Sophos: Beware Facebook's new facial-recognition feature

Facebook's new facial recognition software might result in undesirable photos of users being circulated online, warned a security expert, who urged users to keep abreast with the social network's privacy settings to prevent the abovementioned scenario from becoming a reality.

Graham Cluley, senior technology consultant at security vendor Sophos, said in a statement released Monday that the new facial recognition software introduced last week by Facebook have capabilities to match peoples' faces in photos uploaded by other members. While users will not be automatically identified, or "tagged" in Facebook parlance, members who upload these pictures will be prompted to tag a list of suggested friends identified by the facial recognition software, Cluley noted.

Furthermore, he added that once a Facebook user has identified people to be tagged in a photo, these individuals run the risk of being singled out by the social networking site to other friends.

"Even people who are not on Facebook, or who choose not to identify themselves openly in uploaded pictures, may nevertheless end up [being] easy to find in online photos," he explained.

In an earlier report, Facebook's vice president of product, Chris Cox, told ZDNet Asia's sister site CNET News that photo tagging is "really important" for control because every time a tag is created, it highlights a photo of the user which he was not aware had been uploaded online. "Once you know [this picture exists], you can remove the tag, or you can promote it to your friends, or you can write the person and say, 'I'm not that psyched about this photo'," Cox said.

He said the feature will be rolled out to about 5 percent of Facebook's U.S. users this week and, "assuming that goes well", the company will continue to launch it in other markets. He also stressed that there will be an opt-out option for the new feature, so if members do not want to show up in their friends' tagging suggestions, they will not.

Cluley, however, spoke out against Facebook for maintaining an opt-out, rather than opt-in, stance toward user information. "While this feature may be appealing for those Facebook users that are keen to share every detail of their social life with their online friends, it is alarming to those who wish to have a little more anonymity," he said.

He cited a recent Sophos poll that revealed 90 percent of Facebook users surveyed called for features on the social networking site to become opt-in. With the introduction of the facial recognition capability, he predicted that this percentage will rise.

To prevent privacy loss, Cluley recommended that users opt out when the feature is turned on. He added that keeping on top of new features and ensuring privacy settings are up-to-date is essential for Facebook users in order to make sure they do not share too much personal information online.

This is not the first time the social network has received flak for instituting an opt-out policy for its features. In March, Facebook users were up in arms after the site announced it would automatically share user data with a select group of third-party sites without specific permission.