4 ms·

The law provides them immunity from civil suits. Apple as a provider can say they comply with section 230 and avoid any legal liability from people that may be

by treis 6y ago

The law provides them immunity from civil suits. Apple as a provider can say they comply with section 230 and avoid any legal liability from people that may be harmed by their actions. In other words, you can't sue Apple because someone used iCloud to distribute child porn of you. The essential bargain struck for 230 was that providers get immunity in exchange for policing their system and helping law enforcement. Apple et al removing their ability to police their systems breaks that bargain.

saurik 6y ago
Ok, so I was under the impression that if you are say, a telephone network, that people can't sue you for stuff people do during phone calls, under the premise that the phone company doesn't moderate phone calls; and my understanding of the "bargain struck" is then that online web forums felt that centralized moderation was absolutely critical to spam prevention and search/discovery services (I disagree on the practicalities here, but will admit that with 90s era tech and under the premise of the specific model of website this seems reasonable to have believed and legislate for), and so wanted the ability to "have their cake and eat it too": to be able to decide almost on a whim to take down content--and thereby to have people active to looking at content to decide what to take down--but not to be responsible for those editorial decisions, as they wanted to do their supposedly-required moderation tasks with limited staff and "after the fact": and so, if they "decide" (quite likely by negligence) to leave something up that they should not have published, Section 230 grants them immunity with some provisions. It doesn't seem like a truly end-to-end encrypted service--such as iMessage or iCloud Keychain (but absolutely not iCloud Backup, which has a key escrow backdoor: it should be end-to-end encrypted, but explicitly isn't) needs this immunity, right?
- treis 6y ago
  They may or may not. A victim of child pornography can argue that Apple is liable because they provide a secure platform to distribute the images. Or maybe a victim of a crime might sue because Apple refused to help. Section 230 prevented those types of lawsuits. Without it, who knows?
- qball 6y ago
  That impression is correct; the precedent is here (https://en.wikipedia.org/wiki/Cubby,_Inc._v._CompuServe_Inc https://en.wikipedia.org/wiki/Cubby,_Inc._v._CompuServe_Inc.). A lot of people don't really seem to understand that about S. 230- services that exist basically to pass messages have never needed the protection and that won't change. The best example outside of messaging services is probably content delivery networks, and I'll pick on CloudFlare because they're a great example. As long as CloudFlare is fine with just taking money and serving content, no matter whose it is, they have the legal immunity as intended. As soon as they decide (on a whim) to deny service based on content, as they did a while back, that legal immunity vanishes. It would be catastrophic to their business to make that decision (especially considering everything else CloudFlare hosts), and that's the point. It's also very interesting considering that the changes also appear to affect Patreon (and similar) and, perhaps a bigger deal, PayPal, since it's an interactive computer service used to fund the creation of information (among other things). In fact, I think that's an even bigger deal, because it's not necessarily traditional platforms banning certain people that causes them to be denied a platform these days, it's the inability of them to get funding in a way that isn't "send cash to this PO Box".
  - judge2020 6y ago
    > As long as CloudFlare is fine with just taking money and serving content, no matter whose it is, they have the legal immunity as intended. As soon as they decide (on a whim) to deny service based on content, as they did a while back, that legal immunity vanishes. It would be catastrophic to their business to make that decision (especially considering everything else CloudFlare hosts), and that's the point. Except that they already do moderate based on content (malware, CP, etc) and don't have this immunity. The only reason they haven't been sued is because no lawyer or legal team is going to take on 8chan or random malware websites, and state-level DOJs don't have bad actors knocking on their door with the public's support behind them.
    - luckylion 6y ago
      Does CF actively look for malware, CP etc to throw them out, or are they responding to law enforcement in that regard? My understanding is that the hurdle to get something booted from CF is extremely high, which is why it's very well liked in both copy right infringement (torrents) and for general scammers trying to hide their server locations.
- rstuart4133 6y ago
  > and so wanted the ability to "have their cake and eat it too": to be able to decide almost on a whim to take down content Not really. Sure the telcos can't sensor individual phone calls, but if they don't like what you are doing they will disconnect you. For example my telco explicitly prohibits me from sending spam over SMS. If I break that, they disconnect me. It costs me money to reconnect which is a huge disincentive to spammers, but more than that, they insist on knowing who I am, that have a "true name" in other words. So not only can they disconnect me, they can ensure I never reconnect. Two differences with an internet bulletin board is the users are anonymous and posting is free. Thus the owners can never effectively ban people that deliberately set out to harm their business, they can only deal with the posts as they occur. Or to put in another way: until you read his post, you can never know if a new user is a spammer and it cost him nothing to post his spam. The difference between a telco and an internet web site is really competition, and it's curcial. It costs billions (trillions?) to set up a telco. Worse, there is typically no local competition for land line (and really just a hand full of mobile providers too). So your local land like provider bans you, it's as if you've lost your town water supply, or electricity connection. In that environment a telco shutting you down is indeed total censorship. That's not true for the internet. There are literally thousands if not millions of outlets. If one does not like your post, another one surely will. Since there is no monopoly you are always able to publish somewhere so no one one person or company can shut you up. In fact, it's not difficult to build your own publishing forum and it costs peanuts, so in fact _no one_ except the government can prevent you from having your say. 230 struck a new bargain for this new environment. What arose under its protection was curated forums targeting particular consumers. Stuff the consumers didn't like (such as SPAM, or bullshit, or leftist, or abusive) it is removed. Because the cost of creating the forum is so cheap the competition for eyeballs is fierce, and what ends up dictating the success of these forums is not whether they agree with posts or their political views, it is how well their curation matches their target market. This equation has been spelt out here on HN time and time again, with comments like "Twitter must have judged the cost of letting Trump post bullshit higher than the readership it gained". So, 230 solved the "free speech" problem using capitalist competition in its purest form. Where "pure" near zero friction, and a market with near perfect information flow between participants. It seems to work pretty well to me. It's pretty clear these amendments, g.5(c) in particular, will destroy that balance.
- nullc 6y ago
  You nailed it.
- samatman 6y ago
  > [iCloud Backup] should be end-to-end encrypted, but explicitly isn't Just keep in mind that, when you say it should be, what you're saying is that Apple should make iCloud Backup work in such a way that, if the user loses the keys, Apple is completely unable to help them recover their data. And, I don't agree. I can support it as an opt-in feature, but wouldn't use it; I expect sensitive applications, such as Signal, to encrypt their backups as indeed they do, and would prefer as a last resort to retain my precious exocortex, even if I lose my entropy. And if I wouldn't use it, most people wouldn't, and Apple is right not to do it that way.
  - saurik 6y ago
    Fun story bro, but in the real world Apple agreed with my position and only didn't go through with it because of the FBI. https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv... The reality is that there are tons of obvious alternative solutions to user secure key escrow other than "lose access to your data".
    - samatman 6y ago
      Ok, point taken, TIL. Serves me right for not checking the user name before replying...
WiseWeasel 6y ago
Except Apple doesn’t encrypt iCloud uploaded content with client-side-stored encryption keys. It has been and will continue to be subpeonable. Section 230 concerns internet services, not all technology.
ineedasername 6y ago
The question is where do you draw the line. Apple consciously decides not to collect or track certain things about users. Yet that data could also reveal illicit activity, which means Apple is knowingly turning a blind eye to illicit activity. Further, any data about users could potentially uncover illicit activity, meaning a provider could essentially be required to track everything possible in order to avoid ignoring potential illicit content.

by treis 6y ago

saurik 6y ago

Ok, so I was under the impression that if you are say, a telephone network, that people can't sue you for stuff people do during phone calls, under the premise that the phone company doesn't moderate phone calls; and my understanding of the "bargain struck" is then that online web forums felt that centralized moderation was absolutely critical to spam prevention and search/discovery services (I disagree on the practicalities here, but will admit that with 90s era tech and under the premise of the specific model of website this seems reasonable to have believed and legislate for), and so wanted the ability to "have their cake and eat it too": to be able to decide almost on a whim to take down content--and thereby to have people active to looking at content to decide what to take down--but not to be responsible for those editorial decisions, as they wanted to do their supposedly-required moderation tasks with limited staff and "after the fact": and so, if they "decide" (quite likely by negligence) to leave something up that they should not have published, Section 230 grants them immunity with some provisions. It doesn't seem like a truly end-to-end encrypted service--such as iMessage or iCloud Keychain (but absolutely not iCloud Backup, which has a key escrow backdoor: it should be end-to-end encrypted, but explicitly isn't) needs this immunity, right?

treis 6y ago
They may or may not. A victim of child pornography can argue that Apple is liable because they provide a secure platform to distribute the images. Or maybe a victim of a crime might sue because Apple refused to help. Section 230 prevented those types of lawsuits. Without it, who knows?
qball 6y ago
That impression is correct; the precedent is here (https://en.wikipedia.org/wiki/Cubby,_Inc._v._CompuServe_Inc https://en.wikipedia.org/wiki/Cubby,_Inc._v._CompuServe_Inc.). A lot of people don't really seem to understand that about S. 230- services that exist basically to pass messages have never needed the protection and that won't change. The best example outside of messaging services is probably content delivery networks, and I'll pick on CloudFlare because they're a great example. As long as CloudFlare is fine with just taking money and serving content, no matter whose it is, they have the legal immunity as intended. As soon as they decide (on a whim) to deny service based on content, as they did a while back, that legal immunity vanishes. It would be catastrophic to their business to make that decision (especially considering everything else CloudFlare hosts), and that's the point. It's also very interesting considering that the changes also appear to affect Patreon (and similar) and, perhaps a bigger deal, PayPal, since it's an interactive computer service used to fund the creation of information (among other things). In fact, I think that's an even bigger deal, because it's not necessarily traditional platforms banning certain people that causes them to be denied a platform these days, it's the inability of them to get funding in a way that isn't "send cash to this PO Box".
- judge2020 6y ago
  > As long as CloudFlare is fine with just taking money and serving content, no matter whose it is, they have the legal immunity as intended. As soon as they decide (on a whim) to deny service based on content, as they did a while back, that legal immunity vanishes. It would be catastrophic to their business to make that decision (especially considering everything else CloudFlare hosts), and that's the point. Except that they already do moderate based on content (malware, CP, etc) and don't have this immunity. The only reason they haven't been sued is because no lawyer or legal team is going to take on 8chan or random malware websites, and state-level DOJs don't have bad actors knocking on their door with the public's support behind them.
  - luckylion 6y ago
    Does CF actively look for malware, CP etc to throw them out, or are they responding to law enforcement in that regard? My understanding is that the hurdle to get something booted from CF is extremely high, which is why it's very well liked in both copy right infringement (torrents) and for general scammers trying to hide their server locations.
rstuart4133 6y ago
> and so wanted the ability to "have their cake and eat it too": to be able to decide almost on a whim to take down content Not really. Sure the telcos can't sensor individual phone calls, but if they don't like what you are doing they will disconnect you. For example my telco explicitly prohibits me from sending spam over SMS. If I break that, they disconnect me. It costs me money to reconnect which is a huge disincentive to spammers, but more than that, they insist on knowing who I am, that have a "true name" in other words. So not only can they disconnect me, they can ensure I never reconnect. Two differences with an internet bulletin board is the users are anonymous and posting is free. Thus the owners can never effectively ban people that deliberately set out to harm their business, they can only deal with the posts as they occur. Or to put in another way: until you read his post, you can never know if a new user is a spammer and it cost him nothing to post his spam. The difference between a telco and an internet web site is really competition, and it's curcial. It costs billions (trillions?) to set up a telco. Worse, there is typically no local competition for land line (and really just a hand full of mobile providers too). So your local land like provider bans you, it's as if you've lost your town water supply, or electricity connection. In that environment a telco shutting you down is indeed total censorship. That's not true for the internet. There are literally thousands if not millions of outlets. If one does not like your post, another one surely will. Since there is no monopoly you are always able to publish somewhere so no one one person or company can shut you up. In fact, it's not difficult to build your own publishing forum and it costs peanuts, so in fact _no one_ except the government can prevent you from having your say. 230 struck a new bargain for this new environment. What arose under its protection was curated forums targeting particular consumers. Stuff the consumers didn't like (such as SPAM, or bullshit, or leftist, or abusive) it is removed. Because the cost of creating the forum is so cheap the competition for eyeballs is fierce, and what ends up dictating the success of these forums is not whether they agree with posts or their political views, it is how well their curation matches their target market. This equation has been spelt out here on HN time and time again, with comments like "Twitter must have judged the cost of letting Trump post bullshit higher than the readership it gained". So, 230 solved the "free speech" problem using capitalist competition in its purest form. Where "pure" near zero friction, and a market with near perfect information flow between participants. It seems to work pretty well to me. It's pretty clear these amendments, g.5(c) in particular, will destroy that balance.
nullc 6y ago
You nailed it.
samatman 6y ago
> [iCloud Backup] should be end-to-end encrypted, but explicitly isn't Just keep in mind that, when you say it should be, what you're saying is that Apple should make iCloud Backup work in such a way that, if the user loses the keys, Apple is completely unable to help them recover their data. And, I don't agree. I can support it as an opt-in feature, but wouldn't use it; I expect sensitive applications, such as Signal, to encrypt their backups as indeed they do, and would prefer as a last resort to retain my precious exocortex, even if I lose my entropy. And if I wouldn't use it, most people wouldn't, and Apple is right not to do it that way.
- saurik 6y ago
  Fun story bro, but in the real world Apple agreed with my position and only didn't go through with it because of the FBI. https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv... The reality is that there are tons of obvious alternative solutions to user secure key escrow other than "lose access to your data".
  - samatman 6y ago
    Ok, point taken, TIL. Serves me right for not checking the user name before replying...

WiseWeasel 6y ago

Except Apple doesn’t encrypt iCloud uploaded content with client-side-stored encryption keys. It has been and will continue to be subpeonable. Section 230 concerns internet services, not all technology.

ineedasername 6y ago

The question is where do you draw the line. Apple consciously decides not to collect or track certain things about users. Yet that data could also reveal illicit activity, which means Apple is knowingly turning a blind eye to illicit activity. Further, any data about users could potentially uncover illicit activity, meaning a provider could essentially be required to track everything possible in order to avoid ignoring potential illicit content.