Digital rights groups sound alarm on Stop CSAM Act

The organizations say a reintroduced version of the bill would “break” encryption for most Americans and make it impossible for end-to-end encrypted service providers to avoid lawsuits.

Digital rights groups are urging Senate leaders not to move forward with a bill that would impose new regulations on companies around child sexual abuse material, arguing that the legislation could be a privacy nightmare for Americans.

In a letter addressed to Senate Judiciary Committee leaders Sens. Chuck Grassley, R-Iowa, and Dick Durbin, D-Ill., the groups – which include the American Civil Liberties Union, Freedom of the Press Foundation, Defending Rights and Dissent and RootsAction – say the STOP CSAM Act, reintroduced in May, “walks back a number of important privacy protections that had been included in a previous version of the bill.”

“The current bill creates enormous incentives for platforms to stop offering encrypted services that are critical for enabling all of us to have private conversations and securely store files from our most personal moments, like photos from a child’s birthday,” the letter reads.. “While all of our groups want to stop the harmful transmission of child sexual abuse material (CSAM), its transmission is already illegal, and these modifications to the bill do nothing more than undermine privacy and security.”

The Stop CSAM Act would impose new requirements on companies to prevent the hosting and distribution of child sexual abuse material on their platforms.

It expands companies’ legal obligations by requiring them to report instances of such material on their sites to the National Center for Missing and Exploited Children.  It also introduces stricter privacy protections for children who testify in court. Additionally, and would require businesses with more than 1 million unique monthly visitors or users or $50 million in annual revenue to submit annual reports to the Federal Trade Commission and Department of Justice.

It would also seek to alter immunity under Section 230 of the Communications Decency Act for “interactive computer services,” allowing victims to file civil lawsuits against companies that fail to remove CSAM content from their platforms in a timely fashion.

The bill includes language specifying that “any person who is a victim of the intentional, knowing, or reckless hosting or storing of child pornography or making child pornography available to any person by a provider of an interactive computer service, and who suffers personal injury as a result of such hosting, storing, or making available, regardless of when the injury occurred, may bring a civil action.”

Digital rights groups say that the new version of the legislation includes “recklessness” as a legal standard for liability and by applying it to any “interactive computer service,” the legislation would capture virtually all applications that rely on end-to-end encryption.

That in turn could open up providers of these services to civil lawsuits for hosting material that they can’t view without breaking the encryption of their users.

“[The bill] goes much further than current law and threatens to punish any service that works to keep its users secure, including those that do their best to eliminate and report CSAM,” wrote India McKinney of the Electronic Frontier Foundation. “The bill applies to ‘interactive computer services,’ which broadly includes private messaging and email apps, social media platforms, cloud storage providers, and many other internet intermediaries and online service providers.”

The letter to Grassley and Durbin emphasizes that private communications – underpinned by strong digital encryption – are critical to healthy, functioning democratic societies and have many benefits to marginalized or targeted populations.

“That is why encrypted services are popular amongst journalists who use encrypted messages to contact their sources, protesters seeking to organize to raise their voices against unjust government action, doctors who use it to speak with patients, domestic violence victims who rely on completely private communications to escape dangerous situations at home, and businesses discussing finances with clients,” the letter reads. “But there would also be severe consequences for groups that are being targeted by governments domestically and globally.”

Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Elon Musk claimed he was aware of “literally zero” CSAM content created through Grok. A new lawsuit from thousands of real victims say the model was trained…

Senate set to debate package of bills on privacy, AI and kids safety 

764 splinter group leader sentenced to 40 years in jail

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems