Twenty-five years ago, the technology industry was at a crossroads that could have led to a very different world than the one we see today. The Clinton administration was pressuring the industry to install the “Clipper chip” in all communication devices. This system would have given law enforcement authorities a backdoor to bypass encryption whenever they felt the need. The proposal would have put American technology companies at a disadvantage, because foreign products without backdoors would have been much more attractive to the market. It is likely that e‑commerce would not have taken off as it has, and that Google, Apple, and Facebook would not be the giants they are today. In general, without strong encryption, the unprecedented growth across the spectrum of sectors where the internet is applied would not have been possible.
The proposal disappeared after several years of intense discussion, but the idea resurfaced in the spotlight again recently. It started in the spring of 2019 when Facebook announced its plans to extend end-to-end encryption by default, which already exists on WhatsApp, to all its platforms. In June, Attorney General William Barr argued that advanced encryption hinders criminal investigations and urged «legal access» to consumer devices.
The Justice Department stepped up its crackdown on encryption in October. Barr has pushed for legal access to encrypted communications to combat terrorism, organized crime and the distribution of child sexual abuse images. Senior officials from the United States, the United Kingdom and Australia sent an open letter asking Facebook to either create a way for law enforcement to decrypt encrypted messages or not expand message. Facebook was not convinced. Last December, Facebook said it would not provide “backend access,” which it said could also be used by hackers.
When Facebook refused, Congress changed its tune. On March 5, Senator Lindsey Graham introduced the EARN IT Act, which is reportedly designed to curb online child exploitation. It would remove the liability shield under Section 230 of the Communications Decency Act that protects Facebook and other platforms from being sued for things their users post. It would require companies to earn immunity from liability by following best practices for identifying, reporting, and removing child exploitation content as set forth by a government commission and by taking “reasonable steps” to comply with the law. While there is no mention of best practices or reasonable steps, it’s a good bet that they would include the ability to decrypt encrypted communications.
This is clearly a blow to encryption, disguised as an effort to curb online child pornography. The Washington Post found in a recent survey that many privacy and security experts oppose it. Privacy advocates have denounced the bill as a wolf in sheep’s clothing.
Another aspect of this approach requires our attention. Regardless of how serious child pornography is, it is one of the rare forms of speech that violates the law. The mechanisms developed to suppress one form of speech can also be applied to suppress others. The penetration of encryption for suppressing child pornography will be applied by authoritarian governments to suppress other discussions.
The EARN It law could be used to create an encryption backdoor that would undermine people's privacy on the internet and would put people at risk of unjustified surveillance by oppressive governments. It would undermine the use of secure messaging applications and other software – which is supported by the US – by dissenters, journalists and individuals in authoritarian regimes.
An encryption backdoor would create other problems. If government-held decryption keys were available to criminals, terrorists, or foreign governments, the consequences would be far greater than the damage caused by data breaches.
The backdoor is not necessary, the internet is not «dark», as it was 25 years ago. The ability of law enforcement to map communication patterns, which are difficult to hide through encryption.
At this point we need better data protection for citizens and industry in view of the growing threats from nation‑states to critical infrastructure, elections, human rights and political freedoms.
