IFTAS, the Trust & Safety organization dedicated to the Fediverse, published a guide on the EU’s Digital Services Act earlier this week. The guidance is primarily geared towards instance admins and moderation teams in the Fediverse, and spells out policy obligations for compliance.

If your server has member accounts in the EU, or is publicly viewable in the EU, your service is most likely impacted by this regulation, even if you are not based or hosted in the EU.
IFTAS BLOG

Despite the fact that there are now new considerations in place for people who run Fediverse instances, there are a number of positive outcomes here:

• Most Fediverse servers are relatively small communities, and likely fall under the designation of “Small and Micro Enterprises” – if your server doesn’t employ 50 or more people, and doesn’t take an annual income of over 10 million Euros, you’re probably in this designation. Compared to Very Large Online Platforms, your obligations are fewer in comparison.
• Services are not considered liable for content unless they have been notified of its presence. Failure to take said content down is where the liability starts
• Platforms are not held liable for proactively searching for and removing illegal content.

Big Takeaways

Most of what’s listed in EU DSA requirements come across as simple, common sense, and already-adopted practices. The report published by IFTAS provides suggestions for best practices, and even includes templates for the bare minimum requirements for admins to use.

The biggest changes admins need to be aware of mostly relate to accountability: servers need to assign an EU representative for compliance, need to report on malicious content to local authorities, and needs to provide a notice mechanism (such as email) to inform suspended or banned users of a service of the action taken, as well as the reason.

On the matter of being required to assign an EU-based representative for compliance, IFTAS states the following:

If your service is accessible to users in the EU but you don’t have an establishment there, you’re required to designate either a legal or natural person as your legal representative within one of the Member States where you offer services.

Your legal representative will act on your behalf for interactions with the EU’s Member States’ authorities, regarding compliance with and enforcement of the DSA. You must notify the Digital Services Coordinator in the Member State of your representative’s name, postal address, email address, and telephone number. Ensure this information is public, easily accessible, accurate, and regularly updated. Most legal representative services do not offer an affordable option for donation-driven services.

IFTAS is researching ways to offer this service, but in the meantime, we strongly recommend you ensure you have added a designated contact for authorities to reach you

This will probably be the biggest hurdle for instance operators in the short term, as many instances are roughly the same size as a community group or forum, in terms of users. This is a new consideration for a lot of admins, and not necessarily one that anybody’s given thought to in the past fifteen years.

Regardless, IFTAS has produced a valuable service with lots of insight, advice, and examples for server admins. Hopefully, this will serve as a benefit to the Fediverse as many attempt to navigate compliance for the very first time.

Download the Report

The post IFTAS Publishes DSA Guide for the Fediverse appeared first on We Distribute.

We Distribute

2024-04-11 20:55:20

The European Union Digital Services Act is upon us! But don’t worry – our favorite Trust & Safety organization is here to demystify compliance.

wedistribute.org/2024/04/iftas…

IFTAS Publishes DSA Guide for the Fediverse

IFTAS, the Trust & Safety organization dedicated to the Fediverse, published a guide on the EU's Digital Services Act earlier this week. The guidance is primarily geared towards instance admins an

^{Sean Tilley (We Distribute)}

In our report yesterday about President Biden and the White House opting in to ActivityPub federation, there were a number of responses from people wishing that the White House (and other organizations) would simply self-host their own server to be a part of the network. I agree with this sentiment, and have been thinking about the requirements that would make this kind of thing possible.

Here are my thoughts, based on my limited experience working for both tech startups and government.

Why Would Anyone Want This?

There are a number of people in the Fediverse that would like all forms of government to stay the heck away from the network, citing the problems of bringing the military-industrial-complex and surveillance capitalism to our cozy little space on the Internet. Depending on which government we’re talking about, what their policies are, and how they interact with the network, this isn’t necessarily an unreasonable reaction.

However, there are a number of benefits that bringing government to self-hosted infrastructure might bring:

• Government Officials – Communicating with and representing their constituents.
• Service Notifications – Are there outages on certain train lines? Are roads closed down? Has a natural disaster occurred?
• Bureau Interactions – interacting with municipal services, civic organizations, and emergency / non-emergency services for a variety of jurisdictions.
• Department Information – easy promotion and access to studies from, say, the Department of Labor, or the Department of Energy.
• Legislature – coverage of meeting notes, policies passed, votes on the House or Senate floor.

As of today, these things primarily exist within the domain of corporate social media. You’re more likely to see a smattering of accounts across Twitter, Facebook, and Threads, and those accounts might be pretty limited in what they’re able to actually accomplish, since they’re not even running on government infrastructure.

The fact of the matter is, being able to directly access all of the things listed above could be a boon to users of the Fediverse. Rather than trying to rely on a Facebook page or Twitter account to get necessary information, it could be seen from verified accounts on your timeline, with receipts, and would be accessible to journalists, researchers, developers, and citizens alike.

Technical and Organizational Hurdles

There are a number of hoops to jump through, so let’s talk about them. Before diving in: I’m aware of the effort being done by the European Union as well as some EU governments. I think those are great, and give us some kind of playbook to look to for examples. These musings are more focused on the United States.

Funding

The first headache with any government project is setting aside the funds and people to work on it. A political figure could introduce a bill with provisions to set aside a budget for such a program, but then there are questions pertaining to who actually carries out this effort. How much of the work is being contracted out to another business or agency? What’s the criteria for “winning” the contract, and who carries out what tasks?

Procurement

Then there’s the choice of software itself: the platform and its dependencies need to be audited, examined, and vouched for. Off the top of my head, relatively few Fediverse platforms actually fulfill this expectation: I believe that Mastodon may be one of the few that has actually gone through this process, but there may be significant differences between a security audit by a compliance group, and a security audit by a government.

Aside from choosing an official platform to stake operations on, there’s also the matter of finding an ideal third-party vendor. Currently, managed Fediverse hosting services are still in their infancy, and I’m not sure they’re up to scratch for what a government entity demands: comprehensive compliance requirements, service-level agreements, user training and onboarding materials, and promises pertaining to security upgrades and threat mitigations.

There may also be requirements for custom development, for example, integrating federal single sign-on, such as ID.me or something similar. There would also need to be a deployment strategy for various users, departments, and bureaus. It may be possible for an existing government IT provider to adopt Mastodon or another platform and develop everything needed here, but it’s much harder for any business started in the Fediverse today.

Policy

Another relatively grey area here would be the setting of policy for a US Government-run instance. Dealing with hate speech, CSAM, trolling, harassment, and other nastiness is a job and a half for ordinary instance admins, but I would imagine that this could be compounded further by hosting a government server with potentially millions of followers.

How does a government handle that kind of thing without violating the First Amendment? Does moderation even count as violating free speech, as some people believe? Is there perhaps a threshold for what’s tolerated in civil discussion?

I’m not a lawyer, and don’t have a complete answer. They might be able to get away with something similar to the Mastodon Server Covenant, in which ground rules for participation are set. Alternatively, maybe only allowing inbound federation from other government servers is an answer. I don’t know.

Tooling

One final consideration: departments and organizations are unlikely to get very far if they only have a default web interface to rely on. The Fediverse needs tools like Buffer, Fedica, and Mixpost for teams to come together and coordinate their presence in this new space. As the ecosystem evolves, we’ll likely need alternative tools and frontends to deal with emerging challenges.

It’s Still Worth Trying

I’ll be the first to admit that, looking at everything above, there’s a lot of unanswered questions. People asked why President Biden and the White House opted in to using Threads with ActivityPub federation, rather than stand up their own server. For the time being, the cost of setup, onboarding, and training is cheaper. They’re also making a smart bet by migrating to where a lot of people are, in the hopes that they will be heard by the greatest amount of potential followers.

As the Fediverse continues to grow, and both the protocol and platforms continue to evolve, my hope is that government entities might see the Fediverse as viable. One day, we may see a lot of municipal entities and departments setting up their base of operations right here on the network. I think it’s important that we continue thinking about how to get there.

The post Could the US Government Self-Host a Fediverse Server? appeared first on We Distribute.

In a surprising first, Joe Biden’s social media team enabled Fediverse integration on his Threads account today. For now, the integration is a minor gesture, as it’s only a one-way connection from Threads to the Fediverse.

As viewed from Mastodon.

That being said, the implications make for a pretty big deal: Joe Biden is the first US President to federate with the rest of the network. Even though Donald Trump is on Truth Social, which is based on Mastodon, the backend has never actually federated with another server.

You can follow President Biden and the White House below:

• President Biden: @potus
• White House: @whitehouse

Government Fedi

Over the last few years, a number of governments and officials looked to the Fediverse as the base of their online social presence. The European Union notably offers official Mastodon and PeerTube servers for followers to connect with, and the Dutch government officially uses Mastodon as well.

People familiar with the RSS publishing format may find it helpful to think of Fediverse as “Really Simple Social Syndication”. Similar to RSS an agency can publish subscribable feeds, but with the added bonus of social interaction with citizens and stakeholders.

In effect, this combines the deliverability and reach of email with the personalisation and device-alerting capabilities of social media apps.
IFTAS

Some organizations, such as IFTAS, have begun advocating towards governments currently on Twitter, Instagram, and Facebook to move over. It’s still an emerging part of the network, and definitely will take some time for more organizations to set foot over here. Still, it’s a promising development and will hopefully get more public officials to think about connecting to the Fediverse.

The post You Can Now Follow President Biden on the Fediverse appeared first on We Distribute.