Lindsey Graham Is Quietly Preparing a Mess of a Bill Trying to Destroy End-to-End Encryption

It doesn’t take a genius to see where this is going. The federal government, and especially the DOJ, have wanted tech companies to build surveillance backdoors into their end-to-end encrypted messaging services for years. They insist that they are only interested in preventing major crimes like terrorism or sex trafficking, but in reality building those backdoors would create a convenient pipeline for domestic surveillance. Under the EARN IT Act, an unaccountable 15-member commission or the attorney general (currently anti-encryption fanatic Bill Barr) could claim that end-to-end encryption goes against “best practices” and punish platforms that use it. They could also claim that the “best practices” are to build those surveillance backdoors—which would expose the content of those networks to anyone who discovered them, not just the U.S. government.

What isn’t clear is whether the act would be a big enough cudgel to force tech companies to comply, as it only revokes Section 230 protections as they apply to CSAM, Jeff Kosseff, a cybersecurity professor at the U.S. Naval Academy and author of the Section 23 book The Twenty-Six Words That Created the Internet, told Gizmodo via phone.

“What this bill is saying is for these specific types of lawsuits and criminal prosecutions you wouldn’t get Section 230 protections unless you comply with the guidelines,” Kosseff said. “I’m not sure how big of a threat this type of lawsuit or prosecution would be for the platforms to get them to—to make that tradeoff.”

“The other thing to keep in mind is that Section 230, by its terms, does cover private messaging,” Kosseff added. “It’s ‘interactive computer services’, and that would cover messaging, private email, that sort of thing. But in reality there’s only been a few cases where Section 230 has actually been applied by courts for private messaging. So there are a lot of end-to-end encryption messaging providers that frankly don’t care all that much about Section 230... I think the platforms that would care the most would be the ones that have both public-facing platforms where Section 230 matters as well as messaging services.”

Eric Goldman, a professor at Santa Clara University School of Law, called the Graham bill a “confusing mess” that strains to link perceived issues surrounding end-to-end encryption with criticism of Section 230. “There’s like six different moving parts to it. It’s kind of like a 4-D chess move to see how we get from end-to-end encryption all the way back to Section 230 for a federal crime that’s already not covered by 230,” he said, adding: “The whole structure of the [EARN IT Act] is kind of the wrong framing.”

“Let’s assume for a moment that the unavailability of Section 230 is effectively a death sentence for most companies,” added Goldman. “It’s a fast road to bankruptcy. So is that the right remedy for whatever missteps a company might make?”

There’s other issues with the draft bill as well. Both Goldman and Kosseff said it was unclear whether WhatsApp, which is owned by Facebook, would have to comply with the EARN IT Act for Facebook, the platform, to receive full Section 230 protections. The draft bill also concentrates power in the attorney general’s office in a manner that might not even be legal and leaves room for next to no input from tech companies.

“The idea that Congress can delegate virtually unilaterial authority to the [attorney general] to make rules is confusing,” Goldman said. “I’m not an expert in procedure, but I’m not sure that’s even possible. The absolute power in the AG’s hands to disregard the recommendations of the commission makes the commission a form of theater, I think. I don’t understand why go through the exercise if the AG can just do whatever he or she wants.”

“The composition of the committee is so structurally biased against most of the internet ecosystem that it’s not possible to really believe it would ever speak for the internet in a useful way,” Goldman added. “The internet is far more than Google or Facebook and so the fact that there’d be two voices for the entire rest of the internet, it’s really kind of baffling how anyone thinks that would be helpful.”

Pfefferkorn argues that because the feds can already punish tech companies that don’t do enough to fight CSAM under Sections 2258A/2258B, there’s no reason to target Section 230 other than that it’s taken center stage in politically motivated battles over online speech and censorship.

“This bill is a cynical ploy to exploit current anti-Section 230 sentiment in order to achieve an unrelated anti-encryption goal (one which, by the way, would be disastrous for cybersecurity, privacy, the economy, national security),” Pfefferkorn wrote. “Congress should not kill the freedom to encrypt by taking advantage of Section 230’s current unpopularity to get away with a bait-and-switch.”

Blumenthal hasn’t currently signed on to the draft version of the bill, according to Bloomberg. The news agency noted that while the current opposition to encryption is bipartisan, it’s unclear whether Congress would risk passing the EARN IT Act during an election year, when the assuredly heavy opposition to it could pose an immediate political price.

These old cunts are fucking exhausting.