Free Black Code: Inside the Battle for Cyberspace by Ronald J. Deibert Page B

smartphone, which has been downloaded more than 100 million times, has written into its terms of service the right for Facebook “to read SMS messages stored on your device or SIM card.” The Flickr app can access location data, text messages, contact books, online account IDS, who a person is calling, and even the device’s camera. In fact, the Flickr, Facebook, Badoo, Yahoo! Messenger, My Fitness Pal, and My Remote Lock apps can all access a user’s entire contacts book and record who that user is calling. To repeat, the reason behind this data collection is advertising. As Daniel Rosenfield, director of the app company Sun Products testified in 2012: “The revenue you get from selling your apps doesn’t touch the revenue you get from giving your apps away for free and just loading them with advertisements.”
    •  •  •
    Few users realize how quickly big data about their communications accumulates in the hands of third-party operators. Malte Spitz is an exception. Max Schrems, an Austrian law student, is another. In 2011, Schrems asked Facebook to send him all of the data the company had stored on him. As he is European andFacebook’sEuropean headquarters is in Dublin, Ireland, Schrems had the right to make such a request. Facebook dutifully sent him a CD containing 1,222 individual PDFS they had collected about him. The company had stored information on all of his logins, “pokes,” chat messages, and postings, even those he had deleted. On a detailed map, it had also stored the precise geographical coordinates for all the holiday pictures (in which Schrems was tagged) that a friend of Schrems had taken and posted using her iPhone.
    Schrems discovered that Facebook stores dozens of categories of data about its users so that it can accurately commodify its customers’ digital persona for targeted advertisements. Some examples: the exact latitude, longitude, and altitude of every check-in to Facebook, which is given a unique ID number and a time stamp; every Facebook event to which a user has been invited, including all invitations ignored or rejected; and data on the machines used to connect to Facebook, so that Facebook can connect individuals to the hardware and software they use. Schrems eventually formed an activist group, Europe vs. Facebook, to launch complaints. This led to an inquiry by Irish privacy regulators and widespread media attention about the company’s privacy policies. The battles continue.
    This relentless drive for personal information leads to extraordinary encroachments on privacy by social networking companies and ISPs.Over the years, Facebook’s default privacy settings have been continuously adjusted downwards, mostly in increments but sometimes dramatically. In 2005, only you and your friends could see your contact information and other profile data. Only your personal networks could see your wall posts and photographs, and nothing about you was shared by Facebook through the Internet. In 2007, an adjustment was made such that your personal network could see more of your profile data. And then, in early 2009, a major shift took place: suddenly, all Facebook users were permitted to seeall of your friends, and the entire Internet could see your gender, name, networks, and profile picture. Another dramatic change took place in December 2009: Facebook settings were modified such that users’ “likes” went from something exclusively seen by friends and friends-of-friends to the entire Internet. Months later, the same “all of the Internet” was extended to users’ photos, wall posts, and friends. Like a giant python that has consumed a rat, Facebook captures, swallows, and slowly digests its users.
    The search for new sources of personal information has led down other frightening paths. In 2010, the Sleep Cycle app was thrown onto the market. It monitors the sleep patterns of users from their mobile phones, and works when the phone is placed on the bed of the user. The app