self-hosting-advocacy/harmful-communications-201910
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Under pressure!

Browse source
This commit is contained in:
Éibhear Ó hAnluain 2019-09-14 16:28:36 +01:00
parent 909f59763d
commit b34ef48974
1 changed files with 211 additions and 194 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

405
HarmfulCommunications201908.org
View file

@ -130,11 +130,11 @@
*** Online Harrassment, harmful communications and related offences *** Online Harrassment, harmful communications and related offences
*Possible issues for address* *Possible issues for address*
**** Definition of communication in legislation **** Definition of communication in legislation
1. There are currently significant gaps in legislation with 1. There are currently significant gaps in legislation with
regard to harassment and newer, more modern forms of regard to harassment and newer, more modern forms of
communication. Is there a need to expand the definition of communication. Is there a need to expand the definition of
‘communications’ to include online and digital communications ‘communications’ to include online and digital communications
tools such as WhatsApp, Facebook, Snapchat, etc. when tools such as WhatsApp, Facebook, Snapchat, etc. when
addressing crimes of bullying or harassment? addressing crimes of bullying or harassment?
- Éibhear comment :: (/Address in introduction/) It is - Éibhear comment :: (/Address in introduction/) It is
necessary not to assume that the current services that necessary not to assume that the current services that
@ -357,83 +357,76 @@
(early 2018) and relevant. However it's not alone, and as we look at (early 2018) and relevant. However it's not alone, and as we look at
pending legislation coming to us both domestically and from the EU, pending legislation coming to us both domestically and from the EU,
it's hard not to see the same failures repeating: it's hard not to see the same failures repeating:
- Pat Rabbitte's and - Pat Rabbitte's and Lorraine Higgins' bills, since withdrawn
- The EU Terrorism Content Directive... - The EU Terrorism Content Directive...
- The new Copyright Directive... - The new Copyright Directive...
- -
** CONSTODO The nature of the internet from the perspective of the technology * CONSTODO Self-hosting
** CONSTODO Self-hosting
For the purposes of this submission, /self-hosting/ is where an
individual or small group has opted to provide their own internet
services, making use either of computer capacity provided by an ISP
(for example, Blacknight.com, Amazon AWS) or by maintaining the
computer technology themselves.
The services that the self-hoster exposes, then, are either
developed specifically by the self-hoster or runs software that has
been installed by the self-hoster.
The self-hoster also takes responsibility for the quality of the
service that they provide, including ensuring that it is kept
running and updates are applied appropriately, and so on.
This submission is primarilty concerned about self-hosting as a
hobby and self-hosting engaged in by charity, non-governmental or
community organisations. However, self-hosting for commercial
purposes is a valid use-case, but implications of regulations on
self-hosting has more a direct implication on the former use-cases,
as the effect of poor regulation on vulnerable people would be more
direct, immediate and serious.
*** Why self-host?
There is a myriad of reasons for choosing to host one's own
service. Some examples might be:
** CONSTODO How accessible is self-hosting.
*** CONSTODO Technical protocols *** CONSTODO Technical protocols
Formally, "the Internet" is a mechanism for identifying computers In a previous, similar, submission[fn:dccae:Available [[http://www.gibiris.org/eo-blog/posts/2019/04/15_harmful-content-consultation.html][here]] and
on a network, and for ensuring that messages from one computer on [[https://www.dccae.gov.ie/en-ie/communications/consultations/Documents/86/submissions/Eibhear_O_HAnluain.pdf][here]].], I provide an outline of the challenges before someone who
the network get to another computer. For this purpose, each wants to set up their own services. There are few, and they are
computer is assigned an address (e.g. 78.153.214.9). This system small. In summary, the reasons for this are:
is called The Internet Protocol[fn:IP:[[https://tools.ietf.org/html/rfc791][As defined in RFC 791: - The Internet is mechanism for computers to find each other and
https://tools.ietf.org/html/rfc791]]]. then to share information with each other. The mechanism is
defined in a set of publicly-available documents describing the
relevant protocols.
- Due to the maturity and age of these protocols, software needed
to use them is now abundant and trivially easy to get and
install and run on a computer. Such software is also very easy
to develop for moderately-skilled software engineers.
- Neither the protocols that define, nor the software that
implement the internet regard any computer to be superior or
inferior to any other computer. For this reason, there is no
cost or capacity barrier for someone to cross in order to run an
internet service: if you have the software, and the internet
connection, then you can expose such a service.
These dotted-notation addresses are associated with more Clear examples from the past of how the accessibility of the
easy-to-remember name-based addresses by means of a system called internet technologies has benefited the world include the following:
the "Domain Name System"[fn:DNS:As defined by [[https://tools.ietf.org/html/rfc1034][RFC 1034 - The /Linux/ operating system kernel began life in 1991 as a
(https://tools.ietf.org/html/rfc1034)]] and [[https://tools.ietf.org/html/rfc1035][RFC 1035 college project -- Linus Torvalds wanted to write a computer
(https://tools.ietf.org/html/rfc1035)]].]. operating system that was accessible to all. Linux-based
operating systems now form the basis of a significant proportion
There are a number of protocols[fn:protocols:For the purposes of of internet connected computing devices
this document, a protocol is a set of instructions detailing how
two or more computers should express queries and responses to each
other] for transmitting messages over the Internet, with two of
the more common being
"TCP"[fn:TCP:https://tools.ietf.org/html/rfc1035] and
"UDP"[fn:UDP:https://en.wikipedia.org/wiki/User_Datagram_Protocol].
The software required to implement these communications protocols
is installed onto all forms of internet-connected devices, ranging
from objects as small as (or smaller than) heart pacemakers, to as
large as the largest super-computers.
This software is not aware of the size or capacity of the device
it's installed on. Similarly, the protocols mentioned above have
no regard to the purpose its host computer has, nor to who owns
it, nor to how large it is.
The "World Wide Web" (the Web), from a technological perspective,
is /not/ the Internet. The Web is a set of defined protocols that
make use of the Internet. Unlike the Internet and transmission
protocols -- which are designed to require each computer to regard
all others are peers -- the Web operates a little more on a
client-server basis: the software package, often referred to as a
web browser, on one computer is used to request specific
information from the software package, often referred to as the
web server, on the other computer.
However, despite the "client-server" nature of the Web, due to the
simplicity of the software needed for a computer to be a web
server, you can find web serving software operating on extremely
small "IoT" devices.
*** CONSTODO Low barrier of entry for useful technology
The above demonstrates that someone with a computer, a connection
to the internet and sufficient time and determination can set up a
web service that will function just like the services we're all
familiar with.
This is exemplified by the development of certain internet-related
technology in recent decades:
- The /Linux/ operating system kernel is named after its inventor,
Linus Torvalds, who started work on it in 1991 as a college
project -- he wanted to write a computer operating system that
was accessible to all, and which functioned in a specific
way. The Linux operating system now forms the basis of a
significant proportion of internet connected computing devices
globally[fn:LinuxProportions:https://en.wikipedia.org/wiki/Usage_share_of_operating_systems] globally[fn:LinuxProportions:https://en.wikipedia.org/wiki/Usage_share_of_operating_systems]
(including 73% of smartphones and tablet computers, through (including 73% of smartphones and tablet computers, somewhere
Google's Android, and somewhere between 36% and 66% of between 36% and 66% of internet-facing server computers), and
internet-facing server computers), and 100% of supercomputers. 100% of supercomputers.
- The /Apache/ web server started development when a group of 8 - The /Apache/ web server started development when a group of 8
software developers decided they wanted to add functionality to software developers wanted to add functionality to one of the
one of the original web server software packages, /NCSA original web server software packages, /NCSA httpd/. The Apache
httpd/. The Apache web server now powers 43.6% of all web web server now powers 43.6% of all web
sites[fn:apacheProportions:[[https://w3techs.com/technologies/overview/web_server/all][https://w3techs.com/technologies/overview/web_server/all]]. Incidentally, sites[fn:apacheProportions:[[https://w3techs.com/technologies/overview/web_server/all][https://w3techs.com/technologies/overview/web_server/all]]. Incidentally,
the no. 2 on that web page, with nearly 42% share of websites is the no. 2 on that web page, with nearly 42% share of websites is
/nginx/. It also started out as a project by an individual who /nginx/. It also started out as a project by an individual who
@ -448,20 +441,43 @@
since the late '90s, resulting in far richer and more secure since the late '90s, resulting in far richer and more secure
web. web.
** CONSTODO Self-hosting When we look at the main services that society is currently
struggling with, we need to consider the following historical
facts:
- Facebook started out as a crude service, developed in Mark
Zuckerberg's room in Harvard University, to allow users (men, of
course) to rate the women in the university in terms of
"hotness".
- Google started out as a search engine called
"Backrub". Development initially took place in a garage.
- eBay was originally an auction service tagged onto the personal
website of its founder, Pierre Omidyar.
- LinkedIn was initially developed in Reid Hoffman's apartment
in 2003.
- Shutterstock, a leading provider of stock images, was founded by
a photographer, John Oringer, who developed the service as a
means to make available 30,000 of his own photographs.
The ease with which internet technology can be accessed has given
rise to the explosion of services that connect people, and people
with businesses.
It is critical to note that many of these technologies and
services started out with an individual or small group developing
an idea and showing it can work *prior* to receiving the large
capital investments that result in their current dominance.
*** CONSTODO The nature of self-hosting *** CONSTODO The nature of self-hosting
Both the /Linux/ operating system kernel and the /Firefox/ web All of the above technologies and services can be considered truly
browser can be considered truly disruptive technologies. In both disruptive. In their respective domains, their arrivals resulted in
of their domains, their arrival resulted in a dramatic a dramatic improvements in internet technologies and services.
improvements in internet and other technologies.
This affect isn't unique to those examples. There are many However, There are many alternatives to the systems that we are
alternatives to the systems that we are familiar with, all familiar with, all developed by individuals, or small, enthusiastic
developed by individuals, or small, enthusiastic teams: teams:
- /Twitter/ isn't the only micro-blogging service: there's also - /Twitter/ isn't the only micro-blogging service: there's also
/GNU Social/, /Mastodon/. /GNU Social/, /Pleroma/, /Mastodon/.
- One alternative to /Facebook/ is /diaspora*/ - An alternative to /Facebook/ is /diaspora*/
- /Nextcloud/ and /Owncloud/ are examples of alternatives to - /Nextcloud/ and /Owncloud/ are examples of alternatives to
/Dropbox/. /Dropbox/.
@ -507,130 +523,131 @@
2 of those services, /git.gibiris.org/ and /Social Gibiris/ can 2 of those services, /git.gibiris.org/ and /Social Gibiris/ can
process or post user-uploaded information. process or post user-uploaded information.
*** CONSTODO Regulation of self-hosted services ** CONSTODO Regulation of self-hosted services
While it is attractive to create regulations to manage the large, While it is attractive to create regulations to manage the large,
profit-making organisations, it is imperative that such profit-making organisations, it is imperative that such
regulations don't harm the desire of those who want to create regulations don't harm the desire of those who want to create
their own services. their own services.
Any regulation that applies liability on the service for someone Regulations that apply liability a service-provider for someone
else's words or behaviour, is a regulation that can be adhered to else's behaviour, is a regulation that can be adhered to only by
only by organisations with large amounts of money to hand. For organisations with large amounts of money to hand. For example, if
example, if the regulation was to apply liability on me for the regulation was to apply liability on me for a posting made by
posting made by someone else (and *somewhere* else -- these are someone else (and *somewhere* else -- these are federated services
federated services) on the 2 implicated services that I run, I after all) that appear on one of the services that I run, I would
would have to shut them down, as I would not be able to put in have to shut them down, as I would not be able to put in place the
place the necessary infrastructure that would mitigate my necessary infrastructure that would mitigate my
liability[fn:copyrightDirective:This assumes that my services liability[fn:copyrightDirective:This assumes that my services
aren't forced to shut down by the new EU Copyright Directive aren't forced to shut down by the new EU Copyright Directive
anyway]. Given that my services are intended to provide a positive anyway]. Given that my services are intended to provide a positive
benefit to me, my family members and my friends, and that I have benefit to me, my family members and my friends, and that I have no
no desire to facilitate harmful behaviour on those services, a law desire to facilitate harmful behaviour on these services, a law
forcing me to shut these services down benefits no one. forcing me to shut these services down benefits no one.
Similarly, a regulation that demands responses from services on Similarly, a regulation that demands responses from services on the
the assumption that the service will be manned at all times, assumption that the service will be manned at all times, requires
requires individuals who are self-hosting their services to be individuals who are self-hosting their services to be available at
available at all times (i.e. to be able to respond regardless of all times (i.e. to be able to respond regardless of whether they
whether they are asleep, or overseas on a family holiday, etc.) are asleep, or overseas on a family holiday, too ill to respond,
etc.)
This submission comes from this perspective: that small operators This submission comes from this perspective: that small operators
should not be unduly harmed by regulations; the likelihood of this should not be unduly harmed by regulations; the likelihood of this
harm coming to pass is greater when such small operators are not harm coming to pass is greater when such small operators are not
even considered during the development of the regulations. If the even considered during the development of the regulations. If
regulations have the (hopefully unintended) effect of harming such regulations have the effect[fn:unintended:unintended, one hopes] of
small operators, the result will not just be the loss of these harming such small operators, the result will not just be the loss
services, but also the loss of opportunity to make the Web richer of these services, but also the loss of opportunity to make the Web
by means of the imposition of artificial barriers to entry. Such richer by means of the imposition of artificial barriers to
regulations will inhibit the development of ideas that pop into entry. Such regulations will inhibit the development of ideas that
the heads of individuals, who will realise them with nothing more pop into the heads of individuals, who will realise them with
than a computer connected to the internet. nothing more than a computer connected to the internet.
** CONSTODO Abuse * CONSTODO Abuse
All systems that seek to protect people from harmful or other All systems that seek to protect people from harmful or other
objectionable material (e.g. copyright infringement, terrorism objectionable material (e.g. copyright infringement, terrorism
propaganda, etc.) have, to date, been amenable to abuse. For propaganda, etc.) have, to date, been amenable to abuse. For
example, in a recent court filing, Google claimed that 99.97% of example, in a recent court filing, Google claimed that 99.97% of
infringement notices it received in from a single party in January infringement notices it received in from a single party in January
2017 were 2017 were
bogus[fn:googleTakedown:https://www.techdirt.com/articles/20170223/06160336772/google-report-9995-percent-dmca-takedown-notices-are-bot-generated-bullshit-buckshot.shtml]: bogus[fn:googleTakedown:https://www.techdirt.com/articles/20170223/06160336772/google-report-9995-percent-dmca-takedown-notices-are-bot-generated-bullshit-buckshot.shtml]:
#+BEGIN_QUOTE #+BEGIN_QUOTE
A significant portion of the recent increases in DMCA submission A significant portion of the recent increases in DMCA submission
volumes for Google Search stem from notices that appear to be volumes for Google Search stem from notices that appear to be
duplicative, unnecessary, or mistaken. As we explained at the San duplicative, unnecessary, or mistaken. As we explained at the San
Francisco Roundtable, a substantial number of takedown requests Francisco Roundtable, a substantial number of takedown requests
submitted to Google are for URLs that have never been in our search submitted to Google are for URLs that have never been in our search
index, and therefore could never have appeared in our search index, and therefore could never have appeared in our search
results. For example, in January 2017, the most prolific submitter results. For example, in January 2017, the most prolific submitter
submitted notices that Google honored for 16,457,433 URLs. But on submitted notices that Google honored for 16,457,433 URLs. But on
further inspection, 16,450,129 (99.97%) of those URLs were not in further inspection, 16,450,129 (99.97%) of those URLs were not in
our search index in the first place. Nor is this problem limited to our search index in the first place. Nor is this problem limited to
one submitter: in total, 99.95% of all URLs processed from our one submitter: in total, 99.95% of all URLs processed from our
Trusted Copyright Removal Program in January 2017 were not in our Trusted Copyright Removal Program in January 2017 were not in our
index. index.
#+END_QUOTE #+END_QUOTE
Aside from the percentage of URLs noted that don't exist in Aside from the percentage of URLs noted that don't exist in
Google's index, that a single entity would submit more than 16 Google's index, that a single entity would submit more than 16
million URLs for delisting in a single month is staggering, and million URLs for delisting in a single month is staggering, and
demonstrates a compelling point: there is no downside for a demonstrates a compelling point: there is no downside for a
bad-faith actor seeking to take advantage of a system for bad-faith actor seeking to take advantage of a system for
suppressing information[fn:downside:The law being used in this suppressing information[fn:downside:The law being used in this
specific case is the US Digital Millennium Copyright Act. It specific case is the US Digital Millennium Copyright Act. It
contains a provision that claims of copyright ownership on the part contains a provision that claims of copyright ownership on the part
of the claimant are to be made under penalty of perjury. However, of the claimant are to be made under penalty of perjury. However,
that provision is very weak, and seems not to be a deterrent for a that provision is very weak, and seems not to be a deterrent for a
determined agent: determined agent:
https://torrentfreak.com/warner-bros-our-false-dmca-takedowns-are-not-a-crime-131115]. https://torrentfreak.com/warner-bros-our-false-dmca-takedowns-are-not-a-crime-131115].
More recently, there is the story of abuse of the GDPR's /Right to More recently, there is the story of abuse of the GDPR's /Right to
be Forgotten/. An individual from Europe made a claim in 2014, be Forgotten/. An individual from Europe made a claim in 2014,
under the original /Right to be Forgotten/, to have stories related under the original /Right to be Forgotten/, to have stories related
to him excluded from Google searches for him. This seemed to have to him excluded from Google searches for him. This seemed to have
been an acceptable usage under those rules. However, that this been an acceptable usage under those rules. However, that this
claim was made and processed seems also to be a matter of public claim was made and processed seems also to be a matter of public
interest, and some stories were written in the online press interest, and some stories were written in the online press
regarding it. Subsequently, the same individual used the /Right to regarding it. Subsequently, the same individual used the /Right to
be Forgotten/ to have *these* stories excluded from Google be Forgotten/ to have *these* stories excluded from Google
searches. searches.
This cat-and-mouse game continues to the extent that the individual This cat-and-mouse game continues to the extent that the individual
is (successfully) requiring Google to remove stories *about his is (successfully) requiring Google to remove stories *about his
use* of the GDPR's /Right to be Forgotten/. Even stories that cover use* of the GDPR's /Right to be Forgotten/. Even stories that cover
*only* his /Right to be Forgotten/ claims, making no reference at *only* his /Right to be Forgotten/ claims, making no reference at
all to the original (objected-to) all to the original (objected-to)
story[fn:RTBF:https://www.techdirt.com/articles/20190320/09481541833]. This story[fn:RTBF:https://www.techdirt.com/articles/20190320/09481541833]. This
is clearly an abuse of the law: Google risks serious sanction from is clearly an abuse of the law: Google risks serious sanction from
data protection authorities if it decides to invoke the data protection authorities if it decides to invoke the
"... exercising the right of freedom of expression and information" "... exercising the right of freedom of expression and information"
exception[fn:FoE_GPDR:GDPR, Article 17, paragraph 3(a)] and it is exception[fn:FoE_GPDR:GDPR, Article 17, paragraph 3(a)] and it is
determined that the exception didn't apply. However, the claimant determined that the exception didn't apply. However, the claimant
suffers no sanction if it is determined that the exception /does/ suffers no sanction if it is determined that the exception /does/
apply. apply.
In systems that facilitate censorship[fn:censorship:While seeking In systems that facilitate censorship[fn:censorship:While seeking
to achieve a valuable and socially important goal, this to achieve a valuable and socially important goal, this
legislation, and all others of its nature, facilitates censorship: legislation, and all others of its nature, facilitates censorship:
as a society, we should not be so squeamish about admitting this.], as a society, we should not be so squeamish about admitting this.],
it is important to do more than merely assert that service it is important to do more than merely assert that service
providers should protect fundamental rights for expression and providers should protect fundamental rights for expression and
information. In a regime where sending an e-mail costs nearly information. In a regime where sending an e-mail costs nearly
nothing, where a service risks serious penalties (up to and nothing, where a service risks serious penalties (up to and
including having to shutdown) and where a claimant suffers nothing including having to shutdown) and where a claimant suffers nothing
for abusive claims, the regime is guaranteed to be abused. for abusive claims, the regime is guaranteed to be abused.
** CONSTODO Harmful content definition * CONSTODO Harmful content definition
This submission will not offer any suggestions as to what should be This submission will not offer any suggestions as to what should be
considered "harmful content". However, I am of the belief that if considered "harmful content". However, I am of the belief that if
"harmful content" is not narrowly defined, the system will allow "harmful content" is not narrowly defined, the system will allow
bad actors to abuse it, and in the context where there is no risk bad actors to abuse it, and in the context where there is no risk
to making claims, and great risk in not taking down the reported to making claims, and great risk in not taking down the reported
postings, loose definitions will only make it easier for postings, loose definitions will only make it easier for
non-harmful content to be removed. non-harmful content to be removed.
* CONSTODO Answers to consultation questions * CONSTODO Answers to consultation questions
** CONSTODO Strand 1 -- National Legislative Proposal ** CONSTODO Strand 1 -- National Legislative Proposal