Schneier on Security
A blog covering security and security technology.
« Laptops and the TSA |
| A Heathrow Airport Story about Trousers »
April 10, 2012
Teenagers and Privacy
Good article debunking the myth that young people don't care about privacy on the Intenet.
Most kids are well aware of risks, and make "fairly sophisticated" decisions about privacy settings based on advice and information from their parents, teachers, and friends. They differentiate between people they don't know out in the world (distant strangers) and those they don't know in the community, such as high school students in their hometown (near strangers). Marisa, for example, a 10-year-old interviewed in the study (who technically is not allowed to use Facebook), "enjoys participating in virtual worlds and using instant messenger and Facebook to socialize with her friends"; is keenly aware of the risks -- especially those related to privacy; and she doesn't share highly sensitive personal information on her Facebook profile and actively blocks certain people.
Rather than fearing the unknown stranger, young adults are more wary of the "known other" -- parents, school teachers, classmates, etc. -- for fear of "the potential for the known others to share embarrassing information about them"; 83 percent of the sample group cited at least one known other they wanted to maintain their privacy from; 71 percent cited at least one known adult. Strikingly, seven out of the 10 participants who reported an incident when their privacy was breached said it was "perpetrated by known others."
Posted on April 10, 2012 at 10:21 AM
• 19 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Teens, adults, the entire population in general fails to understand that nothing on a corporate owned social network is between you and your friends. The corporations and the government see EVERYTHING.
The great privacy problem involves privacy from corporations and government, which the masses fail to comprehend.
> young adults are more wary of the "known other"
They're right of course. As any cop knows, most crimes againts minors are commited by persons near them (parents, uncles, friends of the family etc.)
It's similar to an insider-gone-bad in a company; they have more info and opportunity than some distant stranger.
@Hatrick Penry :
While I mostly agree with you, in everyday life the dangers mostly arise from people you know.
Goverment and corporate snooping on our private affairs simply do not happen on a large enough scale. Our inherent risk-management system (correctly IMO) calculates that harm from "insiders" (known persons) is far more likely and dangerous than from goverment agencies.
Please do not think that I'm some sort of "if you haven't done anything wrong, you have nothing to fear" advocate; quite the contrary. But the risk management in this case is correct, simply because of the (perceived) frequency and dangers to the individual person.
Skimming the article, it looks like it was written by Captain Obvious. Teens want to hide from authority figures and bullies. Teens have always wanted to hide from authority figures and bullies. To attribute this to a degree of sophistication is absurd. In my experience, there is little to no forethought about how their online presence as teens might be viewed 5 or 10 years down the road. If they hide it from their parents long enough to go out with their friends on Saturday night, they are happy.
Also, the article seems to equate privacy with security. I have yet to meet an "average teen" who would install an anti-virus on their computer. Or backup their files. Not that this makes them any different from many adults, but they are just as lax about computer security, which in the end can reduce their privacy.
>when their privacy was breached said it was "perpetrated by known others."
The problem I have with this is that it doesn't differentiate between a legitimate and illegitimate breach of a teen's privacy.
It's a very different thing for a classmate to breach a Facebook account for purely selfish or destructive reasons, than it is for a parent to do the same thing in order to find out if their 13yo daughter is having sex with her 16yo boy-friend, or for a school official to breach a Facebook account to verify cyber-bulling.
How is blocking certain people on FB evidence of caring about internet privacy and understanding the risks?
The fact that you think the data is still under your control shows a distinct lack of understanding.
For more sophisticated analysis of online behavior and privacy see the following (which all go back a few years). Did social scientists ever take "young people don't care about privacy" claims seriously? Probably not as it is such obvious nonsense. The articles below, which all use actual data, look at how people try to manage presentation of self (along the lines of Irving Goffman) in the context of the new online technologies.
Acquisti, Alessandro, and Ralph Gross. 2006. “Imagined Communities: Awareness, Information Sharing, and Privacy on the Facebook.” Pp. 36–58 in Privacy Enhancing Technologies.
Tufekci, Zeynep. 2008. “Can You See Me Now? Audience and Disclosure Regulation in Online Social Network Sites.” Bulletin of Science Technology Society 28(1):20–36.
Lewis, Kevin, Jason Kaufman, and Nicholas Christakis. 2008. “The Taste for Privacy: An Analysis of College Student Privacy Settings in an Online Social Network.” Journal of Computer-Mediated Communication 14(1):79–100.
The discussion section in the latter paper has an interesting take on how privacy concerns and management strategies evolve through various waves of adopters, later waves having the benefit of more experience and hence a better understanding of the possible impact of different uses.
It is somewhat encouraging that such a high percentage of kids report having consulted with parents on online privacy. I've been talking to my son about it since he first showed interest in registering for online forums, but I had thought that was the exception, not the rule.
The article also makes the assumption that tweens and teens are good judges of what constitutes a privacy breach AND that they're aware of every time it's happened to them, which is almost certainly not the case. Not to mention, these were kids responding to adults about how responsible they are. How many of them felt there were "wrong answers" to some of the questions on this "test" when they responded?
Who would take a parenting book written by a teenager seriously? Maybe we could approach parenting "as if, like, it was just a teenager world where reality and a grown-up perspective just frustrate you and gets you mad and stuff." When I use a phrase that sounds almost exactly like one of the study's actual sources, I sound like a fool. They're drawing poor conclusions because they're asking kids to judge their own behavior and how it may impact them long-term in a world that's small in their minds.
That said, it was comforting to know that there are 37 middle-school children that know Facebook has privacy settings. It may actually turn out that the care they take to hide their "whatever" from people that should probably be aware/involved may in effect accidentally hide it from people that could use that data against them. Let's hope so.
@Steve: What's not encouraging is that so many of the parents that are consulted cannot give appropriate guidance. Maybe the info provided by Alan S. will turn out to be correct and things will get better within a few generations. At the "people you know" level, it probably will. At the corporate/government level, it will likely get worse as they learn how to extract even more information from the public.
@Chris "Maybe the info provided by Alan S. will turn out to be correct and things will get better within a few generations. At the "people you know" level, it probably will. At the corporate/government level, it will likely get worse as they learn how to extract even more information from the public."
I don't think it is clear how things will work out. Control of how one presents oneself to others is such a basic human quality. Saying that people don't care about privacy is silly. It's like saying people don't have social relationships.
The issue is really about how much control people have over how they present themselves and interact with others. What will be the nature of social relationships? Who will hold the power? The status quo that existed has been disrupted and it is not clear where things will settle. Are we going to live in the enlightened world brought about by David Hume and friends or something else? They knew the darkness from which they emerged and maybe understood the fragility of what they wrought better then we do.
Agreed. It does not guarantee good information, far from it, but it does indicate a potential educational channel. Good information that gets to the parents on this issue might be more likely to find its way into the actual behavior of their children.
@Hatrick Penry: "The great privacy problem involves privacy from corporations and government, which the masses fail to comprehend."
Sure, that's one privacy problem, but can't there be others?
I'm not so sure that any of the (perfectly valid) points you suggested render the article "lousy," as you describe it. It just means the article is concerned with a different privacy problem (kids vs. strangers) than you are (everyone vs. social networks).
Who monitors monitors?
The absurdity of accepting the judgement
of legal incompetents
is simply a subterfuge to subvert
the growing awareness that
new standards will be set
for knowledge about life and preferences
once censorship ceases to be of any effect.
So, if I understand those comments right, the only privacy sophistication that counts is when you never share anything with anybody. Having facebook account proves that you do not understand what privacy is.
I through that sophistication in this case would manifest itself as an ability to weight risks against benefits - and there are benefits on having some social network presence.
This blog contains a lot posts on security trade offs. This is one of those trade offs.
If teens are wary more of "known other" more then "unknown stranger", then they show better understanding of real risks as most adults (at least in this context). Which of these is the biggest threat to an adult if armed with some embarrassing information: random guy on discussion forum, Facebook company or a colleague that wants the same promotion as you?
Both Facebook and random guy are threat only if they leek that information to the known other. So yes, he is the most dangerous.
I think everyone cares once their compromised and then say WTF-BUT I just heard of a new service that takes privacy emails to a new level-Perhaps bruce can comment on this new service-like who is really behind it or does their encryption really assure
Burn note claims no trace or retrieve on emails once their read
As an ex-teenager myself, I think that most of them could not care less about corporations or governments poking around their data. It's the "I don't have anything to hide, so why care?" mentality. Maybe there are some who are annoyed that everything they do is being logged by somebody, but I doubt it bothers the majority. Same is true for adults though, so it isn't a teen issue.
The point of the article I mentioned above is that a lot of people - and teenagers in particular - may not care about privacy, but they do care about image. They don't want their off-message activities announced if it would damage their chosen image.
Some of the photo rating sites or Facebook groups show up some of the strange expectations of teenagers with regard to privacy.
A running theme is of teenage girls who lie about their age in order to participate and then complain that "old men" (anyone recording their age as over 30 and supplying an age-consistent photo) are looking at them.
Another common practice - albeit not just restricted to teenagers - is posting private phone numbers, email addresses and sometimes even bank account numbers on public forums. Usually the poster is directing the message to a specific person but don't realise that anyone can read the message.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.