  Most social platforms offer mechanisms allowing users to delete their posts,
and a significant fraction of users exercise this right to be forgotten.
However, ironically, users' attempt to reduce attention to sensitive posts via
deletion, in practice, attracts unwanted attention from stalkers specifically
to those posts. Thus, deletions may leave users more vulnerable to attacks on
their privacy in general. Users hoping to make their posts forgotten face a
"damned if I do, damned if I don't" dilemma. Many are shifting towards
ephemeral social platform like Snapchat, which will deprive us of important
user-data archival. In the form of intermittent withdrawals, we present, Lethe,
a novel solution to this problem of forgetting the forgotten. If the
next-generation social platforms are willing to give up the uninterrupted
availability of non-deleted posts by a very small fraction, Lethe provides
privacy to the deleted posts over long durations. In presence of Lethe, an
adversarial observer becomes unsure if some posts are permanently deleted or
just temporarily withdrawn by Lethe; at the same time, the adversarial observer
is overwhelmed by a large number of falsely flagged undeleted posts. To
demonstrate the feasibility and performance of Lethe, we analyze large-scale
real data about users' deletion over Twitter and thoroughly investigate how to
choose time duration distributions for alternating between temporary
withdrawals and resurrections of non-deleted posts. We find a favorable
trade-off between privacy, availability and adversarial overhead in different
settings for users exercising their right to delete. We show that, even against
an ultimate adversary with an uninterrupted access to the entire platform,
Lethe offers deletion privacy for up to 3 months from the time of deletion,
while maintaining content availability as high as 95% and keeping the
adversarial precision to 20%.
