Inside Story

Winning the battle, still fighting the war

Facebook’s problems with Australian regulators are far from over

James Panichi 24 February 2021 2805 words

Global mosaic: Facebook’s vice-president of public policy for Asia-Pacific, Simon Milner, appearing before the Senate inquiry into News Media and Digital Platforms Mandatory Bargaining Code via video link in January. Mick Tsikas/AAP Image

Facebook’s decision to purge news from its Australian feed was as sudden as it was brutal. Last Thursday users awoke to find that the news stories they were used to seeing among happy snaps of family and friends were nowhere to be found; those who relied on the platform to find out what was going on in the world were left high and dry.

As befits a well-executed act of bastardry, there had been no warning. The Australian government, which had been negotiating with the Silicon Valley giant over the News Media and Digital Platforms Mandatory Bargaining Code, was caught by surprise, as were the platform’s users. Newsrooms that had built distribution strategies around Facebook-elicited clicks scrambled to regroup.

Less than a week later, just as suddenly, Facebook was back at the negotiating table. The point had been made, and the deal with the government, when it came, did little to reduce the impact of the company’s shock-and-awe response to Australia’s landmark media code. It was a tantrum that echoed around the world — exactly as it was designed to do.

On day one of the operation, local media had been quick to conclude that Facebook’s plan had backfired. The list of innocent bystanders caught in the crossfire was indeed impressive: community groups, the WWF and its save-the-koala campaign, the Bureau of Meteorology, ABC Kids, health authorities and, of course, the now much-derided North Shore Mums group.

For the Australian media, Facebook had reminded the world not only of its power but also of its scattergun approach to moderation, with the platform seemingly unable to differentiate between the Sydney Morning Herald and the Sydney Local Health District. The void left by news would be filled by anti-vaxxers, conspiracy theorists and whatever charlatan Facebook’s algorithm coughs up on any given day.

But the political ruckus was a small price to pay for the message that was sent to other jurisdictions around the world — Canada, Britain, India and France — where similar regulatory moves are being countenanced. At the drop of a hat, Facebook has the power to cut loose the local media businesses that have come to rely on the platform to distribute their content. News needs Facebook more than Facebook needs news.

Local media had every right to take umbrage — after all, the legislation to enshrine the media code hadn’t even been passed. What made it even more unexpected was the fact that Google, the other target of the proposed legislation, had started to play ball with both Australian and international publishers in a bid to avoid being forced to a negotiating table overseen by an independent arbitrator — a nightmare prospect for a big tech company.

Yet the outrage over Facebook’s Australian news purge overlooked the backdrop to the move. The News Media and Digital Platforms Mandatory Bargaining Code may well have been the boldest attempt anywhere in the world to force digital platforms to pay for journalism, but it’s not the first time Facebook has been on the receiving end of innovative regulation in Australia. Over the past few years, digital platforms have been clobbered by Australian laws and enforcement in ways that are simply unthinkable in other countries — and Facebook has been bearing the brunt of that.

Australia’s 2019 “abhorrent violent material” legislation is just one example of what the social media platform has had to endure. Under the law, Australian-based Facebook employees could be jailed for up to three years if the company fails to remove designated violent content in an “expeditious” manner. Facebook’s Australian boss, Will Easton, is reportedly not involved with the company’s local strategy, which is being guided by head office, yet he could still wind up behind bars if live-streamed content, such as the 2019 mass shootings in Christchurch, isn’t removed quickly enough to satisfy the vague wording of the legislation. Nobody accepting a job with Facebook’s Australian business would be unaware of what they are signing up to and no democratic country has comparable legislation in place.

This also suggests that Australian laws targeting platforms are part of a more complex global mosaic. In the United States, judges at both state and federal level already have Facebook in a headlock, with myriad allegations that the tech giant has violated antitrust or privacy laws. French lawmakers are pursuing objectives similar to those of Australia’s media code, albeit using copyright law; India is pushing back on the use of Facebook’s WhatsApp; and the European Commission, the EU’s regulator, has unfinished business with Facebook over its 2014 acquisition of WhatsApp.

Facebook knows that regulation is catching up with it, and it knows that Australia’s efforts to tamper with its business model had to be shut down quickly and ostentatiously, before other jurisdictions followed suit. The North Shore Mums got themselves caught up in what may prove to be the most significant regulatory tangle of the century.

If turnout is an indicator of success for a press conference, the Australian Competition and Consumer Commission’s 16 December effort was a flop. There was just one journalist in the house — a Sydney-based colleague of mine — to hear ACCC chairman Rod Sims announce a court action against Facebook, Facebook Israel and a Facebook-owned company called Onavo. Yet Sims’s words that day attracted the attention of business editors, and reports of the Federal Court of Australia lawsuit quickly bounced around the world.

The Onavo case is significant. The ACCC is tackling Facebook over data-privacy issues — something it has already done, twice, against Google, with one suit delving into what consumers did and didn’t know about Google’s Android operating system. But Australia’s 1988 privacy legislation, which is only now being overhauled, is a hopelessly inadequate tool for safeguarding the rights of people who use digital platforms. Penalties under the Privacy Act aren’t large enough to deter global tech giants, and the privacy enforcer, the Office of the Australian Information Commissioner, is overstretched and underfunded at the very time privacy challenges are mounting.

By contrast, Australia’s recently updated body of consumer laws — known collectively as the Australian Consumer Law, or ACL — places significant firepower and additional investigative tools in the hands of the comparatively well-resourced ACCC. Since 2018, the regulator has been able to ask courts to impose fines of up to $10 million per offence, or three times the value of the monetary benefit received by the company, or 10 per cent of the company’s global annual turnover — whichever of the three options is the largest. That 10 per cent penalty places Australia at the forefront of global privacy enforcement; even the EU’s groundbreaking General Data Protection Regulation, which came into effect in 2018, fixes penalties at a mere 4 per cent.

The ACCC knows that it has a lethal weapon at its disposal, and its lawsuits against Google and Facebook are likely to reveal the law’s efficacy as a deterrent. By contrast, the information commissioner has been relegated to more narrowly defined privacy cases, such as Facebook’s Cambridge Analytica data breach, which saw the usually unadventurous privacy watchdog file action in the Federal Court that mirrors what is unfolding in other jurisdictions — including Canada, where an almost identical lawsuit appears to be floundering.

But pursuing what are essentially privacy cases under consumer law requires lateral thinking. For example, the ACCC isn’t arguing that Google breached the privacy of users of its Android operating system by not informing them that their phones gather information about their whereabouts even after location-tracking settings have been disabled. The ACCC will instead argue that the search giant’s failure to inform Australian consumers of its data-gathering, storing and processing was a breach of its duties under consumer law. It’s about failing to protect consumers.

Which brings us back to Onavo, the Israeli company behind a free, downloadable software application offering a virtual private network, or VPN. Facebook acquired Onavo in 2013 — a deal driven by Onavo’s access to data that is now viewed as highly controversial.

Onavo’s app, called Onavo Protect, promised its users absolute privacy — it was the app’s key selling point. But the ACCC alleges that the company was in fact hoovering up data from its mobile users, and that the data ended up under Facebook’s control. In Sims’s words, “hundreds of thousands” of Australians were affected by Facebook’s alleged actions, none of them aware that their online habits were being monitored by the owner of their privacy-focused VPN. So great was the concern over Facebook’s relationship with Onavo, says the ACCC, that Apple and Google removed the product from their app stores.

While this lawsuit is unfolding in Australia, Facebook has been targeted by twin competition lawsuits filed by the Federal Trade Commission, one of the two competition regulators in the United States, and forty-eight state attorneys-general. The platform has been accused of extending its monopoly of social media through anticompetitive acquisitions — known as “killer” acquisitions — and of devising strategies to exclude its competitors.

The Onavo documents filed in the US case are likely to make an appearance in the ACCC’s local lawsuit because they reveal what US prosecutors will argue was an early-warning system to alert Facebook to current or future threats to its monopoly. Any evidence of users flocking to a particular software, for example, could be dealt with either through a pre-emptive acquisition or by finding other ways to defuse the threat, according to the complaint filed by the US states.

The ACCC is likely to stick to the straight and narrow of Australian Consumer Law by arguing that Australian users should have been informed that Facebook was making use of their data. But the competition law elements fed in from the United States will boost the Australian regulator’s understanding of how Facebook operates — an understanding now recognised as world-class following the landmark Digital Platforms Inquiry, the eighteen-month probe that ultimately led to the formulation of the media bargaining code.

The ACCC’s developing expertise in digital markets is arguably a bigger threat to Facebook than any single piece of legislation. That knowledge is permeating the regulator’s ongoing probe of digital advertising, which is being closely monitored by lawyers working on a lawsuit, filed in Texas by ten US states, taking on both Facebook and Google over their ad-tech practices.

Meanwhile, the ACCC’s growing scepticism about Facebook acquisitions of other technology companies, which are clearly designed to gain control of vast swathes of data, is now feeding into the regulator’s review of specific deals it is examining, including Google’s move on smartwatch maker Fitbit and Facebook’s completed play for Giphy, a company specialising in GIFs.

In fact, nothing illustrates the ACCC’s fear of Facebook’s control of data better than Facebook’s completed acquisition of Giphy, which is now subject to a behind-the-scenes investigation by the watchdog. Rod Sims doesn’t seem to believe that Facebook has any real interest in GIFs of Kanye West going from a smile to a frown or Oprah giving the camera her “I told you so” look; the tech giant simply wanted to get its hands on the data that changes hands every time you download something from Giphy.

Of even greater concern to the ACCC is the fact that every time you use a Giphy GIF on a rival platform, you are embedding Facebook’s data-gathering software — a kind of digital Trojan horse. “This would be right in the middle of their systems and it would help Facebook scrape the data of their rivals to see what their rivals are doing,” Sims told me recently.

Keen observers know that Australian home affairs minister Peter Dutton unliked Facebook years before the platform decided to purge news from its Australian feed.

In December 2018, federal parliament adopted the world’s first laws targeting encrypted messaging services, which allow law-enforcement agencies to demand access to decrypted messages — in other words, to build a “back door” into international encryption standards. The law’s top two targets were Facebook’s encrypted messaging service, WhatsApp, and Facebook Messenger. Not surprisingly, Facebook pushed back — but then, so did most Silicon Valley and Australian software companies. Scott Farquhar, co-founder of the Sydney-based software giant Atlassian, said the legislation amounted to “legislative creep” and warned that rules earmarked for serious crimes and terrorism may ultimately be used to prosecute traffic offences.

Dutton bristled at the criticism and used a National Press Club of Australia speech in 2018 to accuse American tech giants of dodging taxes and complaining about assisting authorities in democracies while cosying up to dictatorships in “grown markets” — by which he presumably meant China. Two years later, Dutton returned to the theme and singled out Facebook, saying that its plans to provide end-to-end encryption for its Messenger service would create a platform for child abuse. “Facebook would not allow in their workplace the abuse of women or children and yet they provide a platform that enables perpetrators to carry out that very activity,” Dutton said, no doubt knowing that once you’ve accused your adversaries of supporting paedophiles they’re unlikely to return your calls.

For Australian police forces and spy agencies grappling with money laundering and terrorism, access to encrypted messages was an important win. They argued that a key to unlock encrypted messages is now an essential part of their investigative toolbox, just as law-enforcement agencies could tap the phones of suspects in more innocent, pre-digital times.

For Facebook, though, the encryption laws were a disaster. By building a back door into its global encryption, said the company, Australia was paving the way for global criminal syndicates that are looking for weaknesses in secure communication. “Cybersecurity experts have repeatedly proven that when you weaken any part of an encrypted system, you weaken it for everyone,” a Facebook spokesperson said when the legislation was being reviewed in 2019. “The ‘backdoor’ access you are demanding for law enforcement would be a gift to criminals, hackers and repressive regimes, creating a way for them to enter our systems and leaving every person on our platforms more vulnerable to real-life harm.”

It’s not that these arguments fell on deaf ears — it’s more that the Australian government treated them with contempt. Since the MV Tampa entered Australian waters in 2001, the country’s centre-right coalition has staked its reputation on national sovereignty — or, at least, its understanding of national sovereignty. It was never going to accept arguments that it had a global responsibility to maintain the integrity of encrypted messaging services at the expense of national priorities. It argued that its responsibility was towards the people that live within Australia’s borders; the suggestion that it couldn’t apply local regulation to technology companies doing business here was never going to fly.

The 2019 legislation on abhorrent violent content, rushed through parliament in under a week, raised the same global concerns. The Coalition government dismissed them just as quickly. Facebook argues that its global operations mean that its Australian staff can’t be held responsible for, say, a piece of extreme terrorist content uploaded in Kazakhstan by someone with no links to Australia. The prospect of local Facebook employees ending up in jail if the company failed to act quickly to remove extreme violent content was at odds with the global nature of the internet, Facebook said.

This time, it was attorney-general Christian Porter’s turn to ridicule the suggestion that the government didn’t have the right to regulate what was appearing on Australian screens. If television stations were to broadcast extreme terrorist content, they would lose their licence — why should Facebook be any different?

That debate set the tone for the Australian government’s current interactions with Facebook. In April 2019, Porter said that discussions with the tech giant had convinced him that the social media platform had “no recognition of the need for them to act urgently to protect their own users from the horror of the live streaming” of the Christchurch massacre.

What had become clear then and remains clear today is that Facebook knows it’s on a hiding to nothing in Australia. The platform has zero friends among lawmakers and is treated with outright suspicion by a competition watchdog that reckons it understands the platform’s business model better than enforcers in other parts of the world. Meanwhile, time and time again, the Australian government has pushed for policy designed to hurt Facebook while mocking suggestions that a global platform was somehow out of the reach of local laws.

If Mark Zuckerberg does eventually decide that the time has come to turn his back on Australian news, it shouldn’t come as a surprise. •

The publication of this article was supported by a grant from the Judith Neilson Institute for Journalism and Ideas.