MySpace flunks Safety 101: It still exposes people's privacy, even on so-called "private" sites

According to research released by the PEW Internet & American Life Project, 66% of teens who use social networking services also restrict access to their online profiles. At first glance, that sounds like clear evidence that they've heard safety messaging and have taken a huge step towards being safer online. But all it really says is that these teens intended to make themselves safer.
For example, take MySpace:

• MySpace automatically fills in fields with personal information in the signup process. Anyone can see it—even if people  set their sites to be private. See some examples.
• MySpace encourages users to expose personally identifiable information. See some examples.
• MySpace makes high risk settings the default, and makes changing them difficult. See some examples.
• MySpace fails to provide timely safety advice that would warn users about the risks of the information they do give or teach users how to stay safer on MySpace. See some examples.

Not only does MySpace fail to inform users about critical safety risks within its product, it has also failed to address these shortcomings in a meaningful way. Fundamental safety flaws within the MySpace product technology and policy seriously undermine anyone's efforts to be safer. If the company really wants people to have a safe experience, it needs to build a safer product. These shortcomings are particularly grievous given the popularity of MySpace with teens and the company's cultivation of this age group.
Is MySpace alone in exposing people to potential risks? No. I've used it as an example because it’s the largest social networking service, and one which has made a string of public announcements about its "safety initiatives" in recent months. The fact that MySpace admitted to having more than 29,000 known sexual offenders on its site speaks volumes about the company's inability to detect, monitor, or prevent abuse. (Note: the 29,000 probably represent only a fraction of the sexual predators on the site, these made themselves discoverable using known sexual predator databases. This does not cover sexual predators who have not been caught, or those smart enough to avoid detection) It took the combined efforts of many state attorneys general and consumers to pressure MySpace into even beginning to remove known predators from their sites; it took further pressure for MySpace to begin sharing that information with states.

1 MySpace puts personal information into fields that anyone can see—even on "private" sites

The girl with this MySpace page (shown below) followed the advice she’d been given about safety, took clear measures to make her site private (something that isn’t part of the signup process, she had to figure this out on her own afterwards), and thought she was safe. She couldn't have been more misled. (The information that identifies her personally has been altered.)
Not only does MySpace display all this personal information, there is no way for a user to make their page truly private without lying in every field)

See All the information on this "private" page is public.
MySpace shows the user’s name or nickname, and encourages them to use their own name. Some users display both first and last names, and there is nothing warning them that this can be viewed by everyone.
 MySpace displays the user’s photo and encourages them to use a photo that identifies them. “The second step in creating your profile is sharing your photos to let friends and other members see who you are”. 
MySpace displays comments or quotes which often show significant vulnerability. There is no safety messaging to explain that showing emotional vulnerability can make them a more vulnerable to bullying, sexual exploitation, and the like; or that using this field to mention an upcoming vacation tells criminals that their home will be empty.
MySpace displays this young girl’s age and gender and her city and state by default. The state information combined with her unusual last name was all it took for a simple online directory search to return her address and phone number.  This helps predators’ select potential victims by their preferences.
Compounding this risk, as part of creating her account, MySpace encouraged her to add her school information, making it even easier for criminals to geographically locate and find her.
MySpace shows when she was last online. (I took this snapshot in mid-October 2007.) Predators don’t want to waste their time trying to converse with people who haven’t used the site in a year; they target people who are active users.
 MySpace displays her URL which includes her first name and the number 524, most likely her birth month and day. (This young woman was shocked to learn it was that obvious.) This is valuable information to predators.

2 MySpace encourages users to expose personally identifiable information

These examples come from the MySpace signup process.
MySpace gives users an example of how to create a user name and create a URL that's very high risk. No one should use their real name in the name field or in their URL, being encouraged by MySpace to do so is dangerous. Once the URL has been created, it cannot be changed. (That said, there has been one improvement in this area: In the past, MySpace automatically used the e-mail address as the MySpace URL. They no longer do this.)
MySpace encourages people to enter first and last names and offers dangerously misleading information about the safety of doing so (see below). This girl—a minor—is now searchable by her full name. Read the highlighted text. How exactly is a real name private or never displayed when anyone can search on it? Not only does searching on the girl’s name show her "private page," it also displays comments about her and by her on others’ pages.

As part of the signup process, MySpace invites you to enter your real name.

3 MySpace makes high risk settings the default and makes changing them difficult

Even though MySpace knows this user is a minor (she’s entered her birth year), her site is automatically set so that anyone can see it. MySpace does not tell her this in the signup process, it does not tell her how to change this, nor does it tell her that the public default increases her risk from a variety of predatory exploits.

• However, if she did know it was public, it's not easy to find out how to make it private. When she lands on her newly minted (and visually busy) home page, she has to know that she must click Edit Profile link to change this setting. But first she has to find it. (How long does it take you to find the link?)

To find Edit Profile, look for Hello, Cortilino! Then look for the first item on the list to the right of the picture.

• If she discovers the link and clicks it, she still can’t see the level of public exposure of her site. Only after she clicks Privacy Settings (shown below) will she find out.

It takes persistence to find out that MySpace has automatically set privacy to the highest level of risk – Public—even if a user is a minor.

4 MySpace gives inadequate (or no) safety advice

• MySpace doesn't give adequate general safety advice. During account creation, users have to check a box acknowledging they’ve read the safety tips, and they also have a link to Safety Tips at the bottom of each page which may look conscientious, but a quick scan shows only six general tips that do little to help users avoid risks as they create sites or add to their pages. MySpace passes along the responsibility for further safety messaging to "Other Resources" none of which give advice that's specific to the risks consumers face on MySpace. The responsibility for informing consumers of the full range of risks in a product, and how users can protect themselves belongs to the company providing the service.
• MySpace provides NO safety messaging for people at the point they're giving personal information. MySpace devotes whole pages to getting users to add information that either locates them or increases the amount of personally identifiable information they share about themselves—school information, interests, personality, background, and lifestyle details, employer information—the list goes on. Its solution is to display across the top of each page—in the smallest font on the page—a warning that contradicts the purpose of the pages.

• MySpace doesn't warn you about what information is searchable—name, display name, e-mail or IM name, school name, gender, age, relationship status, and so on.

In this example I selected a specific public high school where I searched for girls between 16 and 19 years old who want to date and who have posted a photo. The result is a ‘catalog’ of young girls who live within a very narrow geographical range - the school boundaries-  making them very easy to find.

• MySpace offers no warning about the risks inherent in submitting photos. In fact its policy encourages risky behavior.
• It encourages people to post photos that makes recognizing them easy. Combine this with the fact that anyone can search by school and the user is instantly locatable.

• MySpace apparently doesn’t recognize that faces are "personally identifiable content."
• "MySpace ‘Reserves the right to review" and remove offensive photos, but if they really want to step up to their stated standards, they need to accept their RESPONISBILITY to review and remove all offensive photos rather than exposing consumers to  these images.
• MySpace pops up an alarming message (see below) when users who have tried to reduce their public exposure attempt to upload images. Many users believe this is a warning that they have done something wrong by making their privacy settings stronger.

• MySpace offers no safety messaging about the fact that the service automatically connects a user to friends of friends (see below) or the ramifications of this action.

These examples represent just the tip of the iceberg of risks present on MySpace and other popular social networking sites.

What you can do

• Know your rights to a safe Internet experience and let companies and elected officials know you’re unhappy at their failure to protect you and your family online.

The good news is that you have a lot of power. Internet services such as MySpace make their money by selling advertisers access to you.  Only you decide which services deserve your business, so ultimately you determine which companies will stay in business.

• Evaluate the safety of the online products and services you are using, and decide if they meet your safety standards by reading How to know if online programs and services are safe.

To learn more about how to create a safer online environment for you and your family, read Part 3 ("Get Going to Protect Yourself Today") in Look Both Ways: Help protect your family on the Internet.

Linda