Thread by @doctorow

Today, @EFF published "Privacy Without Monopoly: Data Protection and Interoperability," a major new paper by Bennett Cyphers and me.

eff.org/wp/interoperab…

1/

It's a paper that tries to resolve the tension between demanding that tech platforms gather, retain and mine less of our data, and the demand that platforms allow alternatives (nonprofits, co-ops, tinkerers, startups) to connect with their services.

2/

It starts from the premise that tech companies abuse our data because they CAN: because they know we're locked into their silos, because they know we have few alternatives even if we decide to abandon our social ties and move elsewhere.

3/

Demanding better data protection from tech companies works well, but fails badly. It's great when companies respond to public pressure or legal changes by protecting our data, but if they don't, and there isn't any alternative, well...

4/

The upshot is that alternatives represent an important piece of the privacy puzzle: both as a force to discipline big companies tempted to abuse our data, and as an escape valve when they yield to temptation.

5/

Interoperability is complicated. There's some legislative energy for mandating interop - last year's US ACCESS Act, the pending EU Digital Services and Markets Acts.

6/

There's also a lot of antitrust litigation around the US and the world, and companies might settle these with a requirement to open up APIs. And there are other levers: government procurement rules, or requirements for participation in standards bodies.

7/

Mandatory interoperability represents a good floor, but it's a lousy ceiling. Monopolists who are required to allow interoperability to allow alternatives might sabotage the mandate by shifting around their operations so the interop doesn't do much.

8/

The ceiling on interop needs to be competitive compatibility (comcom, AKA "adversarial interoperability"), when a new service plugs into an existing one against its wishes, say, by scraping data on behalf of a user.

eff.org/deeplinks/2019…

9/

Comcom was once the norm in tech, but the same companies that owe their existence to comcom have used their monopoly rents to obliterate the legal framework that permitted comcom, ensuring no one does unto them as they did unto the companies they disrupted.

10/

Restoring comcom can come through a mix of new laws, better interpretations of existing laws, and through the same levers we might use for mandates: antitrust settlements, procurement rules, conditions of participation in standards-setting.

11/

So that's the ceiling; what about the floor? We enumerate three flavors of interop from existing law and legislative proposals:

I. Data portability - this is already a feature of state privacy laws in the US and the EU's GDPR - the right to get your data from a company

12/

II. Back-end interoperability: forcing companies to expose the same interfaces they use to allow their internal business units to communicate (eg the interface between Facebook, Whatsapp and Instagram).

13/

III. Delegatability (AKA front-end interoperability): allowing a third party to automate clicks and mouse movements to connect to your account on a service on your behalf.

14/

Both mandates and comcom expose users to privacy risks - as does business-as-usual. If we take away companies' legal weapons so they can't use the law to block interoperators, they will lose a tool they use to protect users' privacy.

15/

But users will gain ways to interact with social media that are more privacy-preserving than the big companies are willing to stretch to.

16/

The answer to this isn't to count on big companies to have our best interests in heart - and to defend those interests by abusing copyright and cybersecurity law. We need a federal privacy law - one that binds both Big Tech and new rivals.

17/

A federal privacy law would also safeguard users' privacy where there's an interop mandate in play, and because a mandate is managed and orderly, big companies can shut down APIs or limit access when someone breaks the rules.

18/

Big Tech doesn't have a monopoly on good ideas or the ability to provide a platform for discussion, socializing, and political and civil engagement - but they DO have a monopoly on platforms where these things take place.

19/

We can - and should - demand better of the platforms, but we should also encourage (lots of) alternatives, federated with one another, so you can choose a platform without giving up your friends, customers or audience.

eof/

ETA: if you'd like to read or share this thread as a blog post, here's a copy on my site pluralistic.net, which has no trackers, ads or surveillance.

pluralistic.net/2021/02/13/dat…