When sharing goes too far

Being able to share your opinions, experiences, and photographs is the main reason for using a social network. But on Facebook, which is the largest service, with more than 400 million active users, some personal information you don't protect can be read by anyone running a search engine, exposing you to a range of abuses.

"Criminals are opportunists," says Charles Pavelites, a supervisory special agent at the Internet Crime Complaint Center, a partnership of the FBI, the National White Collar Crime Center, and the Bureau of Justice Assistance. Pavelites urges people to use the same caution when sharing sensitive data online as they would offline. "Wherever you have lots of people, they'll see lots of opportunities," he says. "How savvy the criminal is versus how savvy the social network is will determine how much happens. It's a race, but we can't say who will win."

Natalie Connor, a software security industry public relations professional from Sydney, Australia, found that out the hard way. One morning last January, she got a message from a friend of hers on Facebook describing a potential match he'd found on the online dating service eHarmony.

She was 24, "a primary-school teacher ... and she's using your picture," he informed her. She was using Connor's profile picture from her Facebook account. Connor contacted eHarmony, which soon took the photo down.

While it's not certain whether using someone else's photo that way is a crime, doing so could lead to civil action.

Connor said she had restricted access to her Facebook profile to just her friends. Yet she wasn't entirely surprised at what happened, because her work has made her acutely aware of online threats.

"I thought I was safe online," she says. "But in reality, how could I be?" In fact, it's quite easy for other Facebook users, even those not on your friends list, to download photos you don't protect.

For example, our reporter signed onto Facebook and accessed the unprotected portraits and profiles of numerous strangers, including information invaluable to criminals such as a mother's maiden name and child's middle name.

She was able to do it because Facebook had recognized that she and those strangers had friends in common, a relationship it calls "sharing a network." Since, as our survey shows, many Facebook users don't use privacy controls, someone who had only a handful of Facebook friends could conceivably access thousands of unprotected profiles.