By Komal Makhdoom.
Central Question: An increasing amount of online traffic is being directed to social networking web sites. Could this willing provision of information encourage malicious Internet users, particularly terrorists, to exploit the public? Is the public aware of potential attacks?
Case Study: Facebook.
Abstract: A brief history and rapid growth of the social networking site, Facebook, its features, restrictions, and user options. Public reactions to Facebook allowing non-academic accounts, as well as the new demographic that began to use it. In the light of Facebook’s privacy policy, terms of use, and features, incentives and related actions of malicious internet users are discussed. How would a social networking website like Facebook appeal to terrorist recruiters? Also, how secure is information users willingly provide to Facebook? These questions are explored with reference to information from the United States Institute of Peace, technical blog writers, and relevant online sources.
Morgan Stanley, global financial services firm and self-proclaimed “market leader” in securities, asset management and credit services, produced an Internet traffic report in March, 2008. Statistics on this report were all the rage on technical blogs following soon after. To quote David Erikson, director of e-Strategy at Tunheim Partners Strategic Communications Company, the report proved social networking web sites to be “major hubs of online activity” today, given the following global traffic rankings:
| Ranking: 2005 | Ranking: 2008 |
10. Yahoo.com
| 10. Yahoo.com |
9. Msn.com
| 9. Youtube.com |
8. Google.com
| 8. Live.com |
7. Ebay.com
| 7. Google.com |
6. Amazon.com
| 6. Myspace.com |
5. Microsoft.com
| 5. Facebook.com |
| 4. Myspace.com | 4. Msn.com |
3. Google.co.uk
| 3. Hi5.com |
| 2. Aol.com | 2. Wikipedia.org |
| 1. Go.com | 1. Orkut.com |
Of all social media sites, market-researching company “comScore” ranks Facebook as the most-trafficked in the world, as well as the fourth most-trafficked website, globally. Over 55,000 collegiate, geographical, business, high school, and related networks comprise the 110 million active-user population registered with Facebook today (facebook.com). These users upload selective contact information, such as their name, e-mail address, residence, work information, and vacation plans to Facebook’s database, and determine who on their approved ‘friends’ list has access to this information. Facebook also provides tools to construct a ‘profile,’ in which people can describe their interests, favorite quotes and movies, education and relationship details, and any other information they choose. Facebook allows contact between individuals and groups of individuals through ‘groups,’ private messaging, a public ‘wall,’ and its chat feature. People can buy and sell items on Facebook’s designated ‘Marketplace’ and, finally, Facebook provides applications ranging from online photo albums to virtual music players, which users can add to their profiles. According to facebook.com, 140 new applications are added to the site every day, and over 95% of Facebook members have used at least one application built on its platform. 
I joined Facebook when it was still known as “The Facebook:” in 2004 when the site had just extended to college students beyond its point of origination at Harvard. Facebook opened up to high school students on an invite-only basis in 2005. By the following year, it graduated from school and began to allow anyone above the age of 13 to register; the fastest growing Facebook demographic is now aged 25 years and older (facebook.com). There is no background check or evaluation process involved—Facebook’s registration form has only five fields, and a privacy policy it assumes users have read before confirming their registration. Upon joining, new users are able to interact with other Facebook members based on their respective privacy settings, and take advantage of the site’s features. Users have the option of limiting certain information, such as their photo albums and public “wall,” to only be visible to a custom list of friends. The “limited profile” feature regulates content that is visible to a user’s “Facebook friends,” by allowing the user to create a custom “limited profile” list. In this manner, Facebook allows all users to customize their privacy settings.
Facebook’s custom options did not prevent the “FACEBOOK WILL BE AS SKETCHY AS MYSPACE” group from appearing when Facebook announced its decision to allow non-academic accounts. This decision coincidentally took place the same year that television news had been ringing with stories of young girls being abducted by strangers they’d befriended on Myspace.com, another social networking site that, at the time, allowed all users to view each other’s profiles without restriction. The BBC Technology web site published an article fearing “privacy erosion” when Facebook took the next step of allowing its users to appear in Google search listings. When the creators of Facebook let it go public, a dismayed college student created the group titled “I Facebooked Your MOM,” the group description reading: “because it’s actually possible now.” Soon my best friend’s home-schooled younger brother was sending out “friend invites.” My own younger brother, years from college, had an account as well, and so did one of his high school teachers.
One of the first agencies to jump on Facebook’s public-access feature was the United States CIA, which sponsored a Facebook group outlining procedures for potential recruits into its National Clandestine Service. According to a feature in Wired Magazine, the group grew from 200 to over 2,100 members, one week after its debut. There was no resume collection or interaction through the group with members, but recruiters were able to find a multimedia platform for information (a Youtube video accompanied recruitment guidelines). Facebook’s public feature made its influence obvious as membership grew (and continues to grow) exponentially, extending to office workers, community service organizations, people’s distant relatives, and various academic and un-academic publics.
“Public” can be a dangerous word, as it includes, in the case of Facebook, all members of the community with internet access, regardless of their
backgrounds, education level, or personal beliefs. Publics can be unpredictable, in that their different groups use different communication channels
to passage a desired influence. The Edinburgh Journal reported a public use of Facebook resembling that of the CIA, but for essentially the opposite motive. In February of 2008, Radical British Jihadist groups were discovered recruiting students and describing operations on Facebook and other forums. The Facebook group linked, as described by the Journal, to “extremist literature.” After the Terrorism Act banned the radical cleric Omar Bakri Mohammed from re-entering the UK, former members of the organization turned to the online front, primarily recruiting British university students through Facebook (Johnson,1).
Gabriel Weimann of the United States Institute of Peace indicates “recruitment and mobilization” as one of the eight general ways in which terrorists use the Internet. According to Weimann, “[i]n addition to seeking converts by using the full panoply of website technologies (audio, digital video, etc.) to enhance the presentation of their message, terrorist organizations capture information about the users who browse their websites” (1). The next emerging public on Facebook, taking advantage of its rapid expansion and the access it provides to large groups of people, plus features of its privacy policy, and the bountiful member information in its archive, may be of “cyber-terrorists,” i.e. upholders of coercion and possible violence by instigating fear, operating in or facilitating from an online medium.
Cyber-terrorism is defined more specifically by the National Conference of State Legislatures as:
“…the use of information technology by terrorist groups and individuals to further their agenda. This can include use of information technology to organize and execute attacks against networks, computer systems and telecommunications infrastructures, or for exchanging information or making threats electronically.”
The U.S. Institute of Peace describes several incentives for potential terrorist groups to direct attacks or preliminary procedures through an online medium, which coincide with Facebook’s provisions in the following ways :
- Cost efficiency: Malicious Internet users simply need a personal computer and an online connection to communicate with their target group. Creating an account and respective groups, using applications, and contacting people on Facebook are free. There is no charge for using the service unless a direct purchase such as photo prints or a group advertisement is made.
- Anonymity: Like many Internet surfers, terrorists use online nicknames or aliases, making it very hard for security agencies and police forces to track down their real identity. Although Facebook does not approve obscene nicknames or obviously false titles, it cannot verify, for instance, if someone’s profile is entirely fake. The Facebook terms of use deny responsibility of any fake profile in the following bolded section:
FACEBOOK DOES NOT PRE-SCREEN OR APPROVE FACEBOOK PAGES, AND CANNOT GUARANTEE THAT A FACEBOOK PAGE WAS ACTUALLY CREATED AND IS BEING OPERATED BY THE INDIVIDUAL OR ENTITY THAT IS THE SUBJECT OF A FACEBOOK PAGE. NOR IS FACEBOOK RESPONSIBLE FOR THE CONTENT OF ANY FACEBOOK PAGE, OR ANY TRANSACTIONS ENTERED INTO OR OTHER ACTIONS… INCLUDING HOW THE OWNER OF THE FACEBOOK PAGE COLLECTS, HANDLES, USES AND / OR SHARES ANY PERSONAL INFORMATION IT MAY COLLECT FROM USERS.
Upon being interviewed, several Virginia Tech students said they had accepted “friend requests” from people they didn’t know on Facebook. Chris Singh, a senior in Psychology, said he wasn’t afraid to add anyone to his friend’s list, because he assumed that people contacting him were probably classmates, or friends of friends, whose faces he just didn’t remember. Nicole Decreane, a sophomore, said she once accepted a “friend request” from a man with the same last name as her who thought they might have been related. Although privacy settings can be customized, a member of someone’s “friends list” has access to components of their profile. This allows communication between the two “friends,” and the list of friends visible on either profile. A single link sent through a Facebook message or wall post can infect an entire “friends list.” Also, anyone else on this “friends list” that, for instance, does not have a restricted profile, theoretically allows access to any malicious user.
- Variety of targets: According to USIP, cyber-terrorists “target the computers and computer networks of…individuals, public utilities, private airlines, and so forth…[to] find weaknesses and vulnerabilities to exploit.” Several Facebook users, such as Syeda Kutub, a Virginia Tech senior studying Pre-Optometry, said they had members of the Corp of Cadets on their friends list and, therefore, had access to their photo albums and contact information. Since there is no content restriction on Facebook photo albums other than pornography, any pictures taken during cadet training or on a military base featuring equipment, procedures, or weaponry remains open to the uploader’s “friends list.” True, custom privacy settings can restrict which “friends” view an album, but in the bigger picture, more than just “friends” can access this information, since they are archived in Facebook’s database, and can be published elsewhere if accessed by third-party applications on someone’s profile (Terms of Use, Facebook.com).The incentives of anonymity and target variety can facilitate “data mining” on social networking websites by terrorists (USIP). As Weimann’s article explains, members willingly provide information on web sites that can allow anyone with access to learn about their whereabouts, and the wide variety of details surrounding these whereabouts (which may include universities, transportation facilities, offices, public buildings, airports, and ports). Dan Verton, in his book Black Ice: The Invisible Threat of Cyberterrorism, explains that "al-Qaeda cells now operate with the assistance of large databases containing details of potential targets in the U.S. They use the Internet to collect intelligence on those targets, especially critical economic nodes, and modern software enables them to study structural weaknesses in facilities as well as predict the cascading failure effect of attacking certain systems" (Weimann, 2).
Along with storing a copy of profile information (including deleted photographs) for a “reasonable” amount of time, Facebook assumes the right to “use, copy, publicly perform, publicly display, reformat, translate, excerpt (in whole or in part) and distribute [posted] User Content for any purpose, commercial, advertising, or otherwise, on or in connection with the Site or the promotion thereof, to prepare derivative works of, or incorporate into other works, such User Content, and to grant and authorize sublicenses of the foregoing” (Terms of Use, Facebook.com). Essentially, Facebook provides its users a sense of security through control of who views content on their profile. Users remain unaware that third party web sites could acquire their posted information regardless of privacy settings. Several Virginia Tech students admitted to posting vacation pictures of monuments and official buildings in Washington, D.C. on their Facebook profiles. Even if those on “limited profile list” can not view these albums, Facebook retains a copy of them, which could be acquired by a third party through a hack, or even a business negotiation. Secretary of Defense Donald Rumsfeld is reported to have noted an Al-Qaeda training manual recovered in Afghanistan in 2003 tells its readers, "Using public sources openly and without resorting to illegal means, it is possible to gather at least 80 percent of all information required about the enemy” (Weimann, 2).
- Another feature particularly appealing to cyber-terrorists is remote access to their targets. Cyber-terrorism requires less physical training, and travel than conventional forms of terrorism. Isolated terrorist work in an online network also lowers the risk of mortality. Tracking software, including third-party spyware, applications, or cookies distributed through social networking websites, make it easier for terrorist organizations to keep a record of their followers. An organized online medium also makes it easier for organizations to recruit and retain members.
The risk is evident, although our general population may be too optimistic to take precautions. The idea of local or international terrorists using a component of the Internet public’s every day lives sounds a bit outrageous at first. People willingly uploading personal information need to remain aware, however, that there are no “air gaps” on Facebook like there are on nuclear power plant system web sites. Facebook’s privacy policy does not assume responsibility for any form of stalking, harassment, or related discomfort or financial harm occurring in its networks. In fact, the terms of use conclude that:
IN NO EVENT WILL COMPANY OR ITS DIRECTORS, EMPLOYEES OR AGENTS BE LIABLE TO YOU OR ANY THIRD PERSON FOR ANY INDIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, SPECIAL OR PUNITIVE DAMAGES, INCLUDING FOR ANY LOST PROFITS OR LOST DATA ARISING FROM YOUR USE OF THE SITE OR THE SERVICE, ANY PLATFORM APPLICATIONS OR ANY OF THE SITE CONTENT OR OTHER MATERIALS ON, ACCESSED THROUGH OR DOWNLOADED FROM THE SITE, EVEN IF THE COMPANY IS AWARE OR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Voice of America broadcaster Mudassira Manzar, who works in an office where facebook is not yet a restricted web site, complains about “newcomers” in her field being “unprepared.” While the IT department at her office monitors all online activity, she says there are still instances of careless Internet use. “You cannot treat the internet as if it is your living room,” Manzar says, “especially when you’re in the broadcasting business. Anything you say or record onto an online stream can cost you your job.” Manzar works for one of the hundreds of international divisions at VOA, in which news and current events are broadcasted via radio, television, and online streaming audio, worldwide. Employees are restricted from online chat rooms and a list of bookmarked web sites. “Soon,” Manzar says, “Facebook will be on our bookmarked list, because of the sensitive nature of audiovisual content used by employees.”
Works Cited
Bruce, Chaddus. "Cia Gets in Your Face(Book)." Wired (online) January 24 2007.
Cyberterrorism. 2008. National Conference of State Legislatures. Available: http://www.ncsl.org/programs/lis/cip/cyberterrorism.htm.
Facebook. 2008. Available: www.facebook.com.
Morgan Stanley Corporation, 2008. Available: www.morganstanley.com.
Johnson, Miles. "British Students Being Recruited to Jihadist Facebook Groups." The Journal: Edinburgh's Student Newspaper (2008).
Makhdoom, Komal. "Personal Interview." Ed. Mudassira Manzar. Washington, D.C., 2008.
Weimann, Gabriel. Cyber-Terrorism: How Real Is the Threat? 2004. United States Institute of Peace. Available: http://www.usip.org/pubs/specialreports/sr119.html.
---. Www.Terror.Net: How Modern Terrorism Uses the Internet. 2004. United States Institute of Peace. Available: http://www.usip.org/pubs/specialreports/sr116.html.