Facebook accidentally outed users to their parents through group permissions loophole
Facebook users have been inadvertently outed by a loophole in the system of being added to a discussion group by a friend, which overrode their privacy settings and shared information about them.
The Wall Street Journal reported the story of two Facebook users who were outed to their friends and family after being added to a group by the president of a gay choir they had joined, who did not realise it would bypass their privacy settings.
Bobbi Duncan, 22, and Taylor McCormick, 21, both of the University of Texas were added to the discussion group for the Queer Chorus, which was set to “open”, resulting in a note being posted to all of their Facebook friends saying they had joined.
The problem lay in the fact that any Facebook user can be added to a group by a friend, without them having to first approve it.
Both Mr McCormick and Ms Duncan had previously used the privacy settings on the social networking site to ensure their parents did not see all of their activities.
They had been asked by the president of the choir, Christopher Acosta, whether they were part of the discussion group, but did not hesitate to tell him they were not.
“Once I had my Facebook settings set, I knew — or thought I knew — there wasn’t any problem,” Bobbi Duncan said.
She came out to her best friend in 2011, but thought she had prevented any information regarding her sexuality from reaching her father.
Her father left her angry voicemails, and said that she should give up being gay, threatening he would cut family ties.
Ms Duncan said, on her father’s reaction to seeing she had been added to the discussion group: “I felt like someone had hit me in the stomach with a bat,” she said.
Taylor McCormick, a trainee pharmacist, said he had come out to his mother in July 2011, but had used “privacy lockdown” to ensure that his father did not find out. He said:
“We have the one big secret when we’re young,” he says. “I knew not everyone was going to be accepting.”
His mother called him the night the post appeared on Facebook and he recalled what she said: “She said, ‘S— has hit the fan . . . Your dad has found out.’ I asked how,” he said, “and she said it was all over Facebook.”
Facebook has three options for discussion groups: “secret”, meaning only members can see the group, “closed”, which non-members can see, but can’t see posts, and “open”, which every user can see.
Mr Acosta, the former president of the choir, said he felt partly responsible for what Mr McCormick and Ms Duncan had faced.
“This is a great place to find yourself as a queer person,” he said. “I was so gung-ho about the chorus being unashamedly loud and proud,” he said on choosing “open” as the option for the choir discussion group.
Facebook has had increasingly complex privacy settings, however it is still not possible for users to have to approve before being added to an “open” group.
“Our hearts go out to these young people,” says Facebook spokesman Andrew Noyes. “Their unfortunate experience reminds us that we must continue our work to empower and educate users about our robust privacy controls.”
Facebook routinely shuts down duplicate accounts, which means that holding a separate account for family and close friends would not be an option. The site says that its commitment to real names, and single accounts makes it safer for users.
Ms Duncan’s father posted on his Facebook page, two days after the incident: “To all you queers. Go back to your holes and wait for GOD,” Ms. Duncan said. “Hell awaits you pervert. Good luck singing there.”
At the time he had threatened to stop paying her car insurance, had told her to renounce being gay, and to leave the choir. She remained in contact with her mother, but had failed to cease the conflict with her father.
Mr McCormick and his father had discussed his sexuality, and his Facebook page displayed “interested in: men”. Both students remained members of Queer Chorus.
