The Senate's Finsta Problem

from the that's-now-how-it-works dept

Earlier this year we wrote about Senator Richard Blumenthal's viral "finsta" debacle in which he asked a Facebook executive to "end Finsta" as if (1) it was a product, or (2) it was "endable." Some people pushed back on the mocking of Blumenthal, noting that he (or at least his staffers) actually understood what "finsta" meant, since he had given an accurate description earlier, and his staff had set up a fake Instagram account, pretending to be a young girl to see what happened. However, as we and others noted, if he actually understood "finsta" that made his demand to "end Finsta" even worse, because it meant he was calling for an end to anonymity on Instagram, which would have huge problems -- especially for more marginalized people or those at risk, who have very good reasons for not using their real names on social media.

Of course, rather than learning from that debacle, Senators across the board seemed to see it as an opportunity to score some media headlines when they dragged in Instagram CEO Adam Mosseri to testify in yet another one of the Senate's pointless, grandstanding "big tech bad" hearings last week. Senator Blumenthal brought back his finsta. On the other side of the aisle, both Senators Marsha Blackburn and Mike Lee rolled out their own finstas. And all of them were shocked, shocked, shocked, to find that sometimes they didn't like what the algorithm recommended to them.

Except, as an article at the National Journal highlights, this little game of gotcha doesn't make much sense and is not how good research is actually done.

Joshua Tucker, a co-director of the NYU Center for Social Media and Politics, said Senate staff don’t have the time or training to make broad inferences about how teens experience Instagram.

“In a sense these [fake accounts] are useful, because they are surfacing things that can happen on the platform,” Tucker said. “But it’s this leap from ‘it can happen’ to ‘this is prevalent, this is common’—that’s when you need the more sophisticated research design.”

Tucker called it “ironic” that lawmakers are deploying these fake accounts in hearings, given ongoing concerns from Blumenthal and others that “finstas” are a menace and the fact that creating such accounts violates Instagram’s terms of service.

“These are exactly the types of protections that we are asking Congress to provide to researchers—to protect researchers who want to do research, who want to go about and find out how these platforms work, to protect them from being attacked by companies for violating terms of service,” Tucker said.

But, rather than handing access to actual researchers who can determine whether or not there's a problem -- and if there is a problem how big or how prevalent it is -- Senators are instead pushing out garbage science. That is, they're pushing anecdotal examples based on a single case set up in a way specifically designed to try to get the outcome they want.

Not surprisingly, when journalist Brendan Bordelon pointed all this out to Blumenthal's office, it was dismissed in Blumenthal's typically dismissive manner:

The Connecticut Democrat shrugged off the idea that there’s something ironic about his creation of a fake account, given his concerns about “finstas” generally.

“I think it’s justified to be illustrative and then disclosed, and nothing done with it,” Blumenthal said. “It’s not like we set it up to exist for any length of time. We set it up to see what happened, and then we shut it down.

“If I were analogizing it to law enforcement, it’s a little bit like having somebody work undercover,” he said.

It's a misleading anecdote, and for someone who claims to be so concerned about misinformation, you'd think that Blumenthal would be careful not to create more of it.

And... that's not even getting into the point that all of these Senators broke Instagram's terms of service, and according to some interpretations of the law, that means they violated the CFAA. It seems like it would be a hell of a lot more productive to fix that, rather than freaking out about the other stuff.

Filed Under: anonymity, finsta, kids, marsha blackburn, mike lee, richard blumenthal, terms of service
Companies: instagram

Silly, Pandering Politicians Introduce Silly, Pandering 'Cyber Grinch' Law That Would Ban Buying Bots

from the the-grinch-turns-out-good-in-the-end dept

In December of 1983, I had just turned 9 years old, and all of my friends wanted Cabbage Patch Kids dolls. They were everywhere, and are remembered as one of the most well known holiday crazes in which scarcity of the toy, and overwhelming demand, resulted in parents absolutely losing their minds trying to find the dolls. My parents, instead, told me that the dolls were impossible to find, or super expensive if they could be found, and told me to expect something else instead. I never got a Cabbage Patch Kid, and I survived the experience (and learned a bit about supply and demand... and mass hysteria).

Anyway, I'm thinking of that experience from nearly 40 years ago today upon reading about the new "Stop Cyber Grinches from Stealing Christmas" bill, which has been announced via a press release with no actual bill text attached (which really shouldn't ever happen). However, as described, the bill would effectively outlaw "bots" that buy up all of the popular toys in order to resell them at jacked up prices:

On Cyber Monday and with holiday shopping underway, Representative Paul Tonko (D-NY), Senator Richard Blumenthal (D-CT), Senate Majority Leader Charles E. Schumer (D-NY) and Senator Ben Ray Luján (D-NM) today announced the introduction of the Stopping Grinch Bots Act. Their bicameral bill will crack down on cyber Grinches using “bot” technology to quickly buy up whole inventories of popular holiday toys and resell them to parents at higher prices. These third-party sellers use bots to bypass security measures and manipulate online sales systems to buy toys, leading to some toys being almost impossible to buy online or in stores at retail prices, exacerbating shortages caused by stressed supply chains.

“At a time when families should be able to spend time with their loved ones, digital “Grinch bots” are forcing Americans to scour online sites in the hopes of finding an affordable gift or paying exorbitant prices for a single toy,” said Tonko. “These bots don’t just squeeze consumers, they pose a problem for small businesses, local retailers and other entrepreneurs trying to ensure they have the best items in stock for their customers. Our Grinch Bots Act works to level the playing field and prevent scalpers from sucking hardworking parents dry this holiday season. I urge my colleagues to join me in passing this legislation immediately to stop these Grinch bots from stealing the holidays.”

And, sure, it sucks that bots are buying up popular items and then jacking up the prices, but is that really a situation that Congress needs to get involved in? Not all bad things need new regulations. And... I'm not one to necessarily say that the free market solves all problems, but this certainly seems like one that the market itself can and should deal with on its own. Companies can produce more of hot products. Retailers can put in place technical solutions to deal with bots and bulk buyers. And, like me and the Cabbage Patch Kids, kids can learn that they don't actually need the hottest toy on the planet (and parents can realize they don't need to buy their kids those products either).

I'm sure it must be good politics for a bunch of elected officials to claim that they're "saving Christmas," but that doesn't mean that it's good policy.

Filed Under: ben ray lujan, bots, buying, christmas, chuck schumer, demand, holidays, paul tonko, richard blumenthal, supply

The Latest Version Of Congress's Anti-Algorithm Bill Is Based On Two Separate Debunked Myths & A Misunderstanding Of How Things Work

from the regulating-on-myths dept

It's kind of crazy how many regulatory proposals we see appear to be based on myths and moral panics. The latest, just introduced is the House version of the Filter Bubble Transparency Act, which is the companion bill to the Senate bill of the same name. Both bills are "bipartisan," which makes it worse, not better. The Senate version was introduced by Senator John Thune, and co-sponsored by a bevy of anti-tech grandstanding Senators: Richard Blumenthal, Jerry Moran, Marsha Blackburn, Brian Schatz, and Mark Warner. The House version was introduced by Ken Buck, and co-sponsored by David Cicilline, Lori Trahan, and Burgess Owens.

While some of the reporting on this suggests that the bill "targets" algorithms, it only does so in the stupidest, most ridiculous ways. The bill is poorly drafted, poorly thought out, and exposes an incredible amount of ignorance about how any of this works. It doesn't target all algorithms -- and explicitly exempts search based on direct keywords, or algorithms that try to "protect the children." Instead, it has a weird attack on what it calls "opaque algorithms." The definition itself is a bit opaque:

The term "opaque algorithm" means an algorithmic ranking system that determines the order or manner that information is furnished to a user on a covered internet platform based, in whole or part, on user-specific data that was no expressly provided by the user to the platform for such purpose.

The fact that it then immediately includes an exemption for "age-appropriate content filters" only hints at some of the problems with this bill -- which starts with the fact that there are all sorts of reasons why algorithms recommending things to you based on more information than you provide directly might be kinda useful. For example, a straightforward reading of this bill would mean that no site can automatically determine you're visiting with a mobile device and format the page accordingly. After all, that's an algorithmic system that uses information not expressly provided by the user in order to present information to you ranked in a different way (for example, moving ads to a different spot). What's more, "inferences about the user's connected device" are explicitly excluded from being used even if they are based on data expressly provided by the user — so even allowing a user to set a preference for their device type, and serve optimized pages based on that preference, would appear to still count as an "opaque algorithm" under the bill's definitions. You could argue that a mobile-optimized page is not necessarily a "ranking" system, except the bill defines "algorithmic ranking system" as "a computational process ... used to determine the order or manner that a set of information is provided to a user." At the very least, there are enough arguments either way that someone will sue over it.

Similarly, lots of media websites offer you a certain number of free articles before you hit their register or paywall -- and again, that's based on information not expressly provided by the user -- meaning that such a practice might be in trouble (which will be fun to watch when media orgs who use those kinds of paywall tricks but are cheering this on as an "anti-big-tech" measure discover what they're really supporting).

The point here is that lots of algorithm/ranking systems that work based on information not expressly provided by the user are actually doing important things that would be missed if they suddenly couldn't be done any more.

And, even if the bill were clarified in a bill-of-attainder fashion to make it clear it only applies to social media news feeds, it still won't do much good. Both Facebook and Twitter already let you set up a chronological feed if you want it. But, more to the point, the very rationale behind this bill makes no sense and is not based in reality.

Cicilline's quote about the bill demonstrates just how ignorant he is of how all of this stuff actually works:

"Facebook and other dominant platforms manipulate their users through opaque algorithms that prioritize growth and profit over everything else. And due to these platforms’ monopoly power and dominance, users are stuck with few alternatives to this exploitative business model, whether it is in their social media feed, on paid advertisements, or in their search results."

Except... as already noted, you can already turn off the algorithmic feed in Facebook, and as the Facebook Papers just showed, when Facebook experimented with turning off the algorithmic rankings in its newsfeed it actually made the company more money, not less.

Also, the name of the bill is based on the idea of "filter bubbles" and many of the co-sponsors of the bill claim that these websites are purposefully driving people deeper into these "filter bubbles." However, as we again just recently discussed, new research shows that social media tends to expose people to a wider set of ideas and viewpoints, rather than more narrowly constraining them. In fact, they're much more likely to face a "filter bubble" in their local community than by being exposed to the wider world through the internet and social media.

So, in the end, we have a well-hyped bill based on the (false) idea of filter bubbles and the (false) idea of algorithms only serving corporate profit, which would require websites to give users a chance to turn off an algorithm -- which they already allow, and which would effectively kill off other useful tools like mobile optimization. It seems like the only purpose this legislation actually serves to accomplish is to let these politicians stand up in front of the news media and claim they're "taking on big tech!" and smile disingenuously.

Filed Under: algorithms, antitrust, big tech, david cicilline, filter bubble transparency act, filter bubbles, john thune, ken buck, opaque algorithms, ranking, richard blumenthal

Blumenthal's Finsta Debacle: It Remains Unacceptable That Our Politicians Are So Clueless About The Internet

from the this-is-just-embarrassing dept

Fifteen years ago, the best example of how out of touch elected officials were regarding the internet was Senator Ted Stevens' infamous "it's a series of tubes" speech (which started out "I just the other day got, an internet was sent by my staff at 10 o'clock in the morning on Friday and I just got it yesterday.") Over the years, this unwillingness of those who put themselves in the position to regulate the internet to actually bother to understand it has become something of an unfortunate running joke. A decade ago, in the midst of the fight over SOPA/PIPA, we pointed out that it's no longer okay for Congress to not know how the internet works. And yet, a decade has passed and things have not gotten much better. Senator Ron Johnson tried to compare the internet to a bridge into a small creek. Senator Orrin Hatch has no clue how Facebook makes money.

And now there's a new addition to the list of examples of totally clueless Senators seeking to regulate something they clearly don't understand. This time it's Senator Richard Blumenthal, who has been grandstanding about how he wants to take on the internet since long before he was elected to the Senate. He created the most cringe-worthy media clip of a politician in a while while trying to press Facebook's head of safety Antigone Davis during a Senate hearing on "grandstanding about how we all hate Facebook" (not the actual subject matter, but close enough).

I heard about the exchange before I saw it, but watching the whole thing is even worse than just hearing that Blumenthal seemed to think "finsta" is a Facebook "product or service." If you're somehow as ignorant as Blumenthal, "finsta" is just a slang term for a "fake" Instagram account, where someone doesn't want to be posting under their real name. This can be used to have a more focused conversation, to discuss things you don't want to discuss under your real name, to hide from some people, or for plenty of other reasons. But Blumenthal seemed to think this "product or service" was bad and Facebook should stop it.

Blumenthal (giving his stern politician face): Will you commit to ending Finsta.

Davis (long pause and a very confused look): Senator, let me again explain... we don't actually "do" finsta. What "finsta" refers to is young people setting up accounts where they want to have more privacy. You refer to it as having privacy from their parents, but in my interaction with teens, what I found is they sometimes they like to have an account where they can interact just with a smaller group of friends...

This is a nice diplomatic response to a monumentally confused question. Some people might take that answer and realize that maybe they didn't quite understand what they were asking. But not Senator Blumenthal. Senator Blumenthal doubled down, interrupting Davis:

Blumenthal: Finsta is one of your products or services! [smug face] We're not talking about Google or Apple. It's Facebook! Correct?

Davis (another long pause and another very confused look): F-F-Finsta is slang for a type of account. It's not...

Blumenthal (interrupting again): Okay, will you end that type of account?

I mean, what? How the hell does Blumenthal think that Facebook can magically make people's alias accounts go away? Hell, earlier in the very same hearing... Blumenthal more or less admitted that he had created a finsta account for himself to examine Instagram's friend recommendation engine. And, obviously, there are plenty of good questions to be asked about the recommendation engine and how it works and what it promotes. But the "will you end alias accounts" line of questioning is just bizarrely disconnected from reality.

Even if we were to give Blumenthal the benefit of the doubt, and believe he is honestly concerned that people are able to sign up for accounts under non-real names, that also suggests a serious misunderstanding of a bunch of things about the internet. Facebook actually has long had a "real names" policy, and academic research going back a decade has shown just how damaging that is, especially for marginalized groups and those at risk for various reasons. Forcing everyone to use their real names damages privacy, can lead to stalking, can harm those who wish to explore more controversial topics, and a variety of other things. Automatically assuming that forcing everyone to have a profile under their real name is the best solution is its own kind of ignorance regarding the internet and internet culture. EFF's Jillian York rightly refers to this demand as "the White Man's Gambit," in that it is most often suggested as a solution by white men who don't realize how their privileged position blinds to them to the many, many reasons why people might want to use a "finsta" account for their own privacy and safety.

And this is obviously not the first time Blumenthal has made it clear that he has no interest in understanding the ins-and-outs or details of the internet he so desperately wants to regulate. He was the lead Democratic sponsor of FOSTA and took glee in the idea that the law might cause small internet companies to go out of business. He's also behind the EARN IT Act, which would be a disaster for the internet and encryption, but has hilariously also gotten mad that Zoom's encryption wasn't fully end-to-end even though his own bill would undermine the ability of anyone to offer end-to-end encryption.

So, no, Senator Blumenthal does not get the benefit of the doubt regarding his knowledge of the internet. He has a long history of being confused about how it all works and the impacts of his policy proposals. And maybe, just maybe, before rushing in to sternly judge these internet companies, he could take the time to learn what a "finsta" is.

Filed Under: antigone davis, congress, finsta, ignorance, internet policy, real names, richard blumenthal
Companies: facebook, instagram

Why Are Senate Democrats Helping Move Forward Trump's Strategy Of Attacking The Internet?

from the this-makes-no-sense dept

We've detailed for a while now how both Republicans and Democrats are mad online about how the internet works -- though often for reasons that directly conflict with each other. We've also highlighted how Donald Trump and his administration are actively encouraging Republicans to focus all of their legislative and grandstanding firepower on attacking the internet.

What I cannot understand is... why are the Democrats helping?

In a Senate Commerce Committee hearing on Thursday, Democrats initially seemed to recognize that plans to subpoena various internet CEOs (AGAIN) were little more than a dog and pony show for Republicans working on their Trump-directed culture war against the internet. Senators Cantwell and Blumenthal both stated that they knew this was all a grandstanding ruse to pressure social media companies to leave up their misinformation and propaganda:

Sen. Maria Cantwell of Washington, the top Democrat on Wicker’s panel, said she resisted his initial subpoena request over fears that such a move would chill the companies’ efforts to tackle “lies, harassment and intimidation” ahead of the election.

“I am not interested in using our subpoena power to try to play or game the refs days before an election, which is clearly what Republicans are doing,” Sen. Richard Blumenthal (D-Conn.) said this week. “The timing shows that these subpoenas are clearly calculated to chill efforts to get misinformation or falsehoods from abroad or domestic groups [removed].”

But take a wild guess what came next? You got it. They ended up supporting the subpoenas unanimously. Why? Because Republicans told the Democrats that while everything they feared about this nonsense was true, the Democrats can also grandstand over their own bullshit misleading culture war issues. It's a win-win for politicians on both sides of the aisle and a lose-lose for the public and the internet we rely on. I mean come on:

Sen. Maria Cantwell, the top Democrat on the panel, urged caution amid her colleagues' complaints of anti-conservative bias. Last week, as Wicker had been pushing internally for the subpoenas, Cantwell said she feared Republicans sought to "chill the efforts of these companies to remove lies, harassment, and intimidation from their platforms."

On Thursday, Cantwell said she was pleased to move forward with the subpoenas after Wicker agreed to include the topics of Big Tech's impact on media and privacy as issues of concern.

"What I don't want to see is a chilling effect on individuals who are in a process of trying to crack down on hate speech or misinformation about Covid during a pandemic," she said at Thursday's markup.

Neither party seems interested in dealing with real problems. Both parties seem to want to waste time focusing on the internet rather than any of the actual problems facing the country and the world these days. What a waste.

Filed Under: congress, democrats, donald trump, grandstanding, intermediary liability, maria cantwell, privacy, republicans, richard blumenthal, section 230

Senator Blumenthal Warns AT&T Not To Make Wireless Privacy A Luxury Option

from the the-illusion-of-value dept

Last week, we discussed how outlets like Reuters were making a big stink about a new proposal by AT&T to dole out "wireless discounts for advertising." Granted as we pointed out then, that's not really what AT&T has in mind. AT&T for years has been trying to craft a new industry paradigm whereby users who opt in to user surveillance and targeted ads pay one price, and those that opt out to protect their privacy pay significantly more.

It's something the company already has experimented with. AT&T for years charged its broadband subscribers up to $500 more annually to opt out of behavioral ads (but not data collection and tracking). AT&T, in effect, was trying to make the illusion of privacy a luxury option. It only stopped while it was attempting to gain regulatory approval for its merger with Time Warner.

AT&T says its latest wireless "discounts" are still a year or more out, but the company carefully leaked word of them to Reuters, hoping (successfully as it turns out) the outlet wouldn't include essential context.

Senator Richard Blumenthal appears to have noticed what AT&T was up to however, and sent AT&T CEO John Stankey a letter (pdf) asking for more details on what AT&T has planned, and warning the company not to try and make privacy something consumers have to shell out significantly more money for:

"AT&T should not hold privacy above consumers’ heads for additional cost. Rather than a benefit, it is clear that AT&T is seeking to legitimize more intrusion into consumers’ lives and more aggressively commoditize subscribers. AT&T’s announcement would create a “pay-forprivacy” standard in the increasingly consolidated phone market, driving prices up for those who want to opt out. You also acknowledge that an ad-supported wireless plan would cross-fertilize its AT&T data broker and ad targeting products, adding to the race to the bottom that exists in the internet ecosystem."

The problem of course is that AT&T's already framed the debate and prepared the press to call this a "discount," even though that's absolutely not what this is. AT&T has also lobbied (quite successfully) to crush nearly every attempt at a federal or state privacy law, however modest. Especially if proposed legislation involves any restrictions on charging consumers a premium to opt out of data collection and monetization. And because AT&T lobbyists have also successfully lobotomized the FCC, don't expect regulators to inject themselves into the equation any time soon.

That leaves you relying on the wisdom and power of "the market" to organically inhibit the idea of privacy as a luxury option. But because the DOJ and FCC just rubber stamped the Sprint/T-Mobile merger, there will soon be fewer competitors than ever, meaning less incentive to behave. And because consumers (thanks to the press) will genuinely view this as a "discount," that means limited pressure on an already dysfunctional and overwhelmed Congress. That leaves you waiting on AT&T's incompetence to derail such an effort. And while that's certainly possible given recent AT&T history, that's neither a guarantee nor the way you craft effective national privacy safeguards.

Filed Under: fees, pay for privacy, privacy, richard blumenthal
Companies: at&t

Senators Graham And Blumenthal Can't Even 'Earn' The EARN IT Act: Looking To Sneak Vote Through Without Debate

from the don't-let-them dept

Senator Lindsey Graham very badly wants to push the extremely dangerous EARN IT Act across the finish line. He's up for re-election this fall, and wants to burnish his "I took on big tech" creds, and sees EARN IT as his path to grandstanding glory. Never mind the damage it will do to basically every one. While the bill was radically changed via his manager's amendment last month, it's still an utter disaster that puts basically everything we hold dear about the internet at risk. It will allow for some attacks on encryption and (somewhat bizarrely) will push other services to more fully encrypt. For those that don't do that, there will still be new limitations on Section 230 protections and, very dangerously, it will create strong incentives for internet companies to collect more personal information about every one of their users to make sure they're complying with the law.

It's a weird way to "attack" the power of big tech by forcing them to collect and store more of your private info. But, hey, it's not about what's actually in the bill. It's about whatever bullshit narrative Graham and others know the press will say is in the bill.

Either way, we've heard that Graham and his bi-partisan supporter for EARN IT, Senator Richard Blumenthal, are looking to rush EARN IT through with no debate, via a process known as hotlining. Basically, it's a way to try to get around any floor debate, by asking every Senator's office (by email, apparently!) if they would object to a call for unanimous consent. If no Senator objects, then they basically know they can skip debate and get the bill approved. If Senators object, then (behind the scenes) others can start to lean on (or horse trade) with the Senators to get the objections to go away without it all having to happen on the floor of the Senate. In other words, Graham and Blumenthal are recognizing that they probably can't "earn" the EARN IT Act if it has to go through the official process to have it debated and voted on on the floor, and instead are looking to sneak it through when no one's looking.

While Senator Wyden (once again) has said he'll do whatever he can to to block this, it would help if other Senators would stand up as well. Here's what Wyden had to say about it:

The EARN IT Act will not protect children. It will not stop the spread of child sexual abuse material, nor target the monsters who produce and share it, and it will not help the victims of these evil crimes. What it will do is threaten the free speech, privacy, and security of every single American. This is because, at its core, the amended EARN IT Act magnifies the failures of the Stop Enabling Sex Traffickers Act--SESTA--and its House companion, the Fight Online Sex Trafficking Act--FOSTA. Experts believe that SESTA/FOSTA has done nothing to help victims or stop sex trafficking, while creating collateral damage for marginalized communities and the speech of all Americans. A lawsuit challenging the constitutionality of FOSTA on First Amendment grounds is proceeding through the courts, and there is bicameral Federal legislation to study the widespread negative impacts of the bill on marginalized groups.

Yet, the authors of the EARN IT Act decided to take this kind of carveout and expand it further to State civil and criminal statutes. By allowing any individual State to set laws for internet content, this bill would create massive uncertainty, both for strong encryption and constitutionally protected speech online. What is worse, the flood of State laws that could potentially arise under the EARN IT Act raises strong Fourth Amendment concerns, meaning that any CSAM evidence collected could be rendered inadmissible in court and accused CSAM offenders could get off scot-free. This is not a risk that I am willing to take.

Let me be clear: The proliferation of these heinous crimes against children is a serious problem. However, for these reasons and more, the EARN IT Act is not the solution. Moreover, it ignores what Congress can and should be doing to combat this heinous crime. The U.S. has a number of important evidence-based programs in existence that are proven to keep kids safe, and they are in desperate need of funding to do their good work. Yet the EARN IT Act doesn't include a single dollar of funding for these important programs. It is time for the U.S. Government to spend the funds necessary to save children's lives now.

While a Wyden hold would block any attempt to get unanimous consent via the hotlining process, it would help quite a lot if other Senators were willing to speak up and stand with him as well. If it's just Wyden, then he'll face tremendous pressure to remove the hold. If more Senators join Wyden in saying this isn't okay, then Graham and Blumenthal will realize they have a bigger challenge in front of them.

Again, if you haven't been following this debate closely, everything that Wyden says above is accurate. EARN IT is an attack on both free speech and privacy (a twofer) without doing anything to actually deal with the problem of child sexual abuse material online. That is very much a law enforcement issue, and it's one which Congress has failed to provide the funds to law enforcement that it promised on this issue, and (even worse) the DOJ has simply ignored its requirement mandates to deal with this issue as required by Congress. The DOJ seems more focused on attacking tech companies and blaming them for its own failure to do its job.

The EARN IT Act is an incredibly dangerous piece of legislation, but it's also a complicated one -- one that many people don't understand. But Senators see something that says "protect the children" and they immediately think "well, of course we support that." But this bill doesn't protect children. It attacks free speech and privacy online in very insidious ways. Please call your Senators and ask them not to let this through.

Filed Under: debate, earn it, earn it act, encryption, free speech, lindsey graham, privacy, richard blumenthal, section 230, senate

Why Does Richard Blumenthal Always Feel The Need To Lie About Section 230?

from the it's-a-bad-trait dept

Richard Blumenthal has spent years trying to undermine Section 230 of the CDA. Unlike some Senators who have only just jumped onto the silly, counterproductive bandwagon, Blumenthal has been mad about 230 since long before he was even a Senator. Back in 2008, when he was Connecticut's ambitious grandstanding Attorney General, he attacked Craigslist because people had found some ads for sex work on the site. Again, this was protected by Section 230, so Blumenthal just kept threatening Craigslist until it finally made a change: rather than allowing its adult ads to be placed for free (as it had in the past), it required payment with a credit card, which Craigslist (quite reasonably) said would likely discourage more sketchy ads, and would leave a paper trail for law enforcement for any illegal activity. Blumenthal initially celebrated this victory... before turning around and grandstanding again two years later... that Craigslist was now "profiting" off of sex work because it was charging for those ads (ignoring that it only did so because he pressured them, even though he knew he was limited by 230).

Since getting elected to the Senate, Blumenthal has kept up this weird infatuation with hating the internet. He was also the lead Democratic sponsor on SESTA (which became FOSTA), the bill to chip away at Section 230, which has now been seen to make it more difficult for law enforcement to track down sex traffickers, and has put many women at risk.

Indeed, in the run-up to that bill passing, perhaps the most frustrating thing was that Blumenthal has a weird penchant to simply lie about Section 230 and what it did and how it worked. And then after the bill was passed, he flat out lied about what his own bill actually did. In a normal society, you might think that maybe journalists should call him on that.

Now, with his dangerous EARN IT Act being voted out of committee, Blumenthal is back to his old tricks. As reported by Newsweek, during last week's markup, Blumenthal made some statements about Section 230 that are simply untrue. Indeed, they're part of my omnibus post on wrong things people say about Section 230:

Blumenthal stood by the Act's design, saying: "There is no reason for these platforms to have blanket immunity, a shield against any accountability that is not enjoyed by any other industry in the same way."

Pretty much all of that is wrong. They do not have "blanket immunity." They have a narrowly limited immunity for (1) content they didn't create, and (2) for moderation choices they make -- not including any violations of federal law (which is what the EARN IT Act covers) or intellectual property. In other words, whatever immunity Section 230 does cover, it doesn't even cover the very thing that the Act Blumenthal is praising is focused on.

Second, the line about 230 being a shield "that is not enjoyed by any other industry in the same way" is also nonsense. Section 230 applies to every website. And these days, pretty much every industry is online and everyone has a website. Section 230 protects them all. It is not a special protection for one industry. And, since most of Section 230 is really just a procedural out for bogus litigation that would be barred under the 1st Amendment, I might want to remind Senator Blumenthal that everyone is also protected by the 1st Amendment.

But it really does raise the question: why does Blumenthal always need to misrepresent Section 230. I get that it helped him jump up from Attorney General to Senator by falsely attacking a website that was protected by 230 and lying about it, but dude, leave well enough alone. You've done enough damage already.

Filed Under: blanket immunity, csam, earn it, fosta, immunity, richard blumenthal, section 230, sesta

New EARN IT Act Creates An Insane New Dilemma: Either Encrypt All Or Spy On All

from the this-seems-counterproductive dept

Last week, as predicted, the Senate Judiciary Committee voted unanimously to replace the original EARN IT Act, with a new one. As part of the markup, they also voted to approve Senator Patrick Leahy's amendment which some might read to say that EARN IT cannot be used to block encryption -- but the reality is a lot more complicated. As I'll explain, this new bill is terrible in a different way than the old bill: it will create a new dilemma in which internet services will either feel compelled to encrypt everything or in which the only way you'll be able to use any internet service is if you hand over a ton of personal information to the service provider -- potentially putting your privacy at extreme risk.

First lets acknowledge an oddity about this new bill. Both bills involve the creation of a commission to come up with "best practices" in trying to stop "child sexual abuse material" or CSAM (the concept formerly known as child porn). In the old bill, if sites didn't follow the commission's best practices, they could lose their Section 230 protections. This resulted in fears that the commission would outlaw encryption as a "best practice." The new bill retains the commission, but for no recognizable purpose. Instead, it does away with the pretense and just says that a bunch of sites should lose Section 230 protections no matter what. It seems quite odd to first say "we need a commission to determine best practices" and then on a second pass say that before the commission has done anything we're just going to make massive changes to Section 230 based on... nothing at all. No evidence saying that this would create better outcomes. No evidence that Section 230 is a problem with regards to CSAM. Just... nothing.

Specifically, the new bill makes a change to Section 230 that looks similar to the change that was made with FOSTA, saying that you don't get 230 protections if you advertise, promote, present, distribute, or solicit CSAM. But here's the thing: CSAM is already a federal crime and all federal crimes are already exempted from Section 230. On top of that, it's not as if there are a bunch of cases anyone can trot out as examples of Section 230 getting in the way of CSAM prosecutions. There's literally no evidence that this is needed or will help -- because it won't.

As we've detailed before, the real scandal in all of this is not that internet companies are facilitating CSAM, but that the DOJ has literally ignored its Congressional mandate to go after those engaged in CSAM production and distribution. Congress tasked the DOJ with tackling CSAM and the DOJ has just not done it. The DOJ was required to compile data and set goals to eliminate CSAM... and has just not done it. That's why it's bizarre that EARN IT is getting all of the attention rather than an alternative bill from Senators Wyden, Gillibrand, Casey and Brown that would tell the DOJ to actually get serious about doing its job with regards to CSAM, rather than blaming everyone else.

But digging into the details, the real problem here is that, as structured, the new EARN IT Act would be a disaster in trying to achieve the goals the sponsors have set out for it. First off, thanks to the addition of Senator Leahy's Amendment, some may see the bill as one that effectively requires encryption to avoid liability for CSAM. Even that's not totally clear, however. While you can read Leahy's amendment to say that encryption is protected, the actual structure of the final bill punts many issues to state law, and that means having to comply with 50 different state laws. Some, like Illinois, have lower standards for the mens rea regarding CSAM, and the worry is that we won't know whether or not offering end-to-end encryption would be seen as violating state laws until long and costly cases go through their lengthy process.

Either way, this weird CSAM carveout from Section 230 is somewhat equivalent to the moderator's dilemma that other attempts to change Section 230 create. Because most of those other reforms put in place a "knowledge" standard, it gives many sites a reason to never look at the content on their platform. In this case, due to the explicit call out saying that encryption isn't impacted, that would effectively say that if you want to keep 230 protections, you should encrypt absolutely everything. Which, ironically, is the exact opposite of what Attorney General Bill Barr has been asking for.

But, as with the moderator's dilemma, there's also a flipside (if you don't want to ignore everything, then you have to greatly restrict what you allow through). Under the new EARN IT, the flipside is that the government more or less says that you are now responsible for being able to track and identify anyone on your service who is not using encryption -- meaning you would need to carefully verify every user of your platform. No more simple signups. No more anonymity. And, incredibly, this would mean that sites would need to collect a ton of data on every user. Want to use this new service? First submit your phone number, driver's license, etc.

At a time when people are saying they trust big internet companies less and less with their data, why would Senators Graham, Blumenthal, Feinstein, and Hawley (HAWLEY!?!?) be encouraging websites to collect even more (and more intrusive) data on all their users?

Since this is somewhat different than the traditional moderator's dilemma, it might be called the "censor's dilemma" or possibly the "middleman's dilemma," in that this is even more tied to the government's demand that websites block certain content entirely, which puts them in the role of a government middleman or censor (which, not coincidentally, would raise serious constitutional issues with the EARN IT Act turning private entities into state censors).

Either way it is difficult to see how these two outcomes are what Congress (or, for that matter, the DOJ) actually wants:

• Much greater encouragement for websites to encrypt everything
• Much greater encouragement for websites to demand much more personal and private information on users.

And yet, thanks to Congress' standard bungling, that's what we have with the current EARN IT Act. And while it might be nice if the law actually did encourage more encryption, don't pin your hopes on that. As noted above, it's not entirely clear that it really does lead to that outcome, and we might not know until after a whole bunch of litigation. Furthermore, if that is is the end result, it will almost certainly lead to a different kind of backlash and support for even worse laws that seek to blow up encryption through other methods.

In short: the EARN IT Act is bad. At best it might encourage more encryption, but it would also create a whole host of unintended consequences, including much less privacy and no more anonymity on many websites. It's difficult to see how that accomplishes any of the goals of the bill's supporters.

Filed Under: censor's dilemma, data, dilemma, earn it, earn it act, encryption, lindsey graham, middleman's dilemma, moderator's dilemma, patrick leahy, privacy, richard blumenthal, verification

Senator Blumenthal Is Super Mad That Zoom Isn't Actually Offering The End To End Encryption His Law Will Outlaw

from the also-should-acquaint-himself-with-the-1st-amendment dept

Richard Blumenthal has been attacking internet services he doesn't understand since before he was even a US Senator. It has carried over into his job as a Senator, and was abundantly obvious in his role as a co-sponsor for FOSTA. His hatred of the internet was on clear display during a hearing over FOSTA in which he flat out said that if smaller internet companies couldn't put in place the kind of infrastructure required to comply with FOSTA, that they should go out of business. Blumenthal's latest ridiculous bit of legislation lose your Section 230 protections. And while Blumenthal likes to pretend that the EARN IT Act doesn't target encryption, he also lied about FOSTA and insisted it had no impact on CDA 230 (which it directly amended).

But Blumenthal has now taken his ridiculousness up a notch. Following the (legitimately concerning) reports that the suddenly incredibly popular videoconferencing software Zoom was not actually providing end-to-end encrypted video chats (despite its marketing claims), Blumenthal decided to step in and play the hero sending an angry letter to the company, while linking to the Intercept's original story about Zoom's misleading claims about encryption:

The letter highlights a number of recent claims that have been made about Zoom's security and privacy practices -- some of which are very significant (and a few that aren't as big a deal) -- including the end to end encryption claims:

Does Zoom provide end-to-end encryption, as the term is commonly understood by cybersecurity experts, for video conferences? Please describe when end-to-end encryption is available for users and how the personal data is encrypted?

And this is a legit question and I think it's good that a Senator is asking that. I just think that this particular Senator is the wrong messenger, given his active role in trying to make it impossible for companies like Zoom to offer end-to-end encryption in the first place, as Riana Pfefferkorn (the Associate Director Surveillance & Cybersecurity at Stanford's Center for Internet and Society) pointed out:

And it gets worse. As Pfefferkorn also points out, Blumenthal's claims to be so concerned about cybersecurity and privacy ring hollow when just last month he straight up claimed that you have no right to privacy online:

This was in a weak attempt to "respond to concerns" raised about the EARN IT Act. In one of the responses, concerning government mandates for scanning content and how that interacts with the 4th Amendment, Blumenthal, quoting Neil Gorsuch, claims that there's no reasonable expectation of privacy for any content you put online:

In the Ackerman opinion cited by tech companies as raising Fourth Amendment concerns, Gorsuch suggested that the third-party doctrine will protect evidence of CSAM found by a company that privately searched. When a company has terms and conditions that enable it to privately search, there is no Fourth Amendment violation because users lose their reasonable expectation of privacy. Gorsuch stated that “The [Supreme] Court has, after all, suggested that individuals lack any reasonable expectation of privacy and so forfeit any Fourth Amendment protections in materials they choose to share with third parties.”

Of course, as Pfefferkorn further points out, Blumenthal's broken analysis of the Ackerman opinion leaves out some important information. But, still, Blumenthal seems to constantly be talking out of both sides of his mouth. He doesn't believe in an expectation of privacy for content posted online, but he also wants to slam a company for not keeping information private. He doesn't want companies to have end-to-end encryption, but he's angry at Zoom for not having end-to-end encryption.

And that's not the end of the problems with Blumenthal's approach here. While some of the privacy concerns he raises are legit, he lumps them in with ones that are not. For example, for reasons that make no sense at all, he seems to think the relatively new practice of Zoombombing -- in which (often racist trolls from the worst parts of the internet) find publicly linked Zoom events and pop in to be total assholes -- is on par with the other (often legit) security questions raised by Zoom's security practices. Right after his question about end-to-end encryption he asks:

What measures has Zoom put into place to detect and prevent Zoombombing -- intrusions and abuse targeting Zoom meetings? What are the policies governing such abusive behavior, what detection mechanisms are in place, how can users report abusive intrusions, and how quickly does Zoom respond to such incidents?

While there are plenty of questions about how companies can deal with such things, this is not an issue that is under the government's purview. Indeed, as annoying as Zoombombing is, and as quickly as I'm sure Zoom has been working on technology tools to allow meeting hosts to deal with the issue, most Zoombombing is still 1st Amendment protected speech, and a Senator has no business insisting that Zoom silence such activities. And yet, that seems to be exactly what he's focused on doing:

In that tweet he says: "I am calling on Zoom to take urgent & aggressive action to stop the racists, trolls, & peddlers of hate that are silencing & bullying communities." Yeah, the 1st Amendment (the one you swore to defend) might want to have a word with you about that, Senator. I'm all for Zoom coming up with tools for users of its service to help prevent such trollish behavior, but seriously, these kinds of stunts are not at all new on the internet and have been around for literally decades. That doesn't make the juvenile behavior any less annoying or problematic, but it's not the role of any government official to insist that a company censor people for protected speech, no matter how trollish.

Separately, of course, this ignores that Zoom had already put in place a detailed plan for how to stop Zoombombing over a week before Blumenthal sent the letter. The company still could do more, and it's worth noting that it has since released a detailed plan to deal with the newly raised security and privacy concerns, including a 90 day freeze on all feature development to have the engineering team focus on privacy and security issues. That didn't take Senator Blumenthal's grandstanding -- and, of course, if Blumenthal's EARN IT Act passes, that would make Zoom's job that much more difficult.

I know that Senator Blumenthal loves to grandstand over tech issues, but it might help if he understood the technology, the law, and the Constitution before making such a fool of himself. Unfortunately, for over a decade he's shown a decided lack of interest in doing any of those things, and I guess he has no intention of starting now.

Filed Under: earn it, encryption, fosta, free speech, privacy, richard blumenthal, section 230, security, trolls, zoombombing
Companies: zoom