The FISMA Focus IPD

A lawsuit accusing Facebook of mining private messages for information it can pass on to advertisers stands as a reminder to businesses that privacy is a relative word on a social network, experts say.

The lawsuit filed in federal court in Northern California seeks class-action status for all Facebook users allegedly duped into believing that they could send confidential messages. Specifically, the suit says Facebook has violated the federal Electronics Communications Privacy Act and California privacy laws.

Facebook has allegedly gone wrong by scanning private messages containing links to websites and searching the destinations for clues about the sender that it can sell to advertisers, marketers and other data aggregators.

The plaintiffs argue that Facebook implied the opposite when it launched its integrated email and messaging service in November 2010.

“Facebook telegraphs through the use of the words ‘privately’ and ‘private’ that when a user sends a private message to another party, only the user and the intended recipient will be privy to the contents of that communication,” the suit says.

Plaintiffs Matthew Campbell, Pulaski County, Ark., and Michael Hurley, North Plains, Ore., are seeking the greater of either $100 a day for each day of violation or $10,000 for each affected user, plus damages under California law.

Facebook denies any wrongdoing. “We believe the allegations are without merit and we will defend ourselves vigorously,” the company said in a statement emailed to Computerworld.

Expecting privacy from an ad-driven Web site that needs to check all posted links for malware and spam is ludicrous, Anton Chuvakin, research director for security and risk management at Gartner, said.

“Frankly, this is an idiotic suit,” he said. “If the message is really private, as in secret, use encrypted email or hand-deliver it. Why is it on Facebook?”

Of course, the social network has the responsibility of clearly explaining what it does with all user-generated content, so the courts will have to decide whether Facebook was misleading in the use of the word private with its email service.