Case Studies
Office of the Privacy Commissioner: Investigate Facebook Mobile privacy and security
Project: Analyze Facebook privacy and security when accessing from mobile devices
Technologies: Facebook API, Blackberry, iPhone, Windows Mobile, HTTP, cookies
Services: Expert Analysis
Domains: Social Networking Web Development, Mobile Development, Security, Privacy
THE SITUATION The Office of the Privacy Commissioner of Canada (OPC) received a formal complaint (http://www.cippic.ca/uploads/CIPPICFacebookComplaint_29May08.pdf) alleging that Facebook violated Canadian privacy law. Faced with a mandate to respond publicly to the complaint with a high degree of technical analysis to support its response, Macadamian's expert services were sought out.
THE SOLUTION Within 3 weeks, Macadamian Chief Architect Francis Beaudet reported to the OPC with a formal document and presentation on Facebook privacy, security, and session management. The presentation focused on how Facebook compared to recommended standards, industry-standard web sites well as other modern social networking web sites.
To address the aspect of Facebook usage from mobile devices, advanced monitoring techniques were used to analyze network packets sent over cellular networks to Facebook.
THE RESULTS Macadamian's expert report provided the technical explanations, analysis, and references needed by the OPC to respond to the complaint with a high degree of confidence. A second part of Macadamian's report provided further insight into modern session management and security when accessing web sites from a mobile device, as a future reference for the OPC staff.
During the investigation, Macadamian also reported several Facebook bugs related to session management and security to the Facebook development team, some of which have been resolved. As such the OPC was also able to add in its response that Facebook's security had improved since the complaint had been filed.
Ultimately, excerpts of Macadamian's expert report were embedded directly within the OPC official report on Facebook, for reference online by the public.
