Censorship Course DeepSeek Rules

# Lecture 4 — Speaker Notes (Platform Controls)

Per-slide context + clickable links. In-deck notes (the `::: {.notes}` blocks) are also visible via reveal.js speaker view (press **S**). Every URL was verified this session or is a canonical org landing page.

| Slide | Context + Links |
|---|---|
| **From the Pipes to the Platforms** | The hinge from Ch. 2 to Ch. 3 of the book. In the technical chapter, the censor sits on the wire and drops packets; here the censor sits *inside* the platform and shapes the feed. Same goal — a tax on access to information — different layer. Roberts's frame: [*Censored*](https://press.princeton.edu/books/hardcover/9780691178868/censored) (Princeton, 2018), especially the friction/flooding arc from Ch. 2. |
| **The Real Lever Is the Choice Set** | Book §3.1, opening. Tie back to the Ch. 1 "tax on access" framing: modern control rarely requires *removing* content; manipulating **which** content reaches users is often more effective and harder to detect. Foundational reference: Gillespie, [*Custodians of the Internet*](https://yalebooks.yale.edu/book/9780300235029/custodians-of-the-internet/) (Yale, 2018) — moderation as constitutive of the platform, not a bolt-on. |
| **Three Places to Manipulate the Pipeline** | Book §3.1. Production / dissemination / discovery — walk the pipeline. The same four behavioral signatures of influence campaigns (high volume, high retweet ratio, fast retweets, coordination) show up across all three. Foreshadows Lecture 5 (Propaganda). |
| **Many Platforms Can Control Speech** | Book §3.1 + centralization thread from Ch. 1. Every layer of the stack is a chokepoint: registrars, DNS, CDNs, news portals, search, social, app stores, AI assistants. Key teaching point: centralization is what makes modern takedown both *easy* and *deniable*. Concrete anchor: the [Nov 18, 2025 Cloudflare outage](https://blog.cloudflare.com/18-november-2025-outage/) — one misconfig took X, ChatGPT, Shopify, Truth Social, NJ Transit dark for hours. No attacker, no takedown demand, just consolidation risk. |
| **State Pressure Now Runs Through the Platforms** | **Freshest anchor — the EU's DSA enforcement machine (2025–26)** is now the marquee *Western* example of state preferences routed through platform pipelines: a **€120M fine on X** (Dec 2025) over verification/ad transparency, formal DSA proceedings over **Grok-generated illegal imagery** (opened Jan 26, 2026), and preliminary findings that **TikTok and Meta** breached DSA transparency and researcher-data-access duties ([EC, Oct 2025](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2503)), with a further child-safety preliminary finding against Meta in **Apr 2026** — fines up to **6% of global turnover**. The legal hook is the same everywhere: comply with the regulator's risk-mitigation demands, or lose the safe-harbor.<br><br>**Marquee current-event case: Brazil vs. X, Aug 30 – Oct 8, 2024.** Justice Alexandre de Moraes (STF) suspended X nationwide over refusal to remove Bolsonarista accounts and name a legal representative. X ultimately complied — blocked accounts, paid fines, appointed a rep — and was restored Oct 8. Coverage: [Lawfare](https://www.lawfaremedia.org/article/musk-s-x-banned-in-brazil) · [NPR — Brazil starts blocking X](https://www.npr.org/2024/08/30/nx-s1-5096220/brazil-suspends-x-elon-musk) · [NPR — X reinstated](https://www.npr.org/2024/10/08/nx-s1-5146510/brazil-x-twitter-court-reinstated-elon-musk) · [Columbia Global Freedom of Expression case entry](https://globalfreedomofexpression.columbia.edu/cases/the-case-of-the-x-ban-in-brazil/). Starlink assets were also frozen (Aug 24) to cover fines. The point: an *independent judiciary* used infrastructure-level blocking against a major platform. **India IT Rules 2023 fact-check unit:** amendments empowered a government unit to flag content — comply or lose safe-harbor. Ask the room: is a court-ordered platform block "censorship"? |
| **Why Platforms Turn to Automated Filtering** | **Freshest Section 230 hook — the design-defect end-run.** On **Mar 25, 2026** the first California JCCP bellwether jury (Los Angeles Superior Court) found **Meta and Google/YouTube** liable for negligently designed engagement features that harmed a teen, awarding ~$6M — and Judge Kuhl held that **neither Section 230 nor the First Amendment** barred the design-defect claims because they targeted *how the platform was built*, not user content. If it survives appeal it reroutes thousands of MDL cases around Section 230. (Descriptive cite — verdict widely reported Mar 2026; no stable canonical URL yet.)<br><br>Book §3.2. Reframe the "spam filtering is an old problem" arc: the *same* machinery built to filter unwanted traffic now adjudicates *speech*. The danger is the category error — treating "is this hate speech / parody / fair use?" like "is this spam?" Spam has no First Amendment interest; speech does. Foundational Section 230 primer: [47 U.S.C. §230](https://www.law.cornell.edu/uscode/text/47/230). Recent SCOTUS direction: [*Moody v. NetChoice, LLC*, 603 U.S. 707 (2024)](https://supreme.justia.com/cases/federal/us/603/22-277/) — the Court held platform "selection, ordering, and ranking" of third-party content is expressive activity protected by the First Amendment, but vacated and remanded for further facial-challenge analysis. See also [Wikipedia — Moody v. NetChoice](https://en.wikipedia.org/wiki/Moody_v._NetChoice,_LLC). Post-*Moody* Section 230 turbulence: a Third Circuit decision (Anderson v. TikTok) split with the MDL court on whether algorithmic recommendation is Section-230-protected — see [EPIC's overview](https://epic.org/design-based-lawsuits-against-platform-companies-reveal-fault-lines-in-courts-section-230-interpretations/). |
| **A Map of Real Moderation Systems** | Table draws on Gorwa, Binns & Katzenbach, ["Algorithmic Content Moderation"](https://journals.sagepub.com/doi/10.1177/2053951719897945) (*Big Data & Society*, 2020) — the canonical taxonomy of exact-match vs. classifier systems and where humans sit. Rightmost column reveals the teaching point: humans never fully leave the loop — they label data, set thresholds, curate hash databases. "Automated" moderation is automated *enforcement* of human judgments, with all their biases baked in. Distinguish the two families before the next slides. |
| **Family 1: Fingerprinting (Exact / Perceptual Match)** | **PhotoDNA** (Microsoft, 2009) is the canonical example — see [Microsoft's PhotoDNA page](https://www.microsoft.com/en-us/photodna). Deployed by NCMEC and most major platforms for known-CSAM detection. Cross-platform hash-sharing consortium: **GIFCT** (Global Internet Forum to Counter Terrorism) — <https://gifct.org/>. Audio: **Content ID** on YouTube (see [YouTube Copyright Transparency Report](https://transparencyreport.google.com/youtube-policy/)). Teaching point: fingerprinting is precise and privacy-preserving (store the hash, not the image) but **database-bound** and **context-free** — great for known CSAM or copyrighted audio, useless for novel content, parody, or fair use. |
| **Case Study: GIFCT — One Hash, Every Platform** | The **Global Internet Forum to Counter Terrorism** (<https://gifct.org/>), founded 2017 by Facebook, Microsoft, Twitter, and YouTube, runs a **shared hash database** of terrorist/violent-extremist content: per the 2024 GIFCT Annual & Transparency Report, **408,000** distinct hashed items across **33** member platforms, where one platform's takedown decision **propagates to all** members. This is the syllabus's "centralization = takedown risk, no appeal" case study: scope crept from ISIS imagery to broader "violent extremism" (**mission creep**), and *how* content is added, by whom, and what appeal exists stay largely opaque. Civil-liberties critics — Brennan Center, EDRi, Statewatch — flag the absence of any due-process review. The teaching point mirrors the earlier centralization slide: fingerprinting is precise, but a *shared* database turns one firm's judgment into a web-wide deletion. Cross-link: intermediary-liability / DSA framing in Ch. 4. |
| **Family 2: ML Prediction (Statistical Match)** | Google Jigsaw / **Perspective API**: <https://perspectiveapi.com/>. Reddit **AutoModerator** (regex rules): [Reddit's AutoModerator wiki](https://www.reddit.com/wiki/automoderator/). Prediction lets you catch *novel* content but is only as good (and as biased) as its labels — bridge to next two slides. |
| **Prediction Is Brittle: Evasion** | Hosseini et al., ["Deceiving Google's Perspective API Built for Detecting Toxic Comments"](https://arxiv.org/abs/1702.08138) (arXiv:1702.08138, 2017) — the "idiot" → "idiiot" demo. Same character-level fragility that breaks toxicity classifiers breaks any ML moderator. Tie to the asymmetry: defenders must be right at scale; attackers need one cheap trick. Modern analog: adversarial suffixes and jailbreaks against LLM moderators — see [Zou et al., "Universal and Transferable Adversarial Attacks on Aligned Language Models"](https://arxiv.org/abs/2307.15043) (2023). |
| **Prediction Is Brittle: Bias** | Binns et al., ["Like trainer, like bot? Inheritance of bias in algorithmic content moderation"](https://arxiv.org/abs/1707.01477) (2017). "The model doesn't discover a neutral truth about offensiveness — it replicates the subjective judgments (and gaps) of whoever labeled the data." Different protected characteristics, different effects. Related — Sap et al., ["The Risk of Racial Bias in Hate Speech Detection"](https://aclanthology.org/P19-1163/) (ACL 2019) — AAE tweets flagged as toxic at 1.5× the rate of comparable non-AAE tweets. |
| **Auditing the Black Box** | Audit studies are to platform moderation what OONI/Censored Planet are to network censorship (Ch. 5): the only way to know what a black box does is to feed it known inputs and watch. Political-ad audit reference: search "issue ads audit Facebook Google" on the Center for an Informed Public site. General audit-methods primer: Sandvig et al., ["Auditing Algorithms"](https://social.cs.uiuc.edu/papers/pdfs/ICA2014-Sandvig.pdf) (ICA 2014). Both over- and under-blocking are real; you can't optimize away both at once. |
| **From Search to Synthesis** | Book §3.3 "AI as Information Arbiter." The shift: a list of ten links let *you* be the editor; one synthesized answer makes the *model* the editor — deciding sources, weighing conflicts, omitting. The omission is invisible: unlike a blocked site, a missing answer doesn't announce itself. Foundational read: [Bender et al., "On the Dangers of Stochastic Parrots"](https://dl.acm.org/doi/10.1145/3442188.3445922) (FAccT 2021). |
| **The Freshest Hook: The Click Has Gone** | **Pew Research, July 22, 2025:** [Google users are less likely to click on links when an AI summary appears](https://www.pewresearch.org/short-reads/2025/07/22/google-users-are-less-likely-to-click-on-links-when-an-ai-summary-appears/) — n≈900 US adults sharing browsing data, March 2025. When an AI Overview appeared: 8% click-through vs. 15% without; 26% session-end vs. 16%; only 1% clicked a link *inside* the summary. The book's economic argument: the gatekeeper becomes a sink. This is a structural tax on access, not a block. |
| **Censorship Baked Into the Model** | **Concrete current-event anchor — DeepSeek.** The Chinese open model **DeepSeek-R1** (released Jan 2025) refuses or reshapes answers on CCP-sensitive topics (Tiananmen, Xinjiang, Taiwan); testing found the **R1-0528** update is the *most* censored version yet ([TechCrunch, May 2025](https://techcrunch.com/2025/05/29/deepseeks-updated-r1-ai-model-is-more-censored-test-finds/)). Northeastern/Khoury researchers showed the model often *knows* the answer internally but suppresses it in the output — "a gap between what AI tells you and what AI actually knows" — and the censorship even transfers to models **distilled** from it ([Khoury College, Sep 2025](https://www.khoury.northeastern.edu/khoury-researchers-find-political-censorship-in-chinese-ai-model-and-explain-how-to-get-around-it/)). Unlike a blocked website, an LLM presents its gaps as if they don't exist.<br><br>Foundational academic thread: Ahmed et al. work on model behavior in Simplified vs. Traditional Chinese: descriptive citation — Ahmed et al., "Multilingual LLM behavior on politically sensitive Chinese queries" (2024–25 preprints in the AI-fairness literature; check ACL Anthology). LLMs learn from **web crawls** — but the web isn't the same everywhere; in heavily censored regions, large parts of the web are filtered before they're crawled. Unlike a blocked website, an LLM presents its gaps as if they don't exist. Word-embedding analog: Yang et al., "Bias in word embeddings from state-controlled news corpora." This is the subtlest form in the whole course: censorship that propagates *silently*. |
| **Which AI You Pick *Is* the Policy** | Kandel et al. (2024), audit of 96 moderation scenarios across Gemini, GPT-4, Claude, Llama — models disagreed on 36.5% of prompts; replicable for ~$1.58. Descriptive citation — search "Kandel content moderation LLM audit 2024" on arXiv. Punchline: there is no principled standard, just different value judgments shipped as defaults. Users can't predict flags, can't see why, can't appeal. Accountability gap. Live in 2025–26: the DeepSeek-vs-Western and Grok divergences (see adjacent rows) turned "which model = which policy" into an active regulatory question, not a thought experiment. |
| **The Model Is Also the *Target*** | **Marquee 2026 current event: X's Grok.** After Grok generated non-consensual sexualized "deepfake" images — including apparent child sexual-abuse material — regulators moved fast: the **European Commission opened formal DSA proceedings on Jan 26, 2026** (assessing whether X mitigated systemic risks from Grok; fines up to 6% of global turnover, with an EU deadline of ~late Apr 2026 to show effective automated safeguards), **Ireland's DPC opened a GDPR inquiry (Feb 17, 2026)**, and parallel probes opened in **France, the UK (Ofcom), Malaysia, and India** ([The Record, Jan 2026](https://therecord.media/eu-grok-regulation-deepfake)). X's response: restrict Grok image generation to **paying subscribers** — turning a safety control into a **paywall** (the stratification / "tax on access" story; cf. zero rating). Double teaching point: (1) the *moderator* is now the *thing being moderated*; (2) the same **safe-harbor** the platform relies on becomes the **lever** — comply with risk-mitigation demands or lose it. Cross-link: intermediary liability / Section 230 / DSA (Ch. 4). |
| **Content Moderation Is Genuinely Hard** | **Freshest anchor (Mar 2026): the first external verdict on Meta's pivot.** Meta completed its US **Community Notes** rollout on **Mar 5, 2026** ([Meta, testing announcement](https://about.fb.com/news/2025/03/testing-begins-community-notes-facebook-instagram-threads/)), and on **Mar 26, 2026** its **Oversight Board** issued a policy advisory opinion warning that Community Notes is **not a proper substitute** for professional fact-checking when expanded globally — flagging significant human-rights risks in repressive regimes, elections, and active conflicts, and urging a **hybrid** model that keeps independent fact-checkers ([Oversight Board PAO, Mar 26, 2026](https://www.oversightboard.com/decision/pao-007g5zuv/)). Meta held expansion outside the US and renewed fact-checker contracts for 2026 at reduced funding — the pivot's real-world scorecard is now contested, not hypothetical.<br><br>Book §3.3 takeaways. Don't let students leave thinking "platforms are just lazy/biased." The problem is hard: infinite content, missing context, human disagreement, adversarial inputs, *and* now economic stratification of who gets the good AI. **The 2025 Meta / Community Notes pivot is the current-event anchor**: on Jan 7, 2025, Meta announced it was ending its third-party fact-checking program in favor of X-style Community Notes — [Meta announcement](https://about.fb.com/news/2025/01/meta-more-speech-fewer-mistakes/) · [Washington Post](https://www.washingtonpost.com/technology/2025/01/07/meta-factchecking-zuckerberg/) · [NBC News](https://www.nbcnews.com/tech/social-media/meta-ends-fact-checking-program-community-notes-x-rcna186468). Rollout completed [Apr 7, 2025 in the US](https://www.fox10phoenix.com/news/meta-ends-us-fact-checking-2025). This is one company effectively rewriting the moderation rules of the largest ad platform on Earth — with essentially no external accountability. Discuss whether Community Notes actually works: the ITIF, EFF, and misinformation researchers disagree sharply. Meta [Oversight Board's April 2025 policy-change decisions](https://www.oversightboard.com/news/wide-ranging-decisions-protect-speech-and-address-harms/) are the first external review of the pivot. |
| **What We Carry Forward** | Closing map. Chapter spine: choice-set manipulation > deletion; centralization = takedown risk; AI = arbiter. Bridges to Lecture 5 (flooding & propaganda — the *additive* side) and Lecture 6 (personalization — the *quiet* side). Discussion seeds: Should platforms be *required* to automate? For which content — hate speech, CSAM, copyright? Who should bear the burden of detection and the cost of error? For the EU DSA regulatory frame we'll pick up in Ch. 4, note the Oct 24, 2025 Commission preliminary finding against Meta and TikTok — [European Commission IP/25/2503](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2503) — for failing DSA Article 40 researcher data access. Fines up to 6% of global turnover. |