Image via Wikipedia

I’m not a Facebook liker of Justin Bieber. I mean, I know he is some teen singer, formerly the most trending topic on Twitter, and OK, I found out he’s Canadian… but I don’t care. I’d never Like him on Facebook. But if I get ‘clickjacked’, all my Facebook friends will think I do. How embarassing!

But, let’s be honest, that’s kid’s stuff… this is the Internet, I could end up sending some terrible, REALLY embarrassing things to all my friends.

Did you click a Like link this week on someone’s web page? Does Facebook say you did, but you don’t remember? You may have been PRANKED! Many Facebook users are becoming victims of the latest social engineering prank, “clickjacking”. And it might get worse.

If it was something like this link on LikeThisThing, eg: http://www.likethisthing.com/getting-drunk/ (Hey- be careful on that page, OK? Click on NOTHING!) then – were you a victim?

The site has no privacy policy and was only set up about a week ago by someone shy enough to hide their identity in their domain registration records. Yet, by using Facebook’s social plugins to allow you to Like “sleep” or “sex” or  “money”, the site developer gets the ability to access your Facebook id and post on your wall. What are they up to? And would you willingly click that Like button? Did you? Seems highly unlikely people would rationally click on several of the phrases on the site… so what’s going on?

What exactly is “clickjacking“? Essentially, it’s a way for a website developer to get you to click on something you never intended to click on, by overlaying a transparent layer on what you thought you were clicking on (usually something a lot more innocent, such as “Click here to continue”).

Why bother? Because the Facebook “Like” button, and many other social plugins such as the voting buttons to the right of this post, are designed as iframes, little web windows from, say, Trueslant.com into Facebook.com or Reddit.com. When you click on the Facebook Share button, you’re interacting with Facebook.com and not True/Slant. If you’re logged in to Facebook, the Share button will generate a Facebook Share. And if someone engineered a page with what looks like a link to a video, or another page, but placed over that link a transparent iframe to Facebook’s Like button, then your action will generate a click to Facebook. Facebook assumes you intended to click “Like” and immediately registers the Like, which you might not be aware of. And Facebook has no way to know you didn’t take that action willingly.

The benefit to the culprits is getting their page exposed to your friends via your wall post; from there, your friends also help spread the attack as they follow the link to the offending website. Combine clickjacking with sketchy sites – such as the one above – and you have viral embarrassment! (And someone has a chuckle, or worse… they trigger a Paypal payment or an Amazon.com purchase)

Part of this problem is Facebook’s attempt to dominate the online world. Placing their Like button on other websites is a big part of it. And that Like button needs to behave, on those sites, just as it behaves on Facebook – by instantly updating, no fancy pop-up dialog to confirm the action. But that removes the one obstacle to clickjacking and is what makes this attack so easy.

If you’re browsing with Firefox and use the popular NoScript plugin, then you will usually be protected from these attempts. You’ll usually get warnings about such clickjacking attempts. (And a few false alarms, because the NoScript software is a bit sensitive). But users of other browsers, including  Internet Explorer and Safari, have (to my knowledge) no similar protection from these “social engineering” attacks. And the attacks might get more harmful than just egg on your face.

The social networking and plugin providing websites – such as Facebook, Digg, and Reddit – will likely need to make changes to how their plugins work. For example, the Facebook Share button always brings up a confirmation dialog, from which you can cancel. But the new Facebook Like button has no such dialog – maybe Facebook needs one? I think it does, even if it changes the user’s experience.

In the meantime, it may be worth putting on a tinfoil hat, and using a browser with some clickjacking protection, to avoid these exploits.

I spent a bit of time looking for suitable comment quotes to illustrate this story… but ended up leaving the really illustrative once on the offending pages.

So, check out the comment threads on Yahoo! Buzz for live evidence that commenter anonymity (screen names and avatars) can create an atmosphere where valid debate and discussion of an issue is overwhelmed by shouting, name calling, and antisocial behavior. I’ve shown some of the tamer comments below:

keep talking Robert, you’re looking dumber by the second…
Does you mommy know you talk naughty online?

Let the right wing nuts jobs be racist in 5…4…3…2…
And let the conspiracies fly…

god – And let the narcissistic, egomaniacal liberals try to antagonize them because it is their sole source of energy in… -Ah, good work.

What makes a particular site’s comments devolve into the cesspools, while other sites (such as True/Slant) are more civil? Is it comment moderation? Curation? User votes up and down? Something else?

Generally, those comment management techniques can certainly help. A commenter is less likely to be the first to be destructive if the comment quality on the post or site is already high, or if low-quality comments are hidden. An online version of  the broken window theory, which states that communities with buildings in disrepair – even one broken window – are more likely to see increasing vandalism; fixing that window can forestall additional smashed windows.

Of course, there are other factors at work. One theory that should be given credence is that online anonymity contributes to delinquency in the same way darkened streetlights make it difficult to recognize vandals and lawbreakers in a city. The use of screen names and avatars, such as those in Yahoo! Buzz, gives each commenter a degree of anonymity, and as a result, commenters may feel that there are few repercussions to what they say. But is that the sole reason for crappy comments? I’m not the first to ponder this topic, nor will I be the last. Mathew Ingram posted a few months back on the anonymous comments debate and includes several links to various points of view.

When I’m asked about comments, I often say that to me, comments and the ability to interact through them are like democracy. Most people support democracy and its various principles, even though in practice it is frequently ugly and brutal and betrays some of the worst elements of humanity for everyone to see (Winston Churchill said that democracy was the worst possible form of government, except for all the others). So it is with comments. And just as anonymity has a broader purpose in a democratic society — whistleblowing, for example (a point Topix CEO Chris Tolles made), and keeping a check on arbitrary authority — I think it has a purpose in comments and online communities as well.

Regardless of your point of view on anonymity, however, a simple fact remains: using a public profile, and one’s real name, tends to make nearly everyone think twice about their comments… resulting in a more civil tone that makes the work of moderating and curating comments much easier.

So using Facebook Connect or oAuth (using Twitter or other social media credentials to log in to a site and present an online identity while on that site) can be very helpful to websites wishing to generate a highly civil, educated commenting atmosphere. It’s not the only tool, and it comes with a few costs (beyond implementation, not everyone has a Facebook or Twitter account, so it can present a barrier to some folks) but it’s certainly worth exploring in any website’s strategies.

But wait – that’s not all. As Salon magazine has pointed out,

The problem is that once an online discussion space gets off to a bad start it’s very hard to change the tone. The early days of any online community are formative. The tone set by early participants provides cues for each new arrival. Your site will attract newcomers based on what they find already in place: people chatting amiably about their lives will draw others like themselves; similarly, people engaging in competitive displays of bile will entice other putdown artists to join the fun.

Don’t wait til after you launch to worry about comments!

True/Slant gives users a choice of registering via Facebook Connect or by creating a unique user name, which doesn’t need to be your real name, but also uses comment curation to elevate the comments that contribute to the discussion.

As True/Slant Contributor Colin Horgan noted,

people – even internet trolls – seek some form of legitimization, even if it’s for a fairly anonymous opinion posted online. Better still that the recognition comes not from fellow commenters, but from the site itself, because then one’s voice is even louder and carries more weight.

The simple act of curation can help encourage the good commenters and act to discourage those who already know their comments will be hidden to most readers.

So real names alone are not the solution… a well-thought-out, comprehensive, and active comment strategy and daily attention to comment threads is just a start.

Facebook’s new Social Graph has enabled new “Like” buttons all over the web, prompting users to click Like on anything from a political blog post to a pair of jeans in the Levi’s store.

Even without doing anything, if you visit one of these Facebook-enabled pages while logged in to Facebook, it will display the names of your friends if they have clicked Like in the past.

In some cases, those Likes allow the site or page admins to post to your news stream. And likes will be visible to your friends, and perhaps the entire world.

Facebook says “If you decide you no longer like something, you can always remove the connection or ‘unlike’ the content on the original site. You’re always in control of the things you connect to or like.”

However, exactly what gets “erased” when you take an action to protect your privacy is still unclear… does the Levi.com site still have the ability to post to my profile? If I remove the like on Facebook, will it go away on Levi.com?

I tested this out recently, and here are my recommendations:

Page Like on Levi.com

Facebook profile after a Page like

There are supposedly multiple ways to “undo” these likes:

1. Locate the Like on your Profile page (Wall tab) and remove it there (is this what Facebook implied by “remove the connection”? Maybe not…)
2. Follow the link on the Like to the original page and dislike there (click Like again)
3. Edit your profile Settings, choose Likes & Interests, and click “Show Other Pages”, then click “Remove Page”, close, and save changes.

However, I’ve discovered that the first option simply removes the Like from your Wall, and does not remove the Like from the Levi.com page or prohibit the page from posting to your wall in the future.

Using the third option is a good way to review which pages you’ve Liked, especially if they are a distant memory and far down your Profile page. Pages you’ve liked do not show up in your list of applications you’ve authorized, even though they are technically authorized applications (since the page admins can post to your news stream). So you’ll need to find them in your Profile | Edit Profile | Likes & Interests to manage them individually.

Facebook's Edit Profile Menu

And it’s still a good idea to revisit the original page (if it still exists) to ensure it has updated.

More Detail

Facebook shares some of the technical details of “what is shared with the third party site” in a blog post, but they do note these likes are going to be accessible to other websites and applications:

While these buttons and boxes appear on other websites, the content populating them comes directly from Facebook. The plugins were designed so that the website you are visiting receives none of this information. These plugins should be seen as an extension of Facebook.

But then…

When a like makes a connection in your profile, you can control who can see that in your Facebook profile by editing your “Friends, Tags and Connections” settings on your Privacy Settings page. Remember that even if you limit the visibility of a connection, it remains as public information and may appear in other places on Facebook.com or be accessed by applications and websites.

So, in other words, don’t rely on your Privacy settings to keep anything private. Everything’s still technically public. The website you visited receives nothing when you click Like, but can find out who you are later by simply querying the Facebook database. You’ll have to totally remove a Like to be sure it’s not accessible to someone you don’t want to see it. Or better, think twice before you click Like in the first place.

One thing you notice immediately is that Facebook has a lot more searches than Twitter. But, look at the difference in news references! Twitter has seen long periods of time where it gets more media coverage than Facebook, which shows how out of touch the media is with what’s really interesting to the public. To give you some idea, MySpace is still more popular than Twitter, but good luck trying to find someone covering that.

But, it’s not just searches on Twitter. If you look at their Compete.com numbers, you’ll see Facebook gets almost 6 times as many unique visitors and almost 20 times as many visits.

FarmVille > Twitter

If you haven’t started to rethink the power of Twitter, then here’s something that should get you thinking. FarmVille, an MMO game on Facebook, has more active users by itself than Twitter has members. Check it out:

Looking at FarmVille’s info box on their main app page, we can see they have over 83 million active users. Active, not total installs!

By contrast, RJ Metrics reports that Twitter had only 75 million cumulative users by January of 2010, as seen in the graph below.

They also report that Twitter is adding less and less users every month, which is represented with the graph below:

That would make Twitter’s current user base today somewhere over 80 millions users, giving FarmVille the slight edge.

MMOs > Status Updates

The biggest take-away from this is not just that Facebook is bigger than Twitter, but that the interactivity made possible by the robust platform that is Facebook enables things like an MMO such as FarmVille to be bigger than Twitter. Now, don’t get me wrong, I love Twitter! We just need to keep it in perspective, so we don’t act like media sheep giving Twitter more attention than it deserves.

If you really want to have your mind blown, watch the video from Jesse Schelle who first tipped me off that FarmVille was bigger than Twitter. He goes onto share a vision of where the convergence of gaming, social, and mobile will take us.

This year for the first time in 23 years, Pepsi will not have ads in the Super Bowl telecast. No Cindy Crawford, Britney Spears or Justin Timberlake. Pepsi has chosen to give away over $20 million in a social media play it is calling The Pepsi Refresh Project, debuting in 2010. In Super Bowl ads from 1999 to 2009, Pepsi spent over $142 million to encourage consumers to drink the Pepsi brand. Pepsi’s decision to pull its advertising from the Super Bowl telecast and concentrate on its Social Media strategy to try and create a movement will be the largest and most visible showdown between broadcast media and the Internet to date. Pepsi represents one of the stalwarts, not just of the Super Bowl advertiser lineup, but of broadcast TV in general.

First mover advantage? Not anymore.

As much as the life of a tweet is less than 24 hours, first mover advantage in marketing is getting shorter and shorter. Just today a story was published on New Media Age citing Coke and Unilever will be shifting their digital microsite strategy to social communities like Facebook & YouTube.

Prinz Pinakatt, the Coca-Cola Company’s interactive marketing manager for Europe, said, “In some cases some of our campaigns won’t need a coke.com-hosted site. In most cases these will still exist as it’s the most obvious destination for a consumer, but it might only be a page linking to YouTube encouraging people to join the community there. “We would like to place our activities and brands where people are, rather than dragging them to our platform,” Pinakatt added.

Cheryl Calverley, Unilever UK’s senior global manager for Axe Skin, said, “You’ll see fewer brands creating a site for one campaign and then throwing it away. Certainly we won’t do that at Unilever any more.

Big brands feel the pain of creating a site for a campaign, but what about B2B and medium sized businesses?

Launching a microsite is essentially starting over. Starting over is most-often painful for everyone involved. At Webtrends we did this ourselves and wrote about our experience and learnings:

Not only did we have to design and develop a new site from scratch, but we also had to build an audience for the site. In addition to the start up effort, now we had another property that needed ongoing content. While our corporate blog is a great vehicle for the generation of interest in our company we don’t see a greater value than our corporate blog or webtrends.com.

Being focused on digital measurement we had been observing macro trends and predicting a shift from traditional microsites to social microsites. Pepsi, Coke and Unilever are proof that this microsite evolution is a shift in the way marketers look at their marketing mix.

Ultimately, the pace of evolution will likely be governed by marketers’ ability to capture the metrics associated with these new social momentum models. In order for Social Microsites to overtake their conversion-centric ancestors, they will have to be more effective at capturing direct marketing budgets… which means proving ROI. Certainly an interesting opportunity – and challenge – for those focused on measuring online marketing effectiveness today.

What’s this all leading to?

Investments in traditional digital media (if that isn’t an oxy-moron) is evolving at a rapid pace. Mega brands are now shifting their serious dollars toward social media. The trend of investing in social media is taking root in marketing mixes for the largest brands around the world and displacing traditional digital media, which is inline with Forrester’s report on 50% of marketers planning to increase their spend in social media. And where is that money coming from? They are taking the budgets away from broadcasting and microsites. The multi-million dollar allocations of Coke and Pepsi are the largest spends in social media to date and will propel the space into mainstream. If you are a marketer here is the brass tax:

• An increased focus on measuring social media, it must be a part of your mix.
• You should demand benchmarks like average rate of return for dollars spent (I demand a 5X return).
• Plan for less money spent on web development and media and more money spent on content and engagement management.
• You will not be alone: A stampede of additional brands will be following suit.
• Be prepared for increased regulatory pressure for social media, like the FTC rulings on disclosure.
• Media prices will increase on social sites, which increases the cost of social media advertising. That will help push out scammy ads that are dependent on low prices further legitimizing the ad channel.

The controversy is heating up again with recent announcements from The Huffington Post to offer sponsored content, comments, and even Tweets alongside reader responses demonstrate this new development in the ongoing saga of social media monetization. Marketers can now pay for prime social real estate and, therefore, unprecedented prominence within an online conversation in ways that they couldn’t before.

Similarly this site, True/Slant, also announced a paid contributor model called Ad/Slant, which is exactly how we obtained this blog I’m writing on now. Admittedly, injecting paid sponsorships into the seemingly organic channels of social media did make us pause at first. We had to ask ourselves: Will such monetization corrupt the purity of the online conversation? Will it interrupt and undermine the authenticity of the social stream?

Because social media is still relatively new and not yet philosophically digested, we approach it with a naive innocence, as if, in the absence of well-established norms and laws to govern our online behavior, socially generated content is somehow magically untainted by corporate interests or the agendas of big money. Rousseau’s famously romanticized noble savage, that pure and untainted being who, absent the corrupting influence of civilization, is naturally free and happy and supremely virtuous, is an appropriate metaphor.

Our naivete is fed by a powerful authenticity narrative that is pervasive in our internet culture, one deeply intertwined with our understanding of privacy, innocence, purity, and the individual in relation to (or more often pitted against) society. This narrative states that authenticity is an internal trait, the deepest and truest nature of the self that must be continually asserted, uncompromisingly true to itself, and fiercely protected from the corrupting influence of our decadent culture. It reminds me of a few art students I used to know who shunned art history for fear that their art would be tainted and less authentic if they studied other artists, as if their talent could only be diminished, not enhanced, by the context of networks.

What if, instead, we think of authenticity as something that emerges and flourishes within the context of networks instead of in opposition to them? Suddenly the emphasis is on relationships and connections, not individuals. It’s an uncomfortable thought for die-hard individualists, but as society becomes more and more connected, as we share more and more of ourselves on the social web, we need a way to relate effectively with one another. Relating authentically, which I will begin to define as relating openly, honestly, in a way that upholds the dignity of all parties involved and without a hidden agenda (note that I did not say without an agenda), seems like a good place to start.

So where does sponsored social media content fit into all this? The monetization of conversation, online or offline, is nothing new. Self-interest and profit have long been present in the social stream, influencing conversations with and without disclosure. In fact, I’d argue that paying for influence through well-marked content, comments, and Tweets is actually one of the more authentic ways of doing so, because at least you know who you’re dealing with.

Of course these posts will sometimes be disingenuous. Of course people will try to spin the conversation. This happens with or without paid sponsorships. It’s still important to think critically about the content you read. But if a company or a person with interests and an agenda has something to share with me, I’d much rather see it openly, in a spirit of genuine engagement, than in a clandestine Tweet or comment.

This is not corruption. In terms of innocence lost, it’s more like learning Santa Claus isn’t real. You can’t put the genie back in the bottle, so to speak, and nor would you want to. Connectedness is not going away, and neither will sponsored content. The best we can do is uphold our authenticity in the midst of it. And don’t feel bad if you occasionally yearn for some imagined good ol’ days of social media, before things got corrupted by [insert corrupting influence here]. Nostalgia is, after all, a very powerful coping mechanism.

There is much discussion about the new privacy changes that Facebook announced this week. Facebook’s changes can be summed up by saying they now offer more granular privacy control by offering per post options as well as an updated default options that share more of your information by default. The Electronic Frontier Foundation’s take is:

These new “privacy” changes are clearly intended to push Facebook users to publicly share even more information than before. Even worse, the changes will actually reduce the amount of control that users have over some of their personal data.

Critics of these new policy changes are basically contending that Facebook is leveraging interpersonal communication for their own profitable gain. Seriously!?! What did people think they were giving up in exchange for world class services at no charge?

This post could be a rant from me about the emergence of spoiled brat behavior from a culture that feels entitled to a free Internet, but that is another post. Instead, I will argue that social media is not a private activity. I will also argue that not paying for the service makes it accessible to more people, which increases the value we get from using the service. And, finally privacy is about personal discretion, not Facebook settings.

Social media is inherently not private

Social media describes the behavioral usage of media. Media is the distribution of content to an audience, which by definition is not private. So, the larger underlying issue here revolves around the use of media as a communication vehicle, particularly for the transmission of private information.

This is of particular interest to us at Webtrends. The largest brands in the world use our technology to measure people’s consumption of online media. Social is an important measurement frontier for our clients, and it’s not just us. Everyone is clamoring to measure the effectiveness of social media as a communication channel for business objectives like marketing, support, HR, etc.

As a result of business interest and monitoring from organizations that range from non-profits to government, we’re at a historic cross road for social media. Are users willing to continue sharing some of their communications publicly as the payment for the communication systems?

The criticism of Facebook’s privacy policy updates suggests that users don’t see their activity as the creation of media. Rather they see themselves using a communication system with implied privacy much like using the phone or email.

The network effect

The value of networks emerge from increasing the amount of connections in them. Trading free service for ads allows more people to connect to our networks, which benefits us. The network effect is explained in Wikipedia as:

Network effects become significant after a certain subscription percentage has been achieved, called critical mass. At the critical mass point, the value obtained from the good or service is greater than or equal to the price paid for the good or service. As the value of the good is determined by the user base, this implies that after a certain number of people have subscribed to the service or purchased the good, additional people will subscribe to the service or purchase the good due to the positive ‘utility:price’ ratio.

If we charge for social networking, we will decrease the number of connections, which decreases the amount of value to the network’s users. The only reason not to enter into an exchange of advertising exposure for service access is a concern about privacy. Rather than destroy the value of the network effect in free services, people can either join private networks or use personal discretion about what they share.

Private networking

While social networking is a public activity, there are private networking options appearing. Privacy is the very principle that Blackbox Republic was created to support. Blackbox Republic is a paid network that was built to be private from the beginning. Their network uses principles like paid accounts, vouching for other people, per post privacy options, and more so that what happens in BBR stays in BBR. And, that’s why users pay for it. And, more services like BBR are starting up to meet the demand for private networking.

Is this the beginning of the end of transparency?

I joined MySpace when there was less than 200,000 users. I remember when they introduced the private profile option. My first reaction was, “What is the point of that? Why be in a public network if you’re not going to share?” I half jokingly told my friends that privacy was for the emotionally insecure. If you don’t feel comfortable with who you are and what you’re doing when the world’s attention is on you, then you’ve got more emotional development to do.

Over time I realized something different. People weren’t, and still are not, using discretion. There are private communication channels currently, so if I have something private to say, I use those channels. To this day, I don’t post anything in a public social space that I wouldn’t feel comfortable with my family seeing or defending myself publicly. In other words, I don’t see the maintenance of my privacy as Facebook’s responsibility. But, I am not the average user.

The lack of models for how to behave online is exactly what I was thinking about when I wrote “Where are our social media elders?” My view is that we need to work through this period of time to determine best practices for the next generations instead of crawling back into the ignorant darkness because we can’t take the heat. One commenter on my post said it well when she wrote:

…there is one real difference that social media has brought to the eons of generational differences in points of view on life: With the entanglement of relationships in the authentic and transparent across generations, for the first time in history we are forced as a whole to engage others generational POV on life to opt into the conversation, whether it’s your mom reading your Facebook, a Director of Public Relations answering outraged youth on Twitter about violations of green space, or the CTO of the United States appealing to technologists to submit answers to decrease the costs of health care.

I hope we’re not seeing the end of sharing a portion of who we are publicly. It would be sad to return to our isolated social bubbles, especially since we’re at a precipice for understanding what aspects should be public and which should be private. The awareness we’re developing from vetting our points of view by being exposed to each other at historic levels is too valuable for our own personal development to turn our backs on. Don’t you think?

“Most businesses are still sticking their toe in the water of social media and as a result have seriously under invested in the space. Large Fortune 1000 companies are gripping about spending $30K on software and handing it over to super small teams–sometimes a single person. Can you imagine if they tried to answer their phone lines with a 3 person team? Or a single intern?!! How can they expect to evaluate performance when the team is so under water that they can’t even think?”

— Scaling social media

Ok, so if businesses are under investing in social media, what does a proper investment look like? Let’s look at 3 areas: Staffing, Business Processes, and Infrastructure.

Staffing

Staffing is really two pieces: roles and training. Not only do you need the people organized into roles, but you also need to make sure they are trained. Let’s take a look at some of the publicly available numbers for the top brands:

Starbucks (source)

6 people

11 channels

Dell (source and source)

22+ people

11 channels

SAP (source)

35 people

10 channels

Best Buy (source and source)

1,400+ people

9+ channels

Business Processes

A layer below staffing are the business processes that staff are executing. These are the guts of a social media marketing program. Business processes provide governance and structure that enables a team to execute. The following are the list of processes that a multi-channel social media program needs to function:

• Monitoring
• Publishing
• Moderation
• Response
• Measurement
• Promotion
• Networking
• Supervising
• Maintenance

Infrastructure

If business processes are the guts, then the infrastructure are the bones. Technology provides the means to publish, monitor, measure, delegate, supervise and more. When technology is used right, it can improve efficiency allowing your people to maximize their output, especially if that tech is integrated.

Increasing output is the name of the social media marketing game. A recent study from the Altimeter Group and Wetpaint revealed the first financial correlation between social media and financial performance. The bottom line formula for success according to that report was: Channels X Activity = Financial Performance.

There are tons of social media technologies out there. Hundreds of monitoring choices, URL shortners, avatar managers, aggregators, etc. Below is a configuration of core technologies used to manage an Enterprise B2B social media marketing program:

What are your experiences with the operations side of social media?

What have you seen on investments and configurations of staffing, business processes, and infrastructure to power social media programs? How do you think businesses will approach increasing their investments? Do you think they will? What do you see the future landscape looking like?