Creating State Action Via Antitrust Law And Making The People Who've Been Wrong About The Constitutionality Of Content Moderation Suddenly Right

from the stopped-clocks dept

The challenge of a 24+ hour legislative session covering multiple bills is that it's hard to keep track of everything that happens. In my last post I wrote about a few impressions and examples that I happened to catch. This post is about another.

Plenty of people on both sides of the aisle have been plenty wrong about content moderation on the Internet. Many Democrats get it very wrong, and so do many Republicans. In the case of people like Reps. Jim Jordan and Matt Gaetz, their particular flavor of wrongness has been to rant and rave about the private editorial decisions platforms have made to remove the speech they think they should have the right to make on these services, no matter what. They complain that what these platforms are doing to their posts must somehow be violating their First Amendment rights—and they are completely and utterly wrong on that point. Platforms are private actors with their own First Amendment rights to choose what speech to associate with. Making those decisions, even in ways some people (including these Congressmen) don't like, is entirely legal and THEIR constitutional right to exercise. It in no way impinges on the First Amendment rights of any would-be user of their service to refuse their expression.

But these Congressmen and some of their similarly-minded colleagues have noticed that if these antitrust bills should become law in anything close to their current form their speech will continue to be denied access to these services. And this time that denial may well represent an unconstitutional incursion on their speech rights. Because it's one thing if the platforms make their own independent editorial decisions on whether to facilitate or deny certain user speech, including these Congressmen's speech. But it's another when government pressure forces platforms' hand to make those decisions in any particular way. And that's what these bills threaten to do.

One such way that they flagged is through the bills' demands for interoperability. Interoperability sounds like a nice idea in theory, but in practice there are significant issues with privacy, security, and even potentially content moderation, especially when it is demanded. Because one of the problems with an interoperability mandate is that it's hard to tell if, in being interoperable, one platform needs to adopt the same moderation policies of another platform they are trying to interoperate with. If the answer is yes, then suddenly platforms are no longer getting to make their own editorial decisions; now they are making editorial decisions the government is forcing them to make. Which means that when they impose them against certain user speech it now is at the behest of the state and therefore likely a violation of those users speech rights, which are rights that protect their speech against state action.

But even if a platform opts not to conform its moderation policies, the constitutional problem would remain. Because if these bills were to become law in their current form, the decision not to conform moderation policies might still be seen to flout the law's requirement for interoperability. And, at least initially, it would be up to the FTC to decide whether it does and thus warrants taking an enforcement action against the platform. But that means that the FTC could easily be in the position of making content-based decisions in order to decide whether the platform's content moderation decision (in this case not to conform) looks like an antitrust violation or not. This situation deeply concerned these Congressmen, who also happen to be of the belief that the FTC is a captured agency prone to making content decisions that conflict with their own preferred viewpoints. While their concerns generally seem overwrought, bills like these start to give them an air of legitimacy. Because regardless of whether the FTC actually is captured by any particular point of view or not, if it is going to make ANY enforcement decision predicated on any expressive decisions, that's a huge Constitutional problem, irrespective of which point of view may suffer or benefit from such government action.

So while it is very difficult to credit the particular outrage of these Congressmen, their alarm illustrates the fundamental problem with these bills and other similar legislative efforts (including some anti-Section 230 bills that these Congressmen favor): these targeted businesses are not ordinary companies selling ordinary products and services where market forces act in traditional market-driven ways. These are platforms and services handling SPEECH. And when companies are in the speech-handling business we can't treat them like non-speech businesses without impinging on those speech interests themselves in an unconstitutional "make no law" sort of way.

But that is exactly what Congress is deliberately trying to do. It is the government's displeasure with how these companies have been intermediating speech that is at the root of these regulatory efforts. It's not a case of, "These companies are big, maybe that's bad, and oops! Our regulatory efforts have accidentally implicated a speech interest." The whole acknowledged point of these regulatory efforts is to target companies that are "different," and the way they are different is because they are companies in the online speech business. Congress is deliberately trying to make a law that will shape how companies do that business. And the fact that its efforts are running headlong into some of the most provocative political speech interests of the day is Exhibit A for why the whole endeavor is an unconstitutional one.

Filed Under: antitrust, content moderation, interoperability, jim jordan, matt gaetz, state action
Companies: amazon, apple, facebook, google

Will Congress' Big New Push On Antitrust Actually Solve Any Competition Issues?

from the probably-not dept

On Friday, as has been widely expected for a while, a bunch of House lawmakers led by David Cicilline introduced five new antitrust bills that would, if they become law, completely reshape how antitrust works in the US. At least for tech companies. Somewhat notably, many of the bills seem written specifically to target just one industry and to avoid having to deal with other industries. The text of the bills has been floating around all week as the Democrats who are pushing them hoped to find some Republican co-sponsors. And, based on Friday's press release, it appears they found at least one Republican to sponsor each bill (though only four Republicans in total, as they got Lance Gooden to agree to sponsor two of the bills).

Now, most of the bills strike me as extremely problematic -- and even me just saying so will lead people to claim I'm somehow in the tank for these companies. Nothing is further from the truth. I'm all for creative ideas on how to end the dominance of the largest companies and to increase competition. But I fear poorly thought out proposals will have massive unintended consequences that go way beyond punishing Facebook, Google and Amazon.

Each bill does something different, and there are some occasionally creative and interesting ideas in them, but it really seems like these bills are more designed to destroy the thriving tech industry out of spite, rather than to actually encourage competition. As noted above, I'm in agreement that it would be good if we got more competition in the tech industry, but these bills take a very backwards-looking view on how to do that, basically by punishing companies for building successful products, rather than looking for ways to enable more actual competition. I've written before on ways to actually break up the dominance of big tech players, mainly by getting rid of many of the existing rules that have allowed the big players to block and limit competition. But these bills don't do that. They take a much more punitive approach to successful companies, rather than an approach that enables more competition through innovation. That's disappointing.

To me, the one that seemed most interesting at a first glance was the ACCESS Act ("Augmenting Compatibility and Competition by Enabling Service Switching Act") by Rep. Mary Gay Scanlon. It basically requires "covered platforms" to maintain open APIs for interoperability and data portability. And, at a first pass, that is a good thing, and obviously quite consistent with my belief that we need to build a future that is based more on open protocols rather than silo platforms. Portability and interoperability are certainly a step in the right direction for that.

However, the way the bill actually is written suggests a real lack of futuristic technical thinking. It would lock in certain ideas that don't necessarily make any sense. Basically, all this bill would actually do is make sure that you could transfer your data out of an existing internet giant. The big internet companies already do this... and because of the way it's been implemented, it's almost entirely useless and doesn't help anyone. This bill wouldn't change that, unfortunately.

On top of that, this bill fails to deal with the very real and very tricky challenges regarding data portability and interoperability as it pertains to privacy. Instead, the bill just handwaves it away, basically saying "don't do bad stuff regarding privacy" with this data. That's... not going to work, and is more or less an admission that the drafters of the bill don't want to deal with the very significant challenges of crafting a data portability/interoperability setup that is also congruent with protecting privacy.

The real way to do this would be to separate out the data layer so that it's not controlled by the centralized companies at all, but in the hands of the end-users or their agents. But while that could happen as an accident of this bill, it's clearly not the intent. Thus it seems like this bill would not help very much, and that's a real missed opportunity. It's nice that it recognizes portability and interoperability as issues, but it doesn't do the hard work necessary to make that actually meaningful.

Finally, perhaps the most problematic (by far) part of this bill is that if a "covered company" wants to change its APIs, it would need to get FTC approval -- and that seems like a terrible idea. Imagine having to get approval from the government every time you change your API? What? No. Bad.

A covered platform may make a change that may affect its interoperability interface by petitioning the Commission to approve a proposed change. The Commission shall allow the change if, after consulting the relevant technical committee the Commission concludes that the change is not being made with the purpose or effect of unreasonably denying access or undermining interoperability for competing businesses or potential competing businesses.

I mean, yikes. That's going from permissionless innovation -- the very core of our innovation engine -- to having the FTC act as the approver of any slight change to an API. That's really, really bad.

The bill that may get the most attention is Cicilline's own bill that basically says successful internet companies could no longer promote their own ancillary services over those of competitors. Basically, Google couldn't insert its own local results, or its own maps, over a third party's. Think of this as the Yelp Finally Forces Google To Use Yelp's Listings Act, because that's the main driver behind this bill. Basically, some companies that do more specialized search and content don't want Google to be able to compete with them, and more or less want traffic they might not have earned. I can see a slight argument for how the practice of actual monopolies favoring their own services and excluding others could be anticompetitive, but this bill would make it defacto anti-competitive -- and that seems likely to create massive unintended consequences that won't be very good for the internet.

There are, after all, lots of cases where it makes quite a lot of sense for companies to link their ancillary products. Yet, here, doing so will almost definitively lead to a costly antitrust fight, meaning that it will be quite difficult for many companies to build useful complementary services. I don't see how that benefits the public. Again, it seems that a much better solution would be to remove the barriers that currently limit the ability for third party competitors to step in and build tools that interoperate with the bigger players, but that's not the goal here. The goal seems to be to restrict the big internet companies to much more limited offerings, rather than providing a wider suite of services.

Another major change comes from Rep. Hakeem Jeffries, and would effectively make it much, much harder for internet giants to buy companies. A key part of the bill is that the acquiring company would have to affirmatively show that the merger is legit, rather than the government having to show that the merger is problematic. Shifting the burden of proof would basically mean that most such mergers would be presumed unlawful, rather than the opposite. This could have huge and problematic implications for how our economy operates today.

On the good side, the bill would give the FTC and DOJ more resources to review acquisitions. However, as we've discussed before, in trying to block out anti-competitive acquisitions (which are a legitimate concern!) a bill this broad will almost certainly knock out other kinds of important and useful acquisitions (such as ones that keep failing or flailing services alive). More importantly it may take investment capital away from competitive entrepreneurial ventures.

No good investors invest in a company with a plan to just sell it off to a big tech company (indeed, most investors will ask startups how they would deal with such a competitive threat), but having the big guys act as a buyer is an alternative out -- not as successful as succeeding on your own, but still better than losing all of the investment entirely -- makes it easier for the investors to make these kinds of bets. Now that possibility of return will become much more difficult, meaning that investment capital is less likely to go to entrepreneurs trying to create competitive solutions. And that's not good!

A separate bill from Rep. Neguse basically just raises the cost of mergers and acquisitions and... um... sure? Fine. I don't see that as problematic really. I mean, at the margins, making it more costly to do an acquisition might be a nuisance, but the changes and increases don't seem particularly significant here -- and certainly not enough to stop a major acquisition (though, arguably it might drive down the amount that the owners of the acquired company get, effectively transferring it to the government). Consider it kind of a slight tax on selling your business. The bill would also increase funding to the FTC and DOJ to work on antitrust issues, and that seems reasonable as well.

Finally, there's Rep. Jayapal's bill that is pretty clearly designed to just stop Amazon from selling its own goods on Amazon. I know this is an issue lots of people complain about, but it remains unclear to me how much of an actual problem it is. Lots of retailers sell house branded products and compete against others without much of a problem. Costco has its house Kirkland brand, which it sells alongside other companies' competing products. Is that so problematic?

As some are pointing out already, these bills could kill off (or severely limit) a bunch of services that people actually like, mostly as punishment that the innovations have been so successful. And that's a problem.

It's fine to admit that there's a delicate balance here. How do you stop companies from becoming too powerful such that they alone squeeze out or stifle competition, while at the same time not putting in place stringent rules that, by themselves, stifle useful innovations? There really are two major themes of approaches: (1) punish or limit the ability of companies to act or (2) figure out better ways to create incentives for competitors to succeed. Unfortunately, regulators tend to jump to (1) and avoid even trying (2). That seems to be the case here.

Filed Under: acquisitions, antitrust, competition, data portability, doj, ftc, interoperability, mergers
Companies: amazon, apple, facebook, google

Facebook's Distinction Between Data Breaches And Scraping Would Make A Lot More Sense If It Hadn't Argued Differently In Court

from the but-it's-important dept

A few weeks back, news broke that some hackers were offering up personal information on over 500 million Facebook accounts (there had been some earlier reports about this data availability as well). It was even highlighted that some of the "personal information" apparently included Mark Zuckerberg's phone number (though it's unclear if that data was confirmed to be accurate or not).

After there was more reporting on this data being available, some people noticed that Facebook had not alerted people about it. Various data breach laws require notification to effected users of a data breach, and so Facebook's decision raised some eyebrows. Facebook's explanation for not notifying users is that the company did not consider this to be a breach, but rather was done via scraping of information that people put on their own profiles:

Scraping is a common tactic that often relies on automated software to lift public information from the internet that can end up being distributed in online forums like this. The methods used to obtain this data set were previously reported in 2019. This is another example of the ongoing, adversarial relationship technology companies have with fraudsters who intentionally break platform policies to scrape internet services. As a result of the action we took, we are confident that the specific issue that allowed them to scrape this data in 2019 no longer exists. But since there’s still confusion about this data and what we’ve done, we wanted to provide more details here.

This may feel like weaseling out (and in some ways it absolutely is), but the distinction here is actually really important. As explained in a detailed Wired article, no one "hacked" into Facebook, so in some way the data wasn't breached the way many people think of a breach. Instead, it appears that the "import contacts" feature (which is wise to avoid using on basically any service if you can!) had a vulnerability in that malicious actors could basically try to import every possible phone number, and any "match" would give them access to the information those people shared with connections (so, personal info like phone numbers, names, date of birth, email, etc.).

It appears that data protection regulators around the globe are not happy with Facebook's response, and it would not surprise me at all to see Facebook eventually hit with another fine over this situation.

However, we should be at least somewhat wary of efforts to make data scraping a violation of privacy rules.

Admittedly, Facebook is now trying to lean heavily on the distinction to get out of trouble here. In an email someone from Facebook accidentally sent to a Dutch reporter, it was revealed that Facebook was going to try to "normalize" data scraping efforts as both common and different than data breaches (Facebook later confirmed to Vice that the email was legitimate):

'In the long term we expect more scraping incidents and it is important to frame this as a sector problem and normalize that this happens regularly. To do this, the team proposes a follow-up post in the coming weeks that talks more broadly about our anti-scraping work and provides more transparency around the work we do here. This may reflect much of the scraping activity, we hope this helps normalize the fact that this is ongoing and avoid the criticism that we are not transparent about specific incidents. '

And there is some truth to the fact that this kind of thing happens regularly. There were recent reports on similar "data scrapes" from Clubhouse and LinkedIn.

And here's where things get a bit trickier. If we demonize all data scraping, that would create much bigger problems. Data scraping is actually really important for many non-nefarious situations. Hell, search engines are giant data scrapers, and that's incredibly useful. Similarly, many academic researchers use data scraping to analyze various things online (including the activities of big companies like Facebook). Demonizing all data scraping as if it's functionally equivalent to a data breach would lead to bad results.

Indeed, in many ways, being able to scrape data can help lead to a more competitive internet. As people like Cory Doctorow are pushing for competitive compatibility, some of that may include the ability to scrape data to get it out of a silo like Facebook.

Notably, both Facebook and LinkedIn -- both of whom have just recently faced public reports of this kind of scraping -- have, in the past, sued companies that scraped their sites, claiming it violated the Computer Fraud and Abuse Act (CFAA) for "unauthorized access." As you may recall, Facebook won its case against Power, blocking Power's attempt to create an out-of-Facebook dashboard that users could use to post content to Facebook and other social networks without having to use Facebook directly.

LinkedIn, on the other hand, lost its very similar case, because of an important distinction that Facebook is now conveniently ignoring. In the LinkedIn case, the court found that LinkedIn couldn't use the CFAA to stop scraping because the information in question was publicly available. The court distinguished it from the Power case by saying that, with Power, it was scraping (with permission from the end users) data that was not "publicly available."

And, thus, I think that a lot of people are -- somewhat cynically perhaps -- conflating a bunch of different situations to their own advantage. People who are mocking Facebook for trying to distinguish between data breaches and data scraping are perhaps going too far. There is a difference, and that difference matters. Jumping to the extreme position that data scraping is bad would lead to really bad results. The distinction that people should be making is who has authorization to access the data. So, for example, with the recent Clubhouse data scraping, all of the information that was scraped was publicly available to anyone on Clubhouse. No secret information was revealed.

Similarly, with the LinkedIn/HiQ case, the court rightly found that HiQ should be able to scrape public data from LinkedIn. That was a good ruling because scraping public data is an important factor in how the web works.

But, now let's look at the Facebook situation. In the Power case, which I think was decided incorrectly, Facebook argued that scraping data with the permission of the end user who created that data was bad hacking that violated the law. The courts agreed, but that still seems very, very wrong. The key factor here should have been that the end user gave their authorization, and thus the data scraping should have been allowed.

But with this latest situation with the over 500 million accounts... well... now it gets more complicated. This data was available because of the sloppy way in which Facebook set up its "import contacts" feature. The people who put their own data in did not authorize it to be shared that widely (or if they technically did so through convoluted terms of service, it certainly was not with the intent that that data would then be available in a database anyone could hunt through to find their personal info). Given that -- that this data was accessed without the end user's authorization -- this feels a hell of a lot worse than what was happening with Power. Yet, in Power's case, Facebook ran to the courts to claim a "breach." But with the latest story, Facebook is trying to downplay it as not a breach.

At the very least, Facebook is being cynically hypocritical.

And that worries me. I fear that too many people will not sort through the different issues at play here, and will argue that any kind of data scraping is the equivalent of a data breach. Dangerously, that could play right into Facebook's hands, allowing it to put up even larger walls, and create more impenetrable silos, that make it that much more difficult to extract your data from Facebook and move it to alternative and competing platforms.

So, yes, Facebook is being cynical and opportunistic (and inconsistent) in arguing that this scraping situation is different than a data breach. But there is an underlying kernel of truth that shouldn't be ignored. Not all data scraping is bad. It's often quite good and important. The real issue is what data is public and what is private -- and who is given the authorization to make more private data public.

If the end result of this is for regulators to say that Facebook has to lock down more data, that would be bad, as it would continue to raise the competitive barriers for new entrants, and give Facebook even more power. That doesn't mean anyone should let Facebook off the hook for its stupidly implemented contact importer, but understanding the nuances here is important.

Filed Under: cfaa, competition, data breaches, interoperability, privacy, scraping
Companies: clubhouse, facebook, linkedin

Could A Narrow Reform Of Section 230 Enable Platform Interoperability?

from the one-approach dept

Perhaps the most de rigeur issue in tech policy in 2020 is antitrust. The European Union made market power a significant component of its Digital Services Act consultation, and the United Kingdom released a massive final report detailing competition challenges in digital advertising, search, and social media. In the U.S., the House of Representatives held an historic (virtual) hearing with the CEOs of Amazon, Apple, Facebook, and Google (Alphabet) on the same panel. As soon as the end of this month the Department of Justice is expected to file a “case of the century” scale antitrust lawsuit against Google. One competition policy issue that I’ve written about extensively is interoperability, and, while we’ve already seen significant proposals to promote interoperability, notably the 2019 ACCESS Act, I want to throw another idea into the hopper: I think Congress should consider amending Section 230 of the Communications Act to condition its immunity for large online intermediaries on the provision of an open, raw feed for independent downstream presentation.

I know, I know. I can almost feel your fingers hovering over that big blue “Tweet” button or the “Leave a Comment” link -- but please, hear me out first.

For those not already aware of (if not completely sick of) the active discussions around it, Section 230, originally passed as part of the Communications Decency Act, is an immunity provision within U.S. law intended to encourage internet services to engage in beneficial content moderation without fearing liability as a consequence of such action. It’s famously only 26 words long in its central part, so I’ll paste that key text in full: “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”

I’ll attempt to summarize the political context. Section 230 has come under intense, bipartisan criticism over the past couple of years as a locus of animosity related to a diverse range of concerns with the practices of a few large tech companies, in particular. Some argue that the choices made by platform operators are biased against conservatives; others argue that the platforms aren’t responsible enough and aren’t held sufficiently accountable. The support for amending Section 230 is substantial, although it is far from universal. The current President has issued an executive order seeking to catalyze change in the law; and the Democratic nominee has in the past bluntly called for it to be revoked. Members of Congress have introduced several bills that touch Section 230 (after the passage of one such bill, FOSTA-SESTA, in 2018), such as the EARN IT Act which would push internet companies to do more to respond to online child exploitation, to the point of undermining secure encryption. A perhaps more on-point proposal is the PACT ACT, which focuses on specific platform content practices; I’ve called it the best starting point for Section 230 reform discussions.

Why is this one, short section of law so frequently used as a political punching bag? The attention goes beyond its hard law significance, revealing a deeper resonance in the modern-day notion of “publishing”. I believe this law in particular is amplified because the centralization and siloing of our internet experience has produced a widespread feeling (or reality) of a lack of meaningful user agency. By definition, social media is a business of taking human input (user generated content) and packaging it to produce output for humans, doubling the poignancy of human agency in some sense. The user agency gap spills over from the realm of competition, making it hard to evaluate content liability and privacy harms as entirely independent issues. In so many ways, the internet ecosystem is built on the idea of consumer mobility and freedom; also in so very many ways, that idea is bankrupt today.

Yet debating whether online intermediaries for user content are “platforms” or “publishers” is a distraction. A more meaningful articulation of the underlying problem, I believe, is to say that we end users are unable to customize sufficiently the way in which the content is presented to us because we are locked into a single experience.

Services like Facebook and YouTube operate powerful recommendation engines that are designed to sift through vast amount of potentially-desirable content and present the user with what they most value. This content is based on individual contextual factors such as what the user has been watching, and the broader signals of desirability such as engagement level from other users. As many critics allege, the underlying business model of these companies benefits by keeping users as engaged as possible, spending as much time on the platform as possible. That means recommending content that gets high engagement, even though human behavior doesn’t equate positive social value with high engagement (that’s the understatement of the day, there!).

One of the interesting technical questions is how to design such systems to make them “better” from a social perspective. It’s the subject of academic research, in addition to ample industry investment. I’ve given YouTube credit in the past for offering some amount of transparency into changes it’s making (and the effects of those changes) to improve the social value of its recommendations, although I believe making that transparency more collaborative and systematic would help immensely. (I plan to expand on that in my next post!).

Recommendation engines remain by and large black boxes to the outside world, including the users who receive their output. No matter how much credit you give individual companies for their efforts to balance properly their business model demands, optimal user experience, and improving social value, there are fundamental limits on users’ inability to customize, or replace, the recommendation algorithm that mediates the lion’s share of their interaction with the social network and the user-generated content that it hosts. We also can’t facilitate innovation or experimentation with presentation algorithms as things stand due to the lack of effective interoperability.

And that’s why Section 230 gets so much attention -- because we don’t have the freedom to experiment at scale with things like Ethan Zuckerman’s Gobo.social project and thus improve the quality of, and better control, our social media experiences. Yes, there are filters and settings that users can change to customize their experience to some degree, likely far more than most people know. Yet, by design, these settings do not provide enough control to affect the core functioning of the recommendation engine itself.

Thus, many users perceive the platforms to be packaging up third party, user generated content and making conscious choices of how to present it to us -- choices that our limited downstream controls are insufficient to manage. That’s why it feels to some like they’re “publishing,” and doing a bad job of it at that. Despite massive investments by the service operators, it’s not hard to find evidence of poor outcomes of recommendations; see, e.g., YouTube recommending videos about upcoming civil war. And there are also occasional news stories of willful actions making things worse to add more fuel to the fire.

So let’s create that space for empowerment by conditioning the Section 230 immunity on the provision of more raw, open access to their content experience so users can better control how to “publish” it to themselves by using an alternative recommendation engine. Here’s how to scale and design such an openness requirement properly:

• Apply an openness requirement only where the problems described above apply, which is for services that primarily host and present social, user generated content.

• Limit an openness requirement to larger platforms, for example borrowing the 100 million MAUs (Monthly Active Users) metric from the Senate’s ACCESS Act.

• Design the requirement to be variable across different services, and to engage platforms in the process. The kinds of APIs that Facebook and YouTube would set up to make this concept successful would be quite different.

• Allow platforms to adopt reasonable security and privacy access controls for their provisioned APIs or other interoperability interfaces.

• Preserve platform takedowns of content and accounts upstream of any provisioned APIs or other interoperability interfaces, to take advantage of scale in responding to Coordinated Inauthentic Behavior (CIB).

• Encourage platform providers to allow small amounts of API/interoperability interface access for free, while permitting them to charge fair, reasonable, and nondiscriminatory rates to third parties operating at larger scale.

Providing this kind of openness downstream would create opportunities for innovation and experimentation with recommendation engines at a scale never before seen. This is not just an evolutionary step forward in what we think of as internet infrastructure; it’s also a roadmap to sustainable alternative business models for the internet ecosystem. Even assuming that many users would stick with the platform’s default experience and the business model underlying it, for those who choose to change, they’d have a true business model choice, and a deep, meaningful user experience choice at the same time.

I recognize that this is a thumbnail sketch of a very complex idea, with much more analysis needed. I publish these thoughts to help illustrate the relationship between agita over Section 230 and the concentrated tech ecosystem. The centralized power of a few companies and their recommendation engines doesn’t provide sufficient empowerment and interoperability, thus limiting the perception of meaningful agency and choice. Turning this open feed concept into a legal and technical requirement is not impossible, but I recognize it would carry risk. In an ideal world, we’d see the desired outcome - meaningful downstream interoperability including user substitutability of recommendation engines - offered voluntarily. That would avoid the costs and complexities of regulation, put platforms in a position to strike the right balance, and release a political pressure relief valve to keep the central protections of Section 230 intact. Unfortunately, the present day market and political realities suggest that may not occur without substantial regulatory pressure.

Filed Under: cda 230, competition, interoperability, section 230

Understanding The 'Splinternet'

from the how-our-digital-world-fractures dept

In recent years, technologists have coined the phrase “splinternet” to describe the internet’s supposed evolution from a unified, borderless realm into a fragmented set of parallel internets, divided by national borders.

This assumes that the internet was, at one point, global in some meaningful sense. But the reality has always been more complex. From the stark digital divide for students during COVID-19 to Western companies enacting overly broad regional blocking in the name of “security,” the digital world never floated freely on a flat plane, untethered from political and geographical boundaries.

Yet, talk of a splinternet points to an important question: will the internet be more like one world (with some bumps along the way), or will it have semi-permeable borders that are tricky and expensive — perhaps even impossible — to cross?

To know whether (or how) the internet is becoming more fragmented first requires reliable methods for measuring internet fragmentation. The Daylight Security Research Lab has been working on this challenge for over a year with UC Berkeley’s Center for Long-Term Cybersecurity.

The internet is not a singular technology. It’s an ensemble, cobbled together from a variety of complementary tools and protocols. Each protocol sits on top of the one beneath it, creating "layers" of technologies that, together, we colloquially call “the internet.” In a recent column in the New York Times, for example, Shira Ovide describes fragmentation among companies providing digital services in India. This competition happens at the "content layer," which hosts the applications we interact with.

But this content layer locality is only one dimension of fragmentation. “Below” this layer, IPv6, an upgraded internet protocol system — the basic addressing system that allows computers to connect to the internet — rolls out unequally across the world. As older IPv4 addresses (in the style of 127.0.0.1) become increasingly scarce, internet outages could hit countries with low IPv6 penetration. Upgrading to IPv6 requires private- and, in some cases, public-sector investment so this divided access to the internet will break along lines of wealth.

“Above” these technical layers, regulations like Europe’s General Data Protection Regulation (GDPR) and Russian data locality laws fragment the internet at the "legal" or "social" layer. Russia’s laws require data about Russians to be stored in Russia and have enabled the Putin regime to disconnect from the wider internet as part of a “preparedness” drill. However, the GDPR has yielded a more subtle, bureaucratic flavor of fragmentation. As of 2018, about a third of major U.S. news sources blocked visitors from Europe to avoid GDPR regulations. While the policy merits of the GDPR can be debated, the regulation has undeniably made national borders matter more for the way data flows throughout the world.

Fragmentation can come at any layer of the internet stack. To capture this multifaceted reality, the Daylight Security Research Lab built a dataset to measure internet fragmentation through proxy measures based on four different layers of this stack.

Rather than revealing a world moving in one direction from "global" to "fragmented," the research reveals a more complex reality. Internet governance decisions produce diverse types of fragmentation. Some countries may have lots of data locality laws, while their content-layer patterns align with global norms. Other countries may exhibit the opposite pattern.

Across the five layers of the stack, the research mapped these fragmentation profiles with surprising results. On the one hand, countries expected to be different were surprisingly similar. Ask what Norway has in common with Saudi Arabia, Kuwait, UAE, and Bahrain, and someone might guess, “aside from oil, not much.” However, these very different countries have very similar, country-specific browsing habits, degrees of network non-neutrality (e.g., government or ISP interference) and work on similar infrastructures. While the specific browsing habits are almost certainly different between Norway and Saudi Arabia, the way in which they are different from the supposedly “global” internet is itself similar.

On the other hand, similar countries can have a surprisingly different internet. Per popular imagination and some recent reports, China’s model of the internet — one in which blocking is pervasive and centralized— has set a precedent that other Belt & Road countries, like Laos and Indonesia, are following. But the data challenges that assumption. In fact, China stands out from all of the seven Belt & Road countries that were analyzed. China has more data locality laws, a higher degree of content layer locality and significantly higher observed network interference.

As the shape of internet governance changes, barriers and enablers to using these services shift as well. It becomes easier to carry out speech, commerce and other digital activities in “blocs” of interoperability, and harder to move across the borders between those blocs. For an app starting today in the United States, it may be easier to block users from EU countries than to learn about and comply with EU regulation. Imagining this small-scale conflict playing out on a larger scale, regulations can (and do) produce fundamentally different experiences on the internet.

In the meantime, as you read anecdotes claiming the internet is becoming one way or another, or that changes have some good or bad effect, remember the eternal truth about any complex system: it's complicated.

What are we to make of the weird parallels between Norway and Bahrain? And what does this multifaceted reality mean for businesses or policymakers? Our ability to answer these questions is limited by our lack of a common language for discussing the phenomena. To know what’s down the road for the web, we first need to measure it.

Nick Merrill directs the Daylight Security Research Lab at the UC Berkeley Center for Long-Term Cybersecurity. His research is focused on identifying potential harms of technology, and to help others do the same.

Filed Under: borders, censorship, infrastructure, internet, interoperability, jurisdiction, open internet, splinternet