In a post on the University of Cambridge Computer Lab's
Light Blue Touchpaper blog, PhD student Joseph Bonneau describes an experiment he and his colleagues conducted on 16 photo-sharing sites.
The
post, entitled "Attack of the Zombie Photos," points out that more than 40 billion photos are on Facebook alone and that the site gets more than 25 million new photos each day.
Bonneau explains that dealing with such volume means that most photo-sharing sites don't host all their photos on the main site server.
Rather, the photos are stored on a separate dedicated photo server, which delivers the requested photo on receipt of the proper URL.
The problem comes with the fact that if a user deletes a photo through their profile, it isn't actually removed from the photo server. Rather, similar to the way deletions via the Recycle Bin or Trash Can on a personal computer are handled, the photo can sit there until it is overwritten.
During that time, if someone knows the direct URL for the photo, they can still retrieve it.
For what the experiment discovered, see Page 2.
Bonneau and his colleagues uploaded a test image to 16 photo sharing sites, including Facebook, Flickr, LiveJournal, MySpace, Orkut, Picasa, Bebo, and Windows Live Spaces.
They then noted the URLs for the photo and confirmed that all but one site would deliver the photo when requested with the proper URL.
The one exception was Windows Live Spaces, whose photo servers required session cookies, prompting Bonneau to write, "a refreshing congratulations to Microsoft for beating the competition in security."
The researchers then deleted the photo but kept trying to retrieve it for 30 days to see how long it persisted on each site's photo server.
They discovered that Orkut, Photobucket, and Flickr "revoked" the photo immediately, but that it was still available 30 days after deletion on a full seven sites, including Bebo, MySpace, Facebook, and LiveJournal.
Bonneau labeled the sites' approach as "not only fundamentally wrong from a privacy standpoint, but likely illegal under the EU Data Protection Directive of 1995 and its UK implementation, the Data Protection Act of 1998, which both clearly ban keeping personally-identifiable data for longer than necessary given the data’s purpose."
