December 19, 2008

Company Created Official-Looking 'Class of 2013' Facebook Groups for Hundreds of Colleges

Updated 5:59 p.m.

Anyone can create a Facebook group and make it appear to be something it’s not.

Brad J. Ward reminded admissions officials about that simple fact on Thursday after examining hundreds of “Class of 2013” groups that have popped up on the popular social-networking site. Typically, students who plan to enroll at a particular college create such groups to start communicating with their future classmates. Some colleges establish the groups or encourage admitted students to do so.

But Mr. Ward, coordinator for electronic communication in Butler University’s admissions office, found that dozens of the 2013 Facebook groups, complete with college logos, had been created — or were being maintained — by the same handful of people, none of whom were students. So who were they?

On his blog, SquaredPeg.com, Mr. Ward wrote early this morning that, with the help of other admissions officials, he had traced several of the names to College Prowler, a Pittsburgh company that publishes student-written guidebooks about colleges and universities.

Later today, Luke Skurman, College Prowler’s chief executive, confirmed in a message on Mr. Ward’s blog that his company had been “directly or indirectly involved” in creating the 2013 groups. “The original purpose was to use these groups as a way to inform students that they can access a free guide about their new college on our site,” he wrote. “No employee or anyone else associated with College Prowler has used these groups to send out messages or wall posts.”

Yet Mr. Skurman also wrote that he learned “about an hour ago” that College Prowler had been working with another group “that may have been using fake aliases to create these groups.” In an interview with The Chronicle this afternoon, Mr. Skurman identified that group as Match U, a social-networking tool that’s in development. The group, which had also begun creating 2013 groups representing various colleges, reached an agreement with College Prowler: “They granted us some administrative access to their groups, and we granted them some administrative access,” said Mr. Skurman.

This afternoon, Mr. Skurman posted a list of names “associated with” College Prowler on Mr. Ward’s site, and announced that College Prowler had cut ties with all of the 2013 groups. “It was clearly over the line, and we should have checked ourselves earlier,” Mr. Skurman told The Chronicle. “We saw so many other companies doing this, and it seemed it was kind of the Wild West, and that this was an innovative approach.”

As word of what one admission dean has dubbed “Facebookgate” first spread yesterday, some college officials speculated that College Prowler had set out to “colonize” Facebook groups for marketing purposes. Mr. Ward wrote on his blog that he had uncovered “an inside ring with a common purpose.”

“Think of the data collection,” he wrote. “The opportunities down the road to push affiliate links. The opportunity to appear to be an ‘Admin’ of Your School Class of 2013. The chance to message alumni down the road. The list of possibilities goes on and on and on.” Mr. Ward added that he planned to create an official Butler Class of 2013 group, promote it to students, and warn them that other groups were “potential spam.”

In an interview late this afternoon, Mr. Ward said one of his concerns was that the company was engaged in data mining. Although one members of a particular Facebook group cannot see the personal details of another’s profile without being his or her Facebook “friend,” Mr. Ward said that students tend to “friend” everyone in a particular group. “Some freshmen ‘friend’ everyone in their class,” he said.

Michelle Lynch Clevenger, director of recruitment at Winthrop University, in South Carolina, said the concerned admissions professionals were “looking out for students not to get spammed and solicited and taken advantage of.”

Ms. Clevenger first contacted Mr. Ward several weeks ago, after seeing a 2013 group for her institution pop up on Facebook. Winthrop does not create groups for incoming freshmen, but it monitors those that do form to make sure the students do not spread incorrect information.

Ms. Clevenger was suspicious because the 2013 page contained names she did not recognize, and many were from out of state (80 percent of Winthrop students come from South Carolina). So she called Mr. Ward, known as a social-networking guru in the field. Mr. Ward later found a Butler group that listed the same creator — Patrick Kelly — as the Winthrop group did. Neither institution had a record of an applicant with that name.

Some recruitment experts were concerned about how admissions officials, who were already wary of Facebook, might respond to the news. “Colleges and universities continue to struggle to make sense of social networking, and this is an illustration of how you need to be careful about how you manage your presence on the Web,” said Michael Stoner, president of mstoner, a marketing firm that specializes in Web development, and whose clients include higher-education institutions.

“One of the lessons here is that colleges and universities need to be a part of these networks,” he said, “but you can’t take for granted that everything going on there is beneficial.” —Eric Hoover and Beckie Supiano

Comments

1. College Prowler is also known to market a “scholarship program” only to sell the students contact information to marketers. No one has ever won the College Prowler scholarship that is supposed to be given out monthly. Check the website. It states it was given to someone in April 2006, yet that person is an employee of College Prowler.

   They have been using faulty marketing tricks for years to spam and solicit student’s personal information.

   — Anonymous    Dec 19, 03:37 PM    #

2. The real lesson here is do not post personal contact information such as addresses and phone numbers on Facebook.

   — T    Dec 19, 03:57 PM    #

3. Oh my gosh — what a scandal! I’m sure this is only the tip of the iceberg of companies’ misleading use of social networking sites for marketing purposes. It’s nice that Brad Ward was able to ferret this out, but we should all stop being so naive when these things occur. They’re going to happen, and we shouldn’t get all bent out of shape over it.

   As for monitoring groups like this to “make sure the students do not spread incorrect information” — one wonders why colleges bother wasting the time and energy. It’s a Sisyphean battle, and is it really worth the resources trying to fight it?

   — Professor H    Dec 19, 03:58 PM    #

4. Thanks for your help in spreading the story. It’s amazing to see the community of higher ed professional rally together with me and help with the research. I couldn’t have possibly done it alone.

   Brad
   http://squaredpeg.com

   — Bradjward    Dec 19, 04:03 PM    #

5. Granted, I’m just a high school student, but after reading this article, it seems like this is blown way out of proportion. I think the greater issue is lack of understanding of normal facebook behavior…people start facebook groups all of the time, and FYI, you can’t get someone’s contact info. by starting a facebook group, as you’d have to friend them first!

   — A    Dec 19, 04:23 PM    #

6. High school student – the issue is starting a group under false pretenses. Sure, they seem harmless now, but who knows what they would have posted on the group and encouraged students to do, under the guise of being part of the university. Trick enough students into applying for a fake scholarship, as mentioned above, and you’ve got a very happy spammer.

   — Tracy    Dec 19, 04:53 PM    #

7. Just checked into the scholarship to see if it’s legit, and it appears to be (there are photos posted of all of the past winners)…looks like some false info was posted above.

   — Adam    Dec 19, 05:09 PM    #

8. Wait, how does someone get personal info out of Facebook with groups? Do the people that broke this scandal even know how Facebook works?

   — Randy    Dec 19, 07:45 PM    #

9. Randy – I am well aware of how Facebook works. There is a potential for data mining, although it doesn’t seem that is has occurred at this point. When I made that statement, it was forward-looking to what could have been.

   In my extensive research and experience with Facebook Groups, and as the article states, many students tend to friend anyone and everyone in the group. If you are a part of that group, you will gain access to that student’s data. Happens very frequently among ‘Class of’ groups.

   Feel free to shoot me an email if you have any questions. My blog is linked above.

   — Bradjward    Dec 19, 09:54 PM    #

10. The problem is College Prowler—and its associates—would have had unfettered access to students and alumni, with limitless power to spread their own messages (i.e., sell their products) while making it appear official. The implications are very serious. It matters not that they wouldn’t have access to personal information.

    — DLS    Dec 19, 11:34 PM    #

11. I would worry about more than spam and viral marketing – if scholarships are being marketed, unsuspecting students will no doubt provide critical info – address, social security number, birth date – that could lead to wide scale identity theft. If you don’t know about the security of the College Prowler or Match U servers, proceed with extreme caution…

    — NYCEdPhD    Dec 20, 12:23 AM    #

12. This “limitless power” sounds like advertising. Given I can’t turn on a tv, radio, webpage, or anything else without seeing any of that I just can’t get worked up some college site can advertise to college students. Also, how does making a facebook group make servers less secure? There doesn’t seem to be any logical connection there.

    — Randy    Dec 20, 02:02 AM    #

13. I just read some of theses posts and it seems like the universities and bloggers are really blowing this out of proportion. I think it is making things worse, not better. If they want control of the groups they should just make facebook pages for their incoming class community.

    — Julia    Dec 20, 02:08 AM    #

14. #12 – The connection is as follows: College Prowler and Match U. are direct marketing to college students and apparently offering scholarship services. Most if not all scholarships require identifying information that can be used for identity theft. The issue isn’t Facebook’s servers, but rather the security of the servers that will contain students’ personally identifiable information if they do apply for the scholarships offered to them via this third-party arrangement.

    #13 – Two thoughts: 1) Why should College Prowler or Match U. be allowed to be dishonest? Neither company has any right to offer “official” class groups. 2) Colleges and universities have many reasons to NOT create Facebook groups, and have just as many reasons to make sure their institutional identity isn’t used and compromised by third parties.

    — NYCEdPhD    Dec 20, 12:44 PM    #

15. I want to share a comment I made to Brad’s original post. As I try to get my arms around this discussion, a couple of things come to mind. This week I’ve been reading Don Tapscott’s latest book called “grown up digital”. Tapscott is the author of “growing up digital” and “wikinomics”, and has done a tremendous amount of research on the millennial generation. He feels this generation is making a serious mistake, and don’t realize it. They are giving away their personal information on social networks and in doing so are undermining their future privacy. This may come back to haunt them.

    This raises the question of the role colleges should play in educating students about potential privacy issues. How does “in loco parentis” apply in the digital world? That’s a question each college will have to consider. This conversation has been a great starting point.

    — Mark Greenfield    Dec 20, 08:25 PM    #

16. If Brad wanted to, he could take the e-mail addresses of anyone who’s ever posted a comment on his blog and sell that list to advertisers. He could slip sponsored posts into his e-mail subscriptions, he could do a number of things.

    In fact, I’m a little uneasy with the “blacklist” he’s creating in Google docs at http://spreadsheets.google.com/ccc?key=pjG19CBpNu8eHM2eGScMaag

    From Brad: “Douglas Hanna was erroneously listed as a member of the situation in the Duke 2013 group. His name was in ( ) and a note for ‘more research’ was needed. Douglas has emailed me and explained he was not involved, so I have removed him from the Google Doc and wanted to also post it here. Sorry for the mix-up, Douglas!”

    Brad makes it sinister what marketing and advertising professionals do for a living, or in this case what they might do — potential future data-mining in order to market goods and services to potential buyers.

    Now I understand his primary concern is that of masquerading as school officials, protecting students, etc. But can you imagine if we started blocking communication channels because of potential threats, like advertising?

    Facebook is an opt-in service. Anyone can create a group or fan page. And Facebook allows users complete control of their privacy.

    If a student is sending sensitive information about him- or herself and/or filling out scholarships or any other “official” forms via Facebook or similar online social network, I think the issue is bigger than taking down this “ring” or marketing mavens.

    I said this on Brad’s post: This is an issue of education, trust and credibility. Journalism schools have been teaching these skills forever. If anything, this is a fight for the relevance and stamina of journalism in the face of new media.

    I hope schools are vigilant in their fight to not only protect students, but also help educate them.

    — Mich Sineath    Dec 21, 09:44 AM    #

17. I agree with the last several points of your post Mich, and it’s head-spinning stuff: How do we educate students who haven’t begun studying on our campuses yet? How do we get students’ focused attention?

    Several students at my school lost internships or job offers this past semester because of content on their Facebook pages. The students are my school are pretty darn good kids, so I’m very perplexed by this. The student newspaper, though, took this cause up and ran articles or editorials three weeks in a row, and by the third week, the student newspaper was essentially saying, “No, seriously… pay attention to this!”

    To address some of the other interesting discussion points, lots of businesses try to get their hands on college enrollment lists: bed loft companies, credit card providers, micro-fridge companies, local apartment complexes, you name it (I mean, this is truly a short list).

    Colleges make tough decisions about maintaining the privacy of currently enrolled students and alumni. Take the example of the credit card offers we all get from our alma maters – yes, these are an “official” effort of the college or university.

    College Prowler was trying to do the same thing, only without colleges’ and universities’ permission. So for me, it’s not just about protecting students from marketers, it’s about a company being fraudulent.

    Am I saying that everything a college or university does is OK? Heck no. I’m personally very irritated with the commercialism of college and university athletic websites, for example (and while this may seem random, think about it: what if College Prowler had offered to do for colleges and universities what CSTV does for campus athletic departments? Notwithstanding the fact it never would have happened because College Prowler’s let-the-students-keep-it-real stance, this may have been an approach some colleges could have found acceptable… maybe?).

    Of course, College Prowler knew it wouldn’t get the permission it wanted, hence the unauthorized pages. To say that it’s no big deal because it’s Facebook and users can manage their privacy is true IF we’re just talking about the students who opt in (and I still don’t totally agree with that assessment, but that’s beside the point…), but those arguments aren’t going to mean much to colleges (which have to be alert to misinformation promulgated on a site calling itself “official”).

    Case in point, legal counsel at a university in DC presented a case study about needing to correct misinformation in the public sphere after a judge ruled the institution should have responded to factual errors published in The Washington Post. Even though the unauthorized “official” groups were created by marketers to direct students to a product, colleges could have still hard trouble on their hands, just by virtue of the official designation (which, again, we can debate whether students would have believed…).

    RateMyProfessor, JuicyCampus, all that stuff is different, because they’re not making any attempt to suggest any sort of college endorsement.

    Suffice it to say I still believe a third party shouldn’t have the right to claim something as “official” when it’s not, especially when colleges and universities attempt to be thoughtful (some more than others) about what third-party business ventures they get into like this and what negative feedback they are willing to bear for these ventures.

    — NYCEdPhD    Dec 21, 12:32 PM    #

18. I think Brad’s intentions are good. But I think we are teetering dangerously close to infringing upon the privacy of those that may be indirectly involved: honest-to-goodness real life students.

    The media has run with this story from one angle: Marketers are bad. I want to hear from privacy experts and ethics experts about the crowd-sourcing blacklist taking shape in a public Google document as schools look to uncover those involved.

    With respect to Brad—and I said this on his blog—I think he’s taking on a role similar to that of a computer crimes analyst and is asking universities across the country to put on a badge. I want to know who’s looking into this at the university level and if they have the authority to do so.

    I don’t think it’s okay to copy a list of some 300 names from Facebook, place them in a public document and ask schools to check into them.

    I say make the information about a possible phishing scam available, but let the schools and Facebook take it from there. If there is an “unofficial” group masquerading as an “official” group, ask Facebook to take it down. In fact, let’s see what Facebook says. Why are these angles not being covered?

    — Mich Sineath    Dec 22, 11:17 AM    #

19. The individuals who posed as alumni or students of institutions they neither attended nor plan to attend have no privacy claim. If the individuals lied about being a grad of XYZ College, or a currently enrolled student, or an entering student and established themselves as admins, I don’t believe they can now be worried about their privacy rights.

    Reminder: they started the groups and acted as admins!

    Now that those individuals have turned the admin responsibilities over to actual students, and now that College Prowler has made public statements conceding CP crossed a line, I believe the list can be taken down and that colleges can either disclaim the Class of 2013 group or groups or colleges can look into this further on their own.

    To Mich’s observation that the media has run the story from one angle, being that marketers are bad, ummm, No. Dishonesty is bad.

    I am completely unsympathetic to the kids who falsified information. Just as employers are unsympathetic to students they fire for posting keg party photos on their Facebook pages, or for the student groups that get busted for hazing because of photos they post on Facebook groups or pages.

    Do I think the list needs to stay up? No. Am I going to wring my hands for the individuals on the list. Heck No.

    Look, had College Prowler clearly branded these groups The College Prowler Class of 2013 group for XYZ College or ABC College Class of 2013 Group, sponsored by College Prowler, then we’d be having a very different discussion.

    I’m annoyed this continues to circle back to a discussion about marketing (or how we need to protect the marketers). That we can excuse this at all by saying, “But it was marketing…” Are you kidding me?

    And the “with all due respect” comment is anything but respectful. Telling Brad and the others who helped him that they put on badges and acted like crime analysts is the equivalent of chastising him and those who helped him.

    Chastising him for exposing fraud. Incredible. And snarky, too.

    — NYC Ed PhD    Dec 22, 12:59 PM    #

20. The College Prowler CEO has posted another comment on SquaredPeg:

    http://squaredpeg.com/index.php/2008/12/18/facebook-pay-attention/comment-page-5/#comment-1620

    Not to be tangential, but I expect most colleges to say, “Nope, we don’t do Facebook, so anything you see on there is not official and not us” or for colleges to go with another provider, and bring their social networking in-house or have a third party like College Prowler (but not College Prowler) create and administer the site or page – and have this agreed upon in advance.

    Much hunch is that colleges will wash their hands of Facebook completely – there is already a vaguely racist post on one of the Class of 2013 groups warning students to “Watch out for crime at ABC University, it’s under black leadership…” and another strongly suggestive sexual comment on another group wall…

    If students want to have that kind of discussion on their own, in their own space, have at it, but I certainly wouldn’t recommend any college put itself in a position to even see that kind of comment.

    Back to my initial point: clever and smart of the College Prowler CEO to weigh in again and try to drive a constructive conversation.

    — NYCEdPhD    Dec 22, 03:18 PM    #

21. The marketers violated the Facebook terms of service if they created fictitious accounts:

    “In consideration of your use of the Site, you agree to (a) provide accurate, current and complete information about you as may be prompted by any registration forms on the Site (“Registration Data”)”

    They may have committed other violations to the Facebook Terms of Service, as well.

    Those involved in creation of and additions to the Google Docs spreadsheet also violated the Facebook Terms of Service:

    “Except for your own User Content, you may not upload or republish Site Content on any Internet, Intranet or Extranet site or incorporate the information in any other database or compilation, and any other use of the Site Content is strictly prohibited.”

    Facebook terms: http://www.facebook.com/terms.php

    It is curious that my initial comment on this blog post (post #1 at that time) regarding having reported this issue to Facebook on December 1 has been removed. We’ll see if this comment is removed, as well.

    — Rob S.    Dec 22, 03:57 PM    #

22. College Prowler is one of the most over-rated and underimpressive guide books out there. Doesn’t shock me that they would sink so low. Have you ever seen them at NACAC in those orange shirts, practically grabbing your arm to get your to their table? If your product is that good, why must you try so hard?

    — counselor    Dec 22, 04:19 PM    #

23. Touche’ — Dishonesty is bad. But other than a few comments mentioning privacy, I have not seen the media cover that angle of the story. If you have, please direct me to it.

    I have said this all along: I do not have the answers. But I want to hear from everyone on this.

    As for my ‘respect’ comment: I meant what I said. I think Brad’s intentions are good. I’ve seen his work and it’s excellent. I believe that he is truly out to protect the students. But yes, I do think he handled this poorly. Yes, I think he crossed the line. And I think there could be repercussions because of it.

    I went into this further on his blog at http://squaredpeg.com/index.php/2008/12/18/facebook-pay-attention/

    By the way, here’s how Facebook said to handle “illegitimate” groups:

    […]What you can do on your own is to always report and group or person who is impersonating something or someone else. You can do so by clicking the small report link at the bottom of the group or profile, or by writing in to privacy@facebook.com.

    This is interesting: Did you read what Rob S posted above?

    […]Those involved in creation of and additions to the Google Docs spreadsheet also violated the Facebook Terms of Service:

    “Except for your own User Content, you may not upload or republish Site Content on any Internet, Intranet or Extranet site or incorporate the information in any other database or compilation, and any other use of the Site Content is strictly prohibited.”

    Facebook terms: http://www.facebook.com/terms.php

    — Mich Sineath    Dec 22, 07:27 PM    #

24. Mich – I have removed the document from Google. Merry Christmas. Now go enjoy your time off. ;)

    — Bradjward    Dec 22, 08:35 PM    #

25. First, mea culpa. I alluded to my original comment being removed. It was not. I made that comment on a different version of this story on the Chronicle Web site. (The stories were mostly identical.)

    Second, I want to reinforce that my comments about Facebook term violations were statements of fact, not personal attacks on anyone.

    It seems that terms of service are rarely read for popular, consumer-facing software products, but users can be held to those terms. If you’re up for some interesting, though heavy-in-legalese, reading, check out the terms of service for many Web-based products and services you use.

    — Rob S.    Dec 23, 10:37 AM    #

26. This is a fascinating (and timely) story – And while I confess I have not read the other version that Brad S (#25) alludes to, it seems a glaring omission that there is no reference to comments (or the opportunity to comment) from the people who actually run Facebook.
    I wonder why the reporters (Eric Hoover and Beckie Supiano) didn’t ask them what they are doing about this violation of terms? Did I miss this somewhere?

    — JRB@MSU    Dec 23, 02:09 PM    #

27. Thank you all for bringing this issue to Facebook’s attention. We have investigated the situation and found that these groups and a number of accounts associated with their creation were in violation of our terms of service. These groups and accounts have been disabled. – Barry Schnitt (barry@facebook.com)

    — Barry Schnitt    Dec 23, 02:50 PM    #

28. Thanks, Mr Ward, and thanks, Mr Schnitt.

    Merry Christmas to all.

    — Orlando    Dec 23, 11:04 PM    #

Previous: Music Industry Will Stop Mass Lawsuits Against Students Over Illegal Trading
Next: As Debts Mount, Morris Brown College Will Not Reopen Next Semester