US to hold tech firms accountable for spread of child sex abuse imagery

The two measures are the latest in a series of initiatives aimed at combating online child exploitation. Photo / 123RF

Legislation announced Thursday in the US aimed at curbing the spread of online child sexual abuse imagery would take the extraordinary step of removing legal protections for tech companies that fail to police the illegal content. A separate, international initiative that was also announced takes a softer approach, getting the industry to voluntarily embrace standards for combating the material.

The two measures come as tech companies continue to detect an explosion of abusive content on their platforms, and amid complaints that neither Congress nor the companies have been aggressive enough in stopping its spread. An investigation last year by The New York Times found that many companies knew about the problem but failed to quash it, despite having the tools to do so, and that the federal government had not been adequately enforcing a previous law meant to stem the abuse.

Multiple US agencies, together with the governments of Britain, Canada, Australia and New Zealand, released a set of voluntary guidelines on how platforms can stop the spread of online child sexual abuse material, commonly referred to as child pornography. Those recommendations were developed in conjunction with a half a dozen tech companies: Facebook, Google, Microsoft, Roblox, Snap and Twitter.

The bipartisan legislation likewise calls for industry standards and creates a strong incentive for companies to adopt them. The bill's sponsors, Senators Lindsey Graham and Richard Blumenthal, said it was spurred by The Times investigation. Graham is a Republican and Blumenthal a Democrat.

Despite some strong support, the bill faces opposition not only from the tech industry, which considers the changes too broad and a threat to its offering services like encryption, but also from some victim advocates who view it as too narrow an approach to combating harms online.

Last year, tech companies reported nearly 70 million images and videos related to online child exploitation. They are obligated to report the material when they become aware of it on their platforms, but they are not required to go looking for it. Companies are generally not responsible for content uploaded by their users because of a 1990s-era provision in the law known as Section 230. It is formally section 230 of the Communications Decency Act.

The new bill, called the EARN IT Act, would carve out an exception to that rule. Companies that do not follow the recommended standards would lose civil liability protections for that type of content. The legislation would also lower the bar for suing those tech firms.

The bill would create a 19-member commission — including members representing law enforcement, the tech industry and child advocates — to recommend a set of strategies: for instance, how to spot illegal material, categorise it in standardised ways and verify users' ages. These practices would be subject to approval by the Justice Department and other agencies, as well as Congress and the president.

In an interview, Blumenthal said the bill reflected the ideas that tech was no longer the fragile sector it was in the 1990s and that the public would benefit from reasonable rules of the road.

"The industry received this sweetheart deal when they were in their infancy struggling to stay alive, and now they are these behemoths that have incredible impact on the lives of ordinary people," he said. "They have an obligation to the most vulnerable among us, mostly children who are criminally and cruelly abused, to take some action."

Graham said in a statement that it was vital to "put some guardrails on tech companies," while recognising the benefits the industry had brought.

"Our goal," Graham said, "is to do this in a balanced way that doesn't overly inhibit innovation but forcibly deals with child exploitation."

In November, as they were drafting the bill, a group of senators including Graham and Blumenthal asked 36 tech companies to provide details on their efforts to combat child exploitation. Blumenthal said he was surprised to learn that some of the most well-resourced companies, including Amazon, had not adopted even basic countermeasures.

Yiota Souras, general counsel of the National Center for Missing and Exploited Children, the federally designated clearinghouse for child sexual abuse reports, which supports the bill, said the recommendations would raise the bar for tech companies.

"We, among everyone else, have witnessed the deficiencies that inconsistent practices in detecting, reporting and removing this material cause," Souras said.

The broad application of Section 230 is widely credited with allowing the modern internet to flourish. But some experts say that the law's effectiveness stems from its simplicity and that carving out exceptions for certain types of content, as the bill does, will cause concerns.

"This won't be an easy bill to pass," said Paul Gallant, a technology policy analyst at Cowen, a financial services firm in Washington. "Everyone in Congress supports reducing child exploitation, but there's a broad recognition that these platforms and the American economy have benefited tremendously from lack of liability over user content."

Yet the bill's bipartisan support from two prominent senators does make it stand out, he said. "With Graham and Blumenthal leading the charge, it's as well positioned as I could imagine."

Elizabeth Banker, deputy general counsel at the Internet Association, a lobbying group whose members include Amazon, Facebook and Google, said Section 230 had benefited the industry by heading off litigation costs that could have hampered tech companies' ability to host and moderate user content.

The group currently opposes the bill.

"We have very strong concerns," said Michael Bloom, a senior vice president of the group, "that the EARN IT Act as introduced may impede existing industry efforts" to combat abuses online.

Some feel that a narrow exemption for child exploitation doesn't go far enough and leaves out an array of other harmful online behavior, including terrorist content, defamation and the nonconsensual sharing of nude images, or "revenge porn".

"It's essentially saying there are some harms that we actually do take seriously and others that we don't," said Mary Anne Franks, professor at the University of Miami School of Law and president of the Cyber Civil Rights Initiative, a non-profit group dedicated to combating online abuse.

Previous leaked drafts of the bill prompted concern within the tech industry and among some privacy experts that the commission's recommendations could prevent companies from offering encrypted services.

The American Civil Liberties Union and the conservative advocacy group Americans for Prosperity jointly opposed the bill on Thursday, cautioning that it could be used to outlaw encryption.

Encryption would greatly reduce a company's ability to detect the illegal activity and has become a flashpoint in light of Facebook's decision to soon encrypt its Messenger app, which is responsible for millions of reports a year.

Blumenthal said that the commission was specifically designed to include voices from the tech industry with experience in cryptography and information security.

"We have leaned over backward to make sure they are represented," he said.

The two measures are the latest in a series of initiatives aimed at combating online child exploitation, including a more-stringent reporting process for tech companies, calls for increased law enforcement funding and a review of the federal government's response to the problem.

The voluntary guidelines announced Thursday were described by Attorney General William Barr as a "historic event" in the fight against "one of the most horrendous crimes impacting some of the most vulnerable members of society." They have been in development since July, when representatives from the five countries met with the six tech companies. The guidelines aim to tackle not only illegal images but also more complex threats such as livestreaming and grooming. The WeProtect Global Alliance, a child protection organisation with ties to the British government, will work with the six tech companies involved in the initiative to encourage adoption of the guidelines throughout the industry.

"We must ensure these 'voluntary principles' don't remain just that," said WeProtect's founder, Baroness Joanna Shield.

In Washington, The EARN IT Act's sponsors are hopeful that they can bring quick action on the bill; a hearing in the Senate Judiciary Committee is scheduled for next week.

"I don't want to look around 14 years from now and say, 'We could have stopped the abject destruction of the lives of children,' " Blumenthal said. "If we're going to come together on anything, it ought to be protecting our most vulnerable against these heinously brutal criminal practices."