EARN IT Act Abuses Privacy in the Guise of Protecting Kids

It probably won't save any children, but it might mean the end of encrypted messaging.

Governments have never liked it when their subjects keep secrets from them and they really don't like encryption technology, which makes it easier for people to conceal their messages from prying eyes. But the public hasn't been buying the eavesdropping that politicians are selling. So, the powers-that-be moved on to claiming that they're concerned about protecting the children and just incidentally restricting the use of techniques for protecting privacy. The EARN IT Act is the latest effort to invade our communications, and its advocates occasionally let the mask slip.

The Eliminating Abusive and Rampant Neglect of Interactive Technologies (EARN IT) Act of 2022 is ostensibly about protecting kids from child porn. "The bill amends Section 230 of the Communications Decency Act to remove blanket immunity from Federal civil, State criminal, and State civil child sexual abuse material laws entirely," asserted Sen. Lindsey Graham (R-S.C.) in a press release when he introduced the bill last week.

But Reason's Elizabeth Nolan Brown has covered the EARN IT Act and its predecessors through the various incarnations of the legislation, and points out that the bill is based on some false claims:

The main thrust of the EARN IT Act is to add another exception to Section 230 (the law that shields digital entities from some liability for user and customer communications) related to child pornography. What supporters of the law like to obscure is that digital entities are not shielded from federal prosecution if they break child porn laws. The EARN IT Act isn't needed to criminally punish them for this.

So, if the law already holds accountable people who post child pornography, what's going on here? Sen. Richard Blumenthal (D-Conn.), a co-sponsor of the bill, showed his hand when asked by The Washington Post about the bill making encrypted services evidence of wrongdoing. "He said lawmakers wouldn't offer a blanket exemption to using encryption as evidence, arguing companies might use it as a 'get-out-of-jail-free card,'" reporter Cat Zakrzewski noted.

As a result, the Electronic Frontier Foundation warns that "if enacted, EARN IT will put massive legal pressure on internet companies both large and small to stop using encryption and instead scan all user messages, photos, and files."

This isn't an isolated example, either. The British government is waging an extended campaign against encryption in the name of saving children from exploitation. It even launched an advertising campaign against the use of privacy-protecting technology.

"We have engaged M&C Saatchi to bring together the many organisations who share our concerns about the impact end-to-end encryption would have on our ability to keep children safe," the UK Home Office told Rolling Stone last month. 

The motivating factor here isn't an epidemic of kiddie porn. It's more of an organized effort among multiple governments to turn the public against anything that shields communications from prying eyes.

"We, the undersigned, support strong encryption, which plays a crucial role in protecting personal data, privacy, intellectual property, trade secrets and cyber security," the governments of Australia, Canada, India, Japan, New Zealand, the United Kingdom, and the United States insisted in a joint October 2020 statement. "Particular implementations of encryption technology, however, pose significant challenges to public safety, including to highly vulnerable members of our societies like sexually exploited children. We urge industry to address our serious concerns where encryption is applied in a way that wholly precludes any legal access to content."

So, multiple governments are coordinating efforts to suppress encryption by linking it to child abuse, and the EARN IT Act is an American manifestation of that scheme. But even officials of some of those governments find this all a bit preposterous, including Britain's Information Commissioner's Office (ICO), which acts as a data watchdog.

"The discussion on end-to-end encryption use is too unbalanced to make a wise and informed choice. There is too much focus on the costs without also weighing up the significant benefits," Stephen Bonner, ICO's Executive Director for Innovation and Technology, objected in January. "E2EE [end-to-end encryption] serves an important role both in safeguarding our privacy and online safety. It strengthens children's online safety by not allowing criminals and abusers to send them harmful content or access their pictures or location."

Some American lawmakers also raise worries about the bill's impact.

"I've got some concerns with the encryption component of the bill," Sen. Mike Lee (R-Utah) objected during a February 10 Senate Judiciary Committee hearing considering the EARN IT Act. "I'm a little concerned that the current language inadvertently mandates interactive computer services to do for the government what the government itself is prohibited from doing, which is engaging in sort of open-ended policing, the accessing and then reporting of private and protected data without the protections of the law."

He also pointed out that compliance with the proposed law's liability standards would be far easier for large, established services than for smaller operations.

"I remain concerned about some of the provisions around encryption and how it may impact domestic violence victims in this country, human rights advocates and journalists overseas," agreed Sen. Christopher Coons (D-Del.).

Nevertheless, the committee members approved the bill without any changes.

"The newest version of the bill…makes things worse," warns the Center for Democracy and Technology in a letter objecting to the measure before Congress. "By dramatically expanding the risk of lawsuits intermediaries will face over user-generated content and their use of end-to-end encryption, the bill will cause intermediaries to over-remove even lawful content and disincentivize them from offering encrypted services, to the detriment of all internet users."

It's a fair bet that disincentivizing the use of encryption is exactly what is intended by the sponsors of this and related measures in the United States and abroad. For all of the talk of saving children from abuse, the true hope of lawmakers and government officials is to abuse our privacy by stripping us of the ability to keep secrets from the state.