EARN IT Act Threatens Encryption, Free Expression, and Prosecutions of Child Exploitation

Today, Senators Lindsey Graham (R-SC) and Richard Blumenthal (D-CT) introduced the EARN IT Act, which would have wide-ranging effects on privacy, free expression, and secure communications. The bill, which purports to fight the spread of child sexual abuse material online, undermines not only encryption and the security of internet communications, but also future law enforcement investigations against predators of children.

The bill would require providers of online services to adhere to best practices, set by a commission led by the Attorney General, in order to receive liability protections that currently exist for all websites. Those best practices would likely include mandating that companies scan and filter content and effectively banning end-to-end encryption, raising serious questions about constitutionality.

“This bill blurs the line between companies and government in dangerous ways. If companies’ policies about looking for and discovering material containing child sexual abuse are overly dictated by the Commission’s guidelines, they may be considered agents of the government conducting warrantless searches. Congress could be giving a get-out-of-jail-free card to defendants in child exploitation cases,” said Greg Nojeim, Director of CDT’s Freedom, Security & Technology Project.

The bill also poses a serious threat to free expression. “The EARN IT Act would give government officials unprecedented powers to craft de facto regulations for online speech. Online service providers would almost certainly err on the side of caution and take down anything—including a lot of lawful, constitutionally protected speech—that the Attorney General might not like,” said Emma Llansó, CDT’s Director of Free Expression.

The EARN IT Act could even ban end-to-end encryption in practice, putting the safety and security of internet users at risk. “It’s a mistake to frame the debate about whether to ban strong end-to-end encryption in terms of privacy versus safety, because our online and physical-world lives are deeply entwined. For many people, particularly the most vulnerable and at-risk among us like domestic abuse victims and the LGBT* community, maintaining privacy and security online is absolutely critical to maintaining physical safety,” said Hannah Quay-de la Vallee, CDT’s Senior Technologist.