Recently, in a shot heard around the world, the Eliminating Abusive and Rampant Neglect of Interactive Technologies (EARN IT) Act was introduced in the U.S. Senate by Lindsey Graham (R-SC), Richard Blumenthal (D-CT), Josh Hawley (R-MO) and Dianne Feinstein (D-CA). It’s a manageable read, but if I was to sum it up, I’d say the U.S. government is basically telling Internet services providers to do what we say to fight online child exploitation, or we’ll make you liable for what users do on your platform.
That might sound like not such a big deal, or even reasonable. What – don’t you want to help fight online child exploitation? Ridiculous question. Shouldn’t every company be responsible for how their products are used? That sounds like a yes, too, but wait a minute. Any use? Misuse? Can’t anything be misused? I’m not talking about defects, I’m talking about intentional misuse of a product. Would anyone ever build anything if they were held responsible for its intentional misuse? I’m pretty sure existing U.S. product liability law doesn’t work that way. Yet.
The EARN IT Act creates a Commission of 15 “experts”, including the Attorney General of the U.S. and various U.S. Congressional appointees, to develop best practice recommendations for Internet service providers to help the government fight online child exploitation. It sounds fair enough, but although they’re called recommendations, but they’re not really recommendations. If providers do not abide, they lose the decades-old Safe Harbor immunity granted them in Section 230 of the Communications Decency Act a.k.a. Internet Free Speech act, which shields them from liability based on users’ use of their service. Potato potato.
We’re not talking about Sarbanes-Oxley (SOX) style data protection requirements here, either. There are no limits on what the Commission can “recommend.” Perhaps worse, or at least telling, is that there are specific callouts to address things like “retention of evidence and attribution,” which leads any thinking person to believe that a recommendation to build end-to-end encryption backdoors is a foregone conclusion. There’s also a pretty obvious non-attempt to limit the scope of the recommendations to online child exploitation cases, which, considering the effect the Act is sure to have on terrorism, hate crime, harassment cases, etc…, at the very least calls into question why online child exploitation is singled out at all.
The debate on the underlying issue of encryption backdoors, the greater good and the proper balance between privacy and security has been going for a while, but debate on the EARN IT Act itself is just getting started. Many, including the Electronic Freedom Foundation (EFF) have voiced their opposition. Others are more supportive, claiming that even without Safe Harbor, services who reject the Commission’s recommendations would still need to be shown to be acting to the higher legal standard of “reckless” to be held liable. To that, I say: show me the finder of fact in a tort case who would not consider it reckless for a service provider to purposefully disregard the “best practice” recommendations of the countries’ 15 leading experts.
Which is why in my opinion, the EARN IT Act is itself a backdoor. It doesn’t come out and ban encryption or anything outright. Instead, it tips the scale of fairness away from Internet service providers in hopes of making it too costly for them to resist whatever future edict the Act begets. It exposes providers to unfair civil litigation, from which they were protected since the dawn of the Internet, then empowers an unelected few to be the final word on how certain types of encryption and privacy practices should be viewed by those doing the judging. It backdoors the debate on backdoors by not having the debate; by hiding the legislation’s true intentions, allowing legislators to dodge the issue and making it seem like whatever happens, providers will still have some choice in the matter.
Then, there’s the worst part. It’s being pushed in the name of child protection, as if to suggest that opposing it means you don’t want to protect children. I really hate that.
I know the Senators behind this legislation are as well-intentioned as anyone. This is a tricky issue. There are huge constitutional, moral and societal implications in the options before us and strong opinions on all sides. All I’m saying is Congress should take it head on and in the open. Let’s do it that way, not the EARN IT way.