Facebook’s the subject of Jason Calacanis’ wrath at the moment. The tech pundit and occasional prankster (fake iPad review, anyone?) says he just fired off a heated email to Facebook’s execs, and promoted it with a widely publicized blog, alleging it’s possible to “force join” someone to a pedophile support group. It’s a hoax.
Update: Oh the joys of the Internets! The matter is apparently much more twisty than it seemed to be (the thrust of this original article was wrong). As noted by commenters, and a boisterous online debate, there is
a way that Facebook’s Groups settings let someone you know–a friend
within Facebook’s network–can join you to a Group they’re a member of,
with all the ancillary fuss and nonsense and ongoing complications (i.e.
pesky emails, if your Facebook settings are primed that way) that can
thus occur. The groups upgrade had not yet wormed its way onto the
accounts of anyone here at the time we first wrote this story.
the chap that signed him up in the story in question – there still isn’t
any kind of official NAMBLA group on Facebook. And while Calacanis
noted he wasn’t alerted to the fact, he could’ve been had he ticked the
right box in settings so that Facebook emailed him about this sort of
activity (and he could have then unsubscribed). A reminder that one
should vet your Facebook privacy settings when the service makes big
But, yes, there is a way through Facebook’s new Groups system for things to be a little evil. It’s part of Zuckerberg’s continuous drive to make everything public, and probably should not have been a surprise, given how suspicious I’ve been of Facebook in the past.
Here’s the letter Calacanis says he sent to Mark Zuckerberg and Sheryl Sandberg early this morning:
Seems as if anyone can add anyone to a Facebook Group.
There is no “opt in.”
In this case someone added Mike Arrington and I to the “NABLA” groupon Facebook. I know I’m not a member of NAMBLA, and I’m going to guess that Mike isn’t either.
That’s the heated bit, augmented by a comment saying that he’s now a member of a group that’s “very bad”—the North American Man/Boy Love Association–without being asked to join, and was never informed that he was “force-joined” as he calls it. There’s a slightly defusing parting quip that next time Facebook changes things they could check with Calacanis first, as he can probably save them from “a couple of privacy law suits each year.”
The NAMBLA group page, shown in the image, certainly appears to show Calacanis was “joined” to the group by admin Jon Fisher.
Here’s the thing: Facebook famously began purging NAMBLA pages last month. Never mind the technological savvy it would take for the scrappy group to so efficiently target tech gurus Calcanis and Arrington.
Also, after looking into Facebook Groups, even with its purportedly more user-friendly setup, there’s no mechanism to “force join” someone. You can set up a group, open, closed or even secret, and the only way to get new members is to fire off an invite to them, either via Facebook’s own network or to their extra-Facebook email address. The invitee then has an opportunity to reflect on the invite, and choose whether or not they want to join—it’s 100% opt-in.
We’ve been investigating the setup this morning and there may be one way, suggested by a programming expert we’ve contacted, that this thing could’ve worked: It’s a kind of hack, similar to form-based hacks that’ve been around for ages, where a user is sent a form that’s masquerading as something else. When they click the link, they’re signalling to Facebook that they’re actually accepting membership of the Group. But it’s a longshot, and Facebook’s likely to have been on top of this sort of security loophole.
We’ve asked Calcanis, a typically outspoken guy, to clarify all this. He hasn’t responded.
To keep up with this news, follow me, Kit Eaton, on Twitter.