Privacy Governing Knowledge in Public Facebook Groups for Political Activism

Political activism is increasingly digital, following the rise of social media, and online social movements have proliferated (Kelly Garrett, 2006;Soon & Cho, 2014). Simultaneously, social media raises concerns about threats to privacy and questions about the vitality of privacy values (Marwick & boyd, 2014). As online communities have flourished, debate over appropriate information flows among users, as well as to platforms, service providers, and surveillance networks, has grown (Ellison, Vitak, Steinfield, Gray, & Lampe, 2011;Marwick & boyd, 2014). Facebook has received considerable scholarly attention (e.g., Acquisti & Gross, 2006;Mercea, 2013) in this debate. Social media use has been central in organizing not only resistance against repressive regimes, but also recent large-scale demonstrations in the United States responding to the election and administration of President Trump (Earl, 2019;Karpf, 2017). The convergence of politics with social media use amplifies the privacy challenges traditionally associated with political organizing (Breuer, 2016;Nam, 2012), particularly when marginalized groups and minority politics are involved (Stacheli, 1996). This paper reports detailed case studies of three recent political movementsthe Day Without Immigrants movement (DWI), the March for Science, and the Women's March -each of which relied heavily on social media, had similar political motivations, and occurred at the same time. These cases provide a fruitful basis for comparison to understand how political activists and social movements govern privacy on Facebook, including how other online platforms are employed when and where Facebook falls short or is deemed unsuitable in governing privacy.

The 21 January 2017 Women's March on Washington, along with the 672 other satellite marches across all seven continents, drew between 3 and 5 million people (e.g., Boothroyd et al., 2017). While focusing on women's issues, the Women's March became a venue for human rights concerns (Boothroyd et al., 2017;Fisher, Dow, & Ray, 2017). This movement originated from an individual's Facebook post proposing a march on Washington, DC and evolved into an organization advocating and informing about gender and equality issues in a historical moment of heightened opposition to misogyny and sexual violence (Fisher et al., 2017;Moss & Maddrell, 2017). The Women's March organization gained public support as it intersected with the #MeToo movement and continued to organize events and information campaigns, including the Women's Convention and recurring annual marches.

The 22 April 2017 March for Science drew on many existing advocacy networks, piggy-backing on and transforming an annual Earth Day observance in response to a post-truth era in which the legitimacy of science and objectivity increasingly are questioned and challenged in mainstream discourse. Worldwide, 1,070,000 people are estimated to have attended the April 2017 demonstrations (Milman, 2017). This movement employed Facebook to muster pro-science support and respond to perceptions of manipulation of scientific information and 'fake news' (e.g., Reardon et al., 2017). The March for Science movement has maintained visibility and continues to contest anti-science, anti-fact rhetoric in media and politics. However, the March for Science movement has not coalesced into a formal organization, because it was strongly supported by established organizations, such as the American Association for the Advancement of Science (AAAS).

DWI was primarily intended to illustrate the economic importance of immigrants and advocate for immigration reform on 16 February 2017. It also expressed opposition to the proposed border wall and to racial profiling (Robbins & Correal, 2017). It did not focus on a large-scale march in Washington, DC. Instead, demonstrations were held in 30 cities across the United States, and sympathizers elsewhere expressed solidarity through other forms of protest and boycotts. Some restaurants and businesses also closed to express their support (Robbins & Correal, 2017). DWI was highly decentralized and did not coordinate with pre-existing organizations, despite the existence of well-established immigration advocacy groups (e.g., Leitner & Strunk, 2014). Activities were organized through distributed networks of immigrants and their supporters, working to advocate and make their influence felt through a day in which they did not participate in the economy (e.g., Blitzer, 2017).

All three movements were catalyzed by a sense of urgent political opposition to the Trump administration. Each garnered significant support from some segments of the public and significant opposition from others, reflecting deep partisan divides in American society. Social media, including public Facebook groups and a patchwork of other tools and platforms, also played an enormous role in facilitating interactions between organizers and publicizing events for all three movements.

Social movements, and their online counterparts, are as much about constructing knowledge resources and combating misinformation with fact, in pursuit of their advocacy objectives, as they are about organizing the individual demonstrations for which they are best known (Diani, 2000;Earl, 2019). It is thus helpful to conceptualize them as knowledge commons.

Knowledge commons, defined broadly as community governance or management of intellectual or cultural resources, may be systematically studied through the governing knowledge commons (GKC) framework (Frischmann, Madison, & Strandburg, 2014). More importantly than the conceptual alignment, the GKC framework provides structure for empirical analysis, without adopting normative views about particular governance approaches, and facilitates diverse cross-case comparison and observation of patterns (Frischmann et al., 2014). Recent work (Sanfilippo, Frischmann, & Strandburg, 2018) integrates the contextual integrity (CI) conceptualization of privacy as appropriate information flow (Nissenbaum, 2009) with the GKC framework to explore how privacy values and practices serve as community governance institutions.

The GKC framework, depicted in Table 1, was inspired by Ostrom's Institutional Analysis and Development (IAD) framework, which considers how contextual factors shape interactions between actors and resources in various action arenas, thereby producing specific patterns of outcomes that may shape, reform, and reinforce the rules-in-use in a given context (McGinnis, 2011;Ostrom, 2011). Action arenas are characterized by the: resources in a given situation; values actors assign to situations or actions; ways information is acquired, processed, retained, and used; and decision-making processes (Ostrom, 2011). Rules-in-use are distinct from rules-on-the-books, encompassing a wide variety of formal and informal institutions, including values, strategies, norms, and enforceable rules (Crawford & Ostrom, 1995). Contextual rules-in-use emerge in both top-down and bottom-up ways, reflecting variations in participation and perceptions of legitimacy, which may differ between participants and outsiders (Sanfilippo et al., 2018).

The study of how privacy, as appropriate information flow, shapes the governance of knowledge creation and flow within communities is emergent. A meta-analysis by Sanfilippo et al. (2018) demonstrated the implicit influence of privacy in many previous GKC case studies. Yet, few of these studies addressed privacy explicitly and none, to our knowledge, explored privacy's implications for governance in depth. Thus, many open questions remain about how privacy impacts community participation or shared knowledge resources. The GKC framework, as supplemented by parameters from the CI approach to privacy as appropriate personal information flows, facilitates analysis of privacy's role in governance, emphasizing the following parameters within institutions: information contexts, the roles of information sender, recipient and subject, information attributes (or types), and transmission principles.

With complex arrangements of nested contexts, in which there are multiple centers of decision-making distributed across contexts, online social movements and activists with public Facebook groups are, by definition (McGinnis, 2011), polycentric. These cases exemplify why the GKC framework and the contextual integrity approach to privacy are valuable in concert, when exploring questions of privacy as governance. Facebook is both a background environment, in the sense that it supplies exogenous rules for information flow, and an actor, exercising power, making decisions, and distributing

. Who are the decision makers and how are they selected? Are decision-makers perceived to be legitimate? . How do nonmembers interact with the commons? What institutions govern those interactions? . Are there impacted groups that have no say in governance?

. What benefits are delivered to members and to others (e.g., innovations and creative output, production, sharing, and dissemination to a broader audience, and social interactions that emerge from the commons)? . What costs and risks are associated with the commons, including any negative externalities? . Are outcomes perceived to be legitimate by members? By decision-makers? By impacted outsiders?

knowledge flows in ways that may or may not be appropriate. Social movements are situated at the boundaries of social tensions and expose individuals and resources that have historically been embedded within crowds to identifiable exposure in online environments.

We studied three movementsthe March for Science, the Day Without Immigrants, and the Women's March. These case studies provide appropriate comparisons, given their similar uses of online tools and platforms, at the same point in time, with similar exogenous influences. We observe variations in governance of knowledge production, knowledge resources and personal information flow, in order to address the following research questions:

1. Does privacy govern knowledge resources in online collaborative arrangements? 2. How do concerns about personal information flows shape governing institutions and production of knowledge resources within activist groups? 3. Do institutional arrangements, governing appropriate flow of personal information, differ among public Facebook groups for activists? 4. How do social movements' rules-in-use address Facebook's platform level governance of privacy? 5. How does privacy governance on Facebook impact knowledge production in activists' public groups?

Data was collected from public Facebook pages using Capture for NVivo. Specifically, data was collected from 6 March for Science groups (Austin, TX; New Jersey; New York, NY; Princeton, NJ; Seattle, WA; and Washington, DC), 7 Women's March groups (Ann Arbor, MI; Atlanta, GA; Global, which represented all international events; Madison, WI; New York, NY; Princeton NJ; Washington, DC), and 8 DWI groups (Baltimore, MD; Elkhart, IN; Greenville, NC; Nashville, TN; Students; VA; WA; Washington, DC). We collected text from group level pages and a total of 494,911 posts: 4,352 from DWI, 294,201 from the March for Science, and 196,358 from the Women's March. Personally-identifiable information, such as names and profile pictures, were removed from the set to deidentify data.

We also conducted computer-mediated interviews of one decision-maker per group, as well as interviews with stakeholder group representatives from 3 groups, following up with member surveys. Informants for both interviews and surveys included adults who held decision-making roles in one of the target Facebook groups, including those who served as event Hosts and public Facebook group Creators; survey respondents also included other active Facebook participants.

For the interviews (n = 24), individuals with decision-making roles were identified from descriptions and contact pages within the original public Facebook pages; interviewees were recruited through direct messages to groups, rather than personal accounts. Recruitment messages included a description of the study and transparently identified the researcher's affiliation and purpose. Those who responded to recruitment were presented with a document to debrief them on the study protocol and solicit informed consent.

Interviews were conducted via Facebook video-chat, Skype or Google Hangouts, based on participant preferences. No video recordings were made and users consented to audio recordings to transcribe discussions; recordings were deleted following transcription. Interview questions were informed by the GKC Framework (Table 1), directing respondents through open-ended questions to elaborate on: who was involved in their group and in decision-making, descriptions of and the importance of knowledge resources, how Facebook and other platforms served as infrastructure for their group, governance strategies regarding privacy in participation and knowledge resources, and challenges they faced. Many questions addressed participants' perceptions of and experiences with tensions between governances imposed by platforms and groups' needs and preferences, including questions of legitimacy.

Surveys were also posted on the public pages of the groups we studied and shared by decision-maker recommendations. Participants completed a short survey with openended questions about issues of group governance associated with privacy and legitimacy; the full text is available (Author Citation). No questions were asked about individuals' names or identities, though responses were limited by restricting to one answer per IP address. Given the public nature of these groups, there was nothing preventing non-members from responding to the surveys. Respondents self-identified membership and affiliation, providing insight into relationships between communities and outsiders. Surveys were intended only to collect further qualitative input and not to obtain representative statistics. Survey responses (n = 30) came primarily from the March for Science community (n = 27), though detailed perspectives were provided by two Women's March participants and one DWI participant. While a small response rate, their answers to open ended questions provide interesting context and points of contrast to the hours of interview data collected.

All aspects of this research design, from human subjects' protocols to data storage and analysis, were fully reviewed by our university's Institutional Review Board (IRB) and determined to be exempted under Category 2. Despite this exemption, all best practices recommended by the IRB were followed, regarding responsible conduct for research and handling of data, such as encrypting user data and storing it through a password protected university Box account. As privacy scholars, we further sought to minimize collection and retention of personal information, both through de-identification of public data and by not collecting or recording names or other personal identifiers, beyond their roles in the communities studied, for interview or survey respondents.

NVivo was used to systematically analyze qualitative details; because our interview and survey samples are non-representative we did not subject them to quantitative analysis. Coding of interviews, survey responses, and public posts on group Facebook pages was structured by the GKC framework (Table 1), an institutional grammar (Table 2), and the privacy values taxonomy (Table 3), following Sanfilippo et al. (2018). The grammar provides a spectrum of institution types, ranging from unique and flexible strategies, to shared norms, to enforceable rules (Crawford & Ostrom, 1995), thus systematizing the analysis of institutional design rigidity. Note that within this paper, any reference to an 'institution' references a governance mechanism, never an organization. The taxonomy is helpful in exploring specific privacy institutionalisms, including forms of information collection, processing, dissemination, and invasion harms (Solove, 2006). Given that coding distributions were not sought, interrater reliability tests were not performed, though the authors discussed applications of each code for the first interview conducted and all survey responses collected. Our textual analysis of public Facebook discussions placed particular emphasis on privacy, information flows, and institutional legitimacy and development, present in 56,440 of the total 494,911 posts collected.

All three movements developed, aggregated, and shared information resources to: inform members, other participants, and the general public about the movements' objectives and events; share human interest stories and news coverage; and provide information resources for impacted populations. Knowledge resources were crucial to these movements. As an organizer for the Atlanta March for Social Justice and Women emphasized, knowledge resources fostered community building and provided visibility:

We shared a lot … our Facebook was a sounding board in the community, people shared resources themselves … the community page was the most important, I think … people shared contacts and opportunities for support or involvement, interest based … we connected to some other women's groups, social justice groups, and shared news, but it was really personal and community building. All of the organizers shared personal statements about why we were involved, with our pictures and stories, used media … it really spread nicely.

In creating and maintaining knowledge resources, groups handled large quantities of personal information, including member contact information and RSVPs to demonstrations. Other personal information emerged from public Facebook discussions, as individuals debated issues and told personal stories, or shared photos. All of these forms of personal information were central resources, enabling coordination, publicity, public engagement and more. It is also notable that concerns about truthfulness, which abound in this 'fake news' era, aligned with privacy concerns in this context. Groups sought not only to obtain correct contact information and ascertain RSVP quality, but also to ensure that personal stories were not used to spread lies and falsehoods. Organizers expressed worry that misinformation and propaganda could be created to target members or organizers and turn them into scapegoats for the fears and prejudices of those opposed to the movements, particularly white nationalists.

Groups affiliated with all three movements governed 'appropriate' personal information flows, shaping knowledge resources, primarily through rules and norms about use of the group's Facebook pages and other technologies, such as email. While knowledge resources shared and created on Facebook were important, all three groups also used inperson meetings and 'back channels' for organizing purposes because of the inefficiencies associated with large-group decision making. Only DWI, however, seems to have resorted regularly to more sophisticated privacy-enhancing technologies (PETs), such as encrypted messaging apps, Slack channels and, to a lesser extent, Snapchat. PETs facilitated and enhanced participation and protection of undocumented individuals, as well as establishing boundaries around information resources. Moreover, knowledge resources created using PETs are unavoidably and intentionally ephemeral, which is a critical tradeoff against sustainable, publicly accessible information resources.

Knowledge resources about participants differentiated members of movements and their satellite groups from other stakeholders and participants. In this sense, members include all how joined groups and RSVPed to events, thereby documenting their affiliation with specific groups. Contact information was a singularly important resource about membership, documenting participation.

Between groups, there was a partial consensus as to norms for generating, maintaining and securing RSVP lists and other contact information. All three movements used both public Facebook pages and EventBrite RSVPs to project march attendance. EventBrite did not support social engagement, but was considered to be a more accurate and private mechanism to predict attendance than Facebook. In the end, the attendance at mass events for all three movements outstripped the predictions from either source. As an organizer of the NYC Women's March explained, I really recommend that to people if they're doing their own event. Have multiple channels, even if they're different, have multiple channels. Because we had people registered through Facebook, and I think it was only 50,000. [laughter] And over 200,000 in EventBrite alone.

While contact information collection approaches were similar, two movements refused to share this information with outside groups, while the March for Science did share member contacts with supporting organizations. For example, DWI eschewed affiliations with outside groups in order to create a barrier to information flow about the identities of those who were involved (Author Citation). The Women's March, while affiliated with a large number of outside organizations, did not share member lists or contact information with partner organizations. The New York City Women's March group not only did not share contact information or other personally identifiable information about members, attendees, or subscribers with outside organizations, no matter how closely interests and objectives overlapped, but also did not accept information from other organizations. Instead, the group pursued shared objectives by publicizing events and information relating to its partner organizations, so that its own members could learn about opportunities and events without being contacted directly by those groups.

The New York City Women's March group went further, deleting contact and email information it had obtained for the 2017 march and asking individuals to affirmatively opt in to a new list in order to prevent anyone, under any circumstances, from obtaining and re-purposing that information. This decision, informed by information professionals among the membership, sent a strong signal about the group's resistance to surveillance and the value placed on individual autonomy in determining ongoing and future involvement with the Women's March movement and related organizations. As one key organizer explained:

… we needed to have a way of developing unique registrations, but at the same time, we're dealing with people involved in activism, and we want people to know that their information is secure, right? So, that's one reason we started using EventBrite, just to get the numbers. Now, the thing is, you don't have to put your real name in there. You don't even have to put in a real email address. You can put in an address, you know, that's a temporary one. People make those all the time … but, you know, it was a way for us to keep track … We had an opt-in process, after the march, for people [who] wanted to continue to receive email from us and then we destroyed the original database.

While organizational support mattered to the Women's March community, activist privacy was more important.

These approaches to sharing contact information were in stark contrast to the easy exchange of contact information between science and technology organizations and March for Science groups. For March for Science groups, sharing contact information with affiliated reputable professional organizations was deemed appropriate. One Women's March organizer, who was involved, to a lesser degree, in organizing a March for Science satellite march, traced these different treatments of contact information to 'an issue of trust in the powers that be. People who have been historically discriminated against don't trust the status quo in the same way that scientists who are respected professionals might. It's completely different.'

All three movements also accumulated personal information in the form of stories and other personal details, posted to humanize the issues and appeal to the public. However, there was a spectrum from transparent association of real identity with humanizing stories within the March for Science to complete dissociation or obfuscation of identity within DWI groups. The March for Science encouraged publicly recognizable scientists to share personal stories and commit to the movement. One March for Science organizer explained that 'it was best when we could get famous faculty to buy-in and talk, not just demonstrations and things for kids, but in a way that was more political, because it got attention and was … I guess, more credible.' While tenured scientists were encouraged to post personally identifiable narratives, junior scientists expressed fears about the employability implications of such identifiable involvement and were not pressured to do the same. Thus, they effectively used established figures and institutions as privacy shields, protecting graduate students, for example, who often worked behind the scenes even when they served in key organizational roles.

DWI groups, at the other end of the spectrum, were much more uniformly averse to sharing personal stories in ways that identified particular individuals or their immigration status. Public Facebook posts directly admonish individuals who shared friends' stories and persistent metadata reveals deleted posts preceding discussions of these issues, evidencing deployment of content moderation to control flows of identifiable information. Posted comments also include general warnings to be careful about posting information about immigration statuses, as well as extensive discussions among group members buttressing this norm. Facebook discussions and our interviews with organizers also included many expressions of fear and concern about what ICE and law enforcement might do with the personal information of any undocumented members who were publicly associated with the movement.

These fears and concerns were exacerbated by worries about Facebook's data collection and sharing policies. Potential participants were mistrustful of Facebook's ambiguous information sharing practices, which led many to question the legitimacy of Facebook or if it 'had their interests in mind' or 'would change whenever they felt like it.' For example, one organizer explained that while many wanted the visibility Facebook provided, many others felt it was unsuitable and would never directly use Facebook. Privacy concerns thus strongly affected the willingness of DWI supporters to formally affiliate on Facebook, as participants in the groups, or even to maintain Facebook accounts. Serious privacy concerns around immigration status skewed the visible demographics of the movement and shaped public-facing organizer roles. As one such organizer explained: discussing this with other activists around immigration, [who weren't] going to go on social media, but I could and did, and then it could get around to lots of other people. I found that that is the best way to share something, to get attention to a cause. These constraints on Facebook participation inevitably shaped the character and content of the information resources created by this movement.

Rather than taking extensive measures to avoid documentation of personal information or identities in Facebook posts, Women's March groups relied on safety in numbers and privacy through obscurity. Rules-in-use focused on tightly controlling images documenting the events and contact lists to promote and protect political obscurity. Some interviewees described a heightening of concerns, as the #MeToo movement unfolded, about privacy related to the stories told on the group's public Facebook pages. One Women's March interviewee noted that: we didn't really have strict rules about people disclosing personal information, sensitive stories or anything, but I'm getting worried about it, still moderating the group, with #MeToo, because I'll feel responsible when some weirdo decides to target someone because of what they've posted in our group, like the physical threat is real.

These comments parallel DWI members' privacy concerns related to the threat of deportation and other potential repercussions of disclosure.

All three of our case studies uncovered governance issues relating to photos and other visual resources. Groups were very concerned that participants might be identified from photographs posted on a group's public Facebook page. Most groups gladly accepted photographs that were shared by the individuals depicted in them. Some groups struggled, however, to determine how to manage photographs when they depicted individuals who had not consented to having the photo taken or shared. As one March for Science organizer explained:

You sort of expect to be seen when you go to a protest in a public place, but there is a sense of safety in a crowd. You're not the only one, but you can be singled out in a picture, and that becomes more complicated … especially when it's suddenly online forever. We get that this is a real career risk.

Privacy governance also shaped decisions about the preservation of photographic records of events and marches. The NYC Women's March was a leader, both in creating an archive of such images and in securing the photos on local machines or servers, rather than entrusting them to social media alone. Many other groups adopted practices based on the NYC Women's March.

In addition to privacy concerns, the creation and sharing of photographs and other visual knowledge resources sometimes raised questions about intellectual property and ownership, as one organizer of a Women's March satellite explained: You've got volunteers creating graphics for logos and banners and things … tee-shirts … And those people aren't savvy enough to negotiate the rights to that stuff, so then you have weird rights issues that come up. Umm … there's navigating that whole nightmare, then, umm … and something we're still navigating, is that we had a whole group of photographers taking pictures. Umm … and we were lucky, in that our lead, the leader of the photographers got written agreement with the group of photographers that we had, to get the rights for use of those images collected.

Privacy governance was in tension between institutions imposed by infrastructure and those in-use by groups, reflecting polycentric arrangements of institutions. The movements operated within an overarching legal and regulatory context regarding freedoms of association and expression, as well as market considerations. Facebook and other platforms, including EventBrite and Slack, provided infrastructure for these movements, embedding technological constraints on institutional arrangements. Within these background environments, individual groups created their own formal and informal institutions, which alternatively abide, work around, or contradict the constraints placed upon them within the nested structure.

All three movements were very public, allowing those who did not want to join in an identifiable way to still make use of the group's knowledge resources and participate in online discussion. From lurking to participation by proxy, there were a number of ways to consume or contribute without identifiably becoming a member. As alluded to with respect to contact information, not all stakeholders were documented as participating by formally joining groups or RSVPing. Yet many forms of participation are linked to knowledge resources, highlighting the co-emergence of communities with knowledge resources and the importance of participatory privacy as governance (Author Citation). Furthermore, most participants were not decision-makers relative to governance of these movements or their knowledge resources.

There were no formal or informal expectations that all participants would contribute information or actively assist with organizing, though there were informal expectations that participants should publicize and share event details and information resources that were generated by the more active participants. Despite this openness, the logic, as well as the process, of decision-making in these groups was usually informal and non-transparent. For groups at the national level, as well as large satellites in NYC and Seattle, the lack of transparency was at least partially attributable to the ineffectiveness of involving too many people in organizing and decision-making. For smaller satellite groups, lack of transparency often stemmed from the fact that only one or two individuals made most decisions. Because much of the decision-making process in these groups occurred offline, information about specific governing institutions comes from FAQs and interviews. In this sense, the strategies, norms, and rules-in-use that structured these movements and flows of personal information were often implicit and non-transparent. For example, despite the pervasive norm not to share photographs from events without permission of all captured in an image, as alluded to relative to our discussion of photographs as resources, no group clearly identified this as a governing institution on their public Facebook page and fewer than half (9 of 21) stated this in their FAQs. Nonetheless, decision-makers from 19 of 21 groups identified this as an important norm governing flows of images.

In spite of this lack of transparency, data do not reveal significant controversy about the legitimacy of organizer governance and decision-making in these grassroots groups. Though there was debate about particular choices, we did not observe complaints about movement governance in the Facebook data, nor did we uncover major legitimacy concerns in our interviews. The exception to this generalization is that there was very public criticism relating to the diversity of leadership of the national Women's March group (Rose-Redwood & Rose-Redwood, 2017). In contrast, there were significant concerns about the legitimacy of Facebook, which is discussed in the next section.

Rules-in-use were communicated and enforced, across movements, through informal discussion or chiding and through content moderation of Facebook discussions. As an example of one such governing institution enforced in context, rules against disclosing someone else's immigration status were enforced by deleting posts and admonishing the offender, both in public and through private messages within DWI groups. There were generally no other mechanisms for sanctioning violations of rules-in-use or resolving conflicts between members or between members and outsiders.

Content moderation by group organizers provided a centralized, though ad hoc, enforcement mechanism. Admonitions to mind norms about civil conversations were actively enforced through heavy moderation. The remnants of content moderation are easily evident on the public Facebook pages of some groups. For example, of 4,352 posts associated with the seven DWI groups that we studied, only 3,946 still have readable text, indicating that 406 have been deleted. Timestamp and post ID, without a post, remain downloadable through the API after a post is deleted. In some cases, it is possible to infer what the post may have discussed, by looking at responses that are still visible on the page.

Content moderation practices were frustrating to some good-faith participants, who did not understand the implicit expectations underlying these ad hoc enforcement strategies, yet faced explicit consequences when their posts were removed by moderators. Moderators often simply deleted posts that they thought did not reflect community standards, though occasionally, organizers would articulate expectations explicitly and give participants an opportunity to edit their posts, with deletion serving as a last resort.

While there was little explicit discussion of rules or norms within Facebook groups or other public platforms, there were discussions and informal enforcement of rules-in-use involving civility, citation to authority, and privacy. Violations of civility norms were often called out explicitly (e.g., 'yes, i'm sorry it is a little condescending, please edit that out if you could or i'll delete it when i get back:) your heart is in the right place but no human is superior than another human'). Norms requiring citation to authority, preserving the quality of information resources were reflected in requests to provide references or sources in order to back up claims (e.g., 'I didn't see that. Where did you read that? I'm not saying it isn't true, but … ') or assist other members (e.g., 'can you share those details').

While the term 'privacy' was used infrequently on Facebook, appropriate personal information flows were often addressed in FAQs and discussions. Interviewees cited their movements' privacy values very confidently, even when they had not discussed them explicitly with others in the group; I'm not sure … I … as we have talked, this idea has come to me, but it's not something we decided on … I think we are informal and local, loose connections to other immigrant groups, because it provides privacy and keeps people safe. Some specific rules-in-use about personal information were discussed prominently on the Facebook pages, including those against oversharing in light of threats associated with disclosure outside of the group (e.g., 'Everybody: Don't share immigration statuses. Privacy settings don't hide comments. It's a public group.'). Questions about appropriateness were also common on Facebook, for example 'should we really post pictures? there is no expectation of privacy at a public event … ' (Facebook post).

Additional exogenous governance was embedded in platforms, providing top-down ruleson-the-books that frequently presented challenges to be addressed through competing and innovative rules-in-use, developed endogenously within groups. For example, Facebook provides different affordances and information asymmetries for events created by individuals and those created by organizations, with organizational pages providing more flexibility, but individual pages providing more information. Organizers for one Women's March satellite emphasized that they had no idea that having an individual host their event, rather than creating a group from the onset, would create problems when it turned out that the creator of the local group underestimated interest by orders of magnitude. Default settings and information constraints on groups and events involving more than 1,000 people are examples of choices with unexpected ramifications, given how little organizers knew about Facebook's functionality. Groups across all three movements ran into problems when event pages for satellite marches were created by individuals, rather than groups, and did not accommodate adding the number of organizers necessary to adequately manage group or event scope. It was also impossible to migrate members and participants to a new group better configured to their needs. Multiple organizers reported that they had resorted to sharing log-in credentials to get around these constraints to share moderation and FAQ duties.

While groups were sometimes stymied by unhelpful or confusing platform constraints, they often created institutions to circumvent or contradict such constraints and govern flows of personal information. For example, groups used EventBrite, which permits registration using single-use email addresses, to work around the limitations of Facebook event RSVPs, or used offline, ephemeral or encrypted channels for more sensitive communications. Thus, while platform design and default settings impose constraints, groups have used work-arounds or parallel communication technologies to develop rules-inuse that align with community objectives. Such unique strategies and shared norms, as institutions in practice, allow groups to capitalize on the advantages of Facebook, while mitigating its risks and challenges.

Facebook was not sufficient to meet movements' needs. Even when groups created rules-in-use for appropriate flow of personal information among Facebook users and other members of the public, Facebook retained context and metadata about deleted posts from which we could make significant inferences. This information (and much more) is retained by Facebook, despite organizers' moderation of these pages to remove inappropriate flows of personal information. Facebook was perceived to undermine groups' privacy enforcement.

Organizers and participants expressed concerns about what Facebook might do with personal information. As one DWI organizer explained: I think Facebook makes a lot of decisions that don't make people happy, that may not … well affect people, about their privacy, but most of that is not special to us. What is different, what is important and maybe a problem, is how Facebook works with law enforcement, with ICE. I don't know, really, what happens … I don't think they have to tell us, but people talk and people are afraid … Many individuals, across movements, expressed doubts about the legitimacy of decisions by Facebook about their groups' information. There was also entrenched distrust regarding whether Facebook would adhere to its stated policies; 'We agree to Facebook when we use it, but they don't always do what they say and it changes' (March for Science participant, survey response).

While Facebook's limitations and constraints were significant, most organizers believed that it was necessary to use Facebook, despite its downsides, because of the benefits of its social capabilities. They simply did not see any alternative. Moreover, in the end, Facebook played an important role in these contemporary social movements because these movements adopted governance institutions that allowed them to use Facebook successfully to pursue their goals.

While many, including informants for this study, would want normative suggestions and definite best practices from this work, the scale and frame of this study do not lend themselves toward prescriptive generalizable principles for online organizing. However, future social movements can benefit from the implications from choices illustrated in these cases. For example, insight into how choices about who creates an event or particular configurations interact with constraints associated with public Facebook groups can facilitate informed community design and platform use, allowing communities to move beyond governance by default settings. Furthermore, privacy practices shared within and across movements descriptively suggest emerging best practices that might be of broader value.

First, and most broadly accepted, using multiple platforms, particularly for predicting turnout through RSVP functions and in generating and protecting email lists or other contact information, appears to have been a key to success. Using multiple platforms allowed groups to reach communities with shared interests, but diverse privacy concerns, as well as to triangulate.

Second, groups coalesced on a policy of archiving photographs on private servers (perhaps with secure cloud back-up), regardless of whether they deemed it appropriate to host them on a commercial public platform. Many groups also backed up contact lists on private servers, though this was not pervasive, and at least one group notably deleted all of this information after the march.

Third, all three movements adopted content moderation as a mechanism to manage contention and enforce norms within public online spaces, though the extent of moderation and the underlying rationales differed. While some groups were concerned primarily about removing hate speech or fake information, others were more concerned about maintaining their carefully constructed messaging; whatever the reason, groups across these movements determined that some content control was important to their specific goals and maintaining civil spaces for political discourse.

Fourth, efforts were made to protect the personal stories and prevent identifiability of vulnerable members. Thus, though scientists perceived as public intellectuals were encouraged to disclose personal stories, junior scientists were not. Similarly, groups evolved norms to avoid disclosing individuals' immigration statuses or the identities of women in vulnerable situations, often associated with sexual harassment or domestic violence.

This study illustrates how privacy shapes and structures the resources and practices of contemporary political organizing, which increasingly takes place online. Furthermore, it identifies key links between privacy, as appropriate flow of personal information, and discussions about information or knowledge quality. Issues of control, identifiability, and aggregation of personal information are closely coupled to issues of deception through and trust in knowledge resources.

The GKC provided a useful lens through which to explore how grassroots political organizing in public online spaces functions, including privacy as governance, by structuring our analysis around actors, knowledge resources, and the emergence of social governance in context. While individual cases have limited generalizability, the GKC framework is theoretically rich, integrating knowledge commons, contextual integrity, and the taxonomy of privacy challenges and values to structure inquiry and facilitate comparison for long-term, aggregated analysis. In this case, numerous norms and strategies were revealed in complex and diverse contexts; the polycentric nature of governance arrangements was also made visible.

Specifically, movements had unique needs, which generated patterns, but individual groups' efforts to structure their communities appropriately illustrated creative ways of interacting with platforms such as Facebook. Differences in choices about platforms, and of arrangements of tools and configurations within those platforms, illustrated experimentation and context specificity. Groups employed both relatively public platforms and highly privacy protective technologies, to protect privacy appropriately for communications of different types and purposes. Facebook is somewhat limited as a tool for political activism.

Privacy is evident within all three movements as governance of participation norms, diverse information sharing and collection institutions, and technology use norms and strategies. Furthermore, results provide evidence that privacy is a key aspect of commons arrangements, as suggested in previous analysis. The March for Science, the Women's March, and the Day Without Immigrants movements all illustrate political organizing within commons arrangements, despite their differences in organizational influence, polycentric institutional arrangements, scale of participation, and nature of concerns about personal information flow. Despite these differences, some consistent patterns of practices for organizing online, including within public Facebook groups, emerge. Finally, we note that the structure of Facebook, as one component of polycentric arrangements and as a key platform in these cases, directly impacts the institutional arrangements developed within groups and the organizing practices that emerge within these grassroots movements. Participants in all three movements perceived some aspects of Facebook to be problematic, yet saw no alternative because of its social features and prevalence.

No potential conflict of interest was reported by the authors.

Madelyn Rose Sanfilippo is a Postdoctoral IT Policy Scholar at the Center for Information Technology Policy at Princeton University and a former fellow of the Information Law Institute at NYU. She empirically studies governance of sociotechnical systems, as well as outcomes, inequality, and consequences within these systems, through mixed method research design. Her forthcoming book, Governing privacy in knowledge commons (co-edited with B. Frischmann and K. Strandburg, 2020), examines privacy as governance, as well as rules-in-use designed to support appropriate flows of personal information in a diverse series of case studies. Katherine J. Strandburg, Alfred Engelberg Professor of Law and Director of the Information Law Institute at NYU, is an expert in information law, patent law and innovation policy. Her research considers the legal and policy implications of automated decision-making algorithms, of user and collaborative innovation, and of the interactions between innovation and privacy regulation. Her forthcoming book Governing privacy in knowledge commons (co-edited with B. Frischmann and M. Sanfilippo, 2020), continues her investigation of knowledge commons, developed throughout her earlier work in Governing medical commons and Governing knowledge commons.

Madelyn Rose Sanfilippo http://orcid.org/0000-0002-7705-6753