Which bill? The Lawful Access to Encrypted Data Act bill (https://www.judiciary.senate.gov/imo/media/doc/S.4051%20Lawful%20Access%20to%20Encrypted%20Data%20Act.

Which bill? The Lawful Access to Encrypted Data Act bill (https://www.judiciary.senate.gov/imo/media/doc/S.4051%20Lawful%20Access%20to%20Encrypted%20Data%20Act.pdf https://www.judiciary.senate.gov/imo/media/doc/S.4051%20Lawf...) is on its face every security engineer's worst nightmare. It explicitly mandates that large service providers and device manufacturers implement backdoors. Full stop. Not only would that suck for Apple and Signal, it would probably suck for AWS (i.e. AWS KMS), too, presuming AWS doesn't already provide those backdoors. I agree that there seems to be more hyperbole (slippery slope, parade of horribles hand wringing) surrounding the EARN IT bill (https://www.congress.gov/bill/116th-congress/senate-bill/3398/text https://www.congress.gov/bill/116th-congress/senate-bill/339...). It would make CDA Section 230 Safe Harbor protections contingent on complying with "best practices", but only for civil suits related to child sexual exploitation. In practice I assume this would mean the only exposure for, e.g., Facebook if they failed to comply with "best practices" would be suits from those victimized over the platform. Theoretically large social media platforms could probably absorb whatever minimal liability that creates for them, notwithstanding the uncertainty that would exist until the first few cases exposed the contours of when and how they'd be liable. OTOH, from a PR perspective it might be difficult to remain intransigent. But in any event Section 230 Safe Harbor is a rather novel immunity and most other industries have no such protections, so it's not like it would be the end of the world. Heck, plenty of people worried about EARN IT also argue in other contexts (e.g. fake news culpability) for the removal of Section 230 protections altogether. Also, it's really not clear how EARN IT would effect end-to-end encryption. I can't see how it'd effect Signal, period. They have no real need for Section 230. Facebook might need to spin off WhatsApp (assuming it's not already separate), but creating complex corporate ownership structures to limit liability is well trodden ground. That said, half of the language in EARN IT is geared toward creating a fast-track legislative mechanism in the House and Senate that would circumvent debate and, as a practical matter, accountability. Perhaps it's possible that mechanism could also be used to sneak through broader encryption-related legislation.