13 ms·

I don't care for most of it except this: >> Carve-Out for Actors Who Purposefully Blind Themselves and Law Enforcement to Illicit Material >>...it makes lit

I don't care for most of it except this: >> Carve-Out for Actors Who Purposefully Blind Themselves and Law Enforcement to Illicit Material >>...it makes little sense to apply “Good Samaritan” immunity to a provider that intentionally designs or operates its services in a way that impairs its ability to identify criminal activity occurring on (or through) its services, or to produce relevant information to government authorities lawfully seeking to enforce criminal laws. A Good Samaritan is not someone who buries his or her head in the sand, or, worse, blinds others who want to help. >>One important way to confront the grave and worsening problem of illicit and unlawful material on the internet is to ensure that providers do not design or operate their systems in any manner that results in an inability to identify or access most (if not all) unlawful content. Such designs and operation put our society at risk by: (1) severely eroding a company’s ability to detect and respond to illegal content and activity; (2) preventing or seriously inhibiting the timely identification of offenders, as well as the identification and rescue of victims; (3) impeding law enforcement’s ability to investigate and prosecute serious crimes; (4) and depriving victims of the evidence necessary to bring private civil cases directly against perpetrators. >>We propose making clear that, in order to enjoy the broad immunity of Section 230, an internet platform must respect public safety by ensuring its ability to identify unlawful content or activity occurring on its services. Further, the provider must maintain the ability to assist government authorities to obtain content (i.e., evidence) in a comprehensible, readable, and usable format pursuant to court authorization (or any other lawful basis). Is this the end of online privacy as we know it? From here: https://www.justice.gov/file/1286331/download https://www.justice.gov/file/1286331/download

kordlessagain 6y ago
> Is this the end of online privacy as we know it? That would imply there was online privacy at some point, or at least that it was a thing that all users could reasonably understand and achieve. If users understood that Facebook's business model might eventually require what (in hind-sight) appeared to be multiple privacy violations, but continued to use the service anyway because they couldn't help themselves, they really never had online privacy when using the service. For those of you down-voting me, I'm pointing out this is a fallacious argument talking about online privacy. The companies who built these huge platforms didn't bake in online privacy when they built and evolved their systems. Talking about it like we've "lost it" is pointless, but I do think it's worth exploring how we can make it better!
- abvdasker 6y ago
  One thing this effort tells us indirectly but unambiguously is that federal law enforcement and surveillance does not have a technical solution for end-to-end encrypted services or Apple's device encryption. If they did, there would be no need to create new legal penalties (and make no mistake, the federal law enforcement and surveillance agencies are the real force behind this effort to defeat online privacy).
pwinnski 6y ago
Wow, that seems to be written with Apple (at least) in mind, and is terrifying. I want operators to intentionally design and operate their services in way that impairs their ability to identify any activity, because any exceptions are exploits. Just saying "criminal activity" doesn't make it not spying on Americans.
- FriendlyNormie 6y ago
  You sound like you have something to hide.
- saurik 6y ago
  If it truly can't identify activity then does it need Section 230 in the first place? The immunity granted by Section 230 is for people who want the ability to moderate content, and if you are merely a dumb pass-through of a bunch of encrypted information you aren't using it as you are more of a common carrier, right?
  - ROARosen 6y ago
    Exactly. They are also basically saying you don't need to moderate most illicit activity (if it's an unmoderated format) but you essentially can't operate such a platform in a form where it is "unmoderateable"/untraceable because you should be liable for any unlawful content that goes up, and for the the fact that you facilitated it.
    - deleted 6y ago
      [deleted]
  - treis 6y ago
    The law provides them immunity from civil suits. Apple as a provider can say they comply with section 230 and avoid any legal liability from people that may be harmed by their actions. In other words, you can't sue Apple because someone used iCloud to distribute child porn of you. The essential bargain struck for 230 was that providers get immunity in exchange for policing their system and helping law enforcement. Apple et al removing their ability to police their systems breaks that bargain.
jliptzin 6y ago
Yes it is, of course ushered in by the party of “personal liberties” and “individual freedom.”
shadowgovt 6y ago
An anti-8chan interpretation. "If everyone is Anonymous, we're just going to treat it like the actions coming from your service are your actions." Fascinating.
lawnchair_larry 6y ago
Did they just make tor illegal?
- Covzire 6y ago
  Only for sites that would want/need S230 protections right?
mmazing 6y ago
Does that impact VPN providers?
- judge2020 6y ago
  Most certainly. Probably ISPs too since now police can't wiretap and listen in on connections to forums.att.com to stop people from posting illegal content there. Except that this law will be selectively enforced to reduce freedom and spy on the public's communications.
kats 6y ago
Would WebRTC become practically illegal? Because any peer-to-peer communication might be argued to result "in an inability to identify or access most (if not all) unlawful content." If a website has a feature like voice channels or video calls that are peer-to-peer, then for "most (if not all)" of it the website has an inability to identify unlawful content. e.g. Zoom, Slack, Google Voice, and Discord would have to monitor your calls so they have the ability to identify unlawful content.
geofft 6y ago
I'm not seeing that in the actual proposed legal text (https://www.justice.gov/file/1319331/download https://www.justice.gov/file/1319331/download), and I'm wondering if I'm overlooking it or this is just posturing that they weren't able to write up in a reasonable way. The closest thing I see is subsection (d)(2), which says that the platform can be prosecuted (A) for a "specific instance of material or activity" (B) if it had "actual notice of that material's or activity's presence on the service," unless (C) they remove/block "the specific instance of material," report it to law enforcement, and "preserve evidence related to the material or activity for at least 1 year." I believe the major commercial E2E platforms generally have the ability to notice specific hashes of known-bad material (think, e.g., child sexual abuse material) and block it / alert the platform through a client-side filter, which I think would make it pretty easy to comply with these requirements. Alternatively, it would be enough, I think, to remove and ban the accounts involved. The only difficult part is that you need to "preserve evidence," but my understanding is that this phrasing doesn't generally compel you to create evidence where none existed. Privacy-focused platforms have for years avoided keeping logs that they do not want to get turned over for the government, and it's generally much more onerous for the government to ask you to start keeping logs than to get mad at you for deleting/purging logs you already collected. So I don't think this actually imposes any requirements on design, or gets in the way of E2E or non-logging platforms. If you are informed of specific illegal content, you need to take action. But if you operate the service in a way that you don't have "actual notice" or "evidence" of anything people send with it, I think that's still fine. The other carve-outs don't seem to be relevant. (d)(4) might be if you look funny enough: it says the platform has to make itself able to receive notification of illegal content, and that a platform doesn't get immunity "if it designs or operates its service to avoid receiving actual notice of Federal criminal material on its service or the ability to comply with the requirements under Subsection (d)(2)(C)." I suppose you could argue that not keeping logs means that you've designed your service in a way where you can't "preserve evidence," which would run afoul of this. But I don't think that's the right interpretation: if you're not creating unnecessary logs in the first place, if you keep the logs you do log for a year, you've preserved all the evidence that exists. Am I being too optimistic here? (I do agree that the plaintext summary you quoted is very concerning.)
slaymaker1907 6y ago
This is so stupid. It's completely ignoring the fact that programs like GPG have existed for decades that allow you to transmit whatever illegal content you want to over any media supporting arbitrary plain text.
__blockcipher__ 6y ago
This sounds like the EARN IT act. Very scary. Would de-facto outlaw e2e encryption
IanSanders 6y ago
>Purposefully How is that going to be determined?

kordlessagain 6y ago

> Is this the end of online privacy as we know it? That would imply there was online privacy at some point, or at least that it was a thing that all users could reasonably understand and achieve. If users understood that Facebook's business model might eventually require what (in hind-sight) appeared to be multiple privacy violations, but continued to use the service anyway because they couldn't help themselves, they really never had online privacy when using the service. For those of you down-voting me, I'm pointing out this is a fallacious argument talking about online privacy. The companies who built these huge platforms didn't bake in online privacy when they built and evolved their systems. Talking about it like we've "lost it" is pointless, but I do think it's worth exploring how we can make it better!

abvdasker 6y ago
One thing this effort tells us indirectly but unambiguously is that federal law enforcement and surveillance does not have a technical solution for end-to-end encrypted services or Apple's device encryption. If they did, there would be no need to create new legal penalties (and make no mistake, the federal law enforcement and surveillance agencies are the real force behind this effort to defeat online privacy).

pwinnski 6y ago

Wow, that seems to be written with Apple (at least) in mind, and is terrifying. I want operators to intentionally design and operate their services in way that impairs their ability to identify any activity, because any exceptions are exploits. Just saying "criminal activity" doesn't make it not spying on Americans.

FriendlyNormie 6y ago
You sound like you have something to hide.
saurik 6y ago
If it truly can't identify activity then does it need Section 230 in the first place? The immunity granted by Section 230 is for people who want the ability to moderate content, and if you are merely a dumb pass-through of a bunch of encrypted information you aren't using it as you are more of a common carrier, right?
- ROARosen 6y ago
  Exactly. They are also basically saying you don't need to moderate most illicit activity (if it's an unmoderated format) but you essentially can't operate such a platform in a form where it is "unmoderateable"/untraceable because you should be liable for any unlawful content that goes up, and for the the fact that you facilitated it.
  - deleted 6y ago
    [deleted]
- treis 6y ago
  The law provides them immunity from civil suits. Apple as a provider can say they comply with section 230 and avoid any legal liability from people that may be harmed by their actions. In other words, you can't sue Apple because someone used iCloud to distribute child porn of you. The essential bargain struck for 230 was that providers get immunity in exchange for policing their system and helping law enforcement. Apple et al removing their ability to police their systems breaks that bargain.

jliptzin 6y ago

Yes it is, of course ushered in by the party of “personal liberties” and “individual freedom.”

shadowgovt 6y ago

An anti-8chan interpretation. "If everyone is Anonymous, we're just going to treat it like the actions coming from your service are your actions." Fascinating.

lawnchair_larry 6y ago

Did they just make tor illegal?

Covzire 6y ago
Only for sites that would want/need S230 protections right?

mmazing 6y ago

Does that impact VPN providers?

judge2020 6y ago
Most certainly. Probably ISPs too since now police can't wiretap and listen in on connections to forums.att.com to stop people from posting illegal content there. Except that this law will be selectively enforced to reduce freedom and spy on the public's communications.

kats 6y ago

Would WebRTC become practically illegal? Because any peer-to-peer communication might be argued to result "in an inability to identify or access most (if not all) unlawful content." If a website has a feature like voice channels or video calls that are peer-to-peer, then for "most (if not all)" of it the website has an inability to identify unlawful content. e.g. Zoom, Slack, Google Voice, and Discord would have to monitor your calls so they have the ability to identify unlawful content.

geofft 6y ago

I'm not seeing that in the actual proposed legal text (https://www.justice.gov/file/1319331/download https://www.justice.gov/file/1319331/download), and I'm wondering if I'm overlooking it or this is just posturing that they weren't able to write up in a reasonable way. The closest thing I see is subsection (d)(2), which says that the platform can be prosecuted (A) for a "specific instance of material or activity" (B) if it had "actual notice of that material's or activity's presence on the service," unless (C) they remove/block "the specific instance of material," report it to law enforcement, and "preserve evidence related to the material or activity for at least 1 year." I believe the major commercial E2E platforms generally have the ability to notice specific hashes of known-bad material (think, e.g., child sexual abuse material) and block it / alert the platform through a client-side filter, which I think would make it pretty easy to comply with these requirements. Alternatively, it would be enough, I think, to remove and ban the accounts involved. The only difficult part is that you need to "preserve evidence," but my understanding is that this phrasing doesn't generally compel you to create evidence where none existed. Privacy-focused platforms have for years avoided keeping logs that they do not want to get turned over for the government, and it's generally much more onerous for the government to ask you to start keeping logs than to get mad at you for deleting/purging logs you already collected. So I don't think this actually imposes any requirements on design, or gets in the way of E2E or non-logging platforms. If you are informed of specific illegal content, you need to take action. But if you operate the service in a way that you don't have "actual notice" or "evidence" of anything people send with it, I think that's still fine. The other carve-outs don't seem to be relevant. (d)(4) might be if you look funny enough: it says the platform has to make itself able to receive notification of illegal content, and that a platform doesn't get immunity "if it designs or operates its service to avoid receiving actual notice of Federal criminal material on its service or the ability to comply with the requirements under Subsection (d)(2)(C)." I suppose you could argue that not keeping logs means that you've designed your service in a way where you can't "preserve evidence," which would run afoul of this. But I don't think that's the right interpretation: if you're not creating unnecessary logs in the first place, if you keep the logs you do log for a year, you've preserved all the evidence that exists. Am I being too optimistic here? (I do agree that the plaintext summary you quoted is very concerning.)

slaymaker1907 6y ago

This is so stupid. It's completely ignoring the fact that programs like GPG have existed for decades that allow you to transmit whatever illegal content you want to over any media supporting arbitrary plain text.

__blockcipher__ 6y ago

This sounds like the EARN IT act. Very scary. Would de-facto outlaw e2e encryption

IanSanders 6y ago

>Purposefully How is that going to be determined?