Finding hidden circles may improve social network privacy settings

"We want to help users configure privacy to be better protected," said Anna Squicciarini, assistant professor of information sciences and technology, Penn State. "However not all users are interested or motivated to change their privacy settings,"

The researchers designed a software program to better predict how users might assign privacy levels to new content to different groups of people in their networks.

Users may create and maintain connections -- circles -- that are based on more specific and temporary relationships, such as ones based on hobbies and interests, that are not included in the privacy settings provided by the social networks. Many users also skip the process of manually setting privacy restrictions as they add new content and new members to their networks because it can be time consuming or confusing.

"If users could have privacy settings automatically set when they, for instance, add new members to their circle, or when they add new content, we feel it would improve security, but not affect their experience," said Squicciarini, who worked with Sushama Karumanchi, doctoral candidate in information sciences and technology, Penn State; Dan Lin, assistant professor of computer science, Missouri University of Science and Technology; and Nicole DeSisto, systems development and operations consultant.

The program, which used data-mining techniques to find groups and connections, had an average 23 percent error rate in attempting to predict how people would respond to 75,000 different privacy settings in 15 different scenarios -- for instance, how a person might choose privacy setting when posting a picture of a recent vacation.

"Our approach performs extremely well for some scenarios, reaching an error rate of 3 percent, whereas it seems to be not effective for scenarios involving re-uploading content found from others," noted the researchers, who reported their findings in a recent issue of Computers and Security. The accuracy rate improved by up to 90 percent in certain categories during later trials by making the choices about actions and membership more specific.

"Interestingly, when inferring policies targeting general friends, people with common interest and people with similar background, accuracy is up to 90 percent," the researchers said. "For policies targeting family, colleagues, close friends, the policy prediction accuracy is lower, about 78 percent."

The researchers asked 140 participants -- 62 percent female and 38 percent male -- questions about their interests, as well as their social networking habits and attitudes about privacy settings. The subjects also reported how they would set their privacy setting on their social networks under various scenarios, including how they would share family photos, business photos, news stories and posts about hobbies.

Currently, people using social networks can manage privacy levels so that their content is only shared with select users, said Squicciarini. For example, Facebook offers customized groups for its members, while Google Plus allows its members to designated their connections as friends, family, acquaintances or following.

However, these settings do not easily allow people to create more specific interests groups within those main categories, nor can the privacy settings be automatically assigned as new contacts join a user's social network.

"There's only so much that we can learn based on surveys like this and it would be better to actually observe how users manage their privacy settings in a realistic social networking environment," said Squicciarini.