Whatever Problem EARN IT Is Trying To Solve, It Doesn't

from the that-seems-like-a-problem dept

I've already talked about the potential 1st Amendment problems with the EARN IT Act and the potential 4th Amendment problems with it as well. But a recent post by Riana Pfefferkorn at Stanford raises an even bigger issue in all of this: what actual problem is EARN IT trying to solve?

This sounds like a simple question with a potentially simple answer, but the reality, once you start to dig in, suggests that either (1) the backers of EARN IT don't actually know, or (2) if they do know, they know what they actually want is unconstitutional.

Supporters of EARN IT will say, simply, the problem they're trying to solve is the prevalence of child sexual abuse material (CSAM) online. And, that is a real problem (unlike some other moral panics, CSAM is a legitimate, large, and extraordinarily serious problem). But... CSAM is already very, very illegal. So, if you dig in a little further, supporters of EARN IT will say that the problem they're really trying to solve is that... internet companies don't take CSAM seriously enough. But, the law (18 USC 2258A already has pretty strict requirements for websites to report any CSAM they find to NCMEC (the National Center for Missing & Exploited Children) -- and they do. NCMEC reported that it received almost 21.4 million reports of CSAM from websites. Ironically, many supporters of EARN IT point to these numbers as proof that the websites aren't doing enough, while also saying it proves they don't have any incentive to report -- which makes no sense at all.

So... is the problem that those 21.4 million reports didn't result in the DOJ prosecuting enough abusers? If so... isn't the problem somewhere between NCMEC and the DOJ? Because the DOJ can already prosecute for CSAM and Section 230 doesn't get in the way of that (it does not immunize against federal criminal law). And, as Riana noted in her article, this very same Senate Committee just recently heard about how the FBI actually knew about an actual serial child sex abuser named Larry Nasser, and turned a blind eye.

And, if NCMEC is the problem (namely in that it can't process the reports fast enough), then this bill doesn't help at all there either, because the bill doesn't give NCMEC any more funding. And, if the senators are correct that this bill would increase the reports to NCMEC (though it's not clear why that would work), wouldn't that just make it even more difficult for NCMEC to sort through the reports and alert law enforcement?

So... is the problem that companies aren't reporting enough CSAM? If you read the sponsors' myths and facts document, they make this claim -- but, again, the law (with really serious penalties) already requires them to report any CSAM. Taking away Section 230 protections won't change that. Reading between the lines of the "myths and facts" document, they seem to really be saying that the problem is that not every internet service proactively scans every bit of content, but as we've discussed that can't be the problem, because if that is the problem, EARN IT has a massive 4th Amendment problem that will enable actual child sex abusers to suppress evidence!

Basically, if you look step by step through the potential problems that supporters of the bill claim it tries to solve, you immediately realize it doesn't actually solve any of them. And, for nearly all of the potential problems, it seems like there's a much more efficient and effective solution which EARN IT does not do. Riana's post has a handy dandy table walking down each of these paths, but I wanted to make it even clearer, and felt that a table isn't the best way to walk through this. So here is her chart, rewritten (all credit to her brilliant work):

If online services don't report CSAM in violation of 2258A, and the real problem is large-scale, widespread, pervasive noncompliance by numerous providers that knowingly host CSAM without removing or reporting it (NOT just occasional isolated incidents), then there's a very long list of potential remedies:

• Conduct a congressional investigation to determine the extent of the problem
• Hold a hearing to ask DOJ why it has never once brought a 2258A prosecution
• DOJ prosecutes all those providers for illegally hosting CSAM under 2252A as well as violating 2258A’s reporting requirements
• Amend 2258A(e) to increase penalties for noncompliance
• Amend Dodd-Frank to include 2258A compliance in corporate disclosure requirements (akin to Form SD)
• Encourage FTC investigation of noncompliant companies for unfair or deceptive business practices
• Encourage private plaintiffs to file securities-fraud class actions against publicly-traded providers for misleading investors by secretly violating federal reporting duties

If that's the actual problem (which supporters imply, but when you try to get them to say it outright they hem and haw and won't admit it), then it seems like any of the above list would actually be helpful here. And the real question we should be asking is why hasn't the DOJ done anything here?

But what does EARN IT actually do?

• Amend Section 230 instead of enforcing existing law
• Don’t demand that DOJ explain why they aren’t doing their job

Okay, so maybe the supporters will say (as they sometimes admit) that most web sites out there actually do report CSAM under 2258A, but there are still some providers who don't report it and these are occasional, isolated instances of failure to report by multiple providers, OR repeated failure to report by a particular rogue provider (NOT a large-scale problem across the whole tech industry). If anything, that seems more probably than the first version, which doesn't seem to be reported by any facts. However, here again, there are a bunch of tools in the regulator's tool box to deal with this problem:

• Conduct a congressional investigation to determine the extent of the problem
• Hold a hearing to ask DOJ why it has never once brought a 2258A prosecution
• DOJ prosecutes those isolated violations or the particular rogue provider

Again, what it comes down to in this scenario is that the DOJ is not doing it's job. The law is on the books, and the penalties can be pretty stiff (first failure to report is $150,000 and each subsequent failure is another $300,000). If it's true that providers are not doing enough here, such penalties would add up to quite a lot and the question again should be why isn't the DOJ enforcing the law?

But instead of exploring that, here's what EARN IT actually does:

• Amend Section 230 instead of enforcing existing law
• Don’t demand that DOJ explain why they aren’t doing their job

Okay, so next up, Riana points out that maybe it's possible that the DOJ does regular investigations of websites failing to report CSAM in violation of 2258A, but those investigations are consistently resolved without charges or fines and do not become public. Then, there's a pretty simple option for Congress:

• Hold hearings to have DOJ explain why their investigations never result in charges

But, instead, here's what Congress is doing with EARN IT (stop me if you've heard this one before):

• Amend Section 230 instead of enforcing existing law
• Don’t demand that DOJ explain why they aren’t doing their job

Okay, okay, so maybe the reality is that the DOJ does in fact criminally prosecute websites for 2258A violations, but the reason there is no public record of any such prosecution ever is that all such court records are under seal. This would be... odd, first of all, given that the DOJ loves to publicize prosecutions, especially over CSAM. But, again, here's what Congress could do:

• Tell DOJ to move for courts to unseal all sealed records in 2258A cases
• Require DOJ to report data on all 2258A prosecutions since 2258A’s enactment
• Amend 2258A to require regular reporting to Congress by DOJ of enforcement statistics
• Investigate whether providers (especially publicly-traded ones) kept 2258A fines a secret

But, instead, here's what EARN IT does:

• Amend Section 230 instead of enforcing existing law
• Don’t demand that DOJ reveal to Congress its 2258A enforcement details

So, maybe the real problem is simply that the DOJ seems to be ignoring any effort to enforce violations of 2258A. If that's the case, Congress has tools in its toolbox:

• Hold a hearing to ask DOJ why it has never once brought a 2258A prosecution
• Amend 2258A by adding a private right of action so that victims can do the work that DOJ isn’t doing

Instead, EARN IT...

• Amend Section 230 instead of enforcing existing law
• Don’t demand that DOJ explain why they aren’t doing their job

So... that's basically all the possible permutations if the problem is -- as some supporters claim repeatedly -- that companies are regularly violating 2258A and not reporting CSAM that they find. And, in almost every case, the real questions then should be why isn't the DOJ enforcing the law? And there are lots of ways that Congress should deal with that. But EARN IT does literally none of them.

About the only thing that supporters of EARN IT have claimed in response to this point is that, because EARN IT allows for state AGs and civil suits, it is "adding more cops to the beat" to take on failures to report under 2258A. But... that's kinda weird. Because wouldn't it make a hell of a lot more sense to first find out why the existing cops don't bother? Because no one has done that. And, worse, when it comes to the civil suits, this response basically means "the DOJ doesn't care to help victims of CSAM, so we're leaving it up to them to take matters into their own hands." And that doesn't seem like a reasonable solution no matter how you look at it.

If anything, it looks like Congress putting the burden for the DOJ's perpetual failings... on the victims of CSAM. Yikes!

Of course, there are other possible problems here as well, and Riana details them in the chart. In these cases, the problems aren't with failure to report CSAM, but elsewhere in the process. So... if websites do properly report CSAM to NCMEC's CyberTipline, perhaps the problem is that CSAM isn’t being taken down promptly enough or reported to NCMEC “as soon as reasonably possible” as required by 2258A(a)(1)(A)(i).

Well, then, as Riana notes, there are a few things Congress could do:

• Debate whether to insert a firm timeframe into 2258A(a)(1)(A)(i)
• Hold a hearing to ask ICS providers of various sizes why delays happen and whether a specific timeframe is feasible

Instead, what EARN IT actually does is...

• Amend Section 230

Okay, so if companies are reporting to NCMEC in compliance with 2258A, perhaps the problem is the volume of reports is so high that NCMEC is overwhelmed.

Well, then, the possible solutions from Congress would seem to be:

• Hold a hearing to ask NCMEC what it would take to process all the reports they already get
• Appropriate those additional resources to NCMEC

But, what EARN IT does is...

• Amend Section 230 to induce providers to make even more reports NCMEC can’t keep up with
• Give zero additional resources to NCMEC

Okay, so maybe the websites do properly report CSAM to NCMEC, and NCMEC is able to properly alert the DOJ to the CSAM such that the DOJ should be able to go prosecute the actual abusers, but the DOJ doesn’t act on the reports providers make, and doesn’t make its own mandatory reports to Congress about internet crimes against children. That would be horrifying, but again, it would seem like there's a pretty clear course of action for Congress:

• Order GAO to conduct a study on what happens to CyberTips passed by NCMEC to DOJ
• Hold a hearing to ask DOJ why it isn’t acting on tips or filing its required reports
• Appropriate additional resources to DOJ

All of those would help, if this is the problem, but instead, here's what EARN IT actually does:

• Earmark $1 million for IT improvements
• Don’t demand that DOJ explain why they aren’t doing their job

You might sense a pattern here.

And finally, perhaps websites do report CSAM in compliance with 2258A to NCMEC's CyberTipline, and maybe NCMEC does relay important information to the DOJ... and horrifyingly, perhaps federal law enforcement is failing child sex abuse victims just as the FBI turned a blind eye to Larry Nassar’s abuse of dozens of child gymnasts for years.

Well, then it seems fairly obvious what Congress should do:

• Hold a hearing on the FBI’s failure to protect children (this did happen in September 2021)

But here's what EARN IT does in that situation:

• Amend Section 230, effectively delegating enforcement for child sexual abuse to states and victims themselves

As Riana summarizes:

No matter what the problem with online CSAM is, EARN IT isn’t going to fix it. It’s only going to make things worse, both for child victims and for everyone who uses the internet. The truth about EARN IT is that either there isn’t a serious noncompliance problem among providers that’s pervasive enough to merit a new law, but Congress just can’t resist using Section 230 as a political punching bag to harm all internet users in the name of sticking it to Big Tech… or there is a problem, but the DOJ is asleep at the wheel – and EARN IT is a concession that Congress no longer expects them to do their jobs.

Either option should be shameful and embarrassing for the bill’s supporters to admit. Instead, this horrible legislation, if it passes, will be hailed as a bipartisan victory that shows Congress can still come together across the aisle to get things done. Apparently, harming Americans’ rights online while making CSAM prosecutions harder is something both parties can agree on, even in an election year.

So, whatever problem the backers of EARN IT think they're solving for, EARN IT doesn't do it. That seems like it should be a big fucking deal. But, instead of responding to these points, the sponsors claim that people highlighting this "don't care about CSAM."

Filed Under: 2258a, csam, doj, earn it, encryption, fbi, reporting, surveillance
Companies: ncmec

Senator Graham Spreads A Bunch Of Nonsense About 'Protecting Digital Innocence' Online

from the moral-panics dept

We warned last week that Senator Lindsey Graham was holding a "but think of the children online" moral panic hearing. Indeed, it happened. You can watch the whole 2 hours, but... I wouldn't recommend it (I did it for you, though). Most of it is the usual moral panic, technologically illiterate nonsense we've all come to expect from Congress. Indeed, in a bit of good timing, the Pessimist's Archive just tweeted out a clip of a 1993 Senate hearing in which then Senator Joe Lieberman flipped out about evil video games. Think about this, but two hours, and a wider array of nonsense:

It starts out with a prosecutor from South Carolina, Duffie Stone, moral panicking about basically everything. Encryption is evil. Children are being sex trafficked online. And, um, gangs are recruiting members with (gasp) music videos. Later he complains that some of those kids (gasp!) mock law enforcement in their videos. Something must be done! The second speaker, a law professor, Angela Campell, claims that we need more laws "for the children!" She also goes further and says that the FTC should go after Google and others for not magically stopping scammy companies from existing. Then there was this guy, Christopher McKenna, from an organization ("Protect Young Eyes!") dedicated to moral panics, telling all sorts of unbelievable anecdotes about evil predators stalking young people on Instagram and "grooming" them. Remember, that actual data on this kind of activity shows that it's actually quite rare (not zero, and that's not excusing it when it does happen, but the speaker makes it sound like every young girl on Instagram is likely to be at risk of sex trafficking). He also asks the government to require an MPAA/ESRB-style "rating" system for apps -- apparently unaware that laws attempting to require such ratings have been struck down as unconstitutional, and the MPAA/ESRB ratings only exist through voluntary agreements.

There's also... um... this:

It's the app where every kid, regardless of age, has access to the Discover News section, where they are taught how to engage in risky sexual behavior, such as hookup, group, anal, or torture sex, how to sell drugs, and how to hide internet activity from parents using "incognito mode."

He's describing Snapchat. I've used Snapchat for years and, uh, I've never come across any of that. Also, the complaint about incognito mode is... pretty messed up, considering how that's a tool for protecting privacy. This is all straight from the standard moral panic playbook. Also, he claims that Twitter has "hardcore porn and prostitution was everywhere" -- which is also news to me (and I use Twitter a lot). He also whines that VPNs are too easy to get -- and then later whines that it's "too hard" to protect our privacy. Um, hiding VPNs will harm our privacy. It's like a hodge podge of true nonsense.

There was also John Clark from NCMEC -- the National Center for Missing and Exploited Children. NCMEC actually does good work in helping platforms screen out and spot child porn. However, Clark contributes to the scare-mongering about just how awful the internet is. He also flat out lies. At one point during the panel, Senator Ted Cruz asks Clark about FOSTA and what it's done so far. Clark flat out lies and says that FOSTA took down Backpage. This is false. Backpage was taken down and its founders arrested before FOSTA was even signed into law.

The only semi-reasonable panelist was the last one, Stephen Balkam, from the Family Online Safety Institute. While McKenna mocks the idea that "parents have a role" by pointing out that parents can't watch over their kids every hour of every day (duh), Balkam points out that what we should be doing is not watching over our kids all the time, but rather training them and educating them to know how to be good digital citizens online and to avoid trouble. But that kind of message was basically ignored by the Senators, because what fun is actually respecting our kids and teaching them how to be smart internet users. Instead, most of panel focuses on crazy anecdotes and salacious claims about internet services that make them sounds a hell of lot more insane than any of those platforms actually are.

Later, Senator John Kennedy asks the guy from "Protect Young Eyes" if Apple can build a filter that will magically help parents block kids from ever seeing sexually explicit material. McKenna stumbles and admits he has no idea, leading Balkam to finally have to jump into the conversation (he's the only panelist that no Senator had called on throughout the entire ordeal) to point out that all platforms have some forms of parental controls. But Kennedy cuts him off and says "but can it be done?" Balkam stutters a "yes," which is not accurate -- since Kennedy is asking for something impossible. But then Kennedy suggests that Congress write a law that requires companies like Apple and Google to install filters (something that's already been ruled unconstitutional).

Kennedy's idea is... nutty. He includes the obligatory "I don't know how any of this is done" comment before suggesting a bunch of impossible ideas.

Could Apple, for example, design a program that a parent could opt into, and the instructions to Apple would be "design a program that will filter all information that my daughter or son may see that would be sexually exploitative"? Maybe "filter all pictures or written references to human genitalia." Can that be done? ... Isn't that the short way home here?

[....]

So could we write legislation, or promulgate a rule, that says "here's the thing that a reasonable parent would do to protect his or her child from seeing this stuff." And we do that in conjunction with somebody that has the obvious expertise. And you filter everything. I don't know how to do it. I can't write software. Maybe it's to prevent any pictures of human genitalia. Or prohibit any reference to sexual activity. I don't know. The kids aren't gonna like it, but that's not who we're trying to please here. Why couldn't that be done?

Well, the Constitution is why it can't be done Senator. Also, basic understanding of technology. Or the limits on filter technology. Block all mention of sexual activity? Sure, then kids will use slang. Good luck keeping up with that. Block all pictures of genitalia -- then say good buy to biology texts online. Or pages about breast cancer. This is all stuff that lots of people have studied for decades and Kennedy is displaying his ignorance about the Constitution, the law, the internet, the technology, and just about everything else as well. Including kids.

Balkam points out that there are lots of private companies already making such filters, but Kennedy keeps saying "can we write a law" and "can we require every device have these filters" and Balkam looks panic'd noting he has no idea about whether or not they can write such a law (answer: they cannot, at least not if they want it to pass Constitutional muster).

Senator Blackburn... brings up Jeffrey Epstein. Who, as far as we know... didn't use the internet to prey on girls. But according to Blackburn, Epstein proves the problems of the internet. Because. Senator Hawley then completely makes up a claim that YouTube is deliberately pushing kids to pedophiles and refuses to do anything about it. He claims -- incorrectly -- that Google admitted that it knows it sends videos of kids to pedophiles (and, he claims, allows the pedophiles to contact the kids) and that it deliberately has decided not to stop this. This misrepresents... basically everything once again.

Senator Thom Tillis then grandstands that it's all the parents' fault -- and if a kid gets a mobile phone and lies about his age, we should be... blaming the parents for "giving the kids a lethal device." No hyperbole and grandstanding there, huh? He's also really focused on "lethality." He later claims that the internet content itself is "lethal."

Towards the end, the Senators all gang up on Section 230. Senator Cruz asks his FOSTA question (leading NCMEC's Clark to falsely state that it was necessary to take down Backpage), and then Blumenthal calls 230 "the elephant in the room" and suggests that there needs to be a "duty of care" to get companies to do anything. It seems like Hawley is already gone by this time, but no one seems to point out that any such duty of care would likely lead to much greater censorship on these platforms, in direct contrast with his demand that the companies censor less.

Nevertheless, Senator Graham closes the hearing by saying that he thinks the companies need to "earn" their CDA 230 protections (which is part of Hawley's nonsense bill). Graham suggests that Congress needs to come up with "best business practices" and platforms should only get 230 protections if they "meet those best business practices."

Who knew the Republican Party was all about dictating business standards. What happened to the party of getting government out of business?

Who knows what will actually come out of this hearing, but it was mostly a bunch of ill-informed or mis-informed, technologically illiterate grandstanding, moral panic nonsense. In other words, standard operating procedure for most of Congress.

Filed Under: angela campbell, christopher mckenna, duffie stone, john clark, john kennedy, josh hawley, lindsey graham, moral panic, stephen balkam, ted cruz, think of the children
Companies: facebook, google, ncmec, snapchat

Is Hollywood 'Exploiting' Anti-Trafficking Organization To Support SESTA?

from the not-a-good-look-guys dept

We've been a bit perplexed about how much momentum SESTA has. As explained, it's a bill that is called the "Stop Enabling Sex Traffickers Act" but it has many serious problems that could impact just about any online service, even if they have no idea that they're being used to support sex trafficking. Also, there's some aspect of moral panic to all of this, as the actual statistics suggest that the size of the sex trafficking problem is not nearly as big as many politicians and organizations claim. That's not to say it's not a problem -- because clearly it is a problem, and an important one. But it does suggest that broad-brush solutions with massive consequences to the entire internet should be reviewed a bit more carefully.

Indeed, as we've suggested, the way SESTA is currently structured, there appears to be a high likelihood that it would make the sex trafficking problem worse, by making it prohibitively risky for internet platforms to seek out and report to the authorities evidence of trafficking on their platforms. This is why a whole bunch of experts and organizations focused on stopping sex trafficking have all spoken out against SESTA, saying it's the wrong solution. Freedom Network USA, which works to reduce trafficking around the US made this point clearly:

It is important to note that responsible website administration can make trafficking more visible—which can lead to increased identification. There are many cases of victims being identified online—and little doubt that without this platform, they would have not been identified. Internet sites provide a digital footprint that law enforcement can use to investigate trafficking into the sex trade, and to locate trafficking victims. When websites are shut down, the sex trade is pushed underground and sex trafficking victims are forced into even more dangerous circumstances.

Similarly, the Sex Workers Outreach Project (SWOP) has spoke out against SESTA, calling it a "disguised internet censorship" bill.

The Stop Enabling Sex Trafficking Act or SESTA, S. 1963, however cleverly titled, is not at all what it claims to be. It boasts of being the answer to uncovering and punishing those engaged in sex trafficking online but what it actually is about is internet censorship. It is an attempt to remove the protection websites are currently offered under Section 230 of The Communications Decency Act. Section 230 is in place to uphold freedom of expression on the internet and protects websites from being liable for what a third party might post outside of their knowledge. If this bill passes, any person or business online could be subject to civil or state penalties if the authorities “believe” there is any trafficking or condoning of trafficking on your site. How is that determined? What activities will they consider illegal online? What about consenting adults engaging in sexual online courtship? What about our favorite fetish and cruising sites? What about individuals who enjoy posting nude or nude implied photos of themselves online? Would we then have to be worried about our naked photos being considered illegal solicitation?

But what about the groups supporting the bill? Well, we already looked at one group, that saw SESTA as a stepping stone to banning all porn. But I also wanted to look a little more closely at the National Center for Missing and Exploited Children -- NCMEC. NCMEC has a very good reputation, and the organization has done a lot of really amazing work. While it's a private non-profit, it was created by Congress and gets a ton of government funding. NCMEC has, at times, succumbed to moral panics and exaggerated threats around "stranger danger" and such -- but for the most part, it's a pretty respectable organization.

I was a bit surprised, then, to see its General Counsel, Yiota Souras, as one of the people testifying before Congress about SESTA recently, insisting that the bill is narrowly tailored (it's not) and that it was unlikely to negatively impact most companies online (it would).

But, then another story caught my eye. Recently, the powerhouse DC lobbying firm, American Continental Group, announced that it had signed up a bunch of new clients, including News Corporation, the owner of 20th Century Fox.

American Continental Group has signed another five clients: Cognizant Technology Solutions, Diebold Nixdorf, News Corporation, the Onex Corporation and Textron. The firm has signed more than 30 new clients this year, helped by the reputation of David Urban, a lobbyist there who’s seen as close to Trump’s administration after serving as a senior adviser on Trump’s campaign and helping him win Pennsylvania. (Urban’s name was mentioned as a potential replacement for Reince Priebus as White House chief of staff earlier this year.)

Manus Cooney, Chris Israel and Urban will lobby for News Corporation on intellectual property issues, according to the filing.

The name Manus Cooney stood out to me, because it turns out... he's Chairman of the Board of NCMEC:

And, first of all, good for him. It's good to see that he's on the board of non-profits and helping make the world a better place. But, it at least makes me wonder if there isn't something of a conflict here -- and perhaps one that explains NCMEC's over-enthusiastic support of such a bad bill. Yes, Cooney just took on News Corp as a client, but the firm also basically lists every other big Hollywood/legacy copyright player as a client. Viacom, Time Warner, the Authors Guild, Comcast (owners of NBC Universal), the Copyright Alliance, the Music First Coalition (an RIAA front group), Random House, Reed Elsevier, SoundExchange (an RIAA spinoff), Songwriters Guild of America, and others.

And it's no secret that many of those organizations are supporters of SESTA, some more vocally than others. News Corp's 21st Century Fox has directly come out in support, for example.

Hollywood really wants SESTA to pass for a variety of reasons, nearly all of them focused on its weird visceral hatred of one company: Google. You'll recall, of course, how the Sony Pictures hack a few years back revealed the existence of Project Goliath -- in which the various Hollywood studios colluded to try to support doing anything to harm Google. The key part of the Project Goliath strategy was to convinced state Attorneys' General to target Google for basically anything bad found on the internet. Its first "success" story was getting Mississippi Attorney General Jim Hood to subpoena Google and claim it was responsible for all the bad stuff people found on Google -- including counterfeit pharmaceuticals, sex trafficking and, of course, copyright infringement.

It was, of course, later revealed that the letter that Hood sent to Google had actually been authored by the MPAA's outside lawyers. Google pushed back against all of this, and a judge told Hood that nearly all of his attack was barred by CDA 230 (it also noted that the subpoena appeared to have been done in "bad faith.")

Now, let's pull all of this together: a big part of Hollywood's plan to handicap Google was to allow state Attorneys General to attack Google for bad stuff that people could find via Google. That flopped, in large part because of CDA 230, which protects sites from the actions of third parties. Now, along comes SESTA, whose entire point is to punch a giant hole in CDA 230, such that if a site is used to "facilitate" trafficking, the site suddenly loses its immunity. Another key point in SESTA: saying that claims brought by states Attorneys General are no longer immune from action under CDA 230. Hmmmmmm...

And, then, suddenly we have NCMEC step up to make clearly misleading to downright false statements in support of SESTA at the very same time that NCMEC's chairman of the board is pushing to get a lobbying deal with News Corp. -- one of the leaders of the anti-Google effort, and it raises at least some questions about whether NCMEC's support of SESTA is really about saving children... or helping Hollywood attack the internet.

Filed Under: cda 230, intermediary liability, jim hood, lobbying, manus cooney, sesta, yiota souras
Companies: american continental group, google, ncmec, news corp.

Court Says Child Porn Clearinghouse Acts As A Government Entity, Cannot Perform 'Private Searches'

from the gentlemen,-start-your-affidavits dept

A recent decision by the Tenth Circuit Court of Appeals reaches two conclusions: one obvious, and one not quite so obvious.

The defendant, Walter Ackerman, appealed the district court's denial of his motion to suppress evidence obtained through a warrantless search of his email. Unsurprisingly, the court finds [PDF] that the content of his emails are subject to Fourth Amendment protections. More surprisingly (and apparently to the government's complete surprise), it finds a private entity to be a government entity -- one unable to perform "private searches." (via FourthAmendment.com)

First, some background. Ackerman's AOL email account was flagged by the service provider when messages containing hashes known to be related to child porn images were discovered. AOL turned over the flagged email to the National Center for Missing and Exploited Children (NCMEC) as it is required to do by federal statute. NCMEC is the clearinghouse for any suspected child porn discovered by ISPs and works directly with law enforcement to locate suspects.

NCMEC is not a government entity. It is a nonprofit started and run (for the most part) by private citizens. However, it has additional duties imposed on it by Congress -- a total of "22 programs and services to assist law enforcement." The opinion details the close relationship NCMEC enjoys with the government, including the fact that 75% of its funding comes from the federal government and a number of government officials sit on its board. It also details the mandates Congress has handed to it, which require it to do exactly what it did in this case: confirm that flagged images were child porn and alert authorities.

Here we know Congress statutorily required AOL to forward Mr. Ackerman’s email to NCMEC; Congress statutorily required NCMEC to maintain the CyberTipline to receive emails like Mr. Ackerman’s; Congress statutorily permitted NCMEC to review Mr. Ackerman’s email and attachments; and Congress statutorily required NCMEC to pass along a report about Mr. Ackerman’s activities to law enforcement authorities. All at the government’s expense and backed by threat of sanction should AOL have failed to cooperate. All with special dispensation, too, to NCMEC to possess and review contraband knowingly and intentionally. This comprehensive statutory structure seems more than enough to suggest both congressional knowledge of and acquiescence in the possibility that NCMEC would do exactly as it did here.

NCMEC is also allowed to do something private citizens can't: retain and view child porn. While private citizens can come across child porn, preserve the evidence, and turn it over to law enforcement, they can't maintain a private database of images for cross reference like NCMEC does.

The government tried to argue that NCMEC's search of email given to it by AOL was a "private search," and therefore not subject to the Fourth Amendment. Private searches can be performed by almost anyone and these searches can sometimes be duplicated by a government agency without the need for a warrant.

AOL's hash-matching was a form of a private search, albeit a very cursory one that did not access the email's entire contents. It's somewhat the equivalent of a repair shop finding child porn while repairing a computer. In this case, AOL was required to give that information to NCMEC by federal law. NCMEC was required -- again by federal law -- to examine the images and determine the owner of the email account.

It's the insertion of federal law -- along with several other factors -- that turns a private nonprofit into a government agent. If NCMEC had done nothing more than confirmed the single image hash matched hashes in its database, it likely would have steered clear of this issue. But it opened the email and accessed three other attached images. A government agent can duplicate a private search without implicating the Fourth Amendment, but it has to remain within the confines of the original search. NCMEC's search went further than AOL's "private search" -- which only confirmed that one image matched hashes in the child porn database.

The government wanted to salvage the not-so-private search, but seemed completely confident that the appeals court would find in its favor. That's the only explanation for its lack of counterarguments when litigating on appeal. The appeals court, however, isn't obliged to make the government's arguments for it.

In the face of so much law and evidence suggesting NCMEC qualifies as a governmental entity, the government offers almost no reply. In fact, its only response is to question whether the question is properly before us.

[...]

Seeing the void left by the government, NCMEC offers a number of substantive responses to Mr. Ackerman’s entity theory in its own amicus brief. But ours is a party-directed adversarial system and we normally limit ourselves to the arguments the parties before us choose to present. Amici briefs often serve valuable functions, but those functions don’t include presenting arguments forgone by the parties themselves or effectively and unilaterally expanding the word limits established by rule for a favored party.

The NCMEC is a government entity for the purposes of investigating child porn tips. Even if it were to be considered a private entity, law enforcement would need a warrant to duplicate the searches it performs because NCMEC's investigative work goes beyond simply confirming hashes already flagged by ISPs. The government is not allowed to use private agencies to bypass warrant requirements. NCMEC can still do what it's statutorily required to do without violating the Fourth Amendment, but if law enforcement wishes to avail itself of the evidence the clearinghouse has obtained, it will need to obtain a warrant. The contents of the email accessed by NCMEC are protected by the Fourth Amendment.

No one in this appeal disputes that an email is a “paper” or “effect” for Fourth Amendment purposes, a form of communication capable of storing all sorts of private and personal details, from correspondence to images, video or audio files, and so much more.

[...]

Given the uncertain status of Jacobsen after Jones, we cannot see how we might ignore Jones’s potential impact on our case. And its impact here seems even clearer than in Jacobsen. After all, we are not dealing with a governmental drug test that destroyed but a trace amount of potential contraband. We are dealing instead with the warrantless opening and examination of (presumptively) private correspondence that could have contained much besides potential contraband for all anyone knew. And that seems pretty clearly to qualify as exactly the type of trespass to chattels that the framers sought to prevent when they adopted the Fourth Amendment.

[...]

So it seems that, whether we analyze the “search” question through the lens of the government’s preferred authority — Jacobsen and Katz — or through the lens of the traditional trespass test suggested by Jones, they yield the same (and pretty intuitive) result: NCMEC conducted a “search” when it opened and examined Mr. Ackerman’s email.

The court notes that this finding does not immediately preclude the government from successfully battling the suppression motion on remand. There are a host of questions not answered here, mainly because the government decided not to raise them.

Surely hard questions remain to be resolved on remand, not least the question whether the third-party doctrine might preclude Mr. Ackerman’s claim to the Fourth Amendment’s application, a question the government has preserved and the district court and we have reserved. But about one thing we can be very certain. There can be no doubt that NCMEC does important work and that its work can continue without interruption. After all, it could be that the third-party doctrine will preclude motions to suppress like Mr. Ackerman’s. Or that changes in how reports are submitted or reviewed might allow NCMEC to access attachments with matching hash values directly, without reviewing email correspondence or other attachments with possibly private, noncontraband content — and in this way perhaps bring the government closer to a successful invocation of the private search doctrine. Or it may be possible that the government could cite exigent circumstances or attenuation doctrine or special needs doctrine or the good faith exception to excuse warrantless searches or avoid suppression in at least some cases.

But, it goes on to state, this doesn't mean the government should continue to consider NCMEC as operating outside of the confines of the Fourth Amendment and using the nonprofit's statutory mandates to skirt warrant requirements. Given the nature of the NCMEC's investigative work, there should be little standing between law enforcement officers and the proper permission to view NCMEC's collected evidence.

[E]ven if not a single one of these potential scenarios plays out — and we do not mean to prejudge any of them — we are confident that NCMEC’s law enforcement partners will struggle not at all to obtain warrants to open emails when the facts in hand suggest, as they surely did here, that a crime against a child has taken place.

The case goes back to the lower court to discuss the defendant's motion to suppress. No evidence has been suppressed at this moment because the district court never gave Ackerman the opportunity to present a motion, due to its acceptance of the government's "private search" theory.

It's certainly an interesting decision as there appears to be little precedent for this conclusion. The NCMEC has been an integral part in the fight against child pornography -- so much so that the federal government has drafted it into service, funds it, and sits on its board of directors. This close relationship has its benefits for the clearinghouse, but -- at least in this circuit -- it can no longer act on behalf of the government while simultaneously being used by the government as a "private" party for searches.

Filed Under: 10th circuit, 4th amendment, child porn, ncmec, searches
Companies: ncmec