In case you missed it, the controversy began on Friday, when the New York Post reported that merchant bank Goldman Sachs was annoyed that Bloomberg reporters were tracking employees’ log-on activities. The matter soon gained steam when BuzzFeed reported that Bloomberg brass had long known about the practice, and with the news that the Fed and Treasury were investigating the situation.

The company stonewalled at first but on Sunday, Bloomberg News editor-in-chief, Matthew Winkler, addressed the situation in detail:

“Our reporters should not have access to any data considered proprietary. I am sorry they did. The error is inexcusable,” wrote Winkler in a blog post. The rest of the post, however, amounted to a pushback; Winkler explained that the practice was nothing new, and that reporters only tracked “mundane” information.

As bad as voicemail hacking?

So what to make of all this? Did Bloomberg engage in sinister “snooping” (one NYU journalism prof has already compared the incident to the infamous phone hacking conducted by News Corp in Britain)? Or is just this a tempest in a teapot egged on by Bloomberg’s competitors in the news media?

The answer is somewhere in between. On one hand, Bloomberg reporters didn’t do anything approaching the UK scandal — monitoring bankers’ log-in activities is nothing like breaking into a dead girl’s voicemail. Moreover, the Bloomberg “tracking” appears to have done little more than confirm if someone still worked at a certain company. As a source told BuzzFeed’s Peter Lauria, “LinkedIn Pro is more useful and has better information for finding sources and helping to break news.”

All this suggests that some of the the fuss is not about what Bloomberg reporters actually did, but instead is tied to secretive nature of the company itself. This is reflected in a Quartz report that characterizes Bloomberg as “a black box” and portrays a data-obsessed, almost cult-like corporate culture.

News and power of the platform

On the other hand, the Bloomberg episode does raise ethical concerns over how proprietary platforms — including not just Bloomberg but also LinkedIn or Facebook — should handle customer data for news purposes.

The issue isn’t just academic. More and more, platforms are relying on news (think of “LinkedIn Today”) to keep users on their sites. And, as Bloomberg journalists know, customers’ activities on those platforms can be a source of news — and better yet, a source of exclusive news.

The question is where this all this should stop. Would you like reporters to know when you suspend newspaper to go on vacation? Probably not. Would you like your cell phone carrier to use the location of your calls as a source of news? Definitely not. The Bloomberg episode, therefore, appears to be less of a snooping scandal than it is a cautionary tale about what can happen when the line between a company’s news and data gathering operations get blurred.

Not content with sticking two fingers up at the authorities with his Mega secure cloud storage service, larger-than-life entrepreneur Kim Dotcom is planning to release further privacy-centric services. And interestingly, in a Q&A session with the New Zealand Herald late last night, Dotcom said he intended the secure email and instant messaging services to be both military-grade and so easy to use that the user wouldn’t have to do anything to benefit from this security.

This is always the issue with security – if it requires much thought on the user’s part, it will generally fail. Dotcom, who also released a white paper on Tuesday to accuse the U.S. government of misleading New Zealand authorities while pursuing the German-born millionaire, said in the session that he wanted to “provide tools that give our users their privacy back”:

“We are working on encrypted email, IM, etc. The key to make encryption a global success is ease of use. So I am spending most of my time figuring out how I can give you encryption without you having to do anything and at the same time give you military grade privacy. You are all naked on the Internet. I like to help you put some pants on :-)”

It remains unclear what Mega is planning, technologically speaking, to achieve this kind of friction-free encryption. There are plenty of tools out there for sending encrypted emails and messages, but they tend to involve browser extensions or web forms, or paid subscriptions.

Mega’s cloud storage service has also come in for criticism by some security experts, who have pointed out that its use of so-called “convergent encryption” (in order to allow de-duplication) theoretically leaves a trace of who uploaded which file.

That extradition thing

Of course, Dotcom’s plans hinge somewhat on the ongoing extradition proceedings that he faces. The U.S. had Dotcom and some of his associates raided and arrested at the start of 2012 over allegations of copyright infringement, to do with their highly popular (and now deceased) Megaupload file-sharing service, and wants them sent over to face charges.

Since then, the case has occasionally veered into farce, with the New Zealand prime minister having to apologize for the country’s security services illegally spying on Dotcom, and a judge having to step down from the proceedings after describing the U.S. as “the enemy”.

All the while, Dotcom has maintained that Hollywood lobbyists were behind the raid and arrests. He reiterated and expanded upon these claims in the white paper released on Tuesday, verbosely entitled “Megaupload, the Copyright Lobby and the Future of Digital Rights: The United States vs You (and Kim Dotcom).”

The document highlights ties between U.S. vice president Joe Biden and Chris Dodd, the head of the Motion Picture Association of America (the MPAA, Dotcom’s bête noir), describing the whole affair as a “contract prosecution” linked to campaign contributions. It calls on the U.S. House Committee on Oversight and Government Reform and the Office of Professional Responsibility of the U.S. Department of Justice to “conduct an investigation and hearings into the conduct of the Megaupload prosecution by the U.S. Department of Justice.”

Disconnect.me is one example. Launched in 2010 by a former Google engineer, the company provides “Facebook Disconnect” and other tools to stop the “Like” button and other widgets from siphoning data about your web browsing habits. On Monday, Disconnect launched a major update that not only provides a better picture of which companies want to track you, but also improves web speed.

Disconnect 2: what it is, how it works

In 2010, Google engineer Brian Kennish created a popular extension for the Chromse browser that stopped Facebook tracking. Soon after, feeling conflicted about working for a major data collector, he left Google to work on privacy issues full-time. He formed the company Disconnect along with consumer rights’ attorney Casey Oppenheim and another Googler.

The team’s first move was to replicate the features of Facebook Disconnect and use them to shut out other data-collecting platforms like Google, Twitter and Yahoo. Kennish made these companies his target because their widgets appear on many of the most popular websites on the internet: sites that offer information about health or news or weather. These widgets, which invite a reader to “like” or “share,” also act as backdoor portals that disclose what you’re viewing to advertising and analytic companies. For instance, the social media companies help ad firms learn when when you visit sites like “6 Things I wish I knew about Cancer.”

Now, the company has unveiled Disconnect 2, which Kennish describes as the tool he wanted to build all along. In a phone interview, he and Oppenheim explained that the new version is meant to embody three goals: privacy, speed and “don’t break the internet.” The company says this last goal means that Disconnect’s filtering tools won’t interrupt or interfere with a user’s ordinary browsing experience — even as it screens out more than 2,000 of the biggest data-collecting sites.

Disconnect 2, which you can install on your Chrome or Safari browser, also has a new look that provides much more information at a glance than the previous version. The icon sits in the top right of the browser; here’s what you see when you click on it:

The three letters at the top, which represent Facebook, Google and Twitter, are displayed separately because their tracking tools are found on so many websites. The user can also see the number of other tracking sites broken down by category. The drop-down arrows provide specific information about those other tracking sites. Meanwhile, hovering over the bars at the bottom shows how much faster the page loads without all the tracking tools (in this case, 28 percent) as well as how much less data is being consumed:

Finally, users can also pull up an image of just which companies trying to track them on a given webpage. If you click “Visualize page,” this is what you see:

The above image shows that BuzzFeed is one of the dozens of sites, including advertisers, data firms and analytics companies, that request information when I visit the Huffington Post (I don’t mean to single out either BuzzFeed or HuffPo — a similar graphic appears if you visit Reuters, ESPN, Weather.com or nearly any other well-known site — including GigaOM).

What Disconnect 2 means for users, publishers and advertisers

The new version of Disconnect should be a hit with privacy-craving internet users, who will welcome the opportunity to throw up a bigger shield between their social media identities and companies that want their data. The faster, less-cluttered browsing experience is also appealing. Publishers and advertisers, however, will not be giving Kennish and crew a high-five anytime soon.

That’s because, in addition to cutting off tracking sites, Disconnect 2 also strips out many of the ads that appear on a website (I visited Drudge Report, for instance, and the prime top-of-the-page ad had vanished). This is hardly good news for publishers navigating an already challenging ad economy. Advertisers too will be unimpressed since the data Disconnect is unplugging is the lifeblood of popular “retargeting” campaigns.

On the other hand, publishers and advertisers can take comfort in the fact that only a relative handful of users are sophisticated enough to understand the tracking issue in the first place — let alone download a special browser extension to stop it. According to the company, there are one million active users a week for the original Disconnect. While advertisers may fear a future surge in the tool’s popularity, that number alone will not have them quaking in their boots.

Disconnect 2: no match for the movement to mobile

While Disconnect 2 has the potential to throw a wrench into the advertising operations of Facebook and Google, it’s also unlikely to check the larger erosion of privacy taking place all around us. The reason for this is not because Disconnect 2 is an esoteric product. The problem is instead that its arrival coincides with a major shift in how we explore the internet.

Today, the most serious threat to our privacy is not the screen on our desk but the one in our pocket. Our smartphones are not just little computers — they are also GPS tracking devices that record our every movement and many our thoughts. Consumers happily enable this process with toys that blare their location like Foursquare and Facebook. And the trend is only accelerating (see Om’s trenchant thoughts in ”Why Facebook Home bothers me“).

In the face of this voluntary surrender of our location and habits, does Disconnect’s attempt to staunch the tide of desktop data even matter? It can certainly help, of course. At a time when Facebook is collecting not just our online habits but our offline ones too (the company is now partnering with retailers like drug stores), any tool that will deprive them of data will be a comfort to privacy advocates. Overall, though, Disconnect is unlikely to be a game changer.

Kennish appears to recognize this. In our phone interview, he said the company is at work on tools to limit the spread of data from mobile devices. He also stresses that one of Disconnect’s primary goals is education and awareness. By distributing a tool that helps average people understand how their data is collected, the company can help build a critical mass aware of what is happening and what is at stake.

Finally, here’s a video in which the company explains Disconnect 2 in its own words:

Correction: This story was amended at 3pm on Monday to state that the original version of Disconnect has 1 million active users, not 1 million downloads.

(Image by  Sergey Nivens via Shutterstock)

Two months later, what’s the fallout? Well, nothing. Instagram’s new rules went in place in January and the site appears popular as ever (based on my own experience and Facebook’s optimism on a recent earnings call).  Meanwhile, Instagram this week issued a stinging rebuke to Lucy Funes, the California woman who is leading a class action suit against it.

In a filing to dismiss the suit, Instagram’s lawyers said the case was based on “wrongheaded, even frivolous, legal theories.” The document, reported by Reuters, added that Funes’ alleged injury was “self-inflicted” and pointed to “her failure to take the self-help measure of deleting her account.” (our emphasis)

The comments are harsh but also fair. Instagram, and every other social media company, is right when it points out that no one is forcing people to use their service and that, if you don’t like their rules, you can just leave. Instagram notes that Funes is still using the service.

This take-it-or-leave-it approach may be exasperating to consumers who feel powerless as Facebook and others turn them into product pitchmen (Instagram will follow suit soon enough). But for now, the licenses these companies impose ensure the law is on their side and, as long as people don’t pay for sites like Gmail and Twitter, advertising is the only option that will sustain them.

Unfortunately, companies that do try to be transparent about their advertising intentions are likely to be punished for their efforts. As Verge reporter and former copyright lawyer Nilay Patel explained in December, the controversy over Instagram only creates an incentive for companies to be obtuse or sneaky about their terms of service in the future.

This doesn’t mean, of course, that everything is okay. Instagram and the other companies do pose serious threats to our privacy, data and dignity. But until there is a system in which consumers have an option to pay these companies to leave us alone (would you pay $5 a month for ad-free Facebook? — I might), this is the world we’re stuck with.

The Instagram episode ultimately reflects a familiar pattern of hysteria, resignation and forgetting. There will be other examples soon enough.

Why am I part of a Facebook class action in the first place?

The social network got sued for using you as a product pitchmen for “Sponsored Stories” without your permission. For instance, if I “Liked” Justin Bieber’s page, my Facebook friends might have seen a big ad saying “Jeff likes Beeb’s new eyeliner.” Today, Facebook can still do that because it changed its privacy terms — it’s the earlier ads it’s on the hook for.

How do I collect?

Go to the settlement page and fill out the claim form by May 2.

So how much will I get?

Facebook is paying $20 million all-in to make this go away. Under a revised deal (the judge rejected the first one), Facebook users are eligible for up to $10 each — so long as there’s enough money to go around.

Oh, and that $20 million isn’t just for Facebook users. The lawyers are asking for nearly $8 million. Then there are people like the “escrow agent” and the “settlement administrator” who get a cut too. If the judge okays all this, it will be more like $10 to $12 million to go around.

To look at it another way, if there is $12 million left after the lawyers, there is enough money left to pay 1.2 million Facebook users.

Well, what if more than 1.2 million people make a claim?

You have to share. If 2 million Facebook users sign up, everyone would get about $6. If 2.4 million sign-up, it’s $5. If more people than that sign up, everyone gets nothing.

So what are my chances to get some money?

There are about 165 million Facebook users in America. If even 2 percent decide to make a claim, you’re likely out of luck.

Well, that doesn’t seem fair. Who gets the money then?

The class action says it’s not very efficient to cut $4.99 checks to everyone. So, if too many people are eligible, they’re just going to give the money to your friends at Harvard, Stanford, Berkeley and the EFF instead. These groups will then use your money to advocate for privacy.

Well, damn it. It was my privacy that was violated — don’t I even get to be involved?

That’s a good question. This keeps happening again and again — Google, Facebook, etc. violate everyone’s privacy and the money from the resulting lawsuit goes to lawyers and a bit of it goes to “charity.”

To be fair, this isn’t as crazy as it sounds. Many of the privacy advocates do good work and the class action lawyers, even if they’re in it for themselves, do keep the tech companies on their toes.

The bigger problem here is that these legal deals don’t do a good job of involving the people who are affected. Nor do they produce solutions such as a “pay-for-privacy” option. Would you pay $5 a month for an ad-free, non-creepy version of Facebook? I might. But the class action settlement doesn’t allow us to raise these sort of options or to ask Facebook directly about what they’re doing.

If I don’t get any money, does any good come out of this lawsuit?

A bit. The settlement claims it will force Facebook to create a tool to see which products you’re endorsing and to remove your endorsements. But we’ll have to see if this tool will be easy to use in practice.

For an example of what this means in practice, look no further than a new Tumblr blog started by London-based programmer Tom Scott, entitled “Actual Facebook Graph Searches.” This also sounds somewhat dry and academic, until you take a closer look at some of the things that Facebook makes it trivially easy to search for — things like “Islamic men interested in men who live in Tehran, Iran” (where homosexuality is a crime punishable by death) or “family members of people who live in China and like Falun Gong,” the latter being a religious group whose members are routinely persecuted.

Many of these searches may be figments of Tom Scott’s over-active imagination (at least for now) but the fact is that Facebook’s graph search makes them relatively easy to conduct. Dave Morin, a former Facebook executive who left to start the mobile social network Path, has pointed out that the company has had this kind of interest-graph powered search for some time — and this kind of targeting based on “likes” and interests, friends and followed pages, etc. has been available in a different form for advertisers. But it is far more robust and more public now.

It’s not about privacy, but the end of obscurity

In a FAQ on the blog, Scott says he’s not trying to make any deep arguments about privacy, and his Tumblr blog is subtitled: “Don’t worry, we’ll all be used to this in a few weeks’ time.” But it’s still worth thinking about the implications of Facebook’s graph search, especially given the fact that many people don’t seem to appreciate the nuances of the network’s privacy settings — something that Facebook doesn’t really make simple or easy to figure out. Even CEO Mark Zuckerberg’s sister Randi was recently blindsided by them, so what chance do the rest of us have?

In a recent piece in The Atlantic, philosophy professor Evan Selinger and his co-author Woodrow Hartzog argued that in many ways it’s not really helpful to talk about privacy, which is a vague concept in a world of real-time information, “frictionless sharing” and “data exhaust” (the information we give off as we move around the internet, often without realizing it). Instead, they argue that what we are really losing is the protection of obscurity — in the sense that information which was technically public before but difficult to find provided a form of privacy through obscurity:

“Obscurity is created through a combination of factors. Being invisible to search engines increases obscurity. So does using privacy settings and pseudonyms. Disclosing information in coded ways that only a limited audience will grasp enhances obscurity, too. Since few online disclosures are truly confidential or highly publicized, the lion’s share of communication on the social web falls along the expansive continuum of obscurity: a range that runs from completely hidden to totally obvious.”

As Selinger notes, the recent publication of a map of New York state’s registered gun owners made much the same point as Scott’s examples of disturbing Facebook graph searches. The information about who has a gun permit was public by default in New York when the map was published (although a new law has been proposed that would make it private) but it was difficult to collect and so hardly anyone bothered. Other kinds of information are also technically public — government databases and so on — but difficult or impossible to extract useful data from.

Clicks you may not even remember are being analyzed

Of course, the same thing was the case with much of the world’s information before Google came along, and we had to learn to adjust to the fact “the internet never forgets,” and that the information you posted online years ago (or information that was posted about you by others) without really thinking of the consequences can come back to haunt you. But Facebook has taken that to a whole new level of intimacy because much of what occurs there seems so ephemeral: a “like,” a follow, a click — things you might not even remember doing.

While they may seem ephemeral, each of these can be as permanent as anything else on the internet, and just as public, unless you can master the intricacies of what Facebook lets you hide and what it doesn’t (and as Scott notes in his FAQ, you probably shouldn’t rely on that anyway). As Megan Garber of The Atlantic points out in a post, the social network is essentially constructing a virtual version of you out of all those signals — a version that is categorized by all of your activities and interests, some of which may be harmless and some of which may not.

It may seem absurd that someone might say they “like” racism, or that anyone would actually search for that behavior and make use of it somehow. But if we have learned anything from the era of big data, it is that if the information is available — as dirty or questionable as it might be — someone is going to make use of it, and not always in the way you would like them to.

Post and thumbnail images courtesy of Flickr user Alan Cleaver and Tom Scott

What this means in practice is that authorities in the United States and other countries are regularly demanding that Google hand over the keys to user accounts like Gmail or YouTube. In many cases, the government may have a legitimate reason to ask for such information, such as solving a crime or stopping a spying operation.

Other times, though, governments may simply be fishing for data in a way that flouts citizens’ right to privacy. Such fishing expeditions, unfortunately, are relatively easy in the U.S. thanks to the sprawl of so-called administrative subpoenas — a legal tool that lets agencies demand data without first proving to a judge that they have a right to get it. Google’s new stats, which for the first time break out the procedures U.S. governments used to gain information, show that 68 percent of all requests came by way of such subpoenas while only 22 precent came by way of search warrants. Here’s Google’s graphic:

The new stats not only highlight the nature of the modern surveillance society but also strengthen the case for updating the Electronic Communications Privacy Act, a 1986 law that sets out rules for how governments can collect personal information. Influential Senator Patrick Leahy (D-Vt), who chairs the Judiciary Committee, this week declared that reforming ECPA for the age of cloud computing is one of his top priorities.

So Facebook, where’s your report?

In releasing its findings, Google called on other companies and governments to “join us in this effort by releasing similar kinds of data.” Google has made similar appeals in the past but, so far, the only company to offer a report of its own is Twitter which last year published its first Transparency Report to coincide with Independence Day.

Facebook, however, has been conspicuously silent about government demands for data. In recent years, the social network has become a honeypot for federal agencies and other law enforcement powers that want to tap into the vast troves of information Facebook holds about users and their friends. While the government snooping is not Facebook’s fault (the company, after all, must comply with the law), it does raise the question of whether the company should join Google and Twitter in taking a more stance on raising civil liberties issues.

In response to a question about whether Facebook will produce a Transparency Report of its own, a spokesman provided the following statement:

We do not have any immediate plans to release a report, however, we have been working diligently on meaningful transparency such as the Law Enforcement Guidelines in the Help Center and our work with the Digital Due Process coalition to ensure the privacy of our users. While we will continue to evaluate our plans in this area, we devote our primary efforts to auditing every request we receive to ensure the strictest compliance with law. You can find out more here - http://on.fb.me/LEGuidelines

As detailed by BuzzFeed, the problem started late Christmas evening, when Vox Media staffer Callie Schweitzer shared a funny photo on Twitter of the Zuckerberg family using the social network’s new Poke feature — an app that allows users to send messages or photos that self-destruct after a certain amount of time (a feature that itself can be seen as a response to privacy concerns). Randi Zuckerberg saw the photo because she was mentioned in the tweet, which has since been deleted, and told Schweitzer that sharing it publicly on Twitter was “way uncool.”

Schweitzer apologized, and said she believed the picture was public because it showed up in her feed, and that she sees Zuckerberg’s updates because she signed up for them via Facebook’s Twitter-style “subscribe” feature. After some back-and-forth, Zuckerberg determined that the Vox staffer saw the photo because she is connected to a mutual friend — a friend who tagged Zuckerberg in the photo, and thereby shared it with her entire social graph. Zuckerberg then shared what she felt was the lesson we should all take from this incident, namely: “always ask permission before posting a friend’s photo publicly.”

It would be nice if figuring out online privacy was that simple, but it isn’t — not by a long shot. And it’s not just Facebook, although it is the most obvious example of this problem, if only because it is so massive that virtually everyone is either using it or knows someone who is. It’s tempting to think of this as just another sign of how Facebook is an evil social overlord, deliberately tweaking privacy settings so that it can sell our private details to the highest bidder, but that’s a little too facile.

Privacy becomes infinitely more complex online

The reality is that privacy issues we normally take for granted in the “real” world become almost infinitely more complicated when we move online: if Randi Zuckerberg had taken a physical photo of her family, she could only have shared it with a small group of people — and by definition, those people would be close to her and her family, and so privacy wouldn’t be a problem. But when anyone can “tag” a photo and instantly re-share that photo to an audience of thousands, things get complicated really quickly.

Sure Randy Zuckerberg asked all in her family if she could share that pic before posting. That's just human decency bit.ly/Umu32r

—
Danny Sullivan (@dannysullivan) December 26, 2012

Should Randi have asked before she shared that picture on Facebook? Maybe. But she (perhaps naively) trusted that it would only be seen by close friends and family — not thinking of how a friend’s decision to tag it could affect where and with whom it was shared. Should her friend have asked before she tagged it? Perhaps. I tagged a friend once in a photo and she got upset with me because she didn’t want people to know where she was — not because she was doing anything bad, but because she didn’t like the feeling of being tracked. That never even occurred to me until she mentioned it.

To be fair to Facebook, figuring these kinds of nuances out isn’t easy — and implementing them in the form of software controls isn’t either. Facebook has gotten a lot of flak (much of it from Google) for not allowing people to download the emails of their friends, but it has always argued that those emails belong to your friends, and sharing them should be their choice, not yours. We may disagree, but there are good arguments on either side (Facebook now lets you do this but only if your friend specifically allows it).

There are all kinds of things we need to learn — or re-learn — when it comes to online behavior, and how to handle privacy is one of them. It’s easy to throw rocks at Facebook or make fun of Randi Zuckerberg, but the bigger issue is not going away: if anything, it is getting even more complicated.

In case you missed it, a San Diego law firm this week sought to run to the rescue of Instagram users who are upset that the site will change its terms of service in January. These new terms are meant to help Instagram introduce advertising practices akin to its new parent company, Facebook, which turn users into pitchmen for products.

The lawsuit, which came after weeks of uproar about the maladroit way in which Instagram rolled out the proposed changes, made for good headlines. Too bad, then, the case stands as much chance of success as that petition to deport CNN’s Piers Morgan.

Writing on Eric Goldman’s respected Technology and Marketing Law Blog, Seattle lawyer Venkat Balasubramani described the case as “flimsy,” “borderline frivolous” and “an example of lawsuits against social networks gone completely amok.”

Balasubramani, who tracks social media cases closely, points out that that the revised terms haven’t even gone into effect (meaning that users can simply leave) and that, in any case, Instagram has the right to change its terms of service if it darn well pleases. You can see the full take-down, including Goldman’s view, here.

So why are the good folks at Finkelstein & Krinsk law firm filing this case in the first place? My own hunch is that it’s a way for the firm to get on the radar as part of California’s growing cottage industry of privacy lawsuits. This involves law firms who wait for the latest privacy outrage, and then race each other up the courtroom steps to file a case. Next, they ask for Facebook (or whoever) to pay them as part of a “privacy settlement” which typically compensates lawyers and activists — but not the users whose privacy was breached. In this case, though, the only payout Finkelstein & Krinsk are likely to receive is a clobbering by Facebook’s veteran legal team.

Overall, the Instagram episode is just the latest example of the ritualistic cycle of complacency-outrage-resignation that occurs whenever users discover that websites like Facebook and Google are providing a free service in exchange for advertising data.

(Image by ollyy via Shutterstock)

It’s already been documented that much of the information spreading through mainstream and social media at the time was incorrect, but there was one particular moment that stood out for me: the misidentification of the shooter.

As events unfolded, everybody rushed to find out who the killer was. Law enforcement, confused themselves, appeared to name a New Jersey resident called Ryan Lanza as a possible suspect. And once the media had a name, they did the next natural thing: they turned to Facebook.

Fox News happily splashed the face of Ryan Lanza everywhere that “sources identified Ryan Lanza, 24, as the gunman”. And here’s a tweet that went out to CNN’s 6.7 million followers:

CNN’s @susancandiotti reports the suspect is Ryan Lanza and is in his 20s. The latest on @cnn TV and our live blog: on.cnn.com/WbG4H9

— CNN (@CNN) December 14, 2012

At this point, my stream — like yours, probably — was filled with links to Ryan’s profile page. Suddenly a huge lens was focused on the man’s Facebook presence, and by extension that spread to his contacts. Ryan, meanwhile, protested his innocence as a huge swell of incoming messages. One Redditor said that even Ryan’s friends were receiving “hundreds (literally) of hate-filled messages.”

Except, as we know now, it was not Ryan who had committed the atrocity at Sandy Hook: it was his brother Adam, who had murdered their mother before going to the school and opening fire.

The media had got it all kinds of wrong.

Facebook: the lazy researcher’s dream

Whether or not Ryan Lanza chooses to act against the media organizations, agencies and individuals who misidentified him, I don’t know. He’s probably got a lot to deal with right now: the deaths of two family members, trying to comprehend how or why his brother committed such an appalling crime.

More broadly, though, the incident casts some important light on a problem that’s coming up more and more: the increasing reliance on Facebook as a primary research tool for journalists stuck at their desks.

As Facebook has ballooned, it has become the biggest open identification mechanism in the world. That means it’s also become the first port of call for anyone wanting to get information on somebody — things like personal details and photographs — fast. Scanning somebody’s profile for information is a tool deployed by reporters, editors, bloggers, stalkers and busybodies alike.

Sometimes it’s accurate, important, and revealing… especially when triangulated with other information. But often it’s a crutch for those who are rushing to get information, or who are too lazy to do independent confirmation or research.

There are plenty of other examples of prior art here. Most recently, the Oatmeal’s Matthew Inman went hard at Buzzfeed after it ran an unflattering profile piece that seemed to be built in large part around a fake Facebook profile.

The more Facebook becomes our de facto identity service, the more often this is likely to happen — even if the way we’re using it is wrong, and often wildly irresponsible.

Truth or consequences

The problem is that Facebook isn’t just a photograph, or a name, or a location. It’s a conduit directly into somebody’s life. Once you make people searchable, you make them contactable — and sometimes that can be like standing at the gates of hell. The hate mail, anger and invective that can be directed on an individual online is something nobody should underestimate.

The sort of intensely-focused attention that the media can suddenly dump on somebody’s head can be devastating. You only have to look at the sad suicide of Jacintha Saldana, the nurse who fielded a prank call to the hospital housing the Duchess of Cambridge to see how it’s impossible to predict how somebody will react to being in the eye of the storm.

Sometimes, the way social media smooths the path for big errors can be tackled. In Britain, the case of a politician wrongly implicated by the BBC in a child abuse scandal has led to legal action against those who named him on social media — and reverberated so profoundly that the chief of the BBC resigned over the mistake.

But while people may claim that the internet is self-correcting, others have explained that such a belief is little more than a myth. Errors, even brief ones, can live for a long time — and getting it wrong can have serious consequences.

So what do we do?

In a broader sense, we cannot stop errors from happening — as Mathew said yesterday, it’s just the way the media works now. You can’t stop the police getting the facts wrong, and you can’t stop CNN reporting the wrong name.

But on an individual basis, we can make a difference: by realizing that our actions do have consequences.

Posting somebody’s personal details online is often little more than incitement. Leaving an abusive message on their Facebook page, or tweeting abuse, helps nobody but you. And in cases of mistaken identity like this, your actions can actively make the situation worse.

I don’t know that we’ll ever stop these mistakes. But just because everybody else is doing it, you don’t have an excuse. A mob is formed by individuals — and if you don’t want to be culpable for the mob’s mistakes, then it’s your responsibility not to join in.