy Settings again: Try entering a person’s from one of your friend lists; now you can confirm they see only what you want them to see. Objective 2

“ Contact Information” tab: Be sure to restrict the following:

Mobile Phone , Other Phone – this is a really easy way to provide friends and colleagues with a phone number, but you should restrict it to select groups. Set your access to Custom and decide who should, and should not, be able to see your phone number.

Current Address – set this to no one, or perhaps only to your closest friends. There is no reason for this information to be more widely available on the internet; you don’t need an internet acquaintance making a surprise visit.

Website – if your website is a professional one, such as a blog like “8-bar,” restrict it to colleagues and clients – your professional network. If it is a personal site, restrict it to friends.

E-mail – set this to “no one.” People can contact you by private message, or they already have your e-mail address.

When you’ve finished saving the settings, look at your Profile Privacy Settings again:

Try entering a person’s from one of your friend lists; now you can confirm they see only what you want them to see.

Control Access - Applications Pull down Settings > Application Settings Look at your list of applications. Either delete the ones you don’t want ( ), or click “Edit Settings”: Objective 2 For each application, in the Edit Settings window, click on the “Profile” tab. In the Privacy field, select Customize (if you edit this in the future, click “Edit Custom Settings”) As before, select “Some of my Friends” and start typing the Friend List you want to add. Select it when it appears. You can add more than one. You can also restrict access. When you’re done, click Okay

Pull down Settings > Application Settings

Look at your list of applications. Either delete the ones you don’t want ( ), or click “Edit Settings”:

For each application, in the Edit Settings window, click on the “Profile” tab.

In the Privacy field, select Customize (if you edit this in the future, click “Edit Custom Settings”)

As before, select “Some of my Friends” and start typing the Friend List you want to add. Select it when it appears. You can add more than one. You can also restrict access.

When you’re done, click Okay

Control Access – Application Advice Do you really need all those applications? Do you know what they do? Are they from a reliable source? Some applications have been known to spam friend-lists, others are quite useful. Know what it does before you accept a hug/drink/teddybear/etc from someone. If you want a “Wall” you might want to add several different ones (SuperWall, etc), then control which of your groups can see which of the walls. Facebook will even let you pick and choose which Walls your message appears on. You cannot scope an individual message to a specific Friend List, but you can control overall access to each wall. Photos and Videos – you can control access to the individual folders in these applications, it may make sense to leave general friend access to your album open and then restrict access at the folder level. Objective 2

Do you really need all those applications? Do you know what they do? Are they from a reliable source? Some applications have been known to spam friend-lists, others are quite useful. Know what it does before you accept a hug/drink/teddybear/etc from someone.

If you want a “Wall” you might want to add several different ones (SuperWall, etc), then control which of your groups can see which of the walls. Facebook will even let you pick and choose which Walls your message appears on. You cannot scope an individual message to a specific Friend List, but you can control overall access to each wall.

Photos and Videos – you can control access to the individual folders in these applications, it may make sense to leave general friend access to your album open and then restrict access at the folder level.

Control Access – Photos and Videos Go to your Profile homepage (click “profile” at the top of any page), then click the “ Photos ” tab. You should see albums for your photos (always organize photos in albums). Open an album, then click “Edit Photos” and click the “Edit Info” tab. Objective 2 As before, change the privacy by selecting “Customize” then specify “Some Friends” and identify which groups should be allowed to see the photos. When you are done, click “Okay,” then “Save Changes” Customize…

Go to your Profile homepage (click “profile” at the top of any page), then click the “ Photos ” tab. You should see albums for your photos (always organize photos in albums).

Open an album, then click “Edit Photos” and click the “Edit Info” tab.

As before, change the privacy by selecting “Customize” then specify “Some Friends” and identify which groups should be allowed to see the photos.

When you are done, click “Okay,” then “Save Changes”

3 - Retain Control Facebook applications can access any data you permit them to. Applications run by your friends can access any of your data that you have permitted your friend to see. Since your friend may not know what that application does, you need to be careful. To address this, we’ll Lock Down Applications and Stay Aware. Objective 3

Facebook applications can access any data you permit them to.

Applications run by your friends can access any of your data that you have permitted your friend to see.

Since your friend may not know what that application does, you need to be careful.

To address this, we’ll Lock Down Applications and Stay Aware.

Retain Control – Lock Down Applications There’s one last area we need to lock down. Go to “Settings,” then click “Privacy Settings,” then click “Applications” then click “ Settings ” Review the items checked. Do you want applications your friends use to be able to access any of that info (provided the friend has access)? Recommendation -- Only checkmark Profile picture, Basic info, Personal info, Current location, Education history, and Work history. Uncheck the other boxes. You may want to checkmark and block Facebook Connect Applications and Beacon Applications, unless you know what they are and use them. They’re the checkboxes further down the page, amidst the text. Click “Save Changes” Objective 3

There’s one last area we need to lock down.

Go to “Settings,” then click “Privacy Settings,” then click “Applications” then click “ Settings ”

Review the items checked. Do you want applications your friends use to be able to access any of that info (provided the friend has access)?

Recommendation -- Only checkmark Profile picture, Basic info, Personal info, Current location, Education history, and Work history. Uncheck the other boxes.

You may want to checkmark and block Facebook Connect Applications and Beacon Applications, unless you know what they are and use them. They’re the checkboxes further down the page, amidst the text.

Click “Save Changes”

Retain Control – Stay Aware When a friend “Tags” you in a photo or video, take a look at it. Do you want that out there, representing you, even if it isn’t listed on your profile? You could ask them to take you off of it. When a friend tags you in a note, see if you want to stay associated with it. You can remove yourself by clicking “remove tag” (beneath your name) if you don’t want to participate. When someone invites you to a group or fandom, or offers to be your friend, consider who they are. You can always decline or ignore the request. When you accept a new friend, be sure to assign them to a friend list (first). When someone gives you a “gift” in the form of an application that you’d need to install, consider if you want that application on your profile, or to be listed somewhere associated with that application. Offers for gifts/applications do not take effect until you take action. They just wait in your inbox. You can decline or ignore them to make them go away. Objective 3 Stay Aware – and be pro-active

When a friend “Tags” you in a photo or video, take a look at it. Do you want that out there, representing you, even if it isn’t listed on your profile? You could ask them to take you off of it.

When a friend tags you in a note, see if you want to stay associated with it. You can remove yourself by clicking “remove tag” (beneath your name) if you don’t want to participate.

When someone invites you to a group or fandom, or offers to be your friend, consider who they are. You can always decline or ignore the request. When you accept a new friend, be sure to assign them to a friend list (first).

When someone gives you a “gift” in the form of an application that you’d need to install, consider if you want that application on your profile, or to be listed somewhere associated with that application. Offers for gifts/applications do not take effect until you take action. They just wait in your inbox. You can decline or ignore them to make them go away.

Retain Control – Wandering information Terms of Service and Expectations about rights Information that you upload to the internet falls into one of four categories: content you own exclusively (typically email and private systems), content you give everyone rights to use (typically through creative commons), content you own but the hosting services, and often other members, have unlimited rights to use (most photo-library sites, YouTube) Content you no longer own, it becomes property of the hosting service (Facebook, the IBM intranet, and other sites) Be aware of Facebook’s severe terms with regard to ownership of your content. If you want to retain ownership (for future publishing, etc), upload the content to a site with better terms, then link to it. Read the terms before you upload content! You expect everyone will respect copyright, ownership, etc; but these lines are blurred and your rights are generally ignored by other users on the internet. Most websites will remove content “borrowed” from you, upon request, if you can prove it. But are you willing to take the additional legal action of defending your content? Consider how and where you publish content when you expect to be the sole authorized publisher. Objective 3

Terms of Service and Expectations about rights

Information that you upload to the internet falls into one of four categories:

content you own exclusively (typically email and private systems),

content you give everyone rights to use (typically through creative commons),

content you own but the hosting services, and often other members, have unlimited rights to use (most photo-library sites, YouTube)

Content you no longer own, it becomes property of the hosting service (Facebook, the IBM intranet, and other sites)

Be aware of Facebook’s severe terms with regard to ownership of your content. If you want to retain ownership (for future publishing, etc), upload the content to a site with better terms, then link to it.

Read the terms before you upload content!

You expect everyone will respect copyright, ownership, etc; but these lines are blurred and your rights are generally ignored by other users on the internet. Most websites will remove content “borrowed” from you, upon request, if you can prove it. But are you willing to take the additional legal action of defending your content? Consider how and where you publish content when you expect to be the sole authorized publisher.

Retain Control – Be smart The information you publish on the internet is only as private as you allow it to be. Smart settings, self-censure, and some restraint will go a long way. The information you publish on the internet is only as private as the people who read it allow it to be. Will your friends keep your photos and comments private? It’s a lot easier to copy and re-share material on the internet; be explicit about the trust you place in people and the boundaries you want them to follow with regard to your information. Avoid the meme trap. Don’t fill out those “ten things about me” or “my ABCs” Want to write about yourself? Don’t use the lists – they frequently include the same questions as those “forgot your password” hints. Similarly, when creating “password hints” do not pick data that could be easily gleaned from your profile. Objective 3

The information you publish on the internet is only as private as you allow it to be.

Smart settings, self-censure, and some restraint will go a long way.

The information you publish on the internet is only as private as the people who read it allow it to be.

Will your friends keep your photos and comments private? It’s a lot easier to copy and re-share material on the internet; be explicit about the trust you place in people and the boundaries you want them to follow with regard to your information.

Avoid the meme trap. Don’t fill out those “ten things about me” or “my ABCs”

Want to write about yourself? Don’t use the lists – they frequently include the same questions as those “forgot your password” hints.

Similarly, when creating “password hints” do not pick data that could be easily gleaned from your profile.

In summary… You have compared the benefits and risks of a Social Network such as Facebook. You have organized your friends, family, colleagues, professional contacts, and others into discrete and manageable groups. You have configured your information to be available only to the groups that should see it. You have built in controls for the future to manage their access. You have restricted applications that might have revealed your private data, and learned how to handle new application requests. You’ll stay aware of requests from others, and be able to handle them with regard to your own privacy. You understand that content uploaded to Facebook means giving it to Facebook. You’re ready. Enjoy the benefits of Facebook, confident that you have taken the necessary steps to ensure your privacy and mitigate the risks.

You have compared the benefits and risks of a Social Network such as Facebook.

You have organized your friends, family, colleagues, professional contacts, and others into discrete and manageable groups.

You have configured your information to be available only to the groups that should see it. You have built in controls for the future to manage their access.

You have restricted applications that might have revealed your private data, and learned how to handle new application requests.

You’ll stay aware of requests from others, and be able to handle them with regard to your own privacy.

You understand that content uploaded to Facebook means giving it to Facebook.

You’re ready.

Enjoy the benefits of Facebook, confident that you have taken the necessary steps to ensure your privacy and mitigate the risks.

Sources, Additional Reading Joan DiMicco, David Millen . Identity Management: Multiple Presentations of Self in Facebook IBM: http://cattail.cambridge.ibm.com/cattail/#view=joan.dimicco@us.ibm.com/files/51D35DB04BA73DD7B922A2747F000001 Cliff Landis – Freshmen Facebook http://clifflandis.net/presentation-files/FreshmenFacebook.ppt Web Worker Daily: 12 Ways to use Facebook Professionally http://webworkerdaily.com/2007/07/24/12-ways-to-use-facebook-professionally / New York Times: You’re leaving a digital trail. What about privacy? http://www.nytimes.com/2008/11/30/business/30privacy.html?partner= permalink&exprod = permalink 10 privacy tips on Facebook http://www.allfacebook.com/2009/02/facebook-privacy/ The weisure (work/leisure) lifestyle http://www.cnn.com/2009/LIVING/worklife/05/11/weisure/index.html Dwyer, Hiltz, Passerini. Trust and privacy concern within social networking sites: A comparison of Facebook and MySpace http://csis.pace.edu/~dwyer/research/DwyerAMCIS2007.pdf Trust and Identity in Virtual Communities IBM: http://cattail.cambridge.ibm.com/cattail/#view=brian_odonovan@ie.ibm.com/files/BB67766037903DD78EC6240E7F000001

Joan DiMicco, David Millen . Identity Management: Multiple Presentations of Self in Facebook

IBM: http://cattail.cambridge.ibm.com/cattail/#view=joan.dimicco@us.ibm.com/files/51D35DB04BA73DD7B922A2747F000001

Cliff Landis – Freshmen Facebook

http://clifflandis.net/presentation-files/FreshmenFacebook.ppt

Web Worker Daily: 12 Ways to use Facebook Professionally

http://webworkerdaily.com/2007/07/24/12-ways-to-use-facebook-professionally /

New York Times: You’re leaving a digital trail. What about privacy?

http://www.nytimes.com/2008/11/30/business/30privacy.html?partner= permalink&exprod = permalink

10 privacy tips on Facebook

http://www.allfacebook.com/2009/02/facebook-privacy/

The weisure (work/leisure) lifestyle

http://www.cnn.com/2009/LIVING/worklife/05/11/weisure/index.html

Dwyer, Hiltz, Passerini. Trust and privacy concern within social networking sites: A comparison of Facebook and MySpace

http://csis.pace.edu/~dwyer/research/DwyerAMCIS2007.pdf

Trust and Identity in Virtual Communities

IBM: http://cattail.cambridge.ibm.com/cattail/#view=brian_odonovan@ie.ibm.com/files/BB67766037903DD78EC6240E7F000001

Extras

A Facebook dramatization… I apologize for the crude language. I apologize for that crude language, too.