Who should police the web?