DOJ's Latest Ideas For Section 230 Reform Dumber Than Even I Expected

from the what-the-actual-fuck,-guys? dept

Ever since the DOJ started attacking Section 230 of the Communications Decency Act, it was obvious that it was simply a ploy to attack big tech companies that are (unfairly) seen as being "anti-conservative." Remember, that Section 230 explicitly exempts federal crimes -- the kind of law enforcement the DOJ is engaged in. That is, there is literally nothing in Section 230 stopping the DOJ from doing its job. But as Barr and the DOJ continued to attack 230, it also became clear that this was going to be a wedge issue he could use to undermine encryption -- encryption that keeps us all safe.

Last month, the DOJ hosted a "workshop" regarding Section 230, and again Barr and the DOJ's agenda became quite clear. For all the talk of "dangers" to children online, the DOJ ignored the fact that it has failed to abide by Congressional mandates regarding fighting child sexual exploitation, and Congress itself has failed to fund programs it has put forth to deal with the issue.

At the DOJ's 230 hearing, plenty of speakers highlighted why messing with 230 would create all sorts of problems. Unsurprisingly, the DOJ has ignored all of that, and sent out Deputy Attorney General Jeffrey Rosen to pitch four changes to Section 230, each one dumber and more counterproductive than even I had expected. The speech starts out with a misleading history of antitrust law -- the other big tool in the DOJ's toolbox to whack at internet companies -- and then gets to 230. If I have a chance I may get back to Rosen's antitrust discussion, but to keep this post from getting too long, we'll just focus on the 230 argument (ignoring the fact that evidence shows that 230 increases competition, rather than diminishes it).

Shifting gears just a little, as we focus on market-leading online platforms, there is another major issue that has come to the forefront: Section 230 of the Communications Decency Act of 1996. Section 230 has played a role in both the good and the bad of the online world. It has no doubt contributed to new offerings and growth online. At the same time, as DOJ is the agency tasked with protecting the American public through enforcing the law, we are concerned that Section 230 is also enabling some harm.

"Some harm" carries a lot of weight here. Lots of things "enable some harm." Not all of them require massive structural changes. After giving some background on 230 and why it's been useful, he then turns to "the dark side."

But there is a dark side, too. To say the least, the online world has changed a lot in the 25 years since the original drafting of Section 230. The Internet is no longer made up of the rudimentary bulletin boards and chat rooms of AOL, CompuServe, and Prodigy, but instead, it is now a vital and ever-present aspect of both personal and professional modern lives. Indeed, it is now quaint to think of the likes of CompuServe hosting online comments. Instead, major online platforms now actively match us with news stories and friends and, whether by algorithm or otherwise, effectively choose much of what our children see, and enable a seemingly limitless number of people to connect with us or with our children. And platforms are often themselves speakers and publishers of their own content, and not mere forums for others to communicate.

It's not that quaint. Many sites -- such as this one -- still rely on 230 daily. And when platforms are speakers and publishers of their own content, that content is not covered by 230. So it's not clear why that matters.

Now, a quarter century after its enactment, there also is recognition that Section 230 immunity has not always been a force for good, particularly in light of some of the extraordinarily broad interpretation given to it by some courts. For example, platforms have been used to connect predators with vulnerable children, to facilitate terrorist activity, and as a tool for extreme online harassment.

And, again, the DOJ has failed to prosecute many of those situations in which that violated federal laws. That's not on 230, that's on the DOJ. It also leaves out that 230 is what allows platforms to put in place programs to protect children, remove terrorist activity, and block "extreme online harassment. Rather than point that out, Rosen falsely suggests that 230 is to blame for it, rather than the reason it can be blocked.

The drafters of Section 230 might be surprised by this development. Remember, Section 230 was but one provision in the much larger Communications Decency Act of 1996. As its name suggests, the primary aim of the Communications Decency Act was to promote decency on the Internet and to create a safe environment for children online.

The drafters -- Chris Cox and Ron Wyden -- are both still with us. And both of them have made it clear in recent days that, no, they are not "surprised by this development." As for why 230 was a part of the Communications Decency Act, well, Rosen should read Jeff Kosseff's book. The CDA was a separate act, and 230 was attached to it by Cox and Wyden to enable platforms to have that moderation capability so that they could moderate, since without it, following the ruling in the Stratton Oakmont v. Prodigy case, moderation would have been effectively impossible.

As it turned out, the Supreme Court rejected most of the Communications Decency Act on First Amendment grounds. The most significant piece that survived was Section 230. But rather than furthering the purposes of its underlying bill, some scholars have argued that Section 230 has instead immunized platforms “where they (1) knew about users’ illegal activity, deliberately refused to remove it, and ensured that those responsible could not be identified; (2) solicited users to engage in tortious and illegal activity; and (3) designed their sites to enhance the visibility of illegal activity and to ensure that the perpetrators could not be identified and caught.”

Those scholars are wrong. Nearly every major platforms works hard to remove such content -- and, again, if it violates federal law, nothing has ever stopped the DOJ from enforcing the law.

To address these concerns and the others that have been raised, we see at least four areas that are potentially ripe for engagement. First, as a threshold matter, it would seem relatively uncontroversial that there should be no special statutory immunity for websites that purposefully enable illegality and harm to children. Nor does someone appear to be a “Good Samaritan” if they set up their services in a way that makes it impossible for law enforcement to enforce criminal laws. In these particular situations, why should not the website or platform have to defend and justify the reasonableness of their conduct on the merits just like businesses operating outside the virtual world?

This is the most disingenuous bit in the whole discussion. Rosen and the DOJ are obnoxiously linking two separate issues into a misleading "but think of the children" argument. Separately, the word "purposefully" is carrying a lot of water in this paragraph as well -- especially since the EARN IT act does not say "purposefully" but rather has a "reckless" standard (which is already probably unconstitutional). The second half of the paragraph, about the "Good Samaritan" part is a direct attack on encryption -- basically saying that if you offer end-to-end encrypted services, you should lose 230 protections. This is bizarre and stupid at the same time.

First, messaging communication services rarely need 230 protections anyway, since those communications are private, between users. There's no moderation issues in the first place. Second, framing encryption that keeps everyone safe as setting up a service to make "it impossible for law enforcement to enforce criminal laws" is super misleading. Encryption protects us all, and law enforcement has a ton of other tools to do their jobs. The problem is that the DOJ hasn't used those tools and now just wants to whack tech companies.

Finally, the last line is utter bullshit. It's framed in a manner to suggest that companies offering end-to-end encryption are no different than those (never actually identified) platforms who "purposefully enable illegality and harm to children" and then saying they should have to "justify the reasonableness of their conduct." You shouldn't have to justify protecting your users from getting hacked. It's self-evident to everyone but this DOJ.

Next, Rosen tries to get around the fact that the DOJ has failed to actually do its job by still blaming 230... because it's blocking civil cases.

Second, the Department of Justice is also concerned about Section 230’s impacts on our law enforcement function, and the law enforcement efforts of our partners throughout the executive branch. In our discussions with scholars and members of the public on this topic, many are surprised to learn that Section 230 is increasingly being claimed as a defense against the federal government in civil actions. To be clear, Section 230 has a carve-out for certain federal criminal enforcement. But not all problems can be solved by federal criminal law. Federal civil actions play a very important role in their own right. The increasing invocation of Section 230 in federal civil enforcement actions often goes beyond the purpose of the Communications Decency Act, and can undermine the goals of 230 itself.

Can he point to an actual example of useful, reasonable, non-crazy civil actions blocked by 230? Because the very fact that he doesn't give any examples should give you that answer. 230 protects against frivolous ambulance chasing civil suits -- the kind we're already seeing from the last time we amended 230 -- and not legitimate lawsuits.

Third, we are concerned about expansions of Section 230 into areas that have little connection to the statute’s original purpose. As I mentioned earlier, the core of Section 230 concerns defamation and other speech-related torts. And for good reason: The restaurant review platform, for example, has no idea whether the user is right when he says the soup was cold or when she says the service was poor. Nor does the social media site have any idea whether the nosy neighbor’s online comments about the new person down the block are true or not. Civil immunity from tort litigation for online platforms in these instances makes some sense. The alternative would be a quasi-heckler’s veto, where the restaurant or neighbor could complain about the comments, and the platform would be forced to take them down for fear of civil liability.

But some websites have tried to transform Section 230 into an all-purpose immunity for claims that are far removed from speech. For example, some platforms have argued that Section 230 permits them to circumvent or ignore city ordinances on licensing of rental properties. While these types of arguments have not always succeeded, they demonstrate the potentially overbroad scope that some advocates have given the immunity.

This is a misleading summary of a complex issue. What's at issue is whether or not a service like Airbnb can be held liable for user listings on the site. But user listings are speech. Cities have every right to go after those actually posting the listings -- since they're the ones breaking the law. But many cities are trying to go after Airbnb directly, since it's easier to go after just one player.

And here's the big thing that Rosen absolutely leaves out: so far Airbnb has been losing in court. So for all his concerns that 230 is being used "beyond" what it should cover, the courts have already shut that aspect down (in my view, the courts have gone too far, in fact).

Fourth, we are concerned about the extent to which platforms have expanded the use of Section 230 to immunize taking down content beyond the types listed in the statute. Under the Good Samaritan provision, platforms have the ability to remove content that they have a “good faith” belief is “obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable.” We are told that some platforms treat this provision as a blank check, ignoring the “good faith” requirement and relying on the broad term “otherwise objectionable” as carte blanche to selectively remove anything from websites for other reasons and still claim immunity.

Perhaps there needs to be a more clear definition of “good faith,” and the vague term “otherwise objectionable” should be reconsidered. Of course, platforms can choose whether or not to remove any content on their websites. But should they automatically be granted full statutory immunity for removing lawful speech and given carte blanche as a censor if the content that is not “obscene, lewd, lascivious, filthy, excessively violent, or harassing” under the statute?

If the attack on encryption is the most ridiculous, this part is the most frivolous. First of all, having the government determine whether or not moderation choices are made in "good faith" or if they fit outside of "obscene, lewd, lascivious, filthy, excessively violent, or harassing" under the statute would almost certainly violate the 1st Amendment. Second, the removal of "otherwise objectionable" would create a massive problem for online moderation, and would, in fact bring back the "extreme online harassment" he was complaining about just a few paragraphs earlier.

Of course, we all know what is being dog-whistled in this prong: he wants to penalize platforms for "anti-conservative bias" and push for some nonsensical, impossible "neutral" standard for platforms who want 230 protections. But just the fact that this would wipe out the ability to block harassment, while at the same time he's complaining about harassment should show you how brain dead and backwards this proposal is.

This is not a serious proposal, but in this time and place, with the DOJ's backing, it has as serious chance of being put into law. It would devastate large parts of the internet, but that seems like collateral damage for a DOJ who is not focused on what's actually best for society and the economy, but rather what's best for itself.

Filed Under: cda 230, doj, encryption, intermediary liability, jeffrey rosen, section 230, william barr

Why Does The NY Times Seem Literally Incapable Of Reporting Accurately On Section 230?

from the what-the-fuck-is-going-on-over-there? dept

I should preface this piece by noting that there are good reporters at the NY Times who frequently do great work. But there are also a surprising number of dreadful reporters and editors who consistently seem to get key issues wrong. And one example of this is what appears to be a near institutional-level confusion over Section 230 of the Communications Decency Act -- and I say this even while noting that last summer, the Times had an excellent piece written by Sarah Jeong calling out politicians for misrepresenting Section 230. But she should write another piece about her own damn colleagues.

Just last fall, we covered multiple stories in which the NY Times got Section 230 so badly wrong that it often had to issue embarrassing corrections, including the time it put forth a full page massive headline blaming 230 for allowing hate speech online, only to have to later run an (online only) correction saying it was actually the 1st Amendment. That was bad. What was worse was that they kept getting it wrong all through the fall. Just a day after that first mistake, they mixed up the DMCA 512 and CDA 230, blaming CDA 230 for copyright infringement, despite the law explicitly saying it doesn't apply to intellectual property. Then there was a big piece that laughably blamed Section 230 for people dying which, astoundingly, made the identical mistake in swapping out DMCA 512 for CDA 230, and where the Times had to run the word-for-word identical correction from the previous time they had made that mistake.

So I guess it should be no surprise at all that with the latest attack on Section 230, the dangerous EARN IT Act -- which is a badly re-heated FOSTA with a lump of "break encryption" tossed on top -- the NY Times would get nearly every important detail wrong again. The original title, which has since been changed, claimed "U.S. to Hold Tech Firms Accountable for Spread of Child Sexual Imagery." But that's wrong on nearly every point. First, it's just a bill, it's not the law -- yet the title implies otherwise. This is Journalism 101 stuff that the NY Times absolutely should be better at.

Second, the bill is not about "holding firms accountable," but putting more liability on an intermediary to try to ramp up censorship -- and the whole point of the bill is to use that as a wedge by Bill Barr and the DOJ to undermine encryption. But ridiculously the NY Times, acting as stenographers for those introducing the bill, repeated the false claim that internet companies don't currently fight "child sexual exploitation material." Take, for example, this ridiculous tweet from Associate Managing Editor Dean Murphy, claiming that it's a response to "tech companies that do too little to block images of child sexual abuse."

But the whole reason the bill is coming about in the first place is that we have so much data about how widespread the issue of CSAM content is because platforms have worked closely with NCMEC to identify and delete such material, sharing hashes to block it from being reuploaded. The major platforms have gone above and beyond, including Microsoft creating PhotoDNA, which helps a bunch of platforms find, detect, and remove child exploitation photos. Facebook, Google, Twitter and more have whole teams that work on making sure such content is identified and removed rapidly. Cloudflare recently built and released similar technology for free for anyone who uses its platform (even at the free level) to find and remove exploitation images.

In other words, tech platforms have taken this issue seriously for years, and have worked hard to combat things. That's in contrast to the DOJ and Bill Barr, who have literally failed to abide by Congress' mandate to fight such material. The tech companies are handing over all the information necessary, and Barr's spending his time protecting his boss's buddies from prosecution, rather than actually going after the purveyors of child porn.

But, to the NY Times, this is all about tech companies "doing too little" and the US government finally "holding them responsible." It's utter nonsense, and the NY Times, of all papers, ought to do much better.

Filed Under: csam, earn it, encryption, intermediary liability, journalism, reporting, section 230, stenography
Companies: ny times

Senators Hawley & Feinstein Join Graham & Blumenthal In Announcing Bill To Undermine Both Encryption And Section 230

from the for-the-children dept

In late January, we had an analysis of an absolutely dreadful bill proposed by Senators Lindsey Graham and Richard Blumenthal -- both with a long history of attacking the internet -- called the EARN IT Act. The crux of the bill was that, in the name of "protecting the children," the bill would drastically change Section 230 of the Communications Decency Act, making companies liable for "recklessly" failing to magically stop "child sexual abuse material" -- opening them up to civil lawsuits for any such failures. Even worse, it would enable the Attorney General -- who has made it quite clear that he hates encryption -- to effectively force companies to build in security-destroying backdoors.

On Thurdsay, the EARN IT Act (Eliminating Abusive and Rampant Neglect of Interactive Technologies Act) was officially introduced with two additional awful Senators: from the Republican side there's tech hating Josh Hawley, and on the Democratic side, there's encryption hating Dianne Feinstein.

This version of the bill has a few changes from the draft version that made the rounds before, but in effect it is trying to accomplish the same basic things: forcing companies to backdoor encryption or lose Section 230 protections, while at the same time opening up platforms to a wide range of lawsuits (a la what we're seeing with FOSTA suits) from ambulance chasing tort lawyers trying to shake down internet platforms for money, while claiming to do so in the name of "protecting the children."

Senator Ron Wyden, who authored Section 230 decades ago, had the most succinct explanation of why the EARN IT Act is bad on multiple levels:

After the federal government spent years ignoring the law and millions of reports of the most heinous crimes against children, William Barr, Lindsey Graham and Richard Blumenthal are offering a deeply flawed and counterproductive bill in response.

This terrible legislation is a Trojan horse to give Attorney General Barr and Donald Trump the power to control online speech and require government access to every aspect of Americans' lives. It is a desperate attempt to distract from the Justice Department's failure to request the manpower, funding and resources to combat this scourge, despite clear direction from Congress more than a decade ago.

While Section 230 does nothing to stop the federal government from prosecuting crimes, these senators claim that making it easier to sue websites is somehow going to stop pedophiles.

This bill is a transparent and deeply cynical effort by a few well-connect corporations and the Trump administration to use child sexual abuse to their political advantage, the impact to free speech and the security and privacy of every single American be damned.

There are a number of key points on this, starting with the fact that Barr's DOJ has consistently failed to do what it's mandated by Congress to do in fighting against child sexual exploitation. Any news story that fails to mention this key point is failing you in not explaining the context. Barr is looking for someone to blame for his own failures, and he's picked on the politically convenient internet industry -- while simultaneously getting to undermine the encryption he hates.

Another key point in the Wyden statement is that much of the EARN IT Act is dubious and cynical, but as Berin Szoka pointed out, this is likely to make stopping actual sexual exploitation that much more difficult:

“Perversely, the EARN IT Act makes it easier to sue websites than people who actually create and disseminate CSAM,” explained Szóka. “Facing potentially staggering civil liability means website providers will have no choice but to comply with the Commission’s nominally voluntary ‘best practices.’”

In that same link, Berin highlights another Constitutional problem with the Act, which could make it much more difficult for law enforcement to track down those actually responsible for child porn -- a perverse end result, which is not unlike what we've already seen happen with sex trafficking in response to FOSTA, where police have been saying that the law has made it more difficult for them to investigate trafficking.

This is a bad bill, put forth for cynical reasons, wrapped in a insincere "protect the children" blanket -- pushed for by a crew of companies who failed to innovate on the internet, and sponsored by Senators who have a long history of making it clear that they will beat up on civil liberties and innovation at any opportunity.

Filed Under: cda 230, csam, dianne feinstein, earn it act, encryption, intermediary liability, josh hawley, lindsey graham, richard blumenthal, section 230, think of the children, william barr

Hoping To Combat ISP Snooping, Mozilla Enables Encrypted DNS

from the encrypt-ALL-the-things! dept

Historically, like much of the internet, DNS hasn't been all that secure. That's why Mozilla last year announced it would begin testing something called "DNS over HTTPS," a significant security upgrade to DNS that encrypts and obscures your domain requests, making it more difficult (though not impossible) to see which websites a user is visiting. Obviously, this puts a bit of a wrinkle in government, telecom, or other organizational efforts to use DNS records to block and filter content, or track and sell user activity.

As a result, a lot of these folks have been throwing temper tantrums in recent weeks.

The telecom sector, which makes plenty of cash selling your daily browsing habits, have spent much of the last year trying to demonize the Google and Mozilla efforts any way they can, from insisting the move constitutes an antitrust violation on Google's part (it doesn't), to saying it's a threat to national security (it's not), to suggesting it even poses a risk to 5G deployments (nah, that's an entirely different mess). Mozilla's response to telecoms' face fanning? To first urge Congress to investigate telecom's long history of privacy abuses, then proceeding this week to enable the feature by default in the Mozilla browser.

In a blog post, Mozilla explains its thinking as such:

"At the creation of the internet, these kinds of threats to people’s privacy and security were known, but not being exploited yet. Today, we know that unencrypted DNS is not only vulnerable to spying but is being exploited, and so we are helping the internet to make the shift to more secure alternatives. We do this by performing DNS lookups in an encrypted HTTPS connection. This helps hide your browsing history from attackers on the network, helps prevent data collection by third parties on the network that ties your computer to websites you visit."

While there's a lot of overheated rhetoric about the risk of DNS over HTTPS from the likes of big telecom and government surveillance aficionados, there are some legitimate concerns about the standard from more above-board cybersecurity professionals. They'll be quick to note there's several other points at which ISPs can still engage in data surveillance and sales. They'll also argue that DNS over HTTPS really complicates life for enterprise IT managers, and in some instances encrypted DNS could derail existing cybersecurity solutions or parental control solutions.

Mozilla says it's listening to these complaints, so it's starting slowly with a gradual roll out across the US only. The organization says Firefox will disable encrypted DNS if it conflicts with parental controls. The feature will also be disabled by default in enterprise configurations. Firefox's encrypted DNS will use Cloudflare by default, though users can switch to other encrypted DNS providers manually in their browser settings. Those curious about the particulars can dig through Mozilla's FAQ here.

Filed Under: browsers, dns, dns-over-https, encryption, firefox, privacy, snooping
Companies: mozilla

Law Enforcement Official Claims Citizens Use Better Encryption Than Cops Do

from the when-you-don't-understand-the-subject-but-think-you-should-offer-an-expert-o dept

Arguing against encryption is a popular law enforcement pastime. The problem is there really aren't many good arguments to be made against the use of encryption, so people like Attorney General Bill Barr and FBI Director Chris Wray have to summon up apocalyptic scenarios or beat down straw men of their own creation to score points for their side.

Given that the anti-encryption side is loaded with disingenuous intentions, it's really no surprise to see statements being made by law enforcement officials that are either stupid or lies… or maybe some combination of both. A recent NPR discussion of calls to end encryption features a real gem from an official representing a Tennessee law enforcement agency.

[NPR Host Martin] KASTE: There's been a lot of media attention lately on the FBI showdowns with Apple about opening iPhones used in terrorism. But those situations are relatively rare, given that the feds often have other ways of getting information. What's more common is that end-to-end encryption is frustrating local law enforcement - people like Cpt. Clay Anderson.

CLAY ANDERSON: It comes into play at least probably once or twice every single week.

KASTE: He supervises investigations for the sheriff's office in Humphreys County, Tenn. They get a lot of cases involving sexual exploitation - predators grooming minors via online messaging.

ANDERSON: In those cases, you run into dead ends because you can't get past encryption. I mean, who needs that type of encryption other than maybe the military with some type of sensitive operation that they're doing? You know, we don't even in law enforcement use encryption like that.

First off, YES, law enforcement uses encryption like that. Do officers carry smartphones? Then they're using "encryption like that." Are the sheriff office's internal communications and on-site databases encrypted? Then they're using "encryption like that." How about the laptops in their vehicles? I sincerely hope those are protected by "encryption like that."

"Encryption like that" apparently refers to encryption law enforcement can't break easily. In other words, encryption law enforcement doesn't have the passwords to. There's no "military-grade" encryption. Either encryption works or it doesn't. It's not a matter of "grades." These words might sound meaningful to people not familiar with encryption, but they're meaningless to anyone with the slightest familiarity with the subject.

"Military grade" meant something nearly 30 years when the government restricted the export of encryption methods that couldn't easily be broken by US agencies. The explosion of consumer products (computers, smartphones) that has occurred since that point has rendered the line between "consumer" and "military-grade" encryption nonexistent.

The military uses the same encryption consumers do. Captain Clay Anderson's parroting of Bill Barr's idiotic talking points suggesting device manufacturers start using a dumbed-down encryption method for consumer electronics is just that: idiotic. To compromise encryption millions of consumers use would also compromise the encryption the government (home of "military-grade") uses, as Bruce Schneier points out.

The thing is, that distinction between military and consumer products largely doesn't exist. All of those "consumer products" Barr wants access to are used by government officials -- heads of state, legislators, judges, military commanders and everyone else -- worldwide. They're used by election officials, police at all levels, nuclear power plant operators, CEOs and human rights activists. They're critical to national security as well as personal security.

Hopefully, Captain Anderson is just ignorant. Hopefully his officers and his department are making full use of "encryption like that." To do otherwise would be irresponsible. Or maybe Anderson is just upset he can't get all the evidence he needs by sitting at his desk. He doesn't really seem to be the best choice for investigating crimes against children.

In early September 2012, Jackie Little went to investigators with the Humphreys County Sheriff’s Office to report that she had been raped by three men.

In recorded video of her interview, Sheriff Chris Davis can be heard vowing to investigate while sitting in a room with the detective assigned to the case, Clay Anderson.

“If they’ve done this to you, we’re going prosecute them. We’re going to prosecute them wide open,” Davis said.

But our investigation found Anderson never even attempted to gather DNA evidence, didn’t seek out one piece of potential video and interviewed the three suspects several months after the rape was reported.

Anderson was twice recommended for termination by other law enforcement agencies, but resigned before termination could occur, leaving him free to join this department and add his, um, "skills" to their investigatory unit. Now, he's the regional face of "going dark" and his arguments are proving to be just as questionable as his law enforcement career.

Filed Under: clay anderson, encryption, law enforcement

Barr's Motives, Encryption and Protecting Children; DOJ 230 Workshop Review, Part III

from the don't-break-the-internet dept

In Part I of this series on the Department of Justice’s February 19 workshop, “Section 230 — Nurturing Innovation or Fostering Unaccountability?” (archived video and agenda), we covered why Section 230 is important, how it works, and how panelists proposed to amend it. Part II explored Section 230’s intersection with criminal law.

Here, we ask what DOJ’s real objective with this workshop was. The answer to us seems clear: use Section 230 as a backdoor for banning encryption — a “backdoor to a backdoor” — in the name of stamping out child sexual abuse material (CSAM) while, conveniently, distracting attention from DOJ’s appalling failures to enforce existing laws against CSAM. We conclude by explaining how to get tough on CSAM to protect kids without amending Section 230 or banning encryption.

Banning Encryption

In a blistering speech, Trump’s embattled Attorney General, Bill Barr, blamed the 1996 law for a host of ills, especially the spread of child sexual abuse material (CSAM). But he began the speech as follows:

[Our] interest in Section 230 arose in the course of our broader review of market-leading online platforms, which we announced last summer. While our efforts to ensure competitive markets through antitrust enforcement and policy are critical, we recognize that not all the concerns raised about online platforms squarely fall within antitrust. Because the concerns raised about online platforms are often complex and multi-dimensional, we are taking a holistic approach in considering how the department should act in protecting our citizens and society in this sphere.

In other words, the DOJ is under intense political pressure to “do something” about “Big Tech” — most of all from Republicans, who have increasingly fixated on the idea that “Big Tech” is the new “Liberal Media” out to get them. They’ve proposed a flurry of bills to amend Section 230 — either to roll back its protections or to hold companies hostage, forcing them to do things that really have nothing to do with Section 230, like be "politically neutral" (the Hawley bill) or ban encryption (the Graham-Blumenthal bill), because websites and Internet services simply can’t operate without Section 230’s protections.

Multiple news reports have confirmed our hypothesis going into the workshop: that its purpose was to tie Section 230 to encryption. Even more importantly, the closed-door roundtable after the workshop (to which we were, not surprisingly, not invited) reportedly concluded with a heated discussion of encryption, after the DOJ showed participants draft amendments making Section 230 immunity contingent on compromising encryption by offering a backdoor to the U.S. government. Barr’s speech said essentially what we predicted he would say right before the workshop:

Technology has changed in ways that no one, including the drafters of Section 230, could have imagined. These changes have been accompanied by an expansive interpretation of Section 230 by the courts, seemingly stretching beyond the statute’s text and original purpose. For example, defamation is Section 230’s paradigmatic application, but Section 230 immunity has been extended to a host of additional conduct — from selling illegal or faulty products to connecting terrorists to facilitating child exploitation. Online services also have invoked immunity even where they solicited or encouraged unlawful conduct, shared in illegal proceeds, or helped perpetrators hide from law enforcement. ...

Finally, and importantly, Section 230 immunity is relevant to our efforts to combat lawless spaces online. We are concerned that internet services, under the guise of Section 230, can not only block access to law enforcement — even when officials have secured a court-authorized warrant — but also prevent victims from civil recovery. This would leave victims of child exploitation, terrorism, human trafficking, and other predatory conduct without any legal recourse. Giving broad immunity to platforms that purposefully blind themselves – and law enforcers – to illegal conduct on their services does not create incentives to make the online world safer for children. In fact, it may do just the opposite.

Barr clearly wants to stop online services from “going dark” through Section 230 — even though Section 230 has little (if any) direct connection to encryption. His argument was clear: Section 230 protections shouldn't apply to services that use strong encryption. That’s precisely what the Graham-Blumenthal EARN IT Act would do: greatly lower the bar for enforcement of existing criminal laws governing child sexual abuse material (CSAM), allow state prosecutions, and civil lawsuits (under a lower burden of proof), but then allow Internet services to “earn” back their Section 230 protection against this increased liability by doing whatever a commission convened and controllled by the Attorney General tells them to do.

Those two Senators are expected to formally introduce their bill in the coming weeks. Undoubtedly, they’ll refer back to Barr’s speech, claiming that law enforcement needs their bill passed ASAP to “protect the children.”

Barr’s speech on encryption last July didn’t mention 230 but went much further in condemning strong encryption. If you read it carefully, you can see where Graham and Blumenthal got their idea of lowering the standard of existing federal law on CSAM from “actual knowledge” to “recklessness, which would allow the DOJ to sue websites that offer stronger encryption than the DOJ thinks is really necessary. Specifically, Barr said:

The Department has made clear what we are seeking. We believe that when technology providers deploy encryption in their products, services, and platforms they need to maintain an appropriate mechanism for lawful access. This means a way for government entities, when they have appropriate legal authority, to access data securely, promptly, and in an intelligible format, whether it is stored on a device or in transmission. We do not seek to prescribe any particular solution. ...

We are confident that there are technical solutions that will allow lawful access to encrypted data and communications by law enforcement without materially weakening the security provided by encryption. Such encryption regimes already exist. For example, providers design their products to allow access for software updates using centrally managed security keys. We know of no instance where encryption has been defeated by compromise of those provider-maintained keys. Providers have been able to protect them. ...

Some object that requiring providers to design their products to allow for lawful access is incompatible with some companies’ “business models.” But what is the business objective of the company? Is it “A” — to sell encryption that provides the best protection against unauthorized intrusion by bad actors? Or is it “B” — to sell encryption that assures that law enforcement will not be able to gain lawful access? I hope we can all agree that if the aim is explicitly “B” — that is, if the purpose is to block lawful access by law enforcement, whether or not this is necessary to achieve the best protection against bad actors — then such a business model, from society’s standpoint, is illegitimate, and so is any demand for that product. The product jeopardizes the public’s safety, with no countervailing utility. ...

The real question is whether the residual risk of vulnerability resulting from incorporating a lawful access mechanism is materially greater than those already in the unmodified product. The Department does not believe this can be demonstrated.

In other words, companies choosing to offer encryption should have to justify their decision to do so, given the risks created by denying law enforcement access to user communications. That’s pretty close to a “recklessness” standard.

Again, for more on this, read Berin’s previous Techdirt piece. According to the most recently leaked version of the Graham-Blumenthal bill, the Attorney General would no longer be able to rewrite the “best practices” recommended by the Commission. But he would gain greater ability to steer the commission by continually vetoing its recommendations until it does what he wants. If the commission doesn’t make a recommendation, the safe harbor offered by complying with the “best practices” doesn’t go into effect — but the rest of the law still would. Specifically, website and Internet service operators would still face vague new criminal and civil liability for “reckless” product design. The commission and its recommendations are a red herring; the truly coercive aspects of the bill will happen regardless of what the commission does. If the DOJ signals that failing to offer a backdoor (or retain user data) will lead to legal liability, companies will do it — even absent any formalized “best practices.”

The Real Scandal: DOJ’s Inattention to Child Sexual Abuse

As if trying to compromise the security of all Internet services and the privacy of all users weren’t bad enough, we suspect Barr had an even more devious motive: covering his own ass, politically.

Blaming tech companies generally and encryption in particular for the continued spread of CSAM kills two birds with one stone. Not only does it offer them a new way to ban encryption, it also deflects attention from the real scandal that should appall us all: the collective failure of Congress, the Trump Administration, and the Department of Justice to prioritize the fight against the sexual exploitation of children.

The Daily, The New York Times podcast, ran part one of a two-part series on this topic on Wednesday. Reporters Michael Keller and Gabriel Dance summarized a lengthy investigative report they published back in September, but which hasn’t received the attention it deserves. Here’s the key part:

The law Congress passed in 2008 foresaw many of today’s problems, but The Times found that the federal government had not fulfilled major aspects of the legislation.

The Justice Department has produced just two of six required reports that are meant to compile data about internet crimes against children and set goals to eliminate them, and there has been a constant churn of short-term appointees leading the department’s efforts. The first person to hold the position, Francey Hakes, said it was clear from the outset that no one “felt like the position was as important as it was written by Congress to be.”

The federal government has also not lived up to the law’s funding goals, severely crippling efforts to stamp out the activity.

Congress has regularly allocated about half of the $60 million in yearly funding for state and local law enforcement efforts. Separately, the Department of Homeland Security this year diverted nearly $6 million from its cybercrimes units to immigration enforcement — depleting 40 percent of the units’ discretionary budget until the final month of the fiscal year.

So, to summarize:

1. Congress has spent has half as much as it promised to;
2. DOJ hasn’t bothered issuing reports required by law — the best way to get lawmakers to cough up promised funding; and
3. The Trump Administration has chosen to spend money on the political theatre of immigration enforcement rather than stopping CSAM trafficking.

Let that sink in. In a better, saner world, Congress would be holding hearings to demand explanations from Barr. But they haven’t, and the workshop will allow Barr to claim he’s getting tough on CSAM without actually doing anything about it — while also laying the groundwork for legislation that would essentially allow him to ban encryption.

Even for Bill Barr, that’s pretty low.

Filed Under: cda 230, congress, csam, doj, encryption, funding, section 230, william barr

Russia's War On Encryption Stumbles Forth With Ban Of Tutanota

from the what-are-you-so-afraid-of dept

The Russian government continues to escalate its war on encrypted services and VPNs. For years now, Putin's government has slowly but surely taken steps to effectively outlaw secure communications, framing the restrictions as essential for national security, with the real goal of making it harder than ever for Russian citizens to dodge the Putin government's ever-expanding surveillance ambitions.

The latest case in point: starting last Friday, the Russian government banned access to encrypted email service Tutanota, without bothering to provide the company with much of any meaningful explanation:

In a blog post, the company notes that Tutanota has been blocked in Egypt since October of last year, and that impacted users should attempt to access the service via a VPN or the Tor browser:

"Encrypted communication is a thorn in the side to authoritarian governments like Russia as encryption makes it impossible for security services to eavesdrop on their citizens. The current blocking of Tutanota is an act against encryption and confidential communication in Russia.

...We condemn the blocking of Tutanota. It is a form of censorship of Russian citizens who are now deprived of yet another secure communication channel online. At Tutanota we fight for our users’ right to privacy online, also, and particularly, in authoritarian countries such as Russia and Egypt.

Except VPNs have been under fire in Russia for years as well. Back in 2016 Russia introduced a new surveillance bill promising to deliver greater security to the country. Of course, as with so many similar efforts around the world the bill actually did the exact opposite -- not only mandating new encryption backdoors, but also imposing harsh new data-retention requirements on ISPs and VPN providers forced to now register with the government. As a result, some VPN providers, like Private Internet Access, wound up leaving the country after finding their entire function eroded and having some of their servers seized.

Last year Russia upped the ante, demanding that VPN providers like NordVPN, ExpressVPN, IPVanish, and HideMyAss help block forbidden websites that have been added to Russia's censorship watchlist. And last January, ProtonMail (and ProtonVPN) got caught up in the ban as well after it refused to play the Russian government's registration games. While Russian leaders want the public to believe these efforts are necessary to ensure national security, they're little more than a giant neon sign advertising Russian leaders' immense fear of the Russian public being able to communicate securely.

Filed Under: encryption, russia
Companies: tutanota

How Attorney General Barr's War On Encryption Will Harm Our Military

from the stop-it-guys dept

We've highlighted in the past that there are large parts of the federal government that recognize that strong encryption is actually very, very important for national security, and that the framing by Attorney General William Barr, FBI Director Christopher Wray, and even President Trump -- that there need to be back doors to encryption for "security" reasons -- is utter nonsense. The intelligence community has long recognized the importance of strong encryption. Even many people within the FBI think their bosses' position on this issue is bonkers. Late last year, we were pleasantly surprised to see the Defense Department step up as well, with a letter to Congress talking about just how important encryption is for national security.

Over at Cyberscoop, former National Security Council cybersecurity expert Ari Schwartz has a nice article explaining just how important encryption is to protecting the military. It won't tread any new ground for anyone who understands the basics here, but it's nice to see more and more people highlighting this.

Last month, a brigade of U.S. soldiers deployed to the Middle East received instructions from their superiors to use two commercial encrypted messaging applications, Signal and Wickr, on their government issued cell phones. These leadership cues trickled down from the Department of Defense’s (DoD) position that strong encryption is critical to national security. While U.S. Attorney General William Barr continues to push for a broad mandate for backdoors for law enforcement, those on the front lines of protecting America have notably decided on a different approach. Simply put, weakening encryption means putting our military service members at risk.

The key point -- and one that many of us have made for years is that the framing by Wray/Barr (and, for what it's worth, James Comey before them) is that there's some sort of conflict here between "security" and "privacy." But that's always been bullshit. The issue has always been between having both security and privacy vs. giving law enforcement easier access to data and information they can almost always get elsewhere with a little more effort. In short, it's a debate between having security and privacy widely available against a bit of convenience for law enforcement. As such, this should be no debate at all.

Let’s stop wasting time suggesting that we need universal solutions that may solve law enforcement’s short-term needs, but then put consumers and our military at risk.

Somehow, I don't think the time wasting is going to go away any time soon, unfortunately.

Filed Under: dod, doj, encryption, going dark, military, national security, william barr

Court Order Shows DEA Demanding Tons Of Data From WhatsApp And Bunch Of Other Service Providers

from the routing-around-encryption dept

Encryption may be posing problems for law enforcement investigations, but the problems are not as insurmountable or widespread as certain encryption critics are portraying them. Enormous amounts of data are created by cellphone app users every time they communicate. While the content of communications is often of more evidentiary value, there's still a wealth of information investigators can obtain that isn't protected by encryption.

As investigators are getting more creative, they're also getting more careless. Thomas Brewster of Forbes reports the US government is trying to force WhatsApp to turn over information it has no right to demand from the company -- which also includes information WhatsApp may not even have.

[T]he order, unsealed on New Year’s Eve, asked for information WhatsApp wouldn’t ever provide. That included the identity of other WhatsApp accounts that were created using the same IP address, recovery email, telephone number “or other identifiers”. Investigators at the DEA also wanted the “identity of all accounts that are linked to the account by cookies,” —cookies being little programs that keep track of people’s use of different applications. Then they demanded “IP addresses of any websites or other servers to which the cellphone device or devices connected.” And finally they wanted “post-cut-through dialed digits”—the numbers hit by the user once a call is started.

WhatsApp told Forbes it doesn't collect much of the information being sought here. As for the "post-cut-through dialed digits," those could be considered communications content in certain cases, meaning the trap/trace request being used here is insufficient under the Fourth Amendment. A warrant is required to obtain communications but it appears no warrant has been served to WhatsApp. However, a footnote in the order says the government will make no "affirmative investigative use" of any post-cut-through digits determined to be content. But that puts everyone in the position of trusting an agency known for its liberal use of parallel construction to launder evidence it has questionably obtained.

Investigators aren't limiting themselves to WhatsApp. The search for a Mexican meth dealer runs through a number of other tech companies that might be linked to the WhatsApp user the government is targeting.

[T]he order went further still, telling not only WhatsApp, but also Google and a host of telecom providers or “any other provider of any wire or electronic communications service” to provide a range of more detailed data on any accounts tracked by Facebook’s encrypted chat apps. That included names, addresses, email addresses and credit card numbers.

The data demands were also made of a number of other companies -- data the DEA wanted 24/7 access to as it was gathered. From the proposed order [PDF]:

The United States further requests, pursuant to 18 U.S.C. § 2703(c) and (d), that WhatsApp Inc., Cingular Wireless, Sprint Nextel Corporation, Leap Wireless Communications, Inc., Cricket Communications, T-Mobile USA, Cellco Partnership d/b/a Verizon Wireless, AT&T Wireless, Google, and/or any other provider of wire communications service, provide subscriber information as defined in 18 U.S.C. § 2703(c)(2) pursuant to this Order for the accounts revealed by the pen-trap devices to the DEA.

Along with the always-on access, the DEA demanded 24/7 silence from all targeted companies for one year. The silence didn't last, though. WhatsApp challenged the gag order and managed to get this proposed order (which was granted by the judge) unsealed.

The order is broad and it affects a number of service providers. And the order has no end date, allowing the government to harvest metadata and personal info on an ongoing basis in perpetuity. It appears the order was approved the same day the application was made, which strongly suggests the judge did not ask for anything to be modified by the DEA.

Encryption works. It keeps communications secure. But just because there's a wealth of data being generated doesn't mean the government is entitled to all of it. The order shows the DEA has an undercover agent in communication with the target so it's not as if the government is locked out of all communications. The digital playing field has resulted in altered strategies but it did not throw out the rulebook. The loss of a wiretap option doesn't grant permission to operate a data dragnet.

Filed Under: 4th amendment, communications, dea, encryption, warrant
Companies: facebook, whatsapp

Lindsey Graham's Sneak Attack On Section 230 And Encryption: A Backdoor To A Backdoor?

from the if-it-aint-broke dept

Both Republicans and Democrats have been talking about amending Section 230, the law that made today’s Internet possible. Most politicians are foggy on the details, complaining generally about “Big Tech” being biased against them (Republicans), “not doing enough” about harmful content (Democrats, usually), or just being too powerful (populists on both sides). Some have promised legislation to amend, while others hope to revoke Section 230 entirely. And more bills will doubtless follow.

Rather than get mired in the specifics about how tinkering with Section 230 could backfire, Sen. Lindsey Graham is circulating a draft bill called the “Eliminating Abusive and Rampant Neglect of Interactive Technologies Act of 2019” — the “EARN IT Act of 2019,” leaked by Bloomberg yesterday. Democratic Sen. Richard Blumenthal has apparently been involved in drafting.

At first blush, the bill may seem uncontroversial: it would create a presidential commission of experts to “develop recommended best practices for providers of interactive computer services regarding the prevention of online child exploitation conduct.” Who could argue with that? Indeed, given how little lawmakers understand online content moderation, getting analysis and recommendations from real experts about Section 230 is probably the only way out of the increasingly intractable, empty debate over the law.

But what Graham’s bill would actually do is give the Attorney General a blank check to bypass Congress in cracking down on Internet services in ways that may have little to do with child sexual abuse material (CSAM). Specifically, the bill would:

1. Amend Criminal Law & Section 230: Section 230 has never shielded operators of websites and Internet services from federal criminal prosecution for CSAM. But the Graham bill would create broad new legal risks by lowering the (actual) knowledge requirement from “knowingly” to “recklessly” (which would include an after-the-fact assessment of what the company “should have known”) and amending Section 230 to authorize both criminal prosecution and civil suits under state law. For the first time, operators could be sued by plaintiff’s lawyers in class-action suits for “reckless” decisions in designing or operating their sites/services.

2. Condition Section 230 Immunity: The commission’s (a) recommended “best practices” would quickly become (b) conditions for invoking Section 230 immunity against greatly expanded liability for CSAM — immunity so vital to the operation of many online services that (c) the conditions would be tantamount to legal mandates.

As drafted, Graham’s bill entails a shocking abandonment of the most basic principles of how administrative agencies make rules — based on the fiction that the “best practices” wouldn’t be effectively mandatory — by allowing the AG to bypass Congress on other controversial issues like mandatory age verification or even encryption. As I told Bloomberg: “The absolute worst-case scenario could easily become reality: DOJ could effectively ban end-to-end encryption.” Signal, Telegram and Whatsapp all could no longer exist in their current form. All would be required to build in backdoors for law enforcement because all could be accused of “recklessly” designing their products to make it impossible for the operators or law enforcement to stop CSAM sharing. The same could happen for age verification mechanisms. It’s the worst kind of indirect regulation. And because of the crazy way it's done, it could be hard to challenge in court.

The rhetorical premise of the “EARN IT” Act — that Section 230 was a special favor that tech companies must continually “earn” — is false. Republicans have repeatedly made this claim in arguing that only “neutral” platforms “deserve” Section 230’s protections, and Democrats likewise argue that website operators should lose Section 230’s protections if they don’t “do more” to combat disinformation or other forms of problematic speech by users.

Congress has never conditioned Section 230 in the way Graham’s bill would do. Section 230, far from being a special favor or subsidy to tech companies, was crafted because, without its protections, website operators would have been discouraged from taking active measures to moderate user content — or from hosting user-generated content altogether, often referred to as the “moderator’s dilemma.”

Here’s how Graham’s monstrous, Rube-Goldberg-esque legal contraption would work in practice. To understand which services will be affected and why they’d feel compelled to do whatever DOJ commands to retain their Section 230 immunity, we’ll unpack the changes to criminal law first.

Step #1: Expanding Legal Liability

Graham’s bill would amend existing law in a variety of ways, mostly paralleling SESTA-FOSTA: while the 2018 law expanded the federal prostitution law (18 U.S.C. § 1591, 2421A), the Graham bill focuses on “child exploitation” imagery (child porn). (Note: To help prosecutors prosecute sex trafficking, without the need for any amendment to Section 230, TechFreedom supported toughening 18 U.S.C. § 1591, 2421A to cover trafficking of minors when FOSTA was a stand-alone bill — but opposed marrying FOSTA with SESTA, the Senate bill, which unwisely amended Section 230.) Specifically, the Graham bill would:

1. Create a new civil remedy under 18 U.S.C. § 2255 that extends to suits brought against an “interactive computer service” for reckless § 2252 violations;

2. Amend Section 230(e) to exclude immunity for state criminal prosecution for crimes coextensive with § 2252; and

3. Amend Section 230(e) to exclude immunity for civil causes of action against an “interactive computer service” pursuant to other state laws if the underlying claim constitutes a violation of § 2252 (or by operation of § 2255(a)(1)). Most notably, this would open the door to states to authorize class-action lawsuits brought by entrepreneurial trial lawyers — which may even be a greater threat than criminal prosecution since the burden of proof would be lower (even though, in principle, a civil plaintiff would have to establish that a violation of criminal law had occurred under Section 2252).

The Graham bill goes further than SESTA-FOSTA in two key respects:

1. It would lower the mens rea (knowledge) requirement from “knowingly” to “recklessly,” making it considerably easier to prosecute or sue operators; and

2. Allow for state criminal and civil prosecution for hosting child exploitation imagery that could violate § 2252).

In a ploy to make their bill seem less draconian, SESTA-FOSTA’s sponsors loudly proclaimed that they preserved “core” parts of Section 230’s immunity. Graham will no doubt do the same thing. Both bills leave untouched Section 230(c)(2)(A)’s immunity for “good faith” content removal decisions. But this protection is essentially useless against prosecutions for either sex trafficking or CSAM. In either case, the relevant immunity would be Section 230(c)(1), which ensures that ICS operators are not held responsible as “publishers” for user content. The overwhelming majority of cases turn on that provision — and that is the provision that Graham’s bill conditions on compliance with the AG’s “best practices.”

Step #2: How a “Recommendation” Becomes a Condition to 230

The bill seems to provide an important procedural safeguard by requiring consensus — at least 10 of the 15 commissioners — for each recommended “best practice.” But the chairman (the FTC chairman or his proxy) could issue his own “alternative best practices” with no minimum level of support. The criteria for membership ensure that he’d be able to command at least a majority of the commission, with the FTC, DOJ and Department of Homeland Security each getting one seat, law enforcement getting two, prosecutors getting two more — that’s seven just for government actors — plus two more for those with “experience in providing victims services for victims of child exploitation” — which makes nine reliable votes for “getting tough.” The remaining six Commissioners would include two technical experts (who could turn out to be just as hawkish) plus two commissioners with “experience in child safety” at a big company and two more from small companies. So the “alternative” recommendations would almost certainly command a majority anyway.

More importantly, it doesn’t really matter what the Commissioners recommend: the Attorney General (AG) could issue a radically different set of “best practices” — without public comment. He need only explain why he modified the Commission’s recommendations.

What the AG ultimately issues would not just be recommendations. No, Graham’s bill would empower the AG to enact requirements for enjoying Section 230’s protections against a range of new civil lawsuits and from criminal prosecutions related to “child exploitation” or “child abuse” — two terms that the bill never defines.

Step #3: How Conditioning 230 Eligibility Amounts to a Mandate

Most websites and services, especially the smallest ones, but even the largest ones, simply couldn’t exist if their operators could be held civilly liable for what their users do and say — or if they could be prosecuted under an endless array of state laws. But it’s important to stress at the outset that Section 230 immunity isn’t anywhere near as “absolute” or “sweeping” as its critics claim. Despite the panic over online sex trafficking that finally led Congress, in 2018, to pass SESTA-FOSTA, Section 230 never hindered federal criminal prosecutions. In fact, the CEO of Backpage.com — the company at the center of the controversy over Section 230 — pled guilty to facilitating prostitution (and money laundering) the day after SESTA-FOSTA became law in April 2018. Prosecutors didn’t need a new law, as we stressed at the time.

Just as SESTA-FOSTA created considerable new legal liability for websites for sex trafficking, Graham’s bill does so for CSAM (discussed below) — which makes Section 230 an even more critical legal shield and, in turn, makes companies more willing to follow whatever requirements might be attached to that legal shield.

How Broad Could the Bill’s Effects Be?

Understanding the bill’s real-world effects depends on three separate questions:

1. What counts as “child exploitation” and “child abuse?”

2. Which companies would really need Section 230 protection against new, expanded liability for CSAM?

3. What could be the scope of the AG’s conditions to 230 liability? Must they be related to conduct covered by Section 230?

What Do We Mean by “Child Exploitation” and “Child Abuse?”

The bill’s title focuses on “child exploitation” but the bill also repeatedly talks about “child abuse” — without defining either term. The former comes from the title of 18 U.S.C. § 2252, which governs the “visual depiction involves the use of a minor engaging in sexually explicit conduct” (CSAM). The bill directly invokes that bedrock law, so one might assume that’s what Graham had in mind. There is a federal child abuse law but it’s never mentioned in the bill.

This lack of clarity becomes a significant problem because, as discussed below, the bill is so broadly drafted that the AG could mandate just about anything as a condition of Section 230 immunity.

Which Websites & Services Are We Talking About?

Today, every website and Internet service operator faces some legal risk for CSAM. At greatest risk are those services that allow users to communicate with each other in private messaging or groups, or to share images or videos, because this is how CSAM is most likely to be exchanged. Those who traffic in CSAM are known to be highly creative in finding unexpected places to interact online — just as terrorist groups may use chat rooms in video games to hold staff meetings.

It’s hard to anticipate all the services that might be affected by the Graham bill, but it’s safe to bet that any messaging, photo-sharing, video-hosting or file-sharing tool would consider the bill a real threat. At greatest risk would be services that cannot see what their users do because they offer end-to-end encryption. They risk being accused of making a “reckless” design decision if it turns out that their users share CSAM with each other.

What De Facto Requirements Are We Talking About?

Again, Graham’s bill claims a narrow scope: “The purpose of the Commission is to develop recommended best practices for providers of interactive computer services regarding the prevention of online child exploitation conduct.”

The former term (ICS) is the term Section 230 uses to refer to covered operators: a service, system or software that “provides or enables computer access by multiple users to a computer server.” You might think the Graham bill’s use of this term means the bill couldn’t be used to force Apple to change how it puts E2EE on iPhones — because the iPhone, unlike iMessage, is not an ICS. You might also think that the bill couldn’t be used to regulate things that seem unrelated to CSAM — like requiring “fairness” or “neutrality” in content moderation practices, as Sen. Hawley has proposed and Graham has mentioned repeatedly.

But the bill won’t actually stop the AG from using this bill to do either. The reason is the same in both cases: this is not how legislation normally works. In a normal bill, Congress might authorize the Federal Communications Commission to do something — say, require accessibility features for disabled users of communications services. The FCC could then issue regulations that would have to be reasonably related to that purpose and within its jurisdiction over “communications.” As we know from the 2005 American Library decision, the FCC can’t regulate after the process of “communications” has ended — and thus had no authority to require television manufacturers to build in “broadcast flag” technology on their devices to ensure that, once the device received a broadcast signal, it could not make copies of the device unless authorized by the copyright holder.

But that’s not how Graham’s bill would work. A company that only makes devices, or installs firmware or operating system on them, may not feel compelled to follow the AG’s “best practices” because it does not operate an ICS, and, as such, could not claim Section 230 content (and is highly unlikely to be sued for what its users do anyway). But Apple or Google, in addition to doing these things, also operate multiple ICSes. Nothing in the Graham bill would stop the AG from saying that Apple would lose its Section 230 immunity for iMessage, iCloud or any ICS if it does not build in a backdoor on iPhones for law enforcement. Apple would likely comply. And even if Apple resists, smaller companies with fewer legal resources would likely cave under pressure.

In fact, the Graham bill specifically includes, among ten “matters addressed,” the “retention of evidence and attribution or user identification data relating to child exploitation or child sexual abuse, including such retention by subcontractors” — plus two other prongs relating to identifying such material. While these may appear to be limited to CSAM, the government has long argued that E2EE makes it impossible for operators either to identify or retain CSAM — and thus that law enforcement must have a backdoor and/or that operators must be able to see everything their users do (the opposite of E2EE).

Most of the “matters addressed” pertain to child exploitation (at least in theory) but one other stands out: “employing age limits and age verification systems.” Congress tried to mandate minimum age limits and age verification systems for adult materials back in the Child Online Protection Act (COPA) of 1998. Fortunately, that law was blocked in court in a protracted legal battle because adults have a right to access sensitive content without being subjected to age verification — which generally requires submitting a credit card, and thus necessarily entails identifying oneself. (The court also recognized publishers’ rights to reach privacy-sensitive users.)

Rep. Bart Stupak’s (D-MI) ‘‘Online Age Verification and Child Safety Act’’ of 2009 attempted to revive age verification mandates, but died amidst a howl of protest from civil libertarians. But, like banning E2EE, this is precisely the kind of thing the AG might try to mandate under Graham’s bill. And, critically, the government would argue that the bill does not present the same constitutional questions because it is not a mandate, but rather merely a condition of special immunity bestowed upon operators as a kind of subsidy. Courts should protect us from “unconstitutional conditions,” but given the state of the law and the difficulty of getting the right parties to sue, don’t count on it.

These “matters addressed” need not be the only things the Commission recommends. The bill merely says the “[t]he matters addressed by the recommended best practices developed and submitted by the Commission … shall include [the ten things outlined in the bill].” The Commission could “recommend” more — and the AG could create whatever conditions to Section 230 liability he felt he could get away with, politically. His sense of shame, even more than the courts or Congress, would determine how far the law could stretch.

It wouldn’t be hard to imagine this AG (or AGs of, sadly, either party) using the bill to reshape moderation practices more generally. Republicans increasingly argue that social media are “public fora” to which people like Alex Jones or pseudo-journalistic outlets like Gateway Pundit have First Amendment rights of access. Under the same crazy pseudo-logic, the AG might argue that, the more involved the government becomes in content moderation through whatever conditions he imposes on Section 230 immunity, the more essential it is that website operators “respect the free speech rights” of users. Ultimately, the Commission would operate as a censorship board, with murky but enormous powers — and the AG would be the ultimate censor.

If this sounds like a crazy way to make law, it is! It’s free-form lawmaking — not “we tell what you must do” (and you can raise constitutional objections in court) but rather “we’re not gonna tell you what to do, but if you don’t want to be sued or prosecuted under vague new sex trafficking laws, you’d better do what we tell you.” Once the Commission or the AG strays from “best practice” recommendations that strictly related to CSAM, then the floodgates are open to politically motivated back-door rulemaking that leave platforms with no input and virtually no avenue for appeal. And even if the best practices are related to CSAM, the way the Commission makes what amounts to law will still be unprecedented, secretive, arbitrary and difficult to challenge in court.

Other Key Aspects of How the Bill Would Work

The bill would operate as follows:

• The bill allows 90 days Commissioners to be appointed, 60 days for the Commission’s first meeting, and 18 months to make its first set of recommendations — 25 months in total. The leaked draft leaves blankr the window in which the AG must issue his “best practices.”

• Those would de facto requirements would not become legally valid until publication in the Federal Register — which usually takes a month but which sometimes drags out indefinitely.

• Operators would have 1 year to submit a written certification of their compliance.

• If, say, the next administration drags its feet and the AG never issues “best practices,” the bill’s amendments to Section 230 and criminal law go into effect four years after enactment — creating sweeping new liability for CSAM and removing Section 230’s protections.

• The Commission and AG will go through the whole farce again at least every two years.

The bill also grants DOJ broad subpoena power to determine whether operators are, in fact, living up to their certification of compliance with the AG’s “best practices.” Expect this power to be used aggressively to turn tech companies inside out.

Conclusion

In the end, one must ask: what problem is the Graham bill trying to solve? Section 230 has never prevented federal criminal prosecution of those who traffic in CSAM — as more than 36,000 individuals were between 2004 and 2017. Website operators themselves already have enormous legal liability for CSAM — and can be prosecuted by the Department of Justice for failing to cooperate with law enforcement, just as Backpage executives were prosecuted under Federal sex trafficking before SESTA-FOSTA (and plead guilty).

The Graham bill seems to be designed for one overarching purpose: to make services that offer end-to-end encryption effectively illegal, and ensure that law enforcement (and the intelligence agencies) has a backdoor into every major communications platform.

That would be outrageous enough if it were done through a direct mandate, but doing it in the roundabout way Graham’s bill proposes is effectively a backdoor to a backdoor. Unfortunately, that doesn’t mean the bill might not suddenly move quickly through Congress, just as SESTA did. Be ready: the “Cryptowars” may finally turn very, very hot.

Filed Under: encryption, fosta, lindsey graham, privacy, section 230, sesta