UK police force's Facebook app raises privacy concerns

Last week, Greater Manchester Police became the first U.K. police force to establish a presence on Facebook. According to one privacy advocate, it is a move that raises significant privacy issues.

Greater Manchester Police established an application called GMP Updates on Facebook, providing users with crime news, appeals and missing-persons stories.

Individual stories can be shared with a user's contacts and users can add comments to the feed. The application also links users to an external Web site where they can anonymously submit information on crimes or view YouTube videos related to ongoing investigations.

Greater Manchester Police has estimated that seven million Facebook users reside in the United Kingdom. Within a day of launch, 750 people had added the application, the police force said.

"Greater Manchester Police is proud to be the first force in the country to use this new technology, and it demonstrates our commitment to exploring all avenues available to us to help fight and detect crime," said assistant chief constable Rob Taylor, in a statement.

Greater Manchester Police pitched the tool as a way of helping raise public awareness about crimes, and encouraging users to submit relevant information.

However, Guilherme Roschke, a fellow at the Electronic Privacy Information Center (EPIC), said users who add the application to their Facebook profile may be sharing more information about themselves with the police than they realize.

In a research note, Roschke pointed out that Facebook applications have access to far more information than ordinary users do.

According to Facebook's "platform application terms of use", when a user adds an application, that application gets access to a long list of different types of "Facebook site information", which could include political views, relationship interests, copies of photos in Facebook photo albums, a list of user IDs mapped to Facebook contacts, a social timeline, name, birthday, gender, current location and other information.

Applications can access this data even if it's been marked as not viewable via Facebook networks such as those relating to geographic area or education, Roschke noted. Photos are viewable by applications even if users have restricted which of their contacts can see the photos.

"Law enforcement use of applications will significantly expand the reach of what law enforcement can see, and also provides a more surreptitious viewing ability," Roschke wrote.

He pointed out that applications such as the GMP Updates can, by default, see what the user sees on Facebook, including information about contacts. Contacts can opt out of this sharing but, by default, it includes information such as education history, work history, profile status, photos, groups and relationship status.

"It's not enough to carefully tune your privacy vis-a-vis other Facebook users. You also have to avoid adding in applications like the GMP Updates," Roschke wrote.