The Labor government has proposed a Digital Duty of Care, spruiking it as a way to keep children safe and to give people control over their own content recommendation algorithms.
Does the reality match up to the spin? Or is the devil in the details?
Well, it turns out that, rather ironically, for legislation marketed as being about freedom and individual autonomy in the online world, it actually entrenches government control. When the government says that you get ‘my feed, my way’, they really mean ‘your feed, our way’. Much like much of the government’s messaging, the sales pitch is at best disingenuous.
Let’s start by looking at what the government’s Digital Duty of Care legislation does. It has two major parts: (a) the Duty of Care itself, and (b) adjustments to content-recommendation algorithms. It also has ancillary provisions, including permission for the government to use fictitious identities (called ‘sock puppets’). Unfortunately, each of these has problems.
The problems are compounded by the sheer breadth of the legislation: it covers not just social media companies but ‘a service that manufactures, supplies, maintains or installs equipment for use in Australia’. This includes companies ranging from website hosting companies, server installers, data centres, and virtually anything connected with the internet in any way.
So, let’s explore some of the big issues.
Ministerial control over what content is allowed: The Duty of Care states: ‘A person responsible for an online service must ensure, so far as is reasonably practicable, a safe online environment.’ This begs the question of what exactly is ‘a safe online environment’ and who decides.
To answer this, the legislation enumerates several uncontroversial provisions but the minister may also include material that ‘the Minister is satisfied may cause serious harm’. That is, the Minister can determine what is harmful content from which online services must protect people. The scope for political interference is not merely theoretical. Rather, the legislation explicitly allows for, and envisages, political interference.
Ministerial control over what you see and how you see it: The government has pitched the legislation with the slogan ‘my feed, my way’. But, ‘whose way’ exactly? Yours? Or the government’s? It turns out it is the latter.
What the legislation actually says is:
‘The Minister may, by legislative instrument, require specified online services to provide specified user empowerment tools.’
That is, while the government has sold the legislation as letting people ‘turn off’ algorithms, the reality is rather different. It lets the minister specify the nature of the algorithm switch. For example, it is easy to see that the government could enable ‘user empowerment tools’ that switch off content recommendations other than from the government, thereby emphasising government messaging while deemphasising rebuttals.
Incentivising over-reach: The proposed legislation faces another issue: enforcement. Overreach. This is operationalised via the risk assessments, which Online Services are required to conduct. The risk assessments must cover all reasonably foreseeable risks including (but not limited to) those related to the Digital Duty of Care. They must then document the measures in place to address those risks.
The obvious problem is that this risk assessment covers an unknowably large number of risks, which incentivises an online version of ‘safetyism’. This can infect all areas of digital content. Can fitness content trigger body dysmorphia in some people while promoting healthy lifestyles for others? Can anti-government content encourage extremism in predisposed people? Can left-wing content promote economically harmful socialism? The list of potential risks is vast.
The problem is compounded by the fact that the rules cover all Online Services. We can debate whether the rules are too broad even in social media. But, they extend to myriad online services, whether they be people installing servers or domain providers, such as GoDaddy. In this theoretical example, GoDaddy then faces the invidious problem that a person might register a website and host ‘extremist material’. VPN providers must address the risk that people use the VPN to circumvent government control. Server installers must confront the risk that a person using a private material might then fail to secure the server.
Overreach is incentivised by the fact that there are implicit penalties for being deemed to fail to go far enough in suppressing risks, but no penalties for going too far. This leads to more implicit control over the internet.
What about the cost? The foregoing highlights that companies must comply with the regulations. And, regulators oversee the regulations. Now, this implies two things: (a) we will get more bureaucrats (and associated government spending), and (b) companies must expend money complying (see e.g., the risk assessment).
The obligations apply to small and large companies across the internet ecosystem. But, small companies and startups are not resource-rich. So, at a time when productivity is faltering, the government has decided that it is a smart idea to force companies to spend more money on compliance, which they could otherwise spent on innovation. And, the government has decided it is a smart idea to erect another barrier to entry for small innovators. Ultimately, people wonder why productivity is poor. Proposed legislation such as the Digital Duty of Care Bill underscores the problem.
Where does this leave us? The net result is the Digital Duty of Care legislation has been falsely advertised. The government has marketed it as being about freedom and autonomy. But, in reality, it offers neither freedom nor autonomy and merely offers government control.
