The decision only we can make

The past year has been defined by not one, but two plagues. The COVID-19 virus attacked our bodies, our livelihoods, and our ways of life. Meanwhile, an all but invisible corporate infrastructure of servers, databases, and algorithmic systems that commodify not just our social interactions but our very existence atomized our most intimate thoughts and actions as we all migrated our work, school, and social lives online.

The toll of the first plague, now in the initial stages of containment thanks to the rapid development of vaccines, will be counted in the loss of our loved ones, our diminished economic security, and our nostalgia for how life used to be. The toll of the second, which aided in distancing us from scientific facts and fragmenting our sense of common cause, will be the loss of our agency and our ability to co-exist—if it is allowed to go on unchecked.

Machines betray us again and again, yet we are more dependent on them now than ever before. And as data subjects, we have become an integral part of how they function.

“Our use of information and communications technologies is now less a series of deliberate, self-conscious acts and more like something that just continuously runs in the background,” observed Citizen Lab Director Ronald Diebert in Reset: Reclaiming the Internet for Civil Society. He writes, “much of it is rendered invisible through familiarity and habituation. Disparate systems have converged into an always-on, always-connected mega-machine.”^[1]

Our founder, Rebecca MacKinnon, articulated this choice a decade ago in her seminal book Consent of the Networked, the source code for Ranking Digital Rights. She foresaw the dangers of a world in which “the corporations and governments that build, operate, and govern cyberspace are not being held sufficiently accountable for their exercise of power over the lives and identities of people who use digital networks.”^[2] And she called on us all to act: “Whether we are simply users of technology, investors in technology companies, employees or executives of Internet-related companies, elected officials, or mid-ranking government bureaucrats, we all have a responsibility to do whatever we can to prevent abuse of digital power, and even avoid abusing it ourselves.”^[3]

RDR: Establishing the baseline

For the past eight years, Ranking Digital Rights has pushed companies to uphold their obligations to human rights. Our primary vehicle for this work is the annual RDR Corporate Accountability Index, a body of public interest research that evaluates how transparent tech companies are about their policies and practices that affect people’s rights to free expression and privacy, and ranks them against their peers. We use what companies say to establish a baseline against which to measure their practice. To determine our rankings, our team painstakingly combs through thousands of company documents each year to learn how each one sets and enforces its policies, how accessible those policies are, and how they interact with governments and other third parties.

The 2020 RDR Index is our fifth edition. It has grown from ranking 16 companies in 2015 to 26 companies this year. Periodically, we refine and update our methodology to make sure we are responding to developments in the field. Our 2020 RDR Index methodology includes nearly double the original number of indicators, including a robust set of new standards to assess disclosures on algorithmic systems and targeted advertising. We also expanded the scope of human rights harms we cover to include the right to non-discrimination.

Our company scores and our analysis, as well as our continuous engagement with the companies we rank, has yielded some notable improvements:

• In 2015, nine companies committed to protect either free expression or privacy, or both. This year, that number has increased to 19.
• For those that conduct any kind of human rights due diligence, the number has grown from 8 companies in 2015 to 19 this year.
• Companies are also getting better at transparency reporting on content moderation, with 7 companies now doing at least some reporting, as opposed to zero in 2015.
• When we first asked about policies around data breaches in 2015, only three companies disclosed anything. This year, half of all companies we rank did so.

Sometimes, the numbers do not tell the full story. In 2017, when we started asking telcos to publish information on how they respond to network shutdown demands, only one company disclosed the number of shutdown orders it received and none revealed how many they had complied with. Today, three companies specify how many orders they received and two publish compliance rates. More companies are also describing their process for responding to such demands and committing to push back. We also highlight some notable firsts this year: Chinese company Baidu and Russian company Mail.Ru each adopted human rights policies. MTN and Yandex published their first transparency reports.

“The most striking takeaway,” writes our research director, Amy Brouillette, about our key findings, “is just how little companies across the board are willing to publicly disclose about how they shape and moderate digital content, enforce their rules, collect and use our data, and build and deploy the underlying algorithms that shape our world.” Even companies topping this year’s rankings—digital platform Twitter and telecommunications company Telefónica—do not earn a passing grade. We also found that while companies may do well on certain indicators or in one of our three categories, no company does well across the board.

Although U.S. companies have historically ranked at or near the top of the RDR Index, being headquartered in the U.S. is not always a reliable predictor of performance. E-commerce giant Amazon, which we evaluated for the first time in 2020, ranked dead last. With the exception of Apple, U.S.-based companies in the RDR Index saw little to no improvement between 2019 and 2020. Google and AT&T declined on indicators that did not change during this period. When we factored in our new indicators on algorithms and targeted advertising, all U.S. companies saw their scores fall.

Policy transparency helps people

Scores are one thing. But the companies’ collective failure to meet even our minimum standards of policy transparency—especially in a year like 2020—puts the dangers of abusing digital power into high relief.

“Our perpetual state of emergency has exposed the holes in corporate policies and practices that can amplify conspiracies, deprive silenced voices of remedy, and further exclude the marginalized,” write Elizabeth Renieris and Jan Rydzak in “Context before code,” one of three companion pieces to this year’s RDR Index that offer a lens through which to view and understand our 2020 findings and their relevance to the world around us. Their essay illuminates how companies’ lack of preparedness for network shutdowns, the proliferation of COVID-19 misinformation, and stay-at-home orders that left users without human content moderators, can be mitigated in large part by observing the business and human rights practices on which our indicators are based.

Chinese companies and the implications of their operations beyond China’s borders also drew a lot of attention in 2020, with efforts by the U.S. and Indian governments to ban TikTok and WeChat. This spurred us to ask MacKinnon to draw on her deep experience in Asia to take a close look at developments at perennially low-ranking companies Tencent (operator of WeChat) and Baidu in this year’s RDR Index, along with newcomer Alibaba. MacKinnon reports that “Chinese companies can and do respond to pressure from foreign governments, investors, and even users. But the extent to which they can improve policies and practices affecting users’ human rights is severely handicapped by China’s legal and political system.”

In “Moving fast and breaking us all,” Ellery Roberts Biddle and Jie Zhang invoke the specter of the unaccountable algorithm, the data-hungry formulas that are making any number of life-altering decisions on our behalf, but the inner workings and outcomes of which no one—not even the companies who build them—can adequately explain. Equally troubling is how little companies will say publicly about these systems and how they work, information that can help researchers, policymakers, and investors evaluate their risks. Our new indicators are designed specifically to evaluate how much companies disclose about these systems. Spoiler alert: It is not much.

The internet has changed dramatically since RDR began its quest to hold companies to account. When we set out, many of the companies we rank were still thought of as allies—providers of tools that could help people push back against repressive governments and advocate for human rights and democratic governance around the world. In 2021, there is no shortage of headlines suggesting that the world would be a better place without the tech giants. And in a year when so many people have seen their economic security compromised, tech companies across the globe are reporting record revenue and profits—profits driven by the collection and processing of users’ data—making it all but certain the backlash will intensify.^[4]

Civil society puts tech companies on notice

Seven companies control the internet and its infrastructure, according to Mozilla’s latest Internet Health Report. They are all ranked in the RDR Index and are among the top 10 companies by market capitalization in the world. These seven, along with Baidu (which we rank) and IBM (which we do not), also happen to be the companies “who are building the rules, systems and business models for the future of artificial intelligence,” according to Forbes. Three of them—Amazon, Google, and Facebook—have spent more than half a billion dollars on lobbying U.S. lawmakers over the past decade.^[5] Big Tech is also spending more than ever in Brussels—a combined €21 million in 2018–19; and €23 million in the first half of 2020—to influence policymakers working on new legislation such as the Digital Services Act and the ePrivacy Regulation.^[6]

At the same time, we know that without the tech services and platforms we rank, alongside hundreds of others, the pandemic would be even lonelier, less productive, and more difficult to endure. But, we have to ask, at what cost? Without more transparency from the companies, we cannot calculate it. If people and lawmakers do not know the specifics of how they operate, it is much harder to hold them accountable for their negative effects through smart regulation and other measures. We risk losing their benefits as we try to mitigate their harms.

Fortunately, as companies have amassed more power and profits over the past decade, global civil society, including RDR, also has been hard at work, building the political and social capital needed to bring debates about the role of tech companies from the fringes to the mainstream.

Almost as soon as contact-tracing apps were being touted as easy fixes to spreading the coronavirus, privacy and anti-surveillance advocates sounded the alarm. Experts pointed to the potential for misuse of the data they were collecting and the inequities of designing public health systems around technologies that not everyone can access, due to the persistent global digital divide. In the wake of the police murder of George Floyd, civil rights groups led the successful #StopHateforProfit ad boycott, in which more than 1,000 companies pulled their ads from Facebook, bringing the link between targeted ad systems and viral online hate speech into the mainstream.

Meanwhile, investors and shareholders also expressed concern about environmental, social, and governance (ESG) risks tech companies pose, in their portfolio selections and through shareholder resolutions that highlight digital rights risks. Policymakers began taking the threat of tech power more seriously, educating themselves and calling company heads to testify, and formulating regulation that (in some cases) tries to balance the benefits of technology with human rights.

Last year also saw the launch of The Markup, an investigative journalism nonprofit dedicated to “watching Big Tech” by building tools like Citizen Browser that—with users’ permission—can monitor across multiple accounts what content, groups, and ads are amplified. And Consumer Reports, a leading consumer advocacy nonprofit in the U.S., redoubled efforts to integrate its Digital Standard, a framework for evaluating how technologies respect consumers’ interests and needs (based in part on the RDR Index methodology), into product testing of digital devices.

The rise of this ecosystem of actors seeking to hold tech accountable for its digital power sends a clear message: If tech companies do not want to tell the world how they work, how they profit, and how they will factor the public interest into their bottom line, we will force their hand. Through regulation, public advocacy campaigns, tech auditing, antitrust litigation, whistleblower leaks, employee organizing, and other efforts, we will expose and map what is happening behind our screens.

The RDR Index has a significant role to play in this movement. We have built and tested a set of human rights-rooted standards that anyone can use to hold companies to account. And we provide an evidence base that researchers, activists, policymakers, and others can rely on year after year to carry their work forward as we seek to neutralize the power these companies wield and reassert our individual and collective agency.

Together, we must keep up the pressure. There is just too much at stake.