Senators' 'Myths & Facts' About EARN IT Is Mostly Myths, Not Facts

from the they're-lying-to-you dept

I already wrote a long post earlier about the very very real problems with the EARN IT Act -- namely that it would make the problem of child sexual abuse material significantly worse by repeating the failed FOSTA playbook, and that it would attack encryption by making it potential "evidence" in a case against a tech company for any CSAM on its site. But with the bill, the sponsors of the bill, Senators Richard Blumenthal and Lindsey Graham, released a "Myth v. Fact" document to try to counter the criticisms of EARN IT. Unfortunately, the document presents an awful lot of "myths" as "facts." And that's a real problem.

The document starts out noting, correctly:

The reporting of CSAM and online child sexual exploitation provides law enforcement with vital information on active predators and ongoing cases of rape and abuse.

More reports, and more accurate information within those reports, means more children freed from one of the most horrific and life-changing crimes imaginable.

But it ignores that taking away Section 230 protections doesn't magically make them do more reporting. It does the opposite. Because now making the effort to find and report CSAM actually puts you at risk of greater liability under EARN IT. The bill literally creates less incentive for a website to build systems to find and report CSAM because merely doing so gives you the knowledge (scienter) necessary under the law to face liability. The bill gets this all exactly backwards.

The document then has the following listed as a "myth":

Given that some tech companies report significant amounts of CSAM to the National Center for Missing and Exploited Children (NCMEC) and provide technical resources to address child exploitation, the tech industry is doing enough to address this crime.

To address it, it lists these facts:

For tech companies that are already taking clear steps to report CSAM, little will change under this bill.

Except, that's not true at all. Because now, if those companies make any mistakes -- which they will because you can't get everything right -- they face potentially crippling liability. The idea that no one will go after them because they report a lot of CSAM is completely divorced from reality. We see companies getting sued all the time in similar circumstances. Under FOSTA now we're seeing companies like Salesforce and Mailchimp being sued because other companies used their services and then sex traffickers used those other services, and somehow that magically makes Salesforce and Mailchimp liable. The same thing would happen under EARN IT.

According to NCMEC’s 2020 statistics on reports of the online exploitation of children, while Facebook issued over 20 million reports that year, in contrast Amazon (which hosts a significant percentage of global commerce and web infrastructure) reported 2,235 cases.

Maybe that's because Facebook is a user-generated content social media platform and Amazon... is not? I mean, I don't even need to say this is "comparing apples to oranges" here because it's "comparing Facebook to Amazon." The two companies do very, very different things that are simply not comparable.

Of course, the underlying (and pretty fucking scary) suggestion here is that Amazon should be scanning every AWS instance for bad stuff, which raises really serious privacy concerns. It's amazing that the very same Senators pushing this bill, which now they're basically saying should require websites to spy on everything, will turn around next week and argue that these companies are "collecting too much information" and are engaged in "surveillance capitalism."

So which is it, Senators? Should Amazon be spying on everyone, or are they not spying hard enough?

There is a sustained problem of underreporting and neglect of legal obligations by some tech companies. During a Senate Judiciary Committee hearing on the EARN IT Act, NCMEC disclosed that it had reported nearly nine times more cases of CSAM material hosted on Amazon to Amazon, than Amazon had found itself, and that Amazon had not taken legally required action on those cases.

Again, this is taken incredibly out of context, and when put back into context means that Amazon isn't spying on all their customers' data. That should be seen as a good thing? Note what this "fact" doesn't say: when Amazon was alerted to CSAM by NCMEC did it remove it? Did it add hashes to the NCMEC database? Because that's what matters here. Otherwise, these Senators are just admitting that they want more surveillance by private companies and less privacy for the public.

Before introducing the EARN IT Act, a bipartisan group of Senators sent detailed questions to more than thirty of the most prominent tech companies. The responses showed that even startups and small firms were willing and able to build safety into their platform using automated tools. Meanwhile, some large companies like Amazon admitted that they were not even using common and free tools to automatically stop CSAM despite substantial and known abuse of their platforms by predators.

They're really throwing Amazon under the bus here. But this "fact" again demonstrates that most internet companies that host user generated content are already doing what is appropriate and finding, reporting, and removing CSAM. The only example they have of a company that is not is Amazon, and that's because Amazon is in a totally different business. They're not a platform for user generated content, they're just a giant computer for other services. Those other services, built on top of Amazon, can (and do!) scan their own systems for CSAM.

This whole "fact" list is basically a category error, in which they lump Amazon in with other companies because whoever wrote this can't find any actual problem out there with actual social media companies.

It is clear that many tech companies will only take CSAM seriously when it becomes their financial interest to do so, and the way to make that a reality is by permitting survivors and state law enforcement to take the companies to court for their role in child exploitation and abuse.

Except this document's own fact check said that every company they asked was doing what was necessary. And, it already is very much in every company's "financial interest" to find, report, and remove CSAM because if you don't you already face significant legal consequences, since hosting CSAM is already very, very much illegal.

The next "myth" listed is:

This bill opens up tech companies to new and unimaginable liability that necessitated CDA Section 230’s unqualified immunities two decades ago

Which is... absolutely true. And we don't need to look any further than what happened with FOSTA to see that this is true. But the Senators deny it. Because they're lying.

The EARN IT Act creates a targeted carve out for the specific, illegal act of possession or distribution of child sexual abuse material.

And FOSTA created "a targeted carve out for the specific, illegal act of human trafficking" but in practice has resulted in a series of totally frivolous lawsuits against ancillary services used by a company that was then used by sex traffickers.

Any tech company that is concerned that its services or applications could be used to distribute CSAM has plenty of tools and options available to prevent this crime without hindering their operations or creating significant costs.

The detection, prevention, and reporting of CSAM is one of the most easily addressed abuses and crimes in the digital era. There are readily accessible, and often free, software and cloud services, such as PhotoDNA, to automate the detection of known CSAM material and report it to NCMEC.

The naming of PhotoDNA is interesting here. It's a Microsoft project (big tech!) that is very important in finding/reporting/removing CSAM. But Microsoft actually limits who can use it, and I've heard of multiple websites that were not allowed to use PhotoDNA. I don't think Techdirt would qualify to use PhotoDNA, for example. In the meantime, Cloudflare actually introduced its own tool that I think came about because Microsoft made it difficult to impossible for many websites to use PhotoDNA.

But just the fact that PhotoDNA and Cloudflare's solution exist and are being used again suggests that "the problem" here doesn't actually exist. As noted in the first post, we don't see companies being sued for CSAM and using Section 230 as a defense, because that's not the problem.

Also, left out of the "fact" is the actual "fact" that PhotoDNA has very real limitations. That article, published a few months ago, notes that (1) Microsoft and NCMEC seem to go out of their way to avoid allowing researchers to study PhotoDNA, (2) contrary to Microsoft/NCMEC claims, the algorithm is able to be reversed (i.e., enabling users to recreate CSAM images from hashes!) (3) it is easily defeatable with minor changes to images and (4) it is subject to false positives. In other words, while PhotoDNA is an important tool for fighting CSAM, it has real problems, and mandating it (as this "fact" suggests is the goal of EARN IT) could create significant (and potentially dangerous) consequences.

The next "myth" is... just weird.

Requiring companies to be on the lookout for child abuse will harm startups and nascent businesses.

No one has made that argument. The actual argument is that adding very serious liability for anyone making any mistake as they're on the lookout for child abuse will do tremendous harm to startups and nascent businesses.

No other type of business in the country is provided such blanket and unqualified immunity for sexual crimes against children.

Except... tech companies aren't given a "blanket and unqualified immunity for sexual crimes against children." This "fact" is just wrong. What Section 230 does it provide immunity for third party speech -- but not if federal crimes are involved, which is certainly the case with CSAM. The whole attempt to blame Section 230 here is just weird. And wrong.

Startups and small businesses have a critical role in the fight against online CSAM. Smaller social media sites and messaging applications, such as Kik Messenger, are routinely used by abusers. The EARN IT Act will ensure that abusers do not flock to small platforms to evade the protections and accountability put in place on larger platforms.

So, now we're blaming Kik? Okay. Except the timing on this is interesting, as just a few days ago the DOJ literally announced that it had arrested a woman for distributing CSAM on Kik, showing again that when law enforcement actually bothers to do so, it can find and arrest those responsible.

Moreover, there are simple, readily accessible, and often free, software and cloud services, such as PhotoDNA, that can be used by any tech company to automate the detection of known CSAM material and report it to NCMEC.

Again, PhotoDNA involves a "qualification" process, and has significant problems. If the point of this bill is to force every website to use PhotoDNA, write that into the law and deal with the fact that a mandated filter raises other Constitutional concerns. Instead, these Senators are basically saying "every website must use PhotoDNA, but we can't legally say that, so wink, wink."

Indeed, it's pretty funny that right after more or less admitting that they're demanding mandatory filters, they claim this is the next "myth":

The EARN IT Act violates the First Amendment.

The "fact" they used to reply to this kinda gives away the game:

Child sexual abuse is not protected speech. Possession of child pornography is a criminal violation and there is no defensible claim that the First Amendment protects child sexual abuse material.

That's correct, but... misleading. No one is concerned about taking down CSAM (again, pretty much every major internet platform already does this as it's already required by law). The concern is that by mandating filters that are not publicly reviewable, you end up taking down other speech. And that other speech may be protected. Again, look at the link above regarding research into PhotoDNA, which suggests that the "false positive" problem with PhotoDNA is very, very real.

And then we get to the encryption stuff with the next "myth":

The EARN IT Act is simply an attempt to ban encryption.

Actually, it seems to be only partially an attempt to ban encryption. The Senators' "facts" on this is just... again, the part that is actually mythical:

The EARN IT Act does not target, limit, or create liability for encryption or privacy services. In fact, in order to ensure the EARN IT Act would not be misconstrued as limiting encryption, specific protections were included in the bill to explicitly state that a court should not consider offering encryption or privacy services as an independent basis for legal liability.

Weasel words. Again, see what I wrote in the last post about the encryption section. It says it can't be the "independent basis" for liability, but it explicitly states that the use of encryption can still be used as evidence against a website under this law. So it very much increases the legal liability for any website that uses encryption, because it will be used against them in court.

Stopping the abuse of children is not at odds with preserving online privacy. Some online platforms have been using automated tools to check images and videos against CSAM databases for more than a decade without endangering privacy or creating consumer concerns. As Facebook has testified to the Senate Judiciary Committee, tech companies can readily implement tools to detect child sexual abuse while offering strong encryption tools.

This is correct, but does not address the point. Of course, you can fight CSAM while preserving privacy, but this bill makes that much more difficult by adding liability risk to anyone who uses encryption (and anyone who tries to go above and beyond in fighting CSAM, but some slips through).

Then there's a "myth" that's actually a fact. Section 230 exempts federal crimes, and CSAM is a federal crime -- and the real issue is that law enforcement tends not to spend much time and resources on fighting the actual creators and distributors of CSAM:

Since CDA 230 already exempts federal crimes, the solution to this problem is increasing resources for law enforcement and hiring more federal prosecutors.

The "facts" the Senators present in response are incredibly misleading.

We support increasing resources for law enforcement officials fighting sex crimes against children. But no amount of money can compensate for the disengagement of the online platforms actually hosting this material.

That second sentence is a non sequitur, since (again...) EARN IT doesn't do anything to stop sites from hosting CSAM. It just opens them up to being sued for trying to stop it!

Hiring more federal investigators cannot replace having companies committed to the fight against child abuse, especially when it comes to monitoring the content posted on online platforms and checking closed groups for abuse.

Again, companies are committed to fighting child abuse, and EARN IT makes it more risky for them to "monitor" the content posted online!

By requiring that only the Department of Justice can bring criminal cases for child sexual exploitation crimes, CDA Section 230 drastically limits the number and types of cases that are brought.

No, it avoids bogus, wasteful lawsuits like the ones that were brought against Salesforce and Mailchimp under FOSTA.

States and survivors have a well-established role in holding offenders accountable, especially with respect to child sexual exploitation, for a reason: under enforcement of child protection laws fails victims and fosters more abuse.

Yes, and they can already hold "offenders accountable" for sexual exploitation. The problem is that this bill distracts from going after actual offenders, and instead blames random internet services that the offenders used for not magically knowing they were being used by offenders.

The EARN Act would ensure that there is more than one cop on the beat by enabling states and civil litigants to seek justice against those who enable child sexual exploitation.

No. It would allow that anyone can go after just about any website for incidental usage by an actual offender, rather than going after the offenders themselves.

This bill is bad and dangerous. It will make the very real problem of CSAM worse and undermine encryption at the same time. This "myth v. fact" sheet reverses the myths and facts in the services of getting bogus "for the children" headlines for Senators desperate to look like they're doing something about a real problem, while they're really moving to make the problem much, much worse.

Filed Under: csam, earn it, encryption, law enforcement, lindsey graham, photodna, richard blumenthal, section 230
Companies: amazon, facebook, kik, microsoft

Senate's New EARN IT Bill Will Make Child Exploitation Problem Worse, Not Better, And Still Attacks Encryption

from the it's-a-bad-bill dept

You may recall the terrible and dangerous EARN IT Act from two years ago, which was a push by Senators Richard Blumenthal and Lindsey Graham to chip away more at Section 230 and to blame tech companies for child sexual abuse material (CSAM). When it was initially introduced, many people noticed that it would undermine both encryption and Section 230 in a single bill. While the supporters of the bill insisted that it wouldn't undermine encryption, the nature of the bill clearly set things up so that you either needed to encrypt everything or to spy on everything. Eventually, the Senators were persuaded to adopt an amendment from Senator Patrick Leahy to more explicitly attempt to exempt encryption from the bill, but it was done in a pretty weak manner. That said, the bill still died.

But, as with 2020, 2022 is an election year, and in an election year some politicians just really want to get their name in headlines about how they're "protecting the children," and Senator Richard Blumenthal loves the fake "protecting the children" limelight more than most other Senators. And thus he has reintroduced the EARN IT Act, claiming (falsely) that it will somehow "hold tech companies responsible for their complicity in sexual abuse and exploitation of children." This is false. It will actually make it more difficult to stop child sexual abuse, but we'll get there. You can read the bill text here, and note that it is nearly identical to the version that came out of the 2020 markup process with the Leahy Amendment, with a few very minor tweaks. The bill has a lot of big name Senators as co-sponsors, and that's from both parties, suggesting that this bill has a very real chance of becoming law. And that would be dangerous.

If you want to know just how bad the bill is, I found out about the re-introduction of the bill -- before it was announced anywhere else -- via a press release sent to me by NCOSE, formerly "morality in media," the busybody organization of prudes who believe that all pornography should be banned. NCOSE was also a driving force behind FOSTA -- the dangerous law with many similarities to EARN IT that (as we predicted) did nothing to stop sex trafficking, and plenty of things to increase the problem of sex trafficking, while putting women in danger and making it more difficult for the police to actually stop trafficking.

Amusingly (?!?) NCOSE's press release tells me both that without EARN IT tech platforms "have no incentive to prevent" CSAM, and that in 2019 tech platforms reported 70 million CSAM images to NCMEC. They use the former to insist that the law is needed, and the latter to suggest that the problem is obviously out of control -- apparently missing the fact that the latter actually shows how the platforms are doing everything they can to stop CSAM on their platforms (and others!) by following existing laws and reporting it to NCMEC where it can be put into a hash database and shared and blocked elsewhere.

But facts are not what's important here. Emotions, headlines, and votes in November are.

Speaking of the lack of facts necessary, with the bill, they also have a "myth v. fact" sheet which is just chock full of misleading and simply incorrect nonsense. I'll break that down in a separate post, but just as one key example, the document really leans heavily on the fact that Amazon sends a lot fewer reports of CSAM to NCMEC than Facebook does. But, if you think for more than 3 seconds about it (and aren't just grandstanding for headlines) you might notice that Facebook is a social media site and Amazon is not. It's comparing two totally different types of services.

However, for this post I want to focus on the key problems of EARN IT. In the very original version of EARN IT, the bill created a committee to study if exempting CSAM from Section 230 would help stop CSAM. Then it shifted to the same form it's in now where the committee still exists, but they skip the part where the committee has to determine if chipping away at 230 will help, and just includes that as a key part of the bill. The 230 part mimics FOSTA (again which has completely failed to do what it claimed and has made the actual problems worse), in that it adds a new exemption to Section 230 that exempts any CSAM from Section 230.

EARN IT will make the CSAM problem much, much worse.

At least in the FOSTA case, supporters could (incorrectly and misleadingly, as it turned out) point to Backpage as an example of a site that had been sued for trafficking and used Section 230 to block the lawsuit. But here... there's nothing. There really aren't* examples of websites using Section 230 to try to block claims of child sexual abuse material*. So it's not even clear what problem these Senators think they're solving (unless the problem is "not enough headlines during an election year about how I'm protecting the children.")

* Update: After publishing this story, a lawyer pointed out a couple of examples of cases, so I'll qualify the original statement to say there really aren't any credible examples of cases where Section 230 blocked legitimate complaints. The main example the lawyer sent over was a case we had written about just a week earlier regarding a clear nuisance lawsuit against Omegle, in which someone was trying to sue the company because creepy people used the site. This is actually a perfect example of why Section 230 is so important, because it kills such nuisance suits quickly. Without it, the range of internet services would be greatly diminished. Another case involves a recent one against Twitter, which again actually demonstrates the importance and benefits of Section 230, in that people are trying to hold Twitter responsible for the actions of users, rather than going after the actual perpetrators.

The best they can say is that companies need the threat of law to report and takedown CSAM. Except, again, pretty much every major website that hosts user content already does this. This is why groups like NCOSE can trumpet "70 million CSAM images" being reported to NCMEC. Because all of the major internet companies actually do what they're supposed to do.

And here's where we get into one of the many reasons this bill is so dangerous. It totally misunderstands how Section 230 works, and in doing so (as with FOSTA) it is likely to make the very real problem of CSAM worse, not better. Section 230 gives companies the flexibility to try different approaches to dealing with various content moderation challenges. It allows for greater and greater experimentation and adjustments as they learn what works -- without fear of liability for any "failure." Removing Section 230 protections does the opposite. It says if you do anything, you may face crippling legal liability. This actually makes companies less willing to do anything that involves trying to seek out, take down, and report CSAM because of the greatly increased liability that comes with admitting that there is CSAM on your platform to search for and deal with.

EARN IT gets the problem exactly backwards. It disincentivizes action by companies, because the vast majority of actions will actually increase rather than decrease liability. As Eric Goldman wrote two years ago, this version of EARN IT doesn't penalize companies for CSAM, it penalizes them for (1) not magically making all CSAM disappear, for (2) knowing too much about CSAM (i.e., telling them to stop looking for it and taking it down) or (3) not exiting the industry altogether (as we saw a bunch of dating sites do post FOSTA).

EARN IT is based on the extremely faulty assumption that internet companies don't care about CSAM and need more incentive to do so, rather than the real problem, which is that CSAM has always been a huge problem and stopping it requires actual law enforcement work focused on the producers of that content. But by threatening internet websites with massive liability if they make a mistake, it actually makes law enforcement's job harder, because they will be less able to actually work with law enforcement. This is not theoretical. We already saw exactly this problem with FOSTA, in which multiple law enforcement agencies have said that FOSTA made their job harder because they can no longer find the information they need to stop sex traffickers. EARN IT creates the exact same problem for CSAM.

So the end result is that by misunderstanding Section 230, by misunderstanding internet company's existing willingness to fight CSAM, EARN IT will undoubtedly make the CSAM problem worse by making it more difficult for companies to track CSAM down and report it, and more difficult for law enforcement to track down an arrest those actually responsible for it. It's a very, very bad and dangerous bill -- and that's before we even get to the issue of encryption!

EARN IT is still very dangerous for encryption

EARN IT supporters claim they "fixed" the threat to encryption in the original bill by using text similar to Senator Leahy's amendment to say that using encryption cannot "serve as an independent basis for liability." But, the language still puts encryption very much at risk. As we've seen, the law enforcement/political class is very quick to want to (falsely) blame encryption for CSAM. And by saying that encryption cannot serve as "an independent basis" for liability, that still leaves open the door to using it as one piece of evidence in a case under EARN IT.

Indeed, one of the changes to the bill from the one in 2020 is that immediately after saying encryption can't be an independent basis for liability it adds a new section that wasn't there before that effectively walks back the encryption-protecting stuff. The new section says: "Nothing in [the part that says encryption isn't a basis for liability] shall be construed to prohibit a court from considering evidence of actions or circumstances described in that subparagraph if the evidence is otherwise admissable." In other words, as long as anyone bringing a case under EARN IT can point to something that is not related to encryption, it can point to the use of encryption as additional evidence of liability for CSAM on the platform.

Again, the end result is drastically increasing liability for the use of encryption. While no one will be able to use the encryption alone as evidence, as long as they point to one other thing -- such as a failure to find a single piece of CSAM -- then they can bring the encryption evidence back in and suggest (incorrectly) some sort of pattern or willful blindness.

And this doesn't even touch on what will come out of the "committee" and its best practices recommendations, which very well might include an attack on end-to-end encryption.

The end result is that (1) EARN IT is attacking a problem that doesn't exist (the use Section 230 to avoid responsibility for CSAM) (2) EARN IT will make the actual problem of CSAM worse by making it much more risky for internet companies to fight CSAM and (3) EARN IT puts encryption at risk by potentially increasing the liability risk of any company that offers encryption.

It's a bad and dangerous bill and the many, many Senators supporting it for kicks and headlines should be ashamed of themselves.

Filed Under: csam, earn it, encryption, fosta, lindsey graham, richard blumenthal, section 230

Because Congress Apparently Has NOTHING AT ALL IMPORTANT To Work On, It Introduced TWO MORE Section 230 Bills Yesterday

from the don't-you-people-have-work-to-do? dept

If you were in a coma for the past 12 months, just came out of it, and had to figure out what had happened in the last year or so solely based on new bills introduced in Congress, you would likely come to the conclusion that Section 230 was the world's greatest priority and the biggest, most pressing issue in the entire freaking universe. I've completely lost track of how many new bills have been introduced this year -- in the midst of a pandemic -- that try to undermine and destroy the open internet enabled by Section 230 of the CDA. It's absolutely ridiculous.

Last week we had Lindsey Graham and his garbage Online Content Policy Modernization Act. Josh Hawley, the lying demagogue, has probably introduced half a dozen bills aimed at undermining Section 230, including one a few weeks ago. On Tuesday of this week we had Senators Manchin and Cornyn introduce their despicable and dangerous See Something, Say Something Act.

And then, on Wednesday, we got two more truly awful anti-230 bills. What's going on over there on Capitol Hill? If you introduce 12 bills to destroy the internet do you get a 13th one free?

First up, we had Reps. Sylvia Garcia and Ann Wagner introduce the House companion to the Senate's EARN IT Act. We've spent months detailing how this bill is a two-fer: it's dangerous for both encryption and Section 230. And yet, it now has bipartisan support in both the Senate and the House. Garcia seems so proud of being a part of this nonsense that she didn't put the press release on her own website (though she did have time to put up a press release for a bill to rename a post office).

Ann Wagner, you may recall, is the force behind the previous disastrous anti-230 bill, FOSTA, who has spent the years since passing that bill just flat out lying about what the bill did. She claims it's been a huge success, and yet it has yet to be used successfully, has been shown to put women's lives in danger, and has made it more difficult for law enforcement to find actual sex traffickers.

But, not surprisingly, Wagner is touting her "success" with that terrible legislation in introducing this new garbage:

“I’m proud to join with my colleague Rep. Sylvia Garcia in introducing the EARN IT Act, critical legislation that will hold accountable bad actors that facilitate child sexual abuse material,” said Congresswoman Wagner. "This bill is the natural follow-up to FOSTA, my Fight Online Sex Trafficking Act, which amended section 230 to hold accountable websites that facilitate sex trafficking. As I have said many times, I believe that if exploitation is a crime offline, it should also be a crime online, and I’m delighted to continue working with survivors, advocates, law enforcement, and industry to protect children from online sexual exploitation.”

Yes, she keeps saying that "if it's a crime offline, it should be a crime online" and it always has been. This bill, like her last bill, changed literally nothing about what was a "crime." What it did was blame service providers for non-crimes, and made them less willing to host perfectly legal content. And, again, her bill has harmed survivors and made it more difficult for law enforcement, meaning it has done the opposite of protecting children from online sexual exploitation.

And the EARN IT Act, as we've discussed, will again make things worse. This version of EARN IT is even worse than the Senate version, which included a narrow (and most likely useless) attempt to say that it couldn't be used to ban encryption. This version of the bill narrows that limitation, meaning encryption would be even more at risk.

And that was for the horrific bill we already knew about.

Next up to the plate is Senator John Kennedy with the ridiculously named Don't Push My Buttons Act. As you may have guessed, it's pushed all of my buttons for wasting my time in needing to respond to absolute wingnut batshittery in the form of you-can't-actually-be-serious legislation. There have been so many dumb anti-230 bills that it's hard to rank which one's worse than the next, but this one is... just bad. Basically, this would take Section 230 away from any site that tracks any information on its users, or presents an algorithmically generated feed for its users. But, it would not apply if the users of those sites "knowingly and intentionally elect to receive" the algorithmically generated feed. And so sites that want to do that will just put it in their terms of service and make people agree to it and... what good does that do for anyone?

And what does this even have to do with Section 230 anyway? If you don't like algorithmically generated feeds, it would seem that (1) you're going to have a 1st Amendment issue to overcome at some point and (2) there are other tools in the toolbox and (3) it's totally unrelated to the questions about Section 230. This is just "old man yells at cloud... and writes weird legislation."

Kennedy is trying to get this bill attached as an amendment to Graham's wacky bill that's about to be marked up, and it's just open season for crazy ideas on an issue that should not be a priority at this moment when people are literally dying by the thousands every damn day due to a pandemic that Congress seems to have decided to ignore.

Does this shit ever end?

Filed Under: ann wagner, congress, earn it, house, john kennedy, push my buttons, section 230, senate, sylvia garcia

Senators Graham And Blumenthal Can't Even 'Earn' The EARN IT Act: Looking To Sneak Vote Through Without Debate

from the don't-let-them dept

Senator Lindsey Graham very badly wants to push the extremely dangerous EARN IT Act across the finish line. He's up for re-election this fall, and wants to burnish his "I took on big tech" creds, and sees EARN IT as his path to grandstanding glory. Never mind the damage it will do to basically every one. While the bill was radically changed via his manager's amendment last month, it's still an utter disaster that puts basically everything we hold dear about the internet at risk. It will allow for some attacks on encryption and (somewhat bizarrely) will push other services to more fully encrypt. For those that don't do that, there will still be new limitations on Section 230 protections and, very dangerously, it will create strong incentives for internet companies to collect more personal information about every one of their users to make sure they're complying with the law.

It's a weird way to "attack" the power of big tech by forcing them to collect and store more of your private info. But, hey, it's not about what's actually in the bill. It's about whatever bullshit narrative Graham and others know the press will say is in the bill.

Either way, we've heard that Graham and his bi-partisan supporter for EARN IT, Senator Richard Blumenthal, are looking to rush EARN IT through with no debate, via a process known as hotlining. Basically, it's a way to try to get around any floor debate, by asking every Senator's office (by email, apparently!) if they would object to a call for unanimous consent. If no Senator objects, then they basically know they can skip debate and get the bill approved. If Senators object, then (behind the scenes) others can start to lean on (or horse trade) with the Senators to get the objections to go away without it all having to happen on the floor of the Senate. In other words, Graham and Blumenthal are recognizing that they probably can't "earn" the EARN IT Act if it has to go through the official process to have it debated and voted on on the floor, and instead are looking to sneak it through when no one's looking.

While Senator Wyden (once again) has said he'll do whatever he can to to block this, it would help if other Senators would stand up as well. Here's what Wyden had to say about it:

The EARN IT Act will not protect children. It will not stop the spread of child sexual abuse material, nor target the monsters who produce and share it, and it will not help the victims of these evil crimes. What it will do is threaten the free speech, privacy, and security of every single American. This is because, at its core, the amended EARN IT Act magnifies the failures of the Stop Enabling Sex Traffickers Act--SESTA--and its House companion, the Fight Online Sex Trafficking Act--FOSTA. Experts believe that SESTA/FOSTA has done nothing to help victims or stop sex trafficking, while creating collateral damage for marginalized communities and the speech of all Americans. A lawsuit challenging the constitutionality of FOSTA on First Amendment grounds is proceeding through the courts, and there is bicameral Federal legislation to study the widespread negative impacts of the bill on marginalized groups.

Yet, the authors of the EARN IT Act decided to take this kind of carveout and expand it further to State civil and criminal statutes. By allowing any individual State to set laws for internet content, this bill would create massive uncertainty, both for strong encryption and constitutionally protected speech online. What is worse, the flood of State laws that could potentially arise under the EARN IT Act raises strong Fourth Amendment concerns, meaning that any CSAM evidence collected could be rendered inadmissible in court and accused CSAM offenders could get off scot-free. This is not a risk that I am willing to take.

Let me be clear: The proliferation of these heinous crimes against children is a serious problem. However, for these reasons and more, the EARN IT Act is not the solution. Moreover, it ignores what Congress can and should be doing to combat this heinous crime. The U.S. has a number of important evidence-based programs in existence that are proven to keep kids safe, and they are in desperate need of funding to do their good work. Yet the EARN IT Act doesn't include a single dollar of funding for these important programs. It is time for the U.S. Government to spend the funds necessary to save children's lives now.

While a Wyden hold would block any attempt to get unanimous consent via the hotlining process, it would help quite a lot if other Senators were willing to speak up and stand with him as well. If it's just Wyden, then he'll face tremendous pressure to remove the hold. If more Senators join Wyden in saying this isn't okay, then Graham and Blumenthal will realize they have a bigger challenge in front of them.

Again, if you haven't been following this debate closely, everything that Wyden says above is accurate. EARN IT is an attack on both free speech and privacy (a twofer) without doing anything to actually deal with the problem of child sexual abuse material online. That is very much a law enforcement issue, and it's one which Congress has failed to provide the funds to law enforcement that it promised on this issue, and (even worse) the DOJ has simply ignored its requirement mandates to deal with this issue as required by Congress. The DOJ seems more focused on attacking tech companies and blaming them for its own failure to do its job.

The EARN IT Act is an incredibly dangerous piece of legislation, but it's also a complicated one -- one that many people don't understand. But Senators see something that says "protect the children" and they immediately think "well, of course we support that." But this bill doesn't protect children. It attacks free speech and privacy online in very insidious ways. Please call your Senators and ask them not to let this through.

Filed Under: debate, earn it, earn it act, encryption, free speech, lindsey graham, privacy, richard blumenthal, section 230, senate

Why Does Richard Blumenthal Always Feel The Need To Lie About Section 230?

from the it's-a-bad-trait dept

Richard Blumenthal has spent years trying to undermine Section 230 of the CDA. Unlike some Senators who have only just jumped onto the silly, counterproductive bandwagon, Blumenthal has been mad about 230 since long before he was even a Senator. Back in 2008, when he was Connecticut's ambitious grandstanding Attorney General, he attacked Craigslist because people had found some ads for sex work on the site. Again, this was protected by Section 230, so Blumenthal just kept threatening Craigslist until it finally made a change: rather than allowing its adult ads to be placed for free (as it had in the past), it required payment with a credit card, which Craigslist (quite reasonably) said would likely discourage more sketchy ads, and would leave a paper trail for law enforcement for any illegal activity. Blumenthal initially celebrated this victory... before turning around and grandstanding again two years later... that Craigslist was now "profiting" off of sex work because it was charging for those ads (ignoring that it only did so because he pressured them, even though he knew he was limited by 230).

Since getting elected to the Senate, Blumenthal has kept up this weird infatuation with hating the internet. He was also the lead Democratic sponsor on SESTA (which became FOSTA), the bill to chip away at Section 230, which has now been seen to make it more difficult for law enforcement to track down sex traffickers, and has put many women at risk.

Indeed, in the run-up to that bill passing, perhaps the most frustrating thing was that Blumenthal has a weird penchant to simply lie about Section 230 and what it did and how it worked. And then after the bill was passed, he flat out lied about what his own bill actually did. In a normal society, you might think that maybe journalists should call him on that.

Now, with his dangerous EARN IT Act being voted out of committee, Blumenthal is back to his old tricks. As reported by Newsweek, during last week's markup, Blumenthal made some statements about Section 230 that are simply untrue. Indeed, they're part of my omnibus post on wrong things people say about Section 230:

Blumenthal stood by the Act's design, saying: "There is no reason for these platforms to have blanket immunity, a shield against any accountability that is not enjoyed by any other industry in the same way."

Pretty much all of that is wrong. They do not have "blanket immunity." They have a narrowly limited immunity for (1) content they didn't create, and (2) for moderation choices they make -- not including any violations of federal law (which is what the EARN IT Act covers) or intellectual property. In other words, whatever immunity Section 230 does cover, it doesn't even cover the very thing that the Act Blumenthal is praising is focused on.

Second, the line about 230 being a shield "that is not enjoyed by any other industry in the same way" is also nonsense. Section 230 applies to every website. And these days, pretty much every industry is online and everyone has a website. Section 230 protects them all. It is not a special protection for one industry. And, since most of Section 230 is really just a procedural out for bogus litigation that would be barred under the 1st Amendment, I might want to remind Senator Blumenthal that everyone is also protected by the 1st Amendment.

But it really does raise the question: why does Blumenthal always need to misrepresent Section 230. I get that it helped him jump up from Attorney General to Senator by falsely attacking a website that was protected by 230 and lying about it, but dude, leave well enough alone. You've done enough damage already.

Filed Under: blanket immunity, csam, earn it, fosta, immunity, richard blumenthal, section 230, sesta

New EARN IT Act Creates An Insane New Dilemma: Either Encrypt All Or Spy On All

from the this-seems-counterproductive dept

Last week, as predicted, the Senate Judiciary Committee voted unanimously to replace the original EARN IT Act, with a new one. As part of the markup, they also voted to approve Senator Patrick Leahy's amendment which some might read to say that EARN IT cannot be used to block encryption -- but the reality is a lot more complicated. As I'll explain, this new bill is terrible in a different way than the old bill: it will create a new dilemma in which internet services will either feel compelled to encrypt everything or in which the only way you'll be able to use any internet service is if you hand over a ton of personal information to the service provider -- potentially putting your privacy at extreme risk.

First lets acknowledge an oddity about this new bill. Both bills involve the creation of a commission to come up with "best practices" in trying to stop "child sexual abuse material" or CSAM (the concept formerly known as child porn). In the old bill, if sites didn't follow the commission's best practices, they could lose their Section 230 protections. This resulted in fears that the commission would outlaw encryption as a "best practice." The new bill retains the commission, but for no recognizable purpose. Instead, it does away with the pretense and just says that a bunch of sites should lose Section 230 protections no matter what. It seems quite odd to first say "we need a commission to determine best practices" and then on a second pass say that before the commission has done anything we're just going to make massive changes to Section 230 based on... nothing at all. No evidence saying that this would create better outcomes. No evidence that Section 230 is a problem with regards to CSAM. Just... nothing.

Specifically, the new bill makes a change to Section 230 that looks similar to the change that was made with FOSTA, saying that you don't get 230 protections if you advertise, promote, present, distribute, or solicit CSAM. But here's the thing: CSAM is already a federal crime and all federal crimes are already exempted from Section 230. On top of that, it's not as if there are a bunch of cases anyone can trot out as examples of Section 230 getting in the way of CSAM prosecutions. There's literally no evidence that this is needed or will help -- because it won't.

As we've detailed before, the real scandal in all of this is not that internet companies are facilitating CSAM, but that the DOJ has literally ignored its Congressional mandate to go after those engaged in CSAM production and distribution. Congress tasked the DOJ with tackling CSAM and the DOJ has just not done it. The DOJ was required to compile data and set goals to eliminate CSAM... and has just not done it. That's why it's bizarre that EARN IT is getting all of the attention rather than an alternative bill from Senators Wyden, Gillibrand, Casey and Brown that would tell the DOJ to actually get serious about doing its job with regards to CSAM, rather than blaming everyone else.

But digging into the details, the real problem here is that, as structured, the new EARN IT Act would be a disaster in trying to achieve the goals the sponsors have set out for it. First off, thanks to the addition of Senator Leahy's Amendment, some may see the bill as one that effectively requires encryption to avoid liability for CSAM. Even that's not totally clear, however. While you can read Leahy's amendment to say that encryption is protected, the actual structure of the final bill punts many issues to state law, and that means having to comply with 50 different state laws. Some, like Illinois, have lower standards for the mens rea regarding CSAM, and the worry is that we won't know whether or not offering end-to-end encryption would be seen as violating state laws until long and costly cases go through their lengthy process.

Either way, this weird CSAM carveout from Section 230 is somewhat equivalent to the moderator's dilemma that other attempts to change Section 230 create. Because most of those other reforms put in place a "knowledge" standard, it gives many sites a reason to never look at the content on their platform. In this case, due to the explicit call out saying that encryption isn't impacted, that would effectively say that if you want to keep 230 protections, you should encrypt absolutely everything. Which, ironically, is the exact opposite of what Attorney General Bill Barr has been asking for.

But, as with the moderator's dilemma, there's also a flipside (if you don't want to ignore everything, then you have to greatly restrict what you allow through). Under the new EARN IT, the flipside is that the government more or less says that you are now responsible for being able to track and identify anyone on your service who is not using encryption -- meaning you would need to carefully verify every user of your platform. No more simple signups. No more anonymity. And, incredibly, this would mean that sites would need to collect a ton of data on every user. Want to use this new service? First submit your phone number, driver's license, etc.

At a time when people are saying they trust big internet companies less and less with their data, why would Senators Graham, Blumenthal, Feinstein, and Hawley (HAWLEY!?!?) be encouraging websites to collect even more (and more intrusive) data on all their users?

Since this is somewhat different than the traditional moderator's dilemma, it might be called the "censor's dilemma" or possibly the "middleman's dilemma," in that this is even more tied to the government's demand that websites block certain content entirely, which puts them in the role of a government middleman or censor (which, not coincidentally, would raise serious constitutional issues with the EARN IT Act turning private entities into state censors).

Either way it is difficult to see how these two outcomes are what Congress (or, for that matter, the DOJ) actually wants:

• Much greater encouragement for websites to encrypt everything
• Much greater encouragement for websites to demand much more personal and private information on users.

And yet, thanks to Congress' standard bungling, that's what we have with the current EARN IT Act. And while it might be nice if the law actually did encourage more encryption, don't pin your hopes on that. As noted above, it's not entirely clear that it really does lead to that outcome, and we might not know until after a whole bunch of litigation. Furthermore, if that is is the end result, it will almost certainly lead to a different kind of backlash and support for even worse laws that seek to blow up encryption through other methods.

In short: the EARN IT Act is bad. At best it might encourage more encryption, but it would also create a whole host of unintended consequences, including much less privacy and no more anonymity on many websites. It's difficult to see how that accomplishes any of the goals of the bill's supporters.

Filed Under: censor's dilemma, data, dilemma, earn it, earn it act, encryption, lindsey graham, middleman's dilemma, moderator's dilemma, patrick leahy, privacy, richard blumenthal, verification

Senate Waters Down EARN IT At The Last Minute; Gives Civil Liberties Groups No Time To Point Out The Many Remaining Problems

from the this-is-still-a-bad-bill dept

As expected, the EARN IT Act is set to be marked up this week, and today (a day before the markup) Senators Graham and Blumenthal announced a "manager's amendment" that basically rewrites the entire bill. It has some resemblance to the original bill, in that this bill will also create a giant "national commission on online child sexual exploitation prevention" to "develop recommended best practices" that various websites can use to "prevent, reduce, and respond to the online sexual exploitation of children," but then has removed the whole "earn it" part of the "EARN IT" Act in that there seems to be no legal consequences for any site not following these "best practices" (yet). In the original bill, not following the best practices would lose sites their Section 230 protections. Now... not following them is just... not following them. The Commission just gets to shout into the wind.

Of course, we've seen mission creep on things like this before, where "best practices" later get encoded into law, so there remain significant concerns about how this all plays out in the long run, even if they've removed some of the bite from this version.

Instead, the major "change" with this version of EARN IT, is that it basically replicates FOSTA in creating a specific "carve out" for child sexual abuse material (CSAM, or the artist formerly known as "child porn"). It's almost an exact replica of FOSTA, except instead of "sex trafficking and prostitution" they say the same thing about 230 not impacting laws regarding CSAM. This is... weird? And pointless? It's not like there is some long list of cases regarding CSAM where Section 230 got in the way. There are no sites anyone can point to as "hiding behind Section 230" in order to encourage such content. This is all... performative. And, if anything, we're already seeing people realize that FOSTA did nothing to stop sex trafficking, but did have massive unintended consequences.

That said, there are still massive problems with this bill, and that includes significant constitutional concerns. First off, it remains unclear why the government needs to set up this commission. The companies have spent years working with various stakeholders to build out a set of voluntary best practices that have been implemented and have been effective in finding and stopping a huge amount of CSAM. Of course, there remains a lot more out there, and users get ever sneakier in trying to produce and share such content -- but a big part of the problem seems to be that the government is so focused on blaming tech platforms for CSAM that they do little to nothing to stop the people who are actually creating and sharing the material. That's why Senator Wyden tried to call law enforcement's bluff over all of this by putting out a competing bill that basically pushes law enforcement to do its job, which it has mostly been ignoring.

On the encryption front: much of the early concern was that this commission (with Attorney General Bill Barr's hand heavily leaning on the scales) would say that offering end-to-end encryption was not a "best practice" and thus could lead to sites that offered such communication tools losing 230 protections for other parts of their site. This version of EARN IT removes that specific concern... but it's still a threat to encryption, though in a roundabout way. Specifically, in that FOSTA-like carve out, the bill would allow states to enforce federal criminal laws regarding CSAM, and would allow states to set their own laws for what standard counts as the standard necessary to show that a site "knowingly" aided in the "advertisement, promotion, presentation, distribution or solicitation" of CSAM.

And... you could certainly see some states move (perhaps with a nudge from Bill Barr or some other law enforcement) to say that offering end-to-end encryption trips the knowledge standard on something like "distribution." It's roundabout, but it remains a threat to encryption.

Then there are the constitutional concerns. A bunch of people had raised significant 4th Amendment concerns in that if the government was determining the standards for fighting CSAM, that would turn the platforms into "state actors" for the purpose of fighting CSAM -- meaning that 4th Amendment standards would apply to what the companies themselves could do to hunt down and stop those passing around CSAM. That would make it significantly harder to actually track down the stuff. With the rewritten bill, this again is not as clear, and there remain concerns about the interaction with state law. Under this law, a site can be held liable for CSAM if it was "reckless" and there are reasons to believe that state laws might suggest that it's reckless not to do monitoring for CSAM -- which could put us right back into that state actor 4th Amendment issue.

These are not all of the problems with the bill, but frankly, the new version is just... weird? It's like they had that original "earn" 230 idea worked out, and were convinced that couldn't actually work, but were too wedded to the general idea to try to craft a law that actually works. So they just kinda chucked it all and said "recreate FOSTA" despite that not making any sense.

Oh, and they spring this on everybody the day before they mark it up, giving most experts almost no time to review and analyze. This is not how good lawmaking is done. But what do you expect these days?

Filed Under: 4th amendment, best practices, child porn, commission, csam, earn it, encryption, section 230, states

Senators Launch Full On Nuclear War Against Encryption: Bill Will Require Broken Encryption, Putting Everyone At Risk

from the stop-pushing-this-bullshit dept

Another day, another bad bill. Just as we're coming to terms with the EARN IT Act moving forward in Congress, three Senators -- Lindsey Graham, Tom Cotton, and Marsha Blackburn -- have announced a direct attack on encryption. The full bill is here. It's 51 pages of insanity that would effectively destroy privacy and security on the internet. This is five-alarm fire bad.

For what it's worth, Graham is also a co-sponsor of the EARN IT Act, which makes me wonder if he's going to agree to an amendment of EARN IT that keeps encryption out of it while pushing this bill instead. That's now the rumor making the rounds, and I even received a press release from an anti-porn activist group supporting this bill because they think it will help clarify that EARN IT won't end encryption (none of that makes sense to me either, but...)

The announcement of the bill includes all the usual "think of the children" nonsense, claiming that we can't have encryption because some bad people might use it for bad stuff. The press release summarizes what they claim the bill will do:

Highlights of the Lawful Access to Encrypted Data Act:

• Enables law enforcement to obtain lawful access to encrypted data.

• Once a warrant is obtained, the bill would require device manufacturers and service providers to assist law enforcement with accessing encrypted data if assistance would aid in the execution of the warrant.
• In addition, it allows the Attorney General to issue directives to service providers and device manufacturers to report on their ability to comply with court orders, including timelines for implementation.

• The Attorney General is prohibited from issuing a directive with specific technical steps for implementing the required capabilities.
• Anyone issued a directive may appeal in federal court to change or set aside the directive.
• The Government would be responsible for compensating the recipient of a directive for reasonable costs incurred in complying with the directive.

Incentivizes technical innovation.

• Directs the Attorney General to create a prize competition to award participants who create a lawful access solution in an encrypted environment, while maximizing privacy and security.

Promotes technical and lawful access training and provides real-time assistance.

• Funds a grant program within the Justice Department’s National Domestic Communications Assistance Center (NDCAC) to increase digital evidence training for law enforcement and creates a call center for advice and assistance during investigations.

In short, this basically says "break encryption, but we won't tell you how." We're right back to "nerd harder" except that this time it's "nerd harder, or you're breaking the law."

The problems with this should be evident from all the times we've discussed this before, so I'm really not interested in going over it all again. But the quick summary: installing a "backdoor" or "lawful access" to encrypted communications is not a simple technical problem. As cryptography expert Matt Blaze once said, it's like saying "well, if you can land a man on the moon, why can't you land a man on the sun." A backdoor to encryption literally breaks the encryption and opens up a huge host of other problems, none of which are readily solvable. Instead, you just find more and more problems, each of which makes everyone less secure.

The actual text of the bill is even worse than the summary. It's crazy long so I won't do a full breakdown here, but will call out a few scary, scary bits. The key part is that this basically requires the end of encryption. While there is some language early on about it not applying if "technically impossible," there is other language that more or less cancels that out. Specifically, it requires Apple and other large device sellers to backdoor encryption. It is not an option, but a requirement:

DEVICE MANUFACTURERS.—A device manufacturer that sold more than 1,000,000 consumer electronic devices in the United States in 2016 or any calendar year thereafter, or that has received an assistance capability directive under section 3513, shall ensure that the manufacturer has the ability to provide the assistance described in subsection (b)(2) for any consumer electronic device that the manufacturer—

‘‘(A) designs, manufactures, fabricates, or assembles; and ‘‘(B) intends for sale or distribution in the United States.

So, if you sell more than a million consumer electronic devices in the US, you are required to make sure they have backdoors. That's... going to be a LOT of backdoors. Every Alexa device. Every smart TV. And, of course, every phone. That's devices. How about apps and services? More of the same:

PROVIDERS OF REMOTE COMPUTING SERVICE; OPERATING SYSTEM PROVIDERS.—A provider of remote computing service or operating system provider that provided service to more than 1,000,000 subscribers or users in the United States in 2016 or any calendar year thereafter, or that has received an assistance capability directive under section 3513, shall ensure that the provider has the ability to provide the assistance described in subparagraphs (A) and (B) of subsection (b)(2) for any remotely stored data that the provider processes or stores.

That's... a lot of websites that will be barred from using real end-to-end encryption. The "shall ensure" part is what should scare everyone.

That's still talking about data stored on those servers though. As for "data in motion" again, services will have to provide backdoors under this bill. The reference to "technically impossible" only seems to apply to "independent actions of an unaffiliated entity that make it technically impossible to do". So, the only way to avoid having to break encryption on your own services is to... outsource it to an unaffiliated entity who can make it impossible for you to break the encryption?

As for messaging services: again, the bill "shall ensure" assistance:

A provider of wire or electronic communication service that had more than 1,000,000 monthly active users in the United States in January 2016 or any month thereafter, or has received an assistance capability directive under section 3513, shall ensure that the provider has the ability to provide the information, facilities, and technical assistance described in section 2518(4).

And it gets worse. The bill allows the Attorney General to order someone to break encryption:

If a person fails to comply with a directive issued under subsection (b), the Attorney General may file a petition for an order to compel the person to comply with the directive in the United States District Court for the District of Columbia, which shall have jurisdiction to review the petition.

There's also a giant "NERD HARDER" section, which explains Bill Barr's comments above. Basically it creates a contest, run by the Attorney General, to create a type of backdoored encryption where the Attorney General and his hand-picked judges will determine which technology wins. And by "wins" I mean loses, because that technology will be broken in no time at all, putting everyone at risk.

This whole thing is so incredibly dangerous, and it's not even clear that encryption is a real problem for law enforcement. The basic cost-benefit analysis here is that this law would put everyone, and all our communications, at risk of attack, for a possible benefit in a tiny number of cases, where there remains no evidence that a backdoor would have helped stop any crime. I can't see how the tradeoff is worth it, and any elected official pushing this nonsense should be asked to explain how they weigh these costs and benefits. And if they answer like Bill Barr by saying "smart techies can figure it out" they should have their views discounted for being idiots.

Meanwhile, the press release leads off with quotes from the three sponsors, all of which are head-bangingly wrong, but designed to do the usual tugging at the emotional strings rather than any actual recognition of what they're pushing here:

“Terrorists and criminals routinely use technology, whether smartphones, apps, or other means, to coordinate and communicate their daily activities. In recent history, we have experienced numerous terrorism cases and serious criminal activity where vital information could not be accessed, even after a court order was issued. Unfortunately, tech companies have refused to honor these court orders and assist law enforcement in their investigations. My position is clear: After law enforcement obtains the necessary court authorizations, they should be able to retrieve information to assist in their investigations. Our legislation respects and protects the privacy rights of law-abiding Americans. It also puts the terrorists and criminals on notice that they will no longer be able to hide behind technology to cover their tracks,” said Graham.

There remains little evidence that terrorists have been able to communicate without law enforcement being able to access the info. Remember, the FBI flat out lied about how many devices it had in its possession that it couldn't get into, and has since refused to give an updated number (despite multiple requests). At the same time, every time the FBI does come out and point to a situation where it can't get into a phone, a few months later, they seem to admit that, well, actually, there was a technology that let them get in.

On top of that, we've discussed how law enforcement and the FBI have access to so much other information thanks to social media, and various open source intelligence tools, that the idea that they need to attack encryption is just ridiculous.

And that leaves out something else too: if we put backdoors into encryption, guess what will become a huge target for "terrorists and criminals"? That's right: all of our communications.

“Tech companies’ increasing reliance on encryption has turned their platforms into a new, lawless playground of criminal activity. Criminals from child predators to terrorists are taking full advantage. This bill will ensure law enforcement can access encrypted material with a warrant based on probable cause and help put an end to the Wild West of crime on the Internet,” said Cotton.

This is just a joke. The internet is not "lawless" and there's no indication of increased criminal activity, nor any evidence that law enforcement cannot solve crimes because of encryption or the internet. This bill won't ensure anything other than opening up a new avenue for terrorists and criminals to terrorize.

“User privacy and public safety can and should work in tandem. What we have learned is that in the absence of a lawful warrant application process, terrorists, drug traffickers and child predators will exploit encrypted communications to run their operations,” said Blackburn.

Yes, user privacy and public safety do work in tandem. But you know would would ruin that? Breaking encryption and throwing both of those things into the gutter.

This bill should be trashed and these three Senators (and the Attorney General) deserve mockery for a technically ignorant, totally clueless and dangerous bill that would harm Americans and destroy both privacy and security, because some law enforcement agencies are too lazy to do their jobs. Frankly, the intelligence community should come out screaming about this bill as well, as they know full well how much more dangerous this will make their own work. This is a ridiculous attack on the internet.

Filed Under: backdoors, doj, earn it, encryption, fbi, going dark, laed, lindsey graham, marsha blackburn, tom cotton, william barr

Terrible, Dangerous EARN IT Act Set To Move Forward In The Senate; Attack On Both Encryption And Free Speech Online

from the bad,-no,-bad,-stop-it dept

The attacks never stop. After rumors last week, the Senate Judiciary Committee has officially put the EARN IT Act onto the schedule for this week, though many expect that it will get held over and marked up next week on July 2nd, which, conveniently, is a neat time to sneak through legislation when lots of people are not paying any attention (right before July 4th). In short, this means that there's a decent chance the EARN IT bill will be moving forward and could potentially pass.

This would be very, very bad. I won't go back over everything in it, but the general intent of the bill is to undermine both encryption and Section 230 by trying to make Section 230 dependent on not offering encryption. That's at the highest level. Now, the bill is written in a sneaky way to let some Senators pretend it won't impact encryption, since encryption is not mentioned in the bill. However, the bill does condition 230 protections on meeting certain "best practices" that would be developed through a process mostly controlled by the Attorney General, who has made it clear his number one priority regarding the internet is to kill off real encryption. As we've discussed, the EARN IT Act creates a very dangerous moderator's dilemma that will act to suppress both free speech online and the ability to communicate securely and privately.

And beyond moving forward with such a bad proposal, and trying to sneak it through during a holiday week, it's astounding that this is happening right at the very moment when more people than ever are relying on the internet to work from home -- a situation in which open speech platforms and strong encryption are more important than ever. Indeed, Senator Blumenthal, one of the sponsors of the bill who insisted it wouldn't be used to target encryption, is the same senator who got angry when he found out Zoom video calls weren't end-to-end encrypted.

If he wants to support encryption and promise that EARN IT won't be used to undermine encryption, he should write that explicitly into the law.

In short, the EARN IT Act would:

• Put encryption, privacy, and cybersecurity at risk at a time when we need all three things more than ever.
• Put free speech and open internet platforms at risk, at a time when people need to be able to speak out more than ever.
• Not do a damn thing to actually make anyone safer
• Create a constitutional mess, that might even make it easier for bad actors to get away with things by turning companies into state actors with regards to private info, thereby creating 4th Amendment issues regarding disclosure of information.

It is extremely unclear why anyone thinks (1) this is a good bill, or (2) it needs to move forward right now. But, since everyone wants to hate on Section 230 right now, none of that seems to matter.

Filed Under: earn it, encryption, free speech, privacy, section 230, security, senate judiciary committee