A bill aimed at thwarting the online sexual exploitation of children came one step closer to becoming law last week. The Eliminating Abusive and Rampant Neglect of Interactive Technologies (EARN IT) Act made it out of a Senate markup hearing over objections from privacy and human rights groups.
Supporters of the legislation describe it as a narrow carve-out to Section 230, the law that indemnifies digital hosts against civil and state liability for third-party content. Currently, platforms hosting others’ posts are legally obligated to report child sex abuse material, or CSAM, once they are aware of it, but they are not required to scan their platform to find it proactively. EARN IT would change that by making digital hosts liable in civil claims and state criminal prosecutions for sexually exploitative content, leaving it up to 50 states to decide independently where the new line for legal culpability begins.
Republican co-sponsor Sen. Lindsey Graham of South Carolina said the “goal is to tell the social media companies, ‘Get involved and stop this crap, and if you don’t take responsibility for what’s on your platform, then Section 230 will not be there for you.'”
Democratic co-sponsor Sen. Richard Blumenthal of Connecticut argued the bill gives victims of child pornography “access to our justice system so that they can create an incentive for these companies to do the right thing.” He pointed to support from 250 law enforcement and child protection organizations.
The legislation also creates a federal law enforcement commission charged with publishing best practices recommendations for tech companies in combating child pornography, which could provide some liability protections for the firms.
While there was no pushback on the intentions of the bill, some groups warned of unintended consequences lurking in the legislation.
The Electronic Frontier Foundation called the bill “a framework for private actors to scan every message sent online and report violations to law enforcement,” noting the incentives the bill creates for tech companies to stop offering end-to-end encryption and instead scan all user content on platforms and in the cloud.
While offering privacy-protecting encryption alone isn’t enough to land a tech company in court, it would be considered a contributing factor under EARN IT. For that reason, EFF warned that the practical goal of the legislation “is to get states to pass laws that will punish companies when they deploy end-to-end encryption or offer other encrypted services. This includes messaging services like WhatsApp, Signal, and iMessage, as well as web hosts like Amazon Web Services.”
Industry trade association NetChoice wrote in Slate that because the legislation essentially forces tech companies to scan all content to avoid liability, they would be acting as “government agents” in their uncovering of CSAM. That means whatever illegal content they find might be inadmissible in court because of Fourth Amendment constraints. If that evidence gets excluded because it was obtained without a warrant, more individuals prosecuted for child sex abuse could go free.
Opponents caution against this legal shift in part because larger tech firms already report an enormous amount of CSAM to authorities and already have advertiser and user incentives to keep that content off their platforms. In 2020, the National Center for Missing and Exploited Children received 20 million reports from Facebook, more than 500,000 from Google, and almost 100,000 from Microsoft. If those reports were not prosecutable because private companies cannot obtain warrants, the number of criminals caught might diminish.
Curtailing Section 230 protections does not have a good track record. The only other time Congress stepped in to limit those liability protections was 2018’s SESTA/FOSTA bill, an attempt to curb advertising for prostitution online. Since then, the effort has been panned for chilling too much adjacent speech and driving sex workers offline into less safe real-world interactions with clients.
Republican Sen. Mike Lee of Utah expressed hesitation about EARN IT’s incentives for private snooping. “I’m a little concerned that the current language inadvertently mandates interactive computer services to do, for the government, what the government itself is prohibited from doing — which is in engaging in open-ended policing, the accessing and then reporting of private and protected data without the protections of the law.” Similarly, Democratic Sen. Cory Booker of New Jersey urged the bill’s sponsors to work on civil liberties concerns before the legislation moves forward.
After passing out of the Senate Judiciary Committee with bipartisan support last Thursday, EARN IT can now go to the Senate floor. But to garner the votes needed to make it law, it’s likely many of the concerns voiced at the hearing must be addressed.
