Now another prominent Googler has train-hopped to the popular social-networking company as well. As first reported by BoomTown, Elliot Schrage, vice president of global communications and public affairs at Google, is leaving the search sovereign to become Facebook’s vice president of communications and public policy.

“[Elliot Schrage] will be responsible for developing the key messages we want people to understand about our products, our business and the growing global importance of social networking and what we do,” Facebook CEO Mark Zuckerberg said in an email to employees announcing the hire. “The goal here is to help people understand how the Internet can strengthen people’s relationships. Elliot will direct our efforts to work with users, media, governments and other entities around the world to ensure that Facebook’s policies are transparent, responsive, effective and are recognized as being those things. … This is a really important role for us and one that we’ve been trying to find the right person for a while. Elliot’s role will be critical to helping us scale based on our culture that values transparency, openness and honest internal communications.”

“Elliot’s role will be critical to helping us scale based on our culture that values transparency, openness, and honest internal communications”?

Clearly, Zuckerberg meant “build from the ground up a culture that values transparency, openness and honest internal communications.” Because it’s only been about six months since the Beacon fiasco, which demonstrated how grievously the company was lacking in those qualities (see “DiaperFetishFactory.com Is Sending a Story to Your Profile,” “Epicurious Has Added a Potential Privacy Violation to Your Facebook Profile,” “Fiascobook,” and “Fiascobook, Redux“).

Perhaps if Facebook recruits enough former Googlers, it too will be able to lay claim to a silly informal motto like “Don’t Be Evil.”

The ability to control how much information is available to the public has long been one of Facebook’s core principles. It was this very feature, for example, that Facebook used to distinguish itself from other social networks back when it first launched.

Of course, the ensuing years proved that protecting the privacy of its users was not exactly Facebook’s strong suit–especially when it came to digging up the advertising revenues necessary to justify its fantastical $15 billion valuation. There have been privacy issues with Facebook’s news-feed service, with its controversial Beacon advertising system, and with its terms of service, which granted popular applications access to far more personal user data than is necessary.

And now there’s another. A bug in permission restrictions in Facebook Groups allows members to upload content without first receiving permission from a Group admin. I know this firsthand, because over the past few days videos, photos and blog posts have been appearing on the All Things Digital Facebook Group, and neither Walt, Kara nor I–the only three people with admin privileges to the group–put them there (see screen below). Worse, while I was able to delete the photos and blog posts, I was unable to pull the videos off the page. There was no mechanism to remove them.

Worse still, the bug that makes this possible is not specific to the All Things Digital Facebook Group alone. It affects all Facebook Groups, site-wide.

We alerted Facebook to the issue and the company quickly identified the bug. Said spokesperson Brandee Barker: “Engineering has pushed out a fix that should go site wide shortly.”

UPDATE: Facebook engineers fixed the permissions bug, and we were able to remove the rogue videos from our page.

Today brings news of the first lawsuit over the service and, oddly enough, it wasn’t filed against Facebook. It was filed against Blockbuster. Facebook member Cathryn Elaine Harris is suing the video chain Blockbuster (BBI) for its participation in the Beacon program. Her complaint alleges that Blockbuster violated the federal Videotape Privacy Protection Act when it shared information about her movie rentals and sales with Facebook without her consent. It seeks class action status and $2,500 for each violation of the 1988 statute.

According to a new study from the University of Virginia, many of Facebook’s most popular applications access far more personal user data than is necessary. From the study:

We performed a systematic review of the top 150 Facebook applications in October 2007 and examined their information needs. We found that 8.7% didn’t need any information; 82% used public data (name, network, list of friends); and only 9.3% needed private information (e.g., birthday). Since all of the applications are given full access to private data, this means that 90.7% of applications are being given more privileges than they need.”

And what sort of user data are we talking about here? Pretty much all of it, according to the company’s terms of service.

In order to allow you to use and participate in Platform Applications created by Developers (”Developer Applications”), Facebook may from time to time provide Developers access to the following information (collectively, the “Facebook Site Information”). … Examples of Facebook Site Information: your name, your profile picture, your gender, your birthday, your hometown location (city/state/country), your current location (city/state/country), your political view, your activities, your interests, your musical preferences, television shows in which you are interested, movies in which you are interested, books in which you are interested, your favorite quotes, the text of your “About Me” section, your relationship status, your dating interests, your relationship interests, your summer plans, your Facebook user network affiliations, your education history, your work history, your course information, copies of photos in your Facebook Site photo albums, metadata associated with your Facebook Site photo albums (e.g., time of upload, album name, comments on your photos, etc.), the total number of messages sent and/or received by you, the total number of unread messages in your Facebook in-box, the total number of “pokes” you have sent and/or received, the total number of wall posts on your Wall™, a list of user IDs mapped to your Facebook friends, your social timeline, and events associated with your Facebook profile.”

Quite a list–and one that the social network’s users could recall the next time Facebook asks them to agree to “allow this application to … know who I am and access my information” …

“Once every 100 years, the way that media works fundamentally changes,” Zuckerberg stated … (kidding ….)

“We simply did a bad job with this release, and I apologize for it,” he wrote. “…When we first thought of Beacon, our goal was to build a simple product to let people share information across sites with their friends. … At first we tried to make it very lightweight so people wouldn’t have to touch it for it to work. The problem with our initial approach of making it an opt-out system instead of opt-in was that if someone forgot to decline to share something, Beacon still went ahead and shared it with their friends. … It took us too long after people started contacting us to change the product so that users had to explicitly approve what they wanted to share. … Instead of acting quickly, we took too long to decide on the right solution. I’m not proud of the way we’ve handled this situation and I know we can do better.”

And the company is trying. Today it released a privacy control to turn off Beacon completely. Said Zuckerberg, “If you select that you don’t want to share some Beacon actions or if you turn off Beacon, then Facebook won’t store those actions even when partners send them to Facebook.”

That’s a pleasant assurance, but one that some say doesn’t go nearly far enough. “So essentially he’s saying the information transmitted won’t be stored but will perhaps be interpreted,” writes Om Malik. “Will this happen in real time? If that is the case, then the advertising ‘optimization’ that results from ‘transmissions’ is going to continue. Right! If they were making massive changes, one would have seen options like ‘Don’t allow any Web sites to send stories to Facebook’ or ‘Don’t track my actions outside of Facebook.’ ”