Proposed Legislation Threatens Encryption of Messaging Platforms

While conspiracy theories about COVID-19 are running rampant, there’s one aspect of the pandemic that is impossible to argue: The global focus on Coronavirus, the whole Coronavirus, and nothing but Coronavirus is beneficial to certain parties. And, whether it’s been intentional or not, the Senators behind the new EARN-IT Bill make up one such party, because while we’ve all been stockpiling toilet paper, they’ve drafted legislation that, well, it sh*ts all over our virtual privacy.

The EARN-IT (“Eliminating Abusive and Rampant Neglect of Interactive Technologies”) Act, sponsored by Lindsay Graham, Richard Blumenthal, Josh Hawley, and Dianne Feinstein, aims to “ensure tech companies are using best business practices to prevent child exploitation online.”

“The internet is infested with stomach-churning images of children who have been brutally assaulted and exploited, and who are forced to endure a lifetime of pain after these photographs and videos are circulated online,” said Blumenthal. “Simply put, tech companies need to do better. Tech companies have an extraordinary special safeguard against legal liability, but that unique protection comes with a responsibility. Companies that fail to comport with basic standards that protect children from exploitation have betrayed the public trust granted them by this special exemption. Online platforms’ near complete immunity from legal responsibility is a privilege – they have to earn it – and that’s what our bipartisan bill requires.”

It sounds noble, right? We should do everything we can to protect children.

Except EARN-IT isn’t really about that. The Electronic Frontier Foundation explains,

[EARN-IT] will strip Section 230 protections away from any website that doesn’t follow a list of “best practices,” meaning those sites can be sued into bankruptcy. The “best practices” list will be created by a government commission, headed by Attorney General Barr, who has made it very clear he would like to ban encryption, and guarantee law enforcement “legal access” to any digital message.

Section 230 basically dictates that, generally, an illegal thing that is said/done online is the responsibility of the one who said or did it, not the platform which they used to say/do said illegal thing. The Act would basically hold platforms responsible for distributing child pornography unless they agree to let the government have access to all their users’ messages and data, which has raised concerns about the end of end-to-end encryption even though the bill says nothing about encryption.

“This bill says nothing about encryption,” co-sponsor Sen. Blumenthal said at today’s hearing. “Have you found a word in this bill about encryption?” he asked one witness.

It’s true that the bill’s authors avoided using that word. But they did propose legislation that enables an all-out assault on encryption. It would create a 19-person commission that’s completely controlled by the Attorney General and law enforcement agencies. And, at the hearing, a Vice-President at the National Center for Missing and Exploited Children (NCMEC) made it clear [PDF] what he wants the best practices to be. NCMEC believes online services should be made to screen their messages for material that NCMEC considers abusive; use screening technology approved by NCMEC and law enforcement; report what they find in the messages to NCMEC; and be held legally responsible for the content of messages sent by others.

What EARN-IT does not include is any sort of action against ACTUAL child abusers. This isn’t about children and we shouldn’t be convinced that it is. This is about the government being butt hurt that they can’t access MORE private, personal information and picking a front that’s impossible to argue with as a means to get that access. It’s a clear assault on personal freedom and privacy, but it sounds a lot nicer when you brand it as “for the children.”

You can’t have an Internet where messages are screened en masse, and also have end-to-end encryption any more than you can create backdoors that can only be used by the good guys. The two are mutually exclusive. Concepts like “client-side scanning” aren’t a clever route around this; such scanning is just another way to break end-to-end encryption. Either the message remains private to everyone but its recipients, or it’s available to others.

Let me be clear: Obviously I want child abuse to end and every abuser to suffer for what they’ve done. We all do. But EARN-IT isn’t going to make that happen, and even if it could help, it’s at an enormous cost to individual liberty. Government involvement in expanding technology has been a slippery slope that’s just been getting slipperier, and this is a step too far.

Watch this video from CNBC for more context and explanation on the value of encryption and why it’s so important to protect it.