Of Social Media Privacy Through Obscurity

Prof. Woodrow Hartzog is an interesting voice on privacy law and technology. He has written about his own research and interviewed others on the role that obscurity plays in our modern conceptions of privacy. Technologies like encrypted communication applications and device encryption tools can be privacy-enhancing technologies, while obscurity — the condition of being unknown or not entirely comprehensible to others — is a privacy-enhancing state.

Obscurity, it appears, is a state that many of us seek out when it comes to social media, even if we don’t realize it. And if you’re reading this thinking, “I don’t seek anything out on social media… heck I don’t even have an account or knowingly let my picture get posted on friends’ accounts”, it probably only proves the point. Many people’s only private social media policy is one of complete obscurity—don’t let Facebook even know you exist.

Compared to the classic concept of privacy as a right to be left alone, obscurity is much more like the right to be out in public and not need to hide in seclusion because what one is doing or saying is not being intelligibly processed by any discerning observer.

As noted in a 2013 paper, “Obscurity by Design“, a state of obscurity implies a “state of unknowing” shared by otherwise observers…

“If an individual is obscure, this means that an observer does not possess critical information that allows them to make sense of the individual. This critical information can include the individual’s identity, social connections, and other personal information. Without this information, observers are limited in their ability to fully comprehend an observed person’s actions and utterances.”

Consider this entirely common situation:

“Employees on a lunch break in a restaurant often gossip about their co-workers, but this gossip is obscure to eavesdroppers unless these outsiders know the subject of the gossip; those in earshot must be able to draw on unspoken contextual information to make sense of the utterances. […] Though we colloquially say we socialize in “public,” in truth our personal interactions are usually enveloped in zones of obscurity, where our identity and personal context are shielded to those we interact or share common space with.

Hartzog explains how we internet users also tend to employ tactics that obscure us, and that we protect our online interactions wherever possible using obscurity.

“Social media users also have come to rely upon obscurity for privacy protection online. Obscurity is a natural state offline that users can draw upon reflexively when protecting their privacy in online social settings.”

In preparation for some of the privacy discussions we will be having here on the West Coast at the 2015 Pacific Legal Technology Conference, I have been thinking about Hartzog’s notion of “obscurity by design”. Could obscurity as a concept address the privacy fears lawyers have (for themselves). Could paying attention to, and sharpening our instincts for, the ways we can obscure ourselves help us do something about maintaining boundaries amid the context collapse between private, family, professional and social worlds?

Traditionally, legal professionals concerned themselves with impression management in the offline realm. Erving Goffman in his 1963 book, Stigma: Notes on the Management of Spoiled Identity, writes that people use their manner of dress, comportment, and “the revealing and withholding of personal information to convey to the world who they are, or who they want to be taken to be.” We have a much tighter grip in the offline world.

But it’s really not so easy in the online world, with its big-data-ad-retargeting-cookies boogeymen. Hartzog’s suggestion that we might nonetheless be able to “draw upon reflexively” our natural instincts for obscurity, is heartening.

He encourages us to focus on the four factors of obscurity. Each of these items in this four-item list is a bellwether for privacy. Obscurity and privacy improve as each of these factors diminish, and each is easy enough to apply to our social media lives:

1. Searchability — this is the degree to which our social media accounts and the content we produce are accessible through search. Lock down your search visibility settings.
2. Unprotected access — this is the degree to which access controls restrict who can see, scrape or index data, independent of how easy all this is to search and find the existence of. Limit who can see your Faceboook posts, but also who can tag you, see your friend lists, etc.
3. Identification —this is any information that links you as an individual (obviously a name, but also a phone number, work email, etc.). Don’t use work email or any cell number that you use professionally and link it with a social media account. Also be sure that your mobile apps for social networks like Facebook are not synching with your phone contacts. Interestingly, adding a phone number is often suggested as another mode for authentication, and to increase security. In practice, however, it’s fairly obvious that major social networks like Facbook and LinkedIn will use that phone number to make your identity more discoverable. People, including self represented parties adverse in interest with whom you have shared emails or phone calls, may have their own contact list synched with a social media account that you are on. You may already have wondered how that person you know only through a file is being recommended as someone “you may know.” Think about what they are seeing too. Maybe you only have a photo of you, or maybe it’s a profile pic that includes your family. Minimize the information you share with a social network, use a nickname or married name (if possible), and keep in mind other boundary regulations like a separate more anonymous sounding email for social network registrations where you want to create a boundary.
4. Clarity — this is the degree to which an outside viewer can make sense of content shared by an individual. Online information is often easy to see, but important aspects of that information do not make sense to them. Facebook will always make your profile and cover picture publicly visible… but what if the picture was of your pet, or that vineyard you visited? It need not be your face.