mwdegutis Loc: Illinois

This story is not about sex workers, but rather about how Facebook is mining external, non-Facebook data to merge with member profiles, and then exposing that to the world. There are huge legal and ethical issues. Who hasn’t been creeped out when certain people pop up on your ‘People you may know’ list in Facebook? Now you have a glimpse into what they are doing, and how it can be tremendously dangerous.

Kashmir Hill ~ October 11, 2017
Leila has two identities, but Facebook is only supposed to know about one of them.

Leila is a sex worker. She goes to great lengths to keep separate identities for ordinary life and for sex work, to avoid stigma, arrest, professional blowback, or clients who might be stalkers (or worse).

Her “real identity”—the public one, who lives in California, uses an academic email address, and posts about politics—joined Facebook in 2011. Her sex-work identity is not on the social network at all; for it, she uses a different email address, a different phone number, and a different name. Yet earlier this year, looking at Facebook’s “People You May Know” recommendations, Leila (a name I’m using using in place of either of the names she uses) was shocked to see some of her regular sex-work clients.

Despite the fact that she’d only given Facebook information from her vanilla identity, the company had somehow discerned her real-world connection to these people—and, even more horrifyingly, her account was potentially being presented to them as a friend suggestion too, outing her regular identity to them.

Because Facebook insists on concealing the methods and data it uses to link one user to another, Leila is not able to find out how the network exposed her or take steps to prevent it from happening again.

“It’s not just sex workers who are careful to shield their identities,” she said to me via Skype. “The people who hire sex workers are also very concerned with anonymity so they’re using alternative emails and alternative names. And sometimes they have phones that they only use for this, for hiring women. You have two ends of people using heightened security, because neither end wants their identity being revealed. And they’re having their real names connected on Facebook.”

When Leila queried secret support groups for sex workers, others said it had happened to them too.

“The worst nightmare of sex workers is to have your real name out there, and Facebook connecting people like this is the harbinger of that nightmare,” she said. “With all the precautions we take and the different phone numbers we use, why the f**k are they showing up? How is this happening?”

It’s not a question that Facebook is willing to answer. The company is not forthcoming about how “People You May Know,” known internally as PYMK, makes its recommendations. Most of what Facebook does reveal about the feature is on a help page, which says that the suggestions “come from things like” mutual friends, shared networks or groups, or “contacts you’ve uploaded.”

When the suggestions turn out to be unnerving, that explanation is both vague and woefully incomplete. A Facebook spokesman told me this summer that there are more than 100 signals that go into PYMK. All someone like Leila—who was not connected to her clients by anything like mutual friends, networks, groups, or contacts—can know is that the data that exposed her must be something else, in that large undefined set of factors.

Leila suspects either that Facebook collected contact information from other apps on her phone or that it used location information, noticing that her and her clients’ smartphones were in the same place at the same time.

“We do not use information from third party apps to show friend suggestions in People You May Know,” a Facebook spokesperson wrote via email. Facebook has said before that it doesn’t use location information for People You May Know, and the spokesperson confirmed that policy: “People You May Know suggestions are not informed by your smartphone’s Location Services.”

So the linkage between Leila and her clients remains a mystery. While the algorithmic black box that is PYMK is simply creepy to most of us, the intrusive network analysis can have serious consequences for people in the sex work and porn industry. One sex toy reviewer dev**ed a section of her digital security advice to the feature, her cleverest suggestion being to choose a profile photo that doesn’t show your face.

“People think because you have sex on camera, privacy isn’t a big deal for you,” said Mike Stabile, spokesperson for the Free Speech Coalition, a California-based advocacy group for adult performers. “But in this industry, privacy is so important. Performers worry about stalkers on a daily basis.”

Stabile says concerns about People You May Know also go the other way, when people’s accounts for their sex work persona are recommended to people they know in their real, vanilla lives like relatives and friends.

That’s what Ela Darling worries about. Darling, who manages virtual reality adult broadcasting at CAM4, has been working in pornography for eight years, but her family members don’t know that.
“I don’t want my 15-year-old cousin to discover I’m a porn star because my account gets recommended to them on Facebook.”

“I don’t want my 15-year-old cousin to discover I’m a porn star because my account gets recommended to them on Facebook,” Darling told me by phone.

To combat this, she searches Facebook every few weeks for the last names of her family and extended family to see if any of her relatives have joined the network or created a new account. If they have, she blocks them.

Darling used to have a second, private account under her legal name for connecting with people she knew in her normal, vanilla life, but it was getting recommended to her fans, revealing her “real” identity to them. Some of them began harassing her and trying to track down her family.

“We’re living in an age where you can weaponize personal information against people,” Darling said. She’s not sure how Facebook linked her porn identity to her legal identity, but it meant one had to go. She deleted her private account a few years ago, leaving only her public, porn one.

“Facebook isn’t a luxury,” Darling said. “It’s a utility in our lives. For something that big to be so secretive and powerful in how it accumulates your information is unnerving.”

The outing problem is, like Facebook’s ongoing f**e-news scandals, a result of the company’s growth-above-all strategy: First round up as many users as possible, then start cleaning up (or not) the side effects of operating at that scale. People You May Know may be incidental to an individual user’s experience, but it extends the reach and density of the network.

“For sex workers, this is a huge threat. This is life or death for us,” Leila said.

An obvious solution, from a user’s point of view, would be for Facebook to fully explain what data it uses to make friend suggestions, and to allow users to filter it or opt out of the People You May Know feature entirely. That way, someone concerned about having their identity exposed—whether a sex worker, a domestic violence victim, or a political activist—wouldn’t have to worry about having their account shown to someone who shouldn’t see it.

“An opt out is not something we think people would find useful,” the spokesperson wrote. “For example, even for people who have been on Facebook for a long time and already have lots of friends, most of us like to know when someone we know has joined Facebook for the first time.”

The spokesperson said that there was an undocumented trick that could allow users to stop appearing in the People You May Know feature—if they were to switch their account settings under “Who can send you friend requests?” to “No one,” it would disable People You May Know, while also shutting off the ability to receive any friend requests at all.

The day after this story was originally published, the Facebook spokesperson retracted that explanation, saying the company had provided incorrect information about the workaround. Most users do not have the ability to choose “No one” on the friend-request menu; it is a feature offered only to certain users with large followings. And even for those users, selecting that option does not, in fact, do anything to prevent other people from seeing them in People You May Know.

“We take privacy seriously and of course want to make sure people have a safe and positive experience on Facebook,” the Facebook spokesperson wrote. “For people who choose to maintain a separate identity, we’ve put safeguards in place to help them understand their privacy choices, moderate comments, block people, control location sharing, and report abusive content.”

Facebook also says you can just “X” out anyone who appears in “People You May Know” that you don’t want to know. Sometimes, though, just appearing there means the damage is already done.

Note: This story has been revised to reflect Facebook’s retraction of its explanation of the opt-out workaround. Also, after reading the story, a Facebook spokesperson wrote: “We want to do our best to prevent these things from happening and we do care about people’s privacy. We fell short here, and we will do better.”