EARN IT Act Seeks to Undermine Encryption and Online Privacy
By: Adam G.
Tags: Politics, Internet, Congress, Privacy, Business

Photo by Sebastian Pichler on Unsplash

With the media attention centered on the global spread of Coronavirus (COVID-19), and its impacts on health and the economy, one could be forgiven for thinking that the halls of government are solely focused on fighting this pandemic. On March 5, as Coronavirus was beginning its rapid assault across the United States, Attorney General William Barr announced a joint initiative along with Canada, the United Kingdom, Australia, and New Zealand to fight online child sexual exploitation. As part of this initiative, Google, Facebook, Microsoft, Twitter, Snap, and Roblox have agreed to adopt 11 voluntary principles aimed at combating online exploitation. On the same day, a group of bipartisan Senators announced the Eliminating Abusive and Rampant Neglect of Interactive Technologies Act (EARN IT Act), an act defined by the Senate Judiciary Committee “to encourage [the] tech industry to take online child exploitation seriously.” The bill is currently making its way through the U.S. Congress.

Online child sexual exploitation is a real and serious problem, and the elimination of online child sexual abuse material (CSAM) as the EARN IT Act aims to enforce is a necessary cause, which is why Chapter 110 of Title 18 of the U.S. Code (18 U.S.C. §§ 2251–2260A) already makes everything related to CSAM a crime including producing, receiving, accessing, viewing, possessing, distributing, selling, importing, and failing to report. Section 2255 of Chapter 110 further allows for victims of child sexual exploitation to bring civil lawsuits. Instead of revising Chapter 110 of Title 18 of the U.S. Code, EARN IT is proposing a different and curious tactic to encourage the tech industry to fight CSAM: online providers must abide by a set of best practices established by a government commission or risk losing their immunity under Section 230 of the Communications Decency Act of 1996 (CDA). EARN IT offers no support for victims of CSAM, does not provide additional resources for law enforcement agencies, or training for websites to help identify predators. This is a bait and switch aimed at banning strong encryption.

What is Section 230 of the Communications Decency Act?

To understand Section 230 of the Communications Decency Act (CDA) one must first understand the moderator’s dilemma. Prior to the passage of Section 230 of the CDA in 1996, websites were put in the inevitable position of whether to moderate or not moderate their forums. Federal and state courts had concluded in a series of cases that if a website takes the active approach of moderating its forums, it becomes legally responsible for all third-party content posted on its website. However, if a website does not moderate content, it is not legally responsible for third-party content on its website but risks its reputation and credibility. Section 230(c)(1) of the CDA provides a solution to the moderator’s dilemma by giving websites immunity for content posted by third party users. It states, “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”

These twenty-six words are frequently credited with creating the modern internet, as they gave websites the freedom to moderate and innovate without risking legal liability for third party content. Imagine social media, dating sites, or discussion sites existing without Section 230 of the CDA. These entities would have all been sued out of existence before gaining their footing or would have been filled with so much filth that average users would be reticent to use their services. Section 230 is therefore the internet equivalent to the First Amendment; it fosters the free flow of ideas. Few outside of technology or legal spheres, however, know or remember its existence. Section 230 only makes headlines when politicians and interest groups are incensed about the moderation practices of websites.

Photo by Michelle Ding on Unsplash

Like the First Amendment, Section 230 has its limitations. Section 230(e) titled Effect on Other Laws list five such limitations: 1) No Effect on Criminal Law; 2) No Effect on Intellectual Property Law; 3) No Effect on State Law; 4) No Effect on Communications Privacy Law; and 5) No Effect on Sex Trafficking. Section 230(e)(1) specifically provides: “Nothing in this section shall be construed to impair the enforcement of section 223 or 231 of this title, chapter 71 (relating to obscenity) or 110 (relating to sexual exploitation of children) of title 18, or any other Federal criminal statute.” It is clear from this language that Section 230 of the CDA does not offer any protections to websites that do not abide by existing or future CSAM laws, nor for any other Federal criminal statute. The natural avenue to provide additional protections to prevent CSAM would be a revision of Chapter 110 of Title 18 of the U.S. Code. So why does the EARN IT Act even address Section 230 of the CDA?

Section 230 Is Not Perfect, But It is the Best We Got

Section 230 was designed to be both a sword and shield. It shields websites from legal liability for third party content, while giving them a sword to take down posts and ban users who violate their terms of service. Many websites while keen to take advantage of the shield, do not use the sword as often or with as much grace as users, politicians, and interest groups would like. In recent years, various websites have been blamed for their failure to prevent the spread of propaganda and fake news, their inability to stop the proliferation of bots and troll accounts, the rise in online hate speech and terrorism-related content, the frequency of online bullying, the lack of platform neutrality, and of course the use of these services for crime, including sexual trafficking and CSAM. This make Section 230 of the CDA an easy target for politicizing.

Some if not many of these criticisms are fair. One need not look past the 2016 election cycle to see how important website forums have become, and how their moderation or lack thereof can have significant impacts in the public sphere. Senator Ron Wyden, who was one of the drafters of Section 230, has even acknowledged that websites do not use the sword often enough and that Section 230 may need to be revised. In fact, it has been revised, by The Stop Enabling Sex Traffickers Act (SESTA) and Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA) in 2018. SESTA-FOSTA, which is currently facing a legal challenge brought by consumer watchdog the Electronic Frontier Foundation, has been largely ineffective at catching and stopping sex traffickers. Instead, SESTA-FOSTA has resulted in the shutting down of Craigslist Personals and other similar services, the return of sex workers to the street as they no longer have safe spaces online to vet clients thereby further endangering them, and an increase in the censorship targeting LGBT communities. Only Senator Wyden and Senator Rand Paul voted against SESTA-FOSTA.

Likewise, Senator Wyden has called the EARN IT Act “a transparent and deeply cynical effort by a few well-connected corporations and the Trump administration to use child sexual abuse to their political advantage, the impact to free speech and the security and privacy of every single American be damned.” Despite all the politicization surrounding Section 230, it was never designed to be political. Section 230 of the CDA was designed with the intent of allowing every website to be able to moderate their own little corner of the Internet, and most if not all of this moderation is still done the old fashioned way, by humans. The only feasible way to get rid of all bad speech on a forum, is to get rid of all speech, which explains why Craigslist choose to shut down its Personals. Section 230 was also not designed to require websites to be neutral. Ironically, as Section 230 has allowed the growth of massive forums, these forums have been conflated with public forums with the requisite expectations of free speech. While governments may not curtail free speech as provided for in the First Amendment, corporations who are the owners of many of these websites are free to limit speech as they see fit.

What Section 230 does require, is for websites to not turn a blind eye. By way of analogy, if a crime was planned out at a bar without the owners knowledge, the bar owner likely wouldn’t be held responsible for the crime, but if the bar was a known outfit for repeated criminal activity or the bar owner participated in the planning of the crime the bar owner would likely be charged with racketeering and a host of other crimes. The bar is not responsible for playing certain music, catering to all guests, or serving certain drinks, but it does have a responsibility for keeping patrons safe and not turning a blind eye to dangerous activities. These are the requirements of Section 230. Is it perfect? No, but it is a baseline for keeping people safe online, ensuring free speech, and protecting privacy.

CALEA is the Real Target

Since Section 230 is often viewed as the law that allows websites to protect sex offenders, murderers, and of course those with disparaging views, it is easy to politicize. Hate what your frenemy posted on Facebook, blame Section 230. Hate all those political ads you see online, blame Section 230. Hate that your post was taken down for violating community standards, blame Section 230. None of these are directly the fault of Section 230. They are our fault. We are the ones posting, sharing, and liking this content, which makes this type of content profitable. It is common sense that the person who should be held responsible for online comments is the poster. Of course, websites need to do a better job of moderating their content as well. Even accepting the premise that website forums are public forums, however, websites have no responsibility to monitor private messages, absent a court order, nor should they. EARN IT would require them to do so, or at the very least create a backdoor to encryption so that the Federal Government can read all private messages.

Photo by Chad Madden on Unsplash

EARN IT like most bills before Congress has gone through numerous revisions. In its earliest version a 15-member commission was to be created with the responsibility of proposing a series of best practices to prevent CSAM that all websites must follow. If websites do not follow these best practices, they risk losing their Section 230 immunity. The commission in that version of the bill would be largely useless as it granted the Attorney General the unilateral power to rewrite, approve, and veto those best practices. In the most recent draft version of the EARN IT Act, the Attorney General is one of now 19 members of a commission along with the heads of the DHS and the FTC, who have all previously expressed their distaste for encryption. Privacy experts would make up only two members of this commission, although those roles by the language of the bill can be filled by any consumer protection expert (e.g. medical equipment safety), and only one member of the commission would be a cryptography expert, although this member can be replaced with an expert on artificial intelligence. The best practices approved by the commission to prevent CSAM would require only 14 of 19 votes. This means the experts on privacy and encryption can and likely will be outvoted.

Attorney General William Barr has made no secret of his distaste for encryption. He has made numerous speeches and statements calling encryption a threat to public safety and a tool to transfer cyberspace into a law free zone. On March 5th, the day EARN IT was announced, Barr at his own conference stated, “Predators’ supposed privacy interests should not outweigh our privacy and security. There is too much at risk.” Senator Lindsey Graham one of the bills two main sponsors has also previously expressed his distaste for encryption stating in December 2019 while questioning Facebook and Apple over encryption, “You’re going to find a way to do this or we’re going to go do it for you. We’re not going to live in a world where a bunch of child abusers have a safe haven to practice their craft. Period. End of discussion.” The bill’s other sponsor, Richard Blumenthal stated in an interview with the Washington Post that he is unwilling to include language in the bill that the right to encryption cannot be impinged by the commission.

To make matters worse EARN IT applies to all online services that lets a user communicate with another person or transmit a file. That would include not just Facebook, Twitter, Gmail, and Dropbox, and the usual online forums and communication tools, but all email, all cloud storage, and all wikis or online forums whether encrypted or not. Also included in this definition would be all smart devices, including home security cameras and locks, web-based phone services, and routers. The secure tools used by banks and financial institutions to transmit financial data and documents, tools used by hospitals and medical facilities to transmit patient data, and software used by lawyers to communicate with clients would also be subject to scrutinization of the Federal Government under EARN IT. In essence, EARN IT, provides the tools for all encryption and all privacy to be a relic of the past despite numerous laws like HIPAA and the Graham-Leach-Bliley Act that have already codified the right to privacy into our Federal laws.

Most shocking is that EARN IT doesn’t include a carve out for any of these regulations, nor does it mention the Communications Assistance for Law Enforcement Act (CALEA), which covers the Federal Government’s rights to lawfully intercept telephone and internet communications. CALEA, while it requires telecommunications providers to provide a means for wiretapping, does not make the same restrictions for information services (i.e. websites, email, social media, chat apps, cloud storage, etc.). Information services, like WhatsApp and Signal, have never had to be surveillance friendly. As the world has been slowly eaten by software, law enforcement agencies have been seeking to have this carve-out for information services disappear. The only way, however, to make these services surveillance friendly, is either an end to encryption or an encryption backdoor. CALEA also provides a carve-out for covered entities to encrypt communications and discard of the key. EARN IT takes direct aim at both these carve-outs.

Encryption Backdoors Undermine Encryption and Innovation

EARN IT does not ask websites to end end-to-end encryption. It legally cannot make this request, without a modification to the Constitution. EARN IT’s most recent version hints at this when it states, “Nothing in this Act or the amendments made by this Act shall be construed to require a provider of an interactive computer service to search, screen, or scan for instances of online child sexual exploitation.” Asking websites to actively end end-to-end encryption and monitor all communications would be a violation of the Fourth Amendment’s prohibition on unreasonable search and seizures. While the websites would be the entities doing the searching it would be at the behest of the Federal Government, and therefore a clear violation. However, even asking websites to indirectly allow access to communications can and does run afoul of Fourth Amendment prohibitions and will likely undermine the aim of EARN IT, as it makes websites agents of the state. Many of these websites are already using advanced tools such as hashing and artificial intelligence to voluntarily catch CSAM. If this monitoring were no longer voluntary, any evidence of CSAM collected would be subject to suppression in court. EARN IT, therefore, undermines the exact goals it hopes to achieve.

Instead, the EARN IT Act’s appears to be seeking the creation of encryption backdoors, an aim the Federal Government has been pursuing since the 90’s and has largely failed at achieving. The idea is that while encryption could continue all information services and telecommunications providers would be required to create a master key that can be used and would be held by the Federal Government when cause exists to use the master key. As the Information Technology Industry Council has argued for years, “Weakening security with the aim of advancing security simply does not make sense.” In 2016, Apple made this exact case when ordered by the FBI to unlock an encrypted cellphone. Apple neither had a master key, nor was willing to create one, arguing that the creation of a master key was compelled speech in violation of the First Amendment. Apple has a policy that it will never undermine the security features of its products. In a similar case in 2019, Apple released a statement saying, “We have always maintained there is no such thing as a backdoor just for the good guys. Backdoors can also be exploited by those who threaten our national security and the data security of our customers.”

Designing encryption with a backdoor not only weakens the encryption but provides a known vulnerability for others to exploit. A master key can be reproduced, hacked, stolen, or used by rogue actors. The idea that a backdoor could or would never be used other than its intended use is a promise that cannot be met. Encryption backdoors also impact innovation by making software and hardware by American manufacturers less attractive to worldwide buyers and incentivize businesses to move their research and development arms abroad. The messaging app company Signal has already stated that they will move their entire company if EARN IT passes, and numerous watchdogs including the Electronic Frontier Foundation and the Center for Democracy & Technology have been warning about the impacts of the passage of this legislation on privacy, encryption, and innovation. Encryption is not for criminals, it is for those who value privacy, and without it there would be more crime and more lawlessness on the Internet. The Federal Government needs to enhance the privacy laws we have, not rile our base instincts to undermine them.