Getting there

HarmfulCommunications201908.org

@@ -13,7 +13,7 @@
 #+AUTHOR: Éibhear Ó hAnluain
 #+EMAIL: eibhear.geo@gmail.com, 086 8565 666, http://www.gibiris.org/eo-blog/
 #+OPTIONS: ^:{} toc:2 H:4 num:t author:t email:nil
-#+TODO: CONSTODO CONSNOTES | CONSDONE
+#+TODO: CONSTODO CONSNOTES | CONSDONE CONSDONTDO
 
 * Planning                                                         :noexport:
 ** Resources                                                       :noexport:
@@ -245,42 +245,7 @@
         * Abuse, child sexual exploitation, hateful conduct, private information, Sensitive media, voilent threats
         * => 60,000 account reported/day
         * => 0.02% of accounts reported
-* CONSDONE Introduction
+* CONSDONTDO The distinction between user behaviours and online services :noexport:
-
-  My name is Éibhear Ó hAnluain and I have been working in software
-  engineering and IT systems design since 1994. I thank you for the
-  opportunity to submit this contribution to your analysis of /issues
-  of online harassment, harmful communications and related offences/.
-
-  In this submission I am seeking to highlight 3 core concerns:
-  - The distinction between user behaviours and online services.
-  - The nature of the online services from the perspective of small
-    operators
-  - The potential damage legislative measures can have on small
-    operators of online services
-
-
-  However, prior to addressing these topics, I would like to raise
-  some ambiguities that this wider discussion will encounter.
-  - The first is the meaning of the term /self-regulation/. If a
-    measure of self-regulation to address these concerns is
-    acceptable, then it would be necessary for public-perception
-    reasons, to be clear on what that means. /Self-regulation/ could
-    mean either where each service operator manages matters of
-    harassment and harmful communications according to their own rules
-    and processes. This is currently how the large service providers
-    we're most familiar with operate. However, /self-regulation/ may
-    also refer to regulation by a non-governmental industry-funded
-    body, following the model of the press council or the advertising
-    standards authority, where rules and processes are agreed among
-    the operators as a set of standards, and where decisions of
-    compliance to these are made by this body.
-
-    In order to avoid this ambiguity, I will use the term
-    "self-moderation" to refer to the former, and the term
-    "industry-regulation" for the latter.
-
-* CONSTODO The distinction between user behaviours and online services
 
   The internet is awash with online harassment and harmful
   communications, and responsible governments and legislators have
@@ -362,8 +327,43 @@
   - The new Copyright Directive...
   - 
 
-* CONSTODO Self-hosting
+* CONSDONE Introduction
-** CONSTODO Self-hosting
+
+  My name is Éibhear Ó hAnluain and I have been working in software
+  engineering and IT systems design since 1994. I thank you for the
+  opportunity to submit this contribution to your analysis of /issues
+  of online harassment, harmful communications and related offences/.
+
+  In this submission I am seeking to highlight 3 core concerns:
+  - The distinction between user behaviours and online services.
+  - The nature of the online services from the perspective of small
+    operators
+  - The potential damage legislative measures can have on small
+    operators of online services
+
+
+  However, prior to addressing these topics, I would like to raise
+  some ambiguities that this wider discussion will encounter.
+  - The first is the meaning of the term /self-regulation/. If a
+    measure of self-regulation to address these concerns is
+    acceptable, then it would be necessary for public-perception
+    reasons, to be clear on what that means. /Self-regulation/ could
+    mean either where each service operator manages matters of
+    harassment and harmful communications according to their own rules
+    and processes. This is currently how the large service providers
+    we're most familiar with operate. However, /self-regulation/ may
+    also refer to regulation by a non-governmental industry-funded
+    body, following the model of the press council or the advertising
+    standards authority, where rules and processes are agreed among
+    the operators as a set of standards, and where decisions of
+    compliance to these are made by this body.
+
+    In order to avoid this ambiguity, I will use the term
+    "self-moderation" to refer to the former, and the term
+    "industry-regulation" for the latter.
+
+* CONSDONE Self-hosting
+** CONSDONE Self-hosting
    For the purposes of this submission, /self-hosting/ is where an
    individual or small group has opted to provide their own internet
    services, making use either of computer capacity provided by an ISP
@@ -385,14 +385,74 @@
    self-hosting has more a direct implication on the former use-cases,
    as the effect of poor regulation on vulnerable people would be more
    direct, immediate and serious.
-*** Why self-host?
+
+*** CONSTODO Real examples of self-hosting
+    I host a number of such services:
+    - [[http://www.gibiris.org/eo-blog][/Éibhear/Gibiris/]] is my blog site.
+    - [[https://social.gibiris.org/][/Social Gibiris/]] is a micro-blogging service that is federated
+      with others using the /AtomPub/ technology. Thus, /Social
+      Gibiris/ is federated with many other instances of /GNU Social/,
+      /Mastodon/ and /Pleroma/. This network of federated services,
+      operated by individuals, groups and businesses, all connected
+      together as peers, facilitate connections and communication in a
+      way that is very little different to twitter.
+    - [[https://git.gibiris.org/][/git.gibiris.org/]] is a source-code sharing site that I use to
+      make publicly available some of the software that I develop for
+      myself.
+    - [[https://news.gibiris.org/][/news.gibiris.org/]] is a news-aggregation that allows me to
+      gather all the news sources of interest to me into one location,
+      which I can then access from wherever I am.
+    - [[https://cloud.gibiris.org/nextcloud][/cloud.gibiris.org/]] is a file-sharing platform that I use with
+      my family when we are collaborating on projects (e.g. school
+      projects, home improvement projects, etc.)
+    - [[https://matrix.gibiris.org/][/matrix.gibiris.org/]] is an instant-messaging system which I set
+      up for the purposes of communicating with my family and close
+      friends.
+
+    Most of these services are hosted on a computer within my home. 3
+    of these services provide information to the general public, and
+    the other three are accessible only to those who set up accounts.
+
+    2 of those services, /git.gibiris.org/ and /Social Gibiris/ can
+    process or post user-uploaded information.
+
+*** CONSTODO Why self-host?
 
     There is a myriad of reasons for choosing to host one's own
     service. Some examples might be:
+    - Privacy -- until recently many services were careless or
+      outright abusive users' privacy
+    - Tracking -- the extent to which organisations, particularly
+      those whose business models are based on advertising, facilitate
+      the tracking of internet users as they conduct their business or
+      personal activities across the internet.
+    - Autonomy -- to be able to configure ones own service is often a
+      powerful experience.
+    - Community -- While some of the global services with household
+      names offer features go small businesses and community groups
+      (like footall clubs or debating societies), often the lock-in
+      and exclusivity involved can make it hard to include everyone
+      who needs to be involved. Hosting your own services allows you
+      to set the rules and codes of conduct.
+    - Experimentation -- just by means of playing with interesting
+      software projects can people often learn about the tools and
+      systems they use, and grow their knowledge of the technologies
+      involved.
+    - Collaboration -- the softwas that implements self-hosted
+      services often some under the terms of a Free or Open Source
+      Software copyright licence, which allows for peope to copy and
+      improve software, and these improvements often find their back
+      to the original project for others to benefit.
+    - Protection -- Governments in countries where civil rights are
+      not regarded as highly as they are in Ireland very often delight
+      in the greater ease involved in surveilling their populations
+      when the record of all that activity is centralised in a single
+      service.
 
+    Very often, as with me, the reason to self-host is a combination
+    of more than 1 of these reasons.
 
-** CONSTODO How accessible is self-hosting.
+** CONSDONE How accessible is self-hosting.
-*** CONSTODO Technical protocols
    In a previous, similar, submission[fn:dccae:Available [[http://www.gibiris.org/eo-blog/posts/2019/04/15_harmful-content-consultation.html][here]] and
    [[https://www.dccae.gov.ie/en-ie/communications/consultations/Documents/86/submissions/Eibhear_O_HAnluain.pdf][here]].], I provide an outline of the challenges before someone who
    wants to set up their own services. There are few, and they are
@@ -402,18 +462,19 @@
      defined in a set of publicly-available documents describing the
      relevant protocols.
    - Due to the maturity and age of these protocols, software needed
-      to use them is now abundant and trivially easy to get and
+     to use them is now abundant and trivially easy to get and install
-      install and run on a computer. Such software is also very easy
+     and run on a computer. Such software is also very easy to develop
-      to develop for moderately-skilled software engineers.
+     for moderately-skilled software engineers.
    - Neither the protocols that define, nor the software that
      implement the internet regard any computer to be superior or
-      inferior to any other computer. For this reason, there is no
+     inferior to any other computer. For this reason, there is no cost
-      cost or capacity barrier for someone to cross in order to run an
+     or capacity barrier for someone to cross in order to run an
      internet service: if you have the software, and the internet
      connection, then you can expose such a service.
 
    Clear examples from the past of how the accessibility of the
-    internet technologies has benefited the world include the following:
+   internet technologies has benefited the world include the
+   following:
    - The /Linux/ operating system kernel began life in 1991 as a
      college project -- Linus Torvalds wanted to write a computer
      operating system that was accessible to all. Linux-based
@@ -432,14 +493,13 @@
      /nginx/. It also started out as a project by an individual who
      wanted to solve a particular project.].
    - The /Firefox/ web browser was initiated by three software
-      developers who wanted to make a light-weight browser based on
+     developers who wanted to make a light-weight browser based on the
-      the Mozilla code-base. At the height of its popularity,
+     Mozilla code-base. At the height of its popularity, /Firefox/ was
-      /Firefox/ was used in 34% of web-page requests, despite not
+     used in 34% of web-page requests, despite not coming installed by
-      coming installed by default on any computer or mobile
+     default on any computer or mobile device. However, its real
-      device. However, its real impact is that it was instrumental in
+     impact is that it was instrumental in breaking the monopoly that
-      breaking the monopoly that Microsoft's Internet Explorer held
+     Microsoft's Internet Explorer held since the late '90s, resulting
-      since the late '90s, resulting in far richer and more secure
+     in far richer and more secure web.
-      web.
 
    When we look at the main services that society is currently
    struggling with, we need to consider the following historical
@@ -462,12 +522,11 @@
    rise to the explosion of services that connect people, and people
    with businesses.
 
-    It is critical to note that many of these technologies and
+   It is critical to note that many of these technologies and services
-    services started out with an individual or small group developing
+   started out with an individual or small group developing an idea
-    an idea and showing it can work *prior* to receiving the large
+   and showing it can work *prior* to receiving the large capital
-    capital investments that result in their current dominance.
+   investments that result in their current dominance.
 
-*** CONSTODO The nature of self-hosting
    All of the above technologies and services can be considered truly
    disruptive. In their respective domains, their arrivals resulted in
    a dramatic improvements in internet technologies and services.
@@ -482,62 +541,34 @@
      /Dropbox/.
 
    In the cases of all these alternatives, users can sign up for
-    accounts on "instances" operated by third-party providers, or
+   accounts on "instances" operated by third-party providers, or users
-    users can set up their own instances and operate the services
+   can set up their own instances and operate the services themselves.
-    themselves.
 
-    Many of these services can federate with others. Federation in
+   Many of these services can federate with others. Federation in this
-    this context means that there can be multiple instances of a
+   context means that there can be multiple instances of a service,
-    service, communicating with each other over a defined protocol,
+   communicating with each other over a defined protocol, sharing
-    sharing updates and posts. For users, federation means that they
+   updates and posts. For users, federation means that they can
-    can interact with other users who aren't necessarily on the same
+   interact with other users who aren't necessarily on the same node
-    node or instance. For administrators of instances, federation
+   or instance. For administrators of instances, federation means that
-    means that they can configure their instances according to their
+   they can configure their instances according to their own
-    own preferences, rather than having to abide by the rules or
+   preferences, rather than having to abide by the rules or technical
-    technical implementation of someone else.
+   implementation of someone else.
 
-*** CONSTODO Real examples of self-hosting
+** CONSDONE Regulation of self-hosted services
-    I host a number of such services:
-    - [[http://www.gibiris.org/eo-blog][/Éibhear/Gibiris/]] is my blog site.
-    - [[https://social.gibiris.org/][/Social Gibiris/]] is a micro-blogging service that is federated
-      with others using the /AtomPub/ technology. Thus, /Social
-      Gibiris/ is federated with many other instances of /GNU Social/,
-      /Mastodon/ and /Pleroma/.
-    - [[https://git.gibiris.org/][/git.gibiris.org/]] is a source-code sharing site that I use to
-      make publicly available some of the software that I develop for
-      myself.
-    - [[https://news.gibiris.org/][/news.gibiris.org/]] is a news-aggregation that allows me to
-      gather all the news sources of interest to me into one location,
-      which I can then access from wherever I am.
-    - [[https://cloud.gibiris.org/nextcloud][/cloud.gibiris.org/]] is a file-sharing platform that I use with
-      my family when we are collaborating on projects (e.g. school
-      projects, home improvement projects, etc.)
-    - [[https://matrix.gibiris.org/][/matrix.gibiris.org/]] is an instant-messaging system which I set
-      up for the purposes of communicating with my family and close
-      friends.
-
-    Most of these services are hosted on a computer within my home. 3
-    of these services provide information to the general public, and
-    the other three are accessible only to those who set up accounts.
-
-    2 of those services, /git.gibiris.org/ and /Social Gibiris/ can
-    process or post user-uploaded information.
-
-** CONSTODO Regulation of self-hosted services
 
    While it is attractive to create regulations to manage the large,
    profit-making organisations, it is imperative that such
    regulations don't harm the desire of those who want to create
    their own services.
 
-   Regulations that apply liability a service-provider for someone
+   A regulation that apply liability to a service-provider for someone
    else's behaviour, is a regulation that can be adhered to only by
    organisations with large amounts of money to hand. For example, if
    the regulation was to apply liability on me for a posting made by
-   someone else (and *somewhere* else -- these are federated services
+   someone else that appears on one of the services that I run (and
-   after all) that appear on one of the services that I run, I would
+   originally posted *somewhere* else -- these are federated services
-   have to shut them down, as I would not be able to put in place the
+   after all), I would have to shut it down; I am not able to put in
-   necessary infrastructure that would mitigate my
+   place the necessary infrastructure that would mitigate my
    liability[fn:copyrightDirective:This assumes that my services
    aren't forced to shut down by the new EU Copyright Directive
    anyway]. Given that my services are intended to provide a positive
@@ -564,14 +595,20 @@
    pop into the heads of individuals, who will realise them with
    nothing more than a computer connected to the internet.
 
-* CONSTODO Abuse
+* CONSTODO Other considerations
+  While the main focus of this submission is to highlight the
+  potential risk to self-hosters from regulation that neglect to
+  consider the practice, I would like to take the opportunity to
+  briefly raise some additional concerns
 
-  All systems that seek to protect people from harmful or other
+** CONSTODO Abuse
-  objectionable material (e.g. copyright infringement, terrorism
+
-  propaganda, etc.) have, to date, been amenable to abuse. For
+   To date, all systems that seek to protect others from harmful or
-  example, in a recent court filing, Google claimed that 99.97% of
+   other objectionable material (e.g. copyright infringement,
-  infringement notices it received in from a single party in January
+   terrorism propaganda, etc.) have, to date, been very amenable to
-  2017 were
+   abuse. For example, in a recent court filing, Google claimed that
+   99.97% of infringement notices it received in from a single party
+   in January 2017 were
    bogus[fn:googleTakedown:https://www.techdirt.com/articles/20170223/06160336772/google-report-9995-percent-dmca-takedown-notices-are-bot-generated-bullshit-buckshot.shtml]:
 
    #+BEGIN_QUOTE
@@ -590,43 +627,32 @@
    index.
    #+END_QUOTE
 
-  Aside from the percentage of URLs noted that don't exist in
+   That a single entity would submit more than 16 million URLs for
-  Google's index, that a single entity would submit more than 16
+   delisting in a single month is staggering, and demonstrates a
-  million URLs for delisting in a single month is staggering, and
+   compelling point: there is no downside for a bad-faith actor
-  demonstrates a compelling point: there is no downside for a
+   seeking to take advantage of a system for suppressing
-  bad-faith actor seeking to take advantage of a system for
+   information[fn:downside:The law being used in this specific case is
-  suppressing information[fn:downside:The law being used in this
+   the US Digital Millennium Copyright Act. It contains a provision
-  specific case is the US Digital Millennium Copyright Act. It
+   that claims of copyright ownership on the part of the claimant are
-  contains a provision that claims of copyright ownership on the part
+   to be made under penalty of perjury. However, that provision is
-  of the claimant are to be made under penalty of perjury. However,
+   very weak, and seems not to be a deterrent for a determined agent:
-  that provision is very weak, and seems not to be a deterrent for a
-  determined agent:
    https://torrentfreak.com/warner-bros-our-false-dmca-takedowns-are-not-a-crime-131115].
 
-  More recently, there is the story of abuse of the GDPR's /Right to
+   The GDPR's /Right to be Forgotten/ is also subject to abuse. An
-  be Forgotten/. An individual from Europe made a claim in 2014,
+   individual from Europe continues to have stories related to him
-  under the original /Right to be Forgotten/, to have stories related
+   excluded from Google searches. However appropriate on the face of
-  to him excluded from Google searches for him. This seemed to have
+   it, the stories this individual is now getting suppressed relate to
-  been an acceptable usage under those rules. However, that this
+   his continued abuse of the /Right to be
-  claim was made and processed seems also to be a matter of public
+   Forgotten/[fn:RTBF:https://www.techdirt.com/articles/20190320/09481541833]. That
-  interest, and some stories were written in the online press
+   the "right" can be abused in this way is counter to the public
-  regarding it. Subsequently, the same individual used the /Right to
+   interest, as it can now be used like a "Super Injunction".
-  be Forgotten/ to have *these* stories excluded from Google
-  searches.
 
-  This cat-and-mouse game continues to the extent that the individual
+   While the GDPR allows for search engines "... exercising the right
-  is (successfully) requiring Google to remove stories *about his
+   of freedom of expression and information", if they are presented
-  use* of the GDPR's /Right to be Forgotten/. Even stories that cover
+   with /Right to be Forgotten/ demands, they have to choose between
-  *only* his /Right to be Forgotten/ claims, making no reference at
+   serious sanctions if they don't filter the results when they should
-  all to the original (objected-to)
+   have, or no sanctions if they suppress the results when they didn't
-  story[fn:RTBF:https://www.techdirt.com/articles/20190320/09481541833]. This
+   need to.
-  is clearly an abuse of the law: Google risks serious sanction from
-  data protection authorities if it decides to invoke the
-  "... exercising the right of freedom of expression and information"
-  exception[fn:FoE_GPDR:GDPR, Article 17, paragraph 3(a)] and it is
-  determined that the exception didn't apply. However, the claimant
-  suffers no sanction if it is determined that the exception /does/
-  apply.
 
    In systems that facilitate censorship[fn:censorship:While seeking
    to achieve a valuable and socially important goal, this
@@ -639,17 +665,113 @@
    including having to shutdown) and where a claimant suffers nothing
    for abusive claims, the regime is guaranteed to be abused.
 
-* CONSTODO Harmful content definition
+** CONSTODO Behaviour
-
-  This submission will not offer any suggestions as to what should be
-  considered "harmful content". However, I am of the belief that if
-  "harmful content" is not narrowly defined, the system will allow
-  bad actors to abuse it, and in the context where there is no risk
-  to making claims, and great risk in not taking down the reported
-  postings, loose definitions will only make it easier for
-  non-harmful content to be removed.
 
+** CONSTODO Content moderation
 * CONSTODO Answers to consultation questions
+  The follows are some answers to the questions posed in the call for
+  submissions.
+** CONSTODO Definition of communication in legislation
+   1. There are currently significant gaps in legislation with regard
+      to harassment and newer, more modern forms of communication. Is
+      there a need to expand the definition of ‘communications’ to
+      include online and digital communications tools such as
+      WhatsApp, Facebook, Snapchat, etc.  when addressing crimes of
+      bullying or harassment?
+      - Éibhear comment :: (/Address in introduction/) It is necessary
+           not to assume that the current services that operate will
+           be the primary services in 5 or 10 years' time.
+   2. What lessons can be learned from models used in other
+      jurisdictions such as the UK, New Zealand, Australia and other
+      European countries where legislation is now in place to address
+      these issues? How do we establish an appropriate model without
+      compromising free speech?
+      - Éibhear comment :: (/Address in answer to specific questions/)
+           UK: duty of care is inappropriate. New Zealand: allowing a
+           committee to decide what is objectionable, thus restricting
+           not only those who want to share objectionable material,
+           but also those who want to report on it.
+   3. How do we ensure that any legislation that is enacted is
+      flexible enough to keep up with changing and advancing
+      technologies, new apps and other online forums, including the
+      more familiar social media sites?
+      - Éibhear's comments :: (/Core concern/) Hmm. This is the meat
+           of the submission.
+** CONSTODO Harassment, stalking & other forms of online abuse
+   4. [@4] Online harassment can take the form of on-consensual taking
+      and distribution of intimate images or videos, otherwise known
+      as ‘revenge porn’, ‘upskirting’, ‘downblousing’ and other forms
+      of sharing of imagery online without consent. What approaches
+      are taken to addressing these issues in other jurisdictions?
+      - Éibhear's comment :: No answer for this
+   5. New offences are proposed to cover these issues in Deputy
+      Brendan Howlin’s Private Members Bill on this subject. Is the
+      creation of new offences necessary, or is existing legislation
+      sufficient? Should other forms of image-sharing issues - such as
+      exposure - also be addressed?
+      - Éibhear's comment :: No answer for this
+   6. What kind of oversight and regulation of online service
+      providers is possible/used in other jurisdictions? Currently,
+      online providers are self regulated. Is a proactive,
+      self-regulating approach from online companies to activities
+      such as revenge porn and other forms of harassment preferable to
+      the creation of more laws?
+      - Éibhear's comment :: Important to know the difference
+           between "self regulated", and pro-active
+           moderation. These service moderation according to their
+           own rules; there is no industry authority like the press
+           council or the advertising standards authority, which are
+           self-regulatory regimes.
+   7. Is any data provided by online service providers in relation to
+      the reporting or prevalence of activities such as
+      upskirting/revenge porn/cyberbullying and other online behaviour
+      that can be used to develop and draft future legislation?
+      - Éibhear's comment :: No data. However, services should be
+           encouraged to issue reports on their moderation efforts.
+   8. To what extent are An Garda Síochána equipped and resourced to
+      deal with the issues arising from harmful online communications
+      such as these?
+      - Éibhear's comment :: No answer for this
+   9. Should ‘cyberstalking’ be treated as a separate offence to
+      online harassment? What constitutes stalking-type behaviour
+      online? Is there a need to legislative specifically for this
+      activity?
+      - Éibhear's comment :: No answer for this
+   10. Based on the findings of other jurisdictions such as in the UK,
+       An Garda Síochána will require consistent training in order to
+       maintain an appropriate level of knowledge with regard to
+       indictable behaviours. Are resources available for this?
+       - Éibhear's comment :: No answer for this
+   11. Fake accounts/troll accounts used to harass or target others
+       with abuse – what measures can be taken in relation to these
+       without effecting freedom of expression?
+       - Éibhear's comment :: Care needs to be taken to ensure
+            manage/prevent false identification of accounts as 'fake'
+            or 'troll'.
+   12. Do other jurisdictions have statutory measures to protect
+       victim identities in cases of online harassment being released
+       online posthearings, etc?
+       - Éibhear's comment :: No answer for this
+** CONSTODO Harmful online behaviour and young people
+   13. [@13] How do we most appropriately regulate social media
+       platforms to prevent cyberbullying and inappropriate sharing of
+       personal images?
+       - Éibhear's comment :: take details from earlier submission.
+   14. For young people who participate in such online behaviour as
+       consensual image sharing, how can it be ensured that they are
+       not inadvertently criminalised when legislation is enacted?
+       What safeguards can be put in place?
+       - Éibhear's comment :: No answer for this
+   15. Deputy Brendan Howlin’s Private Members Bill provides that
+       those under 17 should not be fined/imprisoned but put into
+       relevant education or supports. Would these supports be part of
+       the same educational supports offered to all young
+       people/schools or would they be a separate entity? Are current
+       supports being utilised? Are there sufficient resources to
+       provide for such a provision when enacted?
+       - Éibhear's comment :: No answer for this
+
+* CONSDONTDO Answers to consultation questions                     :noexport:
 ** CONSTODO Strand 1 -- National Legislative Proposal
 *** CONSTODO Question 1 -- Systems
     - The legislation should state in an unequivocal manner that it is