On the cybersecurity subcommittee’s Wikipedia investigation

Congress is now investigating Wikipedia.

More precisely, according to a letter dated August 27, 2025 and sent by Rep James Comer (R-KY) and Rep. Nancy Mace (R-SC) to the CEO of the Wikimedia Foundation, Maryana Iskander, the cybersecurity subcommittee of the House Oversight and Government Reform Committee has launched an investigation into Wikipedia.

Having recently given comments to one media outlet, I thought I would reproduce them here for the use of Congress and the public.

I am glad that Congress is investigating the use of foreign and U.S. government funds to pay for biased editing on Wikipedia. Last February, I asked President Trump and Elon Musk (when he headed DOGE) to make it a policy that neither federal worker hours nor federal moneys may be used to edit Wikipedia or pay for Wikipedia editing. Musk retweeted the post, which received 35 million views. There is clearly massive support for this sort of investigation.

I would urge Congress not to neglect a problem I have had to deal with often over the years. I regularly hear from famous people who sought to correct their Wikipedia articles, but had great difficulty in doing so. Not a few have sought to sue for defamation by Wikipedia. The problem is that Wikipedia authors are generally anonymous, and the Wikimedia Foundation enjoys Section 230 immunity from such lawsuits. Nor, in general, does the WMF have to reveal the identity of the authors. Who then is the plaintiff supposed to sue? At present, Wikipedia is a veritable engine of defamation.

Essentially, this is a problem created by the current legal situation (meaning Section 230, i.e., 47 U.S.C. § 230), so it is now the responsibility of Congress to address it with appropriate, freedom-respecting legislation.

Congress must also pay close attention to the abundant evidence that the Wikimedia Foundation acts as a publisher.

(1) Former Wikipedia CEO Katherine Maher said that she coordinated with government agencies on “disinformation,” implying that such coordination led to changes on the platform. This means that the nonprofit was not acting as a mere platform.

(2) Wikipedia as a brand is presented as a unified product, rather than a collection of individually signed, piecemeal work by named authors. Qua unified product, its owner and operator must be understood to be the WMF.

(3) Wikipedia curates viewpoints through source blacklists (see the “Perennial sources” list). It makes broad editorial decisions about what constitutes reliable sources, which must be respected by large numbers of participants. The WMF could address the situation, but does not.

(4) The WMF refuses to reveal the identity of its most powerful editors or to override decisions by editors. Given that policy, when torts arise, the owner should be required to take responsibility.

The essential point—which neither Congress nor the WMF may ignore—is that responsibility must fall somewhere. This is a fundamental principle of justice: ubi jus ibi remedium, where there is a right, there is a remedy; so, if there is a tort, the law must provide a way to discover the identity of the defendant. If, for any reason, the law determines that liability cannot be made to fall on the actual author of a defamation, then it must fall on the entity that is responsible for the author’s anonymity. That is a reasonable and narrowly focused principle that justifies a statutory carve-out. This is consistent with how Congress has previously amended Section 230 (i.e., the FOSTA-SESTA exception for sex trafficking platforms) when specific, demonstrable harms are present.

Congress could create a narrow statutory carve-out that addresses Wikipedia’s unique situation. The law might be amended in the following sort of way. If (a) an organization generates in excess of $100 million in revenue; (b) the platform hosts anonymously sourced content; (c) such content is presented as factual and neutral, yet routinely and demonstrably defames members of the public; and (d) the platform refuses to identify key content decision-makers; then the organization should not be entitled to Section 230 immunity. While such a carve-out would have multiple conditions, it is narrowly tailored to handle a generalizable problem that Wikipedia illustrates.