Introduction
In many blog posts, the focus of the texts was on the demand side of information. The implication of some of their outcomes is that the traditional process description of information flows is uprooted. The clear “content creator -> intermediary -> passive consumer” scheme with its distinctive roles is hard to uphold. Rather, the first and last role types appear mixed since demand is an activity, not a consequence. Therefore, citizens’ meaning creation, and potentially linked behavior, is not a vulnerable treasure to be defended but a dynamical process to be facilitated. Responsibilities and accountability are not to be attributed a priori to separate categories of “intentionally destructive” content creators and “enabling” intermediaries only.
Demand as an activity
When accepting demand as an activity, security cannot be the dominant defining perspective; it should be freedom of speech. Naturally, as was described in blog posts, this presupposes that citizens’ experiences of autonomy, belonging, and achievement are at least at levels enabling them to “get by” in life. Below that threshold different aspects come into play as a result of enhanced citizen openness to anything that seems to aleviate the pain.
Roles
In effect, demand as an activity leaves us with two categories: content actors and intermediaries. It is important to distinguish between these two roles to establish who bears content responsibility and who bears risk accountability, keeping in mind that responsibility and accountability can be shared. The DSA provides a European framework for intermediary obligations, while content actor responsibility is substantially situated in other applicable legal regimes.
Distinguishing between the roles
To establish the responsibilities and accountabilities of the intermediary, and thereby establish the respective allocation of responsibilities and accountabilities between the intermediary and content actor, the question to ask becomes: Who controls information, what can that control cause, who consequently bears responsibility, and does an intermediary’s architecture provide enough sovereignty and evidence to make that responsibility meaningful?
Content responsibility checklist
Can the intermediary exercise control over the content actor’s content?
- Data sovereignty (data): Does the content actor have to trust the intermediary:
- with custody of the content?
- to release/ transfer the content when the content actor changes intermediary?
- User sovereignty (decision): Does the content actor have to trust the intermediary
- to ask for their authorisation before performing computations on their content?
- Governance sovereignty (execution/accountability): Does the content actor have to trust the intermediary:
- to respect specific computations authorised by the content actor?
- to interpret the authorisation correctly?
- to execute the authorised computations correctly?
- to execute consequential computations correctly?
- to check its own process correctly?
- to report accurately what it has done?
Risk accountability checklist
How is responsibility for downstream risks distributed? Ask of an intermediary:
- Create: Does its architecture create risks that downstream actors inherit?
- Amplify: Does it amplify risks already present downstream?
- Transfer: Does it transfer risks to another actor?
- Constrain: Does it constrain risks that would otherwise arise?
- Observe: Does it make downstream risks observable and auditable?
- Inform: Does it provide downstream actors with the information necessary to assess and mitigate those risks?