Notices by IFTAS (about.iftas.org@about.iftas.org)

Over the past few weeks, we’ve shared some difficult news, a few of our projects have come to a close after not meeting their funding goals. We know that’s never easy to hear. But we also want to take a moment to share what hasn’t changed – what is continuing, growing, and making a difference every day.

IFTAS is still here. Closing a few projects has allowed us to refocus our funding, and we are fully funded for a year at least. We’re still working, collaborating, researching, advocating, and supporting. The past year has made it clearer than ever that trust and safety infrastructure for the decentralised web isn’t optional – it’s essential.

Here’s what we’re still doing, and why it matters.

Independent moderators are the backbone of the social web, and too often they’re expected to do critical work with little support or recognition. Our Moderator Needs Assessment gathers real data on what moderators need – so that platforms, peers, and funders can respond with resources that actually help. It’s about building a foundation for lasting support, rooted in lived experience. Here’s the latest report.

We’re continuing to develop CARIAD, our tool for observing safety signals and behaviours across the federated web. CARIAD offers valuable insight into abuse trends, moderation challenges, and trust indicators – empowering moderators to respond proactively while respecting the values of decentralisation and autonomy. We also still publish our Do-Not-Interact domain denylist, representing domains reviewed and labelled by IFTAS.

The IFTAS Connect community remains active, supportive, and essential. It’s a place where moderators, admins, researchers, and advocates come together to share advice, resources, and strategies for keeping their communities safe and resilient. Soon, we plan to participate in a co-design effort to create standalone moderation tooling for the Fediverse. Whether you’re new to this work or deeply embedded, Connect is a space for connection and collective problem-solving. Request an account today.

IFTAS continues to represent the interests of decentralised platforms and independent communities in broader discussions about Internet governance, safety regulation, and funding. We provide evidence-informed responses to consultations, highlight the real-world impacts of policy decisions, and advocate for the empowerment, safeguarding, and inclusion of minority and underserved groups. We’re particularly focused on how online harm translates into offline consequences – and how to better bridge that gap in practice and policy.

The Social Web ISAC is still hard at work, supporting secure, coordinated responses to threats across decentralised networks. Whether it’s technical vulnerabilities, emerging abuse patterns, or cross-network incidents, the ISAC provides a space for timely information-sharing and trusted collaboration. Follow the alerts account.

We’re also continuing to build bridges with developers, researchers, standards organisations, and fellow non-profits working on digital safety. Our work depends on these relationships – on listening to each other, learning from each other, and pushing for collective solutions that scale with care.

We know the landscape isn’t always easy. Funding can be precarious. The problems are complex. But the need for safe, inclusive, and resilient online communities hasn’t gone away, and neither have we.

IFTAS is still here. Still advocating. Still researching. Still showing up for the people doing this work at the ground level. And we’re glad you’re here with us.

Want to get involved or support what we’re doing? Join the community at connect.iftas.org or get in touch – we’d love to hear from you.

The IFTAS CCS project was a pilot project to provide CSAM detection and reporting for Mastodon servers. The bulk of the project ran for 26 weeks, and while we cannot afford to maintain the service any longer, the findings below can inform future projects. All numbers are rounded for readability.

CCS received posts from eight services with roughly 450,000 hosted user accounts, 30,000 active monthly.

Our participants represented a range of service sizes from <10 to >100,000 accounts, and a range of registration options (open registration, open subject to approval, invitation only).

During the pilot period, CCS received 3.9 million posts via webhook, or 23,000 per day. These posts represent messages that were authored by or interacted with by the participating services’ active users, leading to media being stored on the host service.

Just under 40% (1.55 million) of all posts received included one or more media attachments to classify, leading to 1.86 million media files to hash and match. Posts with no media were discarded by the service.

Of the 1.86 million files, small numbers were either unsupported formats (~2,000) or no longer available when CCS attempted to retrieve the media for classification (~1,600). An additional ~3,100 media files failed to download.

In total, of the 1.86 million media files sent to IFTAS for classification, 99.665% were hashed and matched.

The hash matcher flags media for human review if it finds a match, or a near match, and after review IFTAS filed 53 reports related to 80 media files with NCMEC. This works out to 4.29 matches per 100,000 media files. An additional number of media files that matched were beyond our human review expertise to adequately classify, and therefore we elected to not report these files.

All of the matched media and subsequent reports were of real human victims, none were fictional, drawn, or AI generated. We did not receive matches for “lolicon”.

We elected to match against a broad array of databases to ascertain their effectiveness, and we found that databases maintained by child hotline NGOs (e.g. NCMEC, Arachnid) were far more effective than databases available from commercial service providers. We saw a handful of false positives, and the vast majority of them came from commercial providers. If we had continued, we would have narrowed down the databases in use.

All matched media generated a notification to the affected service provider, and IFTAS performed any necessary media retention for law enforcement.

4.29 matches per 100,000 may not sound like a large number. However, to be clear, this is a higher number than many services would expect to see, and it includes a broad range of media, from “barely legal” minors posted publicly, to intimate imagery shared without consent, to the very, very worst media imaginable. In some cases, it was apparent that users were creating accounts on host services to transact or pre-sale media before moving to an encrypted platform, under the belief that Mastodon would not be able to detect the activity.

There are 1.6 billion posts on the ActivityPub network today, and if our numbers hold true, this means there are currently many tens of thousands of copies of known CSAM on the network, likely significantly more as our service adopters by definition do not include providers that are not inclined to mitigate this issue, and criminals looking for anonymous accounts are likely to target less-moderated services.

If IFTAS found it happening so brazenly on the first servers we happened to look at, no doubt this activity is still occurring on servers that have no such protections. Mastodon is – at its simplest – a form of free, anonymous web hosting. The direct messaging feature precludes moderators and administrators from being aware of illegal content (it will never be reported by potential customers), and only a hash and match system is able to find these media and flag them.

Not only does inadvertently hosting CSAM revictimise the children involved, it also serves as an attack vector for the service to be targeted by law enforcement. We are aware of several instances of CSAM being uploaded for the express purpose of causing moderator trauma or an immediate report to law enforcement, leading to a significant amount of legal issues. This is essentially a form of swatting; simply upload CSAM, report it to the authorities, sit back and watch the server get taken down and possible criminal charges for the administrator.

We ensured that all webhooks were disabled by the host services, and once all review and reporting was completed, we hard-deleted all remaining data on the service, excepting the metadata and media required to be held for one year for possible law enforcement action. The AWS environment was then dismantled, deleted, and removed from service.

All associated staff and consultants were removed from the relevant IT services, and IFTAS retains no data nor metadata from any of the activity other than the bare minimum required by law pertaining to the encrypted media stored for law enforcement.

Some observed services that were clearly unmoderated and/or willing to host this content to the degree that federating with them would generate legal concerns were added to the IFTAS DNI denylist.

We hope that Mastodon, Pixelfed, Lemmy and other platform developers will quickly implement safeguards within moderation dashboards to minimise moderator trauma.

Content moderators commonly experience trauma similar to those suffered by first responders. Even though the development team may have never reviewed traumatic content, the app or service will at some point deliver this traumatic content to users of the moderation workflow. When presenting reported content to a service provider or moderator:

• Always show the report classification clearly, so the moderator is aware of the type of content they are about to review,
• Blur all media until the moderator hovers to view greyscale version (re-blur when hover not detected or mouseleave event),
• Greyscale all media until the moderator clicks to toggle full colour (allow toggle state back to greyscale),
• Mute all audio until the moderator requests audio, and
• Allow the moderator to reclassify the report.

If you are a service provider, lobby your web host or CDN provider to perform this service for you, and ask them if they have resources you can use.

Cloudflare offers a free service worldwide, if you are a Cloudflare customer, consider enabling this option.

If you are a web host that hosts a large number of Fediverse providers, consider adding this safeguard at the network level.

Tech Coalition has a program aimed at small and medium services called “Pathways“, and they are very interested to hear from Mastodon and other Fediverse service providers. While this does not offer detection, it does offer background, guidance, and access to experts. Sign up to explore these options, and to demonstrate a good faith effort to address this issue. The more providers they hear from, the more likely we are to get better options.

We are aware of noteworthy efforts to continue this work. @thisismissem is working on a prototype implementation of HMA, and Roost is exploring an open source solution for small and medium size services.

Consider following and monitoring https://mastodon.iftas.org/@sw_isac to receive alerts when services are confirmed to be sources of this content.

A range of services and resources that can help mitigate this issue are available on our CSAM Primer page in the IFTAS Connect Library. We will continue to research and share resources that can help mitigate this issue for service providers. Please let us know if you are aware of additional resources we can add to this guide.

IFTAS intends to continue its relationships with INHOPE, NCMEC, Project Arachnid, Internet Watch Foundation and other organisations to advocate for the Fediverse, and to ensure these entities understand the network and have someone to talk to if they have questions.

To everyone who participated, asked to participate, or supported this project, thank you! We are extremely sad to have to end this project, but we have safeguarded the underlying codebase and – should the opportunity arise – we will restart with this or another resource to provide this service to any who need.

Since its inception, IFTAS has worked to support volunteer moderators, administrators, and community managers across decentralised social media platforms, equipping them with the tools and guidance needed to foster safe, inclusive spaces.

While we haven’t been able to raise the funds needed to accomplish all our goals, we’ve been humbled to receive over $5,000 in additional support from our community since January, and this ensures there are plenty of activities we can continue to support.

Over the past two years, IFTAS has achieved several significant milestones:

• Community Building – We established the IFTAS Connect community portal, bringing together over 200 moderators and administrators to share best practices, resources, and support.
• Guidance and Resources – In collaboration with community moderators and industry experts, we developed comprehensive guidance materials, such as the DSA Guide for Decentralised Services and the Moderator Library to assist communities in navigating federated content and behaviour.
• Moderation Tools – We launched services like FediCheck, a web service that allows service providers to review and subscribe to external sources for automated domain blocking. We also built and piloted a CSAM detection service that demonstrated a novel way to approach this issue for administrators seeking to reduce this harm.
• Advocacy and Support – IFTAS has been a vocal advocate for decentralised communities, participating in broader trust and safety discussions and providing direct support to moderators facing challenges.

Given financial constraints, IFTAS is refocusing on its most impactful initiatives to ensure sustainable support.

As part of our re-scoping, we are discontinuing services that are unsustainable or lack sufficient support. These include the Content Classification Service, FediCheck (now available for download), Tall Poppy Personal Digital Safety Services, Bluesky Labeller, and the Moderator Mastodon Sandbox. Most of our planned activities such as OSA Guidance and legal support are no longer being worked on. 

We sincerely thank all users, contributors, and supporters of these services. Your efforts have been invaluable in promoting trust and safety across the open social web.

Despite these changes, IFTAS remains committed to several core initiatives that align with our mission to build and sustain trust and safety at scale in the Fediverse.

• IFTAS Connect – We will continue to support the public library and moderator connection activities of IFTAS Connect. This community platform serves as a vital resource for moderators and administrators, offering access to a wealth of information, best practices, and a supportive community of peers.
• Social Web Domain Observatory – The CARIAD project is what informed our FediCheck service, and it aggregates data on the most blocked domains within the Fediverse, providing valuable insights to help service providers manage federation and enhance the safety of their communities. CARIAD will be converted to a domain observatory. We will provide updates on the observatory’s availability as development progresses.

• Moderator Handbook – Our community has authored a detailed handbook for moderators, and we are working to bring this to the community as soon as possible.
• SW-ISAC – Our information sharing activities will remain, and we will issue alerts as and when appropriate, as well as keeping the IFTAS DNI list up to date. Follow https://mastodon.iftas.org/@sw_isac for the relevant alerts and notices.
• Moderator Needs Assessment – We plan to continue our annual survey of moderators and admins.

By focusing on these core activities, IFTAS will continue its support for decentralised communities, ensuring that moderators and administrators have the resources they need to maintain safe and inclusive environments.

Thank you to everyone who has advised, participated, convened, or in any way supported trust and safety on the social web – you are what makes all of this possible, and we are excited to continue finding ways to support the Fediverse and everything it stands for.

The following services are no longer sustainable or do not have the necessary support to continue, and will be shutdown as listed:

IFTAS CCS: CCS will be shut down Wednesday March 19. All incoming webhooks must be disabled by Friday March 14.

IFTAS FediCheck: FediCheck will no longer publish automated updates to servers effective immediately. The app will remain online in read-only mode until further notice.

Tall Poppy Personal Digital Safety Services: We will not be renewing this service, the app, its resources, and Crisis Resources should be available until the service agreement expires on March 24, 2025.

Bluesky Labeller: The labeller service and associated ATProto account will be shut down on or before March 21, 2025.

Sandbox Mastodon: the moderator sandbox will be shutdown on or before March 21, 2025.

We have a few activities rumbling along and it’s probably time for an update, so here goes.

Content Classification System

CCS is a third-party content classifier operated by IFTAS, and in its pilot form it hashes and matches media to detect known CSAM. We’ve run over a million media files through the stress-test phase and our observation works out to four matches per 100,000 files. That may not sound like a lot, but it’s four more than it should be, especially as our pilot program has only a handful of servers participating.

There is a mix of content, but to be clear, there is extremely vile content on the network. While we pursue funding to expand the pilot, I urge server admins to explore options to identify whether or not their services are being used to transact CSAM. We have some links to resources in the IFTAS Connect Public Library.

This is the most expensive project we run, so we have applied for funding specifically to support this activity.

Online Safety Act

The UK’s OSA is scaring more than few sites into shutting down. We have opened conversations with Ofcom and we are reviewing an option to create an OSA Guide for Decentralised Services (similar to our previous DSA guide). I strongly recommend service providers keep an eye on https://onlinesafetyact.co.uk/ – a collection of resources by Neil Brown, a UK-based tech lawyer who among other things runs his own Mastodon server.

Moderator Handbook

We have a completed draft of the handbook but reduced resources and availability to finish getting it into everyone’s hands. I will be working on getting this out in a living-document good-not-perfect effort as soon as possible.

FediCheck

Our denylist observatory service is getting some upgrades, and includes a beta of an API that can be queried to retrieve the CARIAD 51, 66 and 80% agreement lists. If you’re interested in trying this out, come ask about it in the IFTAS Matrix chat space. Signed-in users can now monitor domains moving up and down the list in the web app. FediCheck is restricted to Mastodon admins and moderators, you’ll need a valid account to access the service.

Our source (observed) server policy means that from time to time we may add or remove a server as it becomes eligible or ineligible to be an observed server, or an eligible server enables or disables public access to their denylist. A forthcoming update will remove one server, and add three, and will represent the blocks in place on the servers that collectively host 56% of all Mastodon accounts. In total we track over 74,000 historical federating domains, and roughly 2,000 are represented in the data we see on the observed servers. Of note, no domain is collectively blocked by all our observed sources.

Sustainability

Fund-raising is the bulk of my time right now, we have enough money to keep everything running through the end of April, but it’s fair to say that we are not seeing much interest from civil society or corporate sponsorship to keep us afloat. Our year-end community crowdfunding added a month of runway. We have two grant proposals under review, and several conversations with foundations in the coming weeks, so I’m hopeful we can get our message to the right people in time to keep us going while we build toward self-sustaining.

IFTAS is my full-time job for as long as I can sustain it, but to do so I will eventually need to get paid and we will need to find sources of revenue to allow us to operate without grants or sponsorship. I know full well the community cannot sustain us, at least not yet, so the original plan of finding outside money for the first three years continues.

I knew when this started it was a race to do as much as possible as quickly as possible to generate the trust and relationships we need to convince funders we are able to achieve the mission. I’m grateful to everyone who has donated their money, time, advice and love to the effort, and I hope to succeed in establishing a long-term option for IFTAS and all the volunteers it supports.

We are thrilled to announce that Erin Kissane has joined the IFTAS Advisory Board! Erin brings a unique and deeply informed perspective on trust, safety, and governance in decentralised online spaces, making her an invaluable addition to our mission of supporting independent social media communities.

Erin’s recent work on Fediverse Governance underscores her dedication to understanding and addressing the nuanced challenges of managing decentralised networks. Her thoughtful exploration of governance models, trust-building, and community care on the Fediverse reflects her commitment to fostering equitable and inclusive online environments.

Other notable achievements include co-founding and leading the COVID Tracking Project at The Atlantic, a significant public data initiative that provided comprehensive national data during a critical time. She also played a pivotal role in establishing OpenNews, fostering collaboration among data journalists, designers, and reporters to enhance the quality of journalism through shared knowledge and resources.

Most recently, through her microstudio wreckage/salvage, Erin continues to investigate the history and future of online networks, exploring cultural protocols and innovative practices that can help sustain healthier digital spaces.

Erin’s extensive experience and her commitment to decentralised governance align perfectly with IFTAS’s values of transparency, fairness, and safety. We are honoured to welcome her to the Advisory Board and are excited to collaborate on shaping the future of independent, inclusive online communities.

Please join us in extending a warm welcome to Erin!

#BetterSocialMedia

We are extremely proud to announce our Content Classification Service is up and running, with our first classifier active. We are starting with detecting child sexual abuse media for our opt-in connected servers, and our plan is to introduce additional classifiers over time, including non-consensual intimate imagery, terroristic and violent extremist content, malicious URLs, spam, and more.

For the time being we are operating in a closed test with a very small number of servers, and we have a slate of additional server admins ready to participate in our beta. You can learn more – and sign up to participate – on the CCS Web page.

In other news, we are kicking off an exciting collaborative with the Bonfire Networks developer team.

Bonfire is a governance-first community platform using ActivityPub, and the developer team are interested in reviewing proposals from the moderator community for rapid iteration of evidence-based, prosocial tooling and workflow in a co-design effort with the moderator community.

The Bonfire team have already rapidly adopted several proposals including:

• greyscaling and blurring media in reported content – this reduces trauma for moderators reviewing harmful content
• muting audio in media files – no sudden noises, loud volume or traumatic audio for the moderation workflow
• removing clickable links from reported content and suggesting URL investigation tools – this reduces the chance of moderators clicking through to phishing, malware, and other harmful web sites

Our IFTAS Connect community is working to provide additional feedback, and anyone is free to suggest additional feedback on the Bonfire GitHub.

This is a fantastic opportunity for the Fediverse’s trust and safety community to interactively guide the development of modular tooling that we hope will not only benefit Bonfire communities but can benefit the ecosystem at large, through modular adoption of the tooling, Fediverse Enhancement Proposals, or other platforms incorporating the same evidence-based prosocial approaches to empowering community managers and moderators.

We urge all IFTAS Connect moderator members to join us in the Moderator Tooling Workgroup and tell us all the tools, features and functions you want to see added to keep you and your community safe!

Lastly, a huge thank you to everyone who has responded to our community support drive, we’ve raised over $2,000 this year in direct community support and our IFTAS First 50 page is filling up! As we head into giving season, a quick reminder IFTAS is a 501c3, all donations are tax-deductible for US supporters, and we accept a wide range of support. If you can, donate today to keep supporting our mission!

https://about.iftas.org/2024/10/03/iftas-update-content-classification-moderation-tooling/

#ActivityPub #BetterSocialMedia #Bonfire #Fediverse

We are excited to celebrate the launch of the Social Web Foundation, a non-profit dedicated to advancing the open, interconnected web through the ActivityPub protocol. At IFTAS, we believe in fostering transparency, innovation, and safety within social platforms, and the formation of SWF is a major step toward that goal.

The Social Web Foundation brings together leaders from the Fediverse, with its mission grounded in educating users, improving social web infrastructure, and enhancing user experience across independent platforms. Under the guidance of leaders like Evan Prodromou (Research Director), Mallory Knodel (Executive Director) and Tom Coates (Product Director), the foundation aims to catalyse innovation while ensuring user autonomy and safety. Already working on end-to-end encryption, GDPR guidance, a Fediverse starter pack and more, the Foundation has plenty of amazing activities lined up.

ActivityPub has enabled thousands of platforms to communicate seamlessly across the Fediverse. This framework encourages a healthier online experience by supporting diversity of thought and content while redistributing governance back to the communities that can best serve their members. In an era where centralised networks dominate, the SWF’s commitment to open standards represents a renewed opportunity for a democratic and inclusive web.

At IFTAS, we share this vision of a safer and more equitable online world. That’s why we are happy to announce that Jaz-Michael King, our Executive Director, is joining the Social Web Foundation as an Advisor. His work at IFTAS has always centred on building safer digital spaces, and this partnership aligns perfectly with our mutual commitment to civil discourse and privacy protection.

The Social Web Foundation’s work is crucial for the future of independent social platforms, and we at IFTAS look forward to collaborating in this endeavour to build a robust, inclusive, and harm-free digital landscape. As Jaz has emphasised, “The opportunities to enhance trust and safety across the Fediverse are immense, and we are eager to work closely with SWF to make this vision a reality.”

Together, we are working to redefine the social web, ensuring that it is not only open but also safe for everyone.

For more information on the Social Web Foundation and its upcoming initiatives, visit socialwebfoundation.org or follow on Fedi using @swf@socialwebfoundation.org.

https://about.iftas.org/2024/09/24/welcoming-the-social-web-foundation/

#ActivityPub #Fediverse #SocialWebFoundation

IFTAS is happy to announce the public availability of our DSA Guide for Decentralized Services – a practical guide for small and micro services that are subject to the EU’s Digital Services Act. 

If your server has member accounts in the EU, or is publicly viewable in the EU, your service is most likely impacted by this regulation, even if you are not based or hosted in the EU.

Developed in collaboration with the great people at Tremau, our DSA Guide is designed to help independent social media service providers navigate these complex regulations and achieve compliance with these new rules without compromising the unique qualities of federated, open social networks.

As part of our Needs Assessment activities, we’ve heard a repeated need for help understanding the complex regulatory landscape that decentralized services need to consider, and this DSA Guide is the first of many in our plan to provide clear, actionable guidance to a range of regulations for the community.

As of February 2024, all online services and digital platforms that offer services in the European Union are required to be fully compliant with the DSA.

However, various portions of the DSA are not applicable to “small and micro” services, and this guide will show you clearly which parts apply and which do not.

For administrators of platforms like Mastodon, PeerTube, and Pixelfed, the DSA Guide can help demystify the requirements and offer practical advice on achieving compliance for the over 27,000 independent operators of these and other decentralized social media services who otherwise may not be able to obtain the guidance and advice that larger operations can afford to invest in.

Download the DSA Guide for Decentralized Fediverse Services.

To join the discussion, visit our community chat service at https://matrix.to/#/#space:matrix.iftas.org or stay tuned to join our community portal in the coming weeks!

https://about.iftas.org/2024/04/09/dsa-guide-for-the-fediverse/

#ActivityPub #BetterSocialMedia #DSA #Fediverse