Social Networking Security

Originally posted 9/9/2010

On the internet, no one knows you’re a dog.  That famous New Yorker cartoon by Peter Steiner from 1993 illustrates a fundamental issue faced by today’s social networking sites: are the members who they say they are?

We’ve learned a lot about participation in social networks via the internet over the last few years. We know from the good old days of altnet newsgroups (don’t worry if you’re too young to remember those) that anonymous participation in social networking sites is always problematic.  People post under multiple identities, they post under false identities (which is why Twitter has a “verified” flag for celebrities), and they can be incredibly disruptive by posting argumentative, obnoxious, inflammatory, obscene and generally vile remarks.  After all, when you’re anonymous, no one knows you’re “that” dog.

One solution to the problem is to try to tie a member identity in the community to an actual person.  Most sites accomplish this by requiring unique user names tied to an email address: that way when you sign up, they can at least send you an email to confirm that you are a real person and that you own that particular email address.  Of course, this doesn’t prevent people from signing up with multiple email addresses, but it helps.  By making members identifiable (rather than anonymous), most of the problems mentioned above go away (or the user is rapidly ejected from the community for being a jerk).  If a social networking site doesn’t require an email address for registration, or if they don’t make new members verify it by clicking on a link in an email sent to them, the site runs the real risk of degenerating into a de facto anonymous network. 

The flip side of requiring a unique user name and a valid email address is that it limits member participation.  Someone using a work computer, for instance, has a problem joining with their personal email address, since their personal email may be unavailable on their work computer (or vice versa).  Or people may fear that the social networking site is collecting their email addresses for nefarious purposes like spam or phishing, and refuse to provide it (and thus be barred from participating in the network). 

This is the classic tension found in systems requiring security: The ultimate secure system lets no one in, assuming that everyone poses a threat to the system; an open system lets everyone in assuming they have a right to be there.  In the real world, security and openness is a balancing act: Make security too hard and lots of people that you want to participate won’t; make security too simple and lots of people that you don’t want to participate will.

Failure and Success at Social Customer Support

Lots of companies now employ people to regularly monitor the major social media sites for complaints.  I know a few months ago when I tweeted something on Twitter (where else does one tweet) about the poor service I had received from my cell phone carrier, a support representative from the carrier tweeted me back within minutes offering to help.  This surprised me at the time, since it hadn’t occurred to me that companies were actually paying any attention to rants on Twitter (or any other social media sites, for that matter) looking for opportunities to provide support.

I had another opportunity to interact with a social media customer support representative recently, and was left both pleased and disappointed with the experience.  Allow me to explain:  Like so many people in the last few months, my wife’s email account (which she’s had for over a decade) was hacked.  The hacker registered a name very similar to hers, and started by sending all of her contacts the now-infamous “I’m stuck in London after losing my wallet please send me money” scam (an approach generically known as a 419 scam).  Since most of her friends (and I) knew she wasn’t in London and wouldn’t have sent such an email even if she had lost her wallet, I wasn’t too concerned when I first got the email.  But the hacker had not only broken into her account, he/she/it had also changed her password, so she could no longer even log in. A big problem, needless to say.  So we searched through the “what to do if you can’t get into your account” links at the provider’s site looking for an email address or a phone number to contact.  Nada. Zip. Nothing. Instead, we could only find a “fill out this form and we’ll get back to you in 24 hours,”  which was not at all what we were hoping to find.  So without any other recourse we filled out the form, and almost exactly 24 hours later got the password reset and she got back into her account.  End of story, or so I thought.

When it happened again two weeks later, I was determined to get a more timely response out of the email provider.  So instead of filling out a “we’ll get back to you with an automated response within 24 hours” form, I fired up Twitter and started to tweet one or two reasonably snarky (I know you are shocked…me??  Snarky??) remarks hoping to draw out a customer support representative from the company (and yes, I tried searching for the handle of a Twitter representative before I ever started ranting).  No response whatsoever from the Twitterverse until the next morning, when a random follower suggested a handle I could try to contact the company.  So I tried that, also apparently without any luck.

However, the handle I tried turned out to be one that apparently was being looked at (occasionally) by a Twitter customer service representative for the company, who upon noticing it contacted me asking for relevant details.  Details were provided, and an actual human person made an actual telephone call to my wife the next day to straighten out the problem.

So the whole experience was very much a good news/bad news affair.  On the bad news side, the provider’s website was totally useless with respect to customer service: no email, no phone, no way at all (other than a form) to contact someone at the company who might be able to solve the problem.  One would think if a company is going to go the social media customer support route, they might even have a “contact us via Twitter or Facebook” button, but no. If I hadn’t gone to Twitter and started ranting about the lack of service, I’m sure I’d still be exchanging form-based trouble tickets with someone or live-chatting with a person who isn’t authorized to help.  On the good news side, once the right support person got involved the problem was resolved quite quickly.

So kudos to the company for providing support via Twitter; boos to the company for not making easier for someone who *isn’t* on Twitter to get support.  I think there’s a lesson here: If you are going to provide customer support by monitoring a social media venue, you might want to make it easier to find your CSR there.  Otherwise, the CSR is probably going to be dealing with angry and frustrated customers, who have probably already publicly bashed your company.