Both Facebook and Google have had their share of embarrassing privacy blunders. Facebook had Beacon, and Google had Buzz. But the most recent privacy scandal to make headlines—surrounding a Gmail feature called Social Circles that pulls in data from users' friend connections—has become a scandal about botched PR. Facebook, apparently gunning for Google in an area where it doesn't look so hot itself, reportedly hired PR firm Burson-Marsteller to do its dirty work.

The effort failed when privacy blogger Christopher Soghoian publicly posted the sleazy e-mail pitch he received. In part, the pitch read:

Google is at it again - and this time they are not only violating the personal privacy rights of millions of Americans, they are also infringing on the privacy rules and rights of hundreds of companies ranging from Yelp to Facebook and Twitter to LinkedIn in what appears to be a first in web history: Google is collecting, storing and mining millions of people's personal information from a number of different online services and sharing it without the knowledge, consent or control of the people involved.

In an interview with Ben Popper at BetaBeat, Soghoian said that Google's Social Circle is far from his main privacy worry:

I'm a fairly outspoken privacy advocate and there are many things Google does that are really bad on privacy, but this isn't the thing that is keeping me up at night. It's something that I had never really worried about.

Soghoian told Popper that companies have recently realized that raising privacy issues is a way to score points against competitors. He continued:

The difference is Microsoft can do it publicly, because they don't have their own privacy problems. Facebook is no better than Google on these issues, so to make these attacks they have to hide behind these PR companies. If they tried it in public, under their own name, people would laugh in their faces.

Soghoian suggested that USA Today, which was the first news outlet to break the story, narrowly escaped being duped itself. The suggestion is plausible. The article, which leads with information about Burson-Marsteller, shifts to descriptions of users expressing shock about Social Circles:

Dion Moses, 25, a computer engineer in Ridgecrest, Calif., also wants out of Social Circle. "This is shocking," Moses says. "I had no idea that Google was doing this, and I pay close attention to most technology news sites."

The only way to disable Social Circle, [Google spokesman] Gaither says, is to stop using Gmail.

I'm not particularly shocked by revelations of the smear campaign, though the details are certainly fascinating. As The Register's Andrew Orlowski writes sarcastically:

Newspaper readers will be appalled to discover that a blushing, innocent maiden in Silicon Valley has had her reputation besmirched by wicked rival. Facebook's PR agency attempted to spin a blogger to write an unfavourable story about rival Google.

What's most important is that this story illustrates what a mess privacy is. Social Circles might indeed be something to worry about—if it weren't a minor infraction compared to the sorts of things that are happening all the time. Companies have access to huge amounts of users' personal data, and don't have to deal with much oversight about what they do with it.

Social-media researcher Danah Boyd summed the situation up well in a piece for TR last year:

Privacy is not simply about controlling access. It's about understanding a social context, having a sense of how our information is passed around by others, and sharing accordingly. As social media mature, we must rethink how we encode privacy into our systems.

When protesters in Egypt overturned the country's government, Twitter got some of the credit.

But Danny O'Brian of the nonprofit Committee to Project Journalists pointed out at the South by Southwest festival yesterday that social networking sites can be a curse to activists, too. "We see the social tools being used by activists or independent journalists becoming a lever to be used against them, to monitor them, to implicate them, or reveal their sources," he said, suggesting that social networking sites be tuned to prevent that and protect political activists in oppressive regimes.

Examples of web services flipping from enabler to disabler include the way Yahoo's Chinese webmail servers were used by the government to identify and then jail political activists. More recently, prominent Chinese blogger and free speech advocate Michael Anti lost a network of 1000 contacts he had built up on Facebook after someone (assumed to be politically motivated) reported him for a technical breach of the site's terms of service.

He was reported for not using his real name, although he has lived for decades and attended Harvard University as Michael Anti. Social sites can't make exceptions to the terms of service (ToS) they ask users to abide by, said Jillian York, of the Berkman Center for Internet & Society, but Facebook should consider adding nuance to its strict name requirements.

When a person is found to have breached Facebook's ToS their account disappears along with their photos, contacts, and other content. That process can be triggered when one user complains about another, creating a tool that can be used to quash free speech, said York. Government agents and competing activist groups report their enemies to pitch their accounts into lock down and their owners into a lengthy, unwieldy claims process. One example was an Arabic group who used the tactic to close down atheist activists on Facebook.

"[Facebook's policy] skews against people who are famous and have enemies," said York, "I believe you should get a choice of what name you use."

Photo-sharing site Flickr, which has no qualms about users taking any name they please, doesn't have such problems, said Ebele Okobi-Harris, director of Yahoo's business and human rights program. "Unlike Facebook's real-name policy our policies can't actually put users at risk," she said, while the company runs every pending product release past her team to screen out potential risks to human rights.

Flickr is under fire from human rights advocates nonetheless this week, for taking down photos uploaded by Egyptian photographer and activist Hossam el-Hamalawy showing alleged members of Egypt's secret police. Flickr took them down after other users reported them for copyright infringement. El-Hamalawy had uploaded a photo taken by someone else, breaching the sites ToS.

Flickr, Facebook and other social sites may not want to politicize themselves by making exceptions or design tweaks to make room for activists. But they can't ignore the problem and hope it goes away.

"I can't truly recommend that anyone use these services for activism in oppressive places," said O'Brian, "but on the other hand, how can you not use Facebook?" As social tools become more powerful and widely used, incidents like Anti's will likely become more common; activists have nowhere else to go online that offers the same features. Some firms, such as Twitter, have actively tweaked their services to help ongoing protest movements like that in the Middle East. Perhaps in the end the commercial imperative to avoid bad publicity will make others take a similar course for business, not political reasons.

Can the infamous website 4chan, known as the home of the mercurial prank community Anonymous, hold the seeds of something more mainstream? In a keynote Sunday afternoon at South by Southwest Interactive, a Web conference in Austin, Texas, its notorious founder "moot," going by his real name, Christopher Poole, outlined the insights from 4chan that he's trying to apply in his new startup, Canvas, which has raised $625,000 in venture capital.

Like 4chan, Canvas is primarily an image board, where users upload and edit images, often building off each other to produce a humorous narrative. Unlike 4chan, Canvas requires users to log in, a fact sure to discourage at least some of 4chan's more unsavory elements. Though users do have to log in on Canvas, they can still post anonymously. Also unlike 4chan, Canvas saves posts so that a lasting record is produced.

For both sites, Poole values the idea of "fluid identity." When everything on the Internet requires you to attach your true identity, he said, "you can't make mistakes the same way you used to." Poole particularly criticized the popular social network Facebook, which requires users to maintain their real, single identities for all their posts.

While anonymity has been equated with lack of authenticity and cowardice, Poole said, "I think that's totally wrong. Anonymity is authenticity." Only in the safety of anonymity, he argued, can people play in the most honest way.

Poole is trying to change how identity works from 4chan to Canvas, but he also resists going as far as Facebook.

Poole also praised the "creative mutation" that has grown on both sites. He described the evolution of an image as a sort of "riffing." Users are participating in a sort of musical jam, though in this case the tools are Photoshop and MS Paint, and the medium is Justin Bieber's face.

Poole's put a lot of thought into getting those tools into users' hands as much as possible. Canvas is designed to make it easy for people to edit images even if they have no experience. It includes picture tags that people can slap onto images if they don't want to put more time into the process. Soon, he hopes, that kind of playing with media can extend to other forms, such as audio and video.

Finally, and perhaps most importantly, Poole values the shared experience of participating in a group activity, even if that activity is ephemeral or has no purpose beyond having fun. He spoke reverently of being on 4chan at 9 p.m. on a Sunday--its peak usage time--and knowing that he's part of a unique moment. He hopes that part of what will hold people to Canvas is the desire to come back and see how an image has progressed.

Poole is a powerful and important voice, particularly in his role as foil to Facebook's Mark Zuckerberg. It's refreshing to hear a defense of fun, and to hear about a social site that is actually, essentially social.

On the other hand, other than slightly more rigid identity, and slightly more persistent posts, it's hard to see how Canvas is ultimately much different from 4chan--particularly considering that Poole is likely to attract people who are already fans of 4chan to his new site. Poole previously founded the site that has come to represent the Internet's id. His vision for Canvas sounds like a subdued version of the same, and it's not clear what he's aiming for.