Privacy herd immunity

You're being profiled through your friends

Three phontes, with ads for watches on Instragram displayed on their screens

If this hasn’t happened to you, then you’ve probably had a friend tell you this has happened to them. They were at a party, where they talked about something random like tennis rackets, and then the next day, when they got online, they were shown ads for tennis rackets. How did that happen?

In my personal experience, a lot of people assume that since they never typed the words “tennis racket” into their phone or computer, then somehow the companies that spy on us to sell us stuff must have overheard us speaking. They must be able to turn on our phone’s microphones to listen in on our conversations. It’s not a crazy idea, since devices like Google Home and Amazon’s Alexa exist, and they are able to parse what we say for the purpose of buying things and marketing to us. And anyone who is even vaguely aware of the claims of Edward Snowden will know that governments and corporations can not be trusted to only be listening when they say they’re listening.

On the other hand, with even a little technical knowledge, you’ll know that it’s one thing to get Google Home to understand what you’re saying when you’re speaking directly to it with a clear set of predefined phrases, and another thing for a computer to listen from a microphone in your pocket in a noisy bar and pick out relevant key words. And it’s a whole other level of computing technology to be able to take in what would presumably be hundreds of thousands of those unclear conversations from people all over the world and mine them for relevant data. While computing power is always getting more impressive, it still exists in a real world of mathematical limitations, and the amount of work might be worth it if you’re trying to stop a terrorist attack, but probably not worth it to just guess if some guy might want a tennis racket.

I believe my own variant of Occam’s Razor, which is that the truth is often the most disappointingly mundane option. In this case, the mystery of how it is you got an ad for tennis rackets after a conversation with your friends even though you never searched for rackets online has a simple answer. One of your friends did the search. Companies like Facebook and Google keep track of your friend connections and your contact list and your email and text conversations. They have an imperfect idea of which friends you are closer to than not, but it’s often good enough to make guesses.

In the simplest form, all that has to happen is your friend looks on Amazon for a tennis racket after you meet. Somewhere out there is a computer running algorithms trying to figure out what to sell you. It sees your friend do the search. It looks through the database of people it has listed as that person’s friend. Your name comes up, it figures odds are okay that you and your friend like similar things, and there you go.

In some circumstances I’ve had some friends claim they’ve asked their friends, and everyone swears that no one searched for tennis rackets, or whatever. Again, Dave’s Razor says that the explanation is most likely mundane and boring, which in this case is that one of those friends is simply lying or forgot. Why would anyone lie? My guess is that once the narrative has been established among a group of friends that they’re being spied on by their phones, no one wants to admit to a less interesting set of conditions. But they could just genuinely forget, too. Or even a little of both. The main point is that you can’t just take everyone at their word.

More interestingly, what if you’re in a group where not everyone is of equal weight in terms of friendship. You’re close enough to some to ask later if they looked for tennis rackets after you spoke, and they say no, but of the other people, you don’t know then well enough to start making weird and random questions out of the blue that sound kind of like some sort of accusation. Maybe they searched for tennis rackets, but then, how did the algorithm know to link that back to you? After all, you don’t know them that well.

Here’s where the situation gets a little creepy, because it is possible that whatever method you used to make the appointment to see your friends was being read in order to have a general sense of your movements. You text your good friend that you will meet them. Your friend texts their friend, someone you don’t know so well, to come join. Now the algorithms know the three of you are sharing a space. During that time, you talk about tennis rackets, though the algorithm has no idea about that. Later, the person you don’t know searches for tennis rackets. The algorithm notes that, and then takes a look at who they were with in the last few hours before the search. That search goes back to your good friend, and to you.

That’s still requires some sophisticated programming, and some invasive analysis of your texts, emails, and maybe your calendar. It’s not at all easy to create algorithms that will read a text message that says, “hey, are we still on for the thing tonight,” and then correlate that with social groupings and timelines and other matters. Still, with current technology, it’s much, much easier to take datasets of text and mine them for useful connections than it is to listen to real time audio under adverse conditions.

None of this really solves the problem that people are really concerned about, which is the degree to which corporations and governments, and other institutions, use technology to build profiles of us and track our comings and goings. It’s not as exotic as our phones and laptop cameras being switched on, and being surveilled in real time.

But, in a way, the reality is more insidious, because it means that the biggest hole in our privacy is our friends.

I have friends that don’t use Facebook, and while this makes them a slightly harder target for online advertisers and whoever else, if the computers are tracking the actions of all the friends around them, then they are just as caught up as their friends who are on Facebook. At best they’ve achieved one level of inconvenience in terms of data tracking from the point of view of Facebook. All it takes is for friend one to use Facebook Messenger to text friend two and say, “hey, when are we supposed to meet Friend Three at that restaurant?” Boom. Facebook algorithms know where Friend Three is that night.

How would Facebook even know who Friend Three is? Because Friend Three still uses Amazon to buy things, and maybe Google for email. Fractional profiles exist of all of us using the internet at all, spread out over different servers in different places, and a market exists for buying and selling that data. I don’t claim to know how it works exactly, but from what I can tell from the Amazon ads being shown to me on Facebook, it’s pretty clear some of this data is getting around between corporations. Picking and choosing one or two different social networks to not participate in, like some of my friends who disdain Facebook, won’t prevent you from having a profile. Your friends are making it for you.

This, to me, is the real future of surveillance. Using CCTV cameras to watch people, unlocking your laptop camera to catch you in private moments, listening in through your phone’s microphone to catch some key phrases, all of these are definitely avenues of surveillance that are being explored in some way or another. But for some years yet, they will be too resource intensive to be worth using on any one person unless you already have some reason to want to take a hard, close look at them.

What computers are really good at is crunching through lots and lots of text and numerical data. The easiest and most readily available data is all the tons of texts your friends write where they mention you. The calendar appointments they make with you. The emails you write back and forth. Even if you were never online, you are being tracked. By your friends. With the right algorithms, a pretty good picture of who you are could be made without you even participating in it.

If your privacy is something you ever wonder about, then I would recommend you worry less about whether or not your laptop camera can be turned on without your consent. Is it really worth anyone’s time to stare at you for hours on end while you are most often just largely motionless as you type? Or what could they learn about you by checking what your friends are texting about that conversation you had last night?