A privacy organization warns a bill in Congress would violate privacy and security by requiring “every message sent” to be read by government-approved scanning software.
The Electronic Frontier Foundation said the EARN IT bill sponsored by Sens. Lindsey Graham, R-S.C., and Richard Blumenthal, D-Conn., would spell the end of encryption online.
The bill’s authors avoided the word “encryption,” EFF noted, but they proposed “legislation that enables an all-out assault on encryption.”
“It would create a 19-person commission that’s completely controlled by the attorney general and law enforcement agencies. And, at the hearing, a vice-president at the National Center for Missing and Exploited Children made it clear what he wants the best practices to be,” EFF said.
“NCMEC believes online services should be made to screen their messages for material that NCMEC considers abusive; use screening technology approved by NCMEC and law enforcement; report what they find in the messages to NCMEC; and be held legally responsible for the content of messages sent by others.”
The objective appears to be “an Internet where the law required every message sent to be read by government-approved scanning software. Companies that handle such messages wouldn’t be allowed to securely encrypt them, or they’d lose legal protections that allow them to operate.”
The proposal would provide for a removal of some legal protections, under Section 230 of federal law, for sites that don’t follow the “best practices.”
That would mean the sites “can be sued into bankruptcy,” the report said.
“You can’t have an Internet where messages are screened en masse, and also have end-to-end encryption any more than you can create backdoors that can only be used by the good guys. The two are mutually exclusive. Concepts like ‘client-side scanning’ aren’t a clever route around this; such scanning is just another way to break end-to-end encryption. Either the message remains private to everyone but its recipients, or it’s available to others,” EFF warned.
The organization, which advocates for privacy issues and individual control over online data, said the “commission” would be dominated by law enforcement and its allies.
“Not only will those groups have a majority of votes on the commission, but the bill gives Attorney General Barr the power to veto or approve the list of best practices. Even if other commission members do disagree with law enforcement, Barrās veto power will put him in a position to strongarm them.”
Once a scanning precedent is set, EFF said, “Authoritarian regimes around the world will rejoice, as they have the ability to add their own types of mandatory scanning, not just for child sexual abuse material but for self-expression that those governments want to suppress.”
STOP THE GRAHAM-BLUMENTHAL ATTACK ON ENCRYPTION
Thatās what the Senate Judiciary Committee has proposed and hopes to pass into law. TheĀ so-called EARN IT bill, sponsored by Senators Lindsey Graham (R-SC) and Richard Blumenthal (D-CT), willĀ strip Section 230 protectionsĀ away from any website that doesnāt follow a list of ābest practices,ā meaning those sites can be sued into bankruptcy. The ābest practicesā list will be created by a government commission, headed by Attorney General Barr, who has made it very clear he would like to ban encryption, and guarantee law enforcement ālegal accessā to any digital message.
The EARN IT bill had its first hearing today, and its supportersā strategy is clear. Because they didnāt put the word āencryptionā in the bill, theyāre going to insist it doesnāt affect encryption.
āThis bill says nothing about encryption,ā co-sponsor Sen. Blumenthal said at todayās hearing. āHave you found a word in this bill about encryption?ā he asked one witness.
Itās true that the billās authors avoided using that word. But they did propose legislation that enables an all-out assault on encryption. It would create a 19-person commission thatās completely controlled by the Attorney General and law enforcement agencies. And, at the hearing, a Vice-President at the National Center for Missing and Exploited Children (NCMEC) made it clear [PDF] what he wants the best practices to be. NCMEC believes online services should be made to screen their messages for material that NCMEC considers abusive; use screening technology approved by NCMEC and law enforcement; report what they find in the messages to NCMEC; and be held legally responsible for the content of messages sent by others.
You canāt have an Internet where messages are screened en masse, and also have end-to-end encryption any more than you canĀ create backdoors that can only be used by the good guys. The two are mutually exclusive. Concepts like āclient-side scanningā arenāt a clever route around this; such scanning isĀ just another way to break end-to-end encryption. Either the message remains private to everyone but its recipients, or itās available to others.
The 19-person draft commission isnāt any better than the 15-person commission envisioned in an early draft of the bill. Itās completely dominated by law enforcement and allied groups like NCMEC. Not only will those groups have a majority of votes on the commission, but the bill gives Attorney General Barr the power to veto or approve the list of best practices. Even if other commission members do disagree with law enforcement, Barrās veto power will put him in a position to strongarm them.
The Commission wonāt be a body that seriously considers policy; it will be a vehicle for creating a law enforcement wish list. Barr has made clear,Ā overĀ andĀ overĀ again, that breaking encryption is at the top of that wish list. Once itās broken, authoritarian regimes around the world will rejoice, as they have the ability to add their own types of mandatory scanning, not just for child sexual abuse material but for self-expression that those governments want to suppress.
The privacy and security of all users will suffer if U.S. law enforcement is able to achieve its dream of breaking encryption. Senators should reject the EARN IT bill.
