Trump's Truth Social Bakes Section 230 Directly Into Its Terms, So Apparently Trump Now Likes Section 230

from the well-how-about-that dept

When Donald Trump first announced his plans to launch his own Twitter competitor, Truth Social, we noted that the terms of service on the site indicated that the company -- contrary to all the nonsense claims of being more "free speech" supportive than existing social media sites -- was likely going to be quite aggressive in banning users who said anything that Trump disliked. Last month, Devin Nunes, who quit Congress to become CEO of the fledgling site, made it clear that the site would be heavily, heavily moderated, including using Hive, a popular tool for social media companies that want to moderate.

So with the early iOS version of the app "launching" this past weekend, most people were focused on the long list of things that went wrong with the launch, mainly security flaws and broken sign-ups. There's also been some talk about how the logo may be a copy... and the fact that Trump's own wife declared that she'll be using Parler for her social media efforts.

But, for me, I went straight to checking out the terms of service for the site. They've been updated since the last time, but the basics remain crystal clear: despite all the silly yammering from Nunes and Trump about how they're the "free speech" supporting social network, Truth Social's terms are way more restrictive regarding content than just about any I've ever seen before.

Still, the most incredible part is not only that Truth Social is embracing Section 230, but it has literally embedded parts of 230 into its terms of service. The terms require people who sign up to "represent and warrant" that their content doesn't do certain things. And the site warns that if you violate any of these terms it "may result in, among other things, termination or suspension of your rights to use the Service and removal or deletion of your Contributions." I don't know, but I recall a former President and a former cow farming Representative from California previously referring to that kind of termination as "censorship." But, one of the things that users must "represent and warrant" is the following:

your Contributions are not obscene, lewd, lascivious, filthy, violent, harassing, libelous, slanderous, or otherwise objectionable.

That might sound familiar to those of you who are knowledgeable about Section 230 -- because it's literally cribbed directly from Section 230(c)(2), which says:

No provider or user of an interactive computer service shall be held liable on account of any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable...

That's almost word for word the same as 230. The only changes are that it removes "excessively" from "violent" and adds in "libelous" and "slanderous," -- subjects in which Devin Nunes considers himself something of an expert, though courts don't seem to agree.

Hell, they even leave in the catch-all "otherwise objectionable," even as some of their Republican friends in Congress have tried to remove that phrase in a few of their dozens of "Section 230 reform" bills.

So it's not at all surprising, but potentially a bit ironic that the man who demanded the outright repeal of Section 230 (even to the point of trying to stop funding the US military if Congress didn't repeal the law) has now not only embraced Section 230, but has literally baked a component of it (the part that he and his ignorant fans have never actually understood) directly into his own service's terms.

It's so blatant I almost wonder if it was done just for the trolling. That said, I still look forward to Truth Social using Section 230 to defend itself against inevitable lawsuits.

There are some other fun tidbits in the terms of service that suggest the site will be one of the most aggressive in moderating content. It literally claims that it may take down content that is "false, inaccurate, or misleading" (based on Truth Social's own subjective interpretation, of course). You can't advertise anything on the site without having it "authorized." You need to "have the written consent, release, and/or permission of each and every identifiable individual person in your Contributions." Does Truth Social think you actually need written permission to talk about someone?

There's also a long, long list of "prohibited" activities, including compiling a database of Truth Social data without permission, any advertising (wait, what?), bots, impersonation, "sexual content or language," or "any content that portrays or suggest explicit sexual acts." I'm not sure how Former President "Grab 'em by the p***y" will survive on his own site. Oh right, also "sugar babies" and "sexual fetishes" are banned.

Lots of fun stuff that indicates that like 4chan, then 8chan, then Gab, then Parler, then Gettr that have at times declared themselves to be "free speech zones," every website knows that it needs to moderate to some level, and also that it's Section 230 that helps keep them out of court when they moderate in ways that piss off some of their users.

Filed Under: content moderation, devin nunes, donald trump, section 230, terms of service
Companies: tmtg, truth social

New 'TLDR' Bill Requires Companies Provide Synopsis Of Overlong, Predatory Terms Of Service

from the good-luck-with-that dept

This week saw the introduction of the The Terms-of-service Labeling, Design and Readability Act, or "TLDR Act," for short. The bill, which, for now, has bipartisan support, would require the FTC to create rules mandating that websites must offer a truncated version of obnoxiously long and predatory terms of service (TOS) nobody actually reads. The "summary statement" websites would be obligated to provide would not only lay out the legal requirements in terms normal humans could understand, it would also require a website disclose any major data breaches that have occurred in the last three years.

A breakdown (pdf) of the bill also states it will require websites to disclose what data is collected upon a user's visit, and what kind of control a user has over that data. Any violation of the new law would be declared to be within the realm of "unfair and deceptive" under the FTC Act, giving the agency the authority to act on it. Rep. Lori Trahan had this to say about the need for such a law:

"For far too long, blanket terms of service agreements have forced consumers to either ‘agree’ to all of a company’s conditions or lose access to a website or app entirely. No negotiation, no alternative, and no real choice,” said Congresswoman Trahan, a member of the House Subcommittee on Consumer Protection and Commerce. “To further slant the decision in their favor, many companies design unnecessarily long and complicated contracts, knowing that users don’t have the bandwidth to read lengthy legal documents when they’re simply trying to message a loved one or make a quick purchase."

Yes, most TOS are overlong and that length is often used to obscure bad behavior or quietly erode consumer rights (see: binding arbitration). But many TOS are also overlong because U.S. law and compliance are complicated as hell. The idea that you can always simplify everything a company needs to get across to a user to comply with the law and reasonably cover your ass in a sentence or too is probably a little simplistic. At the same time, I'm not sure the American consumer, many with the attention span of a goldfish, would even read the truncated version of a TOS anyway.

While "more transparency" is certainly good, it also only goes so far if you're not willing to tackle the deeper problem(s). For example the FCC is pondering a transparency label on broadband connections outlining all the sneaky ways you're getting ripped off by your internet service provider. And while knowing the precise parameters how you're getting ripped off is nice, users in monopolized markets can't switch ISPs anyway because the FCC generally isn't willing or able to combat monopolization and limited competition. So transparency only accomplishes so much.

Here too, websites, apps, and services use overlong TOS to obfuscate all manner of behaviors U.S. regulators either don't have the resources to police (the FTC has 8% of the staff dedicated to privacy issues as the UK, despite the UK having one-fifth the consumers to protect) or are apathetic to because of revolving door corruption (see: telecom, banking, adtech, etc.). Expecting the FTC to do a whole lot more stuff without notably expanding funding seems a bit short sighted. And this is all assuming the bill is actually well written and doesn't cause new, unforeseen problems via sloppy language.

So while well intentioned, this feels like a bit of a band aid on problems policymakers can't or won't tackle head on. Like limited competition. Or the complete and total lack of anything even vaguely resembling accountability in telecom, adtech, or the data broker space. Or privacy reform. Or antitrust reform. All of these problems lead to bad behaviors companies are hiding in their TOS, and making those bad behaviors clearer to the end user is only part of a process. Knowing you're getting screwed or spied on is only helpful if you have the recourse to do something about it, and regulators willing to stand up for you when push comes to shove.

Filed Under: congress, ftc, terms of service, tldr, tldr act

The Senate's Finsta Problem

from the that's-now-how-it-works dept

Earlier this year we wrote about Senator Richard Blumenthal's viral "finsta" debacle in which he asked a Facebook executive to "end Finsta" as if (1) it was a product, or (2) it was "endable." Some people pushed back on the mocking of Blumenthal, noting that he (or at least his staffers) actually understood what "finsta" meant, since he had given an accurate description earlier, and his staff had set up a fake Instagram account, pretending to be a young girl to see what happened. However, as we and others noted, if he actually understood "finsta" that made his demand to "end Finsta" even worse, because it meant he was calling for an end to anonymity on Instagram, which would have huge problems -- especially for more marginalized people or those at risk, who have very good reasons for not using their real names on social media.

Of course, rather than learning from that debacle, Senators across the board seemed to see it as an opportunity to score some media headlines when they dragged in Instagram CEO Adam Mosseri to testify in yet another one of the Senate's pointless, grandstanding "big tech bad" hearings last week. Senator Blumenthal brought back his finsta. On the other side of the aisle, both Senators Marsha Blackburn and Mike Lee rolled out their own finstas. And all of them were shocked, shocked, shocked, to find that sometimes they didn't like what the algorithm recommended to them.

Except, as an article at the National Journal highlights, this little game of gotcha doesn't make much sense and is not how good research is actually done.

Joshua Tucker, a co-director of the NYU Center for Social Media and Politics, said Senate staff don’t have the time or training to make broad inferences about how teens experience Instagram.

“In a sense these [fake accounts] are useful, because they are surfacing things that can happen on the platform,” Tucker said. “But it’s this leap from ‘it can happen’ to ‘this is prevalent, this is common’—that’s when you need the more sophisticated research design.”

Tucker called it “ironic” that lawmakers are deploying these fake accounts in hearings, given ongoing concerns from Blumenthal and others that “finstas” are a menace and the fact that creating such accounts violates Instagram’s terms of service.

“These are exactly the types of protections that we are asking Congress to provide to researchers—to protect researchers who want to do research, who want to go about and find out how these platforms work, to protect them from being attacked by companies for violating terms of service,” Tucker said.

But, rather than handing access to actual researchers who can determine whether or not there's a problem -- and if there is a problem how big or how prevalent it is -- Senators are instead pushing out garbage science. That is, they're pushing anecdotal examples based on a single case set up in a way specifically designed to try to get the outcome they want.

Not surprisingly, when journalist Brendan Bordelon pointed all this out to Blumenthal's office, it was dismissed in Blumenthal's typically dismissive manner:

The Connecticut Democrat shrugged off the idea that there’s something ironic about his creation of a fake account, given his concerns about “finstas” generally.

“I think it’s justified to be illustrative and then disclosed, and nothing done with it,” Blumenthal said. “It’s not like we set it up to exist for any length of time. We set it up to see what happened, and then we shut it down.

“If I were analogizing it to law enforcement, it’s a little bit like having somebody work undercover,” he said.

It's a misleading anecdote, and for someone who claims to be so concerned about misinformation, you'd think that Blumenthal would be careful not to create more of it.

And... that's not even getting into the point that all of these Senators broke Instagram's terms of service, and according to some interpretations of the law, that means they violated the CFAA. It seems like it would be a hell of a lot more productive to fix that, rather than freaking out about the other stuff.

Filed Under: anonymity, finsta, kids, marsha blackburn, mike lee, richard blumenthal, terms of service
Companies: instagram

Trump Announces His Own Social Network, 'Truth Social,' Which Says It Can Kick Off Users For Any Reason (And Already Is)

from the because-of-course dept

Last night, Donald Trump sent out a press release announcing (effectively) the launch of his new social network, "Truth Social." The press release shows that it's a bit more complicated than that. Trump is launching "Trump Media & Technology Group" which is entering into a reverse merger agreement to become listed as a public company in order to launch this new service. Apparently, Truth Social will let in "invited guests" next month, followed by a full launch in early 2022. The press release has the expected bombastically ridiculous quote from the former President.

"I created TRUTH Social and TMTG to stand up to the tyranny of Big Tech. We live in a world where the Taliban has a huge presence on Twitter, yet your favorite American President has been silenced. This is unacceptable. I am excited to send out my first TRUTH on TRUTH Social very soon. TMTG was founded with a mission to give a voice to all. I'm excited to soon beginning sharing my thoughts on TRUTH Social and to fight back against Big Tech. Everyone asks me why doesn't someone stand up to Big Tech? Well, we will soon!"

I mean, first off, it's an interesting world in which you can both claim to be silenced, but also (a) put out a press release read by millions and (b) launch your own damn social network. Doesn't seem that "silent" to me, but what do I know?

Anyway, given that Trump claims that the mission here is "to give voice to all," I was pretty interested in Truth Social's terms of service which (unsurprisingly), make it clear they can kick you off for any reason they want at all. Specifically, it says:

We reserve the right, but not the obligation, to:

(1) monitor the Site for violations of these Terms of Service;

(2) take appropriate legal action against anyone who, in our sole discretion, violates the law or these Terms of Service, including without limitation, reporting such user to law enforcement authorities;

(3) in our sole discretion and without limitation, refuse, restrict access to, limit the availability of, or disable (to the extent technologically feasible) your access or any of your contributions or any portion thereof; or

(4) otherwise manage the Site in a manner designed to protect our rights and property and to facilitate the proper functioning of the Site.

In other words, like every other website out there, Truth Social will moderate content.

Also, there's this:

If we terminate or suspend your account for any reason, you are prohibited from registering and creating a new account under your name, a fake or borrowed name, your email address or the name of any third party, even if you may be acting on behalf of the third party.

In addition to terminating or suspending your account, we reserve the right to take appropriate legal action, including without limitation pursuing civil, criminal, and injunctive redress.

So, it sure sounds like Truth Social, giving voice to all, is pretty damn sure it's going to have to kick people off its site (and maybe even sue them!). And why might they kick you off? Well, there's a very long list of "Prohibited Activities." I'll highlight some of them...

use the Site to advertise or offer to sell goods and services.

How much do you want to bet that Trump himself will violate this?

engage in unauthorized framing of or linking to the Site.

If you LINK TO THE SITE in an "unauthorized" way, they can remove your account.

trick, defraud, or mislead us and other users, especially in any attempt to learn sensitive account information such as user passwords;

MISLEADING OTHER USERS is grounds for having your account banished. So much freedom.

use any information obtained from the Site in order to harass, abuse, or harm another person.

This kind of thing is standard on all social media sites -- but which is notable because it's what many Trumpists get kicked off other platforms for. And yet, here it is.

use the Site as part of any effort to compete with us or otherwise use the Site and/or the Content for any revenue-generating endeavor or commercial enterprise.

Any effort to use the site to make money and they'll shut you down. That's... weird.

harass, annoy, intimidate, or threaten any of our employees or agents engaged in providing any portion of the Site to you.

If you annoy Trump or any of his employees, no more Truth for you!

upload or transmit (or attempt to upload or to transmit) viruses, Trojan horses, or other material, including excessive use of capital letters and spamming (continuous posting of repetitive text), that interferes with any party’s uninterrupted use and enjoyment of the Site or modifies, impairs, disrupts, alters, or interferes with the use, features, functions, operation, or maintenance of the Site.

One of those is not like the others. Excessive use of capital letters? I mean, that's not banned on any other social media platform I know of. Seems a lot less "freedomy" than we were led to believe. Also... excessive use of capital letters? Can I think of a famous social media user who regularly made use of that... hmm... who could that be...?

Also, there's an indemnity clause (a pretty broad one actually), so that if they get sued for something, you may be on the hook for the legal bills:

You agree to defend, indemnify, and hold us harmless, including our subsidiaries, affiliates, and all of our respective officers, agents, partners, and employees, from and against any loss, damage, liability, claim, or demand, including reasonable attorneys’ fees and expenses, made by any third party due to or arising out of: (1) use of the Site; (2) breach of these Terms of Service; (3) any breach of your representations and warranties set forth in these Terms of Service; (4) your violation of the rights of a third party, including but not limited to intellectual property rights; or (5) any overt harmful act toward any other user of the Site with whom you connected via the Site.

Notwithstanding the foregoing, we reserve the right, at your expense, to assume the exclusive defense and control of any matter for which you are required to indemnify us, and you agree to cooperate, at your expense, with our defense of such claims. We will use reasonable efforts to notify you of any such claim, action, or proceeding which is subject to this indemnification upon becoming aware of it.

So, when I first wrote this article I had a paragraph noting that once it actually launched I expected that Truth Social would speedrun the content moderation learning curve just like every MAGA-wannabe social network before it. But... of course, it's even faster than that. You see, despite saying it wasn't open, a bunch of fairly enterprising people figured out how to access the site and sign up for accounts via an unadvertised link. So someone set up a Donald J. Trump account. And posted quite an image.

Someone else created their own Donald Trump account:

And a Mike Pence account:

And thus we learned that, indeed, the "freedom loving" Truth Social... is already banning accounts.

Freedom is so fleeting. I mean, it went away even faster than all those other Trumpist social media sites. Oh, and it seems notable that even pre-launch, Trump's "freedom" loving social media site has text ready to go for suspended accounts:

You can no longer use your account, and your profile and other data are no longer accessible. You can still login to request a backup of your data until the data is fully removed, but we will retain some data to prevent you from evading the suspension.

So... it seems that Truth Social has "permanent suspensions" all ready to go. Just like every other social media website, of course. But, at least they don't present themselves as the antithesis of those other social media sites while all doing the same thing.

Either way, this can't be a good week for all those other super thirsty MAGA wannabe social networks. Gab is still out there pretending Trump is posting on its platform (they just repost every one of his press releases on his "verified" account and say they've "reserved" the account for him). Then, of course, there was Parler, who promised not to remove content, but whose former CEO gleefully told reporters that he was suspending "leftist trolls." And, then, of course, there was Gettr, which was taken over and "launched" by former close Trump aide, Jason Miller, and which also speedran the content moderation learning curve. Miller was unable to get his recently former boss to get on his own platform, and now they'll be competitors.

And, hey, competition is a good thing. Let a million social networks bloom. But don't expect one that is actually "taking on Big Tech" or guaranteeing that everyone has a voice. Because that's not Truth Social. It's just more lies.

Oh, and there are even some people suggesting that Truth Social is merely a reskin of Mastodon, as it matches almost exactly. If that's the case, then it's almost certainly violating Mastodon's AGPL license. And, considering that Truth Social's terms of service say that it is forbidden for you to:

copy or adapt the Site’s software, including but not limited to Flash, PHP, HTML, JavaScript, or other code.

Then it seems that it certainly would violate such an open source license. And, I'm not even going to ask why they're including "Flash" in that list other than to wonder where they copied this list from...

Filed Under: content moderation, donald trump, hacked, mastodon, social media, terms of service
Companies: tmtg, trump media and technology, truth social

Facebook Says It Violates The Terms Of Service Of Their New Snoopervision Glasses If You Cover The 'I'm Recording You' LED

from the like-that'll-work dept

You've likely heard by now that Facebook has launched their own version of sunglasses with a built-in camera, in partnership with Ray Ban, called "Ray Ban Stories" (because, seriously, which brand is cooler right now? Facebook? Or Ray Ban?). Lots of people are comparing it to the failed disaster that was Google Glass (which gave rise to the term "Glassholes") or SnapChat's similar product, and lots of people are calling out the potential privacy issues associated with these snoopervision glasses. To be honest, personally I feel like at least some of those concerns are typical moral panics, akin to people freaking out when the camera itself was invented, such as this story about early Kodak cameras:

The appearance of Eastman's cameras was so sudden and so pervasive that the reaction in some quarters was fear. A figure called the "camera fiend" began to appear at beach resorts, prowling the premises until he could catch female bathers unawares. One resort felt the trend so heavily that it posted a notice: "PEOPLE ARE FORBIDDEN TO USE THEIR KODAKS ON THE BEACH." Other locations were no safer. For a time, Kodak cameras were banned from the Washington Monument. The "Hartford Courant" sounded the alarm as well, declaring that "the sedate citizen can't indulge in any hilariousness without the risk of being caught in the act and having his photograph passed around among his Sunday School children."

And, frankly, if someone wants to record people surreptitiously, there are tons of ways to do so today already that are a lot easier (and often a lot cheaper) than an ugly pair of sun glasses. I think the bigger issue in the long run is going to be coming up with a new set of social norms and social cues for what is and what is not appropriate here. But that's a debate for another day.

What amazes me about the rollout of Facebook's glasses is that they seem to think that they can stop people from covering the LED light that goes on when you're recording... by claiming that it's a terms of service violation. That's what a Facebook VP told Buzzfeed writer Katie Notopoulos, whose article on the whole Facebook glasses thing is absolutely worth reading. But this bit is just pure silliness and makes Facebook look ridiculous:

Although you can’t turn off the light on the glasses or through the app, I was able to do this the old fashion way: I put a tiny piece of masking tape over the LED light and colored the tape black with a Sharpie. It covered it up perfectly.

Sometimes to stop the creeps, you have to become...a creep.

Alex Himel, VP of AR at Facebook Reality Labs, informed me over a Zoom chat that taping over the LED light was a violation of the terms of service of the glasses, which prohibit tampering with the device. Be warned.

Yeah, that's not how any of this works. Claiming that putting a piece of tape over a light is "tampering" that violates the terms is highly questionable. Second, thinking that that even matters is just exceptionally silly. If people want to cover the light, they'll cover the light. At least confront that head on rather than with a "ooooh, you'll break your warranty" kind of nonsense. But this is Facebook and Facebook is going to do Facebook type things and believe that the terms of service rules all.

Beyond the ridiculousness of this response, it drifts into right to repair territory and questions of ownership. Facebook has taken over enough of people's lives as is. They shouldn't be out there telling you what you can do with physical products you purchased, even if they're associated with the product.

Filed Under: cameras, glasses, led lights, ownership, privacy, ray ban stories, right to repair, stories, sunglasses, tape, terms of service
Companies: facebook, ray ban

Bad Section 230 Bills Come From Both Sides Of The Aisle: Schakowsky/Castor Bill Would Be A Disaster For The Open Internet

from the that's-not-how-any-of-this-works dept

It truly is stunning how every single bill that attempts to reform Section 230 appears to be written without any intention of ever understanding how the internet or content moderation works in actual practice. We've highlighted tons of Republican-led bills that tend to try to force websites to host more content, not realizing how (1) unconstitutional that is and (2) how it will make the internet into a giant garbage fire. On the Democratic side, the focus seems to be much more on forcing companies to takedown constitutionally protected speech, which similarly (1) raises serious constitutional issues and (2) will lead to massive over-censorship of perfectly legal speech just to avoid liability.

The latest bill of the latter kind comes from Reps. Jan Schakowsky and Rep. Kathy Castor. Schakowsky has been saying for a while now that she was going to introduce this kind of bill to browbeat internet companies into being a lot more proactive in taking down speech she dislikes. The bill, called the Online Consumer Protection Act has now been introduced and it seems clear that this bill was written without ever conferring with anyone with any experience in running a website. It's the kind of thing one writes when you've just come across the problem, but don't think it's worth talking to anyone to understand how things really work. It's also very much a kind of "something must be done, this is something, we should do this" kind of bill that shows up way too often these days.

The premise of the bill is that websites "don't have accountability to consumers" for the content posted by users, and that they need to be forced to have more accountability. Of course, this leaves out the kind of basic fact that if "consumers" are treated badly, they will go elsewhere, so of course every website has some accountability to consumers: it's that if they're bad at it, they will lose users, advertisers, sellers, buyers, whatever. But, that's apparently not good enough for the "we must do something" crowd.

At best the Online Consumer Protection Act will create a massive amount of silly busywork and paperwork for basically any website. At worst, it will create a liability deathtrap for many sites. In some ways it's modeled after the idiotic policy we have regarding privacy policies. Almost exactly a decade ago we explained why the entire idea of a privacy policy is dumb. Various laws require websites to post privacy policies, which no one reads, in part because it would be impossible to read them all. The only way a site gets in trouble is by not following its privacy policy. Thus, the incentives are to craft a very broad privacy policy that gives sites leeway -- meaning they have less incentive to actually create more stringent privacy protections.

The OCPA basically takes the same approach, but... for "content moderation" policies. It requires basically every website to post one:

Each social media platform or online marketplace shall establish, maintain, and make publicly available at all times and in a machine-readable format, terms of service in a manner that is clear, easily understood, and written in plain and concise language.

That terms of service will require a bunch of pointless things, including a "consumer protection policy" which has to include the following:

FOR SOCIAL MEDIA PLATFORMS.—For social media platforms, the consumer protection policy required by subsection (a) shall include—

(A) a description of the content and behavior permitted or prohibited on its service both by the platform and by users;
(B) whether content may be blocked, removed, or modified, or if service to users may be terminated and the grounds upon which such actions will be taken;
(C) whether a person can request that content be blocked, removed, or modified, or that a user’s service be terminated, and how to make such a request;
(D) a description of how a user will be notified of and can respond to a request that his or her content be blocked, removed, or modified, or service be terminated, if such actions are taken;
(E) how a person can appeal a decision to block, remove, or modify content, allow content to remain, or terminate or not terminate service to a user, if such actions are taken; and
(F) any other topic the Commission deems appropriate.

It's difficult to look at that list and not laugh and wonder if whoever came up with it has ever been anywhere near a content moderation or trust & safety team, because that's not how any of this works. Trust & Safety is an ongoing effort of constantly needing to adjust and change with the times, and there is no possible policy that can cover all cases. Can whoever wrote this bill listen to the excellent Radiolab episode about content moderation and think through how that process would have played out under this bill? If every time you change the policies to cover a new case you have to publicly update your already ridiculously complex policies -- while the new requirements be that those same policies are "clear, easily understood, and written in plain and concise language" -- you've created an impossible demand.

Hell, someone should turn this around and push it back on Congress first. Hey, Congress, can you restate the US civil and criminal code such that it is "clear, easily understood, and written in plain and concise language?" How about we try that first before demanding that private companies be forced to do the same for their ever changing policies as well?

Honestly, requiring all of this be in a policy is just begging angry Trumpists to sue websites saying they didn't live up to the promises made in their policies. We see those lawsuits today, but they're kicked out of court under Section 230... but Schakowsky's bill says that this part is now exempted from 230. It's bizarre to see a Democratic bill that will lead to more lawsuits from pissed off Trumpists who have been removed, but that's what this bill will do.

Also, what "problem" does this bill actually solve? From the way the bill is framed, it seems like Schakowsky wants to make it easier for people to complain about content and to get the site to review it. But every social media company already does that. How does this help, other than put the sites at risk of liability for slipping up somewhere?

The bill then has separate requirements for "online marketplaces" which again suggest literally zero knowledge or experience with that space:

FOR ONLINE MARKETPLACES.—For online marketplaces, the consumer protection policy required by subsection (a) shall include—

(A) a description of the products, product descriptions, and marketing material, allowed or disallowed on the marketplace;
(B) whether a product, product descriptions, and marketing material may be blocked, removed, or modified, or if service to a user may be terminated and the grounds upon which such actions will be taken;
(C) whether users will be notified of products that have been recalled or are dangerous, and how they will be notified;
(D) for users—

(i) whether a user can report suspected fraud, deception, dangerous products, or violations of the online marketplace’s terms of service, and how to make such report;
(ii) whether a user who submitted a report will be notified of whether action was taken as a result of the report, the action that was taken and the reason why action was taken or not taken, and how the user will be notified;
(iii) how to appeal the result of a report; and
(iv) under what circumstances a user is entitled to refund, repair, or other remedy and the remedy to which the user may be entitled, how the user will be notified of such entitlement, and how the user may claim such remedy; and

(i) how sellers are notified of a report by a user or a violation of the terms of service or consumer protection policy;
(ii) how to contest a report by a user;
(iii) how a seller who is the subject of a report will be notified of what action will be or must be taken as a result of the report and the justification for such action;
(iv) how to appeal a decision of the online marketplace to take an action in response to a user report or for a violation of the terms of service or consumer protection policy; and
(v) the policy regarding refunds, repairs, replacements, or other remedies as a result of a user report or a violation of the terms of service or consumer protection policy.

Honestly, this reminds me a lot of Josh Hawley's bills, in that it seems that both Hawley and Schakowsky want to appoint themselves product manager for the internet. All of the things listed above are the kinds of things that most companies do already because you need to do it that way. But it's also the kind of thing that has evolved over time as new and different challenges arise, and locking the specifics into law does not take into account that very basic reality. It also doesn't take into account that different companies might not fit into this exact paradigm, but under this bill will be required to act like they do. I can't see how that's at all helpful.

And, it gets worse. It will create a kind of politburo for how all internet websites must be run:

Not later than 180 days after the date of the enactment of this Act, the Commission shall conduct a study to determine the most effective method of communicating common consumer protection practices in short-form consumer disclosure statements or graphic icons that disclose the consumer protection and content moderation practices of social media platforms and online marketplaces. The Commission shall submit a report to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate with the results of the study. The report shall also be made publicly available on the website of the Commission.

Yeah, because nothing works so well as having a government commission jump in and determine the "best" way to do things in a rapidly evolving market.

Also, um, if the government needs to create a commission to tell it what those best practices are why is it regulating how companies have to act before the commission has even done its job?

There are a bunch more requirements in the bill, but all of them are nitty gritty things about how companies create policies and implement them -- something that companies are constantly changing, because the world (and the threats and attacks!) is constantly changing as well. This bill is written by people who seem to think that the internet -- and bad actors on the internet -- are a static phenomena. And that's just wrong.

Also, there's a ton of paperwork for nearly every company with a website, including idiotic and pointless requirements that are busywork, with the threat of legal liability attached! Fun!

FILING REQUIREMENTS.—Each social media platform or online marketplace that either has annual revenue in excess of $250,000 in the prior year or that has more than 10,000 monthly active users on average in the prior year, shall be required to submit to the Commission, on an annual basis, a filing that includes—

(A) a detailed and granular description of each of the requirements in section 2 and this section;
(B) the name and contact information of the consumer protection officer required under subsection (b)(4); and
(C) a description of any material changes in the consumer protection program or the terms of service since the most recent prior disclosure to the Commission

(2) OFFICER CERTIFICATION.—For each entity that submits an annual filing under paragraph (1), the entity’s principal executive officer and the consumer protection officer required under subsection (b)(4), shall be required to certify in each such annual filing that—

(A) the signing officer has reviewed the filing;
(B) based on such officer’s knowledge, the filing does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements, in light of the circumstances under which such statements were made, not misleading;
(C) based on such officer’s knowledge, the filing fairly presents in all material respects the consumer protection practices of the social media platform or online marketplace; and
(D) the signing consumer protection officer—

(i) is responsible for establishing and maintaining safeguards and controls to protect consumers and administer the consumer protection program; and
(ii) has provided all material conclusions about the effectiveness of such safeguards and controls.

So... uh, I need to hire a "consumer protection officer" for Techdirt now? And spend a few thousand dollars every year to have lawyers (and, most likely a new bunch of "compliance consultants" review this totally pointless statement I'll need to sign each year? For what purpose?

The bill also makes sure that our courts are flooded with bogus claims from "wronged" individuals thanks to its private right of action. It also, on top of everything else, exempts various state consumer protection laws from Section 230. That's buried in the bill but is a huge fucking deal. We've talked about this for years, as various state Attorneys General have been demanding it. But that's because those state AGs have a very long history of abusing state "consumer protection" laws to effectively shake down companies. A decade ago we wrote a definitive version of this in watching dozens of state attorneys general attack Topix, with no legal basis, because they didn't like how the company moderated its site. They were blocked from doing anything serious because of Section 230.

Under this bill, that will change.

And we've seen just how dangerous that can be. Remember how Mississippi Attorney General Jim Hood demanded all sorts of information from Google, claiming that the company was responsible for anything bad found online? It later came out (via the Sony Pictures hack) that the entire episode was actually funded by the MPAA, with Hood's legal demands written by the MPAA's lawyers, as part of Hollywood explicit plan to saddle Google with extra legal costs.

Schakowsky's bill would make that kind of corruption an every day occurrence.

And, again, the big companies can handle this. They already do almost everything listed anyway. All this really does is saddle tons of tiny companies (earning more than $250k a year?!?) with ridiculous and overly burdensome compliance costs, which open them up to not just the FTC going after them, but any state attorney general, or any individual who feels wronged by the rules.

The definitions in the bill are so broad that it would cover a ton of websites. Under my reading, it's possible that Techdirt itself qualifies as a "social media platform" because we have comments. This is yet another garbage bill from someone who appears to have no knowledge or experience how any of this works in practice, but is quite sure that if everyone just did things the way she wanted, magically good stuff would happen. It's ridiculous.

Filed Under: busywork, consumer protection, content moderation, ftc, jan schakowsky, kathy castor, paperwork, private right of action, section 230, terms of service

Donald Trump's Website's Terms Of Service Rely On Section 230, And Promise To Remove Content That Violates Its Terms

from the such-cancel-culture dept

We had just noted that should Donald Trump ever launch his rumored social media website, it would undoubtedly rely on Section 230 despite the fact that Trump insisted that Section 230 must be repealed and even tried to block military funding if the law wasn't taken away.

Yet, apparently we don't even need to wait for his vaporware social media website to appear. As the excellent @Section_230 Twitter feed alerts us, the new "The Office of Donald J. Trump" website already appears to invoke the protections of Section 230 by mirroring its language in its terms of service concerning liability for 3rd party content:

OFP takes no responsibility and assumes no liability for any User Content posted, stored or uploaded by you or any third party, or for any loss or damage thereto, nor is OFP liable for any mistakes, defamation, slander, libel, omissions, falsehoods, obscenity, profanity or other objectionable content you may encounter. Your use of Interactive Areas is at your own risk. Enforcement of the user content or conduct rules set forth in these Terms of Service is solely at OFP’s discretion, and failure to enforce such rules in some instances does not constitute a waiver of our right to enforce such rules in other instances. In addition, these rules do not create any private right of action on the part of any third party or any reasonable expectation that the Sites will not contain any content that is prohibited by such rules. As a provider of interactive services, OFP is not liable for any statements, representations, or User Content provided by its users in any Interactive Area.

As you can see, when it's Trump's own website, he declares that he gets full say and full discretion in how to moderate, and should accept no liability "as a provider of interactive services," just as Section 230 makes clear as well. Furthermore, for all of Trump's ridiculous talk about how content moderation is "censorship" or "cancel culture," his own website now makes clear that it may moderate however it sees fit:

Although OFP has no obligation to do so, it reserves the right, and has absolute discretion, to remove, screen or edit any User Content posted or stored on the Sites at any time and for any reason without notice, and you are solely responsible for creating backup copies of and replacing any User Content you post or store on the Sites at your sole cost and expense. Any use of the Interactive Areas or other portions of the Sites in violation of the foregoing violates these Terms of Service and may result in, among other things, termination, or suspension of your rights to use the Interactive Areas and/or the Sites.

And yes, this is all standard boilerplate kinda stuff that lots of websites have. But it demonstrates why websites need to be free to moderate, and why Section 230 is important in protecting websites from liability -- even for former Presidents who claim to hate the law (or, at least, demonstrate near total ignorance of the value of the law). The nice thing about both the 1st Amendment and Section 230 is that it protects you, even if you don't like it.

Filed Under: content moderation, donald trump, intermediary liability, section 230, terms of service

Judge Not Impressed By Parler's Attempt To Force Amazon To Put It Back Online

from the not-how-it-works dept

It appears that Parler's antitrust lawsuit against Amazon for suspending its AWS account isn't off to a very good start. In an emergency hearing on Thursday to see whether or not the judge would order Amazon to turn AWS back on for Parler, the judge declined to do so:

U.S. District Judge Barbara J. Rothstein in Seattle said during a hearing Thursday she’s not inclined to order Amazon to immediately put Parler back online. Instead, she expressed interest in taking a more measured approach to deciding whether she should order a permanent injunction to restore web-services to Parler.

Having spoken to two people who followed the hearing, it sounds like the judge did not make an official ruling yet, but said she will quickly. Another comment I heard from people who listened to the hearing was that Parler's lawyer did not seem to understand some fairly basic concepts regarding how all of this works, which does not bode well for his client. Also, Amazon's lawyer has said that they told Parler that the they would allow the site to return to AWS if it put in place a real content moderation strategy -- which again leans into the fact that they suspended, rather than terminated Parler's account (this has become a key point in the lawsuit, as Parler argues that termination violates their contract, while Amazon says the account was merely suspended, which is different from terminated).

One other point: Parler's lawyer apparently told the judge that Parler could not afford to litigate this case all the way to judgment (in the context of arguing that there would be irreparable harm in not turning the site back on immediately, when asked why any harm couldn't later be dealt with by an award of damages). I find this amusing, because just last week (which feels like a century ago, of course), Parler insisted that it didn't need Section 230 at all and CEO John Matze was saying that Parler was big enough to fight off any lawsuits that would come about without 230. At the time, I pointed out to him that while his backers, the Mercer family, are wealthy, they're not that wealthy.

Still, it's pretty stunning to go from "eh, we can handle such lawsuits if we're liable for our users postings" to "uh, we can't afford this lawsuit we filed to keep our site alive" in just one week.

Filed Under: antitrust, aws, injunction, terms of service
Companies: amazon, parler

New Hampshire Supreme Court Issues Very Weird Ruling Regarding Section 230

from the but-that-makes-no-sense dept

In New Hampshire, Facebook has been dealing with a pro se lawsuit from the operator of a cafe, whose Instagram account was deleted for some sort of terms of service violation (it is never made clear what the violation was, and that seems to be part of the complaint). The Teatotaller cafe in Somerset, New Hampshire, apparently had and lost an Instagram account. The cafe's owner, Emmett Soldati first went to a small claims court, arguing that this violated his "contract" with Instagram, and cost his cafe revenue. There are all sorts of problems with that, starting with the fact that Instagram's terms of service, like every such site, say they can remove you for basically any reason, and specifically says:

You agree that we won’t be responsible . . . for any lost profits, revenues, information, or data, or consequential, special, indirect, exemplary, punitive, or incidental damages arising out of or related to [the Terms of Use], even if we know they are possible. This includes when we delete your content, information, or account.

And then there's the Section 230 issue. Section 230 should have wiped the case out nice and quick, as it has in every other case involving a social media account owner getting annoyed at being moderated. And, indeed, it appears that the local court in Dover tossed the case on 230 grounds. Soldati appealed, and somewhat bizarrely, the New Hampshire Supreme Court has overturned that ruling and sent it back to the lower court. That doesn't mean that Facebook will definitely lose, but the ruling is quite remarkable, and an extreme outlier compared to basically every other Section 230 case. It almost reads as if the judges wanted this particular outcome, and then twisted everything they could think of to get there.

To be clear, the judges who heard the case are clearly well informed on Section 230, as they cite many of the key cases in the ruling. It says that to be protected by Section 230(c)(1) (the famed "26 words" which say a website can't be held liable for the actions of its users), there's a "three pronged" test. The website has to be an interactive computer service -- which Facebook clearly is. The plaintiff has to be an information content provider, which Teatotaller clearly is. That leaves the last bit: does the lawsuit seek to hold Facebook liable as a publisher or speaker.

Let's take a little journey first. One of the things that often confuses people about Section 230 is the interplay between (c)(1) and (c)(2) of the law. (c)(1) is the websites not liable for their users' content part, and (c)(2) is the no liability for any good faith moderation decisions part. But here's the weird thing: in over two decades of litigating Section 230, nearly every time moderation decisions are litigated, the website is considered protected under (c)(1) for those moderation decisions. This used to strike me as weird, because you have (c)(2) sitting right there saying no liability for moderation. But, as many lawyers have explained it, it kinda makes sense. (c)(1)'s language is just cleaner, and courts have reasonably interpreted things to say that holding a company liable for its moderation choices is the same thing as holding it liable as the "publisher."

So, in this case (as in many such cases), Facebook didn't even raise the (c)(2) issue, and stuck with (c)(1), assuming that like in every other case, that would suffice. Except... this time it didn't. Or at least not yet. But the reason it didn't... is... weird. It basically misinterprets one old Section 230 case in the 9th Circuit, the somewhat infamous Barnes v. Yahoo case. That was the case where the court said that Yahoo lost its Section 230 protections because Barnes had called up Yahoo and the employee she spoke to promised to her that she would "take care of" the issue that Barnes was complaining about. The court there said that thanks to "promissory estopel," this promise overrode the Section 230 liabilities. In short: when the company employee promised to do something, they were forming a new contract.

Barnes is one of the most frequently cited case by people trying to get around Section 230, and it almost never works, because companies know better than to make promises like the one that happened in the Barnes case. Except here, the judges say that the terms of service themselves may be that promise, and thus it can be read as the terms of service overrule Section 230:

However, to the extent that Teatotaller’s claim is based upon specific promises that Facebook made in its Terms of Use, Teatotaller’s claim may not require the court to treat Facebook as a publisher. See Barnes, 570 F.3d at 1107, 1109 (concluding that the defendant website was not entitled to immunity under the CDA for the plaintiff’s breach of contract claim under a theory of promissory estoppel because “the duty the defendant allegedly violated springs from a contract—an enforceable promise—not from any non-contractual conduct or capacity of the defendant”); Hiam v. Homeaway.com, Inc., 267 F. Supp. 3d 338, 346 (D. Mass. 2017) (determining that “the Plaintiffs are able to circumvent the CDA” as to certain claims by asserting that “through [the defendant’s] policies, [the defendant] promises (1) a reasonable investigatory process into complaints of fraud and (2) that the website undertakes some measure of verification for each posting”), aff’d on other grounds, 887 F.3d 542 (1st Cir. 2018).

This is not a total win for Teatotaller, as the court basically says there isn't enough information to know whether the claims are based on promises within the terms of service, or if it's based on Facebook's decision to remove the account (in which case, Facebook would be protected by 230). And thus, it remands the case to try to sort that out:

Thus, because it is not clear on the face of Teatotaller’s complaint and objection whether prong two of the CDA immunity test is met, we conclude that the trial court erred by dismissing Teatotaller’s breach of contract claim on such grounds. See Pirozzi, 913 F. Supp. 2d at 849. We simply cannot determine based upon the pleadings at this stage in the proceeding whether Facebook is immune from liability under section 230(c)(1) of the CDA on Teatotaller’s breach of contract claim. See id. For all of the above reasons, therefore, although Teatotaller’s breach of contract claim may ultimately fail, either on the merits or under the CDA, we hold that dismissal of the claim is not warranted at this time.

So, there are still big reasons why this case against Facebook is likely to fail. On remand, the court may recognize that the issue is just straight up moderation and dismiss again on 230 grounds. Or, it may say that it's based on the terms of service and yet still decide that nothing Facebook did violated those terms. Facebook is thus likely to prevail in the long run.

But... this ruling opens up a huge potential hole in Section 230 (in New Hampshire at least), saying that what you put into your terms of service could, in some cases, overrule Section 230, leading you to have to defend whether or not your moderation decision somehow violated your terms.

That sound you hear is very, very expensive lawyers now combing through terms of service on every dang platform out there to figure out (1) how to shore them up to avoid this problem as much as possible, or (2) how to start filing a bunch of sketchy lawsuits in New Hampshire to exploit this new loophole.

Meanwhile, Soldati seems to be celebrating a bit prematurely:

“I think it’s kind of incredible,” said Soldati, who represented himself as a pro se litigant. “I think this is a very powerful message that if you feel a tech company has trampled or abused your rights and you don’t feel anyone is listening ... you can seek justice and it will matter.”

That's... not quite the issue at hand. Your rights weren't trampled. Your account was shut down. That's all. But in fighting this case, there may be a very dangerous hole now punched into Section 230, at least in New Hampshire, and it could create a ton of nuisance litigation. And, that even puts business owners like Soldati at risk. 230 protects him and the comments people make on his (new) Instagram account. But if he promises something... he may wipe out those protections.

Filed Under: emmett soldati, new hampshire, section 230, terms of service
Companies: facebook, instagram, teatotaller

EFF, Orin Kerr Ask The Supreme Court To Prevent Turning The CFAA Into A Convenient Way To Punish Site Users, Security Researchers

from the another-way-to-break-the-internet dept

As we reported here earlier, the Supreme Court is examining a CFAA case that could have far-reaching implications for… well, just about anyone who uses any online service, website, platform, or device. The case deals with a cop who abused his access privileges to run unapproved searches of government databases in exchange for cash. Obviously, this is far from an ideal case to argue against overbroad readings of an overbroad law. But, given the abuses perpetrated under this law, non-ideal cases will have to do if we don't want to be turned into criminals by generous judicial interpretations of the phrase "unauthorized access."

Plenty of people and entities are lobbing briefs in the Supreme Court's direction, begging it to avoid criminalizing activities honest Americans participate in every day. It's not just about security research. But it definitely does affect researchers -- both those engaging in normal security research efforts, and those ignoring websites' terms of service in attempts to determine whether sites engage in biased practices.

The EFF's brief [PDF] focuses mainly on the negative effects on researchers -- security and otherwise. It points out security researchers are often threatened with CFAA prosecutions/lawsuits just because entities engaging in lax security practices don't like having their lapses noticed, much less pointed out publicly. These researchers perform a valuable public service.

Decades of experience have shown that independent auditing and testing of computers by members of the security research community—often in a manner unanticipated and even disapproved by the computers’ owners—is particularly effective at discovering serious vulnerabilities in widely used software and devices.

But far too often they're punished for providing this service.

In 2008, the Massachusetts Bay Transit Authority (“MBTA”) invoked the CFAA to try to enjoin two independent security researchers from presenting truthful information about vulnerabilities in the MBTA’s fare collection system at a security conference. And in United States v. McDanel, the government brought criminal CFAA charges against a defendant who discovered a security vulnerability, alerted the company, and then, when the company refused to fix the problem, alerted the company’s customers…

If arguments about security researchers are too esoteric, perhaps Orin Kerr's arguments [PDF] will hit closer to home. According to the Eleventh Circuit's interpretation of the CFAA, Kerr himself is a criminal.

Like the majority of American adults, I have a Facebook account. Facebook’s terms of service require its users to “[p]rovide accurate information about” themselves. See Facebook Terms of Service, https://www.facebook.com/legal/terms/plain_text_ terms (last visited July 1, 2020). I recently violated that term by listing my home city as Sealand. Sealand is an offshore platform in the North Sea near England built during World War II to host anti-aircraft guns. It’s not actually my home city. I list it only to make a point about the CFAA. But under the government’s position, my joke is no laughing matter. It is a federal crime.

Interpreting the CFAA this way makes every website owner a jokester and every website user the punchline. If you think the thousands of federal laws are arbitrary, just wait until you run into the whims of the thousands of people running sites and platforms.

Part of the problem is that written restrictions placed on computers can be entirely arbitrary. These days, anyone can run a website. Anyone can buy a computer for another person to use. And the computer owners or operators can impose whatever restrictions they want. Their limits don’t need to serve an important interest. They don’t even need to make sense.

Kerr cites the Lori Drew case as a real world example of how the law can be abused by federal prosecutors. Back in 2006, a teen girl committed suicide after being duped into an online relationship with a nonexistent 16-year-old male.

The Drew prosecution started with a terrible tragedy in a suburb of St. Louis, Missouri. In October 2006, a 13-year-old girl named Megan Meier committed suicide. Meier had regularly used the social media networking site MySpace, a then-popular forerunner to today’s Facebook. In the weeks before her death, Meier had communicated with a MySpace profile of what appeared to be a handsome 16-year-old boy named Josh Evans. The Evans account had befriended Meier, and Evans expressed his admiration and affection for Meier.

But the online friendship soured. In messages sent soon before Meier committed suicide, Evans had abruptly ended the relationship. According to one witness, the last message Evans had sent to Meier had said, “You’re a shitty person, and the world would be a better place without you in it.” Lauren Collins, The Friend Game, The New Yorker, Jan. 14, 2008.

An investigation into Meier’s suicide revealed that Josh Evans did not exist. The account was fake. It had been created by a group that knew Meier and used it to learn what Meier was saying about her friend Sarah Drew. The senior member of the group was Sarah’s mother, Lori Drew. Other participants included Ashley Grills, an 18-year-old employee of Mrs. Drew who actually devised the idea and used the account, and Sarah Drew herself.

This was abhorrent behavior by a bunch of adults who discovered the internet provided an avenue for the complete destruction of a person's life. But was it a criminal act? Local prosecutors said being an asshole isn't a crime, no matter how much we'd like it to be.

Despite intense public demand to punish Drew, Missouri state prosecutors declined to file charges. A law enforcement spokesperson explained that decision straightforwardly: Drew’s conduct “might’ve been rude, it might’ve been immature, but it wasn’t illegal.”

With Drew facing intense criticism for her actions, the federal government stepped in with the CFAA in hand to engage in a prosecution for the clicks.

The terms of service gave prosecutors a hook. Because Josh Evans did not exist, using the account violated MySpace’s terms of service. According to prosecutors, this rendered every use of the Evans account an unauthorized access in violation of 18 U.S.C. § 1030(a)(2). And because MySpace’s computer servers were in Los Angeles County, federal prosecutors could bring charges in California even though everyone involved was in Missouri.

Ultimately, Drew was only convicted of misdemeanors. But the feds did such a good job convincing everyone she had broken the law that jury members expressed disappointment in their own verdict.

This -- along with Kerr's example about lying to Facebook about his personal info -- is the reality facing everyone if the Supreme Court decides the Eleventh Circuit is right about this and every other circuit that disagrees with it is wrong. It won't just be the Lori Drews of the world at the mercy of federal prosecutors. It will be everyone who ignores certain parts of terms of service agreements or engages with sites in ways the owners' did not anticipate or explicitly approve.

Filed Under: cfaa, scotus, security, security researchers, supreme court, terms of service