Signal Speaks Out About The Evils Of The EARN IT Act

from the speak-out,-in-encrypted-fashion dept

Signal, the end-to-end encrypted app maker, doesn't really need Section 230 of the Communications Decency Act. It can't see what everyone's saying via its offering anyway, so there's little in the way of moderation to do. But, still, it's good to see it come out with a strong condemnation of the EARN IT Act, which as been put forth by Senators Lindsey Graham, Richard Blumenthal, Dianne Feinstein, and Josh Hawley as a way to undermine both Section 230 of the CDA and end-to-end encryption in the same bill. The idea is to effectively use one as a wedge against the other. Under the bill, companies will have to "earn" their 230 protections, by putting in place a bunch of recommended "best practices" which can be effectively put in place by the US Attorney General -- the current holder of which, Bill Barr, has made clear that he hates end-to-end encryption and thinks its a shame the DOJ can't spy on everyone. And this isn't just this administration. Law enforcement officials, such as James Comey under Obama, were pushing this ridiculous line of thinking as well.

To be clear, the EARN IT Act might not have a huge direct impact on a company like Signal -- since it doesn't really much rely on 230 protections (though it might at the margins). But it's good to see that it recognizes what a terrible threat the EARN IT Act would be:

It is as though the Big Bad Wolf, after years of unsuccessfully trying to blow the brick house down, has instead introduced a legal framework that allows him to hold the three little pigs criminally responsible for being delicious and destroy the house anyway. When he is asked about this behavior, the Big Bad Wolf can credibly claim that nothing in the bill mentions “huffing” or “puffing” or “the application of forceful breath to a brick-based domicile” at all, but the end goal is still pretty clear to any outside observer.

However as Signal makes clear, getting rid of end-to-end encryption is much more likely to harm everyone, without providing much help to law enforcement in the first place:

Bad people will always be motivated to go the extra mile to do bad things. If easy-to-use software like Signal somehow became inaccessible, the security of millions of Americans (including elected officials and members of the armed forces) would be negatively affected. Meanwhile, criminals would just continue to use widely available (but less convenient) software to jump through hoops and keep having encrypted conversations.

There is still time to make your voice heard. We encourage US citizens to reach out to their elected officials and express their opposition to the EARN IT bill. You can find contact information for your representatives using The Electronic Frontier Foundation’s Action Center.

Stay safe. Stay inside. Stay encrypted.

Filed Under: communications, earn it, encryption, intermediary liability, secrecy, section 230
Companies: signal

The EARN IT Act Creates A New Moderator's Dilemma

from the moderate-perfectly-or-else dept

Last month, a bipartisan group of U.S. senators unveiled the much discussed EARN IT Act, which would require tech platforms to comply with recommended best practices designed to combat the spread of child sexual abuse material (CSAM) or no longer avail themselves of Section 230 protections. While these efforts are commendable, the bill would cause significant problems.

Most notably, the legislation would create a Commission led by the Attorney General with the authority to draw up a list of recommended best practices. Many have rightly explained that AG Barr will likely use this new authority to prohibit end-to-end encryption as a best practice. However, less discussed is the recklessness standard the bill adopts. This bill would drastically reduce free speech online because it eliminates the traditional moderator’s dilemma and instead creates a new one: either comply with the recommended best practices, or open the legal floodgates.

Prior to the passage of the Communications Decency Act in 1996, under common law intermediary liability, platforms could only be held liable if they had knowledge of the infringing content. This meant that if a platform couldn’t survive litigation costs, they could simply choose not to moderate at all. While not always a desirable outcome, this did provide legal certainty for smaller companies and start-ups that they wouldn’t be litigated into bankruptcy. This dilemma was eventually resolved thanks to Section 230 protections, which prevent companies from having to make that choice.

However, the EARN IT Act changes that equation in two key ways. First, it amends Section 230 by allowing civil and state criminal suits against companies who do not adhere to the recommended best practices. Second, for the underlying Federal crime (which Section 230 doesn’t affect), the bill would change the scienter requirement from actual knowledge to recklessness.  What does this mean in practice? Currently, under existing Federal law, platforms must have actual knowledge of CSAM on their service before any legal requirement goes into effect. So if, for example, a user posts material that could be considered CSAM but the platform is not aware of it, then they can’t be guilty of illegally transporting CSAM. Platforms must remove and report content when it is identified to them, but they are not held liable for any and all content on the website. However, a recklessness standard turns this dynamic on its head.

What actions are “reckless” is ultimately up to the jurisdiction, but the model penal code can provide a general idea of what it entails: a person acts recklessly when he or she “consciously disregards a substantial and unjustifiable risk that the material element exists or will result from his conduct.” But what’s worse, the bill opens the platform’s actions to civil cases. Federal criminal enforcement normally targets the really bad actors, and companies that comply with reporting requirements will generally be immune from liability. However with these changes, if a user posts material that could potentially be considered CSAM, despite no knowledge on the part of the platform, civil litigants could argue that the moderation and detection practices of the companies, or lack thereof, constituted a conscious disregard of the risk that CSAM will be shared by users.

When the law introduces ambiguity into liability, companies tend to err on the side of caution. In this case, that means the removal of potentially infringing content to ensure they cannot be brought before a court. For example, in the copyright context, a Digital Millennium Copyright Act safe-harbor exists for internet service providers (ISPs) who “reasonably implement” policies for terminating repeat infringers on their service in “appropriate circumstances.” However, courts have refused to apply that safe-harbor when a company didn’t terminate enough subscribers. This uncertainty about whether a safe-harbor applies will undoubtedly lead ISPs to act on more complaints, ensuring they cannot be liable for the infringement. Is it "reckless" for a company not to investigate postings from an IP address if other postings from that IP address were CSAM? What if the IP address belongs to a public library with hundreds of daily users?

This ambiguity will likely force platforms to moderate user content and over-remove legitimate content to ensure they cannot be held liable. Large firms that have the resources to moderate more heavily and that can survive an increase in lawsuits may start to invest the majority of moderation resources into CSAM out of an abundance of caution. As a result, this would leave less resources to target and remove other problematic content such as terrorist recruitment or hate speech. Mid-sized firms may end up over-removing user content that in any way features a child or limit posting to trusted sources, insulating them from potential lawsuits that could cripple the business. And small firms, who likely can’t survive an increase in litigation could ban user content entirely, ensuring nothing on the website hasn’t been posted without vetting. These consequences, and the general burden on the First Amendment, are exactly the type of harms that drove courts to adopt a knowledge standard for online intermediary liability, ensuring that the free flow of information was not unduly limited.

Yet, the EARN IT Act ignores this. Instead, the bill assumes that companies will simply adhere to the best practices and therefore retain Section 230 immunity, avoiding these bad outcomes. After all, who wouldn’t want to comply with best practices? Instead, this could force companies to choose between vital privacy protections like end-to-end encryption or litigation. The fact is there are better ways to combat the spread of CSAM online which don’t require platforms to remove key privacy features for user.

As it stands now, the EARN IT Act solves the moderator’s dilemma by creating a new one: comply, or else.

Jeffrey Westling is a technology and innovation policy fellow at the R Street Institute, a free-market think tank based in Washington, D.C.

Filed Under: attorney general, best practices, cda 230, earn it, earn it act, encryption, moderator's dilemma, recklessness, section 230

Senator Blumenthal Is Super Mad That Zoom Isn't Actually Offering The End To End Encryption His Law Will Outlaw

from the also-should-acquaint-himself-with-the-1st-amendment dept

Richard Blumenthal has been attacking internet services he doesn't understand since before he was even a US Senator. It has carried over into his job as a Senator, and was abundantly obvious in his role as a co-sponsor for FOSTA. His hatred of the internet was on clear display during a hearing over FOSTA in which he flat out said that if smaller internet companies couldn't put in place the kind of infrastructure required to comply with FOSTA, that they should go out of business. Blumenthal's latest ridiculous bit of legislation lose your Section 230 protections. And while Blumenthal likes to pretend that the EARN IT Act doesn't target encryption, he also lied about FOSTA and insisted it had no impact on CDA 230 (which it directly amended).

But Blumenthal has now taken his ridiculousness up a notch. Following the (legitimately concerning) reports that the suddenly incredibly popular videoconferencing software Zoom was not actually providing end-to-end encrypted video chats (despite its marketing claims), Blumenthal decided to step in and play the hero sending an angry letter to the company, while linking to the Intercept's original story about Zoom's misleading claims about encryption:

The letter highlights a number of recent claims that have been made about Zoom's security and privacy practices -- some of which are very significant (and a few that aren't as big a deal) -- including the end to end encryption claims:

Does Zoom provide end-to-end encryption, as the term is commonly understood by cybersecurity experts, for video conferences? Please describe when end-to-end encryption is available for users and how the personal data is encrypted?

And this is a legit question and I think it's good that a Senator is asking that. I just think that this particular Senator is the wrong messenger, given his active role in trying to make it impossible for companies like Zoom to offer end-to-end encryption in the first place, as Riana Pfefferkorn (the Associate Director Surveillance & Cybersecurity at Stanford's Center for Internet and Society) pointed out:

And it gets worse. As Pfefferkorn also points out, Blumenthal's claims to be so concerned about cybersecurity and privacy ring hollow when just last month he straight up claimed that you have no right to privacy online:

This was in a weak attempt to "respond to concerns" raised about the EARN IT Act. In one of the responses, concerning government mandates for scanning content and how that interacts with the 4th Amendment, Blumenthal, quoting Neil Gorsuch, claims that there's no reasonable expectation of privacy for any content you put online:

In the Ackerman opinion cited by tech companies as raising Fourth Amendment concerns, Gorsuch suggested that the third-party doctrine will protect evidence of CSAM found by a company that privately searched. When a company has terms and conditions that enable it to privately search, there is no Fourth Amendment violation because users lose their reasonable expectation of privacy. Gorsuch stated that “The [Supreme] Court has, after all, suggested that individuals lack any reasonable expectation of privacy and so forfeit any Fourth Amendment protections in materials they choose to share with third parties.”

Of course, as Pfefferkorn further points out, Blumenthal's broken analysis of the Ackerman opinion leaves out some important information. But, still, Blumenthal seems to constantly be talking out of both sides of his mouth. He doesn't believe in an expectation of privacy for content posted online, but he also wants to slam a company for not keeping information private. He doesn't want companies to have end-to-end encryption, but he's angry at Zoom for not having end-to-end encryption.

And that's not the end of the problems with Blumenthal's approach here. While some of the privacy concerns he raises are legit, he lumps them in with ones that are not. For example, for reasons that make no sense at all, he seems to think the relatively new practice of Zoombombing -- in which (often racist trolls from the worst parts of the internet) find publicly linked Zoom events and pop in to be total assholes -- is on par with the other (often legit) security questions raised by Zoom's security practices. Right after his question about end-to-end encryption he asks:

What measures has Zoom put into place to detect and prevent Zoombombing -- intrusions and abuse targeting Zoom meetings? What are the policies governing such abusive behavior, what detection mechanisms are in place, how can users report abusive intrusions, and how quickly does Zoom respond to such incidents?

While there are plenty of questions about how companies can deal with such things, this is not an issue that is under the government's purview. Indeed, as annoying as Zoombombing is, and as quickly as I'm sure Zoom has been working on technology tools to allow meeting hosts to deal with the issue, most Zoombombing is still 1st Amendment protected speech, and a Senator has no business insisting that Zoom silence such activities. And yet, that seems to be exactly what he's focused on doing:

In that tweet he says: "I am calling on Zoom to take urgent & aggressive action to stop the racists, trolls, & peddlers of hate that are silencing & bullying communities." Yeah, the 1st Amendment (the one you swore to defend) might want to have a word with you about that, Senator. I'm all for Zoom coming up with tools for users of its service to help prevent such trollish behavior, but seriously, these kinds of stunts are not at all new on the internet and have been around for literally decades. That doesn't make the juvenile behavior any less annoying or problematic, but it's not the role of any government official to insist that a company censor people for protected speech, no matter how trollish.

Separately, of course, this ignores that Zoom had already put in place a detailed plan for how to stop Zoombombing over a week before Blumenthal sent the letter. The company still could do more, and it's worth noting that it has since released a detailed plan to deal with the newly raised security and privacy concerns, including a 90 day freeze on all feature development to have the engineering team focus on privacy and security issues. That didn't take Senator Blumenthal's grandstanding -- and, of course, if Blumenthal's EARN IT Act passes, that would make Zoom's job that much more difficult.

I know that Senator Blumenthal loves to grandstand over tech issues, but it might help if he understood the technology, the law, and the Constitution before making such a fool of himself. Unfortunately, for over a decade he's shown a decided lack of interest in doing any of those things, and I guess he has no intention of starting now.

Filed Under: earn it, encryption, fosta, free speech, privacy, richard blumenthal, section 230, security, trolls, zoombombing
Companies: zoom

Teleconferencing Company Zoom Pitching End-To-End Encryption That Really Isn't End-To-End

from the some-sort-of-magic-happens-at-both-ends-so-probably-good-enough dept

As Karl Bode wrote what feels like a decade ago on March 19, 2020, privacy and encryption will be more important than ever during this pandemic and the future that succeeds it. Plenty of governments have been sacrificing citizens' privacy for better virus tracking and plenty of governments were already throwing shade at encryption well before the pandemic became a pandemic. That includes our government, which has been agitating against encryption for several years now and fighting against our privacy in federal courts for decades.

An influx of remote workers makes encryption and privacy even more important, as there's plenty of sensitive company business being done over open networks with minimal protections. The beneficiaries of this new normal are responding quickly to the unexpected demand, but protection of work-at-home employees and their employers seems to have been forgotten.

The field is crowded with lots of telecommuting software providers. Standing out is key if you're going to take advantage of the current health crisis. Video conference software developer Zoom, however, is playing fast and loose with terminology in an attempt to scoop up more market share. As Micah Lee and Yael Grauer report for The Intercept, words don't seem to mean what they normally mean when they're being used by Zoom.

Zoom offers reliability, ease of use, and at least one very important security assurance: As long as you make sure everyone in a Zoom meeting connects using “computer audio” instead of calling in on a phone, the meeting is secured with end-to-end encryption, at least according to Zoom’s website, its security white paper, and the user interface within the app.

Sounds comforting, but Zoom is apparently using a proprietary definition of "end-to-end encryption." Zoom explained that phrase means something else when used in marketing materials or when users hover over the green padlock on their session screens that delivers a pop-up saying "Zoom is using an end to end encrypted connection."

This is what "E2EE" means when Zoom says it:

[W]hen reached for comment about whether video meetings are actually end-to-end encrypted, a Zoom spokesperson wrote, “Currently, it is not possible to enable E2E encryption for Zoom video meetings. Zoom video meetings use a combination of TCP and UDP. TCP connections are made using TLS and UDP connections are encrypted with AES using a key negotiated over a TLS connection.”

Well, if it's not possible to do the thing people think you're doing when you say "end to end encryption," maybe you should stop saying you're using end-to-end encryption. All Zoom is doing is encrypting the endpoints, much in the way sites using HTTPS do. This protects you from outsiders wishing to eavesdrop on your internet connection. But it doesn't mean Zoom can't access the content of teleconferencing sessions. And it means anyone that can find a way to access what Zoom can access is going to be able to do access possibly-sensitive communications.

One offering is actually encrypted end-to-end: Zoom's text chat. But that's not a standout feature. There are plenty of encrypted messaging apps. There's been no increase in demand for those. But when privacy and security matter most, Zoom is misleading users about what it's doing to protect them.

Update: Zoom has since put out two fairly detailed blog posts, the first one much more clearly explaining the encryption issue, and then a more important one explaining what the company is doing to respond to recent security concerns, including freezing all feature development to focus solely on "trust, safety, and privacy issues." It remains to be seen how that plays out in practice, but it's much better than the typical defensive response that most companies have.

Filed Under: encryption, end-to-end, privacy, security, video conferencing
Companies: zoom

Apple Helps China Censor Citizens By Pulling The Plug On A Keyboard App That Encrypted Text Messages

from the don't-be-Big-Brother's-little-brother dept

China keeps being China, despite all the problems it has at home. The coronavirus traces back to Wuhan, China, and it has become clear the Chinese government is doing what it can to suppress reporting on the outbreak.

The country has a fine-tuned censorship machine that works in concert with its overbearing surveillance apparatus to ensure the government maintains control of the narrative. "Ensures" is perhaps too strong a term because, despite its best efforts, information always leaks out around the edges.

Citizens of China have found numerous ways to dodge censorship and surveillance over the years. But they're not being helped much by American companies, which have more often than not complied with government demands for apologies, takedowns, and other efforts that ensure access to the Chinese market at the expense of their Chinese users.

The latest news is more of the same. A clever keyboard app that encrypted messages has been nuked from the Chinese app store by Apple following a takedown demand from the Chinese government.

Apple yesterday removed Boom the Encryption Keyboard, an app that allowed Chinese internet users to bypass censorship, from the China app store, according to its developer.

[...]

According to an email sent by Apple to [app developer] Wang Huiyu, the app was removed because it contained “content that is illegal in China.” The app is still available in other regions, including Hong Kong, he said.

Boom encrypted messages by changing the originating English or Chinese to a blend of emoji, Japanese, and Korean characters. To decrypt the messages, users simply copied the characters sent to them, which were reverted to their original state on the keyboard below. Not enough to thwart targeted surveillance, but more than enough to dodge blanket censorship efforts like keyword blacklists.

The app's developer suspects Boom was targeted by the Chinese government because it was being used to spread an article about the virus that was censored by the government shortly after its publication.

The article in question is an interview with Ai Fen, a Wuhan doctor who said she was reprimanded for alerting other people about the novel coronavirus. The article, published on March 10 by China’s Ren Wu magazine, was deleted within hours of its publication. Various versions of the article, including those reproduced in emoji, English, and even Hebrew, emerged after the deletion as people scrambled to save Ai’s story…

This is the sort of information American companies should be helping to spread, not shutting down at the behest of the parties who want to see this information buried. If this were a one-off, it would be worrying. But it's just another data point in a long string of incidents where American tech companies have endangered users in foreign countries, seemingly for the single purpose of maintaining market share.

Filed Under: app store, boom, censorship, china, codes, content moderation, emoji, encryption, keyboard
Companies: apple

Privacy & Encryption Will Be More Important Than Ever In Wake Of Coronavirus

from the encrypt-ALL-the-things! dept

Be it Cambridge Analytica, Equifax, or wireless carrier location data, the U.S. has already faced a steady parade of privacy and security related scandals. Now as countries around the world hunker down to slow the rate of COVID-19, the problem could easily grow even larger as a chain reaction of implications make privacy, security, and tools like encryption more important than ever.

Millions of Americans are now telecommuting for the first time. As they do so, more than a few of them won't be wise enough to use basic security precautions while handling sensitive work or health related data. And as we've noted for years, services like VPNs often don't provide reliable protection, given it's hard to verify just how secure or trustworthy service owners are. Many services were already shady as hell, and even the reliable offerings may struggle under the load.

Many folks are already using the pandemic as scam fodder. As a result, the shift to home work -- and the dramatic spike in healthcare information being shoveled around the internet -- means that the battle over encryption is also more important than ever:

As with everything this pandemic is going to touch, there are layers and layers of complications here. Many popular teleconferencing services don't have particularly great privacy standards. And with no U.S. privacy law to speak of for the internet era (outside of the problematic COPPA), it shouldn't be hard to see how we might run into some additional problems. It should also be easy to see how the pandemic may provide justification for all manner of problematic privacy and security related behavior, from the war on encryption to the quest to expand domestic surveillance.

Israel, for example, has started using a previously unknown database of phone location data to help track the spread of COVID-19. The Washington Post this week indicated that both Google and Facebook (that bastion of privacy-related trust) are also working with the U.S. government to explore the use of location data to help combat the spread of the virus. Experts suggest that we should be able to walk and chew gum at the same time, including data sharing and sunset provisions into any efforts designed to battle the pandemic:

We're only going to have so much attention to go around as we worry about ourselves, our families, and our livelihoods. Unfortunately, the pandemic could easily provide cover for the steady expansion of problematic domestic surveillance efforts that continues at a pretty brisk clip, even in normal times.

Filed Under: covid-19, encryption, privacy, surveillance, tracking

Since The FBI Can't Be Bothered To Do It, Motherboard Has Compiled A Database Of Attempts To Access Encrypted IPhones

from the thanks-for-nothing,-g-men dept

The FBI continues to avoid playing its hand honestly in the "going dark" debate. It continues to do things like call strong encryption "warrant-proof" encryption, damning it by associating its very existence with unlawfulness. FBI Director Chris Wray continues to claim he's not asking for encryption backdoors while calling for encryption backdoors. And for nearly two years, the FBI has refused to update its erroneous count of uncracked devices in its possession.

The last time the FBI delivered a number, it claimed it had about 7,800 devices in its possession that it couldn't get into. After being questioned by Congress about its claims, the FBI went back to count devices and found its tracking method had resulted in a severe miscount. No real number has been delivered yet, but the early estimate was that the actual number was slightly over 1,000 devices. Not quite the apocalypse the FBI needed us (and our Congressional reps) to believe it was.

As usual, when the government fails, private citizens step in to do the work that government agencies are spending our tax dollars not doing. The DOJ and FBI have spent years hardly bothering to compile an accurate accounting of police use of deadly force, resulting in a small cottage industry of journalists, activists, and hobbyists doing the work for them.

The same thing can be said about the "going dark" narrative. The FBI loves the narrative but can't be bothered to provide any hard data backing its assertions that encryption is destroying the criminal justice system. So, it's left up to people like Joseph Cox and his team members at Motherboard to try to get a grip on how often device encryption is disrupting criminal investigations.

Using information gathered from more than 500 iPhone search warrants and other court records, Motherboard has compiled a database that gives readers a better idea of encryption's impact on law enforcement investigations -- a narrative stripped of all the competing narratives, if you will.

In conclusion, Going Dark is a land of contrasts:

[T]he records compiled by Motherboard show that the capability to unlock iPhones is a fluid issue, with an ebb and flow of law enforcement sometimes being able to access devices and others not. The data solidifies that some law enforcement officials do have trouble accessing data stored on iPhones.

What this doesn't answer is the question the FBI and DOJ want answered in their favor: should access to encrypted content and communications be guaranteed? Is it better for citizens to be less secure but possibly more "safe" by making encryption inherently flawed? Of course, the answer is "no," but those at the top of the law enforcement food chain are never going to stop arguing that their lofty ideals should trump the rights and protections of all the little people below them. Only a criminal would want encryption because innocent people have nothing to hide and all of that garbage.

But Motherboard is providing a valuable service -- one the government refuses to do itself: it's providing data about the law enforcement v. encryption battle which should better inform everyone on both sides of the issue. For all of its insistence that encryption is an evil that's not even necessary, the FBI has done next to nothing than provide a handful of anecdotes about its experience with encrypted devices. And for more than a half-decade, these anecdotes have been backed by extremely faulty numbers. Let's hope throwing a little more reality around will bring the agency back to earth -- and more in agreement with the millions of people who ensure it stays funded.

Filed Under: chris wray, encryption, fbi, going dark, law enforcement, william barr

EPIC Offers Its Support Of The EARN IT Act; Thinks It Can Separate Undermining Section 230 From Undermining Encryption

from the it-really-shouldn't-be-supporting-either dept

As the EARN IT Act moves forward -- with all of its Section 230 and encryption-threatening appendages still intact -- we're getting some very interesting responses from tech companies that have benefitted from Section 230 and/or rely on strong encryption.

The goal may be noble -- the protection of children from sexual abuse -- but those noble goals are just a crowd-pleasing dodge. It's an assault on both Section 230 and strong encryption that's being pushed with an anti-child porn narrative, one that makes it very difficult for legislators to oppose. To vote against EARN IT, supporters will misleadingly claim, is to vote for the spread of child porn, so it's going to be tough to find lawmakers willing to push back.

Attorney General Bill Barr wants encryption broken. If it means American citizens are less protected, so be it… just as long as the FBI can get into a few more locked devices or accounts. Plenty of people in the administration seem to feel Section 230 has to go, if only to make it easier to sue platforms for perceived slights.

Entities that used to be allied against Section 230 reform and encryption-breaking are now for it. The Electronic Privacy Information Center wants to do both somehow. It has sent a letter [PDF] in support of the EARN IT Act that is pure cognitive dissonance. EPIC claims it wants to see Section 230 reformed but somehow keep this "reform" from threatening the encryption of end-to-end communications. How it imagines this law will achieve both aims is nearly impossible to discern.

The letter says Section 230 must be reformed, but for something much lower on the "for the children" list.

EPIC also supports efforts to reform Section 230. In the case Herrick v, Grindr, EPIC provided an amicus brief for the Second circuit in which we explained that the “Internet has changed since Congress passed the [Communication Decency Act] in 1996. Advanced social media platform did not exist when Congress enacted the law.” We objected to a lower court interpretation of section 230, which found that “online platforms bear no responsibility for the harassment and abuse their systems enable. If they chose not to respond to the exposure of personal information or intimate images, to threats of violence, to verbal and psychological abuse, there is nothing a victim can do to intervene.” As we explained, “Congress never intended § 230 to create such a system.”

We all can agree platforms need to handle things like harassment better. But there's no clear way to make it better, not when you're moderating millions (Twitter) or billions (Facebook) of users. Attacking the law that allows them to engage in moderation without fear of reprisal isn't going to make things better. It's either going to result in platforms refusing to moderate at all or -- in the case of smaller competitors -- just deciding it's not profitable to do business in the United States.

EPIC knows the EARN IT Act also threatens the use of end-to-end encryption. If the "best practices" handed down by law to address the spread of child porn include forcing platforms to break encryption to view message content, encryption gets weaker and opponents of encryption like Bill Barr and FBI Director Chris Wray get what they want: encryption that doesn't protect anyone.

EPIC thinks it can back the EARN IT Act and keep encryption intact.

[F]or companies that actually provide end-to-end encryption we would caution against recommendations that diminish user privacy and security. Strong encryption is critical for network security. The Act correctly identifies “data security and privacy” as relevant considerations in developing best practices. The Act also requires that the Commission include two experts who have “current experience in matters related to constitutional law, consumer protection, or privacy” as well as two experts in “computer science or software engineering related to matters of cryptography, data security, or artificial intelligence in a non-governmental capacity.” The Act should make end-to-end encryption a “Relevant Consideration” under Section 4(a)(4).

Providing end-to-end encryption protects users, promotes commerce, and ensures cybersecurity. EPIC recommends that the EARN IT Act make clear that liability should not be imposed for a secure end-to-end encrypted communications system that safeguards the security and privacy of users.

That's all well and good, but we're not going to get a law that undermines Section 230 while protecting encryption. It will undermine both. That's the goal of the legislation. Doing everything you can to prevent the distribution of child porn means cracking open encrypted messages to view their contents. Platforms are doing all they can to prevent this, but forcing them to undermine encryption makes millions of people not distributing child porn less secure. It's pretty screwed up to run an organization interested in protecting the privacy of internet users when you're throwing your support behind a bill that threatens to make everyone's conversations less private.

Filed Under: earn it, encryption, section 230
Companies: epic

Senators Pretend That EARN IT Act Wouldn't Be Used To Undermine Encryption; They're Wrong

from the plausible-deniability dept

On Wednesday, the Senate held a hearing about the EARN IT Act, the bill that is designed to undermine the internet and encryption in one single move -- all in the name of "protecting the children" (something that it simply will not do). Pretty much the entire thing was infuriating, but I wanted to focus on one key aspect. Senators supporting the bill, including sponsor Richard Blumenthal -- who has been attacking the internet since well before he was in the Senate and was just the Attorney General of Connecticut -- kept trying to insist the bill had nothing to do with encryption and wouldn't be used to undermine encryption. In response to a letter from Facebook, Blumenthal kept insisting that the bill is not about encryption, and also insisting (incorrectly) that if the internet companies just nerded harder, they could keep encryption while still giving law enforcement access.

“This bill says nothing about encryption,” Sen. Richard Blumenthal..., said at a hearing Wednesday to discuss the legislation...

[....]

“Strong law enforcement is compatible with strong encryption,” Blumenthal said. “I believe it, Big Tech knows it and either is Facebook is lying — and I think they’re telling us the truth when they say that law enforcement is consistent with strong encryption — or Big Tech is using encryption as a subterfuge to oppose this bill.”

No, the only one engaged in lying or subterfuge here is Blumenthal (alternatively, he's so fucking ignorant that he should resign). "Strong" encryption is end-to-end encryption. Once you create a backdoor that lets law enforcement in, you've broken the encryption and it's no longer stronger. Even worse, it's very, very weak, and it puts everyone (even Senator Blumenthal and all his constituents) at risk. If you want to understand how this bill is very much about killing encryption, maybe listen to cryptographer Matthew Green explain it to you (he's not working for "Big Tech," Senator):

EARN IT works by revoking a type of liability called Section 230 that makes it possible for providers to operate on the Internet, by preventing the provider for being held responsible for what their customers do on a platform like Facebook. The new bill would make it financially impossible for providers like WhatsApp and Apple to operate services unless they conduct “best practices” for scanning their systems for CSAM.

Since there are no “best practices” in existence, and the techniques for doing this while preserving privacy are completely unknown, the bill creates a government-appointed committee that will tell technology providers what technology they have to use. The specific nature of the committee is byzantine and described within the bill itself. Needless to say, the makeup of the committee, which can include as few as zero data security experts, ensures that end-to-end encryption will almost certainly not be considered a best practice.

So in short: this bill is a backdoor way to allow the government to ban encryption on commercial services. And even more beautifully: it doesn’t come out and actually ban the use of encryption, it just makes encryption commercially infeasible for major providers to deploy, ensuring that they’ll go bankrupt if they try to disobey this committee’s recommendations.

It’s the kind of bill you’d come up with if you knew the thing you wanted to do was unconstitutional and highly unpopular, and you basically didn’t care.

Or listen to Stanford's Riana Pfefferkorn explain how the bill's real target is encryption. As she explains, the authors of the bill (including Blumenthal) had ample opportunity to put in language that would make it clear that it does not target encryption. They chose not to.

As for the "subterfuge" Blumenthal calls out, the only real "subterfuge" here is by Blumenthal and Graham in crafting this bill with the help of the DOJ. Remember, just the day before the DOJ flat out said that 230 should be conditioned on letting law enforcement into any encrypted communications. So if Blumenthal really means that this bill won't impact encryption he should write it into the fucking bill. Because as it's structured right now, in order to keep 230 protections, internet companies will have to follow a set of "best practices" put together by a panel headed by the Attorney General who has said multiple times that he doesn't believe real encryption should be allowed on these services.

So if Blumenthal wants us to believe that his bill won't undermine encryption, he should address it explicitly, rather than lying about it in a Senate hearing, while simultaneously claiming that Facebook (and every other company) can do the impossible in giving law enforcement backdoor access while keeping encrypted data secure.

Filed Under: earn it, earn it act, encryption, intermediary liability, richard blumenthal, section 230

FBI Director Chris Wray Pitches Weakened Encryption At A Cyber Security Conference

from the piling-on-the-unintended-irony dept

On May 29, 2018, the FBI promised to deliver an updated count of encrypted devices in its possession. As James Comey and his replacement, Chris Wray, continued to advocate for weakened encryption, the number of phones the FBI couldn't get into swelled from 880 in 2016 to over 7,800 by the time the FBI realized its phone-counting method was broken.

This number still hasn't been updated. An early internal estimate by the FBI put the real number of locked devices at ~1,200. But the official number still hasn't been released. This hasn't stopped Chris Wray from continuing his attacks on encryption, painting pictures of a dark future that isn't supported by the small number of encrypted devices in the agency's possession.

The attacks continue. They're more subtle than Attorney General Bill Barr's aggressive pitches, but they're still happening. Chris Wray spent his time at a recent cyber security conference in Boston making the case for strong encryption before (yet again) making a plea for tech companies to give law enforcement the encryption backdoors Wray still refuses to call backdoors.

Today we’re worried about a wider-than-ever range of threat actors, from multi-national cyber syndicates to nation-state adversaries. And we’re concerned about a wider-than-ever gamut of methods continually employed in new ways, like the targeting of managed service providers—MSPs—as a way to access scores of victims by hacking just one provider.

[...]

We’re also battling the increasing sophistication of criminal groups that places many hackers on a level we used to see only among hackers working for governments. The proliferation of malware as a service, where darkweb vendors sell sophistication in exchange for cryptocurrency, increases the difficulty of stopping what would once have been less-dangerous offenders. It can give a ring of unsophisticated criminals the tools to paralyze entire hospitals, police departments, and businesses with ransomware. Often the hackers themselves haven’t actually gotten much more sophisticated—but they’re renting sophisticated capabilities, requiring us to up our game as we work to defeat them, too.

These all sound like arguments for strong encryption. They're not, I guess. Because the very next thing out of Wray's mouth is this:

We’re having to fight these increasingly-dangerous threats while contending with providers increasingly shielding indispensable information about those threats from any form of lawful access—through warrant-proof encryption.

"Warrant-proof encryption" is just encryption. It's protecting all the people Chris Wray says need to be protected from cyber threats. Just because it's made gathering evidence slightly more difficult is no reason to portray encryption as an evil the nation needs to be saved from.

But Wray's disingenuousness doesn't stop there.

We are all for strong encryption—and contrary to what you might hear, we’re not advocating for “back doors.” We’ve been asking for providers to make sure that they themselves maintain some kind of access to the encrypted data we need, so they can still provide it in response to a court order.

It's still a door -- one that wasn't there previously. Trying to dodge the "backdoor" term by asking service providers to leave themselves a key under the doormat is a weak and transparent effort to pre-distance Wray from any subsequent damage his desires might cause. Wray doesn't want to be the villain if anti-encryption laws are ever enacted. But he won't waste any time availing himself of the access it provides, even as it undermines the security of the nation.

Filed Under: chris wray, doj, encryption, fbi