Mark Zuckerberg: Facebook founder admits 'bunch of mistakes' amid privacy u-turn

Mark Zuckerberg has admitted Facebook has made "a bunch of mistakes" on privacy and agreed to overhaul its policy to make all major changes opt-in, following regulatory criticism from the American Federal Trade Commission.

Mark Zuckerberg, Facebook's founder, is to implement a new privacy regime Photo: GETTY IMAGES

Writing in a rare blog post, the social network site's founder and chief executive said he “founded Facebook on the idea that people want to share and connect with people in their lives, but to do this everyone needs complete control over who they share with at all times”.

But he added that while overall the site had a good history of being open about privacy, "I am the first to admit that we have made a bunch of mistakes".

He also admitted that the site's executives "can always do better" on the controversial issue.

His comments came after the US Federal Trade Commission (FTC) accused Facebook of systematically invading user privacy on seven specific counts, including when the social network had changed settings to make more of its users' information publicly visible.

The new plan to settle the compaints marks a major step on the social network’s road to its initial public offering, which had been widely expected to value the company at $100 billion.

Facebook will now be “required to obtain consumers’ affirmative express consent before enacting changes that override their privacy preferences”.
This will effectively make all major future privacy control changes opt in. Facebook must also submit to privacy audits every 2 years for the next 20 years, stop any access to content on deactivated accounts, and present its policies on privacy or security of user data more clearly.
Although new settings can apparently be added without requiring users to opt in, new services will now require users to explicitly give their consent if they are to take part. Facebook Places, for example, which allows users to check-in online to physical locations, was cited as an example of a service that Facebook would not now be able to turn on for all users without their consent.
Zuckerberg conceded that the site had made major mistakes with users’ privacy, citing the launch of the ‘Beacon’ system which showed users’ friends their shopping habits, and the company’s previous changes to privacy policies.
He claimed, however, that “When I built the first version of Facebook, almost nobody I knew wanted a public page on the internet. That seemed scary. But as long as they could make their page private, they felt safe sharing with their friends online. Control was key”.
Zuckerberg put the social network’s success down to making it “easy for people to feel comfortable sharing things about their real lives”.
“Overall, I think we have a good history of providing transparency and control over who can see your information,” he wrote.
"That said, I'm the first to admit that we've made a bunch of mistakes. In particular, I think that a small number of high profile mistakes, like Beacon four years ago and poor execution as we transitioned our privacy model two years ago, have often overshadowed much of the good work we've done.
"I also understand that many people are just naturally skeptical of what it means for hundreds of millions of people to share so much personal information online, especially using any one service."
He added: "Even if our record on privacy were perfect, I think many people would still rightfully question how their information was protected. It's important for people to think about this, and not one day goes by when I don't think about what it means for us to be the stewards of this community and their trust.
Facebook has always been committed to being transparent about the information you have stored with us – and we have led the internet in building tools to give people the ability to see and control what they share.
"But we can also always do better. I'm committed to making Facebook the leader in transparency and control around privacy."
The new agreement with the FTC “means we're making a clear and formal long-term commitment to do the things we've always tried to do and planned to keep doing - giving you tools to control who can see your information and then making sure only those people you intend can see it”, Zuckerberg said.
The social network will now also have two Chief Privacy Officers; former lawyer Erin Egan will be responsible for Policy, while Michael Richter will become Chief Privacy Officer, Products. Richter is currently Facebook's Chief Privacy Counsel.
Overall, the changes are set to alter Facebook’s development of new products, as well as its attitude to users. FTC Chairman Jon Leibowitz said ”Facebook’s innovation does not have to come at the expense of consumer privacy. The FTC action will ensure it will not.”
The proposals will now be put to a 30-day consultation period. They are likely to meet the majority of the concerns raised be European privacy regulators, although those issues remain unresolved.

Microsoft defends against espionage virus

Microsoft has released a temporary software patch to defend against the threat from Duqu, an espionage virus thought to be closely related to Stuxnet, the cyber attack that disrupted the Iranian nuclear programme. 

Cyber espionage is a growing threat, according to the Government

 

Duqu was first detected last month and, according to security analysts, is designed to steal sensitive information from industry.

Microsoft said it exploited a vulnerability in the Windows TrueType font parsing engine to gain control of infected computers. The temporary patch will be replaced by permanent update at an undisclosed later date.

Whoever was behind Duqu was able to “install programs; view, change or delete data; or create new accounts with full user rights", Microsoft said.

It has also shared technical details with anti-virus firms.

"This means that within hours, anti-malware firms will roll out new signatures that detect and block attempts to exploit this vulnerability,” Microsoft said. “Therefore, we encourage customers to ensure their antivirus software is up-to-date.”

The Laboratory of Cryptography and Systems Security at Budapest University, which first detected Duqu, has said it is spread by a bogus Word document.
Only a handful of targets have been identified, according to anti-virus firms, leading them to suspect the virus is being used as part of a highly-targeted espionage operation, potentially as a prelude to further Stuxnet-style attacks.
“Duqu's purpose is to gather intelligence data and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party,” Symantec said.
Similarities between Duqu and Stuxnet have led to claims they must have been created by the same state-sponsored entity. Israeli and American intelligence agencies are widely belive to be behind the attack on the Iranian nuclear programme.