The EARN IT Bill Is the Government’s Plan to Scan Every Message Online
eff.org
eff.org
The draft of this bill is currently lacking decent limits.
EARN IT doesn't let the government scan every message (just like right now your non e2e encrypted data says isn't subject to mass scanning by government, but guarded by a warrant or your hosting provider's government bootlickiness), but merely (as the article admits) doesn't prevent the government from passing such a law in the future.
That's not consistent with my understanding of XKeyscore.
I mean, do you really think that a military intelligence agency operates under domestic law? And from what I've read, need to know structure within the NSA doesn't map to command/reporting structure. So there may be components that operate ~independently as deep backup.
For starters, it feels like an appeal to authority. I don't think Pulitzer gets to decide who is credible, as they possibly (likely?) have an agenda like anyone else.
Second, I'm not sure how many hundreds of Pulitzer prizes have been given out over the years, but I surely don't blindly trust every source that has every been awarded one.
Third, receiving a Pulitzer price for one story/investigation, doesn't mean that all the stories written by your dozens of other reporters also become credible.
It’s legit to be worried about the legislation, particularly considering the sponsor.
The bill creates a group of anti-E2E-encryption folks with the power to smack down an online company when it suits them, who won't need congressional approval when deciding what the rules are. We know the rules they want are incompatible with E2E encryption.
It is possible they surprise us with E2E-encryption-friendly rules. Was that your point? Possible, sure.
Expert opinions about the effect of adding backdoors/ending encryptiin on safety won't matter to them.
> The so-called EARN IT bill, sponsored by Senators Lindsey Graham (R-SC) and Richard Blumenthal (D-CT), will strip Section 230 protections away from any website that doesn’t follow a list of “best practices,” meaning those sites can be sued into bankruptcy. The “best practices” list will be created by a government commission, headed by Attorney General Barr, who has made it very clear he would like to ban encryption, and guarantee law enforcement “legal access” to any digital message.
If that's accurate, I don't believe that EFF is overstating at all.
However, none of this particularly frightens me. That's because I assume that any communication where I don't manually encrypt stuff locally, using well-vetted open-source software, is vulnerable. And I also assume that any entity that operates openly, and is vulnerable to legal, criminal or financial pressure, cannot be trusted at all.
So if all this authoritarian bullshit comes to pass, everyone who uses vulnerable tools will be pwned. That's sad, and perhaps it'll be worse than now, but there's arguably no reliable way to know if so, and by how much.
More importantly, there'll be an opportunity to move more online activity and communications to truly secure channels, which are far less vulnerable to compromise. You could consider that an expansion of criminal enterprise, but that's how things work.
There are some signs that the Tor Project is getting with the program. And there is actually a new onion-routing network, Loki, which looks promising. I've been using their messaging app, Session, and it's quite usable on Linux and (I gather) Android. Perhaps I2P will attract more users too.
I can bet they'll also have rules along the lines of "services will scan their own non-encrypted messages to make sure no encryption is being done by the user", so you'd likely be legally liable, or at least liable to being banned by the service.
And as I said, I'd just avoid services that were vulnerable to coercion.
If it gets to the point that all ISPs block anything that's encrypted, then most everyone will be screwed. However, that'd be hard to implement without creating opportunities for private pwnage.
And as a deep backup, there's always encryption via covert channels. You can only hide maybe 0.1%-1% of throughput, but that's enough for text hidden in video or whatever.
And re banning, I can create as many new personas as I need.