Federal Revenge Porn Bill Not As Bad As It Could Have Been, Still Probably Unconstitutional

from the just-saying dept

For the last two and half years or so, my Congressional Representative, Jackie Speier, has insisted that she was just about to introduce a federal law outlawing revenge porn. And then it wouldn't come. There would be an article saying it was almost ready... and then nothing. Months would go by, another article would appear... and then nothing. Finally, on Thursday, Speier introduced the bill, insisting that the delay was in convincing Silicon Valley companies to sign on to it. Of course, that leaves out the fact that the reason many refused to sign on was because previous iterations of the bill were incredibly problematic and almost certainly unconstitutional. With two and half years to work on it, however, the finally introduced bill, called the Intimate Privacy Protection Act of 2016, or IPPA, is not nearly as bad as it could have been, nor as bad as some of the suggestions passed around by those who "consulted" on drafting the bill.

But that doesn't mean the bill isn't unconstitutional.

Let's be clear: revenge porn is horrific. The creeps who put up revenge porn sites deserve to be shamed and mocked. The people who actually upload images to such sites or visit them are complete losers who need to get a life. But there are really important legal issues that come up when you try to outlaw such things, starting with the First Amendment. Yes, yes, as everyone will say, there are some exceptions to the First Amendment (though if you claim that shouting fire in a crowded theater is one of them, you're going to be mocked as well). But the exceptions to the first First Amendment are very narrowly prescribed by the Supreme Court, and they're much more narrow than most armchair lawyers believe. Looking over the list, it's pretty difficult to see how revenge porn fits.

Next up, context matters a lot, and while the bill tries to take some of that into account, it's unclear if it actually succeeds. The bill has a vague and nearly totally undefined "public interest" exception -- but what does that actually include? That's left unclear. Remember last year when Lenny Kravitz accidentally exposed himself at a concert. Was everyone who passed around videos of images of that violating this new revenge porn bill? It would seem so. That would be "knowingly" using an "interactive computer service... to distribute a visual depiction of a person who is identifiable from the image itself or information displayed in connection with the image... of the naked genitals... of a person, with reckless disregard for the person's lack of consent to the distribution."

Remember, tons of people were passing around that image and video last year. Should all of them face five years in prison plus fines? That seems... extreme. And extremely problematic.

The ACLU has a rather simple request to fix this problem with the law: add an intent requirement, such that it only applies to those who "maliciously and intentionally invade another person's privacy." Even that may have some First Amendment issues, but supporters of the law refused to add an intent standard, claiming that such a standard would be too limiting, and wouldn't cover those who weren't motivated by "malice" but by money or fame. But, that's ridiculous. Any court would likely decide that setting up a revenge porn site for money was a form of malice.

Thankfully, this version of the law says that it does not apply to online platforms, as defined by Section 230 of the Communications Decency Act, which is a big jump from where some of the crafters of this bill were a few years ago, in which they openly discussed undermining CDA 230 as a way to attack revenge porn.

In the end, two and a half years of effort means that the bill isn't as horrible as some of the earliest suggestions, but it's still not clear that it's constitutional. It seems likely that the ACLU, and possibly others, will likely challenge this law should it pass and then I guess we'll find out what the courts actually think of it.

Filed Under: first amendment, free speech, jackie speier, revenge porn

Rep. Speier Wants To Register Every Prepaid Phone Purchase, In Case Someone Bad Uses One As A Burner Phone

from the post-Paris-panic-continues dept

First, the legislators came for encrypted phones, because terrorists were apparently using encryption. (Except they weren't.) Now, they're coming for prepaid phones. Sure, customers will still be able to buy prepaid phones. They'll just have to "register" with their local retailer in order to do so.

A bill proposed in congress this week would require that all users provide identification and register prepaid ‘burner’ phones upon purchase.

[...]

Representative Jackie Speier, the congresswoman who introduced the bill, called the prepaid phone “loophole” an “egregious gap in our legal framework,” one that allowed terrorists and criminals near-complete autonomy and a means for private, anonymous communications.

This "loophole" has existed for years. There's nothing new about burner phones. The only thing "new" is that these were used by the terrorists who attacked Paris. So, of course, a legislator has decided to do something about it.

What exactly will be done remains unclear. The bill has yet to arrive in written form. But it has, sight unseen, been referred to three House committees and enjoyed a full-page press release from Rep. Speier.

The Closing the Pre-Paid Mobile Device Security Gap Act of 2016 would place the same identification and record-keeping standards on pre-paid mobile devices as the ones that already exist on traditional contract mobile devices. When customers buy a traditional contract-based phone, they provide basic information such as a name, address, and date of birth, which law enforcement can request with a warrant in order to stop terrorist attacks or other illegal activity.

This bill would direct pre-paid cell phone retailers to collect basic ID information at the time of purchase and share that information with the cellular provider for that individual device. The information would be verified using a credit card, debit card, social security number, driver’s license number, or other information that the Attorney General finds adequate in order to have some record of the transaction. Pre-paid “burner phones” were used in the 9/11 attacks, the failed Times Square bombing, and the Paris attacks. Failure to hold them to the same standard as regular contract phones poses a serious risk to national security.

GIven that burner phones have been associated with criminal activity since forever, if anyone seriously felt the need to close the "loophole," you'd think they'd have accomplished it already. (Here's a failed attempt from 2010, made by Sens. Chuck Shumer and John Cornyn post-Times Square bombing.) What Speier wants to do is generate yet another set of third-party records to be housed by phone providers that can be accessed without warrants.

Even if this passes, it will do little to allow law enforcement agencies to follow up on burners recovered after attacks. Criminals and terrorists won't be presenting identification -- at least not theirs -- to retailers. In fact, they're going to do what they've done before: use straw purchasers or buy directly from resellers who fall outside of the bill's likely purview -- like individuals or online retailers.

This will have little investigative worth, but it will generate a ton of records on people who don't have any option but to buy prepaid phones, whether it's due to credit issues or a lack of verifiable identification. Many won't have the ID options requested, like credit/debit cards. Some may not have state ID/Social Security cards either. Adding this requirement will just inflict further difficulties on people whose lives are filled with difficulties already.

Then there are those who do have these things but would prefer to use a "burner" for conversations/communications they don't want to have linked to a phone that, for all intents and purposes, identifies them. Activists and journalists are two groups that immediately come to mind. So do philandering spouses, but that sort of activity is really none of the government's business -- nor the retailers acting as prepaid phone dragnets on the government's behalf.

And then there will be any number of people who buy prepaid phones simply to leave less of a personally-identifiable digital footprint -- without having to surrender most of their communication options.

In addition to these issues, requiring registration for prepaid phones will both lead to more criminal activity (in the form of a new black market for unregistered phones) and adversely affect smaller retailers who will now be shouldering additional burdens for the government. From a 2013 GSM (Groupe Speciale Mobile) report on registration requirements for SIM cards: (h/t Glyn Moody)

In countries where prepaid users represent the majority of the mobile communications market, the costs to mobile operators of implementing new registration processes can be significant including:

• Training staff and retailers i.e. on how to register users, what the acceptable forms of identity are and how to verify them;
• Investing in public awareness campaigns to inform their customers about the need to register;
• Ensuring that customer data databases are accurately updated, maintained and secured;
• Monitoring compliance and deactivating all unregistered SIM cards after the imposed deadline; and
• Verifying, copying and storing users’ identity documents.

The report also recommends:

Governments considering mandating the registration of prepaid users should seek to consult with industry stakeholders and conduct impact assessments before introducing regulation.

Right now, the only entity that has been consulted is Rep. Speier's gut instinct. It says, "Do something!"

Certainly a cell provider can gather any information it wants in exchange for providing phone service, but third parties like Wal-Mart and Target shouldn't be put in the position of tracking certain people who make certain purchases. As useful as it may be to have this information lying around (and that's certainly disputable), Speier's proposal will do little to prevent attacks and criminal activity while harming the privacy interests (and more) of her constituents.

Filed Under: anonymity, burner phones, fear, fud, jackie speier, prepaid phones, registration

Federal Revenge Porn Bill Will Look To Criminalize Websites

from the dangerous-step dept

My own representative in Congress, Jackie Speier, has apparently decided to introduce a federal "revenge porn" bill, which is being drafted, in part, by Prof. Mary Anne Franks, who has flat out admitted that her goal is to undermine Section 230 protections for websites (protecting them from liability of actions by third parties) to make them liable for others' actions. Now, I've never written about Franks before, but the last time I linked to a story about her in a different post, she went ballistic on Twitter, attacking me in all sorts of misleading ways. So, let me just be very clear about this. Here's what she has said:

"The impact [of a federal law] for victims would be immediate," Franks said. "If it became a federal criminal law that you can't engage in this type of behavior, potentially Google, any website, Verizon, any of these entities might have to face liability for violations."

That makes it clear her intent is to undermine Section 230 and make third parties -- like "Google, any website, Verizon... face liability."

Now, her retort to all of this is likely that she's not seeking to undermine Section 230 in any way. Rather, she's attempting to do something of an end-run around it. Section 230 has never protected sites from liability of federal crimes -- just civil infractions and state crimes. So her goal is to make the amorphous concept of "revenge porn" a "federal crime" thereby suddenly making third-party websites liable. She will argue that does nothing to undermine Section 230. A more reasoned and thoughtful look at the issue, however, shows how this effort is fraught with dangerous consequences and potential First Amendment problems.

Taking a step back, though, let's be clear: revenge porn -- the practice of posting naked pictures of someone (who likely took those photos for an individual or themselves, rather than the public) along with that person's identifying information -- is odious. Those who are involved in the practice are morally repugnant individuals. And yet, what we've seen is that there do appear to be ways to deal with them. One of the most well-known creators of revenge porn, Hunter Moore, was recently arrested on charges that he conspired with another person to hack into email accounts to get more photos. Often, those engaged in revenge porn are also engaged in extortion over those images or other crimes on which they can be charged. Some revenge porn sites have been hit with lawsuits for copyright infringement -- though that creates a whole different set of problems.

Meanwhile, amazing folks like Adam Steinbaugh have been diligently tracking down and exposing the details of people who operate revenge porn sites, which can sometimes be an effective (if slightly ironic) way to get them to go away. But that's an example where more speech is often a better result than censoring speech by increasing liability.

Still, you can see why there's a temptation to create a new anti-revenge porn statute. The whole concept of revenge porn is itself repugnant, so it's tempting (especially as a lawmaker) to pull out that old hammer and create some regulations. But the dangers of regulating based on reacting to the odiousness of those sites may obscure the way such laws will inevitably -- as Prof. Franks herself admits -- impact companies that are clearly not engaged in revenge porn.

In the article about the legislation, EFF's Matt Zimmerman (who, actually, just left EFF) points out that using criminal law here is "dangerous" because it would likely lead lots of companies to reflexively delete all sorts of content, including plenty of perfectly legal and legitimate content, to avoid the sort of liability Franks describes. And that's the huge problem here. By spreading liability, you guarantee over-censorship. It's easy for people who are narrowly focused on a single issue to not recognize the wider impact that issue may have. Trying to accurately describe what "revenge porn" is for the sake of criminalizing its posting, will almost certainly have chilling effects on third parties and undermine the very intent of the CDA's Section 230.

People who don't think through the details seem to assume that it must be easy to define what is "revenge porn," but the deeper you go, the more difficult it becomes to define -- and the more risks there are of both over-criminalizing and creating serious First Amendment issues. For example, you could say that sites should be forced to take down photos of individuals where those individuals insist that the photos are problematic. But then you'd have to deal with situations, like with Ranaan Katz, where he went after a blogger and Google (using civil copyright law) for posting an "unflattering" photo. Do we really want to bring criminal law into that arena?

And the First Amendment issue is not easy to get around. At all. As lawyer Mark Bennett discussed in trying to create a First Amendment-compliant anti-revenge-porn statute, it's not an easy challenge:

The First Amendment problem we face is that “posting nude or explicit images of former lovers online” is speech; a statute focused on such posting is a content-based regulation of speech; content-based regulations of speech are presumed to be invalid (that is, speech is presumed to be protected); and the Supreme Court in U.S. v. Stevens expressly rejected a balancing test for content-based criminal laws, instead applying a categorical test.

At best, Bennett tries, as an exercise, to see if it would be possible to extend obscenity laws to cover "revenge porn," but that would massively expand obscenity laws, again in potentially dangerous ways. The problem here is that pretty much everyone agrees that revenge porn is a really horrible thing -- but any attempt to criminalize it will have serious implications way beyond the targeted issue.

Instead of following Franks down that dangerous road, it would be wise to focus on ways to use existing laws to go after those who are clearly engaged in related questionable behaviors. Changing the laws to put the burden on third parties is only going to create significant new problems. I'm disappointed that my own Representative in Congress, Jackie Speier, appears to not realize this, and I will be contacting her office to express my concerns about the bill.

Filed Under: cda, first amendment, jackie speier, liability, mark bennett, mary anne franks, revenge porn, section 230, speech

Rep. Jackie Speier Puts Forth Bill To Extend TSA To Mass Transit

from the because-that's-exactly-what-we-need dept

Well this is very disappointing. My own Congressional Representative, has put forth a bill, HR 3140 to expand TSA info sharing capabilities to mass transit. Because that's just what we need. Even worse, in speaking about it, Speier doesn't seem to even recognize that there's a problem with the TSA at airports, and seems to assume that it's just obvious that everything's great with airport security:

"We have put in place through TSA a very elaborate system [in airports]. We all go through those metal detectors and those secondary searches. And we've put a lot of focus on the airlines for good reason. But we have neglected the mass transit components, generally speaking," she said.

Speier said 2 million people fly each day, compared with more than 5 million who ride the subway each day in New York City alone. She pointed out that the most recent terrorist attacks have been on mass transit. Also, when U.S. Special Forces raided Osama Bin Laden's compound last year, intelligence gathered revealed the next attack was intended for mass transit.

"The writing is on the wall. We need to be better prepared than we are right now," Speier said.

I'm all for keeping trains safe from terrorists. I ride on trains all the time -- including a Caltrain that has been named after Jackie Speier (I'm not joking). But any approach that suggests the current TSA efforts are somehow reasonable and should be expanded -- without even offering any evidence that this is true -- is a serious mistake.

Filed Under: caltrain, jackie speier, mass transit, security, tsa