Letter to Mark Zuckerberg, CEO, Facebook

Letter

Today, Chairman of the Judiciary Subcommittee on Privacy, Technology and the Law Al Franken (D-Minn.) and Sens. Charles E. Schumer (D-N.Y.), Sheldon Whitehouse (D-R.I.), and Richard Blumenthal (D-Conn.) urged Facebook to stop plans that could reveal sensitive personal information about its 147 million American users, making them easy targets for fraud, theft, and abuse. Americans who use Facebook, especially the 13 million users who are under 18, may be exposing sensitive personal data such as mobile phone numbers and home addresses to third parties unless Facebook changes a new plan that would allow application developers to request and obtain the information, the senators warned Facebook CEO Mark Zuckerberg in a letter today.

"Anyone with ten minutes, $25, and a Facebook user's phone and address and no other information can obtain a breathtaking amount of information about that Facebook user--and that Facebook user's family, friends, neighbors, and landlord," the senators wrote. "Combined with a targeted Google search, these two pieces of information can allow someone to obtain almost all of the information necessary to complete a loan or credit card application. It is hard to contemplate all of the different ways in which this information could be abused."

The senators found that this information is all someone would need to unlock many personal details about a user, from their date of birth to the value of their mortgage. The senators asked Zuckerberg to reconsider Facebook's policy or at least take some commonsense steps to block those under 18 from revealing this information, inform other users of the risks of doing so, or allow those users to opt out.

The full text of the letter is here:

March 9, 2011

Mr. Mark Zuckerberg, CEO
Facebook
1601 S. California Avenue
Palo Alto, CA 94304

Dear Mr. Zuckerberg:

We write to express our concern regarding Facebook's plan to allow application developers to request and obtain Facebook users' mobile phone numbers and home addresses, as stated in a January 14, 2011 blog posting and Mr. Andrew Noyes' February 23, 2011 letter to my colleagues Rep. Edward Markey and Rep. Joe Barton. We urge you to reconsider this policy. Barring this, we urge you to block this feature for users who are 17 or younger, and to structure your permissions process to inform users of the risks of releasing their mobile phone and home address information and to allow users to access applications without acceding to the applications' requests for this information. These simple changes would go a long way in protecting the 147 million Americans who use Facebook today -- especially the 13 million Facebook users who are teenagers and have not yet reached the age of 18.

User phone numbers and home addresses are two of the most sensitive pieces of information available on Facebook profiles. First and most obviously, anyone can use this information to immediately contact a Facebook user outside of the Internet ecosystem. This could be very useful. But these two pieces of information can also be abused -- quickly, cheaply and with astounding efficacy.

The top result for "People Search" or "Person Search" on Google is at site called www.zabasearch.com. This site in turn refers you to a powerful search engine, www.intelius.com. By entering a Facebook user's seven-digit phone number and mailing address on this site and purchasing a "Phone Report," "Email Address Report," and a "Resident's and Property Report," one can obtain that user's:

(1) name;
(2) age;
(3) date of birth;
(4) email address;
(5) estimated income;
(6) the names of that user's family members (i.e. mother, father, brother, sister);
(7) the names of the owner of the user's home;
(8) the estimated value of the user's home;
(9) the actual purchase value of the user's home;
(10) the name of the bank that financed that purchase;
(11) the number of bedrooms in the user's home;
(12) the number of bathrooms in the user's home;
(13) the names,
(14) addresses, and
(15) phone numbers of the user's neighbors; and
(16) the names,
(17) phone numbers, and
(18) dates of birth of the past occupants of the user's home, as well as
(19) the names of the family members of those past occupants (i.e. mother, father, brother, sister).

Anyone with ten minutes, $25, and a Facebook user's phone number and address and no other information can obtain a breathtaking amount of information about that Facebook user -- and that Facebook user's family, friends, neighbors, and landlord. Combined with a targeted Google search, these two pieces of information can allow someone to obtain almost all of the information necessary to complete a loan or credit card application. It is hard to contemplate all of the different ways in which this information could be abused.

As of January, 147 million Americans are members of Facebook; 13 million of them are teenagers between 13 and 17 years of age. As of May of last year, there were 550,000 applications available on Facebook. The changes Facebook is contemplating would allow countless application developers to access a vast repository of personal information with just one or two clicks from a user's mouse. In our opinion, the risks presented by these changes are too high -- especially for thirteen- or fourteen-year-olds who may have no conception of the consequences for disclosing this kind of information.

We thus respectfully request that you reverse your plans to permit applications to request and access Facebook users' mobile phone numbers and addresses. If Facebook denies this request, we ask that at minimum you block this feature for Facebook users between 13 and 17 years of age. This is consistent with Facebook's existing practices of strengthening privacy settings for teenage users (e.g. preventing these users from making information available to "Everyone"). We also ask that the permission screen to request user phone numbers and home addresses contain a warning to all users of the different ways in which this information could be abused. Finally, we ask that wherever operationally possible you allow Facebook users to access all applications regardless of whether or not they choose to provide these applications with their mobile phone number and/or address.

We believe that these are modest requests that will go a long way in protecting the privacy and security of millions of Americans. We urge you to consider and adopt them.

Sincerely,

Al Franken
U.S. Senator

Sheldon Whitehouse
U.S. Senator

Charles E. Schumer
U.S. Senator

Richard Blumenthal
U.S. Senator

Last year, Sens. Franken, Schumer, Michael Bennet (D-Colo.), and Mark Begich (D-Alaska) wrote to Facebook urging the company to fix its privacy policy to block users' personal information from being accessed by third parties without the users' consent.

Source