And thanks, everybody, for having us here to talk about some of our favorite subjects,
online speech and privacy. I'm Cathy Gellis, half of this duo, and I'm going to be going first
because if we're going to be talking about potential changes to Section 230, which is what
the EARN IT Act does in part, we should have a good idea about what Section 230 is, how it works,
and really understand it before we break it and find out that maybe that was a mistake.
It will be a mistake. Stay tuned. We will explain why. By way of introduction, I am a solo cyber
lawyer in the San Francisco Bay Area. I like to work on online speech issues, including Section
230 issues. I am a lawyer. Rihanna's a lawyer. We are not your lawyers. If we were your lawyers,
we would have all signed letters saying so, and there's been no letters. So just to make that
clear. But we do know what we're talking about. So this presentation has two parts. The reason I'm
going first, doing the crash course, and then I will be joined by Rihanna to talk more.
Hi, everyone. We are back again with more technical difficulties. But have no fear,
I've got everyone back. I don't know if anyone's ever done OBS over a virtual desktop. Apparently,
tip for the other folks learning from this stream, if you are logged into a Zoom in a virtual machine
using OBS, and somebody else logs into that virtual machine, Zoom disconnects the user
that is connected to Zoom on that virtual machine. So we're back. We've learned this new
thing about technology. I will give it back over to Kathy, who's going to talk about the
overarching principles. Okay, thanks, Whitney. I'm not quite sure where we got cut off. But
Rihanna and I, both lawyers, not your lawyers, but it does mean we know what we're talking about.
The first bit that we're going to do is crash course in Section 230. Because speaking of
learning curves, stuff breaks, but it'd be really stupid to break it on purpose, because we didn't
understand this really great and important law before we start changing it with proposals like
the earn it and various other things that are floating through the halls of our government.
So getting into it, as we go into this lesson, this crash course, couple of things to keep in
mind, overarching principles. The first thing, Section 230 is a really hot topic these days.
Everybody's talking about it. Everybody's complaining about it. Bear in mind that much
of what people are complaining about, because people are saying bad stuff, saying and doing bad
stuff on the internet, is really a byproduct of we've got a First Amendment. Freedom of speech
tends to protect an awful lot of stuff that we are upset about. And if we were going to try to
change the law to change it, that means we'd have to get rid of the First Amendment, and that's
probably not a really good idea. So it also means that basically, if we're unhappy about something,
the correct policy choice is not to change Section 230, because it's not actually Section 230's fault.
A second overarching point that we need to bear in mind is that litigation can be cripplingly
expensive, even when the position that you've got as a defendant is the better one.
The fact you might win the lawsuit doesn't necessarily help. Lawsuits are expensive and
potentially bankrupting, and what Section 230 is designed to do is to make sure that
platforms can stay in business without feeling like they're going to be financially obliterated
because one of their users says or does something stupid, and somebody tries to hold them responsible
to it. Because if you think about the tremendous volume of what even the smallest platforms end up
facilitating in terms of user-generated content, that's enormous. Even if they just had to, like,
call up a lawyer to find out, do we need to really respond to this? That gets expensive. That meter
ticks. It's not realistic. And what Section 230 is designed to do is make sure that a platform
cannot be bled dry financially by getting called into court by legal threats, real or even
actual ones as well. Put another way, the overall goal of Section 230, and we're going to get back
to this a lot, is to ensure that we get the most good stuff online and the least bad.
There are a lot of really cool things that people say or do over the internet. We want to make sure
that the internet remains as available as possible to get the most of that. If platforms had to fear
liability, they would not be in the position to facilitate all that good stuff. It would end up
much more limited or maybe not be possible at all. At the same time, there's a lot of crap on the
internet, and we would like to minimize the crap. So the other point of Section 230 is to put
platforms in a position where they can minimize the crap without worrying about getting into trouble
if they actually do the best they can on that front. So in order to optimize the most good and
least bad, we have Section 230. It doesn't mean that we'll ever hit optimum on either front,
but it gets us as close as we can reasonably get. And that gets to the fourth point.
Effective regulation doesn't need to be punitive. Carrots can work best with sticks. And what Section
230 is best understood as is all carrot, no stick. That basically, we want the platforms to be there
to get us the most good stuff and the least bad stuff, and we're going to make it... we're going
to incentivize them to do the best they can on both fronts. And the reason they're going to be
able to do the best they can is because they're not scared. They're not scared of being punished
financially through liability, etc. That's the magic of Section 230, to make it possible that
the platforms and policy can all be aligned to do the best that we can. That's why we have the
Internet today. So let's take a look at our next slide and talk about how we got Section 230.
So if we get in our time machine and go back to 1995, a couple of things were happening. The first
thing that was happening was that the Internet, which had been existing for quite some time,
but was starting to enter the public consciousness. And as it hit the public consciousness,
Congress became aware of it and started to become concerned that, oh my gosh, the Internet,
there's porn on the Internet. Oh no, this is terrible. Some of it, probably not so great,
but some of it is maybe a little overreaction. But in any case, they were very concerned about
the amount of porn on the Internet and didn't want any of it there. Meanwhile, there was also
this lawsuit that came up in a state court of New York involving the system Prodigy. So Prodigy,
at the time, there were a number of dial-up, bulletin board-type services. Some were somewhat
large and commercial. Prodigy, CompuServe, eventually AOL. They were small in the sense of
not as big as today's platforms, but they were relatively big. Prodigy had been around for
10 years, at least, at that point. And they handled an awful lot of user-generated content.
And a user had arguably defamed the plaintiff in this lawsuit. But the plaintiff decided to
Prodigy, basically under the theory of how dare you produce a system that allowed a user to defame
me. And they filed this lawsuit. And a judge in a state court in New York said, well, that sounds
good. Go ahead with your lawsuit. Sure, Prodigy should be in trouble for allowing this to happen.
And a couple of members of Congress looked at that case with alarm. Senator Wyden and then
Congressman Chris Cox. And they said, this is not going to be good. The Internet is coming. We've
got all these cool services. And they're going to not be able to be available to provide,
to facilitate user-generated speech. Nor are they going to be in a position to take down the
terrible stuff. So again, we have a crisis. If this law becomes a thing, we won't get the most
good stuff. We won't be able to minimize the most bad stuff. This is a problem. So these two ideas
came together and formed the Communications Decency Act of 1996. And then there was a lawsuit
challenging most of it because the getting rid of porn parts happened to infringe on the First
Amendment quite severely. And in a case called Reno v. ECLU, the U.S. Supreme Court said, nope,
those parts go away. They made clear that the First Amendment applies to online speech just
as much as it applies to offline speech. Those parts of the CDA went away, but Section 230
survived. And it survived, and it did its job clearing the way to make sure that people
continue to innovate internet services. So we're now looking at statute. Don't worry. If you're
not a lawyer, you will survive. This is okay. It's a good statute. It's pretty readable by
normal human beings. But I will give you a scenic tour of some of the parts. So this particular
page that we're on, they put in the beginning of the statute some preamble text, and it basically
boils down to Congress finds that the internet is pretty awesome. They go through two pages worth
of awesomeness, and then they get to their policy, and that the policy of the United States is to
keep the internet awesome. So this sort of sets what Congress is trying to accomplish. And one
of the things that it kind of articulates, most good stuff, but it also puts in some, we want to
make sure that there's some leverage so we can get rid of the bad stuff. Here we go. That's what
I just said. Okay. This is the most magnificent part of section 230. It is 26 words. Professor
Jeff Koseff wrote a book called the 26 words that created the internet. And I've tried to read it
out loud at conferences before, and it sounds terrible when pronounced, but it is fantastic.
And if I'm to summarize it in more understandable language, it basically means whoever creates the
problematic content is totally responsible for the problematic content, but not the service they used
to express it. And if we look at the bits that I highlighted, the bit at the bottom, the information
content provider, that's who created the content. And that other bit, the interactive computer
service, that's the platform. Internet platforms, interactive computer services,
it can be a lot of different things, but it's basically the platform that facilitated
a third party's expression. Here we go. Okay. This is the part of the statute that looks at
those definitions and basically says what I just told you. The information content provider is the
person who created it, and the interactive computer service is the part that facilitated it.
And that first part basically said the facilitator's not liable, but the people who
created it are. And so there's some question about what sort of, you know, who gets to be counted as
an interactive computer service. And, you know, we think a lot about social media. That's the easiest
thing to kind of get our heads around. But an email provider, they're facilitating other people's
expression, a bulletin board service like Prodigy, comment sections on blogs and online newspapers,
these are things that, you know, whoever posted the article is responsible for the content of the
article, but the things that the community provides to comment on the article, that's a
textbook case of Section 230. And then there's also a lot of courts that have looked at this
and said, you know, it also could apply to you, individuals. If you have a Facebook post that
takes comments on it, and somebody posts a comment, you're not responsible for the comment if
something is wrong with it. That's an important thing. I think when people talk about Section 230,
they tend to think of it in terms of, well, Google, Twitter, Facebook, and however you feel about
these companies tends to color your view. But understand that it's not about them. A, yes,
true, it was a law that allowed these innovative companies to come and exist. But it's also what
allows any company to come and exist. And it also is enabling an awful lot of online behavior that
ordinary people actually do themselves. There is a companion piece to Section 230. It's not
something that has actually, like, carried as much weight as the Section C1 part. But that whole bit
of, we want the companies to, we want the platforms to be able to do two things, keep the most good
stuff and the least bad stuff. And so what we've done with that carrot approach is said, okay,
here's the carrot. You're not liable if something wrong gets posted on your systems. And that's a
carrot because it basically means that the companies can say, I'm fine. I don't have to
worry if I'm not able to keep something bad off the internet. And that means that they're safe
to sort of be as expansive as possible to allow the most good stuff. If they had to fear the
punishment, then they would scrutinize a lot of content and take down a lot of content that
probably would have been just fine and completely lawful. So carrot-based approach to make the
platforms feel safe to leaving content up. But we also wanted to make them feel safe to take
content down because that's the other part, least bad stuff. If companies had to fear that they could
be punished or held liable for taking content down, they wouldn't bother at all. It would just
be too risky. But we want them to be partners in helping maintain internet hygiene. So we've also
given them a carrot in this department to say, go ahead. So here we are next. The other part of the
statute is there's section E where they threw in a couple of other things that end up being really
important. This particular clause is not really important. They sort of thought back then that
there would be a collision with another law that was on books, ECPA. And so they basically wrote
this text to say, no collision, no issue, go away, let's move on. And so indeed, let's move on.
This is an important clause because if we stop and think about the internet, this is inherently
interstate. It's very difficult to put something on the internet that stays in any one locality.
If you put something on the internet, it's available everywhere, everywhere throughout
the country, even throughout the world. And so we kind of ruin this whole policy if we let each
individual state pass a law that will somehow impact it. So if the companies are feeling safe
in Iowa to like, well, we're not going to be liable here, it really doesn't help them if
Illinois passes a law that says, no, no, if it happens in Illinois, you're in trouble.
So this is essentially a preemption statute. And so Congress put this in to say, look,
it's federal government, we got it, states sit this one out. And that's important because
internet policy is complex enough. It really would be overwhelming if all 50 states plus
territories and local jurisdictions could have their say. Okay, but they did put an exception.
So Section 230 applies for almost everything that could be legally wrong with user content with a,
but there's a few exceptions. And one of the big ones that they baked in originally was
the thing wrong with the content is that it potentially infringed on an intellectual property
right. Easiest one to get our head around is it might have infringed a copyright. Then
Section 230 doesn't apply. No protection for the platform. They might, they're going to be on the
hook for the liability in the user. Now it turns out that shortly thereafter, Congress passed
another law, the Digital Millennium Copyright Act, which does give platforms some protection.
But the reason I've put up this slide is this is a tiny piece of a tiny section of just one of
pieces of the Digital Millennium Copyright, Section 512 alone, and this isn't particularly
readable. It's not even particularly understandable. And companies go bankrupt trying to litigate.
There is a terrible situation like if you think that it's a problem that YouTube is so big, you
should know that there used to be a competitor to YouTube that got sued for copyright infringement
allegedly in their users content. And they went bankrupt in the process of litigating it
to the point where the Ninth Circuit Court of Appeals actually said there's no infringement.
They're not liable for this. They should have been just fine. At that point, the company was gone
and we lost a competitor, which now we're missing because it actually might be nice to have more
competition online. So when we think about messing with these liabilities or making these liabilities
complicated or conditional, this is what happens. We tend to obliterate them, and that's not what
we want to have happen. There was also an exception from the very beginning that said
there is no effect on federal criminal law. So that means that if the thing that was wrong with
the content is that it violates a federal criminal law, also section 230 wouldn't apply.
And for a while that was fine. I basically sort of said like child porn. That's bad. That tends
to violate federal criminal law. And so we would impose on the platforms that they needed to
do something about it. But that was one ask of a platform. And it's difficult and it's got some
issues tied up in how do you do that effectively, but basically it was a single ask, our most
important ask of what we could ask for a platform, and at least they could focus their resources on
that and not have to be dragged into any other things that they might have to look for. But then
things changed recently. A couple years ago, Congress put forth the first significant change
to section 230 since it was passed. You might have heard it called SESTA, but by the time it
got passed, it was referred to as FOSTA. And FOSTA basically said, you know, there's another type of
bad content. We don't want sex trafficking either. And that's true. That's bad. But they
poked a big hole in section 230. And one of the things to note, just looking at the slide,
is they poked a very complicated hole in section 230. That's hard to read and understand. And you
can see those hyperlinks are pointing you to other areas of the U.S. Code where they've put
another criteria. It's made platforms really unsure about what sort of content is okay for
them to facilitate and what sort of content is not. And as a result, they've started taking down
or making themselves unavailable for content that would be totally lawful. A very famous example is
Craigslist took down entire sections of classified ads, like dating ads. Dating ads are... they've
been around for ages. Couples have met that way. There's nothing inherently wrong about an ad
looking for dates and matchmaking. But because this is sort of adult content that can, you know,
tip into the period, Craigslist quite reasonably got scared because they didn't really know,
I think we might be held responsible for it. And that's just too big a chance to take.
The other thing that this law did is it made it somewhat unsafe, and actually more than somewhat,
it made an unsafe for a platform to take stuff down. Because... and we'll talk about this as
we talk about other attempts to reform Section 230. They tend to mess with the idea of, like,
if you knew it was there, then you're on the hook for it. So if you didn't know it was there,
you might be okay. But then why should a platform take the time and energy to look for what might be
there? Because it's just tempting trouble for themselves. So all of a sudden, now the platform
is not a partner in dealing with the internet hygiene. And that's not constructive. It's not
going to help us get the most good stuff or the least bad stuff. So remember these thoughts,
how cripplingly expensive it is to be sued, even if the lawsuit is without merit. Remember that
we want the most good stuff and the least bad stuff. And that carrots are more effective than
sticks to helping us get that. And when we think about what some of these other laws are,
you know, tested against that notion, and I think you'll find that most of these proposals fail.
So with that, we're about to bring up Rihanna to talk to her. And one of the things we'll tip on
is there is one proposal floating out there, which is okay. The first one, the examination
of secondary effects for sex workers study. One of the things is that FOSTA kind of got rammed
through where people said, I think we have a problem. But instead of really understanding
the dynamic of that problem, they went ahead and changed the law around it without really
understanding if that was a good solution, an effective solution, or one that didn't actually
make the problem worse. Because it turns out there's a lot of evidence that it's actually made
the problem they were trying to fix worse, worse. Women, there's a body count attached to FOSTA,
sad to say. And this is a proposal to basically let's figure out what the effects are before we
do anything else to it. But the rest is not okay. We're hearing executive orders trying to challenge
Section 230. The DOJ has put out a guidance document that doesn't really understand it at all.
The PACT Act is the most plausible where it seems to at least understand the statute,
but it still creates problems. It seems like every week Senator Hawley is producing a bill
to change it. And then there is the ERNED Act, which is sort of the bane of our existence,
because it does more than change Section 230. I'm going to bring up Rhiannon now.
We're going to close the sides and hopefully things don't break. And did I succeed?
Okay. So, do we have Rhiannon? Yay! Okay, we're back to a single person.
Great. Well, I was going to suggest we've gotten a few questions coming in over the Discord. Thanks,
everybody. Maybe we could try knocking out a few of these, Kathy, before we get to talking a bit
more about ERNED. Okay, excellent. Let's see. I see that... I'm seeing questions about moderation
by bot and whether that is somehow bad or not, or that 230 speaks to it. And basically,
230 has a deliberately very light touch. It can apply to a whole bunch of systems
in a whole bunch of contexts, and it's not very specific, which makes it very flexible. It was
written in the mid-90s, and the internet has obviously changed quite a bit ever since,
and it's flexible. It doesn't directly speak to AI, but if we stop and think about what AI is,
AI, in theory, is the computer outsourcing of the brain of the people in the company.
They have made decisions about how they want things moderated, and they deploy their bots to
do it. The fact that you have technology pressing the button instead of a human being pressing the
button, it doesn't change it. The core thing about Section 230 is that the intermediary is not
responsible for the wrongfulness of the content that somebody else created, and the bots don't
change that. They're still connected to the editorial discretion of the platform, and
no, 230 is fine. It's not like it's an end run around it. They had an essential equation of who
created the content and who made it wrongful. That's still core Section 230 stuff the way it
was in the 1990s. And then I see the question about who gets to determine bad stuff. You know,
I like to use the general term just to help people get their heads around it, but basically,
the platform does. Because remember, I brought up that example of, like, you have a Facebook post
and somebody posts a comment on it. You know, if they come and they insult your kid, you want to
be able to delete that comment. Whereas if they come and they say your kid is awesome, you want
to be able to leave that comment up. That is sort of the editorial discretion that the First Amendment
protects. Same thing if you extend that. Instead of your own personal Facebook post, it applies
to Facebook as a whole. They get to decide, because essentially, it offends the First Amendment
to have an external government entity force anybody to carry speech. Minor exceptions to this,
if we want to quibble, but they are very minor and they tend to be applied to things that are
not the internet. So no, that's something that does get talked about a lot, where people are like,
wait a minute, who gets to decide this? A private platform is a private platform, whether they're a
large corporation of a lot of people who got together or a single person with their own post,
it's the same equation. And the name of the YouTube competitor who got sued out of existence is,
I don't know, the lawsuit ended up changed to shell, it was Veo Networks. That was the name of
the video system. Veo Networks ceased to be, it is no longer a platform. So now my question is to
Rihanna, what is wrong with the EARN IT Act? Thanks, Kathy. So everything is wrong with the
EARN IT Act. Okay, end of stream. We're done here. We can all go home now. Thanks, everybody. Good
night. No, so to be serious, the EARN IT Act is, I think, one of the most serious challenges
and threats to online privacy, security, and freedom of speech that we have seen come across
the transom in Congress for quite some time. It is one of, as Kathy mentioned, a bumper crop of
anti-230 bills that would aim to narrow or even repeal Section 230 entirely. And sadly, it's also
not the only anti-encryption bill out there right now, as I'll discuss in a moment. Kathy touched
upon SESTA-FOSTA, which created a carve out from the 230 immunity with regard to sex trafficking
offenses. In its current instantiation, the EARN IT Act bill is kind of similar, except instead of
sex trafficking is child sex abuse material. Now, I'll call this CSAM for short. Child sex
abuse material is a pernicious and difficult problem on the internet. It has been around
ever since the days when people were allowed to transmit one file to another through some of the
earliest services that you can think of, many of which I am too young to have used. And it's
something that platforms have struggled with and that they've had to go through evolutions in their
approaches to try and cut down on and prevent. The important thing to understand about CSAM is
that it is illegal on the federal level, on the state level, across the entire planet. It's not
legal anywhere. And as such, it is already subject to federal criminal statutes that impose duties
on providers and platforms to report it and remove it when they learn about it on their services.
That learning about it is important because it is what we would call an actual knowledge
requirement in the law. Platforms are only required to take action about CSAM if they find out about
it. That could be because a user reports it. It could be because they have an automated scanning
service that looks at attachments that are in email or files that are uploaded to a cloud storage
account to try and match against a database of hashes of known CSAM images. When they
find something like this, they are required to report it to the National Center for Missing and
Exploited Children, or NCMEC for short, which is a quasi-NGO, quasi, it's been deemed at this point
to be an agent or an arm of the state, that handles reports of child, excuse me, of CSAM.
Also, you might know NCMEC from the images on the side of milk cartons, the Have You Seen Me
images. But I think at present, they're probably mostly associated with their really difficult
role of having to process these reports that come in from providers. And providers do report CSAM
that they learn about on their services millions of times a year. There's also federal requirements
that say that the Department of Justice is supposed to provide funding for, conduct studies,
conduct reporting with respect to all of these reports that are coming in with respect to trying
to fight and minimize the abuse of children and other crimes against children online. They've been
falling down on the job. They have not been filing their federally mandated reports most of the years
that they have been required to do it over the last decade or so. And I think one of the motivations
for the EARN IT Act bill is to try and point a finger away from DOJ's own shortcomings and away
from how overwhelmed NCMEC is because they do not have the resources, they do not have the personnel
they need in order to take on this task and deploy that platforms instead. And the way that they've
chosen to do that is by taking kind of the, you know, the whipping boy do short, which is Section
230. Right now there's a lot of kind of popular discontent, I think, with Section 230, much of it
ill understood. And so thank you to Kathy for trying to explain a bit better why Section 230 is a
important force online. But by going after Section 230, it enables, I think, the DOJ to try and both
direct attention away from its own shortcomings and also to promote an agenda that has long had
for greater surveillance of online speech, and in particular to go after encryption, which is
an area that I focus on in particular in my role at Stanford. So by curtailing immunity for under
Section 230 for CSAM, there's nothing about that that is not something that DOJ can already do.
Kathy discussed how one of the limitations on 230 immunity is that it already does not bar
enforcement of federal criminal law. You even saw where she noted that child sexual abuse materials
explicitly called out in that particular clause in 230. So it is already the case that if platforms
are not complying with those aforementioned reporting duties when they learn about CSAM
on their services that I mentioned, nothing at all is stopping the Department of Justice
from penalizing those platforms. All Section 230 currently does is to bar state AGs, state
attorneys general, from bringing criminal charges against platforms because Section 230 bars state
criminal law, and it bars private plaintiff lawsuits by individual people with private right
of action because those two are barred by the Section 230 immunity. So we're in a situation
where providers are subject to statutorily mandated duties with respect to CSAM by all
of evidence they are complying with those things, but there's a sense that they should be doing
more. The fact that they are reporting millions of pieces of CSAM a year to NCMEC is taken not
as evidence that they are finding and reporting things, but that they aren't doing enough,
which is a bit curious. So the point of the Grant Act bill in its current instantiation since its
introduction earlier this year kind of doesn't make sense under the name anymore because originally
what the bill would have done would have been to make continued immunity under Section 230
contingent upon compliance by providers with some to-be-determined best practices. If you follow
these best practices, you jump through the hoops, these would be set by an unelected commission of
people headed by the Attorney General, then you could maybe continue to be eligible for continued
Section 230 immunity for CSAM. Otherwise, you might just be sort of thrown to the wolves. That
link between following the best practices set by the commission and continued immunity is taken
out in the current version of ERNIT. Current ERNIT is much more like SESTA-FOSTA in that it abrogates
the immunity full stop. It still has this commission, this 19-member commission, who are
still charged with coming up with best practices for fighting CSAM online and protecting child
safety online. However, those are now just non-binding voluntary recommendations that are
not tied to any particular carrot or any particular stick under the bill. So there's nothing left to
earn. There's no more immunity left to earn. And the ultimate upshot of all of this is because
the removal of the 230 immunity bar opens up potential liability under what could be 50 or
more state and territorial laws that deal with CSAM, there's a lot less certainty for platforms
about what their duties are. Right now, they know what they have to do as specified under the federal
reporting law. But under the ERNIT Act, there could be a variety of state laws that might open
them up to liability for CSAM and to private civil lawsuits and to state AGs going after those
platforms under what could be much lower bars. Going back to what I mentioned about the actual
knowledge requirements under the federal reporting statute, that's a fairly permissive bar for
platforms. It's not that low. Whereas, we know from a survey that a group called NetChoice has
done of state CSAM laws, that some state level CSAM laws impose liability on those who trade or
host or transmit CSAM under a much lower standard, such as negligence or recklessness. So platforms
could easily potentially be held liable for CSAM on their services if they negligently or recklessly
host it, transmit it, allow it to be promoted or presented or distributed, etc., etc.
You might be asking yourself, wait a second, doesn't that just mean the ability to transmit
files? Why, yes, it does. All of the things that we do online, such as talking to each other,
such as sending files to each other, this is what the internet is for, those can also be used in
ways that can lead to the exploitation of children or that can involve the transmission of CSAM
online. So by potentially exposing platforms to liability for negligently or recklessly
transmitting CSAM, they're really potentially exposing platforms to liability for hosting user
contributing content at all, for the ability to transmit files, for the ability to speak online
and speak to other people, some of whom may or may not be over the age of 18. So the chilling
effect of this bill's potential cannot be overstated. We already saw with regard to
FOSTA how it led to the shutdown of large swaths of completely legal speech on the internet.
You may recall that Craigslist immediately shut down its entire personal section.
They also shut down their section that allowed for therapeutic services. So massage therapists
were suddenly out of that part of their livelihood that came from finding clients on Craigslist,
for fear that somewhere in those personals ads, or somewhere in their massage therapy ads,
there might be somebody who was being trafficked and exposed those platforms Craigslist to
liability under SESTA-FOSTA. Here, similarly, we can predict that there would be a similarly
large chilling effect on the ability of people to speak to each other online. Because again,
what if any particular file might sneak through? What if some communication between two users on
the service might be exploitative or enticement between an adult and a minor? These are all
things that platforms are going to be wrestling with in the event the EARN IT Act passes,
because they now may be exposed to liability under 50 or more state laws. So the fact that
there have been some changes that were made to the EARN IT Act don't really fix the core problems
with the bill. When we think about how this bill relates in particular to encryption,
the changes that were made between the early version of the bill and the current version of
the bill were intended to placate concerns somewhat. I'm here to tell you, it doesn't fix it.
There's an amendment offered by Senator Leahy that was intended to protect encryption and take away,
basically restore immunity from suit for the use of encryption, for deploying it in encryption,
for providing device encryption, and so forth. It's not really enough, though, in my opinion.
Both because it does not protect other forms of providing user security and would still allow
lawsuits to arise if somebody who was determined to bring a criminal charge as a state AG or a
private plaintiff were determined to bring a lawsuit. All they'd have to do would be to come
up with some reason for suing, let's say WhatsApp, let's say Signal, that wasn't directly about the
encryption. Any other pretext that they could find or any other security measure that was in use,
even, say, data minimization practices, for example, if that would potentially get in the way
of fighting CSAM, maybe that's something that you use as the basis for trying to make a platform
liable. And on the other hand, I don't think that the way the Leahy amendment that is supposed to
protect encryption is structured would necessarily mean that platforms would be safe from being
pressured or induced into introducing other forms of user surveillance that don't touch the
encryption. One of the moves that we have seen in the encryption debate over the last few years
has been, as we've pushed back against proposals to weaken encryption, to insert mandatory backdoors
into encryption, we have instead seen law enforcement proposals come out that say,
well, how about this other idea? It doesn't involve breaking the encryption at all. And those
include things like the so-called ghost user proposal proposed by GCHQ, the spy agency in
the UK, which would silently add a law enforcement user to an otherwise end-to-end encrypted
conversation while suppressing notifications to the people who are present in the conversation
that this silent ghost law enforcement user has been added. It doesn't touch the encryption,
right? It's still a way of undermining the privacy guarantees and security guarantees
that you expect from using an end-to-end encrypted app. That's just an example of how the Leahy
amendment doesn't really do enough to protect encryption and to keep providers from being
disincentivized to continue offering end-to-end encryption and other security measures to their
users. So I know I get a little head up about these things. It's hard to restrain. I could
talk about this all day. But before I wrap up and we go on to maybe having a bit more of an
actual fireside back and forth, I want to mention, I noted that Section 230 bills aren't the only
threat to our encryption and privacy and online speech rights that are out there. There's another
companion bill that was introduced by the same sponsor, Senator Graham, of the EARN IT Act. He
introduced it just a few days before releasing the amended version of the EARN IT Act a few weeks ago.
It's called the Lawful Access to Encrypted Data Act, or I like to say the L is silent, and it's
the Awful Access to Encrypted Data Act. And that is just a flat-out backdoor bill. It is something
that we have been waiting for, hoping wouldn't come out. Dreading, I think, is the word. Dreading
is absolutely the word. It is really the full frontal nuclear assault on your ability to just
be able to use encryption and move on with your life that we have gotten used to in recent years
as encryption by default has become the norm in the devices that we use and in the apps and
services that we use. So what is so dangerous about the LAED Act, or the Laid Act if you want
to sound a little bit naughty about it, is that it would require basically any sort of larger
provider, anybody who sold a million devices in the United States in a given year, or who has a
million monthly active users in any given month dating back to 2016, so even retroactively,
would have to proactively re-engineer their services to be able to comply with warrants or
other legal process they received from law enforcement to decrypt information that was
encrypted. They'd have to proactively redesign to build a backdoor in. If you are a smaller provider
that's not part of that million plus club, let's say a very small handset maker or the provider
of an end-to-end encrypted app or other encrypted service that does not have a million users,
you still might, you're still covered by this bill because then the Attorney General would be
able to serve a notice on you telling you to re-engineer your service and add that backdoor
into your service, even though you would not be forced to re-engineer it proactively. So this
bill was introduced, as I said, same sponsor, right before the EARNET amendments were made,
clearly intended to make EARNET look more reasonable by comparison and make it look
less like an attack on encryption by comparison because this is an overt rather than covert
attack on encryption. But the lesser of two evils is still evil. Like the EARNET Act is bad
and the LAED Act is worse. It's not as though Congress members have to pick between one or the
other. They could just pick neither and, oh, I don't know, focus on making sure that millions
of Americans don't become fucking homeless, you know, in the next few weeks and, you know, do
something to fix the epidemic that is ravaging this country. Instead, lawmakers have been deciding
to focus on what really matters, which is Google and Facebook are apparently annoying to some
people. Whatever. Go and focus on what really matters, Congress, and start leaving the internet
alone. Leave my right to encrypt alone. So please contact your Congress members. I wrote it down
here. I'm making this very small so that nobody can just, you know, photoshop me and say something
stupid. Know EARNETact.org. That's where you need to go. Call your Congress members. Call your
senators in particular, because the EARNET Act bill has advanced fairly far within the Senate
already. It's already gotten out of the committee in which it was introduced. It passed out
unanimously out of that committee. And there has been efforts just this week by Senator Graham,
its lead sponsor, to try and force it through by what's called unanimous consent so that it would
pass out of the Senate without all of those members of Congress actually having to stand up
there on the floor of the Senate and be seen on C-SPAN voting in favor of this terrible, destructive
bill. So please contact your senators. Contact your House reps, too. And make sure that while
you're at it, you tell them to oppose the Lawful Access to Encrypted Data Act as well. That bill
hasn't gotten as far in the Senate. It hasn't gotten out of committee yet. But it has already
had a companion bill introduced in the House by one of the same people who was behind the SESTA-FOSTA
precursors and is also a threat to online speech. So make sure, tell your senators,
tell your House reps, oppose both of these bills. And now that I can just stop being a little
verklempt, I think we can move on and have this chat. We're not going to completely move on. We're
going to tease out some of the reasons why this is bad. Because I think we need to, the same way
we need to understand how 230 works, I think we need to understand what went wrong and what goes
wrong here. So I think one of the things that's come up is, this is not a small thing. That basic
thing we talked about, about what should Congress want from the internet providers?
Them to help us get the most good stuff and the least bad stuff. And one of the things you talked
about is that it does the exact opposite. You talked about how it will make platforms completely
afraid to remain available to intermediate good content because anything could set off the
liability threat, especially now when we're adding all those different states. So remember that
one of the things I pointed out was there was a preemption clause in section 230 because it would
be a mess if you had 50 different state attorney generals with 50 different opinions about how
things should be, essentially getting to decide what internet policy was. And so you point out
that the internet essentially does away with that preemption and now puts an awful lot of power
among individual state attorney generals to essentially censor the internet and it'll
essentially become a situation of the least common denominator of, you know, that may be great that
49 states are like, yeah, yeah, whatever, be reasonable, it's fine. But if one state is like,
I'm coming to get you if you do something that offends what I've declared to be the policy so
that I can get re-elected next term, that's going to be a problem. And basically the rest of the
United States, their internet experience will get shaped by that single, it's the least common
denominator thing that if one state, you know, wants to have something that's irrational, but
it's on the books, they've got the power now to do it because the section 230 protection goes away.
And when that protection goes away, the choices that platforms make to have the most good stuff
and to minimize the bad stuff goes out the window. You also talked about how it messes
up them being partners and getting rid of the bad stuff, because right now we've already left
because of that carve out for federal criminal law, we've told them, go ahead and, you know,
we want you to get rid of the child porn, get rid of that. Platforms are making an effort to do it,
but now you've sort of created a weird incentive of like, if you look for it, now you might be
in trouble for having found it. So why would a platform now want to look for it? That seems like
it would just be begging for trouble. Why wouldn't they just encrypt everything so that they could
see nothing? And now we mess up your encryption. And yeah, so I mean, let's talk a little bit about
the politics because I think one of the things and one of the reasons why we wanted to do this talk
is because section 230 has become this very hot topic that everybody is banding about
because it's become the easy scapegoat for anything that's wrong online and anything that's
wrong online that's affecting the rest of our world, which is difficult these days for a variety
of reasons. So you have people who have differing agendas, but we're all kind of unhappy these days
and we've now found something to blame. And so you end up with these weird bedfellows of,
Ernact Act is sponsored in part by Senator Graham, who is a Republican, but it's also
equally pushed by Senator Blumenthal, who is a Democrat. How on earth did we get a Republican
and Democrat in this incredibly polarized world to agree that messing up section 230 with this
law is a good idea? How does this have appeal to both parties at the same time? And does that maybe
suggest for each camp that maybe they should rethink it? Because if the thing they want is
making the other side happy, maybe that should cause some concern about what it is they actually
want. I mean, the easy answer there is this is a bill that's supposed to be about child safety.
It's not actually going to help protect children on the internet because if major platforms like
Facebook or like Twitter now know that they are exposed to liability unless they get a lot more
intrusive in terms of the amount of information that they collect from users, in terms of the
surveillance they do of their users, then everybody who is treating in this material on these major
platforms is just going to be forced off and they're going to be using Tor hidden services
and they're going to be on other sites that don't comply with federal CSAM reporting laws because
they exist in order to host this kind of material, don't qualify for section 230 because they are
themselves engaged in violating the law, and don't care. So it's not going to achieve the stated goal
of helping protect children. By the way, this does not provide the sorts of services for housing
stability, for removing children from abusive homes, all the stuff that you could try to do to
prevent abuse from happening in the first place. It's just meant to be another thing of the children
bill. And so it doesn't achieve those goals that it sets out to do. But by being out there as a
bill that's purporting to protect child safety, it makes it much more bicameral friendly in terms of
getting a bipartisan buy-in from each side of the aisle. And it makes it a lot harder for members
of Congress to vote against it, because who wants to be seen as voting against something that helps
the children? Do you hate the children? You must hate the children. Well, it prompts the two
questions. One, this isn't actually going to help them, it's going to hurt them, correct? Right.
Yeah. Okay. So first of all, it's not going to accomplish what it set out to do, just like FOSTA
didn't accomplish what it set out to do. But I think the big problem is, yeah, who wants to vote
against keeping children safe? So if it's got that banner bumper sticker, think of the children,
vote for this, it's a very difficult thing politically to say no to. But that means that
it becomes a really convenient cover for people who have other agendas. Because they've now made
the poison pill that the other side can't say no to. And I mean, that was happening even with
SESTA-FOSTA, where people who had agendas for why they wanted to get Section 230 off the books,
were able to push that. Do you have any thoughts about what some of these agendas are?
I mean, I absolutely agree. And you know, there's an organization of sex workers,
and allies who have been really vocally working against EARN IT ACT, as they did against SESTA-FOSTA
called Hacking and Hustling. And one of the slogans that they use when they are describing
both the impact of SESTA-FOSTA and the likely impact of EARN IT, is that it punishes people
because we want to punish platforms. Not you and I, we, but you know, the general...
We personally, no, we're cool with them. Yeah.
Don't punish people because you want to punish platforms. If the idea is somehow that Google
or Facebook or whoever is too big for their britches, or they're making too much money,
our tax code allows them to make it. Or they're somehow acting above the law, the law permits them
to do everything that they're doing. That's what Section 230 does. Then, you know, you pass a bill
that ends up making it more dangerous for sex workers to be alive, to exist, to work. And that
will make it harder, potentially, to prosecute CSAM traders if this bill passes. I agree with
you that there is an ulterior agenda in each of these cases. And one thing that I thought was
really problematic, in particular, about the use of the EARN IT bill, as what was clearly just a
Trojan horse for trying to ban encryption, or at least strongly discourage it, was that we're
talking about such a wide range of services that would be covered when really we're talking about
a couple of different things. The thing that makes people angry about the way that the internet kind
of sucks is the stuff that's not encrypted. It's the comments that you see on Twitter,
it's the comments you see on YouTube, it's why we have emoji-only chat in our Twitch stream this
weekend. You know, it's the things that are happening in unencrypted spaces, I think,
are largely what motivate people being just kind of sick and tired of what the internet feels like
these days. And yet, the thing that is being attacked by efforts to sort of be a backdoor to
an encryption backdoor mandate is encrypted private communications. It's private spaces.
So it's trying to take this popular anger at something that doesn't have to do with the
private communications that we have in one-on-one spaces and sort of misdirect it. Again, this is
all a big game of misdirection between the DOJ, which I'm convinced largely wrote both of the
bills I'm talking about, especially the second one, to try and push that agenda. And, you know,
I do believe overall that, you know, it would be very difficult. We talk in the encryption debate
sometimes about finding some sort of middle ground proposal or some sort of compromise.
But it seems like the only compromise, the only middle ground is only ever demanded
from the people who have the right and now the ability to protect themselves and to exercise
their rights. It's never a law enforcement offering to give ground. I'm very dubious. I mean, I've been
called an absolutist, but the reason I'm an absolutist is I'm really dubious about that
there's a way to have a compromise. I mean, I pulled up, I did this slide about the Digital
Millennium Copyright Act, which in theory is a type of conditional safe harbor. If you do X, Y,
and Z, okay, then you're not in trouble for your third party content. But it's a mess. It's very
difficult to figure out the conditions. It's very difficult to meet them all. It's not necessarily
realistic. The point I didn't make for that is how much censorship of lawful speech happens because
we've made this, the platform protection so conditional where people send garbage takedown
notices that the platforms really have no choice but to take down, even though the copyright claims
behind them are garbage, sometimes because they're not even really copyright claims at all. But a
platform handling voluminous content with and potentially expensive liability doesn't have the
ability to say no to them. I mean, sometimes they do. But it's rare, because it can't happen all
that often. It's just not practical. So I don't see how we can, this is kind of an all or nothing
thing. And that's why I go back to the, do you want the most good stuff and least bad stuff? I
think there's really only one way to achieve it. And that's by aligning the incentives of
we have more tools in our regulatory tool belt to regulate, it doesn't have to be penalty based.
And somehow I think we're not good at that. I think we don't understand how to regulate effectively by
making parties partners, where acting consistent with their own interests happens to get them to
do what we want. The reason the internet sprouted and did so well in 20 years is because that's how
we regulated because that's how we made it work. And that's how we went from basically no internet
to an awesome internet. I mean, it's got wrinkles, but you can connect the whole world, we can
connect like an infinite amount of knowledge and ideas and make connections. By and large,
it is incredibly awesome. Maybe part of the problem we have is that, you know, if you've
got 7 billion people on, you know, connected to each other, some of them suck, some of them are
not good people, some of them say terrible things. And when these terrible things happen, we become
hyper aware of them, because a we now can be aware of them, because the internet is providing us with
that information. And they end up with this outsized effect, like, oh, my gosh, I can't
believe what that person did. And we're upset about it. And we look at what existed that allowed the
bad thing to happen. Well, that was the internet. And the internet got to exist because of Section
230. So therefore, 230 is bad, let's get rid of it. And it's really hard to sort of call time out
to reasonable people and say, hang on, maybe that's not the best way to think about it. Although,
that's why we're doing presentations like this, to kind of walk people through the thinking,
so that they understand that, like, no, this is really important and really valuable.
And maybe the things that are going wrong are things that we should target our regulation
to. That if we're upset about something, let's carefully define the problem and come up with an
appropriate solution that helps, you know, fix the thing that's wrong without just taking away the
whole thing that's created the internet, good things and bad things, because now we won't have
the internet at all. Right. Human terribleness has been around since well before there was an
internet. People have been terrible for as long as they have been people. Nevertheless, I like
your point about how we tend to sort of focus on the bad parts without thinking about the vast
majority of perfectly fine content. The same is true of encryption. You know, I feel that
the focus on the use of encryption to to commit crimes or to hide evidence of crimes gets blown
all out of proportion compared to how rare the instance of crime really is when you compare it
to the fact that more than one out of seven humans on this planet use WhatsApp. One billion
people aren't criminals. Right. So most of the usages, most of the people using encrypted apps,
most of the people using encrypted devices, which at this point is basically everybody,
just by default, most of that is not for crime. And so we lose sight of placing these things into
context and thinking in more big picture about what the cost benefit analysis is of trying to
increase surveillance and reduce free speech rights for everybody through bills like this.
I want to make sure we get to some of the questions that have been coming in. We have maybe
about five or ten minutes left to take questions. I know we've run over a little bit, but it's the
end of the day. There's no rules. Well, wait till Congress gets at it. But OK, so I think some of
these questions now, some of them are sort of technical to 30 questions. I almost can globally
say, yes, 230 totally applies, although, yeah, if we can get to them, we'll be more specific.
Actually, the most interesting one is one that I've been putting forth. And since I'm a speaker,
I can say that somebody asked a question about 230 and Amazon. One of the things that's starting
to happen is some of Internet services have started to look more like actions than speech,
because people sell things on Amazon. And is that a different sort of activity?
And I've argued in briefs before courts that basically it still boils down to speech,
that if you're on Airbnb, what you're really saying is, I have an apartment to rent.
That may be the only thing you're really saying on Airbnb, because it's a very hyper-focused
platform. But again, that whole slide about 230 is kind of general in its application,
and it applies to a whole bunch of things. It can apply to Amazon when you regard that
a third-party seller is really a seller saying, I have a thing to sell. And that when we start
imposing liability for attacks to the sale, that ripples through and affects every platform that
hosts every type of expression, because there's no real contingency of whether 230 applies to
a broad-based platform that takes all sorts of speech, or a narrow-focused platform that
takes very specific, I'm only selling this kind of thing type of speech. So that's a lot of the
230 things. On the EARNET side, people are asking, and maybe this is the way to phrase the question,
if EARNET passes, what happens? Does signal go offshore? Does something go offshore? Does the
internet die? I mean, it kind of died. Well, it didn't completely die with FOSTA, except it really
took a very severe hit, and so did an awful lot of the users who used it. Like, that body count of
sex workers is significant and real. So let me ask you, what happens if EARNET passes?
If EARNET passes, I think we will immediately see even more shutdowns of portions of services,
or even maybe entire services, just as we saw immediately the moment SESTA-FOSTA was signed
into law. I think we'll see a lot of litigation, including over this encryption safe harbor that
Senator Leahy tried to insert in. It basically creates kind of a license to litigate,
where because it is narrowing what should be a broad immunity, and which already takes quite
a lot of litigation often to just get to the point of saying, no, Section 230 bars this lawsuit and
kicking it out of court. I think we'll see a lot of litigation over whether a lawsuit is trying to
hold a platform accountable for CSAM on its service on the basis of encryption or some other
thing. If it's encryption, then the lawsuit is barred. If it's some other pretextual reason
that the plaintiff or the state AG can come up with, then it's not going to be barred.
So we'll see platforms drawn into quite a lot of litigation, and that's for the ones that
dare to continue providing any kind of functionality for user-generated content at all. I think we may
see small platforms start to shut down. It's true that Signal has threatened to go offshore
and move to another jurisdiction. This is one of the limitations with this bill.
I don't know how it could possibly purport to touch open source tools. Most of the encrypted
tools out there are either open source or housed overseas outside of U.S. jurisdiction. So these
tools would still be available, and those who want to use encrypted tools for bad acts would
flock to using them. There's another question in the stream about that. But the people who are
just everyday average users probably won't take the time to seek out services that have not been
intentionally weakened in order to try and avoid the specter of liability that EARNET would raise,
in the event that that is in fact what platforms do. I think we'll see a difference between the
response, as you were talking about earlier, between the large well-resourced platforms
that can handle the deep pockets needed to face this kind of litigation and try to make that
calculation that they would rather protect their users and continue keeping these kinds of security
protections in place and just deal with, you know, paying for the stuff that they don't catch.
And we might see smaller services either shutting down or, as mentioned, potentially offshoring.
So we'll see. But all the uncertainty that that opens up is just another reason to, like, keep
fighting against this bill, because everything about the world is uncertain right now. I would
like to know that, like, my ability to just use my phone and use whatever you signal is still certain.
So I think this boils down to that, you know, understand how the law works and the basic
mechanics of it. That's how 230 works. And then definitely understand how the statute
messes with that. I think it boils down to also, like, I asked the question about, like, what is
the political motivation behind some of these things? And to the extent that there's genuine
displeasure with some of the larger internet companies, the point you're making also is that
they'll probably be able to survive. But if one of the things we really want to have, like,
if we don't like Google, we really need a new Google. And this is not going to help us get a
new Google. This is going to help us double down and entrench the Google with everything we don't
like about it doubled down. So it doesn't actually solve any of our problems. And I think the thing
is, like, the internet might limp along, it's pretty great. But I mean, to the extent that
the internet facilitates human speech among 7 billion of us, that's a great thing. And when
we take that away, I think we will miss it greatly. And so I think our final thought is,
we need to be a lot more careful. We can't do legislation based on convenient bumper stickers.
We really have to understand very carefully the dynamics of how law works, how human beings work,
and how we start driving behavior when we start imposing punishments or even just uncertainty
on people who are talking, expressing themselves, or facilitating that expression.
Any other final thoughts? Yeah, I mean, just to say again, like, please take action,
please call your senators, take action against both of these bills. There's a question about
whether this would be bad for the US economy. I think the other bill, the LAED bill is a greater
threat to the economy on the basis of a similar bill having been passed in Australia a couple
of years ago that has really helped to screw up their tech economy sector there. So I think we
would see, yes, a negative impact from the LAED Act, but also from EARNET, because of the lesser
amount of vibrant services that we'd be able to see online. So anyway, I could rant about this all
day. I can rant about 230, my favorite thing. I mean, I want people to understand it. I want,
you know, right now, there's an awful lot of people with an awful lot of agendas saying,
Section 230 bad. And I think the general populace is like, I don't understand. Yeah, that sounds
good to me. I want everybody who's listening to be somebody who says, Aha, maybe that's not good.
Maybe I should really rethink that. And to start, I think if people really understood what is being
threatened by this legislation, they would not be for it. But I, you know, laws is kind of scary
and complex system. And you leave it to other people to do that thinking for you. But I think,
is make it that you can understand the mechanics of how this works, to draw an opinion. And I think
that opinion will be that this is not a good idea. It's just that it's not always intuitive
to understand this dynamic. How does the law work? Why do things respond to it? So hopefully,
we can demystify it. And there's an awful lot of advocates out there, me, Rihanna, EFF, other
organizations who, you know, are happy to sort of answer questions and help sort of make people
understand what's really at stake with any of these bills. So I think that actually brings us
to an end. Thank you so much, Village, for having us. And thank you, Rihanna, for doing this with
me. I think this was great. And hopefully everybody watching thinks so. Great, thank you so very much
to both of you. It was a pleasure to wrap up our very first day with you both. And so thank you,
again, for speaking at the Village. Folks, this is the end of the day for us. We have survived
day one of Virtual Crypto and Privacy Village, which frankly took more years off of my life
than maybe all of 2020. No, I'm just kidding. But I will say, like an influencer, because I've never
really streamed, if you like and subscribe below, we have various different avenues that you can
communicate with us, reach out to us, engage with us. Since we can't be with all of you in person
this year, please feel free to reach out to us on Twitter. For volunteers, I'm reaching out to you
about a happy hour tonight. And to all of our speakers, thank you, thank you so much again.
And if I haven't said this enough, thank you so much to everyone else who makes the Crypto and
Privacy Village possible. There are a ton of folks who spend a lot of time, who have done
so much work for the Crypto and Privacy Village this year to make it happen as we shifted gears
from going live to going virtual. I could list all of their names now, but I'll save that for
another time when I get to host and see you all again. So I'm going to transition and hopefully
not break OBS because I'm doing both. So let's see if we can go to something that is a little more
on five. Thank you, everyone, and I'll see you soon.