An Empirical Study on User Access Control
in Online Social Networks
Faculty of Science, Technology and
Shanghai Key Laboratory of Data Science
University of Luxembourg
Faculty of Science, Technology and
Shanghai Key Laboratory of Data Science
University of Luxembourg
In recent years, access control in online social networks has
Online social networks (OSNs) have gained a huge success
attracted academia a considerable amount of attention. Pre-
in the past decade. Leading players in the business includ-
viously, researchers mainly studied this topic from a formal
ing Facebook, Twitter and Instagram have attracted a huge
perspective. On the other hand, how users actually use ac-
number of users. Nowadays, OSNs have become a primary
cess control in their daily social network life is left largely
way for people to connect, communicate and share life mo-
unexplored. This paper presents the first large-scale em-
ments. For instance, every day, 500M tweets are shared on
pirical study on users' access control usage on Twitter and
Twitter, and Instagram users publish 60M photos1. OSNs
Instagram. Based on the data of 150k users on Twitter and
have brought a lot of convenience to our life, users' privacy,
280k users on Instagram collected consecutively during three
on the other hand, has become a major concern due to the
months in New York, we have conducted both static and dy-
large amount of personal data shared online. Previously,
namic analysis on users' access control usage. Our findings
researchers showed that a user's personal information can
include: female users, young users and Asian users are more
be inferred through statuses  and locations  that she
concerned about their privacy; users who enable access con-
shared in OSNs.
trol setting are less active and have smaller online social
To mitigate users' privacy concern, major OSNs have de-
circles; global events and important festivals can influence
ployed access control schemes to delegate the power to users
users to change their access control setting. Furthermore,
themselves to control who can view their information. For
we exploit machine learning classifiers to perform an access
example, Facebook provides a fine-grained access control
control setting prediction. Through experiments, the pre-
scheme which enables users to apply different policies on
dictor achieves a fair performance with the AUC equals to
each post they publish. Twitter and Instagram, on the other
0.70, indicating whether a user enables her access control
hand, provide a much simpler scheme. A Twitter or Insta-
setting or not can be predicted to a certain extent.
gram user could enable her access control setting such thatstrangers cannot have access to all detailed contents in heraccount, except for her profile picture, number of friends and
Categories and Subject Descriptors
number of online posts. To study and further improve access
K.6.5 [Management of Computing and Information
control in OSNs, academia have conducted many research,
Systems]: Security and Protection; H.2.8 [Database Man-
most of which take either formal or logical approaches. For
agement]: Database Applications—Data mining
instance, researchers have modeled access control with hy-brid logic  and semantic web technology .
other hand, understanding how users exploit access control
in their daily life is essential to improve access control in
Online social networks; access control; empirical analysis;
OSNs. Much to our surprise, this is left largely unexplored.
In this paper, we perform a large-scale empirical study
on access control usage of Twitter and Instagram users inNew York. To the best of our knowledge, this is the first
Permission to make digital or hard copies of all or part of this work for personal orclassroom use is granted without fee provided that copies are not made or distributed
work on analyzing users' access control on Twitter and In-
for profit or commercial advantage and that copies bear this notice and the full cita-
stagram. We collect data of 150k Twitter users and 280k In-
tion on the first page. Copyrights for components of this work owned by others than
stagram users continuously within three months and study
ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or re-publish, to post on servers or to redistribute to lists, requires prior specific permission
their access control usage from both static and dynamic
and/or a fee. Request permissions from email@example.com.
point of view. Especially, the dynamic analysis is conducted
SACMAT'16, June 05-08, 2016, Shanghai, China
on a daily base instead of a yearly base as done in previ-
2016 ACM. ISBN 978-1-4503-3802-8/16/06. . $15.00
ous works [8, 21]. This allows us to understand in depth
Access control schemes on these three OSNs are differ-
how users exploit access control in their daily OSN life. Our
ent as well. Facebook deploys a fine-grained access control
contributions in this paper can be summarized as follows.
scheme for users to control who can view their resources.
This scheme is on a per-resource base, i.e., a user can de-
• We perform a static analysis on New York users' ac-
fine a specific access control policy for each of her photos
cess control usage and find that female users and young
and statuses. In addition, Facebook also introduces a func-
users are more likely to enable their access control set-
tion, namely friend list to help users categorize their friends
ting. Moreover, users who enable their access control
into different lists, e.g., colleagues and family, and the orga-
setting tend to have smaller online social circles, but
nized friend lists can then be directly used in a user's access
are more willing to conduct social activities in the of-
control policy which improves its access control scheme's us-
fline world represented by location check-ins.
ability. Different from Facebook, Twitter4 and Instagram5provide users with a much simpler access control scheme.
• We conduct a dynamic analysis on users' access con-
On Twitter and Instagram, users can only choose whether
trol usage based on the three-month consecutive data.
to enable their access control setting, i.e., protect their ac-
We find that a considerable amount of users change
count or not. Once a user enables her access control setting,
their access control setting frequently and there are
others who are not the user's approved followers cannot view
more users (especially female users and young users)
any of her information except for her profile photo, number
enabling their access control setting than disabling it.
of followers/followees and number of posts. In the follow-
When users disable the access control setting, they
ing analysis, we refer users who enable their access control
tend to become less active online and delete some of
setting as private users while others as public users.
their followers. Interestingly, we also find that impor-
To improve access control in OSNs, one important per-
tant festivals and events cause more users to disable
spective is to understand how users apply their access con-
access control setting.
trol in their OSN life. Several previous works [12, 8, 21, 13]have focused on the access control usage on Facebook. How-
• We apply machine learning techniques to conduct a
ever, to the best of our knowledge, there do not exist works
prediction on whether a user would enable her access
focusing on Twitter and Instagram.
As discussed above,
control setting or not. By combining users' online be-
these two OSNs deploy different access control schemes from
havior such as the number of followers, together with
Therefore, it is important and meaningful to
user demographics, our prediction experiments achieve
understand how users apply their access control setting on
a fair result in which the AUC (area under the ROC
Twitter and Instagram to protect their privacy.
curve) equals to 0.70. This indicates a user's accesscontrol setting can be predicted to a certain degree.
In this paper, we collect the access control usage data
The rest of the paper is organized as follows. Section 2
of New York users on Twitter and Instagram. Even though
introduces background information of Twitter and Insta-
the dataset of New York users is not a random sample of the
gram's access control schemes as well as the dataset used
global population, due to the diversity of New York users ,
for our study. Section 3 and Section 4 present static and dy-
we believe that our analysis should be indicative enough to
namic analysis on users' access control usage, respectively.
reflect users' access control usage in general.
Section 5 performs an access control setting prediction using
To identify users in New York, we leverage check-ins (user-
machine learning techniques. Section 6 discusses limitations
shared location information) on the two OSNs. Nowadays,
of this paper. Section 7 summarises related work and Sec-
many people use their OSN services on mobile devices, e.g.,
tion 8 concludes the paper with some future works.
80% of Twitter's active users are on mobile6. To adapt tothis trend, major OSNs add new functionalities to their mo-
BACKGROUND AND DATASET
bile versions, one of which is location sharing, namely check-in, through mobiles' GPS sensors. It is quite common for
Access Control in OSNs
users to share a photo together with the location where thephoto is taken. By exploiting check-ins to identify users in
Facebook, Twitter and Instagram are among the most
New York, we can ensure accurate results from our analysis.
popular OSNs at the moment. By September 2015, Face-
Moreover, it allows us to compare public and private users'
book has around 1.5 billion monthly active users with 83.5%
mobility behaviors as well (see Section 3).
of its users are outside the US and Canada2, while Twitter
To obtain users' check-ins, we first define a geo-coordinate
and Instagram have 316 million and 400 million monthly
bounding box covering New York region and then exploit
active users respectively. Besides the difference in size, the
Twitter  streaming API7 and Instagram REST API8 to
three OSNs are also appealing to different demographics
collect users' check-ins respectively. To make sure that the
and usage. Facebook is a general purpose OSN3 with users
users are locals in New York rather than visitors, we only
distributed more evenly to diverse ages, races and genders;
keep those users with more than 10 check-ins.
Twitter on the other hand is largely treated as a news source,
depicts a sample of check-ins in New York on Instagram.
also its percentage of users with high education and income
After identifying the users in New York, we use Twitter
is higher than those of the other two OSNs; Instagram is a
platform for users to share their life styles and its users are
more skewed to young people.
Table 1: Summary of the conducted analysis on Twitter and Instagram.
Figure 1: Check-ins in New York on Instagram.
REST API9 and Instagram REST API to extract users' ac-cess control setting together with some general information
Figure 2: Gender, race and age distributions of New
such as number of followers/followees and number of posts,
York users on Twitter and Instagram.
on a daily basis for nearly three months, from October 15th,2015 until January 12th, 2016. We regard accounts withmore than 2,000 followers as celebrities and those whose fol-
ternational competitions, it has also been exploited in other
lowers are 1,000 more than followees as business accounts,
works for detecting users' demographics, such as [20, 19].
and remove them from the dataset.
Figure 2 depicts gender, race and age distributions of our
For static analysis, we focus on the data collected on
users on Twitter and Instagram. As we can see, there are
November 12th with 175,202 users for Twiter and 292,406
more female users than male users on Twitter and Insta-
users for Instagram10. For dynamic analysis, we focus on
gram in New York, and the proportion of female is much
users that appear in our dataset everyday. In the end, we
higher on Instagram. In addition, as mentioned before that
get 155,387 Twitter users and 282,066 Instagram users11.
Instagram attracts more young users than Twitter, thus its
Note that when we exploit API to extract a private user's
users' age distribution is skewed to younger ages than that
information, Twitter allows us to access the user's profile
of Twitter users.
photo, number of followers/followees, and number of postswhile Instagram forbids all the access. Since we get users'
demographics through analyzing their profile photos, and
In this section, we perform static analysis on users' access
quantify their online behavior through their numbers of fol-
control usage. We start by checking the percentage of pri-
lowers/followees, and numbers of posts, we cannot conduct
vate users in our dataset, then analyze the relation between
analysis related to those information on Instagram users.
users' demographics and their access control usage. Users'
Table 1 lists the analysis we perform on the two OSNs.
online and offline behavior is discussed in the end. Here, a
Users' demographic information is another important as-
user's online behavior is quantified by her number of posts
pect of our analysis. To get users' demographics, we resort to
and followers/followees in OSNs, while offline behaviors are
Face++12, a state-of-the-art facial recognition service that
quantified by her mobility, i.e., check-ins. As mentioned in
detects a user's gender, race (Asian, White, African Ameri-
Section 2, we have no access to the demographic information
can) and age information from her profile photo. Face++ is
and online bahaviors of private users on Instagram, thus we
based on deep learning techniques and has won several in-
cannot perform static analysis on Instagram users' demo-graphics and online behaviors.
10We have analyzed data collected on other dates and the
analysis results are similar.
As shown in Table 2, the general percentages of private
Some users might delete their accounts or get suspended
during the three months, thus the number of users for dy-
users in our dataset are 5.22% for Twitter and 11.92% for
namic analysis is slightly smaller than the number of users
Instagram. This indicates that Instagram users pay more
used for static analysis.
attention to their privacy than Twitter users. The reason
could be the different purposes of using the two OSNs (see
Section 2): Twitter is treated as a news spreading medium,
thus its users are less likely to share personal sensitive in-
formation; Instagram, on the other hand, is a photo-sharing
OSN and photos can contain personal sensitive information.
Table 2: Statistics of public and private users.
% of Private Users
% of Public Users
% of Public Users
% of Private Users
Private User Percentage
Figure 3: Demographic distributions of Twitter users.
So far there does not exist official data from Twitter and
Instagram on their private users' percentages. Cha et al. 
claim that the percentage of private Twitter users is more
than 7% which is close to our observation. The slight differ-
ence can be due to the sampling methodologies. The dataset
in  is sampled through randomly picking user ids, while
our dataset focuses on users in New York. On the other
hand, the percentage of private users on Instagram is un-
% of private users
% of public users
% of public users
% of private users
clear from the literature. We emphasize that the focus ofthis paper is to understand how users exploit their accesscontrol in real life, the general percentages of private users
Figure 4: Demographic distributions of all users and
on Twitter and Instagram are certainly interesting but left
users whose ages are below 10 on Twitter.
as future work.
We further analyze users under 10 through their race and
gender. Compared with Figure 3, Figure 4 shows that the
Observation 1: Access control usage is different amongusers with different genders, races and ages. Female users,
percentages of private users have increased for both gen-
young users and Asian users are more likely to enable their
ders and all races. The percentage of female private users
access control setting than others.
increases 1.33 percents to 8.24%, while that of male usersincreases 1.84 percents to 5.99%. Furthermore, Asian users
Gender. We calculate private users' percentages of male
remain to have the most private users, with the percent-
and female users respectively, and find out that more female
age of private users increases about 2.1 percents to 8.3%.
users enable their access control setting than male users. As
Those two results coincide with the results in our analysis
we can see from Figure 3, 4.15% of male Twitter users enable
above that female users and Asian users are more concerned
their access control setting while the corresponding rate of
about their privacy. More importantly, we can see that users
female users is 6.91%.
who use children's photos in their profiles tend to be more
Race. Among people of three races in New York (see Fig-
ure 3), the private users' percentage of Asian users is the
As introduced in Section 2.2, we ex-
highest (6.20%) followed by White users (5.60%). African
tract a user's demographic information through recognizing
American users, on the other hand, have the lowest percent-
her profile photo with Face++. Therefore, if a user uses
age (5.22%). One possible explanation could be the culture
non-human pictures, such as a cat, in the profile, we can-
difference: Asian people are considered more conservative
not get her demographics14. Private users' percentages of
than White and African American people in general13.
Twitter users with and without demographics are listed in
Age. Figure 3 shows that for all Twitter users who are older
Table 2. Among 107,413 users with demographics, 6,066
than 10, the percentages of private users are decreasing when
(5.65%) users are private, while for 67,789 users without de-
the age grows.
This trend is especially notable for users
mographics, only 3,079 (4.54%) of them are private. This
aged from 20 to 40, which indicates younger people are more
indicates that users without demographics (not using human
concerned about their privacy than people of other ages.
photos) on Twitter care less about their privacy than those
Interestingly, the private users' percentages of users under
who use human pictures. The reason might be that using
10 years old (children) are high as well. Since children under
fake profile pictures makes users feel secure.
10 are less likely to be frequent Twitter users, we conjecturethat these users use children's photos in their profiles.
14By manually checking 100 users without demographics in
our dataset, we find that more than 90% of these users use
non-human pictures in their profiles.
the other hand, private users following less people is an in-teresting observation. This suggests that private users tend
to filter not only their followers, but also followees to ensure
their social circles to be less chaos.
Observation 3: Private users are more socially active than
public users in the offline world.
The mobility data we get from Twitter and Instagram
can be a good reflection of New York users' offline life. Ourmobility dataset is composed of users' check-ins, and each
check-in of a user tells us when and where the user is. In thefollowing, we conduct our analysis from these two aspects.
Time. Figure 6 depicts the distributions of users' check-intime on a daily base on Twitter and Instagram. Despite thedifferent distribution curves (Twitter users are more active
at late night and early morning), we can observe an agree-
ment between the two OSNs: compared to public users, pri-vate users are more active at night. As most offline social
Figure 5: Users' distributions of posted tweets (top-
activities happen at night rather than working hours, this
left), favored tweets (top-right), followers (bottom-
indicates that private users are more socially active in the
left) and followees (bottom-right).
Locations. Due to the different designs of the two OSNs'
APIs, we can extract the category information of each lo-cation for Instagram while not for Twitter. Here, location
Observation 2: Private users share more contents but have
category information on Instagram is from Foursquare, a
smaller online social circles than public users.
popular location-based social network, in which different lo-
Four metrics are exploited to quantify a Twitter user's
cation categories are organized into a tree structure15. In
online behavior, including the number of posted tweets, the
this paper, we take the first layer of the category tree (nine
number of favorites, the number of followers and the number
categories) to label each location, including entertainment,
of followees. The former two metrics can be used to evaluate
university, food, nightlife, outdoor, professional, residence,
the active level of each user on Twitter, while the latter two
store and transportation.
represent the size of each user's social circle.
Figure 7 depicts distributions of public and private users'
We use box plots  to visualize the distributions of four
check-ins over different location categories. It shows that
metrics for private and public users respectively (see Fig-
private users have more check-ins at food and nightlife places.
ure 5). Box plot, i.e., box and whisker diagram, is a stan-
Since many offline social activities happen at these two types
dardized way of displaying data distribution based on the
of places, this further confirms that private users are more
five number summary: minimum, first quartile (25%), me-
active in the offline world.
dian, third quartile (75%), and maximum.
From Figure 5, we observe that, compared with public
users, private users have published and favored more tweets.
Our static analysis focuses on three aspects including de-
On average, private users have posted 8,864.07 tweets and
mographics, online behavior and offline behavior. We have
favored 3,380.43 tweets, while public users posted 7,550.96
tweets and favored 2,277.58 tweets. There are two possibleexplanations for this result:
• Female users, young users and Asian users are more
concerned about their privacy than others;
• Private users publish more tweets, i.e., to express them-
selves, since they are aware that their privacy is guar-
• Private users publish more posts than public users, but
anteed to a certain extent;
have smaller online social circles;
• Users who have used Twitter for a longer period of
• In the offline world, private users are more socially
time are more likely to become private since they are
active than public users.
more aware of the privacy threats. Meanwhile, theirlonger Twitter-ages result in more tweets.
In Section 4, we perform further analysis on this from a
After the static analysis, in this section we study New
dynamic point of view.
York users' access control usage from a dynamic perspec-
Public users have more followers and followees than pri-
tive. Questions we attempt to answer include: how many
vate users (see Figure 5). On average, public users have
users have changed their access control setting; what is the
423.26 followers and 431.73 followees, while private users
changing trend; who are these users; what is the correlation
have 329.37 followers and 355.17 followees. This indicates
between users' changing of access control and other factors
that private users have much smaller social circles. Fewer
such as online behavior and global events?
followers may due to Twitter's access control scheme sinceprivate users have to give approvals to their followers. On
Figure 6: Check-in distribution over time on Twitter (left) and Instagram (right).
Table 3: Statistics of users' changing frequency.
check-in distribution 0.05
Figure 7: Check-in distributions over location cat-
egories on Instagram, each category is represented
by its first letter, e.g., F stands for food.
We start by checking the general statistics of users who
change access control setting, then focus on these users' de-
mographics. Next, the correlation between access control
changes and users' online behavior is analyzed. In the end,
we study the influence from global events and festivals on
users' decisions of changing access control.
Observation 4: A considerable amount of users' access
that users' privacy concerns are increasing day by day. Note
control usage is dynamic, i.e., they change their access con-
that similar reslts are obtained for New York  and Pitts-
trol setting from time to time. There are more users chang-
burgh  users on Facebook.
ing their access control setting from public to private thanfrom private to public.
Changing frequency. A considerable amount of users inour dataset have changed their access control setting during
Observation 5: Female users and young users change ac-cess control setting more frequently and have a faster chang-
the three months. On Twitter, 7,590 (5.21% of total Twit-
ing trend from public to private than others. White users
ter users) users have changed their access control setting,
change access control setting least frequently and their chang-
while the proportion on Instagram is much higher (19.95%
ing trend from public to private remains the slowest.
of 56,261 users).
Table 3 further presents the statistics of times that users
Changing frequency and demographics. The statistics
have changed their access control setting. Among all the
of both Twitter and Instagram16 users' changing frequency
Twitter users who have changed their access control, 54.44%
w.r.t. demographics is presented in Table 4, 6.52% of female
of users have changed more than once. On the other hand,
users and 3.66% of male users on Twitter, and 19.20% of
Instagram users seem to be more indeterminate on access
female users and 13.92% of male users on Instagram have
control usage: 69.09% of them have changed more than once
changed their access control setting.
In addition, female
during the three months. Moreover, 553 Instagram users
users change access control more frequently than male users.
have even changed more than 15 times.
Especially on Instagram, the average changing times for fe-male users is 3.60, while it is 2.93 for male users.
Changing trend. From the dataset, we have observed an
On Twitter, Asian users have the highest proportion of ac-
increasing trend of users enabling their access control set-
cess control changing (6.11%), while African American users
ting during the three months, i.e., more users change from
have the most frequent changing times, i.e., 2.40 times on av-
public to private than changing from private to public. OnOctober 14th 2015, 4.89% of Twitter users and 9.36% of
16As some public users with demographics on Instagram
Instagram users in our dataset are private, while on Jan-
change their access control setting to private during the
uary 12th 2016, the percentages have increased to 5.62%
three months, we can still study Instagram users' changing
on Twitter and 14.20% on Instagram. This result indicates
frequency and trend w.r.t. demographics here.
Table 4: Statistics of users' changing frequency on Twitter and Instagram w.r.t. demographics.
users changed (%)
average changed times
users changed once (%)
users changed (%)
average changed times
users changed once (%)
erage. On the other hand, 20.63% of African American usershave changed their access control setting on Instagram, but
Asian users have the most changing times, 3.84 on average.
On both Twitter and Instagram, White users are the most
determinate about their access control setting.
We discretize age into four bins and study users' chang-
ing frequency w.r.t. each age bin.
On both Twitter and
Instagram, younger users change their access control setting
more frequently. For instance, 18.09% Instagram users be-
tween 11 and 30 years old have changed at least once and
the average changing times is 3.74. While for users between31 and 45 years old, the two number is 13.14% and 2.82
respectively. In addition, users under 10 is the group with
the highest number of users who change their access control
setting freqently, this is consistent with our previous analy-
sis that users under 10, i.e., users using children's photos in
their profiles are more concerned about their privacy.
Changing trend and demographics. We further study
the changing trend of users w.r.t. demographics. As shown
in Figure 8a), female private users' percentage grows faster
than that of male users. On Twitter, the percentage of pri-
vate female users increases 0.94%, while that of private male
users is 0.72%. This trend is more obvious on Instagram,
private female users' percentage increases nearly 10% while
private male users' percentage increases about 8%.
Trends of enabling access control setting by users of differ-
ent races are exhibited in Fig. 8b). On Twitter, the propor-
tion of private African American users increases the slowest,
while on Instagram, it becomes the fastest. We believe it is
caused by the different purposes of the two OSNs.
The changing trend for users of different age (bin) is plot-
Figure 8: Changing trends of proportions of private
ted in Fig. 8c). On both Twitter and Instagram, the private
users based on their demographics in our dataset.
users' percentage of younger users increases faster than older
As we cannot get private users' demographics from
users. This accords with the result in Section 3 that young
Instagram in the beginning, thus the beginning pro-
users are more concerned about their privacy.
portion for Instagram users w.r.t. different demo-
graphics is approaching 0.
Observation 6: In general, users being private through allthe three months and users changing from public to private
ing 1) new tweets; 2) new favorites; 3) new followers; and 4)
tend to be less active in publishing new contents. Besides,
new followees, added daily17.
these users barely establish new relationships with others,
The comparisons between the constantly-public users and
and their followers become fewer. Moreover, topics of users'
constantly-private users w.r.t. four metrics of dynamic on-
posts on both OSNs are more (less) personal/sensitive when
line behavior are shown in Figure 9. Recall the observation
changing from public (private) to private (public).
in Section 3 that private users have more tweets (and fa-
Statistics of online behavior. We first refer users staying
vored tweets) than public users in general. Here, we find
private (public) within the three month as constantly-private
17Different from demographics, users' online behaviors are
(constantly-public) users, users who have changed their ac-
dynamic, for instance, number of followers may vary every-
cess control setting are named inconstant users. Based on
day. Thus, we cannot apply the same method for demo-
users' online behavior presented in Section 3, we design four
graphics to analyze Instagram users' dynamic online behav-
metrics to evaluate users' dynamic online behavior, includ-
ior in this section.
Table 5: Statistics of inconstant users' dynamic on-
Public to private
Private to public
California Gun Shot
Major Baseball League's
b) Social Network
Figure 9: Constantly-public and constantly-private
users daily added new tweets, favored tweets, fol-
lowers and followees.
that, on the contrary, constantly-private users have less new
California Gun Shot
and favored tweets everyday than constantly-public users on
average. In Figure 9a), both curves representing constantly-
Major Baseball League's
private users are below the ones for constantly-public users.
In Section 3, the two explanations why private users hav-
ing more tweets than public users include: users are morecomfortable to express themselves in the private context;
Figure 10: Differences between daily new private
private users have longer Twitter-ages, thus having more
users and daily new public users.
tweets. The result in Figure 9a) gives a strong support forthe second explanation, i.e., longer Twitter-age is the reasonwhy private users have more Tweets than public users.
start to query each inconstant user's posts through the cor-
We also find that constantly-private users barely establish
responding API one day before and after she changed her
new links with others, i.e., their average amount of daily new
access control setting, then aggregate posts of each user to-
followers and followees are very close to 0, while constantly-
gether as one document. Punctuations and stop words are
public users often have new followers and followees every
filtered out during the process. We then organize all the
day. This suggests that private users are more careful on
documents into a corpus, and remove words that appear in
choosing their followers and followees (similar to the sum-
less than 20 documents and more than 70% of the docu-
mary in Section 3).
ments . Note that for users who change from public to
Inconstant users' dynamic online behavior statistics are
private, we cannot get their published posts on both Twitter
presented in Table 5. It appears that users changing from
and Instagram. However, as users frequently change their
public to private have fewer newly posted and favored tweets
access control setting and some private users become pub-
than those changing from private to public. Moreover, in-
lic on the day we collect their published posts (January 21,
constant users changing from public to private are reducing
2016), we are able to extract topics from their posts when
their followers and followees. In addition, more followers are
they change from public to private.
deleted than followees (-0.15 vs. -0.04), which indicates that
Table 6 lists the top 3 topics for Twitter and Instagram
users' one purpose of enabling access control is, to some ex-
when users change their access control setting. We observe
tent, to protect themselves from being viewed by someone
that when users are public, their topics are not privacy-
from whom they are hiding sensitive information. In an-
sensitive, for instance, "happy, years, new" published during
other way, users are more concerned about privacy leakage
the New Year on Twitter and "follow, keep, coming" repre-
through who follows them than who they follow. This result
senting the popular hashtags on Instagram. On the other
reflects some fundamental differences between follower and
hand, when users enable their access control setting, their
followee relations on Twitter.
topics become more private, such as "family" on Twitter and
User topics. Next, we analyze posts (tweets for Twitter
"missing" on Instagram.
and captions of photos for Instagram) that users publish
Global Events and Festivals
before and after they change access control setting and checkwhether topics of users' posts have changed.
Observation 7: Global events and festivals cause more users
We exploit a classical topic modeling algorithm in the nat-
to change access control setting from private to public.
ural language processing field, namely Latent Dirichlet Al-
As stated before, the trend for users to enable their access
location (LDA)  to detect topics from users' posts. We
control setting is increasing, thus there should be more users
• Many users change their access control setting from
Table 6: Topics of users' posts one day before and
time to time. Instagram users change more often than
after changing their access control settings.
Twitter users. More users change from public to pri-
Public to private
Private to public
vate, showing that users become more concerned about
their privacy day by day.
• Female users and young users change their access con-
trol setting more frequently and their changing trend
from public to private is faster than others. Asian and
African American users behave differently on Twitter
and Instagram, while White users' changing behavior
is the least active on both OSNs.
• Constantly-private users are less active than constantly-
public users in terms of published posts and new fol-
lowers/followees. When users change from public to
Public to private
Private to public
private, they publish less tweets than users changing
from private to public, and delete their followers, their
posts' topics are more privacy-sensitive than before.
• Global events and festivals cause more users to change
access control setting from private to public.
ACCESS CONTROL PREDICTION
After analyzing users' access control usage, in this section
we investigate whether it is possible to predict a user's ac-
cess control setting. Being able to predict a user's access
control setting opens up opportunities for appealing appli-cations. For instance, OSNs can automatically assign accesscontrol setting to their users for better privacy protection;government can develop a privacy advisor to remind users
changing from public to private than from private to public
of their privacy leakage. Our prediction is based on users'
every day. However, when plotting the difference between
static information, by only using a user's information listed
daily new private users and public users (the number of new
on the OSN page, we aim to predict whether the user should
private user subtracts the number of new public users), we
enable access control setting or not.
have found several interesting dates on which many more
We model access control prediction as a binary classifi-
users changed from private to public than from public to
cation problem, and intend to solve the problem with ma-
private (see Figure 10).
chine learning classifiers.
We label private users as posi-
On three important festivals in the US, i.e., Thanksgiving
tive cases while public users as negative cases. For features
(November 26th, 2015), Christmas (December 25th, 2015)
used in classification, two models are constructed, namely
and New Year's Day (January 1st, 2016), more users disable
Model1 and Model2. Model1 exploits users' static online be-
their access control setting on both Twitter and Instagram.
havior including number of followers/followees, number of
This indicates that on holidays, users are more open and less
tweets and number of favorites as features for classification.
concerned about their privacy for the purpose of meeting
Model2 combines the features of Model1 with demographics.
new people and expressing gratitude.
In demographics, there are two categorical variables includ-
In addition, we find that some global events might cause
ing gender and race, we change them into dummy variables
more people to become public in OSNs as well. For instance,
for classification. Three machine learning classifiers, i.e., lo-
more users become public on November 13, 2015 (Paris ter-
gistic regression, random forest and gradient boosting, have
rorist attack) and on December 3rd, 2015 (California gun
been used to conduct prediction. ROC (Receiver operating
shot case). This is probably because users are more willing
characteristic) curve and AUC (area under the ROC curve)
to express their opinions when such events take place.
are used as evaluation metrics.
There also exists an obvious drop on November 1, 2015
on both OSNs, we believe this is due to the final match ofthe Major Baseball League's champion series between New
Table 7: AUC of prediction.
York Mets and Kansas City Royals held in New York. Even
though New York Mets lost the championship on that day,there are still New York users becoming public to commu-
nicate with other baseball fans on Twitter and Instagram.
In this section, we study dynamic usage of users' access
Table 7 lists the AUC for two models under each clas-
control in OSNs and have observed the following.
Our best prediction result (gradient boosting and
policies are defined by semantic web technologies. The au-thors of in [9, 2] propose to use hybrid logic as the policy lan-
guage, this logic has been demonstrated quite powerful and
later be used in several works including [22, 7, 14, 17, 6, 15].
Compared to the formal perspective, not many works fo-
cus on the empirical perspective of access control in OSNs.
True Postive Rate 0.2
True Postive Rate 0.2
Existing works include [12, 8, 21, 13]. Compared to these
works, this paper has the following advantages:
False Postive Rate
False Postive Rate
Figure 11: ROC curves for
We perform dynamic analysis on users' access control
Model1 (left) and Model2
(right) w.r.t. different classifiers.
usage within three consecutive months, which allowsus to study users' change from a daily perspective andprovide with more insightful conclusion on users daily
Model2) is fair, the AUC equals to 0.7018, which indicates
online activities. On the other hand, the dynamic anal-
that users' access control setting can be predicted to a cer-
ysis in [8, 21] is yearly-based, which can only provide a
tain extent. Model2 achieves a better result than Model1 in-
general trend of access control usage. For instance, the
dicating demographics' usefulness on separating public and
authors of  study users' access control setting once
private users. Figure 11 further depicts the ROC curves for
a year from 2005 to 2011 and discover that more and
Model1 and Model2, respectively.
more Facebook users in Pittsburgh enable their access
As we cannot get private users' demographics and online
control setting every year.
behavior information from Instagram's API (see Section 2),we only focus on Twitter users for access control prediction.
• This paper conducts a much more comprehensive study
than previous ones ranging from users' demographicsto online behavior. Besides, we are the first to analyze
the relation between access control and users' offline
In this section, we discuss a few limitations in our study.
behaviors (mobility information), topics of published
Dataset. The current work focus on New York users' access
texts and global events.
control usage. Even though the user sample is large (morethan 150k users for Twitter and and more than 280k users
• This paper is the first to show that it is possible to
for Instagram), there still exist some region bias in our anal-
use users' information to predict their access control
ysis. Meanwhile, knowing users being in New York allows us
setting to a certain extent. This result can potentially
to conduct some more interesting analysis, such as users' of-
lead to promising applications such as automatic ac-
fline behaviors (see Section 3) as well as a base ball match's
cess control enforcement and privacy advisor.
influences on users' access control changing (see Section 4).
• Our user sample is bigger than most of the previous
Social relation and access control. Section 4 concludes
works. We have more than 150k users for Twitter and
that when a user changes her access control setting from
more than 280k users for Instagram while the dataset
public to private, the user is more likely to reduce her num-
in  focuses on 200 users and the one in [21, 13] has
ber of followers. However, we haven't conducted the detailed
around 1,000 users. On the other hand, the authors
analysis on who are these users being deleted. One obstacle
of  use a bigger sample than us (1.4 million New
for this analysis is the restriction of the API: Twitter allows
York users on Facebook).
much less access to their users' social networks19, while In-stagram provides only a small number of followers/followees
Besides the above advantages, all of [12, 8, 21, 13] only
of a user each time20.
focus on Facebook while, to the best of our knowledge, thisis the first work to analyze users' access control usage on
Twitter and Instagram. As stated in Section 2, Twitter andInstagram have different types of users and functions com-
Access control in OSNs has attracted academia a consid-
pared to Facebook, thus it is very interesting and meaningful
erable amount of attention during the past decade. Many
to study their users' access control usage.
researchers have focused on modeling access control schemesin OSNs from a formal or logical perspective. Carminati etal.  propose three regulations for access control scheme in
CONCLUSION AND FUTURE WORK
OSNs, including social relation, distance in social network
We have conducted the first large-scale empirical study on
as well as trust level. The authors of  describe a two-
users' access control usage on Twitter and Instagram. Our
stage access control where, to access a resource of a certain
analysis focused on both static and dynamic perspectives.
user, one has to be able to reach that user in the social net-
We further demonstrated that users' access control setting
work and then requests the access. Besides modeling access
can be predicted to a certain extent.
control schemes, researchers have also proposed methods to
For the future work, we plan to conduct analysis on other
precisely define access control policies. In , access control
cities to check whether culture differences play a role in
18AUC is not sensitive to label imbalance problem and AUC
users' access control usage. Our access control prediction is
for random guessing is around 0.5.
only based on users' static information, we plan to explore
users' dynamic information to predict whether a user will
change her access control setting on a certain day by using
more sophisticated features in machine learning classifiers.
 J. Pang and Y. Zhang.
A new access control scheme for
Facebook-style social networks. In Proc. 9th Conference on
Minyue Ni and Weili Han are supported by NSFC (Grant No.
Availability, Reliability and Security (ARES), pages 1–10.
61572136). We thank anonymous reviewers for their comments.
IEEE CS, 2014.
 J. Pang and Y. Zhang. Cryptographic protocols for enforcing
relationship-based access control policies. In Proc. 39th An-
 D. Blei, A. Ng, and M. Jordan. Latent dirichlet allocation.
nual IEEE Computers, Software & Applications Conference
Journal of Machine Learning Research, 3:993–1022, 2003.
(COMPSAC), pages 484–493. IEEE CS, 2015.
 G. Bruns, P. W. L. Fong, I. Siahaan, and M. Huth.
 J. Pang and Y. Zhang. Location prediction: communities
Relationship-based access control:
its expression and en-
speak louder than friends. In Proc. 3rd ACM on Conference
forcement through hybrid logic. In Proc. 2nd ACM Con-
on Online Social Networks (COSN), pages 161–171. ACM,
ference on Data and Application Security and Privacy (CO-
DASPY), pages 117–124. ACM, 2012.
 J. Pang and Y. Zhang.
A new access control scheme for
 B. Carminati, E. Ferrari, R. Heatherly, M. Kantarcioglu,
Facebook-style social networks.
Computers & Security,
and B. Thuraisingham. A semantic web based framework
for social network access control. In Proc. 14th ACM Sym-posium on Access Control Models and Technologies (SAC-
 M. J. Paul and M. Dredze. You are what you tweet: Analyz-
MAT), pages 177–186. ACM, 2009.
ing twitter for public health. In Proc. 5th AAAI Conferenceon Weblogs and Social Media (ICWSM), pages 265–272. The
 B. Carminati, E. Ferrari, and A. Perego. Rule-based access
AAAI Press, 2011.
control for social networks. In Proc. IFIP WG 2.12 and 2.14
 M. Redi, D. Quercia, L. Graham, and S. Gosling. Like party-
Semantic Web Workshop (OTM), volume 4278 of LNCS,
ing? your face says it all. Predicting the ambiance of places
pages 1734–1744. Springer, 2006.
with profile pictures. In Proc. 9th AAAI Conference on We-blogs and Social Media (ICWSM), pages 347–356. The AAAI
 M. Cha, H. Haddadi, and F. B. K. P. Gummadi. Measuring
user influence in Twitter: The million follower fallacy. InProc. 4th AAAI Conference on Weblogs and Social Media
 F. Souza, D. de Las Casas, V. Flores, S. Youn, M. Cha,
(ICWSM), pages 10–17. The AAAI Press, 2010.
D. Quercia, and V. Almeida. Dawn of the selfie era: Thewhos, wheres, and hows of selfies on Instagram. In Proc. 3rd
 M. Cramer, J. Pang, and Y. Zhang. A logical approach to
ACM on Conference on Online Social Networks (COSN),
restricting access in online social networks. In Proc. 20th
pages 221–231. ACM, 2015.
ACM Symposium on Access Control Models and Technolo-gies (SACMAT), pages 75–86. ACM, 2015.
 F. Stutzman, R. Gross, and A. Acquisti. Silent listeners: The
evolution of privacy and disclosure on Facebook. Journal of
 J. Crampton and J. Sellwood. Path conditions and principal
Privacy and Confidentiality, 4(2):2, 2013.
matching: a new approach to access control. In Proc. 19thACM Symposium on Access Control Models and Technolo-
 E. Tarameshloo, P. W. L. Fong, and P. Mohassel. On pro-
gies (SACMAT), pages 187–198. ACM, 2014.
tection in federated social computing systems. In Proc. 4thACM Conference on Data and Application Security and Pri-
 R. Dey, Z. Jelveh, and K. Ross. Facebook users have be-
vacy (CODASPY), pages 75–86. ACM, 2014.
come much more private:
A large-scale study.
2012 IEEE International Conference on Pervasive Comput-
 J. W. Tukey. Exploratory Data Analysis. Pearson, 1977.
ing and Communications Workshops, pages 346–352. IEEE,2012.
 W. X. Zhao, J. Jiang, J. Weng, J. He, E.-P. Lim, H. Yan,
and X. Li. Comparing Twitter and traditional media us-
 P. W. L. Fong.
Preventing sybil attacks by privilege at-
ing topic models.
In Proc. 33rd European Conference on
tenuation: a design principle for social network systems.
IR Research (ECIR), volume 6611 of LNCS, pages 338–349.
In Proc. 32nd IEEE Symposium on Security and Privacy
(S&P), pages 263–278. IEEE CS, 2011.
 Y. Zhong, N. J. Yuan, W. Zhong, F. Zhang, and X. Xie. You
 P. W. L. Fong, M. M. Anwar, and Z. Zhao. A privacy preser-
are where you go: Inferring demographic attributes from
vation model for Facebook-style social network systems. In
location check-ins. In Proc. 8th ACM International Con-
Proc. 14th European Symposium on Research in Computer
ference on Web Search and Data Mining (WSDM), pages
Security (ESORICS), volume 5789 of LNCS, pages 303–320.
295–304. ACM, 2015.
 P. W. L. Fong and I. Siahaan.
control policies and their policy languages. In Proc. 16thACM Symposium on Access Control Models and Technolo-gies (SACMAT), pages 51–60. ACM, 2011.
 Y. Liu, K. P. Gummadi, B. Krishnamurthy, and A. Mislove.
Analyzing Facebook privacy settings: user expectations vs.
reality. In Proc. 2011 ACM SIGCOMM conference on In-ternet measurement conference (IMC), pages 61–70. ACM,2011.
 M. Mondal, Y. Liu, B. Viswanath, K. P. Gummadi, and
A. Mislove. Understanding and specifying social access con-trol lists. In Proc. 10th Symposium on Usable Privacy andSecurity (SOUPS), pages 271–283. USENIX Association,2012.
LOS JUDEOMARROQUÍES EN SUDAMÉRICA: una experiencia migratoria singular Juan J. Vagni, docente-investigador del Centro de Estudios Avanzados de la Universidad Nacional de Córdoba. Programa de Estudios sobre Medio Oriente firstname.lastname@example.org Diego Buffa, docente-investigador del Centro de Estudios Avanzados de la Universidad
Ang1-TURP Syndrome: a complication that can occur despite precautions S. BOUDARI, Y. ZARROUKI, O. CHOUKA, M. KHALLOUKI, MA. SAMKAOUI Service d'Anesthésie-Réanimation Hôpital Ibn-Tofail, CHU Mohammed VI, Marrakech Introduction: The TURP (transurethral resection of the prostate) syndrome is the most serious complication of transurethral resection of the prostate, it can be fatal. The incidence of TURP syndrome is decreasing, especially because of observance of requirements relating to the use of glycine, and utilization of technologic advances (laser techniques and bipolar circuitry). We report the case of a patient who presented a severe TURP syndrome following glycine irrigation despite the observance of all precautions of use. Case report: A 72-year-old man, followed for arterial hypertension under amlodipine, proposed for TURP for Benign prostatic hyperplasia revealed by lower urinary tract symptoms, and which the size of prostate is sonographically estimated 40 grams. The preanesthetic assessment has shown a patient with a good physical activity (more than 4 MET) and echocardiography, an abnormal relaxation pattern related to age and hypertension. Biological tests were correct, in particular Hb = 12.4 g/dL and natremia = 138 mEq/L. The procedure was performed under spinal anesthesia and consisted on a monopolar TURP. Irrigation of bladder made with a total of 6 L of 1.5% glycine with 1% ethanol at a pressure of up to 60 cm water. 35 minutes after the beginning of the procedure when the surgeon finalizing hemostasis, the patient became slightly disoriented, so the TURP syndrome was suspected, surgeon advised and irrigation stopped. Despite stopping of irrigation of glycine, evolution was marked by rapid clinical deterioration, with apparition in few minutes of a respiratory distress with crepitations on auscultation, hemodynamic instability (bradycardia, hypotension 70/40 mmHg) and then quickly occurrence of partial seizures of left upper limb. After this the patient was put under mechanical ventilation, correction of hyponatremia started by saline serum 3.3% and an internal jugular catheter was placed. Initial biological assessment showed : pH=7.31 PCO2 = 46.4 mmHg PO2 = 52.1 mmHg HCO3- = 23.5 mmol Na+ = 108.3 mmol/l K+ = 5.47 mmol/l After restoration of effective circulation, furosemide was given and the patient was transferred to surgical intensive care unit. The sedation was stopped and 2 hours later, extubation done in a patient respiratory and hemodynamically stable, persistent slightly confused. The hyponatraemia was slowly corrected to 132 mmol/l and the patient discharged day 3 from ICU with a good recovery especially neurological. Commentaries: In this clinical observation, the patient has presented a life threatening TURP syndrome, despite the small prostate size, the not elevated irrigation pressure and the short duration of resection. That illustrates how regional anesthesia is superior than general anesthesia, by allowing an early detection of any change in mental status, enabling an early recognition of the syndrome and avoiding thereby its expression by an intraoperative cardiac arrest. Under general anesthesia, the diagnosis of TURP Syndrome is difficult, generally delayed and the cardiovascular signs are prominent.