New legislation has encrypted apps and civil rights groups terrified

Signal, a popular encrypted messaging app, is threatening to shut down in the United States if a controversial piece of legislation becomes law.

The legislation -- known as the EARN IT act is moving its way through Congress with bipartisan support -- would threaten the app's sheer existence due to what it deems overly burdensome oversight.

"COVID-19 has us sheltering in place, but we cannot quarantine our concerns,” says Joshua Lund, a programmer for Signal Messenger, which is funded by the non-profit Signal Foundation, in a blog post on April 8.The result may be that “it would not be possible for a small nonprofit like Signal to continue to operate within the United States.”

Lund notes that “over the past few weeks,” as the Covid-19 pandemic has made its presence felt from America to Australia, “Signal traffic has gone through the roof. New users are signing up at unprecedented rates, and we’ve expanded our server capacity faster than we ever anticipated.”

Inverse has sent Signal inquiry asking for specifics, but the company has not responded.

The bill’s proponents in Congress think that Signal, and its allies, are seeking a fight where none exists.

The most influential Internet regulation could change

The EARN IT Act seeks to alter the relationship between tech companies and an influential segment of the Communications Decency Act known as Section 230.

Law since 1996, Section 230 states that “no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”

In other words, a website like Facebook or a messaging platform like Signal is not responsible for what its users post.

Both its critics and its defenders agree that Section 230 is responsible for much of our current social media ecosystem.

Section 230 helped usher in a system where users can upload the content they want without a second thought, and it is up to the companies hosting them to moderate under “Good Samaritan” policies.

"It urges companies to filter and to block offensive content," Danielle Citron, a law professor at the University of Maryland and author of the book Hate Crimes in Cyberspace, told Wired in 2018. "Congress wanted to let companies filter dirty words and shield kids, without being held responsible for doing it incompletely. The idea that 230 requires neutrality is to fundamentally misunderstand it."

The EARN IT act would fundamentally change Section 230. The name makes it clear: tech companies would no longer have the immunity they currently enjoy, but would have to “earn” a certification allowing them to take full advantage of Section 230, showing that they would following with best practices in detecting and reporting child sexual exploitation materials to law enforcement.

“This bill says nothing about encryption,” Senator Richard Blumenthal, a Democrat from Connecticut who co-sponsored the legislation, said at a hearing in March. “End-to-end encryption must be able to exist with robust law enforcement and I’m not going to support anything that does not protect the integrity of encryption for users, I can promise you that,” said Republican Sen. Josh Hawley of Missouri, a co-sponsor.

What would those changes mean?

And that’s where the agreements between proponents and opponents start to fray.

In his blog post, Lund belittles the best practices that EARN IT would demand as “designed-by-committee” and warns that they are “extraordinarily unlikely to allow end-to-end encryption,” which Signal currently guarantees its users. Even if Senator Blumenthal and Senator Hawly don’t want to target end-to-end encryption, Lund writes, Attorney General Bill Barr has expressed concerns about the technology, and he would be an “arbiter of any recommendations from the “best practices” commission that the EARN IT bill would create.”

The EARN IT Act would create a 19-person panel to decide these best practices, one seat of which would be permanently reserved for the Attorney General. Four seats would be reserved for representatives of tech companies, although the legislation does not stipulate the size of these companies.

While there have been changes made to the panel since the bill's introduction, but Kate Ruane, Senior Legislative Counsel of the ACLU, tells Inverse that she is "still pretty concerned with the structure of the commission...there have been changes to the Attorney General's broad authority over the eventual best practices, but still, the Attorney General has enhanced authority to approve or disapprove the best practices. And given the current Attorney General's support for encryption backdoors, that in and of itself is concerning."

Ruane goes on to point that while the expanded commission will have input from tech companies, it will "not have any input from impacted communities, such as the sex worker community or the LGBTQ community."

Critics compare it to FOSTA-SESTA, the 2018 law that also cited child sex trafficking for encroaching on websites, and has been criticized by the ACLU and others for its potential harm to sex workers. But Ruane thinks EARN IT "is more concerning that SESTA and FOSTA...this will deal with an even broader swath of content than child sexual abuse material, which is a grave concern, and we should be finding ways to adequately address. These best practices will go far beyond that: there will be best practices relating to any potential interaction with youth. There will be best practices relating to age-gating and age-rating, which has nothing to do with any illegal content."

The Inverse Analysis

It's unclear how the legislation will ultimately play out. FOSTA-SESTA passed, after all. But that legislation had the support of major industry players like Facebook, while they oppose EARN IT. Time will tell if that switch will be enough to sway Congress.