Facebook’s "People You May Know" Is a Black Box That Needs Opening

Facebook is an incredible tool for catching up with friends and everyone alike. There is no denying it. But let's also not forget that the social network was built on the very foundation of undermining user privacy, right from the days when it was called FaceMash.


Built as a Harvard version of Am I Hot or Not, FaceMash courted trouble in November 2003 when Mark E. Zuckerberg, then a sophomore student at the university (interestingly, he majored in Psychology), was accused of "breaching security, violating copyrights and violating individual privacy by creating the website, www.facemash.com."

The site was created entirely by Zuckerberg over the last week in October, after a friend gave him the idea. The website used photos compiled from the online facebooks of nine Houses, placing two next to each other at a time and asking users to choose the “hotter” person.

Students were ranked within the general Harvard community and individual Houses according to attractiveness.

Zuckerberg hacked into House websites to gather the photos, and then wrote the codes to compute rankings after every vote.

The website had also been created with an insidious intent: "Sitting alone in his dorm room that night in 2003, Zuckerberg had just been jilted by a girl. He started drinking and once again sought solace in the realm that never let him down. Logging on to his blog, he created an entry titled 'Harvard Face Mash: The Process.' His plan was as simple as it was vindictive: create a site called Facemash.com, hack into Harvard’s directory, download photographs of his classmates and post them online next to photos of farm animals to rate who was more desirable."

Zuckerberg was threatened with expulsion when the "breach" came to light, but ultimately the charges were dropped.

The company's shady values are so baked into its DNA (remember Zuckerberg's dumb f**ks comment?), it's thus no big surprise that Facebook wilfully crosses the creepy line with impunity, but even then nothing explains the black box that's People You May Know (PYMK), a tool that has consistently surprised, delighted and horrified users for its uncanny ability to recommend new friends.

Ever wondered how Facebook is able to suggest all your friends from high school and college the minute you sign up for the service and log into it the first time? It's PYMK at work. It's impressive. But it's also "low-key terrifying."

Gizmodo's Kashmir Hill has extensively documented about PYMK over the years, and it bears compulsory reading:
From using the contact details you provide voluntarily while signing up to the contacts you upload (for Find Friends) to your current location to your Instagram followers (and the people you follow) to your photo metadata (image file names, lens scratches, dust etc.) to building shadow profiles* (securing information about you from other sources, online and offline), there isn't a single data point Facebook has left out in order to suggest potential new connections.


As Hill notes, "more than 100 signals (emphasis mine) go into making the friend recommendations and that no one signal alone would trigger a friend suggestion." Also, "Facebook has told us many things it doesn't do, to ease fears about Facebook's ability to spy on its users: It doesn't use proxies for location, such as wi-fi networks or IP addresses. It doesn't use profile views or face recognition or who you text with on WhatsApp. Most of Facebook's uncanny guesswork is the result of a healthy percentage of users simply handing over their address books."

But two patents granted to Facebook recently suggests it may be doing exactly this, and possibly take it even further:
On one hand, it's admirable that Facebook is into this lofty goal of connecting people and "bringing the world closer together" — it can come incredibly useful in circumstances when you met someone at a party but forgot to get their name — but you know who else can benefit from this sort of wireless sniffing? Cyberstalkers and… law enforcement.

In its present form, they are just patents. And almost all companies file patents for technology that sometimes remains just that, and done so in an attempt to lockdown their intellectual property and stifle competition.

Why worry then? It's because no one really knows how the PYMK feature works, including people at Facebook (unless you happen to be the engineer working in the PYMK team). Since its introduction in 2008, the tool has been nothing but notoriously opaque, with the social network staunchly refusing to get into the specifics of the algorithm, instead resorting to vague non-committal responses. (Having friends in common, being tagged in the same photo, and uploading your contacts are some of the ingredients, sure, but not all of it.) What's more, there is no option to turn the feature off.

But when sex workers' real identities are outed to their clients, or when it suggests "I friend a person that I had met in a parking lot" when the meeting involved no exchange of contact information, the obvious solution for Facebook would be to "give its users access to their own data, and control over it. Along with offering to connect one person to another, it could explain what data it used to suggest that connection, and offer a clear way to opt out of it."

The reluctance on Facebook's part to cede control to users ("An opt out is not something we think people would find useful.") is why it's high time this black box is opened, overriding the company's questionable growth-at-all-costs thought process behind tools like it. For all the headaches and privacy troubles the social network has caused, what its users deserve in the least is a platform that's founded on the principles of accountability, transparency and trust.

*The idea of "networked privacy" or "transitive privacy" is so relevant because you have no control over the information someone else shares/uploads about you. You can read more about it here.

Comments