The EARN IT act is back, and it’s more dangerous than ever

http://cyberlaw.stanford.edu/blog/2022/02/earn-it-act-back-and-it%E2%80%99s-more-dangerous-ever

by grappler • 4 years ago

1363 476 4 years ago

cyberlaw.stanford.edu

prepend2• 4 years ago

I wish they would address real problems like arbitrary enforcement of TOS that damages users with no recourse. There’s no regulation for what happens when Google or Facebook or whatever deletes or blocks an account and provides no support.

Child abuse is serious, but not that common and this law will do little to change that. The lack of a UCC-style law for big tech platforms affects way more people.

This seems like BS that will squelch small players that can’t afford to comply. And consolidate more power into a few small firms.

ridaj• 4 years ago

There’s no regulation for what happens when Google or Facebook or whatever deletes or blocks an account and provides no support.

Yes there is, per the trade regulations you're entitled to a refund

Wait

I'm only partly sarcastic. If you think you're entitled to anything provided as a free service then the problem starts there. Do I miss the days when ISPs provided email as part of your subscription? Then made you pay for anything over 100 Mb? Then held your email address hostage if you wanted to switch providers? Hell no. But I also don't think government should force anyone to provide services to me for free.

Edit: downvotes without replies do not help me understand where this feeling of entitlement to a free service comes from; insight would be appreciated.

bee_rider• 4 years ago

The service isn't free, you pay for it with your personal information. If they want to provide refunds by deleting our information, that seems like a fair trade.

umbauk• 4 years ago

Well one could argue Google and FB services are not free. Those 2 companies are 2 of the most profitable, valuable companies in the world. If they are providing their services for free, how can that be? Our attention and information is what they profit from, and that should not be undervalued. They are certainly not providing these services to us out of the goodness of their hearts.

heartbeats3• 4 years ago

These companies are providing critical infrastructure. If I run a business that's dependent on the phone lines and they cut me off, I'm entitled to a hell of a lot more than the monthly fee for my line. There's many businesses that are solely reliant on Facebook to earn a living. Should Facebook own them?

zbrozek• 4 years ago

Paying for their services doesn't seem to make the customer service any better.

prepend2• 4 years ago

I pay for their services with money every month and year. Their customer service sucks. I’m worried about getting hosed by them one day.

There are numerous stories of paying customers losing their account and getting no help.

I didn’t downvote you, but your response seems disengenuous. Even if the service was free, people depend on them substantially and losing that access disrupts businesses and lives.

Google is a monopoly for search. Losing the ability to buy ads or broadcast on YouTube without any due process is a big deal and needs regulation. I’m not a fan of regulation and thinks there are many inefficiencies. But Google has had 20 years without regulation and obviously won’t change because it’s profitable the way they have it now.

foxfluff• 4 years ago

I'm only partly sarcastic. If you think you're entitled to anything provided as a free service then the problem starts there. Do I miss the days when ISPs provided email as part of your subscription? Then made you pay for anything over 100 Mb? Then held your email address hostage if you wanted to switch providers? Hell no. But I also don't think government should force anyone to provide services to me for free.

I'm gonna argue that government shouldn't force anyone to provide services for free, but they should mandate that if you provide a service, you also take responsibility for the customer's property in context of that service, whether that service is free or not.

If I take my car to be serviced and they accept it, they can't just tow it to a junkyard and tell me to bugger off when I come back for it. Why can Google effectively put my private correspondence through the shredder and tell me to bugger off?

Likewise, offering to hold your grocery bag for a minute for free while you go to the restroom doesn't entitle me to destroy everything in the bag and throw it away.

fallingknife4• 4 years ago

Squelching small players is the intent. Large institutions are easy to exert political control over. It's hard to exert political control over masses of individuals. It benefits the Republican party when you get your news from FOX. It benefits the Democratic party when you get your news from CNN. It does not benefit the Democratic or Republican party when any individual can broadcast their views to millions of willing listeners on a platform like Youtube. This is why you only ever hear about "misinformation" coming from small time players. When CNN/FOX et al. do it (which is constantly), they get a free pass. Both parties share an interest in monopolizing information flow to their followers, which is why they both support this law.

cossatot• 4 years ago

FOX and CNN are constantly accused of spreading misinformation by huge swaths of the populace (but not necessarily the same swath for both networks).

SturgeonsLaw• 4 years ago

These assholes just keep trying and trying until they get their way. At least it's good to see there's some actual pushback in the United States. Here in Australia, this sort of legislation has bipartisan support, it gets rubberstamped and passed on a Friday evening before a public holiday with the media staying silent.

Keep fighting against these bills, or else you'll get a government that happily runs roughshod over your civil liberties like ours.

Arubis• 4 years ago

Of course they do. They know the equation: we have to win every time; they only have to win once.

matheusmoreira3• 4 years ago

Yeah. Maybe there should be a law that makes it illegal to attempt to ban encryption.

dane-pgp5• 4 years ago

But what if they make it illegal to attempt to make it illegal to attempt to ban encryption?

nichos• 4 years ago

Shouldn't it be covered under the 4th amendment?

cyberlurker• 4 years ago

No matter your opinion on the issue, the firearm lobby would probably serve as an effective model for fighting legislation like this on a long term basis.

KerrAvon2• 4 years ago

The second amendment, like abortion, is a political wedge issue used by politicians to wield against their opponents. You’re not going to replicate that with issues requiring more nuance and that cannot be used as emotional cudgels.

umvi• 4 years ago

The point though is that you can't afford minor losses here and there, because it's a war of attrition. Firearm lobby knows that the opposition's strategy is to just chip away at 2A rights slowly over the decades. Therefore, they can't afford to allow minor gun control victories here and there, or else a century later they are out of business and their supporters have no 2A rights anymore.

Same with this. You can't allow minor anti-encryption victories here and there chipping away at privacy/mathematical rights or your great grandkids won't have those freedoms.

queuebert• 4 years ago

I think the lack of nuance employed by both 1A and 2A communities has been a strength.

Nuance allows compromise, and compromise allows incrementalism. It's a classic fascist play. It's also a classic politician play to get people lost in the details so that no one truly understands their intent, i.e. "never let a good crisis go to waste".

I'm willing to be proven wrong, however.

bpodgursky• 4 years ago

It would require people willing to be single-issue voters, the way many are on abortion or firearms.

Would anyone here switch party votes to a candidate who sided their way on tech privacy — even if they disagreed on other core principles like abortion, gun rights, religion in schools, etc?

Maybe a few, but I'm not convinced many.

vorpalhex• 4 years ago

Tie it to existing wedge issues. "Do you want Facebook knowing every time you buy a gun/get an abortion?"

spaetzleesser• 4 years ago

I wouldn’t. That’s the sad thing in the US with its entrenched two party system. You have to choose between two unlikeable options. I usually vote Green but it’s sad that these votes are “lost”.

strulovich2• 4 years ago

Those single issue voters are the not present in many other countries besides the US.

This might show that the right arguments and lobbying can turn what is not a big political debate into a wedge over time.

logiczero• 4 years ago

If encryption is treated as a munition[0], does it mean that the Second Amendment could actually be used to protect the right to use it? If the intent of the Second Amendment is to protect citizens' ability to combat government overreach, it seems like it should...

[0] https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...

jimbob45• 4 years ago

Graham (R-SC)

Blumenthal (D-CT)*

Durbin (D-IL)

Grassley (R-IA)*

Feinstein (D-CA)

Cornyn (R-TX)

Whitehouse (D-RI)

Hawley (R-MO)

Hirono (D-HI)

Kennedy (D-LA)*

Casey (D-PA)

Blackburn (R-TN)

Masto (D-NV)*

Collins (R-ME)

Hassan (D-NH)*

Ernst (R-IA)

Warner (D-VA)

Hyde-Smith (R-MI)

Murkowski (R-AK)*

Portman (R-OH)*

* are up for re-election this year.

Bit of a pain to find this information really - couldn't find a single news outlet with a list of who introduced the bill. Kinda seems like they don't want to be known.

yareally• 4 years ago

Portman (R-OH)*

He's retiring this year. Candidates running for his spot in his party are likely to support it though

KerrAvon2• 4 years ago

Feinstein really needs to go. CA can do so much better.

loteck5• 4 years ago

By all means contact and organize on Senators, it's good practice. In my experience they are completely unresponsive to anything smaller than the largest and most funded groups. Still, making noise is only good.

You may find your local house rep to be much more persuadable and willing to listen to your educated points of view. Getting their position stated publicly and on the record in either direction can be very meaningful.

1121redblackgo• 4 years ago

Really surprised Warner is on this list, and very unsurprised by the inclusion of both remarkable senators from Iowa

userbinator• 4 years ago

Exactly 10 on each side --- that's about as non-partisan as it gets.

mrandish5• 4 years ago

I think a lot of us are no longer convinced traditional two-party partisanship is a useful lens through which to understand politics. Regardless of party, the politicians pushing this bill are overwhelmingly pro-surveillance state and pro-big government as well as being invested in perpetuating the two-party machine. Personally, I now see things more through a lens of those who perpetuate the two-party machine and big federal government on one side and those who are skeptical of both the eternally growing central government for it's own sake and the reduction of local and individual autonomy.

Neither big party really represents many of my viewpoints as much in recent years. Even when I do agree with one of them on something, I now suspect many of the inter-party battles are as staged as pro-wrestling where the eventual prevailing side was already predetermined by special interests, lobbyists and the party machines. It's weird how many votes on something I care about fail to survive committee or amendment by just one vote. And the politicians who voted "against" the thing in the 'losing' party, all happen to be in very 'safe' districts or not facing reelection soon and those facing reelection in 'unsafe' districts happen to be the ones who voted "for" it.

This happens far too often to statistically be random chance. I hate that this possibly makes me sound like a conspiracy nutjob but the math here says something's definitely going on behind the scenes.

drilldrive• 4 years ago

Authoritarian abuse is second to war in being the most bipartisan issue.

greenie_beans• 4 years ago

Hyde-Smith is from MS not MI

eikenberry5• 4 years ago

This seems like it could have a significant upside if passed. That it would help promote federated and peer to peer free software systems with no centralized, commercial target to sue. Might even require some of the current giant social networks to pair back significantly to avoid liability.

I'm not saying I want it to pass, just think the unintended consequences might be interesting and even beneficial in some ways.

bo1024• 4 years ago

Pretty sure the government won't view it that way. It'll be called a loophole and crushed if it gets mainstream. This is the country where sending an HTML GET and receiving response 200 can be prosecuted under the CFAA.

We need a legal environment that explicitly protects encrypted communications, not one where they are are maybe tolerated on the fringe.

eikenberry5• 4 years ago

This is a different battle. The government has gone after general purpose encryption multiple times and has been beaten back so far. And while this would definitely be a win for that side of things it isn't the same battle and the Earn IT Act is not about encryption in general. It is about encryption in the context of commercial entities and their managed content.

devwastaken2• 4 years ago

Decentralized does not mean lack of liability. That's a marketing ploy. P2P filesharers and tor hosted sites are taken to court on the daily because of this one little trick called the IP address. Everything you send has your external IP. It doesn't matter that they "can't prove it was you". Courts have continually upheld that an IP address is grounds for either civil discovery or further criminal investigation. And yes, the court can absolutely compel you to unlock your full disk encrypted MacBook/Linux/bitlocker whatever.

The only reason people en mass can do decentralized is because of the availability of encryption, because VPN's, because companies and software can offer encryption. This legislation and it's precedent would kill the decentralized web. It's not as if Google is going to go broke - they'd be the first to be approved and go on their merry way.

eikenberry5• 4 years ago

I said P2P, not TOR. With P2P systems you only host your own stuff. So if they want to take someone to court it would be the person with the illegal content on their system... IE. who you want to go after. There is no reason to have to prove anything. Those P2P filesharers that are taken to court are the ones sharing the files, not just random people on the network.

With P2P and Federated systems (encrypted or not), the people hosting the content are breaking the law and are the ones you go after. Just like now (pre Earn-It), where they go after the people posting the files to the central servers and not the central servers themselves.

heartbeats3• 4 years ago

Sites hosted behind Tor do not reveal your external IP address.

mrandish5• 4 years ago

While this bill is strongly opposed by the Internet Society, ACLU, CDT, and EFF, the critiques I've read don't get much into the real "why" behind this legislation continuing to be pushed so forcefully. The pretext is, of course, "protect the children" and more generally law-and-order with a bonus side-helping of "stop those awful social media giants." While these justifications are (hopefully) obvious misdirection to most, I'd like to see more mainstream discussion about who this bill benefits and why. The legislation 'coincidentally' achieves exactly the agenda proposed by the "surveillance state" (ie CIA, NSA, FBI, DHS, law enforcement lobby, state prosecutors, etc). While it doesn't specifically prohibit public access to encryption, it seeks to create nearly the same effect by making it legally risky for large social media and platform companies to offer end-to-end encryption as a default to law-abiding citizens. It's no accident that almost every version of the bill creates this exposure to essentially bottomless legal liability for platforms offering secure communications.

Frankly, this scares the crap out of me. These people seem incapable of understanding the existential threat to free society and democracy posed by limiting everyone's ability to communicate private thoughts. While not explicitly outlawing untappable communications, it's much easier to identify who is choosing to use end-to-end encryption when it's not the typical default. This will ultimately put all of us who care about secure communications under default suspicion, whether our interest in private comms is a moral ideal, political principle or simply proper technical architecture and data hygiene. In today's multi-national environment of nation-state, criminal and privateer (NSO etc) threat actors, insecure communications over Internet infrastructure should only be seen as an ill-advised risky behavior or a technical bug.

ocdtrekkie2• 4 years ago

While this bill is strongly opposed by the Internet Society, ACLU, CDT, and EFF,

It's worth noting that the companies destroying democracy that this bill regulates (Google, Facebook, etc.) are major donors to all of these organizations.

jjulius• 4 years ago

"See, we donate to these organizations, we're not that bad, promise!"

wbsss44122• 4 years ago

Seems the world isn’t all black and white.

It’s not like those companies have “destroy democracy” as their mission.

ideashower• 4 years ago

And Mozilla Corporation’s entire business model is built on Google’s financial support. Does that make Mozilla’s (or the ACLU etc.) work inherently suspect or anti-democratic?

TameAntelope2• 4 years ago

None of those companies are destroying democracy, that's needless hyperbole...

E2EEd2• 4 years ago

E2EE is offered to all users, whether or not they are law-abiding. More precise is to say that E2EE is offered to users who are primarily law-abiding.

Your points are well-heard, even by those in the IC. What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC related to the growing entropy of E2EE wielded at scale by folks, a large subset of whom are engaging in criminal behavior. I strongly believe that fighting this issue with a hard-line no compromise response will result in an undesirable outcome for your agenda.

I am not a fan of kneecapped cybersecurity in consumer endpoints, which is the elephant in the room. It's a compromise borne of the E2EE entropy problem, intentional or not. I don't support unchecked recoverable encryption in any centralized fashion, nor do I support covert backdoors or skeleton keys.

Unfortunately, too many folks defend their position from libertarian ideals, a position which does have a technical justification. It just misses the bigger picture - that most folks in govt are just doing their job. A compromise will seek to enable those doing their job correctly while preventing abuses with technological means.

Telling the govt "too bad, you can't stop math" will backfire. The law can be used to force tech companies to literally stop doing math at scale.

mrandish5• 4 years ago

What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC

Public policy orgs like EFF etc have proposed modifications to limit the most disastrous elements of this proposal but to the extent those proposals fix or limit the 'accidental' limitless liability for communications platforms, they are met only with disingenuous cries of "think of the children." I think it's pretty clear the lack of "good-faith discussion" lies with the people who've never openly acknowledged what all this is really about.

even by those in the IC.

Hopefully the intelligence community, as opposed to the domestic law enforcement agencies, already understands how dangerous this legislation could be for U.S. national interests. The unintended consequences won't stop at social media. Platforms of all kinds will react to the liability exposure or merely the possibility of it. With other nations imposing their own in-country data requirements on trans-national platforms how many platforms (or their upstream technology providers) will maintain a separate insecure version for domestic tapping and a robustly secure version for international use? Just like our own backdoors being used against us, we've already seen how this kind of thing has a way of undermining our own security. Short-sighted bureaucrats are playing with fire here.

too many folks defend their position from libertarian ideals

I don't see how this is tied to uniquely libertarian ideals. The 4th amendment prohibition on government search of citizen's "papers and property" isn't some aspirational ideal or partisan political viewpoint - it's always been at the very core of the nation. It's also been continuously endorsed by both liberal and conservative supreme courts for hundreds of years.

that most folks in govt are just doing their job.

To the extent their actions undermine the constitution, it's no longer "law enforcement". Sadly, quite the opposite. If the law is the 'operating system', then the constitution is the 'secure kernel' - the last line of defense against both external AND internal threats capable of undermining the integrity of the entire system. Law enforcement has privileged accounts which are THE primary internal threat the secure kernel was designed to stop. From day one in the 1700s, the constitution has always made the job of law enforcement MUCH harder. That's not a bug. It's "As Designed" and perma-marked by the original designers (and the maintainers in SCOTUS) as "Won't Fix". Hell, it goes beyond just a feature - limiting the power of the government is the explicitly stated purpose of the thing - to the extent it puts a big fence around the few powers granted to government (with the barbs pointed inward) and grants everything else, mentioned or not, as powers granted to citizens.

It's always been well understood, as well as taught in elementary school, that the unique freedoms the country was founded on came with a cost - and sometimes that cost would be high, but... preserving these freedoms, including making things harder on law enforcement (and potentially easier on criminals), was worth the cost. I suspect congress is going to be surprised by how non-partisan (and non-negotiable) the fundamental integrity of the system is for most users.

iamstupidsimple• 4 years ago

Telling the govt "too bad, you can't stop math" will backfire. The law can be used to force tech companies to literally stop doing math at scale.

There is no practical scenario where those who want to use e2e will not have that capability. Even if technology companies are totally banned from producing it domestically, it's trivial for foreign companies to provide the e2e software and supply it over the internet.

bradleyjg3• 4 years ago

Law enforcement and IC are starting with the assumption that they are entitled to the best access they’ve ever had. Yes, things are going dark that they had access to 20 years ago, but 20 years before that they didn’t have access because most of the conversations were happening face to face. At that point they needed to rely on traditional boots on the ground police/intelligence work instead of electronic backdoors. Why is it impossible for them to go back to doing things that way?

matheusmoreira3• 4 years ago

Law enforcement issues don't override all other concerns. If life is difficult for them, good. That's the point. It should be difficult in order to prevent abuse of power. Encryption is a perfectly reasonable reaction to governments that give themselves the right to surveil the entire planet. Nobody really cares that it makes their life harder. That's exactly what it's supposed to do. It should be incredibly hard if not impossible for the NSA employee to spy on his spouse.

If they want to investigate stuff, they should have to get warrants and literally send out operatives to physically compromise the targeted equipment. This puts a limit on the scale of government operations. This is how it's supposed to be.

quanticle• 4 years ago

What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC related to the growing entropy of E2EE wielded at scale by folks, a large subset of whom are engaging in criminal behavior.

I think that the tech community has extended entirely too much "good faith" towards a law enforcement and intelligence community who feel entitled to review and record all communication at their own sole discretion. I know you think that you're the "good guys", trying to keep us safe from "adversaries", but you have to understand that after the Snowden leaks, many people in the tech. industry don't see you that way. They see you as the diet-Coke version of the Chinese Ministry of State Security, and feel that if you were able to slip your legal bonds, you'd attack free speech just harshly as the Chinese Communist Party does.

Of course, from your perspective, it's not cracking down on free speech. It's "preserving democracy" by "suppressing misinformation" planted by "hostile adversaries" and "non-state actors".

mr_toad2• 4 years ago

What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC related to the growing entropy of E2EE wielded at scale by folks, a large subset of whom are engaging in criminal behavior.

How about a good faith discussion of the fact that crime rates are at historic lows, or the fact that many crimes (burglary, car theft) are never investigated, or the fact that surveillance is never going to solve, let alone prevent the real issues that people care about, like domestic violence, gun violence, or the epidemic of prescription pain killer addiction.

Focus on crime prevention, not more law enforcement empire building.

guy982387103• 4 years ago

It just misses the bigger picture - that most folks in govt are just doing their job.

Any office with excessive power will be a magnet for assholes. Excessive power will be abused.

guy982387103• 4 years ago

E2EE wielded at scale by folks, a large subset of whom are engaging in criminal behavior

You cannot really engage in criminal behavior exclusively via E2EE communication. Victim would use the communication as evidence. All the crimes you are talking about have an essential component outside E2EE communication, which means that detection and evidence gathering is possible without breaking E2EE.

jmcnulty• 4 years ago

How secure is E2EE anyway when, like WhatsApp, it's implemented such that you blindly trust a 3rd party to distribute the public keys and instruct your client who it should be encrypting and sending your messages to? How do you know your mobile app isn't also sending encrypted copies of your messages to a ghost user you have no visibility of? A ghost user that could be WhatsApp, law enforcement or anyone.

danShumway2• 4 years ago

What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC related to the growing entropy of E2EE wielded at scale by folks

What would a "solution" for the IC allow them to do, and what would be the limits on it? Would the IC stop asking to weaken encryption after it was granted?

"Meet us halfway" is meaningless if we don't know what halfway is or what the extent is of what you're asking for, and proponents of these bills never give an answer to that question because they don't have an answer to that question. Is "meet us halfway" on CSAM zero CSAM, because I've people advocate for that -- and if that's the position and any time that encryption gets in the way of that we need to compromise, then you are effectively asking to abolish encryption. Is it that there should never be any information that law enforcement can't access -- because if so, you're asking to ban encryption.

Others have pointed out (correctly) that law enforcement today has unprecedented tools to monitor civilians and catch criminals, everything from facial recognition (which has largely not been banned across America) to digital dragnets to public social media to cooperation with companies that hoover up tons of PII. We carry devices that allow law enforcement with a warrant to ask cell companies for the name and location of everyone inside of a radius. That is a frankly wild amount of power.

You have already been met hecking way more than halfway on the issue of privacy vs law enforcement, and it's just utterly dishonest to claim otherwise. What we're seeing is that on the one issue where law enforcement has less access than they used to have, that's suddenly an existential problem. And my takeaway from that is that what law enforcement is asking for is not to be met halfway, law enforcement is asking to weaken and disrupt literally any tool that makes their job harder in any way at all. Any technology that weakens their level of access to anything is an existential problem to them.

It is not Libertarian to ask for end to end encryption, that is a normal, moderate position for people across all political spectrums to take. The characterization of "maybe police shouldn't be able to access everything about me at time, including my location and every single one of my conversations" as a Libertarian view is just so utterly disingenuous and dishonest. So what is a halfway position where people in the government will stop calling to weaken encryption? I do not believe that position exists, and I have never heard anyone try to articulate it using measurable criteria that don't boil down to "we'll constantly balance and use the courts". I have never seen law enforcement as a unified group argue, "you know what, we have too much access here and maybe we should have less, and it's good that this technology makes our job harder." It doesn't happen.

There is not a solution to this problem that law enforcement will ever be satisfied with other than complete surveillance of everyone in the United States. And these are the people that whine that privacy advocates are "absolutists." I carry a hecking cell phone already; you have monitoring tools, stop acting like you don't. Stop pretending that an era of unprecedented surveillance at a level that has never before been seen in all of human history is actually super awful and hard for you because you can't also read every single text message I've ever sent across all of time.

kragen26• 4 years ago

These people seem incapable of understanding the existential threat to free society and democracy posed by limiting everyone's ability to communicate private thoughts.

The existential threat this bill poses to free society and democracy is exactly why they're supporting it. It's not some accidental side effect.

They're opposed to the existence of free society and democracy because it limits government power, which means letting criminals and terrorists run free. They want the police to have all the power they can get because, as far as they're concerned, they're the good guys, and giving the good guys more power helps them win against the bad guys.

Free society means limited government, and the only way for the government to be in favor of that is for the government to vote against its own interests. That requires the people in the government to identify more strongly with the people living under the government than with the government itself. This is precarious at the best of times. Why would the governing party want to make it easy to organize dissenting political parties and alternative centers of power? Power might fall into the wrong hands.

I know that sounds sarcastic, but try to see it from their perspective, even if you don't agree with it.

treis2• 4 years ago

We had a free society and democracy before the internet.

akomtu• 4 years ago

The gov isnt worried about criminals or terrorists: those guys are easy to deal with. The gov is worried about organised protests, like those canadian truckers, because protesters are protected by laws. Encrypted communications is an obvious enabler of such protests.

emmelaich5• 4 years ago

With the paranoidal view you're placing yourself outside the realms of sensible discussion.

You can't really think that some politicians are knowingly and deliberating proposing an existential threat to "free society and democracy."

guy982387103• 4 years ago

They want the police to have all the power they can get because, as far as they're concerned, they're the good guys, and giving the good guys more power helps them win against the bad guys.

But we all know that giving excessive power to good guys turns them rather reliably into bad guys.

Joeri• 4 years ago

Free society means limited government, and the only way for the government to be in favor of that is for the government to vote against its own interests.

I would argue that a free society protects people’s rights, and this is impossible without a strong government. As for voting against its own interests, the government in a true democracy is quite literally the will of the people. We get what we vote for. So if people in general are unhappy with the outcome it is democracy itself that has broken down. The solution to a broken democratic process is not to limit the consequences of that process by shrinking government, it is to fix what’s broken in the first place. In a healthy democracy the government will take up only the responsibilities people want it to take up, and no more than that.

bambax• 4 years ago

Free society means limited government

Strong disagree. A good government protects freedom from big private companies that feast on it. Antitrust laws cannot be enforced by a weak government, and without those, there can't really be freedom.

bitL• 4 years ago

Maybe those people absolutely understand the implications for free society. What if there was a power transfer on the background, over many years, unnoticed, and the winning group now doesn't want any disruptions coming from encrypted communication in the future?

IAmGraydon• 4 years ago

It’s truly amazing how many people are conspiracy theorists these days.

PaulDavisThe1st• 4 years ago

Ending Section 230, incrementally or all in one go, has been increasingly on the minds of politicians (mostly but not exclusively conservative ones) for some time now. There's a lot more to EARN IT than just that, but some of them will vote for anything that increases the liability exposure of anyone hosting anything online.

judge20202• 4 years ago

All section 230 does is make it so that "platforms" can remove posts it doesn't like without needing to assume liability for every other posts. Unless they think Twitter is going to hire a few million employees to screen every post, Twitter and the rest would simply turn off the platform to anyone who isn't verified or doesn't otherwise sign a waiver releasing twitter of that liability (which was possible before CDA, as well, but nobody wanted to introduce that sort of barrier to social media/forums back then).

judge20202• 4 years ago

These people seem incapable of understanding the existential threat to free society and democracy posed by limiting everyone's ability to communicate private thoughts.

Democracy only directly benefits the people, not those in power. The only difference between a democracy and a dictatorship in terms of leaders keeping key supporters happy (the people vs. just those that hold office and control the military) is that democracies tend to employ more creative people with society-enhancing goals, thus driving technology forward and maybe even extending our lifetimes (via better healthcare).

goodpoint2• 4 years ago

These people seem incapable of understanding the existential threat to free society and democracy posed by limiting everyone's ability to communicate private thoughts

Oh, they understand perfectly.

Power-hungry people love authoritarianism. Authoritarianism is opposed by democracy.

They are the threat.

gotoeleven• 4 years ago

Its nice to see that the ACLU actually opposes something that stomps on american civil liberties these days!

faangiq• 4 years ago

It’s because all those orgs are co-opted by tptb. Thoughtcrime is already here, it was welcomed eagerly.

ren_engineer• 4 years ago

it's almost comical how politicians always use the same tactic for destroying online privacy too - "think of the children!"

belorn• 4 years ago

While this bill is strongly opposed by the Internet Society, ACLU, CDT, and EFF, the critiques I've read don't get much into the real "why" behind this legislation continuing to be pushed so forcefully.

The original bill was originally pushed because certain republican accounts was banned from certain social media platforms. It is explained pretty well on its Wikipedia article (https://en.wikipedia.org/wiki/EARN_IT_Act#Events_leading_to_...).

One potential reason why it is still getting pushed is that politicians on both sides of the fence is still afraid of the power that social media have, and they are using the pretext of "protect the children" in order to get bipartisan support and getting some distance to the historical events that lead up to the creation of the bill.

malwarebytess• 4 years ago

These people seem incapable of understanding the existential threat to free society and democracy posed by limiting everyone's ability to communicate private thoughts.

I proffer instead that this outcome isn't a side effect but their ultimate goal.

csomar2• 4 years ago

the critiques I've read don't get much into the real "why" behind this legislation continuing to be pushed so forcefully.

I think, what most people are missing, is that Democratic (the free world) governments have lost control of the narrative. It's not that there wasn't corruption before, but people trusted the government more back in the day. Before the immersion of social media, information moved slowly. There wasn't free channels to transfer information (the Media controlled what can get out) and people couldn't take high-quality photos, videos and live stream to their fellow citizens.

This changed now. This means the government and politicians can't control the narrative anymore (ie: almost all politicians are corrupt now!). This is doubly worse since young people disproportionately use social media. TV is still watched, but only by seniors. They'll be gone soon and the politicians will have to rule a ruly population.

The next decade is going to be quite challenging to Democracy, Freedom of Speech, Privacy, Freedom of Movements and all freedoms and liberties really. Many of the liberties the West population take for granted are quite expensive; you better be ready for this change.

BoorishBears2• 4 years ago

This entire comment is the definition of FUD.

It's not that complicated:

Politicians don't know technology

Politicians hear there's this thing that lets bad guys have fully secure conversations that even 3 letter agencies can't crack.

Politicians see blocking that as a political win.

All of this nonsense about corruption... you think politicians are successfully going to get social media giants to intercept DMs that say bad things about them?

Or this is the first step to a CPP-esque lockdown on free speech?

That's fantasy at best and a disturbing level of paranoia at worst.

kmeisthax• 4 years ago

The Internet wasn't the first time we had free speech in both senses of the word, though. Before the era of broadcast television, the FCC running a de-facto censorship regime, and the Five Filters; everyone read newspapers to get their news. This prior era of media was a lot more like the Internet than I think a lot of people would care to admit. We had clickbait, they had yellow journalism; we had Trump, they had the Know-Nothings; etc.

One other constant shared between the pre- and post-broadcast eras of media was an extremely high level of distrust towards politicians. Why? Well, the handful of companies that owned TV broadcast licenses weren't about to start biting the hand that fed them. Also, the FCC outright banned them from pushing overtly political narratives. This ultimately acted to reduce the total amount of information voters knew about their candidates.

Let's say that you happen to have brainworms. And your local Senator promised on TV that every brainworm had a right to live in a person's head. You, obviously, vote for him. However, Congress then passes the Comprehensive Brainworm Mitigation Act of 1973. But you remember that your Senator fought for you and your brainworms, because that's all you saw of him on TV. In fact, he goes to the press and swears how he fought to tone down the brainworm bill, or included an amendment for brainworm sanctuaries.

Today? Well, the moment that the Worm Free Children Act of 2023 passes, you're already getting pings on Facebook and Twitter about how your Senator betrayed you. You hear rumors about how he secretly agreed to pass the bill months ago. Someone's already spamming you with memes about how he sleeps with earplugs in his ears, constantly in fear that a brainworm might slither into his ear canal. You're talking in realtime with millions of other brainworm hosts, all of whom are angry and planning protests against your brainworm-hating Senator.

Of course, all of that could be a complete and total fabrication. It does not matter. Defamation is dual to censorship, after all.

This actually isn't a new condition, but regression to the mean. American politics in the 1800s was chock full of people with brainworms trading wild accusations around in similar fashions. The main difference between then and now was just the speed at which news travelled, but the effects were the same.

Diesel5554• 4 years ago

Edit: See thread below, the EARN IT act does not in any way reclassify the designation of social media companies under section 230 or solve the issues mentioned in this post with 230. The change to 230 just provides exceptions for CSAM. However, keep reading if you want background on 230 and why many people are trying to change it.

I want to provide some background on section 230 which the EARN IT act proposes to amend. I was against regulating social media companies, then I researched and wrote a paper on misinformation and changed my opinion on whether or not any policy action should be taken. I'm not saying the EARN IT act is correct (Edit: It's not), but here are some excerpts with sources on why I believe Section 230 should be amended in some way. I hope it makes more clear the reasons people want to change section 230.

Social media companies currently enjoy protections from Section 230 of the Communications Decency Act of 1996. For reference, Myspace was launched in 2003. Section 230 allows social media companies to be classified as interactive computer services and not information content providers (Gallo, 2021). Due to this designation, social media companies are not responsible for the content they distribute. Even media companies in America are still held responsible for libel or false information designed to incite immediate violence or public harm (FCC, 2021) which social media companies are not. The media is still provided many freedoms guaranteed by our constitution while being held responsible for gross negligence.

Social media companies do not adequately moderate the content they promote to their users, allowing members of society to be presented misinformation by domestic and foreign actors resulting in polarization, the propagation of false facts, and the loss of faith in our democratic electoral process. Social media algorithms, motivated by financial gains, promote divisive content and have little incentive to prevent the distribution of false information. This false, divisive information comes from internal actors, such as those who want to discredit climate change and COVID facts. It also comes from external actors, such as Russia, who want to destabilize our democratic systems and influence our policy choices in their best interest.

For example, YouTube shared videos containing COVID-19 misinformation 20 million times, generating 71 million reactions in eight months (Gallo, 2021). Russia's Internet Research Agency (IRA) is a private organization funded by a close confidant of Putin (Bowen, 2021). Eighty thousand posts were made on Facebook by IRA-controlled accounts in two years, reaching 126 million users. The IRA even organized political rallies in the United States through these accounts (Mueller, 2019). Intelligence services have determined that Russia uses its cyber teams to "undermine public faith in the U.S. democratic process," as Russia's influence operations demonstrated in the 2016 election against Hillary Clinton (Sayler, 2021).

I'm not saying that social media companies should be held to the same standard as content creators or the media, or that the EARN IT act is right. I haven't looked at the implications of that. However, the current law is outdated and something needs to change the incentives of social media companies to prevent these externalities (influencing elections, misinformation, etc) from effecting our population.

FCC. (2021, January 8). Broadcasting False Information. Federal Communications Commission. https://www.fcc.gov/consumers/guides/broadcasting-false-info...

Gallo, J. A. G., & Cho, C. Y. C. (2021, January). Social Media: Misinformation and Content Moderation Issues for Congress (No. R46662). Congressional Research Service. https://crsreports.congress.gov/product/pdf/R/R46662

Mueller, R. S. M. (2019, March). Report On The Investigation Into Russian Interference In The 2016 Presidential Election, Volume I of II. U.S. Department of Justice. https://www.justice.gov/archives/sco/file/1373816/download

Sayler, K. M. S., & Harris, L. A. H. (2021, June). Deep Fakes and National Security (No. IF11333). Congressional Research Service. https://crsreports.congress.gov/product/pdf/IF/IF11333

zozbot234• 4 years ago

EARN IT is tightly focused on the perceived issue of CSAM material, exploitive "grooming" of minors via the Internet, and the like. It would do zilch to incent large social media companies against using algorithms that implicitly promote outrage-inducing content, much of it naturally being fake news and misinformation. It would also make it harder for smaller, more independent actors to counter these dynamics - because increased, more complex regulation and heavier liability always hinders smaller actors to the benefit of larger ones. You're conflating two issues which have very little to do with one another.

jerry1979• 4 years ago

Are you looking for the government to censor all "divisive" information or just "divisive information that is false"?

danShumway2• 4 years ago

For example, YouTube shared videos containing COVID-19 misinformation 20 million times, generating 71 million reactions in eight months (Gallo, 2021).

How would reworking Section 230 fix this? Most of that information isn't punishable by the federal government, it falls under first amendment protections.

A lot of the most dangerous speech online is protected speech, the exclusions here like libel or incitement to violence are very narrow. For better or worse, the government can't punish people over saying that vaccines are dangerous. The only entities that can legally crack down on that information are the private entities that control their own platforms.

I often find in critiques of Section 230 that people have (for lack of a better word) an optimistic view of what the government can and can't do in regards to speech. Remember that a lot of the TV content from stations like Fox News are not covered by Section 230, and they're still legal. If the government had the ability to shut that misinformation down, why would those networks still be operating today? Even just regulations on how sorting algorithms work for social media are not certain to pass a Supreme Court challenge.

----

You link to the FCC rules on broadcasting, here's what they state:

FCC rules specifically say that the "public harm must begin immediately, and cause direct and actual damage to property or to the health or safety of the general public, or diversion of law enforcement or other public health and safety authorities from their duties."

Covid misinformation is obviously bad and harmful, it has obviously made the pandemic worse and people have died because of it. Covid misinformation also doesn't rise to the standard that the FCC sets above; the Supreme Court has ruled multiple times that "immediate" harm is a pretty narrow category, and that causing "direct and actual damage" is also a kind of high bar to clear. The reality is that even if the government got rid of Section 230, it couldn't ban vaccine misinformation from Facebook. At best, it could impose large liabilities that made Facebook very nervous about having unvetted speech of any kind, as well as making it dangerous for any competitors or smaller companies to try and compete without a large legal team backing them up -- in other words, exactly the chilling effects and market consequences that people warn about whenever these bills come up.

zamalek• 4 years ago

These people seem incapable of understanding the existential threat to free society and democracy posed by limiting everyone's ability to communicate private thoughts.

The truly idiotic thing about it is that they aren't really: cryptography knows no jurisdiction, it's just mathematics. They are limiting the power of law abiding citizens to communicate freely, nobody else.

kurthr• 4 years ago

I agree it's dangerous not only for civil society, but also against other nation states. I have wondered why the TLAs seem enamored of this sort of anti-encryption legislation (since presumably they are the likely only technical enough members to write and promote it). My best guess is not that they "hate freedom" or that they are "compromised agents of a foreign power", but simply that they are fighting the last battle. The older cold war generation has retired, and people in positions of power within the TLAs are simply so consumed by foreign terrorist threats, that they aren't thinking about the fact that if they can read (and forge) these communications, then so can our geopolitical adversaries. Furthermore, the possible disruption of our entire economic (banking) and political system are made possible by such a vulnerability.

noelsusman• 4 years ago

I'm reminded of when I was told for years that eliminating net neutrality would destroy the Internet as we know it. Then it was eliminated and the Internet is exactly the same as it was before. Point being, I am extremely skeptical that this bill is an existential threat to free society and democracy.

Anyway, the text of the bill clearly states that offering encryption services cannot serve as a basis for liability under the new CSAM carveout. I haven't seen critics of the bill explain why that language isn't good enough to protect E2EE services from liability. Most critics just pretend that part of the bill doesn't exist.

marcan_42• 4 years ago

I agree with your comment, but just to point out something counterintuitive:

privateer (NSO etc) threat actors,

E2EE is actually a boon to NSO and friends. It's how they get to deliver their exploits to targets without the service operator being able to inspect them or filter them, or retroactively analyze them to plug the exploits. NSO doesn't have any traffic inspection capability, so their antics rely entirely on exploiting target devices, and E2EE counterintuitively helps in that case.

If iMessage weren't E2EE it would be very easy for Apple to implement a heuristic to look for suspicious messages and keep a copy for further analysis, or automatically run them through their codebase in a sandbox and see if it results in any indicators of compromise. But they can't do any of that, and that's how NSO sometimes goes on years exploiting the same iOS bugs before Apple figures them out. With E2EE, you have to rely entirely on endpoint security, and the provider can't help you server-side.

klabb3• 4 years ago

E2EE is actually a boon to NSO and friends.

I think you're right, but I don't think it's due to some first principles contradiction between E2EE and exploits as much as it is largely a historical anomaly that customers have looked to service providers for security. The track record shows pretty clearly that the service provider's interest in customer security only goes as far as not to be reputationally damaging - we've seen plenty of communications companies actively helping authorities to spy on their own customers.

If iMessage weren't E2EE it would be very easy for Apple to implement a heuristic to look for suspicious messages

Indeed, it would at the very least be easier, but let's assume Apple did have this capability. The first order of priority would be stopping spam, which is orders of magnitude more common and problematic than targeted exploits. Simply taking a look at the app store kind of shows their ambition level. At best, Apple is going to want to be "more secure than Android", but beyond that.. it's simply not gonna be a priority (and Apple is even one of better ones).

NSO sometimes goes on years exploiting the same iOS bugs before Apple figures them out

Yes, but I think this is temporary. Citizen Labs have been shortening this round trip time enormously simply by having analysis or software deployed on likely targets' devices. CrowdStrike and similar security companies operate on a similar model, acting as a counter-surveillance trusted third party. On medium-term time scales, I think such models are more ethical, have a superior incentive structure and, most importantly, will prove to be more effective than the usual half-assed service provider solutions. At least, I hope I'm right.

gjsman-1000• 4 years ago

It’s bad, but there is still some light.

This bill, remember, removes Section 230 protections against civil lawsuits for noncompliance.

The solution is fairly easy though. If your messaging app runs somewhere hard to sue (Russia, China), good luck bringing a lawsuit. Even better if it’s decentralized with no clear leader to sue.

If anything this may help get people further away from regulated tech companies.

throwaway058527• 4 years ago

Isnt it true that the "society" has dug its own grave ?

Where were the freedom of speech defenders (aclu et al) when the progressives and policians in that spectrum celebrated shutting down opinion by effectively monopolies of information (twitter, FB, google, cc infra)

Why is there no common ground? When speech is shut down, no matter the side its on, the net winner is the state.

Frankly there is no room for bipartisan support of anti security state.... Until and unless there is recognition of section 230 enabled abuses that are still ongoing.

Obviouly 230 should not apply uniformly to every single website, but thats the kind of nuance that is missing from the current debate.

secondaryacct• 4 years ago

But democracy existed before whatsapp, why cant it exist after ?

I mean I agree with what you say it s convenient to anonymously communicate private thought over public telecom fibres, but... I mean... democracy and "freedom" as a Nation citizrns are unrelated to this, completely unrelated.

indymike• 4 years ago

Taking away freedom of speech and freedom of press, just because it's no longer talking to my neighbor on the corner or smashing ink into paper is the issue.

noduerme7• 4 years ago

I'd personally love to see social media shut down tomorrow, by holding twitter and facebook liable as publishers for the content of every post on their platform, and letting them defend in civil litigation every time they re-publish their users' false statements for profit. But that has nothing to do with government censorship, that's pure libertarianism and letting the publisher bear the cost. The entire notion of inching forward a general level of public disapproval for encryption is indeed terrifying. The template for government now is so well-worn, to take a 2/3rds opinion in the dumb populace and get them to go against the other 1/3rd in the name of safety; yet, we see it much more clearly now. It's easier to fight.

The platforms that are the biggest targets of this are, unfortunately, extremely compromised already by their failure to regulate their own users. Take that and a dose of populist anger, and it's pretty easy to see how important freedoms will be eroded and ultimately, any kind of private speech will be held as grounds for suspicion, even though that speech has nothing to do with these platforms or this law.

Private speech and personal files never belonged on those platforms in the first place, and to me it's hard to believe anyone doing anything illegal at scale would even be using those platforms. What we're concerned with here is how the demolition of their privacy regulations might turn public opinion against those of us who manage our own privacy.

The one bright spot is that we all see it coming.

closeparen• 4 years ago

What you are proposing is that the only writers we should hear from are professionals at publishing institutions, who have editors to vet their work and lawyers to defend it.

That is certainly a take on what The Discourse should be! Return to the print media era, basically. But it is weird to see this take expressed in the same form it wants to end. Hacker News is social media and YCombinator is surely not going to stand beyond everything everyone posts here, or turn it over to spammers.

kelnos4• 4 years ago

I'd personally love to see social media shut down tomorrow

Yeah, ok, I'm with you there...

... by holding twitter and facebook liable as publishers for the content of every post on their platform, and letting them defend in civil litigation every time they re-publish their users' false statements for profit.

Whoa there, hold on. If we hold Twitter and FB liable for that stuff, then that means we also have to hold every single web forum, support forum, mailing list, blogging platform, etc. liable as well. So those things essentially just disappear overnight, because no one is willing to expose themselves to that sort of legal liability.

Eventually, the only things you can read on the internet come from big corporations that can afford big legal teams, or people who have the technical know-how to host their own blog. HN is gone. Slashdot is gone. The Raspberry Pi support forum is gone. Hell, the LKML is gone. That's not an internet-world I want to live in.

netcan• 4 years ago

I think on one side you have security. This means law enforcement, espionage and the increasingly relevant civil security industry. They have pretty straightforward "pro" interests. You also have child protection advocates. They, perhaps rightly, are focused on their own agenda, not the greater picture. It's "not their job" to worry about freedom of speech and association.

This side, like any scrutinized company or government department insisting that "it's a resource thing." IE, their doing all they can with what they've got. Doing better requires something external. More resources, more power, etc. They deliver estimates of how many more children can be saved if only X.

On the other side is more vague. Esoteric digital freedom advocates. Abstract, ideological general freedom advocates. The concentrated, directly interested parties are the social media companies themselves.

So first, social media companies do not want to be stuck in a debate where it's them vs child advocates. They don't want to make esoteric freedom arguments that they don't believe in anyway, and use these to counter child protection arguments.

Second, regulation like this is often beneficial to incumbents. The DMCA, for example. Large incumbents can influence details of legislation, enough that they can at least live with the legislation. It also makes it harder to disrupt them from the outside. Under DMCA, record companies and film studios got what they wanted & social media companies got what they wanted.

sandworm101• 4 years ago

> by making it legally risky for large social media and platform companies to offer end-to-end encryption

I'm converted. I now totally support this legislation. Lack of secure encryption will bring down all the large social media companies. It happened to Blackberry during the London riots a decade ago. The kids quickly realized that someone associated with the police was reading their texts. From that point, Blackberry was doomed. Also Skype.

So let the FBI have a free hand inside facebook. Let teachers inspect the social media posts of their students. Let cops track the location tags of clandestine highschool parties. Every teenager will dump facebook, creating huge new markets for other services. Facebook will be MySpace within the decade.

eximius• 4 years ago

... you realize it doesnt specify companies by name. If it is legally risky for Facebook, it will be legally risky for any replacement services.

uejfiweun2• 4 years ago

It seems like this Stanford page has clearly taken a side on the issue. Does anyone have a link to a solid unbiased discussion of the pros and cons of this? It's got bipartisan support, so clearly there are legitimate arguments in favor of these changes, would be interested to hear what they are.

fallingknife4• 4 years ago

It's got bipartisan support, so clearly there are legitimate arguments

That doesn't follow. The worst laws passed (e.g. the Patriot Act) tend to have bipartisan support.

uoaei• 4 years ago

It's got bipartisan support, so clearly there are legitimate arguments in favor of these changes

I don't see how the conclusion follows from the premise.

It doesn't seem appropriate to assume that politicians are acting in good faith dialectical fashion, based on literally every observation we've ever made of their actions vs their rhetoric.

Spooky23• 4 years ago

Issues like this are difficult as there are conflicting needs and people wearing blinders on the issue. There’s really no correct answer, but there are at least 4-5 camps of true believers.

Recall the HN community going apeshit over Apple’s proposed methodology to address this issue. That solution was engineered to benefit Apple and was imperfect, but fundamentally addressed CSAM risk with a proven methodology and preserved strong crypto.

That visceral, apeshit reaction was incited by a poorly written EFF article that blurred the lines between a parental control and CSAM.

So yay, we won. Now broken encryption is back and may well pass, as both law and order moderates and batshit crazy conservatives can find common ground.

loteck5• 4 years ago

Let's have no fear to face down our opponents' claims. Senators pushing this bill laid down their claims in a document [0], and everyone should put on their critical thinking caps and grapple with it.

[0] https://www.documentcloud.org/documents/21194217-earn_it_act...

uejfiweun2• 4 years ago

Thank you, something like this is exactly what I was looking for. Balances out nicely with the original posted link.

s1artibartfast• 4 years ago

Thanks, This was helpful.

MYTH: Requiring companies to be on the lookout for child abuse will harm startups and nascent businesses.
FACT: No other type of business in the country is provided such blanket and unqualified immunity for sexual crimes against children.

This jumped out out to me in particular. I can think of another similar industry that delivers private packets which may contain CSAM. What is the US Post office doing to evaluate the bits they deliver? What is the post man's legal liability?

wbsss44122• 4 years ago

Are there any issues that come up in Washington that don’t have have legitimate arguments for them, regardless of the status of their partisan support?

The “pros” are fairly straightforward, mass data collection makes it easier for law enforcement to do their jobs, or, at least, that’s their opinion.

mullingitover4• 4 years ago

It's got bipartisan support, so clearly there are legitimate arguments in favor of these changes

Both parties have pretty wide dumb/authoritarian streaks, so it's not necessarily true that there are legitimate arguments in favor. The war on drugs, for example, had/has bipartisan support even though it is an ongoing demonstrable harm to society.

aaaaaaaaaaab• 4 years ago

It's got bipartisan support, so clearly there are legitimate arguments in favor of these changes, would be interested to hear what they are.

The safety of our children™!

loteck5• 4 years ago

The 3 Techdirt links in the article are especially helpful for catching up.

EARN IT is another skirmish in the 30+ year old Crypto Wars. For those who care about defending privacy and encryption, exhaustion is not an option.

Power-hungry governments must be viewed similarly to an APT in this context. They are following their very nature, and they will never stop inventing new approaches.

There is no other option except to stay organized and always ready to engage.

bsder3• 4 years ago

For those who care about defending privacy and encryption, exhaustion is not an option.

For those who care about democracy, exhaustion is not an option.

This is why people who believe that they can be "neutral" or "in the middle" make me so angry.

"Two sides" doesn't hold when one side is actively trying to sabotage you.

snarf21• 4 years ago

While I agree with you, I think the last 5 years have shown that exhaustion wins. It is just a matter of time. People won't stay vigilant. They just want to provide a life for their family. Life is hard enough without having to stop clueless and bribed politicians from ending freedom on a weekly basis.

loteck5• 4 years ago

I think the last 30 years of failed government efforts to effectively end the use of secure encryption contradict your opinion. Those battles were won by vigilant defenders. You can and should join them if it's important to you.

xvector• 4 years ago

I don't think this doomer/fatalistic mentality helps anyone. History has also shown that even exhausted people can fight and win.

McDyver• 4 years ago

They just want to provide a life for their family.

That's true, and keeping people worried about their next paycheck is a great way to control them.

The good thing about this "great resignation" or "great renegotiation", is that some people are starting to take that fight into their own hands. They are shifting the power and taking control of their own lives.

Eventually their focus will no longer be on short-term survival, and thry will take control of other aspects of their lives that currently are not so pressing.

I'm hopeful that younger people will be more aware, and see through these boomer games.

fsflover• 4 years ago

People who are busy with their own life can at least support EFF etc. with donations.

nexuist• 4 years ago

Cynicism is obedience. We can and should beat this.

kweingar• 4 years ago

The main concern I have is the technological/administrative burden put on smaller platforms, which would cause further consolidation of the web.

What obligations this would impose on an operator of a small web forum?

charcircuit12• 4 years ago

We should design cryptosystems that include functionality that support warrants as opposed to being antiencryption and removing encryption.

emkoemko2• 4 years ago

then that's not encryption ... if it has a back door....

charcircuit12• 4 years ago

I'm not talking about a backdoor. I am talking about it being a part of the actual system design.

seanw444• 4 years ago

Sounds like junk crypto.

charcircuit12• 4 years ago

There is utility to being are to prevent random people and companies from eavesdropping your conversations. Crypto has important security benefits that we can't just give up.

randomhodler842• 4 years ago

No we shouldn’t. Never. Get that idea out of your head. It can never be secure or safe. This path leads to bodies hanging from the town square.

charcircuit12• 4 years ago

So you want encryption so criminals who would have otherwise been hung to be able to evade the law? It is pretty clear to me how a government may not approve of encryption for this usage.

emmelaich5• 4 years ago

Here's a thought. Private[0] keys could be held in escrow, with sss[1] being used to decrypt, publically. The sss shares could be held by different branches of government. (state,federal,exeecutive,legislative,judicial)

Please shoot my idea down.

[0] or 'backdoor' keys [1] https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing (or similar)

charcircuit12• 4 years ago

Personally I think the company should also hold a key. They would use this key after verifying that a warrant is valid. I also think giving out hardware keys with rate limiting / logging features along with key rotation / revocation is essential to reducing abuse.

mullingitover4• 4 years ago

The minute your system depends on good behavior from any of the parties involved, you've failed as a designer.

It's like nobody learned anything from Snowden's revelations. The second those backdoors are available, they're going to be surrendered in secret to various three letter agencies in the name of national security. That's going to happen on day one. On day two they'll be breached by foreign intelligence services.

charcircuit12• 4 years ago

The minute your system depends on good behavior from any of the parties involved, you've failed as a designer.

Everyone is bad designers then. All of them rely on operating system providers not stealing your messages. Some with the people providing the chat application. Since they have to be able to display messages they are able to log them somewhere.

Society needs trust to function.

jamesgeck0• 4 years ago

Basically every professional cryptographer has been saying that it's impossible to build a secure system this way since the idea was floated by the US government in the 1990s.

phatfish• 4 years ago

In a perfect world a agree with this. But the power this gives governments is so great that I don't see how it wouldn't end up abused.

In the analogue days "wire tapping" regulated it's self because of the manual nature, and a warrant attempted to ensure enough evidence was required to actually target an individual.

With digital communications the same thing can be done leaving almost no trace against an entire population.

Governments have a LONG way to go to prove that "three letter agencies" won't abuse a system that is setup to provide legal wire taps for digital communications.

mr_toad2• 4 years ago

functionality that support warrants

A back door marked ‘staff only’ doesn’t actually know who is staff and who isn’t.

charcircuit12• 4 years ago

A back door marked ‘staff only’ doesn’t actually know who is staff and who isn’t.

Which is my you use cryptography instead of just a sign.

urthor• 4 years ago

I feel like there's two big issues at war with this one.

1) The Web 2.0 war over how much legal liability internet platforms have to bear. This is the big one to me, ever since the DMCA this is the pivotal issues about the internet.

2) The ongoing war against E2E encryption. This is a nonissue, the attempts of the authorities to restrict digital encryption are pointless and futile.

I'm a big fan of reform in #1. The big internet platforms like Facebook absolutely need to face far more legal liability for their actions.

But conflating the thing into one big bill that pushes forward E2E encryption restrictions is one of the issues with democracy in America.

There is so much horse trading involved in Washington required to do anything, because of lobbyist vetos, the fact all these issues have to end up in an omnibus bill is ridiculous.

lstroud• 4 years ago

Will all government agencies be required to comply? I would think that would be an issue.

NewMountain• 4 years ago

For those living in California: https://www.feinstein.senate.gov/public/index.cfm/e-mail-me

A copy of my note if you would like a template:

``` Dear Senator Feinstein,

I am deeply disappointed with your support of the EARN IT act and am expressing my deep concern and disapproval of such a bill.

Congruent with the recent report released by Stanford, I am expressing my deep disappointment in your sponsorship of the EARN IT act. I believe it represents a fundamental undermining of citizens right to privacy through strong encryption under the extremely divisive framing of "protecting the children". As a Father of two children myself, I do not believe that whatever incremental improvement to their safety, if any at all, justifies the undermining of encryption of ordinary citizens. In my opinion, this law actively undermines the fourth amendment in the digital realm and I must state that if you believe this is in my best interest, you have lost both my vote and my trust. ```

bsder3• 4 years ago

Sadly, Feinstein doesn't give one iota of damn ... unless she is being wiretapped.

And, at this point, I'm not sure that she actually even knows what she is doing. However, too many people are on the gravy train that are preventing her from resigning.

tagoregrtst5• 4 years ago

Feinstein is the senator I dislike the most. Even after she complained like a baby that the FBI had surveilled her (what did she expect?) it didn't affect her political positions one bit.

She cant loose the elections because shes a Dem from CA. She cant get primaried because shes in the hands of the SV

takeda• 4 years ago

So far for this type of laws she always have a canned response essentially saying "I know better than you".

Anyway I emailed her, and encourage everyone do so. Not doing anything, by assuming it is pointless is a self fulfilling prophecy.

I wish somebody younger would replace her :(

chris_va• 4 years ago

Having peeked behind the political shroud on occasion (and still by no means an expert), I think people overestimate the complexity of the US political system.

Most politicians are not imposing some personal beliefs, they are just representing whichever voice their staffers/office hears most often. And, even for a senator, there aren't that many people who actually call to talk to a staffer.

The ones that do usually have a strong interest, so the staffers generally hear a skewed version of reality (and while these folks are often bright, deep domain experts they generally are not).

Sooo... Calling/writing does quite a bit more than you might think, if you can get even a reasonable number of people to do it who the staffers believe actually have expertise and are within the district/state.

The staffers will probably give a mostly generic response, but these are all tallied up internally and definitely drive policy.

icelancer4• 4 years ago

I write to all my Democrat reps (I live in a solidly blue state) and get shit all nothing in response to positions that go against the mainstream leftist positions. I still do it because... eh, why not, but I know it has zero value. It's sad.

beebmam• 4 years ago

All it is going to take is one big violent event organized using end-to-end encryption and that's it, this bill (or something like it) will pass. So you should probably prepare for that political battle if this is an issue you care about

ipnon• 4 years ago

What violent conspiracy hasn't incorporated encryption? Can you read in plaintext every email that cross the Web? I can't even access HN over HTTP. Encryption is the default for modern communication. That's the rub: it's a mass surveillance bill masquerading as an encryption bill.

Spivak• 4 years ago

The bill isn’t about encryption despite the messaging. It’s about the design of communications systems that are “unwiretappable.”

mrobot• 4 years ago

What we need is positive privacy rights that are very well thought out and firm in preventing legislation such as this from even ever surfacing, as what's proposed in this policy should just be illegal in the first place. These privacy rights would go against what both Silicon Valley and NSA/CIA/Pentagon want, so we need a movement to fight it. I don't think i believe anyone with any power (including Silicon Valley big wigs) are actually opposed to any of this garbage.

Anyway, I'm sick of just being reactive to this anti-human garbage. People need to get clued in and slay the demons instead of building stuff for them.

dmje• 4 years ago

I know it's wildly off-topic but can someone please explain to me why there are still sites like this that are clearly well funded and professional that fail to have spent - what - 2-3 designer hours time ($150?!) on a simple mobile stylesheet?

They almost definitely get 50%+ mobile traffic. What gives?

aspenmayer17• 4 years ago

I think they’re hiring, if it’s any consolation. I’m sure that HN staff does actually have work besides moderation.

https://www.ycombinator.com/companies/y-combinator/jobs/7D3d...

ghoward• 4 years ago

If anyone needs a link to point politicians to, you can use [1].

Suggestions welcome for improvements.

[1] https://everyoneneedsencryption.gavinhoward.com/

javajosh4• 4 years ago

We have to give them something for CSAM, or they'll keep coming at free speech in general using CSAM as cover.

I strongly recommend considering the invention of a sticky, client-side program that scans all images passing through your network interfaces. It is also allowed to send red flagged images to a jury that will be a first hurdle to doing anything: determining it's really a CSAM matter.

I've proposed this before, and got shouted down. Partly because its client side and can be theoretically disabled. But I think it can be made as difficult as black box baseband firmware to undermine. I do not believe the argument that consumers are sophisticated enough to disable this scan, if implemented well. We have demonstrated the ability to force-run processes at every level of abstraction for general compute hardware.

Our best hope is to implement something that has a reasonable chance of catching actual CSAM without generating false positives and without being exploited to prosecute people deemed problematic for arbitrary reasons. Otherwise we get what is probably happening now, which is the secretive scanning of all messages, prosecution limited only by the cost of parallel construction.

nine_k• 4 years ago

Two questions: how do we know that the program only scans images, and only exfiltrates CSAM-suspect content?

Otherwise looks fine, as long as the traffic is never encrypted.

javajosh4• 4 years ago

You hit on the feature that makes it viable: you would always know if an image is flagged, and as what. It doesn't stop your nation state from flagging you as a problem because you're gay, but it also doesn't hide the fact that they're looking for that. I think that's the best we can do right now.

dane-pgp5• 4 years ago

I think it can be made as difficult as black box baseband firmware to undermine.

And once we've set the precedent in law that the government gets to force mandatory unauditable features onto all computing devices, what makes you think they'll stop at image scanning? You're basically saying that no Free and Open Source machine should ever be allowed on the internet again.

javajosh4• 4 years ago

If it can't be designed properly, then I withdraw the suggestion, but I think it's possible to design something that cannot hide from you the fact of a detection and the questionable content. That is, if they don't stop at image scanning for CSAM then you'll at least know it, even if you can't stop it. Not perfect, but its something.

anaganisk2• 4 years ago

Couldnt it be easily broken by masquerading a jpg as a txt file? Or actual people who pass such images use some kind of masking techniques. I will tell you what, any thing can be broken if it’s on software. DRM is broken by design because it failed to stop shit its only a hurdle to actual users.

javajosh4• 4 years ago

That doesn't sound like an argument against my proposal. Or, if it is, it's like arguing against using locks because any lock can be picked.

Any counter-measure, even the most invasive and draconian, can be foiled by simply doing your CSAM offline, using photocopiers and the postal service. That would be a big improvement, I'd argue.

friendlydog3• 4 years ago

Instead of just getting these shutdown how about an opposing act which puts penalties for lobbyists and politicians who back this kind of thing?

I don't want to keep fighting zombie bills like these, because we will eventually miss one.

dane-pgp5• 4 years ago

penalties for lobbyists and politicians who back this kind of thing

You want to make it illegal for people to propose and vote for policies that you don't like? What if they beat you to it and pass a law that stops you from getting your law passed?

friendlydog3• 4 years ago

Some parts of government should be immutable, and putting safeguards to ensure constants are constant makes a lot of sense to me.

tehwebguy• 4 years ago

It’s not just this specific legislation, there is no reason to give police any additional power and all the reason in the world to dial back the extraordinary power they already have.

boppo1• 4 years ago

I've said it before, I'll say it again. The only way this ends with the preservation of encryption as a standard is a bipartisan fappening-style leak of CEOs, politicians, lawyers, etc. Not just sexual content, but intimate content of any and all kinds: financial records, healthcare visits, everyday texts, etc.

spacexsucks• 4 years ago

This is the only way.

BLKNSLVR• 4 years ago

I'm in agreement, but how sad a commentary on the state of politics and 'the best governance society has developed so far'?

All I hear from the people at the top is: Me, me, fucking me!

(Would I be any better in a position of power? I don't know, but I'd like to think so).

swinglock• 4 years ago

They would find a way to misinterpret the situation and double down, to fight the criminals at fault who did this to them.

ryeights2• 4 years ago

Politicians are malignant tumors on free, democratic society. IMO anyone who would choose to run for a political office in today’s society should be banned from ever holding a position of power.

iopq3• 4 years ago

Only Rand Paul and Ron Wyden voted against FOSTA/SESTA, the legislation passing 97 to 2

natsup123490• 4 years ago

If this bill passes, it will only weaken America's position as leader in the Internet space. The world will eventually benefit from that weakening. We will route around America.

grammers• 4 years ago

Man that's bad. I wish if a bill was off the table once, it can't be simply brought back again and again. It feels like constantly treading water, no wonder people are frustrated with politics.

jmconfuzeus• 4 years ago

The return of Gestapo.

shmerl• 4 years ago

Using encryption should be considered a right, this way such kind of bills will become impossible.

totorovirus• 4 years ago

wow I am just utterly surprised how the politicians in US are trying to pass the bill via CSAM just like the politicians in korea. Korea already has a DNS surveilance on porn related websites because it may contain sexually abusive material that may harm teenagers' mental health (it is called children and teenangers act). They even passed a bill to monitor the videos shared in online chatroom because people may share sexually abusive material via messengers. They have a very strong ethical reason in that they are trying to protect children and teenagers, and it is difficult to overcome that by making a case for privacy protection.

dsign• 4 years ago

Here is where we are going:

https://dsignrandom.tumblr.com/post/675431677522329600/not-s...

I think that these bills will have not only a chilling effect over free speech, but also reduce the overall safety of citizens, both of which are truly bad things. And make no mistake, many countries will follow the lead of USA, UK and Australia in taking these steps.

On the plus side, moving free speech outside the moderation of big tech and, by extension, big-government, is a good thing. And that will happen the moment people realize that they are liable for CSAM crimes for posting photos of bread and having a stupid AI flag them, or referring to their cat as "my kid" in a tweet. People with a strong political opinion on bread or otherwise will need to find high-effort platforms to publish those opinions, i.e. magazines, books, and (eventually) face-to-face meetups. My perhaps over-optimistic hope is that this will attenuate the rage-by-tweet phenomenon, we will get back to thinking before publicly expressing something, and people will only get mobilized after informing themselves properly on a subject. Even if this is a "count your blessings" attitude.

jeegsy• 4 years ago

I'm not sure why a law is needed. These big tech companies do the government's bidding all the time.

MatekCopatek2• 4 years ago

To start, I absolutely don't think this bill is good, BUT I think there might be potential for some interesting silver lining.

Let's say it's passed and big platforms such as FB need to start heavily policing their users because they become responsible for all published content. This level of moderation is nearly impossible to achieve, so they are forced to heavily limit participation (you can only post a limited amount, posts need to be confirmed before becoming public, AI filters auto-reject various topics etc.).

Users are pissed and move to platforms with "more freedom", but nothing lasts - as soon as they grow, they all hit those same issues.

Because all the responsibility is on the publisher, the only realistic solutions are smaller and more distributed communities. You can self publish your blog or create an invite-only forum/chatroom/Mastodon instance for your friends/family/neighbourhood.

Because now everyone is doing this, hosting providers, ISPs and software publishers adapt by improving UX and reducing technical barrier to entry. It's basically a reneissance of oldschool internet.

Whaddya say, too optimistic?

bagacrap• 4 years ago

whatever "self publish your blog" means, but if it's sufficiently easy for non technical users to figure out, no doubt it's a platform that can be subjected to this law. If it's not an easy-to-use platform it will deplatform and disengage the less sophisticated internet users. The old-school internet was mostly a few eccentrics no one paid attention to.

MatekCopatek2• 4 years ago

Disagree - you could take the exact registration flow of any existing platform (e.g. Blogger) and adjust it so that instead of creating an account in their database (and consequently on their platform), it provisions a hosting account in your name and installs some blogging software there.

lawrenceyan• 4 years ago

Great power comes with great responsibility. Quis custodiet ipsos custodes?

HowardPlayzOA• 4 years ago

The EARN IT bill was not dangerous before this year; it was to hunt down some child predators in all platforms such as TikTok. I don’t know why they need to pass the bill, but the ways of living under this such a bill will be terrifying; such a thing would be spied like Mainland China when they are using a social credit technique for everyone who browses things online. In other words, we must protest the bill by sending some important details of why the bill must rip off from the checklists due to our own security and privacy. Even I am using ZOOM in my iPhone to chat with my friends, including Signal and Discord. Whenever this bill passed, we must be ready for the REVOLUTION to start. That’s all I have to say today.

neycoda• 4 years ago

I can't read the article on mobile, it's apparently formatted for an 85" ultra-widescreen 4K screen

The EARN IT act is back, and it’s more dangerous than ever

Related Stories