Hypocrite FCC Commissioner Cheers On Zoom Block Usage By Person He Disagrees With; While Insisting Social Media Shouldn't Block People

from the want-to-try-that-again-brendan? dept

FCC Commissioner Brendan Carr has been first in line to gleefully pump up the still-unsubstantiated-by-any-evidence claim that social media companies are "unfairly censoring conservatives." In fact, he's been very vocal about the idea that social media should not be blocking anyone for their political beliefs. Just a few months ago he attacked "conservative bias and threats to free speech on the internet," saying that "doing nothing is not the answer." He's complained loudly about when Twitter briefly banned an infamous Twitter troll/Republican political operative for harassment, saying (falsely) that it was "censorship on social media and an attempt by social media "gatekeepers" to "launch a war on memes so they can control the 2020 narrative." No, dude. It was Twitter following its rules against harassment.

Oh, and here's my favorite. Back in 2016, he happily quoted his then-boss Ajit Pai saying "the impulse to squelch free speech on college campuses is anything but progressive."

Can you take a wild guess where this is heading? I know that you can.

Last week there was yet another hyped up culture war nonsense thing, when some conservative websites started freaking out that two faculty members at San Francisco State were planning to host a webinar/roundtable conversation with one of the participants being Leila Khaled, considered to be the first woman to hijack a plane. She hijacked two planes -- one in 1969 and one in 1970 -- as part of the Popular Front for the Liberation of Palestine. In 1997 (many years later) the State Department designated the PFLF as a foreign terrorist group.

This resulted in many arguing that merely allowing Khaled to speak with students was somehow a violation of laws against material support for terrorists. This is wrong. Some people point to the ruling in Holder v. Humanitarian Law Project, in which the Supreme Court (somewhat awkwardly) upheld the law against material support for terrorism, saying that groups that were seeking to support humanitarian or legal projects associated with terrorist groups could not do so.

But that's not what's happening here. This was just some professors hosting a Zoom call. As FIRE points out, there does not seem to be any realistic way to argue that Khaled being on a Zoom call violates the law:

The Lawfare Project went further, calling on the U.S. Department of Justice to “take appropriate action” against the SFSU faculty members for hosting the discussion and Zoom for broadcasting it, alleging that the discussion amounts to material support for terrorism in violation of federal law. Rep. Doug Lamborn joined this call, asking United States Secretary of Education Betsy DeVos and Secretary of the Treasury Steven Mnuchin to open investigations into — and cut all federal funding to — the university, arguing that Khaled cannot be given a “platform” because it is “aiding the dissemination of terrorist propaganda” and is “not speech or academic inquiry.”

That’s unlikely. First, we’re not aware of any indication that Khaled will be compensated for her virtual appearance, meaning the only conceivable “support” provided is the virtual forum for the discussion — in other words, speech. The Supreme Court’s pronouncement on the intersection of the First Amendment and “material support for terrorism” laws — Holder v. Humanitarian Law Project— is muddled, but focused on the “fungible” nature of the training provided to prohibited organizations, as it allowed the organizations to become more efficient. But the Court also pointedly noted that the law does not prohibit being a member of the organization, just providing it with “material” support. In other words, association — even membership — with an organization is protected by the First Amendment.

Second, Holder should not be read to enshrine no-platforming into federal law. Universities should be places where students and faculty can discuss — and hear from — people whose acts or views may be controversial or unlawful. Students and faculty members must remain free to invite speakers — whether they agree with them or not — without fear of censorship or punishment by administrator, bureaucrat, or politician. The First Amendment extends a right not only to speak, but also a right to hear or receive information. This right makes no exception for people who have engaged in misdeeds, criminal activity, or membership in blacklisted organizations. Indeed, in Kleindienst v. Mandel, although the First Amendment did not require the federal government to grant a visa to a communist speaker, the Supreme Court said it was “loath” to hold that the ability of students and faculty to hear from the speaker by telephone was sufficient to override their interest in the “particular form of access” to face-to-face discussions. If Holder applies here, then there is no form of access available.

You may or may not like Khaled, and you may not approve of her group or her views or her past actions. But what she was looking to do here was purely in the realm of speech. 1st Amendment protected speech. As complaints got louder, Zoom, on whose platform the call was to be held, said that it would not allow the call to be done. That... seems concerning. While private social media companies have every right to determine whose content they wish to host, it gets a lot trickier when we're talking about infrastructure and just the transmission, rather than hosting, of speech.

As some are pointing out Zoom's decision represents a terrible precedent. If you make enough noise, you can block someone from merely presenting. In that article, Mark Gray wonders if a hypothetical 2024 Republican National Convention might be pressured into not being allowed to be broadcast over Zoom because Roger Stone is one of the speakers. After all, he's been convicted of seven felonies. Or what about various convicts who have done their time and now give lectures to warn people about the mistakes they made in the past? Should they not be able to use Zoom?

And, yet, there was Brendan Carr, first in line, to cheer on this decision. He who had so eagerly tweeted against the "impulse to squelch free speech on college campuses" was cheering on a move by a tech company to squelch free speech on campus, saying that you "don't need to hear both sides." When I pointed out to him that this seemed hypocritical he doubled down saying that he has "no issue with a company denying service in this case," because Khaled was a "convicted terrorist who literally hijacked two airplanes where at least one person was shot." Lest you think Khaled shot someone, it was her partner in trying to hijack the plane who got shot. In neither of the two hijackings -- which again, were 50 years ago -- did anyone else die.

But, really, there are two key points here. First, Carr is admitting that his position is hypocritical, and that he does believe that private platforms should be able to deny service in certain cases based on the political views of the individual -- it's just that it seems he supports it when those political views diverge from his own. Carr seems to suggest that an appropriate standard is when someone has been "convicted" of certain crimes. I do wonder, then, if he thinks that no one in prison for murder should have access to phone lines. I mean, that's an area that he, as an FCC Commissioner even has some direct say over. Should, say, Kyle Rittenhouse, who shot and killed some people in Wisconsin be denied access to any phone service?

Second, while I have explained many times why websites should have freedom about whose content they host and whose they do not, it gets much, much, trickier when we're not talking about hosting content, but the mere transmission of content. Zoom is little different from a telephone call. And yet, here, it's blocking people based on political complaints about the speaker's views and the crimes she committed 50 years ago. Even if you disagree with Khaled, and even if you condemn her actions 50 years ago, it seems like a stretch to say she shouldn't be allowed to take part in a Zoom webinar.

Filed Under: 1st amendment, brendan carr, content moderation, fcc, free speech, infrastructure, leila khaled, pflf, terrorism
Companies: zoom

Forget TikTok. Feebly Secured Infrastructure Is Our Real Problem

from the missing-the-broader-context dept

One of the dumber aspects of press coverage of the TikTok kerfuffle is the lack of broader context. How, exactly, does banning a Chinese-owned teen dancing app solve our security and privacy headaches in a world where apps and services everywhere are collecting most of the same data, if not more? And why the myopic focus on just TikTok when Americans attach millions of totally unsecured Chinese-made "smart" IOT devices to their home and business networks with reckless abandon? If you're going to freak out about U.S. consumer privacy and internet security -- why not focus on actually shoring up overall U.S. consumer privacy and security?

Many press outlets and analysts have innately bought into the idea that banning TikTok somehow seriously thwarts the Chinese government's spying efforts. In reality, China's spying capabilities, fueled by an unlimited budget, have no limit of potential other ways to get far more data thanks to United States' lax privacy and security standards. Case in point, last week in the midst of TikTok hysteria, a report quietly emerged showing that the U.S. satellite communications networks have the security of damp cardboard:

"More than a decade has passed since researchers demonstrated serious privacy and security holes in satellite-based Internet services. The weaknesses allowed attackers to snoop on and sometimes tamper with data received by millions of users thousands of miles away. You might expect that in 2020—as satellite Internet has grown more popular—providers would have fixed those shortcomings, but you’d be wrong."

The security researcher in question showcased how it wasn't particularly difficult to hack into these satellite networks to observe all manner of online activity, from airliners receiving unencrypted navigation data in flight, to utility administrators managing wind turbines. Many of these vulnerabilities have been known about for fifteen years yet still haven't been fixed:

“There are still many satellite Internet services operating today which are vulnerable to their [the previous researchers’] exact attacks and methods—despite these attacks having been public knowledge for more than 15 years at this point,” Pavur told me ahead of Wednesday’s talk. “We also found that some newer types of satellite broadband had issues with eavesdropping vulnerabilities as well."

Which is all to say: if you're going to freak out about TikTok, why not at least spend some of those calories discussing actually trying to fix our broader cybersecurity and privacy problems? Why not create systems that are simply resilient, transparent, and accountable by design?

The U.S. still doesn't have even a basic privacy law for the internet era, companies routinely face no serious penalty for privacy missteps, our privacy regulators are routinely kneecapped and under-funded, consumer data is routinely left open on the cloud, a new hack is revealed at least once a week, and nobody wants to spend the funds necessary to upgrade older infrastructure because doing so simply isn't sexy. To ignore this, then become utterly hysterical because the Chinese government might get some teen phone data, seems divorced from the broader context.

Yet most of the biggest pearl clutchers about the dangers of TikTok have been utterly absent from this broader reality.

They were nowhere to be found among efforts to fix a massive SS7 flaw that makes our cellular infrastructure vulnerable. They were dead quiet as folks tried to hold the cellular industry accountable for selling everybody's location data to any nitwit with a nickel. In fact, most of the folks that have hyperventilated the most about TikTok have repeatedly shot down attempts at internet-era privacy laws and fought against funding to secure U.S. elections. Why, it's almost as if many of them don't actually care about U.S. privacy and security, and instead are performatively upset about TikTok for xenophobic, financial, and political reasons.

Seriously concerned about U.S. cybersecurity and privacy issues? Why not work to actually try to fix those problems instead of engaging in histrionics about a teenage dancing app? Because it only takes a few hours of reading about the U.S. cybersecurity and privacy incompetence before you come to realize that TikTok is among the very least of this country's problems on that front.

Filed Under: china, infrastructure, iot, privacy, surveillance
Companies: tiktok

Understanding The 'Splinternet'

from the how-our-digital-world-fractures dept

In recent years, technologists have coined the phrase “splinternet” to describe the internet’s supposed evolution from a unified, borderless realm into a fragmented set of parallel internets, divided by national borders.

This assumes that the internet was, at one point, global in some meaningful sense. But the reality has always been more complex. From the stark digital divide for students during COVID-19 to Western companies enacting overly broad regional blocking in the name of “security,” the digital world never floated freely on a flat plane, untethered from political and geographical boundaries.

Yet, talk of a splinternet points to an important question: will the internet be more like one world (with some bumps along the way), or will it have semi-permeable borders that are tricky and expensive — perhaps even impossible — to cross?

To know whether (or how) the internet is becoming more fragmented first requires reliable methods for measuring internet fragmentation. The Daylight Security Research Lab has been working on this challenge for over a year with UC Berkeley’s Center for Long-Term Cybersecurity.

The internet is not a singular technology. It’s an ensemble, cobbled together from a variety of complementary tools and protocols. Each protocol sits on top of the one beneath it, creating "layers" of technologies that, together, we colloquially call “the internet.” In a recent column in the New York Times, for example, Shira Ovide describes fragmentation among companies providing digital services in India. This competition happens at the "content layer," which hosts the applications we interact with.

But this content layer locality is only one dimension of fragmentation. “Below” this layer, IPv6, an upgraded internet protocol system — the basic addressing system that allows computers to connect to the internet — rolls out unequally across the world. As older IPv4 addresses (in the style of 127.0.0.1) become increasingly scarce, internet outages could hit countries with low IPv6 penetration. Upgrading to IPv6 requires private- and, in some cases, public-sector investment so this divided access to the internet will break along lines of wealth.

“Above” these technical layers, regulations like Europe’s General Data Protection Regulation (GDPR) and Russian data locality laws fragment the internet at the "legal" or "social" layer. Russia’s laws require data about Russians to be stored in Russia and have enabled the Putin regime to disconnect from the wider internet as part of a “preparedness” drill. However, the GDPR has yielded a more subtle, bureaucratic flavor of fragmentation. As of 2018, about a third of major U.S. news sources blocked visitors from Europe to avoid GDPR regulations. While the policy merits of the GDPR can be debated, the regulation has undeniably made national borders matter more for the way data flows throughout the world.

Fragmentation can come at any layer of the internet stack. To capture this multifaceted reality, the Daylight Security Research Lab built a dataset to measure internet fragmentation through proxy measures based on four different layers of this stack.

Rather than revealing a world moving in one direction from "global" to "fragmented," the research reveals a more complex reality. Internet governance decisions produce diverse types of fragmentation. Some countries may have lots of data locality laws, while their content-layer patterns align with global norms. Other countries may exhibit the opposite pattern.

Across the five layers of the stack, the research mapped these fragmentation profiles with surprising results. On the one hand, countries expected to be different were surprisingly similar. Ask what Norway has in common with Saudi Arabia, Kuwait, UAE, and Bahrain, and someone might guess, “aside from oil, not much.” However, these very different countries have very similar, country-specific browsing habits, degrees of network non-neutrality (e.g., government or ISP interference) and work on similar infrastructures. While the specific browsing habits are almost certainly different between Norway and Saudi Arabia, the way in which they are different from the supposedly “global” internet is itself similar.

On the other hand, similar countries can have a surprisingly different internet. Per popular imagination and some recent reports, China’s model of the internet — one in which blocking is pervasive and centralized— has set a precedent that other Belt & Road countries, like Laos and Indonesia, are following. But the data challenges that assumption. In fact, China stands out from all of the seven Belt & Road countries that were analyzed. China has more data locality laws, a higher degree of content layer locality and significantly higher observed network interference.

As the shape of internet governance changes, barriers and enablers to using these services shift as well. It becomes easier to carry out speech, commerce and other digital activities in “blocs” of interoperability, and harder to move across the borders between those blocs. For an app starting today in the United States, it may be easier to block users from EU countries than to learn about and comply with EU regulation. Imagining this small-scale conflict playing out on a larger scale, regulations can (and do) produce fundamentally different experiences on the internet.

In the meantime, as you read anecdotes claiming the internet is becoming one way or another, or that changes have some good or bad effect, remember the eternal truth about any complex system: it's complicated.

What are we to make of the weird parallels between Norway and Bahrain? And what does this multifaceted reality mean for businesses or policymakers? Our ability to answer these questions is limited by our lack of a common language for discussing the phenomena. To know what’s down the road for the web, we first need to measure it.

Nick Merrill directs the Daylight Security Research Lab at the UC Berkeley Center for Long-Term Cybersecurity. His research is focused on identifying potential harms of technology, and to help others do the same.

Filed Under: borders, censorship, infrastructure, internet, interoperability, jurisdiction, open internet, splinternet

Knight Foundation Grant To Copia To Research Content Moderation, Governance, Rules & Norms For Internet Infrastructure

from the excited-to-dig-in dept

So many of the discussions around content moderation have focused on the so-called "edge-providers" (the companies that are more user-facing). We all know the stories about content moderation dealing with Facebook, Twitter, YouTube, Google, etc. But for a while now we've been concerned about how the debate will play out regarding content moderation at the infrastructure layers -- that is the behind-the-scenes providers that people don't always even know exist. This includes hosting companies, DNS providers, domain registrars, CDNs, broadband providers and many, many more.

So we're (in the form of our Copia Institute think tank) are excited to be a part of a new grant to research this issue, with a specific focus on how these infrastructure content moderation issues may impact competition, privacy, and liability. We're planning to do some (virtual, for the time being!) gatherings, and putting together some research about these issues as well.

This is the first time we've worked with the Knight Foundation, and we're excited that they were willing to step up and support such important work.

Filed Under: content moderation, governance, grant, infrastructure, internet infrastructure, platforms, protocols, research
Companies: copia institute, knight foundation

Senator Cotton Dumbly Claims Huawei Building 5G Networks Is Like Letting The USSR Build US Cold War Submarines

from the ill-communication dept

We've noted for a while that the "race to 5G" is largely just the byproduct of telecom lobbyists hoping to spike lagging smartphone and network hardware sales. Yes, 5G is important in that it will provide faster, more resilient networks when it's finally deployed at scale years from now. But the society-altering impacts of the technology are extremely over-hyped, international efforts to deploy the faster wireless standard aren't really a race, and even if it were, our broadband maps are so terrible (often by monopolist design), it would be impossible to actually determine who won.

A huge part of the idiotic "race to 5G" narrative involves ample fear mongering over China, or the idea that if China somehow deploys 5G faster to Chinese residents, that somehow means... anything to the consumers in the US already facing high prices and patchy availability. The reality is that China is well ahead of the United States in terms of 5G deployment already, and the 5G being deployed here in the States is notably slower than many overseas 5G deployments because of a lack of mid-band spectrum (aka policy failure). It's simply not a race, and the monopoly-dominated US telecom sector isn't likely to "win" it.

Yet another aspect of the whole "race to 5G" narrative is the endless pearl-clutching and face-fanning about Chinese telecom giant Huawei, and its role in helping build global 5G networks. The Trump administration has repeatedly tried to claim that Huawei should be unequivocally banned from participating in global 5G builds. Many lawmakers in Germany and the UK have repeatedly balked at this request, quite correctly noting that nobody in the Trump administration has been able to provide any public evidence that Huawei has spied on Americans or Europeans at scale.

Companies like Microsoft have expressed skepticism as well:

"When Microsoft asked US lawmakers to explain the threat, they've been too vague for Smith's liking. Huawei is a major customer of his company: Its laptops come with Microsoft's Windows operating system. "Oftentimes, what we get in response is, 'Well, if you knew what we knew, you would agree with us'," Smith told Bloomberg. "And our answer is, 'Great, show us what you know so we can decide for ourselves. That's the way this country works.'"

To be clear, Huawei engages in shaky, unethical behavior. But so does AT&T. So does Verizon. So does the NSA, routinely. And while there's certainly security considerations when it comes to using Huawei's gear, a lot of this hysteria has been driven in DC by companies like Cisco for years, simply because they don't want to have to compete with cheaper Chinese hardware. It's extremely easy to bury anti-competitive motivations under the din national security. And it's pretty easy to hoodwink press outlets that can't identify, much less navigate, their own patriotic bias.

Enter Senator Tom Cotton, who this week equated letting China help build global 5G networks to letting the USSR develop US submarines during the cold war:

"Tom Cotton, who represents Arkansas, said he had geopolitical and technical objections to Huawei and claimed that, if hacked, its equipment could track the movements of key parts for F35 fighter jets. Deploying Huawei, the politician continued, “would be as if we had relied on adversarial nations in the cold war to build our submarines, or to build our tanks. It’s just not something that we would have ever considered."

Except that's hyperbolic nonsense. Keep in mind, the US has already banned Huawei from its networks. And all the UK is proposing is letting Huawei participate in up to 35% of its network builds, which will need to undergo elaborate security and standards checks under the watchful eye of heavy skepticism. And again, there's also this annoying fact that nobody has been able to provide public evidence that Huawei uses its gear to spy on Americans on behalf of the Chinese, despite fifteen years of vague allegations of this type, including a 18 month investigation by the US government that found... bupkis.

If there was evidence, the administration would have found some way to release at least a heavily redacted version of it. As a result, countries like the UK and Germany have argued that instead of engaging in a costly (and probably unenforceable) game of global blackballing, countries can simply refuse to use gear that can clearly be proven not to be secure via the elaborate security and safety processes that already exist. Many UK leaders are also quite correct in noting that this isn't a subject the United States really has much credibility on given its history of surveillance, falsehoods, and leadership failures:

"Stewart McDonald, an SNP MP, also challenged Cotton, arguing that the behaviour of Donald Trump, particularly during the George Floyd crisis, adversely affected the United States’s ability to lead on the issue. “The current presidential leadership and, in particular, his style of leadership is grossly undermining,” McDonald said."

Huawei, meanwhile, is likely correct in noting that the origins of this entire effort stems from companies that don't want the Chinese giant encroaching on the US dominated smartphone and network hardware markets:

"Speaking after the hearing, Victor Zhang, the vice-president of Huawei, said the hearing demonstrated that the senator’s principal concern was that the company had become too successful in an industry where the US has traditionally dominated. "It’s clear its market position, rather than security concerns, underpins America’s attack on Huawei as the committee was given no evidence to substantiate security allegations,” he added."

This is true. There's an entire cottage industry of US industry lobbyists driving this train that simply don't want to lose revenues via more intense Chinese competition. How much of this is genuine national security concerns? How much of this is lobbyist gamesmanship? Would the ratio even be measurable?

Again, Huawei is no saint. There's evidence that the company has helped some governments in Africa spy on political opponents and journalists. But again, this is all stuff the United States, NSA, and partners like AT&T engage in on a regular basis, and you don't see folks calling for a blacklisting of AT&T (can you imagine the US hyperventilation if a foreign government tried?). The United States has been such a rabid supporter of unchecked global spying -- and bullshits so frequently on this subject -- that it's pretty hard to take us seriously when it comes to doling out advice on trust and surveillance.

Again it's a complicated subject, and few involved with it seem up to the task of separating patriotism, bigotry, and the motivations of US giants like Cisco from intelligent global policy.

Filed Under: 5g, china, conspiracies, infrastructure, networking equipment, tom cotton
Companies: huawei

Fancy That: Comcast's Network Holding Up Fine Without Usage Caps

from the captive-audience dept

For many years in the early aughts, broadband providers insisted they needed to impose usage caps and costly overage fees to help manage network congestion. By 2015, leaked documents from Comcast revealed that was never true. In the years since, even industry CEOs have acknowledged that the limits are little more than an additional tax on captive customers in uncompetitive U.S. broadband markets.

As COVID-19 struck, ISPs quickly bowed to pressure to eliminate such restrictions so home-bound Americans weren't inundated with significantly higher bills. In a press release, Comcast makes it clear that its network has (gasp), performed perfectly well under the added load -- despite a 32% increase in upstream traffic and 18% increase in downstream traffic. There's been a 77% surge in gaming downloads, a 37% bump in streaming video consumption, and a 228% bump in VOIP and teleconferencing use. This is, Comcast says, causing no issues for Comcast:

"Our ongoing, proactive network investment to add fiber and capacity has put us in a good position to manage the increases that we are experiencing today. While the COVID-19 experience is new and unprecedented, the Internet ecosystem is flexible and performing the way it was designed. We engineer the network to handle spikes and shifts in usage, and what we have seen so far with COVID-19 is within our capacity."

Many ISPs, like Comcast, backed off the "congestion" claims a few years ago after their own memos, and numerous researchers and journalists, kept debunking them.

These days, most ISPs can't even be bothered to offer a justification for the arbitrary limits. When they do attempt to justify them, they're usually (falsely) passed off as an "issue of fairness." But that's false too: Americans already pay some of the highest prices for broadband in the OECD, and flat rate broadband is perfectly profitable, regardless of usage. Comcast's CEO has also routinely tried to compare bandwidth to electricity and gasoline consumption, which is again a misleading comparison to finite, completely different resources -- all in a bid to make the restrictions sound sensible and necessary.

Imposing additional surcharges on everybody isn't an issue of fairness, it's monopoly price gouging of captive customers. Such restrictions wouldn't work in competitive markets; users would simply flock to the uncapped provider. But thanks to apathetic US telcos that refuse to upgrade their aging DSL networks, Comcast is securing a bigger monopoly than ever across countless US markets. Worse perhaps: such limits create a perfect opportunity for ISPs to anti-competitively exploit them in their battle against streaming providers, something that's already happening at AT&T.

Yet there are still occasionally folks who try to justify these arbitrary restrictions as just normal, creative, business price differentiation. But that logic not only ignores the monopoly, consumer, and competitive problems noted above, it ignores that extremely heavy users of bandwidth -- say like a guy running a server in his garage -- can already be (and are) nudged to more expensive business class tiers without applying confusing, costly additional surcharges on everybody. It also ignores that (again due to no competition), you'll never see very light users (like grandma who just checks the weather and email) pay significantly less. She too pays a high price. Everybody pays a high price for broadband in America. Again, with with a few regional exceptions, because it's a broken, monopolized market.

Like so many "normal" behaviors, COVID-19 has exposed broadband usage caps as folly. Yet once things settle down it remains likely that large ISPs will bring back such surcharges -- along side ambiguous, debunked, and nonsensical justifications for them. After all, with very little competition in US markets, and US regulators now a rubber stamp for industry interests, who or what exactly is going to stop them?

Filed Under: broadband, congestion, data caps, home working, infrastructure
Companies: comcast

Defeating Tech Giants With Open Protocols, Interoperability, And Shared Stewardship

from the alternative-approaches dept

Across the ideological spectrum, there seems to be a consensus that something must be done about the biggest tech companies — that the legal mechanisms we currently have to address monopolization in the United States are inadequate to deal with the realities of the digital market. While recognizing how powerless our institutions have become in the face of Big Tech's massive lobbying power, there's an idea that's gaining traction as a viable approach to curb the societal and economic impacts of tech monopolies. The idea is to restore the core of a healthy internet ecosystem: interoperability and the revival of open protocols.

Lawmakers, policy experts, and even Twitter, are advocating for tech companies to open up their platforms to enable other services and start-ups to enter the playing field. There are different approaches to doing so and varying layers of interoperability that are possible. The overarching goal, however, would be to get rid of the worst aspects of tech monopolization and bring about a new era of competition and innovation.

As a writer and nonprofit tech entrepreneur who has focused on projects promoting digital justice and community networks, I became interested in these ideas. Why do we need to extend interoperability into the application layer? How do we create new Internet standards that open up our networks and platforms in ways that invite new features and applications that better respect our individual and collective rights online? As I examined the three most likely scenarios being discussed, I realized that we had much to learn from the past. We need to revive the power of standards bodies, and ensure that they stay relevant and effective by observing known principles about how to successfully govern a commons.

A Brief Overview of Interoperability and Competition

What made the early Internet so exciting was how quickly it changed. Different services like bulletin board systems (BBS), email, and Internet relay chat (IRC) came about and allowed people to communicate in ways that were impossible before. That rich ecosystem of tools and services were enabled by downstream innovation. New applications and features could be built with existing technologies with or without permission from the prevailing tech companies. Yes, there were plenty of lawsuits against these start-ups back then. But people were still willing to take the risk, and there were investors that wanted to back them up. There were less onerous laws hindering experimental technologies.

Perhaps most importantly, much of the Internet ran on open protocols and standards. The academics and others who initially designed the protocols wanted to build a relatively free ecosystem, so they made it possible for services to interoperate with each other. Standards bodies like the World Wide Web Consortium (W3C) established shared protocols in the name of the collective interest. These institutions have helped companies and organizations come together and set rules based on agreed upon needs, making them transparent and representative of the interests of more than one stakeholder. At standards bodies, companies sit alongside non-profit organizations, educational institutions, policy experts, and academics.

But standards bodies have grown increasingly inefficient and exploitable. Not only were they always slow and under-resourced, tech companies grew powerful enough to bend them to their will or ignore them altogether by building walled gardens with no interoperability built into their platform (besides providing some public APIs with varying levels of consistency). In the era of Move Fast and Break Things, there was little patience for the kind of multi-stakeholder dialogue and decision-making that is required to build and conform to shared technical standards.

There has been little incentive for tech companies to play well with others. Not only that, it's become the norm for tech monopolies to destroy any competition. Laws that regulate the internet such as the Digital Millennium Copyright Act (DMCA) and the Computer Fraud and Abuse Act (CFAA) have had a chilling effect on the types of innovation that was characteristic of the early internet. These regulations can be weaponized by big players to crush new start-ups over even the most trivial violations. If they don’t sue them, tech companies can easily buy them out or throw all their resources into imitating the services of their smaller competitors until they crush them.

Now most people communicate, get news, and publish their work through closed platforms run as web services. When people think of the Internet, they think about the platforms, not the protocols that run beneath them and make them work. To many, email is Gmail, chat is Slack, and discussion forums are Facebook.

Of course the underlying protocols are still core to the Internet’s functionality. But these closed platforms severely lack the traits of interoperability. As we’ve become dependent on them, our digital lives have been left at the mercy of companies whose primary goal is to enclose as much of the Internet’s infrastructure as they can get away with. Especially when it comes to social networks, their ability to mediate every aspect of our relationships and interactions online has come at an immense cost to our right to free expression, privacy, and access to knowledge.

Possible Paths Towards an Interoperable Internet

There are those who are calling for a revival of antitrust enforcement to break up the tech monopolies. But federal agencies in the U.S. such as the Federal Trade Commission (FTC) move too slowly and are under-resourced. And then there are others who say that breaking up the tech companies is entirely the wrong approach — that we need to build protocols to again make the Internet more interoperable as it was in the early days.

The European Commission, the Electronic Frontier Foundation, the University of Chicago Booth School of Business, Mozilla, Twitter CEO Jack Dorsey, and others are calling for a revival of interoperability as means to address Big Tech's dominance over the Internet. Among them they present three possible ways this could come about, with or without state intervention.

1) State Antitrust Enforcement

Through litigation or legislative action, the state could require companies to make their platforms more open and interoperable. Mozilla's Chris Riley asserts that the agency best suited to take this on would be the FTC, which has the explicit mandate to protect consumer protection and enforce U.S. antitrust laws. Harold Feld of Public Knowledge calls for an entirely new agency empowered to oversee any implementation of any proposed law enforcing digital platform competition, given the specific technical complexities of enforcing such a law.

There is precedence for this in Europe. The European Commission brought a case against Microsoft in the early 2000's that resulted in the company being required to release information enabling competing software to interoperate with Windows desktops. The U.S. and Europe have their own approaches to antitrust, of course. Interoperability enforcement would look very different depending on which state(s) had the mandate to move forward with this type of action.

2) Established Platform Companies Seek Standardization

One of the big players could willingly embark on a path to build open protocols. In December, Twitter CEO Jack Dorsey announced Blue Sky, an initiative to help develop an open and decentralized standard for social media. In his Twitter thread about the project, Dorsey says that Twitter would fund further development of an existing decentralized standard or as he says, "create one from scratch".

Many responded to him asking about ActivityPub — the protocol behind Mastodon, the federated alternative to Twitter. Why wouldn't Twitter invest its resources into that? Dorsey responded that it might be possible, but that it's up to the Blue Sky team to decide whether that protocol would be best. It's worth pointing out that ActivityPub has already gone through discussions at the W3C and is officially a recommended standard.

It makes sense that a major platform would want to decentralize their platform, the most obvious reason being to relieve themselves of the responsibility over content moderation. The second reason is to fortify itself against even bigger competitors, like Facebook, that threaten to enclose even more of the Internet.

3) Building Open Protocols from Scratch

Within the last seven years there's been an explosion of decentralized protocols, dealing with everything ranging from currency and commerce to social media and decision-making. We are way beyond the proof of concept stage. There are all kinds of ways to build decentralized protocols — based on gossip, distributed files, blockchains, or federated databases. The issue isn't whether decentralization is technically feasible. The issue is that there are so many ways to do it and how each protocol is appropriate for different use cases.

Developer and writer Jay Graber compared a few of the most well-known decentralized social network protocols. She explains the pros and cons of each protocol and how they operate. Protocols that put users in full control over their data and identity in a network can be too technically challenging for the average user. Protocols that rely on append-only logs, such as secure scuttlebutt, make it impossible to edit or delete posts. Federated networks can carry many of the same user-friendly features as centralized networks, but still leave the server administrators hosting the network with the same challenges — such as overseeing content moderation and platform security. So while protocols can be more neutral than platforms they still contain biases.

This Is a Human Problem, Not a Technical One

If we're talking about interoperability, we're talking about public Internet infrastructure. Open protocols and standards are part of a digital commons, and a commons thrives when people use and maintain it together.

As economist Elinor Ostrom declared in her Nobel Prize winning work, commoning is a social practice. What Ostrom asserted was that the success or failure of a commons, or what she called a "common-pool resource", rested on "how a group of principals who are in an interdependent situation can organize and govern themselves to obtain continuing joint benefits when all face temptations to free-ride, shirk or otherwise act opportunistically." For any type of commons, it's the relationships between those governing and relying on shared resources together that's central to its success.

Standards bodies were in many ways an implementation of Ostrom's eight principles for a commons — what she found were the basic elements needed for a commons to be governed sustainability and equitably. Thus Dorsey's call to build an "open community" around a new social media protocol is encouraging. It suggests the need to build organizations that keep various stakeholders engaged in an open dialogue about how we make social networks open and interoperable. This is the promise of a functional standards body. When they’re robust and effective, they can play a critical role in ensuring that the Internet remains free, open, and equitable.

Overcoming the Challenges

It's exciting to see this resurgence of energy for greater interoperability. But I'm not going to let myself get too hopeful. Anyone involved in this project needs to prove that this is going to be done right. Whether due to state-driven antitrust enforcement, tech companies' self-motivation, or from the bottom up with a new decentralized protocol, the manner in which protocols come about will be critical.

There are foreseeable issues with all three paths towards interoperability. Even if the government were to regulate companies, the state is feeble in the face of overpowering influence from corporate lobbyists. The revolving door that exists between private industry and public oversight bodies nearly guarantees a compromised process. Companies can't be trusted either. Independent developers have been continually burned by companies being unpredictable and negligent regarding the availability of public APIs — not to mention the hundreds of other ways they've violated public trust. Finally, nearly all of the decentralized web protocols were built by lone geniuses who collectively represent one demographic. If new protocols are to address the needs of diverse online communities, more types of people will need to be involved in their development.

Internet interoperability cannot be a project embarked on for the sake of profit, power, or someone's ego. Who is or is not in the room when critical decisions are being made about the protocol will make or break whether it will succeed in bringing about a more interoperable internet. We ought to learn from experts who know what it takes to govern shared resources together. If we’re serious about re-building the Internet as public infrastructure, we need to be prudent enough to assemble the types of organizations that can steward the Internet protocols of the future.

—

Further Reading

• European Commission, "Competition Policy for the Digital Era" (April 2019)   

• Mozilla's "A framework for forward-looking tech competition policy" (September    2019)

• Jack Dorsey, a twitter thread on Twitter's bluesky project

• George J. Stigler, Center for the Study of the Economy and the State "Committee    for the Study of Digital Platforms: Market Structure and Antitrust Subcommittee" (May    2019)

• Harold Feld, Public Knowledge "The    Case for the Digital Platform Act"

• Mike Masnick, Knight Foundation "Protocols, Not Platforms: A Technological Approach to Free Speech" (August 2019)

• Cory Doctorow, Electronic Frontier Foundation "Adversarial Interoperability: Reviving an Elegant Weapon From a More Civilized Age to Slay Today's Monopolies"    (June 2019)

• Chinmayi Sharma, University of Virginia School of Law “Concentrated Digital Markets, Restrictive APIs, and the Fight For Internet Interoperability” (January 2020)

• Irina Bolychevsky, Redecentralize "Instead of breaking up big tech, let’s break them open" (October 2019)

Filed Under: big tech, communities, competition, infrastructure, interoperability, platforms, protocols
Companies: facebook, google

Cloudflare Removes Warrant Canary: Thoughtful Post Says It Can No Longer Say It Hasn't Removed A Site Due To Political Pressure

from the tough-calls dept

Late last week, Cloudflare put up a fascinating and thoughtful blog post discussing (among other things) a change to its warrant canary list. As you hopefully know, a warrant canary is when a service provider makes a proactive statement about something it has supposedly never done. The idea is that if that statement disappears at a later date, one might reasonably infer that the company had been forced to do the thing it claimed it had not ever done -- and, additionally, that it had possibly been gagged from saying so. There are (somewhat reasonable) criticisms of warrant canaries, and to date, they're probably more well known for false alarms than any actual report of gagged pressured malfeasance.

Still, Cloudflare's public (so, not gagged) decision to delete a line from its warrant canary is interesting and worth thinking about. The original warrant canary from Cloudflare stated that the company hadn't done any of the following:

1. Cloudflare has never turned over our SSL keys or our customers SSL keys to anyone.
2. Cloudflare has never installed any law enforcement software or equipment anywhere on our network.
3. Cloudflare has never terminated a customer or taken down content due to political pressure.
4. Cloudflare has never provided any law enforcement organization a feed of our customers' content transiting our network.

Recently it added a few more and slightly modified the old ones, so that Cloudflare at the beginning of 2019 insisted that it had never done any of the following.

1. Turned over our encryption or authentication keys or our customers' encryption or authentication keys to anyone.
2. Installed any law enforcement software or equipment anywhere on our network.
3. Terminated a customer or taken down content due to political pressure*
4. Provided any law enforcement organization a feed of our customers' content transiting our network.
5. Modified customer content at the request of law enforcement or another third party.
6. Modified the intended destination of DNS responses at the request of law enforcement or another third party.
7. Weakened, compromised, or subverted any of its encryption at the request of law enforcement or another third party.

Now, you might notice that at the end of number three, there's an asterisk. That was done when Cloudflare kicked up quite a debate after it decided to remove Daily Stormer from its service. The asterisk was more or less a nod to the idea that things can be a bit more complicated than "political pressure." Cloudflare kicked off Daily Stormer because its CEO got sick of a bunch of neo-Nazis laughing and joking about Cloudflare for protecting them and keeping them online. Is that political pressure? Seems pretty subjective. Even Cloudflare's CEO, Matthew Prince, acknowledged this at the time, noting:

We're going to have a long debate internally about whether we need to remove the bullet about not terminating a customer due to political pressure. It's powerful to be able to say you've never done something. And, after today, make no mistake, it will be a little bit harder for us to argue against a government somewhere pressuring us into taking down a site they don't like.

The solution that Cloudflare came up with was to keep the line in there with the asterisk and an explanation. And now it's decided to remove the line entirely, as part of the decision earlier this year to remove 8chan from its service as well. However, it's still not an easy call, and the company wants you to understand the thought process it went through:

In August 2019, Cloudflare terminated service to 8chan based on their failure to moderate their hate-filled platform in a way that inspired murderous acts. Although we don’t think removing cybersecurity services to force a site offline is the right public policy approach to the hate festering online, a site’s failure to take responsibility to prevent or mitigate the harm caused by its platform leaves service providers like us with few choices. We’ve come to recognize that the prolonged and persistent lawlessness of others might require action by those further down the technical stack. Although we’d prefer that governments recognize that need, and build mechanisms for due process, if they fail to act, infrastructure companies may be required to take action to prevent harm.

And that brings us back to our warrant canary. If we believe we might have an obligation to terminate customers, even in a limited number of cases, retaining a commitment that we will never terminate a customer “due to political pressure” is untenable. We could, in theory, argue that terminating a lawless customer like 8chan was not a termination “due to political pressure.” But that seems wrong. We shouldn’t be parsing specific words of our commitments to explain to people why we don’t believe we’ve violated the standard.

We remain committed to the principle that providing cybersecurity services to everyone, regardless of content, makes the Internet a better place. Although we’re removing the warrant canary from our website, we believe that to earn and maintain our users’ trust, we must be transparent about the actions we take. We therefore commit to reporting on any action that we take to terminate a user that could be viewed as a termination “due to political pressure.”

I think this was probably the right call, but I'm just as on the fence about it as Cloudflare itself seems to be. There are strong arguments in either direction. The one thing I will say, though, is that I appreciate Cloudflare's willingness to be transparent in this way, and publicly discuss the tough calls its making on things like this. That's something few other companies (especially those as large as Cloudflare) would do. Instead, they'd either hide the removal, or try to PR the issue to death with some vague and noncommittal explanation. This, on the other hand, is direct and quite understandable, even if you disagree with various parts of it.

Filed Under: infrastructure, political pressure, takedowns, warrant canary
Companies: cloudflare

Cloudflare Makes It Easier For All Its Users To Help Stop Child Porn Distribution

from the this-is-good dept

We recently wrote about how Senators Lindsey Graham and Richard Blumenthal are preparing for FOSTA 2.0, this time focused on child porn -- which is now being renamed as "Child Sexual Abuse Material" or "CSAM." As part of that story, we highlighted that these two Senators and some of their colleagues had begun grandstanding against tech companies in response to a misleading NY Times article that seemed to blame internet companies for the rising number of reports to NCMEC of CSAM found on the internet, when that should be seen as more evidence of how much the companies are doing to try to stop CSAM.

Of course, working with NCMEC and other such organizations takes a lot of effort. Being able to scan for shared hashes of CSAM isn't something that every internet site can do. It's mostly just done by the larger companies. But last week Cloudflare (one of the companies that Senators are demanding "answers" from), did something quite fascinating: it enabled all Cloudlfare users, no matter what level of service, to start using Cloudflare CSAM scanning tools for free, even allowing them to set their own rules and preferences (something that might become very, very important if the Graham/Blumenthal bill becomes the law.

I highly recommend reading the entire article, because it's quite a clear, interesting, and easy to read article about how fuzzy hashing works (including pictures of dogs and bicycles). As the Cloudflare post notes, those who use such fuzzy hashing tools have intentionally kept at least some of the details secret -- because being too public about it would allow those who are producing and distributing CSAM to make changes that "dodge" the various tools and filters, which would obviously be a problem. However, that also results in two potential issues: (1) a lack of transparency in how these filtering systems really operate and (2) an inability for all but the largest players to make use of these tools -- which would be disastrous for smaller companies if they were required to make use of such things.

And that's where Cloudflare's move is quite interesting. In providing the tool for free to all of its users, it keeps the proprietary nature of the tool secret, but it's also letting them set the thresholds.

If the threshold is too strict — meaning that it's closer to a traditional hash and two images need to be virtually identical to trigger a match — then you're more likely to have have many false negatives (i.e., CSAM that isn't flagged). If the threshold is too loose, then it's possible to have many false positives. False positives may seem like the lesser evil, but there are legitimate concerns that increasing the possibility of false positives at scale could waste limited resources and further overwhelm the existing ecosystem. We will work to iterate the CSAM Scanning Tool to provide more granular control to the website owner while supporting the ongoing effectiveness of the ecosystem. Today, we believe we can offer a good first set of options for our customers that will allow us to more quickly flag CSAM without overwhelming the resources of the ecosystem.

Different Thresholds for Different Customers

The same desire for a granular approach was reflected in our conversations with our customers. When we asked what was appropriate for them, the answer varied radically based on the type of business, how sophisticated its existing abuse process was, and its likely exposure level and tolerance for the risk of CSAM being posted on their site.

For instance, a mature social network using Cloudflare with a sophisticated abuse team may want the threshold set quite loose, but not want the material to be automatically blocked because they have the resources to manually review whatever is flagged.

A new startup dedicated to providing a forum to new parents may want the threshold set quite loose and want any hits automatically blocked because they haven't yet built a sophisticated abuse team and the risk to their brand is so high if CSAM material is posted -- even if that will result in some false positives.

A commercial financial institution may want to set the threshold quite strict because they're less likely to have user generated content and would have a low tolerance for false positives, but then automatically block anything that's detected because if somehow their systems are compromised to host known CSAM they want to stop it immediately.

This is an incredibly thoughtful and nuanced approach, recognizing that when it comes to any sort of moderation, one size can never fit all. And, by allowing sites to set their own thresholds, it actually does add in a level of useful transparency, without exposing the inner workings that would allow bad actors to game the system.

That said, I can almost guarantee that someone (or perhaps multiple someones) will come along before too long and Cloudflare's efforts to help all of its users combat CSAM will somehow be incorrectly or misleadingly spun to claim that Cloudflare is somehow helping sites to hide or enable CSAM. No good deed goes unpunished.

However if you want to support actual solutions -- not grandstanding nonsense -- to try to deal with CSAM, approaches like Cloudflare's are ones worth paying attention to. This is especially true if Graham/Blumenthal and others get their way. Under proposals like the one they're suggesting, it will become virtually impossible for smaller companies to take the actions necessary to meet the standards to avoid legal liability. And that means that (once again) the big internet companies will end up getting bigger. They all have access to NCMEC and the necessary tools to scan and submit CSAM. Smaller companies don't. Cloudflare offering up its scan tool for everyone helps level the playing field in a really important way.

Filed Under: child porn, csam, fuzzy hashing, infrastructure, tools
Companies: cloudflare