Disclosure
In general, information disclosure enables an attacker to gain valuable information
about a user (or a system). In social network services, disclosure is often concomitant
with the social network service use itself. In fact, according to the already cited
definition of SNS provided by boyd and Ellison ( 2007 ), social network services
allow the creation of “public or semi-public profiles within a bounded system”, they
foster the articulation of lists of personal connections within the system, and they allow the transversal of these connection lists within the system. This way, with
respect to the general problem of information disclosure, it has become more evident
that in SNS the problem of privacy is not bounded by the perimeters of individuals
but also by the privacy needs of their social networks and of the communities
they belong to. When information is disclosed on SNS (voluntarily or involuntarily),
personal data can be utilized not only for the primary purposes for which they were
collected. They can be utilized for secondary (from the perspective of the user) purposes
that are covered in the SNS’s terms of use and in that sense accepted by users
(e.g., targeted marketing), but they can also be utilized for other illegal or unwanted
purposes, both from the point of view of the user or the members of the community
the user belongs to (indirectly affected by user’s information disclosure).
For these reasons, particular attention must be provided in managing ‘private’
and ‘public’ data, according to the common classifi cation of confidentiality levels.
Preibuschet al. ( 2007 ) provide two further levels for classifying data confidentiality,
taking into account specific ‘group’ and ‘community’ aspects of social network
services:
• Private data : disclosed to the SNS operator for its internal purposes only, its
disclosure needs explicit consent;
• Group data : disclosed to the SNS operator and accessed by other users of the
same SNS that are also in the same group as the user; data disclosure is limited
to the group;
• Community data : disclosed to the SNS operator and available to all registered
and logged-in users of the SNS; the data is not accessible for anonymous SNS
visitors;
• Public data : disclosed to the SNS operator and made accessible for all SNS visitors,
including anonymous visitors.
Even if the concrete details and the application (and even the interpretation) of
these confidentiality levels to data depends on the SNSs implementation, their correct
definition and use could help in addressing the privacy issues described in the
following sections.