Discover Top Posts Tagged with #compliance

No such thing as selective censorship resistance

ITHACA and NYC! I'm heading your way for a zillion events from Sept 11-17. Here's a list of open-to-all CORNELL activities including two major keynotes; a movie night with dinner and discussion; and a public event at CORNELL TECH in NYC. I'll also be at the BROOKLYN BOOK FESTIVAL on Sept 21.

If you have a sufficiently horrible boss, you might have heard them use the phrase, "One throat to choke," by which they mean, "We must arrange this project so there's one person I can blame and punish if it goes awry.

The problem with "one throat to choke" is that this is another word for chokepoint. If the person who has ultimate authority over the system somehow manages to evade your discipline, there's no one else you can approach to resolve any arguments about how the system should work. "One throat to choke" is a single point of failure. That can be a nice arrangement if you're in charge of that chokepoint, but if not, it means you're SOL.

The digital world is in the process of bifurcating. The dying, legacy systems are the zuckermuskian, centralized ones, where there's always one throat to choke. If you don't like the moderation, recommendation, or other policies on Google, Twitter, Facebook or Amazon, you know exactly who to blame. If you're a lawmaker or a regulator, you know exactly who to drag into court.

Then there's the new, exiting, free and open digital technology that's crawling out of the half-dead carcass of Big Tech: federated and decentralized systems like Mastodon (and the Fediverse) and Bluesky (and the Atmosphere). While both of these networks have official maintainers who oversee their open source software projects, and while both groups of maintainers also run the servers that dominate their networks, you can absolutely join and participate without the consent of the organizations that created and maintain them, and they can't stop you or kick you off.

That's what decentralization means – if you don't like a user or their behavior, there's no manager to speak to in order to have them removed. Sure, a user can be kicked off of some servers, even all the servers, but the user can still stand up their own server. So long as there are other users, somewhere on the internet, who want to interact with that person, they can continue to connect with one another.

Now, you'd think that the Maga movement would love this – and they do…to a point. Trump's Truth Social is just a Mastodon server, albeit one that very few other Mastodon servers have any connections to. But the Maga movement is incapable of imagining a world in which the power it arrogates to itself will ever fall into the hands of its enemies. They want the power to send troops into cities they don't like, to federally dictate election procedures, to fire any federal official without cause, to override Congress's budgetary edicts, to be insulated from all liability irrespective of criminality.

Maga desires these powers within the borders of the United States because it intends to abolish free and fair elections and install a dictatorship, which means they they won't have to worry about Democrats ever controlling the presidency and turning those weapons around.

But even if they manage this trick in the USA, they won't be able to pull it off on the internet. There are simply too many territories in which federated, decentralized services can domicile themselves, places that are not only outside America's jurisdiction, but where the local authorities are hostile to the idea of extraterritorial intrusions by the US state on their domestic affairs.

The American culture warriors, obsessed with the idea that tech platforms have shadow banned, downranked, deplatformed and demonetized them, want to bring Big Tech to heel. And since each Big Tech company has just one throat to choke, they think they can do it.

Take "age verification," the latest social contagion sweeping through authoritarian governments around the world. In the name of keeping kids from seeing stuff that's not kid-friendly online (a perfectly reasonable goal), governments are demanding that tech companies somehow deduce the ages of their users and block them from seeing adult materials. Some age verification proponents claim that it's possible to verify a user's age without creating as massive privacy catastrophe that reveals the browsing habits of every internet user, of every age. These people are wrong:

https://pluralistic.net/2025/08/14/bellovin/#wont-someone-think-of-the-cryptographers

The only way to verify that a user is a child is to verify the user, which means performing extraordinarily invasive checks on every internet user, and storing the results of those checks, and, inevitable, leaking the result of those checks.

The Big Tech companies are delighted by this. Google and Meta have both offered to do a kind of digital phrenology on their users to determine their ages. After all, they spy on us so much that they can probably make a good guess about our ages. And if they guess wrong, well, no biggie, they'll just block all the edge cases and force users to provide them with even more sensitive data.

But the future-proof, federated, decentralized services can't do age verification. Oh, sure, some of the servers in these federations can verify their users' age, and they might have to, because you can always find that single throat to choke for the people running the main Mastodon and Bluesky servers. But you can use Mastodon and Bluesky without using those servers – and they can't stop you.

This is something that the Turkish dictator Recep Tayyip Erdoğan discovered last spring, whe he ordered Bluesky to block information about his political rivals. All Bluesky can do in these cases is flag some messages as "banned in Turkiye" and then turn on the "block banned in Turkiye posts" filter for Turkish accounts. Those users can just turn that filter off, or avail themselves of a third-party client that doesn't auto-subscribe them to "block banned content" filters:

https://gizmodo.com/bluesky-just-bowed-to-censorship-demands-in-turkey-but-theres-a-loophole-2000593628

That's what it means for a service to be a protocol, not a platform. It means you can't demand to speak to the manager of the protocol if you don't like how someone is using it. It means there isn't a single throat to choke:

https://knightcolumbia.org/content/protocols-not-platforms-a-technological-approach-to-free-speech

Today, the new, future-proof federated services are trying to figure out how to comply with age verification orders. Bluesky has announced that it will age verify UK users:

https://www.theverge.com/news/704468/bluesky-age-verification-uk-online-safety-act

But you don't have to interact with the Bluesky servers to use Bluesky. While Bluesky was (very) slow off the mark to enable the tooling that would allow anyone to talk to anyone else using Atproto (the underlying protocol) without Bluesky's permission, that day has arrived now. There are now Bluesky (the service) implementations that are entirely separated from the authority of Bluesky (the company), most notably Blacksky, created by and for Black social media users who lived through Musk's enshittification of Black Twitter and won't get fooled again:

https://www.techdirt.com/2025/08/27/techdirt-podcast-episode-428-blacksky-demonstrates-the-promise-of-open-social-media-protocols/

Meanwhile, Mastodon (the organization) has said that it doesn't have "the means" to comply with age verification rules in Mississippi:

https://techcrunch.com/2025/08/29/mastodon-says-it-doesnt-have-the-means-to-comply-with-age-verification-laws/

The Mastodon server operated by the Mastodon organization has a policy barring under-16s from getting an account there. But there are many, many Mastodon servers (including, you'll recall, Truth Social) and they are all technically capable of talking with one another. Even if Mastodon (the organization) implemented some kind of invasive age verification on its server, other organizations – so distant from Mississippi as to be beyond legal retribution – could sign up users of any age, at its discretion.

One wrinkle here is whether there is an "enforcement nexus" between one of these independent Mastodon or Bluesky servers and a government seeking to impose age verification or other censorship policies. If you're running one of these servers, you wanna be sure your throat is out of choking range of these governments:

https://pluralistic.net/2023/03/05/theyre-still-trying-to-ban-cryptography/

The easiest way to do this is to not have any personnel or assets in territories controlled by governments seeking to impose censorship requirements. Large corporations whose investors made a bet on global domination find this tradeoff difficult to make. They want to open sales offices in every country.

But co-ops, individual tinkerers and small businesses typically don't have assets or personnel in a lot of countries or states, and avoiding the censorious ones doesn't pose much of a challenge.

The other enforcement nexus to worry about isn't enforcement against a server's operators, but rather, enforcement against its data. Territories with national firewalls (or heavily concentrated ISPs who represent a tractable number of chokeable throats) can block noncompliant servers from their users (who might or might not avail themselves of VPNs to evade thse blocks).

There aren't many national firewalls, and enumerating all the noncompliant servers in the Fediverse is a big chore for their operators (less so for all the noncompliant Atmostphere servers, because there's just not that many of those – yet). On the other hand, the mobile device duopoly of Google and Apple represent a pair of trivially chokeable throats that can be used to extinguish any app that displease a country's censors (all the more reason to make everything web-first and treat apps as unreliable adjuncts to core web functionality).

But there's one more potential chokepoint: to the extent that the Bluesky (the service) or Mastodon (the service) maintain some nexus of control over users, even users on independent servers, they could come under pressure to terminate users that displease governments. Now, Mastodon has no such control over users, and if it tried to exert that control (for example, by pressuring an independent server to terminate their users' access), they could be sued for tortious interference with contract.

Unfortunately, Bluesky has chosen to insulate itself from that hedge against being the chokeable throat that is used as a means to exerting pressure on independent servers in the Atmosphere. Bluesky's Terms of Service trap all of its users in a "binding arbitration" waiver that forces them to surrender their right to sue. That means that if Bluesky were to threaten Blacksky in a bid to force it to do age verification or engage in some other form of censorship, anyone involved with Blacksky who ever created a Bluesky account would be unable to use to courts to defend themselves:

https://pluralistic.net/2025/08/15/dogs-breakfast/#by-clicking-this-you-agree-on-behalf-of-your-employer-to-release-me-from-all-obligations-and-waivers-arising-from-any-and-all-NON-NEGOTIATED-agreements

(However, if you set up a Bluesky server without ever joining Bluesky (the service) and clicking through its ToS, you're golden.)

Of course, none of this matters to Maga – but it should. Decentralized systems with no readily chokeable throats are good for people with disfavored views, and that includes a lot of the Maga movement. Remember, Trump's agenda is incredibly unpopular:

https://navigatorresearch.org/wp-content/uploads/2025/04/Navigator-Topline-F04.07.25.pdf

Someday, Maga is going to find that their enemies have found the right throat to choke to silence them. But Maga's useful idiots just keep on stepping on this rake – these are the same self-owning fools who opposed municipal fiber and thus ensured that if just a handful of giant ISPs decided to deplatform you, you'd disappear from the internet:

https://pluralistic.net/2022/12/15/useful-idiotsuseful-idiots/#unrequited-love

Bluesky users were furious when JD Vance joined the service. Maga culture warriors were furious when Bluesky users called for his account to be terminated. Both groups are nuts. If Bluesky lives up to its promise – if it becomes an unchokeable, future-proof, decentralized social media protocol, and not merely a platform, then there's no way to kick JD Vance off Bluesky (the service). All you can do is demand that Bluesky (the server) cut off his account, whereupon he will immediately decamp to another server where he is more welcome, and still able to communicate with any Bluesky user who wants to hear from him.

Progressives should want this, because it's far more likely that Bluesky will be pressured to terminate users for failing to be insufficiently demonstrative in their anguish over the Charlie Kirk shooting than it is that Bluesky will be pressured to terminate the Vice President of the USA. But Conservatives should want this too – because if they're really worried about "deplatforming" and "Big Tech censorship," then they should be trying to create a new internet where deplatforming and Big Tech censorship are impossible – not an internet where they decide who gets deplatformed and censored.

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2025/09/16/too-many-throats-to-choke/#pluralism-is-resiliency

#compliance

Trending Tags

Recently Viewed Tags

#compliance