Senate panel advances bill to combat child exploitation, but critics fear it could weaken encryption

Changes to the bill weren't enough to satisfy critics.

The Senate Judiciary Committee on Thursday unanimously advanced a bill that would combat child pornography, but which technologists say risks weakening encryption for average internet users by exposing tech companies to lawsuits.

The Eliminating Abusive and Rampant Neglect of Interactive Technologies Act (EARN IT Act) would remove liability protections for companies like Facebook when users share child pornography on their platforms. The bill is the latest front in a long-running struggle between lawmakers who see end-to-end encryption as shielding criminality, and civil liberties advocates and technologists who say weakening encryption could make swaths of the internet less secure.

Lawmakers responded to criticism of earlier versions of the bill by making the standards that tech companies have to meet to receive liability protection voluntary. The bill also now states that tech providers won’t be targeted under federal law simply for providing encryption technology, thanks to an amendment from Sen. Patrick Leahy, D-Vt.

“I’m not trying to stop companies from encrypting their products,” Sen. Lindsey Graham, R-S.C., the committee’s chairman, said during a hearing Thursday. “I am trying to make them harden their products against sexual exploitation by child predators.”

But critics say the latest version of the bill, with its overly broad language, could expose technology providers to a raft of lawsuits at the state level. The nonprofit Center for Democracy & Technology charged that a “consistent threat of litigation….will be a strong disincentive against providing [end-to-end encryption] and continuing to have to defend that decision in court.”

The Internet Association, a trade group that includes Facebook, Google and Microsoft, said the bill “[o]pens the door to an unpredictable and inconsistent set of standards under state laws that pose many of the same risks to strong encryption.”

Joseph Lorenzo Hall, a senior vice president at the nonprofit Internet Society, called Leahy’s amendment “a fig leaf of protection for strong encryption.” The bill, he added, leaves “people to fight it out in court, which is far from cementing protection and clarity for encryption, the bedrock of our lives on the internet and in the real world.”

For years, across Democratic and Republican administrations, law enforcement officials have said that encryption has hindered criminal and terrorism investigations. They have also, however, sometimes used hacking tools to access encrypted data on devices. In May, Attorney General William Barr said FBI technicians had cracked the iPhones of the perpetrator of a terrorist attack at a U.S. Naval base. Barr sharply criticized Apple for not unlocking the devices.

Legislative push for child online safety runs afoul of encryption advocates (again)

The Stop CSAM Act would compel companies to curb online child sexual abuse material, but critics argue it would also weaken encrypted services for all users.

Return of the EARN IT Act rekindles encryption debate at critical moment for privacy-protecting apps

EARN IT Act gets no changes to encryption language in Senate committee

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure