When it comes to enforcing the EU’s digital regulation against social media platforms like X and TikTok, the Commission and national authorities are not alone in collecting the necessary evidence. In many cases, they rely on the work that is done by outside actors, such as AI Forensics.

The non-profit organisation analyses and investigates the algorithms that shape the information landscape. Based in Paris, they consider themselves an European organisation, with people working from all across the continent.

In an interview with netzpolitik.org, Marc Faddoul, the founder and director of AI Forensics, reflects on the organisation’s experience of working with regulators and points out how the conditions could be improved: by providing flexible funding and legal protection.

Contribution behind the scenes

netzpolitik.org: We often ask whether the European Commission or the national authorities have enough staff to enforce the Digital Services Act (DSA), but no one ever really mentions contributors like you. I suppose it’s partly because you’re not allowed to talk about all your contributions…

Marc Faddoul: In a way I’m sometimes shocked myself. About the role we are given to play in those big scale politics, about how much falls onto civil society.

I am not even sure it is really a matter of number of people; it’s more about the specific expertise that is needed to do this job. That is not necessarily the profile that is drawn towards the institutions.

And also the methods: We often have to deploy unconventional and adversarial methods to do the work that we do, that is not what the institutions are best at doing.

netzpolitik.org: So, let’s start at the beginning. What is it that you do?

Marc Faddoul: We’ve done a lot of work on social media recommender systems, because they were, and are still to a large extent, the most influential algorithmic system in shaping the information we consume. We are working increasingly on chatbots, since they are becoming the new gatekeepers of online content.

Our audience is the general public, usually through journalists. And we do a more targeted dissemination to regulators and policymakers to inform policymaking processes and especially to enforce existing regulation.

Our reports are always data driven. We collect data, including on systems for which there are no official data access mechanisms. We do so by using what we call “adversarial methods” which allow us to basically scrape publicly available content directly from those services and therefore analyse how they behave in different conditions and for different users.

netzpolitik.org: You mentioned the enforcement of laws. Besides the DSA, are there any other laws that are also quite important, or is that really the most important one right now?

Marc Faddoul: It’s definitely the most important one.

Firstly, because it is at the European level. When you’re facing those huge tech giants, you need a strong enough market power to be able to impose your rules.

Secondly, it encapsulates a lot of things through this notion of systemic risks: electoral integrity, a risk to mental health, technology-facilitated gender-based violence. There’s a whole range of risks that are captured in this article, which makes it one of the more flexible legal frameworks to date.

But it’s not only the DSA we work on. Recently we have done this study exposing the dissemination of non-consensual intimate images and the production of CSAM content by Grok. For both of these there are a lot of other legal frameworks for which this is relevant, both in Europe and worldwide. On those cases we are also working with other regulators, including Australia, the UK and California.

netzpolitik.org: And how exactly do you work with regulators? Do you bring something to their attention, or do you get tasks from them?

Marc Faddoul: In many cases we do our own investigations and then we bring them to the attention of the regulators. So that’s really our own initiative.

In other cases, regulators can come to us with specific requests. That can be paid or contracted, but not always.

Sometimes the work is unpaid

netzpolitik.org: And when it’s not paid, why do you still do it?

Marc Faddoul: When it’s unpaid, we still do it because it’s aligned with the mission of our organization to hold platforms to account to the user and to the law.

But obviously there are limits to how much we can do under these modalities, so it cannot be systematic. There is clearly a lack of funding mechanisms available from institutions to support the ecosystem. In some respects, there are new mechanisms arising, but it’s still quite limited.

netzpolitik.org: Who decides about the funding and how should it be improved in your opinion?

Marc Faddoul: At the European level now is an important moment because of the ongoing negotiations around the EU’s multi-annual budget. I think this is a big opportunity to push for more flexible funding.

One of the big pain points right now is that a lot of the funding is available through Horizon calls, which are typically three-year projects that have to be done in a large consortium of ten organizations or more.

It is quite inflexible because you cannot anticipate three years in advance what will be most relevant to do.

For example, the age verification mechanism has become a big priority. That was not the case two years ago. It is a change in the political agenda that gives it a stronger priority.

netzpolitik.org: Ok, let’s go over how the political agenda affects your work. In Brussels, it is said that people in the top political sphere are the ones taking some important decisions around the DSA cases, and that it’s not a purely technical enforcement.

Marc Faddoul: The fact that this is being constantly weighed on a geopolitical scale, is both frustrating for people who are involved in building this case, but also, most importantly, incoherent with the statements by those political leaders who say that respecting European laws is not something that is negotiable and that they will be enforced strictly.

Also, it is sending a wrong signal to those platforms and to adverse politicians that indeed they can put pressure to block those decisions.

And then you have a second component which is: What are you enforcing? What are the priorities?

There’s a lot of room for interpretation because the DSA is big. It’s being rolled out and not everything is being implemented with the same speed and with the same priority.

Political climate influences enforcement

netzpolitik.org: What is being prioritised?

Marc Faddoul: Some topics that have consensus across the political spectrum and also transatlantic consensus include the dissemination of non-consensual intimate images. Even Melania Trump, for example, was quite involved in advocating for this specific issue. Other examples of topics with broad consensus include CSAM content and age verification. Still, those political dynamics define where we are putting the pressure on.

On the other hand, climate change disinformation is now being pushed towards the bottom of the list.

netzpolitik.org: How would you rate the transparency of how the DSA is being enforced?

Marc Faddoul: I can tell you one thing: in the cases we’re involved in, where we provided evidence, we have no idea about their content or when they’re going to come out. We only know it’s been received.

And even then, we can be exposed by the results of those investigations.

This happened with the X investigation. The fine was sent out, then the Department of Justice in the U.S. leaked the whole investigative file with our names in it, unredacted.

So, this is a real consequence for us. We can have retaliation against us, especially when Elon Musk tweets very aggressively against the fine, how it’s censoring US free speech, which is obviously complete nonsense.

But, still, in reality, we can be harassed and attacked in response, but we had no control over the fact that our name was captured in those files, over the fact that it was released, and over the fact that we are not even really informed about the timetable.

This is not directly the Commission’s fault. They had to give the file to Twitter. Then the Department of Justice requested the file from Twitter. And then they leaked it.

We are a pivotal actor in building this case, but we have no control, and even no information on what happens next.

netzpolitik.org: You can not only be harassed via tweets or comments, but there could also be legal consequences, right? Do you have any sort of protection for that or does that all lie on you?

Marc Faddoul: All on us. The Commission doesn’t help us with that in any way.

Here, we have a clear policy request: the creation of a much better safe harbour for people who do public interest research, like we do.

netzpolitik.org: So, the main things that you would need are better funding, legal protection, also transparency, something else?

Marc Faddoul: Well, in fact, I think for our protection it is good that we don’t have the details of the cases. I wouldn’t make it a request.

The funding, absolutely. It should be more flexible, shorter term, not only through large consortiums.

And on the protection, yes, absolutely. A safe harbour for public interest research and also institutional support when we get attacked by foreign actors for the work that we do in supporting enforcement of democratic regulation.