kiwifarmsfan1
kiwifarms.net
- Joined
- Apr 13, 2018
Here is an analysis of the EARN IT act by Standford Law
cyberlaw.stanford.edu
Besides other major changes, and hoops you'll have to go through, below is the part that stood out to me is. The whole article goes step by step pointing out problems, and the second half is just prose about how it will allow the government to exploit and threaten places.
The EARN IT Act: How to Ban End-to-End Encryption Without Actually Banning It
Besides other major changes, and hoops you'll have to go through, below is the part that stood out to me is. The whole article goes step by step pointing out problems, and the second half is just prose about how it will allow the government to exploit and threaten places.
- Section 230 immunity for CSAM can be earned via 1 of 2 “safe harbors”:
- 1: Compliance with “recommended” “best practices” for the prevention of online child exploitation conduct, TBD by a new 15-member commission
- Analysis: Encryption, particularly end-to-end encryption, is likely to be targeted as being contrary to “best practices” for preventing CSAM, because if a provider cannot “see” the contents of files on its service due to encryption, it is harder to detect CSAM files.
- The commission would include at least 4 law enforcement reps, 4 tech industry reps, 2 reps of child safety organizations, and 2 computer scientists/software engineering experts
- Analysis: No representative is required to speak for users or civil society.
- The commission “shall consider” users’ interests in privacy, data security, and product quality
- Analysis: This is very weak language; it means the commission can “consider” these interests for a few seconds, chuckle to themselves, and then move on.
- The commission recommends best practices to the Attorney General, who has the power to unilaterally change them before they’re finalized, as long as he writes up some reason for the changes.
- Analysis: This means the AG could single-handedly rewrite the “best practices” to state that any provider that offers end-to-end encryption is categorically excluded from taking advantage of this safe-harbor option. Or he could simply refuse to certify a set of best practices that aren’t sufficiently condemnatory of encryption. If the AG doesn’t finalize a set of best practices, then this entire safe-harbor option just vanishes.
- A “best practice” requires the approval of only 10 of the 15 commission members in order to be recommended on to the AG.
- Analysis: This means that the commission could totally ignore both of the computer scientists, or both of the child safety org reps, or all 4 tech industry reps, so long as it can hit the 10-person quorum.
- An officer of the provider must certify compliance with the best practices; “knowing” false statements are a federal felony, carrying a fine and a 2-year prison term.
- Analysis: The language of the certification requirement doesn’t sound optional; it sounds like officers are compelled to certify, whether it’s true or not.
- 2: Implementing other “reasonable measures” instead of the best practices
- Unlike certifying compliance with the prescribed best practices, which guarantees Section 230 immunity, taking the “reasonable measures” option is not a guaranteed way of “earning” immunity.
- Analysis: It’s not exactly a real “safe harbor” if the provider still has to litigate the 230 immunity question. Providers that can’t/won’t/don’t certify adherence to the “best practices” will have to take their chances on whether their chosen measures will be deemed “reasonable” by a court.
- Analysis: Would a court find end-to-end encryption to be “reasonable,” when the goal is not data security, but instead, combating CSAM? Providers would struggle to reconcile their duty to provide “reasonable” data security, as imposed by the FTC and dozens of state data-security laws, with a conflicting duty not to encrypt information because it’s “unreasonable” under the EARN IT Act.