Key senators have voted for the anti-encryption EARN IT act(eff.org)
eff.org
Key senators have voted for the anti-encryption EARN IT act
https://www.eff.org/deeplinks/2022/02/key-senators-have-voted-anti-encryption-earn-it-act
327 comments
US folks who are interested in writing their Senators can find information at https://www.senate.gov/senators/senators-contact.htm?OrderBy...
FWIW, I sent the email below (largely cribbed from the EFF).
Dear :
I am a constituent. I urge you to oppose the EARN IT act, S.3538. It does not strike a reasonable balance between fighting crimes and the rights of users to privacy and encryption.
The bill empowers every state or territory to create sweeping new Internet regulations, by stripping away the legal protections for websites and apps in Section 230 of the Communications Decency Act of 1996. The states will be allowed to pass whatever law they want to hold private companies liable, as long as they somehow relate their new rules to online child abuse.
The bill’s sponsors have stated that EARN IT will pressure Internet companies to do widespread scanning of user messages and photos. This scanning is incompatible with strong encryption. Consequently, the act allows states to pass laws that will punish companies when they deploy end-to-end encryption, or offer other encrypted services. This includes messaging services like WhatsApp, Signal, and iMessage, as well as web hosts like Amazon Web Services.
The sponsors have falsely claimed that the act would protect children. But abusive images are already highly illegal under federal law. Any Internet platforms that knows about child sexual abuse material being distributed or received are required to take action on it, and can be severely prosecuted if they do not.
EARN IT would lead to penalties for people and companies that use encryption. The harm done by this will fall on vulnerable people. Once we allow encryption to be compromised in order to scan for one thing, authoritarian regimes will demand the same capabilities to track information shared by activists and journalists. Another example is that people subject to domestic abuse, including children, won’t have secure channels of communication to report and reach out for trusted help.
Once again, I urge you to oppose the EARN IT act.
Thank you,
FWIW, I sent the email below (largely cribbed from the EFF).
Dear :
I am a constituent. I urge you to oppose the EARN IT act, S.3538. It does not strike a reasonable balance between fighting crimes and the rights of users to privacy and encryption.
The bill empowers every state or territory to create sweeping new Internet regulations, by stripping away the legal protections for websites and apps in Section 230 of the Communications Decency Act of 1996. The states will be allowed to pass whatever law they want to hold private companies liable, as long as they somehow relate their new rules to online child abuse.
The bill’s sponsors have stated that EARN IT will pressure Internet companies to do widespread scanning of user messages and photos. This scanning is incompatible with strong encryption. Consequently, the act allows states to pass laws that will punish companies when they deploy end-to-end encryption, or offer other encrypted services. This includes messaging services like WhatsApp, Signal, and iMessage, as well as web hosts like Amazon Web Services.
The sponsors have falsely claimed that the act would protect children. But abusive images are already highly illegal under federal law. Any Internet platforms that knows about child sexual abuse material being distributed or received are required to take action on it, and can be severely prosecuted if they do not.
EARN IT would lead to penalties for people and companies that use encryption. The harm done by this will fall on vulnerable people. Once we allow encryption to be compromised in order to scan for one thing, authoritarian regimes will demand the same capabilities to track information shared by activists and journalists. Another example is that people subject to domestic abuse, including children, won’t have secure channels of communication to report and reach out for trusted help.
Once again, I urge you to oppose the EARN IT act.
Thank you,
What I don't see in the writeup, is which senators are voting which way. I can tell from the writeup what Blumenthal thinks of it, but not any other committee participants.
I really wish politicians would embrace a "we will make policies for things we can understand" motto.
I really wish politicians would embrace a "we will make policies for things we can understand" motto.
I have not read the details on the bill. However, a quick glance just reminds me of how counter productive and opposite of what our tax paid for research outlines as best practices for protecting data.
The NIST SP 800 series publications were paid for by our tax money and outline how encryption should be used for ALL. Not to mention sets standards for all of the intricacies that come with development, implementation and validation of strong algorithms for use in commerce, medical, federal, military and even GAH personal use.
https://www.nist.gov/cryptography
The NIST SP 800 series publications were paid for by our tax money and outline how encryption should be used for ALL. Not to mention sets standards for all of the intricacies that come with development, implementation and validation of strong algorithms for use in commerce, medical, federal, military and even GAH personal use.
https://www.nist.gov/cryptography
Section 5:
“[Use of end to end encryption] shall not serve as an independent basis for liability of a provider […]” but the fact that you did so can now be used against you in court.
The spirit of this bill is to make WhatsApp liable from the moment they become aware of specific instances of child pornography being shared on their platform, and only then after they’ve been shown to be doing nothing to take it down. If they don’t do anything after they’ve verified those specific instances then they are liable.
What’s being implied by all the senators and the journalism around this is something like “everyone knows that in general these E2E platforms carry child porn, so in general they need to turn off E2E.”
The text of the bill doesn’t seem to be talking in generalities. It’s talking about specific criminal cases involving specific instances of abuse? Or maybe it anticipates some sort of action where the government is the plaintiff?
It’s all very confusing.
“[Use of end to end encryption] shall not serve as an independent basis for liability of a provider […]” but the fact that you did so can now be used against you in court.
The spirit of this bill is to make WhatsApp liable from the moment they become aware of specific instances of child pornography being shared on their platform, and only then after they’ve been shown to be doing nothing to take it down. If they don’t do anything after they’ve verified those specific instances then they are liable.
What’s being implied by all the senators and the journalism around this is something like “everyone knows that in general these E2E platforms carry child porn, so in general they need to turn off E2E.”
The text of the bill doesn’t seem to be talking in generalities. It’s talking about specific criminal cases involving specific instances of abuse? Or maybe it anticipates some sort of action where the government is the plaintiff?
It’s all very confusing.
At the US Senate Web site at URL
https://www.congress.gov/bill/117th-congress/senate-bill/3538/cosponsors
S.3538 - EARN IT Act of 2022
Cosponsors: S.3538 — 117th Congress
(2021-2022)
Sponsor: Sen. Graham, Lindsey
[R-SC] | Cosponsor statistics: 19
current - includes 19 original
* = Original cosponsor
Sen. Blackburn, Marsha [R-TN]*
Sen. Blumenthal, Richard [D-CT]*
Sen. Casey, Robert P., Jr. [D-PA]*
Sen. Collins, Susan M. [R-ME]*
Sen. Cornyn, John [R-TX]*
Sen. Cortez Masto, Catherine [D-NV]*
Sen. Durbin, Richard J. [D-IL]*
Sen. Ernst, Joni [R-IA]*
Sen. Feinstein, Dianne [D-CA]*
Sen. Grassley, Chuck [R-IA]*
Sen. Hassan, Margaret Wood [D-NH]*
Sen. Hawley, Josh [R-MO]*
Sen. Hirono, Mazie K. [D-HI]*
Sen. Hyde-Smith, Cindy [R-MS]*
Sen. Kennedy, John [R-LA]*
Sen. Murkowski, Lisa [R-AK]*
Sen. Portman, Rob [R-OH]*
Sen. Warner, Mark R. [D-VA]*
Sen. Whitehouse, Sheldon [D-RI]*In my mind "Think of the children" is synonymous with "ulterior motive". After reading the comments here, I am adding CSAM to the list of synonyms.
I haven't tried reading the text of The Act, most of the press about it focuses on E2EE-type messaging systems. So presumably if this passes, Signal would have to move offshore or something? (for example)
But what about HTTPS certificates, would The Act have any effect on them? Would there be any legal issues with (for example) running your own Matrix server?
And what about hosting providers (instead of platforms). Would Amazon be compelled to decrypt HTTPS traffic en-mass that's routed to their machines?
But what about HTTPS certificates, would The Act have any effect on them? Would there be any legal issues with (for example) running your own Matrix server?
And what about hosting providers (instead of platforms). Would Amazon be compelled to decrypt HTTPS traffic en-mass that's routed to their machines?
I contacted my representatives. It took 1 minute. Please do it too.
So if you click on the actual article, there is a "TAKE ACTION" button that will email your representatives. It takes about 15 seconds total, if that. Do it.
This could only work if there are monopolies that work with the government. I don't think we're there yet, but it is concerning that lawmakers view this as a viable piece of legislation.
I wish we had a legislature who would recognize the importance of net neutrality to fostering competition. Instead, bills like this seem focused on ensuring monopolies so they can control how they operate.
I wish we had a legislature who would recognize the importance of net neutrality to fostering competition. Instead, bills like this seem focused on ensuring monopolies so they can control how they operate.
This country is fucked. The senate does what they want, most of them are not afraid of being voted out. This or something like it will eventually pass. It will be a Brexit level disaster, and take 20 years to unwind. The small majority of people that want this passed are absolutely relentless, and seem to have enough money to influence enough senators to get this passed.
This will eventually pass.
This will eventually pass.
You can watch the meeting from this morning here:
https://www.judiciary.senate.gov/meetings/02/03/2022/executi...
The discussion on the EARN IT act starts around 1:42:00
Any mention of concerns over encryption are with a really incredulous, dismissive tone. I have a hard time understanding whether that's actual ignorance on the part of the Senators, or if it's some kind of theatrics that plays into the broader politics of the situation.
The discussion on the EARN IT act starts around 1:42:00
Any mention of concerns over encryption are with a really incredulous, dismissive tone. I have a hard time understanding whether that's actual ignorance on the part of the Senators, or if it's some kind of theatrics that plays into the broader politics of the situation.
So basically this is just the government using private companies to do an end run around the 4th amend.?
The Achilles' heel of the internet is that it's controlled by the US.
It seems we are all fighting a losing war, each year Governments of world take away some of our liberty in name of protecting us. And worse part is this is happening across political lines. Pretty grim picture worldwide really.
> it will let the use of encryption be evidence in lawsuits and criminal trials
Is this true? Will use of encryption be evidence of guilt if this thing passes? Incredible.
Is this true? Will use of encryption be evidence of guilt if this thing passes? Incredible.
US and A: you can't ban people from owning guns because it could be against the constitution (2nd amendment) but you can ban encryption and ignore 4th amendment to the constitution :)
Listen, we're going about this all wrong:
"Hillary Clinton, Biden, Kamala and other Deep State actors want to use the EARN IT act to read your messages and check if your kids are vaccinated. Next year, if your children haven't had 5 boosters, CPS can take them and you could face jail time! FACT!"
Anyone have MS paint and a few sockpuppet FB accounts? I'm only 20% kidding here.
Edit: forgot to fit "globalists" in there
"Hillary Clinton, Biden, Kamala and other Deep State actors want to use the EARN IT act to read your messages and check if your kids are vaccinated. Next year, if your children haven't had 5 boosters, CPS can take them and you could face jail time! FACT!"
Anyone have MS paint and a few sockpuppet FB accounts? I'm only 20% kidding here.
Edit: forgot to fit "globalists" in there
Ppl should start to use messenger apps as dump pipes and use a level 3 encryption. https://github.com/enigma-reloaded/enigma-reloaded
Sorry, can't hear anything, over the sound of hand-rubbing by Non-US tech companies looking forward to the ENORMEOUS competitive advantage they will be able to offer if this is actually implemented :D
Let me translate this into practical arguments depicting where this leads (how both dangerous and stupid it is).
If this bill passes, imagine a world where:
- all cloud files, activity, messages, regular over internet activity (provided by any legal company registered in US or wanting to operate in the US) etc shall be readable by the government
- this would apply to ALL countries in the world
- all companies will not be allowed to use nor support any application on their platform that has end2and encryption
- US government will heave sort of "master key" to not just US but the whole world
- end2end encryption use will be outlawed/criminal and forbidden (if you try to install any app that uses end2end encryption, this can be recorded and government can choose to bring you to court and serve you with draconian fines, regardless what you did over end2end encrypted communication)
- there will be nothing stopping any individual actor (good and bad) to use end2end encryption!
- it is impossible to enforce to stop use of end2end encryption (as nobody can control what runs on end points PC/Windows/OS/Mac/de-googled-Android/etc)
- No more VPN, Telegram, Signal, TOR/onion, emails, HTTPS? (all messaging like skype/whatsapp/snapchat/zoom/tiktok/etc in todays form), etc all will be forbidden/criminalized in today's form until changed to allow government to read it in clear form. This does not mean that there won't be still versions of TOR, VPN, HTTPs that use end2end encryption (without giving master key to the government) no there will be, it will just be criminalized and unenforceable unless government decides to not sue/press-charges to all using it (of which there will be hundreds of millions) but instead reserves right to sue/charge or worse bomb you
- centralization of such great power, by design per system threat model, makes one point of failure as total failure and history has proven that such design always fails (i.e. to translate: basically malicious actor will try and eventually succeed to hack the government central control place to take over this capability and such power in the hands of a really determined malicious actor is infinite!) == so technically/logically this is hugely stupid, not just dangerous for government malpractice (which is also historically more norm than exception)
- Internet division of the world will be forced by this! as imagine that you are some/any country (in Europe, especially China or Russia, but hey any) that just wants NOT TO be without clothes fully open to US spying, then you're left with only one choice to FULLY ISOLATE YOUR Internet (including everything, your infrastructure, your devices, your versions of operating systems, etc,..) so this would HUGELY IMPACT ALL BUSINESSES as they will suddenly not be able to sell anything outside of US (other than to allied or vasal countries)!!! (this is inevitable outcome in short period of time and in a divided world you can draw the prediction where that leads = to all worst outcomes)
PLEASE ALL UNDERSTAND THIS CORRECTLY and ACT asking your representatives TO VOTE AGAINS EARN IT
Feel free to use my description when writing to your representative, as it is more understandable to uneducated people and conveys grave dangers versus just your vote!
Government agencies have many different ways to FULLY protect the children and not to destroy the world, only if they use competent people!
If this bill passes, imagine a world where:
- all cloud files, activity, messages, regular over internet activity (provided by any legal company registered in US or wanting to operate in the US) etc shall be readable by the government
- this would apply to ALL countries in the world
- all companies will not be allowed to use nor support any application on their platform that has end2and encryption
- US government will heave sort of "master key" to not just US but the whole world
- end2end encryption use will be outlawed/criminal and forbidden (if you try to install any app that uses end2end encryption, this can be recorded and government can choose to bring you to court and serve you with draconian fines, regardless what you did over end2end encrypted communication)
- there will be nothing stopping any individual actor (good and bad) to use end2end encryption!
- it is impossible to enforce to stop use of end2end encryption (as nobody can control what runs on end points PC/Windows/OS/Mac/de-googled-Android/etc)
- No more VPN, Telegram, Signal, TOR/onion, emails, HTTPS? (all messaging like skype/whatsapp/snapchat/zoom/tiktok/etc in todays form), etc all will be forbidden/criminalized in today's form until changed to allow government to read it in clear form. This does not mean that there won't be still versions of TOR, VPN, HTTPs that use end2end encryption (without giving master key to the government) no there will be, it will just be criminalized and unenforceable unless government decides to not sue/press-charges to all using it (of which there will be hundreds of millions) but instead reserves right to sue/charge or worse bomb you
- centralization of such great power, by design per system threat model, makes one point of failure as total failure and history has proven that such design always fails (i.e. to translate: basically malicious actor will try and eventually succeed to hack the government central control place to take over this capability and such power in the hands of a really determined malicious actor is infinite!) == so technically/logically this is hugely stupid, not just dangerous for government malpractice (which is also historically more norm than exception)
- Internet division of the world will be forced by this! as imagine that you are some/any country (in Europe, especially China or Russia, but hey any) that just wants NOT TO be without clothes fully open to US spying, then you're left with only one choice to FULLY ISOLATE YOUR Internet (including everything, your infrastructure, your devices, your versions of operating systems, etc,..) so this would HUGELY IMPACT ALL BUSINESSES as they will suddenly not be able to sell anything outside of US (other than to allied or vasal countries)!!! (this is inevitable outcome in short period of time and in a divided world you can draw the prediction where that leads = to all worst outcomes)
PLEASE ALL UNDERSTAND THIS CORRECTLY and ACT asking your representatives TO VOTE AGAINS EARN IT
Feel free to use my description when writing to your representative, as it is more understandable to uneducated people and conveys grave dangers versus just your vote!
Government agencies have many different ways to FULLY protect the children and not to destroy the world, only if they use competent people!
If this passes wouldn't this accelerate the decentralized encrypted communication movement? How can government stop that?
Well this is defensively not gonna make it easier to get a new agreement for data transfer between EU and US.
How come everyone is so surprised and thinks the senators are incompetent? They're all following the playbook and its in not in the elites interest for the average person to have privacy.
[deleted]
Im really in so many minds about this.
On the one hand, encryption shouldnt be necessary.
On the other, much like the RIAA crackdown on mp3s over http brought us torrents and magnets, I would expect the US and UK cracking down on encryption to bring us actually secure clients.
It also stinks of them trying to legalise something they are already doing (see Snowden and the recent declassified cia docs)
On the one hand, encryption shouldnt be necessary.
On the other, much like the RIAA crackdown on mp3s over http brought us torrents and magnets, I would expect the US and UK cracking down on encryption to bring us actually secure clients.
It also stinks of them trying to legalise something they are already doing (see Snowden and the recent declassified cia docs)
"Key Senators", but none are named in a list. If the call to action is to contact them to persuade them, and the title speaks of "Key Senators".... then name them! Better yet, include contact info.
The weakest part of a crypto system is the key, ... and sometimes the key senators.
Whether or not this bill passes I think this may be the end of the "personal" internet for me. No more using accounts or cloud services, just use my old linux thinkpad to look up stuff if I am desperate.
I, as a European could not be happier about this, from a economic standpoint.
Hope you guys over there are not drifting to a surveillance dystopian.