Researchers from the University of British Columbia Vancouver infiltrated Facebook with a set of bot-controlled fake accounts, sent out a load of friend requests, got a load of responses, and then harvested 250GB of personal data. They managed this in spite of Facebook's defense measures such as CAPTCHAs if an account tries to add too many friends, and the "Facebook Immune System" (FIS), that detects suspicious, spider-like activity and blocks it.
In total, 102 bots were used. These sent friend requests to 5,053 random users with public accounts, 976 of which accepted them. The bots then sent a further 3,517 requests to friends of those users; 2,079 of these were accepted. Facebook Immune System blocked about 20 percent of accounts after users reported those accounts for spamming. The result was a network of 3,055 profiles, with a further 1,085,785 friends-of-friends in the extended network.
With these connections made, the researchers then tried to harvest information that could have monetary value: the extensive personal information contained in Facebook profiles. They then compared the amount of data accessible before infiltration (i.e. that made available to the public) and that after (i.e. that made available to friends or friends-of-friends). While some information was widely publicized—almost everyone who included their gender on their profile made it public—other details, such as postal and e-mail addresses, became much more accessible after friendship was granted: for people directly friended by the bots, availability of e-mail went from 2.4 percent (unfriended) to 71.8 percent (friended), and postal addresses from 0.9 percent to 19.0 percent.
Facebook disputes the value of the study, arguing that FIS actually blocked more accounts more quickly than the researchers claim, and that the bots were given more leeway than normal accounts because they were using a single university IP address. The fact that friends can access more personal data than strangers is in any case unsurprising: that's rather the point of being Facebook friends.
But what we did find weird was the number of people willing to add complete strangers as friends. The initial batch of friend requests had about a 20 percent success rate. These were unsolicited friend requests between people who couldn't possibly have relationships, and yet one in five people were willing to make the connection. If that complete stranger had a mutual friend in common, the success rate went up to about 60 percent.
Much is made of Facebook privacy and control. The site has been criticized for making it too hard to secure personal data, and be too liberal with its default policies. In response to these criticisms, it has made the privacy and security system easier to use and with more sensible defaults.
But these controls are irrelevant if people are willing to add random bots, and hence give away access to their "friends-only" private information. With its focus on data harvesting, the study didn't examine why people might add such accounts as friends, but plainly there are many Facebook users who are more interested in having the connection than whether they actually know someone. Facebook users are clearly taking the time to consider how widely their data is shared, and hiding information from non-friends. But when looking at whom the data is shared with, much of that same care and attention appears to be missing.