Senator Wyden And Others Introduce Bill Calling The DOJ's Bluff Regarding Its Attempt To Destroy Section 230 & Encryption

from the should-be-called-the-do-your-job-bill dept

One of the key points we've been making concerning Attorney General William Barr and his DOJ's eager support for the terrible EARN-IT Act, is that much of it really seems to be to cover up the DOJ's own failings in fighting child porn and child exploitation. The premise behind the EARN IT Act is that there's a lot of child exploitation/child abuse material found on social media... and that social media companies should do more to block that content. Of course, if you step back and think about it, you'd quickly realize that this is a form of sweeping the problem under the rug. Rather than actually tracking down and arresting those exploiting and abusing children, it's demanding private companies just hide the evidence of those horrific acts.

And why might the DOJ and others be so supportive of sweeping evidence under the rug and hiding it? Perhaps because the DOJ and Congress have literally failed to live up to their mandates under existing laws to actually fight child exploitation. Barr's DOJ has been required under law to produce reports showing data about internet crimes against children, and come up with goals to fight those crimes. It has produced only two out of the six reports that were mandated over a decade ago. At the same time, Congress has only allocated a very small budget to state and local law enforcement for fighting internet child abuse. While the laws Congress passed say that Congress should give $60 million to local law enforcement, it has actually allocated only about half of that. Oh, and Homeland Security took nearly half of its "cybercrimes" budget and diverted it to immigration enforcement, rather than fighting internet crimes such as child exploitation.

So... maybe we should recognize that the problem isn't social media platforms, but the fact that Congress and law enforcement -- from local and state up to the DOJ -- have literally failed to do their job.

At least some elected officials have decided to call the DOJ's bluff on why we need the EARN IT Act. Led by Senator Ron Wyden (of course), Senators Kirsten Gillbrand, Bob Casey, Sherrod Brown and Rep. Anna Eshoo have introduced a new bill to actually fight child sex abuse online. Called the Invest in Child Safety Act, it would basically make law enforcement do its job regarding this stuff.

The Invest in Child Safety Act would direct $5 billion in mandatory funding to investigate and target the pedophiles and abusers who create and share child sexual abuse material online. And it would create a new White House office to coordinate efforts across federal agencies, after DOJ refused to comply with a 2008 law requiring coordination and reporting of those efforts. It also directs substantial new funding for community-based efforts to prevent children from becoming victims in the first place.

Basically, the bill would do a bunch of things to make sure that law enforcement is actually dealing with the very real problem of child exploitation, rather than demanding that internet companies (1) sweep evidence under the rug, and (2) break encryption:

• Quadruple the number of prosecutors and agents in DOJ’s Child Exploitation and Obscenity Section from 30 FTEs to 120 FTEs;
• Add 100 new agents and investigators for the Federal Bureau of Investigation’s Innocent Images National Initiative, Crimes Against Children Unit, Child Abduction Rapid Deployment Teams, and Child Exploitation and Human Trafficking Task Forces;
• Fund 65 new NCMEC analysts, engineers, and mental health counselors, as well as a major upgrade to NCMEC’s technology platform to enable the organization to more effectively evaluate and process CSAM reports from tech companies;
• Double funding for the state Internet Crimes Against Children (ICAC) Task Forces;
• Double funding for the National Criminal Justice Training Center, to administer crucial Internet Crimes Against Children and Missing and Exploited Children training programs;
• Increase funding for evidence-based programs, local governments and non-federal entities to detect, prevent and support victims of child sexual abuse, including school-based mental health services and prevention programs like the Children’s Advocacy Centers and the HHS’ Street Outreach Program;
• Require tech companies to increase the time that they hold evidence of CSAM, in a secure database, to enable law enforcement agencies to prosecute older cases;
• Establish an Office to Enforce and Protect Against Child Sexual Exploitation, within the Executive Office of the President, to direct and streamline the federal government’s efforts to prevent, investigate and prosecute the scourge of child exploitation;
• Require the Office to develop an enforcement and protection strategy, in coordination with HHS and GAO; and
• Require the Office to submit annual monitoring reports, subject to mandatory Congressional testimony to ensure timely execution.

While I always have concerns about law enforcement mission creep and misguided targeting of law enforcement efforts, hopefully everyone can agree that child exploitation does remain a very real problem, and one that law enforcement should be investigating and going after those who are actually exploiting and abusing children. This bill would make that possible, rather than the alternative approach of just blaming the internet companies for law enforcement's failure to take any of this seriously.

Filed Under: csam, doj, earn it, exploitation, funding, intermediary liability, law enforcement, section 230

News Orgs Attack Big Tech For Being Bad For Privacy... While Their Lobbying Against Big Tech Will Harm Privacy

from the guys,-come-on dept

It's kind of difficult to take "privacy advocates" seriously if they're supportive of the EARN IT Act and its structure that would effectively enable the Attorney General to ban real encryption. That's why it was so ridiculous that vocal privacy advocate non-profit EPIC (in the midst of a truly horrifying scandal in which its President exposed employees to COVID-19 without telling them) came out in favor of the EARN IT Act. As with so much that EPIC does, the issue was more that they saw EARN IT as "anti-big tech companies" and to hell with how it actually impacts privacy and encryption.

This is an ongoing problem. Many people who (whether for good reasons or not) dislike big internet companies seem way too willing to embrace bills that appear aimed against them as a sort of "stick it to them" attack, rather than recognizing the long term impact of those bills. We've seen that in the past with bills from the EU's Copyright Directive, the GDPR, and the California Consumer Privacy Act (CCPA), all of which some groups supported solely because it would "be bad" for Google, Facebook and other internet giants, without recognizing the wider impact.

Apparently we can add big news publishers to this list as well. While papers like the NY Times and the Washington Post have run a bunch of stories about how "big tech" is bad about privacy, it's difficult to take them seriously when their lobbyists are out there lobbying in favor of a bill that would ban encryption. And yet, there is the News Media Alliance, formerly the Newspaper Association of America, cheerfully attacking Section 230 of the CDA (which, someone should remind them, all of their websites rely on...) at the DOJ's hearing back in February. Because the EARN IT Act is structured in a way to try to play Section 230 and encryption off of one another, the News Media Alliance's support of attacking 230 gives cover to the EARN IT Act's effective chipping away at encryption.

And that should greatly concern all of the journalists who work for these newspapers, like the NY Times and the Washington Post among others. Reporters at those newspapers rely heavily on encryption as they cultivate sources. And the newspapers themselves rely strongly on Section 230 to protect them against bogus SLAPP suits, even as they pretend that Section 230 is a "special favor" for large tech companies.

The end result, as with EPIC, is that it seems that the focus on "big internet companies are the problem" means that they're compromising on their own principles in order to "punish" the big internet companies. Suggesting Section 230 should be amended gives cover to the plan to trade Section 230 protections for undermining encryption -- thereby undermining both. And that's really dangerous, given that news reporters and news sites rely on both strong encryption and on Section 230.

The News Media Alliance is playing a dangerous game, while being blinded by its dislike of big internet companies.

Filed Under: cda 230, earn it, earn it act, encryption, section 230

Signal Speaks Out About The Evils Of The EARN IT Act

from the speak-out,-in-encrypted-fashion dept

Signal, the end-to-end encrypted app maker, doesn't really need Section 230 of the Communications Decency Act. It can't see what everyone's saying via its offering anyway, so there's little in the way of moderation to do. But, still, it's good to see it come out with a strong condemnation of the EARN IT Act, which as been put forth by Senators Lindsey Graham, Richard Blumenthal, Dianne Feinstein, and Josh Hawley as a way to undermine both Section 230 of the CDA and end-to-end encryption in the same bill. The idea is to effectively use one as a wedge against the other. Under the bill, companies will have to "earn" their 230 protections, by putting in place a bunch of recommended "best practices" which can be effectively put in place by the US Attorney General -- the current holder of which, Bill Barr, has made clear that he hates end-to-end encryption and thinks its a shame the DOJ can't spy on everyone. And this isn't just this administration. Law enforcement officials, such as James Comey under Obama, were pushing this ridiculous line of thinking as well.

To be clear, the EARN IT Act might not have a huge direct impact on a company like Signal -- since it doesn't really much rely on 230 protections (though it might at the margins). But it's good to see that it recognizes what a terrible threat the EARN IT Act would be:

It is as though the Big Bad Wolf, after years of unsuccessfully trying to blow the brick house down, has instead introduced a legal framework that allows him to hold the three little pigs criminally responsible for being delicious and destroy the house anyway. When he is asked about this behavior, the Big Bad Wolf can credibly claim that nothing in the bill mentions “huffing” or “puffing” or “the application of forceful breath to a brick-based domicile” at all, but the end goal is still pretty clear to any outside observer.

However as Signal makes clear, getting rid of end-to-end encryption is much more likely to harm everyone, without providing much help to law enforcement in the first place:

Bad people will always be motivated to go the extra mile to do bad things. If easy-to-use software like Signal somehow became inaccessible, the security of millions of Americans (including elected officials and members of the armed forces) would be negatively affected. Meanwhile, criminals would just continue to use widely available (but less convenient) software to jump through hoops and keep having encrypted conversations.

There is still time to make your voice heard. We encourage US citizens to reach out to their elected officials and express their opposition to the EARN IT bill. You can find contact information for your representatives using The Electronic Frontier Foundation’s Action Center.

Stay safe. Stay inside. Stay encrypted.

Filed Under: communications, earn it, encryption, intermediary liability, secrecy, section 230
Companies: signal

The EARN IT Act Creates A New Moderator's Dilemma

from the moderate-perfectly-or-else dept

Last month, a bipartisan group of U.S. senators unveiled the much discussed EARN IT Act, which would require tech platforms to comply with recommended best practices designed to combat the spread of child sexual abuse material (CSAM) or no longer avail themselves of Section 230 protections. While these efforts are commendable, the bill would cause significant problems.

Most notably, the legislation would create a Commission led by the Attorney General with the authority to draw up a list of recommended best practices. Many have rightly explained that AG Barr will likely use this new authority to prohibit end-to-end encryption as a best practice. However, less discussed is the recklessness standard the bill adopts. This bill would drastically reduce free speech online because it eliminates the traditional moderator’s dilemma and instead creates a new one: either comply with the recommended best practices, or open the legal floodgates.

Prior to the passage of the Communications Decency Act in 1996, under common law intermediary liability, platforms could only be held liable if they had knowledge of the infringing content. This meant that if a platform couldn’t survive litigation costs, they could simply choose not to moderate at all. While not always a desirable outcome, this did provide legal certainty for smaller companies and start-ups that they wouldn’t be litigated into bankruptcy. This dilemma was eventually resolved thanks to Section 230 protections, which prevent companies from having to make that choice.

However, the EARN IT Act changes that equation in two key ways. First, it amends Section 230 by allowing civil and state criminal suits against companies who do not adhere to the recommended best practices. Second, for the underlying Federal crime (which Section 230 doesn’t affect), the bill would change the scienter requirement from actual knowledge to recklessness.  What does this mean in practice? Currently, under existing Federal law, platforms must have actual knowledge of CSAM on their service before any legal requirement goes into effect. So if, for example, a user posts material that could be considered CSAM but the platform is not aware of it, then they can’t be guilty of illegally transporting CSAM. Platforms must remove and report content when it is identified to them, but they are not held liable for any and all content on the website. However, a recklessness standard turns this dynamic on its head.

What actions are “reckless” is ultimately up to the jurisdiction, but the model penal code can provide a general idea of what it entails: a person acts recklessly when he or she “consciously disregards a substantial and unjustifiable risk that the material element exists or will result from his conduct.” But what’s worse, the bill opens the platform’s actions to civil cases. Federal criminal enforcement normally targets the really bad actors, and companies that comply with reporting requirements will generally be immune from liability. However with these changes, if a user posts material that could potentially be considered CSAM, despite no knowledge on the part of the platform, civil litigants could argue that the moderation and detection practices of the companies, or lack thereof, constituted a conscious disregard of the risk that CSAM will be shared by users.

When the law introduces ambiguity into liability, companies tend to err on the side of caution. In this case, that means the removal of potentially infringing content to ensure they cannot be brought before a court. For example, in the copyright context, a Digital Millennium Copyright Act safe-harbor exists for internet service providers (ISPs) who “reasonably implement” policies for terminating repeat infringers on their service in “appropriate circumstances.” However, courts have refused to apply that safe-harbor when a company didn’t terminate enough subscribers. This uncertainty about whether a safe-harbor applies will undoubtedly lead ISPs to act on more complaints, ensuring they cannot be liable for the infringement. Is it "reckless" for a company not to investigate postings from an IP address if other postings from that IP address were CSAM? What if the IP address belongs to a public library with hundreds of daily users?

This ambiguity will likely force platforms to moderate user content and over-remove legitimate content to ensure they cannot be held liable. Large firms that have the resources to moderate more heavily and that can survive an increase in lawsuits may start to invest the majority of moderation resources into CSAM out of an abundance of caution. As a result, this would leave less resources to target and remove other problematic content such as terrorist recruitment or hate speech. Mid-sized firms may end up over-removing user content that in any way features a child or limit posting to trusted sources, insulating them from potential lawsuits that could cripple the business. And small firms, who likely can’t survive an increase in litigation could ban user content entirely, ensuring nothing on the website hasn’t been posted without vetting. These consequences, and the general burden on the First Amendment, are exactly the type of harms that drove courts to adopt a knowledge standard for online intermediary liability, ensuring that the free flow of information was not unduly limited.

Yet, the EARN IT Act ignores this. Instead, the bill assumes that companies will simply adhere to the best practices and therefore retain Section 230 immunity, avoiding these bad outcomes. After all, who wouldn’t want to comply with best practices? Instead, this could force companies to choose between vital privacy protections like end-to-end encryption or litigation. The fact is there are better ways to combat the spread of CSAM online which don’t require platforms to remove key privacy features for user.

As it stands now, the EARN IT Act solves the moderator’s dilemma by creating a new one: comply, or else.

Jeffrey Westling is a technology and innovation policy fellow at the R Street Institute, a free-market think tank based in Washington, D.C.

Filed Under: attorney general, best practices, cda 230, earn it, earn it act, encryption, moderator's dilemma, recklessness, section 230

Senator Blumenthal Is Super Mad That Zoom Isn't Actually Offering The End To End Encryption His Law Will Outlaw

from the also-should-acquaint-himself-with-the-1st-amendment dept

Richard Blumenthal has been attacking internet services he doesn't understand since before he was even a US Senator. It has carried over into his job as a Senator, and was abundantly obvious in his role as a co-sponsor for FOSTA. His hatred of the internet was on clear display during a hearing over FOSTA in which he flat out said that if smaller internet companies couldn't put in place the kind of infrastructure required to comply with FOSTA, that they should go out of business. Blumenthal's latest ridiculous bit of legislation lose your Section 230 protections. And while Blumenthal likes to pretend that the EARN IT Act doesn't target encryption, he also lied about FOSTA and insisted it had no impact on CDA 230 (which it directly amended).

But Blumenthal has now taken his ridiculousness up a notch. Following the (legitimately concerning) reports that the suddenly incredibly popular videoconferencing software Zoom was not actually providing end-to-end encrypted video chats (despite its marketing claims), Blumenthal decided to step in and play the hero sending an angry letter to the company, while linking to the Intercept's original story about Zoom's misleading claims about encryption:

The letter highlights a number of recent claims that have been made about Zoom's security and privacy practices -- some of which are very significant (and a few that aren't as big a deal) -- including the end to end encryption claims:

Does Zoom provide end-to-end encryption, as the term is commonly understood by cybersecurity experts, for video conferences? Please describe when end-to-end encryption is available for users and how the personal data is encrypted?

And this is a legit question and I think it's good that a Senator is asking that. I just think that this particular Senator is the wrong messenger, given his active role in trying to make it impossible for companies like Zoom to offer end-to-end encryption in the first place, as Riana Pfefferkorn (the Associate Director Surveillance & Cybersecurity at Stanford's Center for Internet and Society) pointed out:

And it gets worse. As Pfefferkorn also points out, Blumenthal's claims to be so concerned about cybersecurity and privacy ring hollow when just last month he straight up claimed that you have no right to privacy online:

This was in a weak attempt to "respond to concerns" raised about the EARN IT Act. In one of the responses, concerning government mandates for scanning content and how that interacts with the 4th Amendment, Blumenthal, quoting Neil Gorsuch, claims that there's no reasonable expectation of privacy for any content you put online:

In the Ackerman opinion cited by tech companies as raising Fourth Amendment concerns, Gorsuch suggested that the third-party doctrine will protect evidence of CSAM found by a company that privately searched. When a company has terms and conditions that enable it to privately search, there is no Fourth Amendment violation because users lose their reasonable expectation of privacy. Gorsuch stated that “The [Supreme] Court has, after all, suggested that individuals lack any reasonable expectation of privacy and so forfeit any Fourth Amendment protections in materials they choose to share with third parties.”

Of course, as Pfefferkorn further points out, Blumenthal's broken analysis of the Ackerman opinion leaves out some important information. But, still, Blumenthal seems to constantly be talking out of both sides of his mouth. He doesn't believe in an expectation of privacy for content posted online, but he also wants to slam a company for not keeping information private. He doesn't want companies to have end-to-end encryption, but he's angry at Zoom for not having end-to-end encryption.

And that's not the end of the problems with Blumenthal's approach here. While some of the privacy concerns he raises are legit, he lumps them in with ones that are not. For example, for reasons that make no sense at all, he seems to think the relatively new practice of Zoombombing -- in which (often racist trolls from the worst parts of the internet) find publicly linked Zoom events and pop in to be total assholes -- is on par with the other (often legit) security questions raised by Zoom's security practices. Right after his question about end-to-end encryption he asks:

What measures has Zoom put into place to detect and prevent Zoombombing -- intrusions and abuse targeting Zoom meetings? What are the policies governing such abusive behavior, what detection mechanisms are in place, how can users report abusive intrusions, and how quickly does Zoom respond to such incidents?

While there are plenty of questions about how companies can deal with such things, this is not an issue that is under the government's purview. Indeed, as annoying as Zoombombing is, and as quickly as I'm sure Zoom has been working on technology tools to allow meeting hosts to deal with the issue, most Zoombombing is still 1st Amendment protected speech, and a Senator has no business insisting that Zoom silence such activities. And yet, that seems to be exactly what he's focused on doing:

In that tweet he says: "I am calling on Zoom to take urgent & aggressive action to stop the racists, trolls, & peddlers of hate that are silencing & bullying communities." Yeah, the 1st Amendment (the one you swore to defend) might want to have a word with you about that, Senator. I'm all for Zoom coming up with tools for users of its service to help prevent such trollish behavior, but seriously, these kinds of stunts are not at all new on the internet and have been around for literally decades. That doesn't make the juvenile behavior any less annoying or problematic, but it's not the role of any government official to insist that a company censor people for protected speech, no matter how trollish.

Separately, of course, this ignores that Zoom had already put in place a detailed plan for how to stop Zoombombing over a week before Blumenthal sent the letter. The company still could do more, and it's worth noting that it has since released a detailed plan to deal with the newly raised security and privacy concerns, including a 90 day freeze on all feature development to have the engineering team focus on privacy and security issues. That didn't take Senator Blumenthal's grandstanding -- and, of course, if Blumenthal's EARN IT Act passes, that would make Zoom's job that much more difficult.

I know that Senator Blumenthal loves to grandstand over tech issues, but it might help if he understood the technology, the law, and the Constitution before making such a fool of himself. Unfortunately, for over a decade he's shown a decided lack of interest in doing any of those things, and I guess he has no intention of starting now.

Filed Under: earn it, encryption, fosta, free speech, privacy, richard blumenthal, section 230, security, trolls, zoombombing
Companies: zoom

EPIC Offers Its Support Of The EARN IT Act; Thinks It Can Separate Undermining Section 230 From Undermining Encryption

from the it-really-shouldn't-be-supporting-either dept

As the EARN IT Act moves forward -- with all of its Section 230 and encryption-threatening appendages still intact -- we're getting some very interesting responses from tech companies that have benefitted from Section 230 and/or rely on strong encryption.

The goal may be noble -- the protection of children from sexual abuse -- but those noble goals are just a crowd-pleasing dodge. It's an assault on both Section 230 and strong encryption that's being pushed with an anti-child porn narrative, one that makes it very difficult for legislators to oppose. To vote against EARN IT, supporters will misleadingly claim, is to vote for the spread of child porn, so it's going to be tough to find lawmakers willing to push back.

Attorney General Bill Barr wants encryption broken. If it means American citizens are less protected, so be it… just as long as the FBI can get into a few more locked devices or accounts. Plenty of people in the administration seem to feel Section 230 has to go, if only to make it easier to sue platforms for perceived slights.

Entities that used to be allied against Section 230 reform and encryption-breaking are now for it. The Electronic Privacy Information Center wants to do both somehow. It has sent a letter [PDF] in support of the EARN IT Act that is pure cognitive dissonance. EPIC claims it wants to see Section 230 reformed but somehow keep this "reform" from threatening the encryption of end-to-end communications. How it imagines this law will achieve both aims is nearly impossible to discern.

The letter says Section 230 must be reformed, but for something much lower on the "for the children" list.

EPIC also supports efforts to reform Section 230. In the case Herrick v, Grindr, EPIC provided an amicus brief for the Second circuit in which we explained that the “Internet has changed since Congress passed the [Communication Decency Act] in 1996. Advanced social media platform did not exist when Congress enacted the law.” We objected to a lower court interpretation of section 230, which found that “online platforms bear no responsibility for the harassment and abuse their systems enable. If they chose not to respond to the exposure of personal information or intimate images, to threats of violence, to verbal and psychological abuse, there is nothing a victim can do to intervene.” As we explained, “Congress never intended § 230 to create such a system.”

We all can agree platforms need to handle things like harassment better. But there's no clear way to make it better, not when you're moderating millions (Twitter) or billions (Facebook) of users. Attacking the law that allows them to engage in moderation without fear of reprisal isn't going to make things better. It's either going to result in platforms refusing to moderate at all or -- in the case of smaller competitors -- just deciding it's not profitable to do business in the United States.

EPIC knows the EARN IT Act also threatens the use of end-to-end encryption. If the "best practices" handed down by law to address the spread of child porn include forcing platforms to break encryption to view message content, encryption gets weaker and opponents of encryption like Bill Barr and FBI Director Chris Wray get what they want: encryption that doesn't protect anyone.

EPIC thinks it can back the EARN IT Act and keep encryption intact.

[F]or companies that actually provide end-to-end encryption we would caution against recommendations that diminish user privacy and security. Strong encryption is critical for network security. The Act correctly identifies “data security and privacy” as relevant considerations in developing best practices. The Act also requires that the Commission include two experts who have “current experience in matters related to constitutional law, consumer protection, or privacy” as well as two experts in “computer science or software engineering related to matters of cryptography, data security, or artificial intelligence in a non-governmental capacity.” The Act should make end-to-end encryption a “Relevant Consideration” under Section 4(a)(4).

Providing end-to-end encryption protects users, promotes commerce, and ensures cybersecurity. EPIC recommends that the EARN IT Act make clear that liability should not be imposed for a secure end-to-end encrypted communications system that safeguards the security and privacy of users.

That's all well and good, but we're not going to get a law that undermines Section 230 while protecting encryption. It will undermine both. That's the goal of the legislation. Doing everything you can to prevent the distribution of child porn means cracking open encrypted messages to view their contents. Platforms are doing all they can to prevent this, but forcing them to undermine encryption makes millions of people not distributing child porn less secure. It's pretty screwed up to run an organization interested in protecting the privacy of internet users when you're throwing your support behind a bill that threatens to make everyone's conversations less private.

Filed Under: earn it, encryption, section 230
Companies: epic

Burning The Ladder: Match.com Supports Burning Section 230 To The Ground, Despite Relying On It To Exist

from the what-the-fuck? dept

Here's one I didn't quite expect to see. Match.com -- the dating website owned by IAC, which owns basically every other major dating site, including OkCupid, PlentyOfFish, Tinder, Hinge, and a bunch of others as well -- has announced that it will support the idiotic EARN IT Act, that would utterly destroy Section 230 and the ability of websites to host user generated content. Match's publicly stated reasons for this are... bizarre. It doesn't actually explain why it supports it. It just says it does, that protecting children is important, and then some mumbo jumbo about the kids online these days -- none of which touches on what the bill would actually do.

At Match Group, the safety of our users is at the heart of all we do and something we are constantly investing in. However, the EARN It Act rightfully acknowledges that online safety is a societal issue that demands action from leaders in the social media and tech space and on Capitol Hill. The EARN IT Act would help accomplish this by establishing a joint commission of lawmakers, experts and industry participants to set standards and best practices for internet companies to follow in addressing online exploitation of children.

The only way I can read this in a manner that makes sense, is Match has realized -- as the absolute most dominant player in the field -- that it can handle whatever recommendations come out of this panel in order to retain its 230 protections. But it also knows that all those smaller competitors, the ones that Match keeps buying up left and right, probably, cannot. So, from a competitive standpoint, this strengthens Match's position vis-a-vis upstart competitors, and probably depresses their value, making them easier to buy up. Win-win... if you're Match.com.

The rest of the blog post is just pure propaganda.

As the mom of a teenager, I am constantly thinking about my own daughter’s safety. And as the chief executive of a company that includes some of the world’s leading dating brands—Match, Tinder, OkCupid, and Hinge—I find myself often awake at night thinking about my daughter’s future, her digital footprint and the safety and privacy issues that come with this territory.

And that's why you're supporting a bill that literally removes your ability to decide how best to run your platform and hands it to a bunch of bureaucrats who don't know your business? Say what?

I remember a time when tech didn’t encompass every area of life. That’s no longer true for today’s kids. They have been immersed in a device-driven, always-on world since birth, and it’s incumbent on us to give them the tools to thrive in this increasingly digital world.

And that's why... you no longer want to be able to decide which tools to give them... but instead give that right to the government? Why?

Given our kids spend so much time with technology, we need to take bolder steps to protect them. We know that sex traffickers, pedophiles and other predators target children in places where they believe them to be most vulnerable. The internet will continue to fail our children without the entire internet ecosystem investing in and adopting new rules, technologies and practices to better govern online interactions and crack down on predatory behavior.

Beyond the whole "targeting children" issue being overblown, one place where they are targeted is on dating sites -- and you're now signing up to be held liable for that on your own website.

That is why Match Group has voluntarily chosen to make all of our platforms 18+. Beyond the age requirement, we vigilantly deploy a network of industry-leading automated and manual moderation and review tools, systems and processes designed to find and remove people from our app who should not be there. This includes both underage users and the bad actors that could prey on them. We work with partners like the National Center for Missing and Exploited Children, Polaris, RAINN, Thorn and others to solicit recommendations from these experts. We welcome the opportunity to work with regulators to ensure that we are all coming together to protect our next generation of citizens. And, like most tech companies, we will continue to invest in new technologies and adopt new practices to try to stay ahead of predators.

That already happens. Most platforms already do that. So why are you good with adding liability on top of that, other than knowing you can handle it while your competitors cannot?

What's even more bizarre is why would IAC allow Match.com to support legislation like this that will harm other IAC properties, like Vimeo, HomeAdvisor, Angie's List, Dotdash (the former About.com), and more? The whole thing seems self defeating, unless the entire point is just to fuck over smaller competitors. Section 230 helped Match.com become the giant success it is today, and now it's burning the ladder it used to reach those heights, so no one else can get there. Despicable.

Filed Under: competition, dating sites, earn it, earn it act, intermediary liability, section 230
Companies: iac, match.com

Senators Pretend That EARN IT Act Wouldn't Be Used To Undermine Encryption; They're Wrong

from the plausible-deniability dept

On Wednesday, the Senate held a hearing about the EARN IT Act, the bill that is designed to undermine the internet and encryption in one single move -- all in the name of "protecting the children" (something that it simply will not do). Pretty much the entire thing was infuriating, but I wanted to focus on one key aspect. Senators supporting the bill, including sponsor Richard Blumenthal -- who has been attacking the internet since well before he was in the Senate and was just the Attorney General of Connecticut -- kept trying to insist the bill had nothing to do with encryption and wouldn't be used to undermine encryption. In response to a letter from Facebook, Blumenthal kept insisting that the bill is not about encryption, and also insisting (incorrectly) that if the internet companies just nerded harder, they could keep encryption while still giving law enforcement access.

“This bill says nothing about encryption,” Sen. Richard Blumenthal..., said at a hearing Wednesday to discuss the legislation...

[....]

“Strong law enforcement is compatible with strong encryption,” Blumenthal said. “I believe it, Big Tech knows it and either is Facebook is lying — and I think they’re telling us the truth when they say that law enforcement is consistent with strong encryption — or Big Tech is using encryption as a subterfuge to oppose this bill.”

No, the only one engaged in lying or subterfuge here is Blumenthal (alternatively, he's so fucking ignorant that he should resign). "Strong" encryption is end-to-end encryption. Once you create a backdoor that lets law enforcement in, you've broken the encryption and it's no longer stronger. Even worse, it's very, very weak, and it puts everyone (even Senator Blumenthal and all his constituents) at risk. If you want to understand how this bill is very much about killing encryption, maybe listen to cryptographer Matthew Green explain it to you (he's not working for "Big Tech," Senator):

EARN IT works by revoking a type of liability called Section 230 that makes it possible for providers to operate on the Internet, by preventing the provider for being held responsible for what their customers do on a platform like Facebook. The new bill would make it financially impossible for providers like WhatsApp and Apple to operate services unless they conduct “best practices” for scanning their systems for CSAM.

Since there are no “best practices” in existence, and the techniques for doing this while preserving privacy are completely unknown, the bill creates a government-appointed committee that will tell technology providers what technology they have to use. The specific nature of the committee is byzantine and described within the bill itself. Needless to say, the makeup of the committee, which can include as few as zero data security experts, ensures that end-to-end encryption will almost certainly not be considered a best practice.

So in short: this bill is a backdoor way to allow the government to ban encryption on commercial services. And even more beautifully: it doesn’t come out and actually ban the use of encryption, it just makes encryption commercially infeasible for major providers to deploy, ensuring that they’ll go bankrupt if they try to disobey this committee’s recommendations.

It’s the kind of bill you’d come up with if you knew the thing you wanted to do was unconstitutional and highly unpopular, and you basically didn’t care.

Or listen to Stanford's Riana Pfefferkorn explain how the bill's real target is encryption. As she explains, the authors of the bill (including Blumenthal) had ample opportunity to put in language that would make it clear that it does not target encryption. They chose not to.

As for the "subterfuge" Blumenthal calls out, the only real "subterfuge" here is by Blumenthal and Graham in crafting this bill with the help of the DOJ. Remember, just the day before the DOJ flat out said that 230 should be conditioned on letting law enforcement into any encrypted communications. So if Blumenthal really means that this bill won't impact encryption he should write it into the fucking bill. Because as it's structured right now, in order to keep 230 protections, internet companies will have to follow a set of "best practices" put together by a panel headed by the Attorney General who has said multiple times that he doesn't believe real encryption should be allowed on these services.

So if Blumenthal wants us to believe that his bill won't undermine encryption, he should address it explicitly, rather than lying about it in a Senate hearing, while simultaneously claiming that Facebook (and every other company) can do the impossible in giving law enforcement backdoor access while keeping encrypted data secure.

Filed Under: earn it, earn it act, encryption, intermediary liability, richard blumenthal, section 230

Why Does The NY Times Seem Literally Incapable Of Reporting Accurately On Section 230?

from the what-the-fuck-is-going-on-over-there? dept

I should preface this piece by noting that there are good reporters at the NY Times who frequently do great work. But there are also a surprising number of dreadful reporters and editors who consistently seem to get key issues wrong. And one example of this is what appears to be a near institutional-level confusion over Section 230 of the Communications Decency Act -- and I say this even while noting that last summer, the Times had an excellent piece written by Sarah Jeong calling out politicians for misrepresenting Section 230. But she should write another piece about her own damn colleagues.

Just last fall, we covered multiple stories in which the NY Times got Section 230 so badly wrong that it often had to issue embarrassing corrections, including the time it put forth a full page massive headline blaming 230 for allowing hate speech online, only to have to later run an (online only) correction saying it was actually the 1st Amendment. That was bad. What was worse was that they kept getting it wrong all through the fall. Just a day after that first mistake, they mixed up the DMCA 512 and CDA 230, blaming CDA 230 for copyright infringement, despite the law explicitly saying it doesn't apply to intellectual property. Then there was a big piece that laughably blamed Section 230 for people dying which, astoundingly, made the identical mistake in swapping out DMCA 512 for CDA 230, and where the Times had to run the word-for-word identical correction from the previous time they had made that mistake.

So I guess it should be no surprise at all that with the latest attack on Section 230, the dangerous EARN IT Act -- which is a badly re-heated FOSTA with a lump of "break encryption" tossed on top -- the NY Times would get nearly every important detail wrong again. The original title, which has since been changed, claimed "U.S. to Hold Tech Firms Accountable for Spread of Child Sexual Imagery." But that's wrong on nearly every point. First, it's just a bill, it's not the law -- yet the title implies otherwise. This is Journalism 101 stuff that the NY Times absolutely should be better at.

Second, the bill is not about "holding firms accountable," but putting more liability on an intermediary to try to ramp up censorship -- and the whole point of the bill is to use that as a wedge by Bill Barr and the DOJ to undermine encryption. But ridiculously the NY Times, acting as stenographers for those introducing the bill, repeated the false claim that internet companies don't currently fight "child sexual exploitation material." Take, for example, this ridiculous tweet from Associate Managing Editor Dean Murphy, claiming that it's a response to "tech companies that do too little to block images of child sexual abuse."

But the whole reason the bill is coming about in the first place is that we have so much data about how widespread the issue of CSAM content is because platforms have worked closely with NCMEC to identify and delete such material, sharing hashes to block it from being reuploaded. The major platforms have gone above and beyond, including Microsoft creating PhotoDNA, which helps a bunch of platforms find, detect, and remove child exploitation photos. Facebook, Google, Twitter and more have whole teams that work on making sure such content is identified and removed rapidly. Cloudflare recently built and released similar technology for free for anyone who uses its platform (even at the free level) to find and remove exploitation images.

In other words, tech platforms have taken this issue seriously for years, and have worked hard to combat things. That's in contrast to the DOJ and Bill Barr, who have literally failed to abide by Congress' mandate to fight such material. The tech companies are handing over all the information necessary, and Barr's spending his time protecting his boss's buddies from prosecution, rather than actually going after the purveyors of child porn.

But, to the NY Times, this is all about tech companies "doing too little" and the US government finally "holding them responsible." It's utter nonsense, and the NY Times, of all papers, ought to do much better.

Filed Under: csam, earn it, encryption, intermediary liability, journalism, reporting, section 230, stenography
Companies: ny times