The Autoadmit controversy: Some notes about social software, code, and norms

JB

The Washington Post recently ran a story about Autoadmit.com, a bulletin board site in which prospective students at colleges and law schools talk about the admissions process. Several Yale law students have been targeted for harassment and defamation at the site; links to one student's pictures have been placed on the site [not uploaded to the site as previously reported] and commenters have made lewd comments about her appearance, her breasts and her alleged sexual habits. After the student complained, other commenters have exhorted people to follow her around and take pictures of her when she goes to the gym to work out. The site has also had various racist and bigoted comments, not to mention plenty of other comments that are in extremely bad taste.

The Washington Post story reflects an all too familiar tale about social software: there are a lot of people using the site who can speak anonymously and therefore feel they have no responsibility for how they harm other people. When you have that combination, and when nobody in the community-- including the site administrator-- stands up for and signals the importance of decent behavior on the site, you inevitably get bad results.

I'm a professor of First Amendment law, so let me make one thing clear at the outset: People may have free speech rights to make some or even most of these comments. But we should never confuse whether one has a constitutional right to say something with the question of whether one is right in saying it. Comments that harass people and invade their privacy are completely inappropriate; moreover, they have nothing to do with the goal of the site, which is to share useful information about the admissions process.

It is very unlikely that the operators of Autoadmit can be held liable for the comments posted on the site; nor should they be, in my opinion. But that is really not the most important question. The real question is whether the site administrators should, as a matter of common decency, work to change social norms or to change the code on their site to prevent the site from being used to harass people and invade their privacy. Doing this does not violate anybody's free speech rights. In fact, what it does is make the site more useful for people's speech about admissions and encourage a better kind of information sharing.

One of the central insights of cyberlaw is that how you structure a social software system has a great deal to do with how valuable the system turns out to be. A second insight is that code can't do everything; social norms are particularly important too. If the site administrator or the other users of the site make clear that they do not condone harassing behavior, that would go a long way toward making people behave. Nevertheless, code and norms interact in important ways. Redesigning the code can help beneficial norms develop and sustain them over time. And that leads to my basic point: The site administrator controls the code, and he or she can go a long way toward encouraging good social norms.

The problem with the owners of Autoadmit is not that they have done something illegal; it is that they have failed to design and maintain their system properly. They have implemented what turned out in practice to be a bad design whose problems should have become obvious to them; moreover, once its flaws became apparent they failed to lift a finger to fix things. They completely abdicated their responsibility to the community who uses the site to encourage socially beneficial norms for the user base. As a result, the site is far less valuable than it could be, and it allows a small group of immature miscreants to injure people at will. The owners of the site may bear no legal responsibility for this, but that does not mean that they bear no responsibility at all.

Let me say something about the prevailing law. Under section 230 of the 1996 Telecom Act, Autoadmit is probably immune from suit for hosting comments that are defamatory or harassing. Although section 230 does not immunize some violations of federal electronic privacy law, it probably does apply to the ordinary privacy tort of disclosure of true embarrassing private facts. Autoadmit is probably also not liable for the use of the site to encourage other persons to stalk one of the female Yale law students and take pictures of her at her gym.

Since Autoadmit can't be sued, the only targets of legal action are the actual persons who posted the comments. It may be hard to find them because they used pseudonyms. In theory, the aggrieved law students could try to subpoena the ISP's the commenters used to find out their identities. But that might not succeed.

A better approach, I think would be to recognize that this case is about code and social norms. People should put moral pressure on the site administrators of Autoadmit to denounce bad behavior on the site and to change the code on the site to encourage good behavior and to limit comments that harass and invade people's privacy.

There are two obvious ways to recode the system. One involves moderation. The other involves identified anonymity. Each solution has its costs and benefits. Although neither solution is required by law, each is perfectly legal. Moreover, if the site owners institute either solution they are insulated from liability under the very same statute, section 230, which holds site owners harmless if they remove content, even if they do so selectively.

The first way to deal with harassing and defamatory comments is for site owners to moderate comments. The difficulty is that this can be very time consuming give the volume of comments. However, the site owners can create a system to delegate moderating to a team of volunteers like Slashdot does. This takes much more programming work but Slashdot shows that such a system can be very successful at self-policing. It essentially uses community norms backed by code to give people incentives to behave themselves.

In fact, even the Slashdot solution may not be necessary. Moderation doesn't have to be all that comprehensive to work. It merely has to signal what appropriate behavior in the community is. Even if the site owners simply announces that they will occasionally remove some comments that, in their opinion, go way over the line, they will be making an important statement about social norms. At the end of the day, social software sites rely heavily on social expectations. Autoadmit has degenerated into a place where people feel they can get away with exhorting others to stalk female law students, harass them online and invade their privacy. Clearly something has gone wrong here. The site administrators should lead by example. They should make a statement that this conduct is unacceptable, and encourage the rest of the community to join in. Failing to do even this much to discourage bad behavior is not protecting free speech. It is simply shirking responsibility.

The second way to deal with harassing comments on bulletin board systems like Autoadmit is to use identified anonymity. This requires posters to adopt pseudonyms connected to verifiable e-mail accounts. (This is what Google now does on Blogger, for example). A verifiable e-mail address means that the identity of the commenter can be traced. Indeed, if this system is adopted, the site owner could even institute a notice and take down system along the lines of section 512(c) of the Digital Millennium Copyright Act (DMCA). But this, too, might be unnecessary because the mere fact that one has to provide an traceable e-mail address should deter most people from misbehavior.

There are probably other ways to change social norms and to rework the code to discourage harassing behavior. I invite suggestions in the comments, and please remember, this blog is also a social software system, so play nice!
Posted 8:55 AM by JB [link]