Looking Through the Hype of Scoble and Plaxo’s Facebook Conundrum

We've said it before, and we'll say it again: You should be able to control your data. And your data isn't just the words you write, or the photos you take, but the relationships and connections you make online.

There's been a debate over these ideas for years now, and the new year has been greeted by a variation on the conversation about data privacy and ownership. This time, it's been prompted by well-known blogger Robert Scoble's Facebook account being shut down, at least temporarily, due to his use of an application designed to connect his Facebook friends with his address book by programatically extracting his personal relationship information from Facebook. The application is a still-in-development feature from the folks at Plaxo, who have been working a great deal on open data portability through their efforts around the Plaxo Pulse service. In the course of extracting this information, Plaxo's development version of their script caused an unusually high amount of activity on Scoble's account, and may have violated Facebook's terms of service about using automated scripts to retrieve data from the service.

With the basic facts out of the way, a few important points are worth highlighting:

• The issue here isn't about Facebook or Plaxo -- we've talked to lots of people at both companies over the years, and they generally want to do the right thing, if possible. The issue is how we make it possible for all of us to control our own data while maintaining privacy.
• There is often a tension between best practices around privacy/security and the ability to make data portable, even one's own data.
• Most average people don't (yet) know that they even want to have data portability -- though they are taking advantage of portability daily when they find their friends by importing their address book.
• It is hard to focus on issues like usability and user experience when everyone is still figuring out ways to make data portable.
• The privacy issues surrounding your friends’ data still aren't clear. Even if you can manually write down their email address, does that give you the right to programatically export it into another service?

From those points, you can figure out some really specific examples of why things are so broken right now. For example, Facebook is screwed either way -- if they keep their current policy of prohibiting third-party scripts from bulk-extracting this kind of data, they'll get beaten up for being too closed and proprietary. But if they allow these types of scripts, they are just as likely to get beaten up on privacy grounds, for permitting or encouraging you to enter your login and password information on third-party sites. Either way, it's an ugly headline, and neither scenario serves users well.

Plaxo's in a bind, too -- this is a great feature, since it makes their Pulse service more valuable and makes their users happy. But having to hang on to a bunch of people's Facebook passwords is a liability, and means having the burden of a big responsibility that just sucks time away from interesting things like adding new features. And Plaxo's feature relies on scraping data, which isn't just against the Facebook terms of service, but is the Wrong Way of doing the Right Thing.

But just like OpenSocial isn't about Google or Facebook, the debate over personal relationship data isn't about Facebook or Plaxo, it's about giving you more control over your information.

First-Hand Experience

We've been through this a bit ourselves and put a lot of thought into it. For example, on Vox, we recently added the ability to invite or search for your friends using your email address book. Lots of other services do this, and we could have only done what everybody did and said "throw your Hotmail or Gmail password in here and we'll do the rest"; and that option is there. But, for example, your Google account, which connects to your Gmail address book, can also be connected to your bank account through Google Checkout, or even your social security number through an AdSense account. So, that latest social network you tried out because it got linked on TechCrunch? You might have trusted them to not grab your entire identity -- hope you read the security policy!

Now, our security policies are sound -- we don't store your login information at all and use SSL when you give it to us. And fortunately, we've been in business long enough that people can judge our track record on privacy policies. But we also wanted to come up with the ideal solution: A way to let you import your address book without giving away your passwords. The super high-tech solution we settled on? Plain old CSV files. CSV stands for comma-separated values, and it's the most basic, stupid-simple way of exchanging things like address lists. Now you can easily export stuff that way from Outlook or Gmail or Yahoo or almost anything else without having to give us any of your login information. It's just another example of how thinking through the little details makes it easier to do the right thing.

In the future, though, simple formats like CSV just might not be good enough. As we said when we launched the relationship update stream, we believe that most sites want to do the right thing ‚there just haven't been tools available to make that possible. So in the future, reusing existing open formats like FOAF, XFN, OPML, APML, and hCard, along with open protocols like OpenID and OAuth, will make it easy for all of us to take our data, and our friends, with us wherever we go. This is why we're so excited to participate in efforts like DataPortability.org and see Google, Plaxo, and Facebook join the effort too. That said, follow through is extremely important.

For Next Time

There will inevitably be another recycling of this conversation in the future. Don't let the usual suspects turn it into a "this company vs. that company" story -- whether it's us at Six Apart or the people at Google or Facebook or Microsoft or anywhere else, the companies are not what matters. What matters is that there are some great new things we'll all be able to do on the web once all of the services we use let us control our own information.