James Grimmelman has a new paper out on privacy in social networks that suggests I might be wrong. In short, Prof. Grimmelman argues that data portability is not a solution to the privacy problem, because privacy is determined not just by who controls data, but by what code controls and interprets the data. Of course, the code won’t follow ‘ported’ data. For example, if a friend shares a picture with you, they aren’t deciding ‘just’ to share that picture with you, they are deciding to share it under the specific rules of the social network they are sharing it through. They may not fully understand those rules, but the rules are discoverable, choosable, and maybe even predictable. If that picture is taken elsewhere the rules may be better- but they may well be worse. Using the example of Scoble getting banned from Facebook for importing information into the notorious Plaxo, Grimmelman points out that this helped Scoble’s independence- but may well have violated the privacy expectations of anyone who had shared data with Scoble, assuming that Facebook would enforce certain rules on the use of the data. Or to put it more abstractly: “data portability may reduce vertical power imbalances between users and social network sites, it creates horizontal privacy trouble.” I think I’d known this before reading this paper, but Grimmelman laid the problem out so clearly that I will be forced to revisit the question.

(Tangentially, Grimmelman notes that this problem is in part a side-effect of the use of notions of ‘ownership’ to describe personal data, when property norms may well be the wrong metaphor for personal data. Certainly we’ve been guilty of that mistake here from time to time.)

Grimmelman does suggest a slew of other approaches that might lessen the privacy issues in modern social networks, and critiques a slew of others that he thinks won’t work – so for anyone thinking about privacy and network services the paper is well worth a read. In the meantime, I’ll be mulling what it means for free/autonomous social networks, and invite others to do the same.

There has been some progress in virtual worlds, particularly with efforts like opencroquet, but more could still be done. Azdel Slade has written some worthwhile and interesting posts about the problem here, here, and here- worth a read!

Rather than spending their time on grandiose statements, the DiSo Project and others like are already distributing code that just works. … [T]he web moves much faster than desktop software and it remains to be seen if the principles of desktop software can guide the development of an open web.

We’re actually in agreement with Wired here, though Wired hasn’t realized it yet autonomo.us is very explicitly about the idea that “the principles of free/open desktop software” can’t guide the development of an open web. If it could, FSF and OSI would already have been on their respective warpaths about this years ago. Instead, those principles- especially where they focus on user freedom- will probably be relevant, but also almost certainly insufficient and sometimes nonsensical. If the old principles only partially work, there must be some other principles that can guide the development of an open web. I think we see our primary goal as understanding what these new principles are, so that we can work with other groups to forward them.

With this focus on principles, rather than code, we think we complement- rather than compete with- projects like DiSo, DataPortability, and Open Web Foundation. We’re not ivory tower types; every one of us has an extensive development background, so we all have the deepest respect for the people writing code (and specs), and no desire to get in their way. While those guys and gals charge ahead doing the hard and important work- probably stumbling in some places and hopefully succeeding brilliantly in others- we’ll be watching their successes and failures, and thinking and writing about the philosophy, the principles, and the big picture. Our hope is that this will help inform and frame the discussion, so that we can all focus on advancing software autonomy instead of reinventing philosophical wheels.

To put it another way- we don’t expect to write code (though individual members or their affiliated groups have written code and will continue to.) We do expect that when concerned code writers are wrestling with what their code or specs should do, we’ll be able to help answer their questions about principles and goals.

Luis is a law student at Columbia Law School; a director of the GNOME Foundation; a member of OSI’s legal advisory board; and many other hats. This post is not a formal statement of GNOME, OSI, or any other organization of which I’m a part- even autonomo.us- just a reflection of my understanding of the state of our little project here.

Free and open software has a slightly indirect mechanism for dealing with software of low quality. It gives people the freedom to fix the problems themselves, pay for someone else to fix it, or to get their data out and use other software. In other words, freedom creates choices and markets- which allow and encourage quality to happen. Given that free software originates in one man’s quest to improve the quality of his printer, this side effect of freedom shouldn’t be too surprising.

It is a good thing that better quality software happens as a pleasant side effect of freedom, because quality is really hard to define, and anything which is hard to define is almost impossible to mandate. One man’s bug is often another man’s feature, so even though we’d all agree that less buggy software is good, it’d be pretty hard to write a free software license that says “you can modify this software, as long as you don’t introduce new bugs.” Under such a license, who would decide if the new version of the software was buggier or not, and hence whether or not it was acceptable? Hard to picture that working, especially as standards change over time. Instead, we’ve put our faith in the choices of autonomous individuals. This has created incentives to create some pretty high quality software despite the noticeable lack of licenses or philosophies that mandate quality.

Privacy is (to me) remarkably similar to software quality. Defining privacy is hard- like pornography, we know it when we see it, but usually can’t explain it. Valuing privacy properly is also hard- can you articulate when you are willing to compromise it, and for what reasons? And valuing and defining privacy consistently is nearly impossible- Europeans tend to give very different answers to these questions than Americans, for example, and teens give very different answer than adults. Given all that, it would be very difficult, if not impossible, to mandate privacy in a statement like the Franklin Street Statement, or in a license- whose definition would you use? when could it be compromised? etc.

The good news is that I don’t think we have to mandate privacy for good privacy to happen, just like Richard Stallman didn’t need to mandate quality in order to create high quality software. Services which respect user autonomy could ’solve’ the privacy problem the same way autonomy-protecting software has solved the quality problem- by giving users the right to fix problems or use different software, rather than by mandating specific standards or approaches. Don’t like your DiSo provider’s privacy policy? Move to a different DiSo provider, or start your own; soon enough there will be a variety of DiSo providers with varying privacy standards you can choose from.

It isn’t guaranteed that this will work, of course. People who feel locked in by network effects (like facebook users) might not have true autonomy in the way an emacs user does. And privacy may be different than quality, since a single crash is temporary but a personal data leak may be forever. So this issue could easily merit more discussion. But until then, trusting in the cumulative effect of personal choice seems like the most reasonable starting approach to the complex and thorny problem of privacy in networked services.

Luis is a law student at Columbia Law School; a director of the GNOME Foundation; a member of OSI’s legal advisory board; and many other hats. He wrote this at 2am, so cut him some slack .