Two Washington-based tech policy think tanks lashed out Friday against a new encryption draft bill from Senate Intelligence Committee leaders Richard Burr (R-N.C.) and Dianne Feinstein (D-Calif.), warning it would harm tech companies.
Meanwhile, a key House Democrat said lawmakers should opt for a negotiated solution.
Sen. Ron Wyden (D-Ore.), a staunch privacy advocate, said in a Tweet that the bill would require tech companies to “decide how to weaken their products to make you less safe.” Through a spokesman, he vowed to fight it.
The long-awaited encryption bill from Burr and Feinstein surfaced late Thursday night. The measure in its current version would require entities — tech companies, internet service providers, etc. — that receive a government request for data to provide it or give officers the necessary technical assistance to get to that data. The legislation would mandate that those entities get reimbursed for the cost of that assistance.
The Open Technology Institute, a left-leaning advocacy group in Washington, said the public release of the bill “would be embarrassing if it wasn’t so frightening.”
Kevin Bankston, OTI’s director, called the draft measure “the most ludicrous, dangerous, technically illiterate tech policy proposal of the 21st century so far.”
Bankston said the legislation could lead to the weakening of encrypted systems that also protect people’s data against bad actors. It also could damage the American tech sector competitively because foreign companies would be able to offer encrypted services that terrorists, thieves and spies could use.
OTI isn’t alone in its concerns. The Information Technology and Innovation Foundation, a more moderate business-oriented group, criticized the draft by arguing that it puts “an unqualified demand on companies to decrypt their customers’ data upon receiving a court order from law enforcement.”
ITIF Vice President Daniel Castro said that what the bill demands often isn’t technically possible. “While companies should comply with lawful requests, it is simply not possible for a company to do so when the customer controls the only keys used to encrypt the data,” Castro said in a statement. “For example, the popular messaging app WhatsApp, which provides end-to-end encryption on its platform, would not be able to comply with the legislation, unless it modified its system.”
Castro said the legislation would create a “legal paradox that would further muddy the waters about how and when the government can compel the private sector to assist in gaining access to private information.”
The American Civil Liberties Union also weighed in with a statement from legislative counsel Neema Singh Guliani that the measure “ignores economic, security, and technical reality. It would force companies to deliberately weaken the security of their products by providing backdoors into the devices and services that everyone relies on.”
The measure faces an uphill battle in Congress, particularly now that federal investigators have backed off their court-ordered request for assistance breaking into an iPhone used by one of the San Bernardino shooters. Bankston came close to mocking Burr and Feinstein for their continued efforts in the wake of opposition.
“Considering that the White House reportedly won’t endorse this bill, the Senate Majority Leader seems uninterested in moving it, the House of Representatives would never pass anything like it, and the internet community will oppose it with everything it’s got, this bill might as well be named the DOA Act, because it is certainly dead-on-arrival as currently written,” he said.
House Intelligence Committee ranking member Rep. Adam Schiff (D-Calif.) said Friday that he thinks the encryption debate is too important to be left to the U.S. courts, and that a path forward should be decided in Congress. Without clear guidelines from lawmakers, courts could find themselves balancing the needs of law enforcement and tech users on a case-by-case basis.
“The policy implications of encryption — on privacy, public safety, the economy, and individual freedom — are far too significant to be left to courts, and must ultimately be decided by the people, through their representatives in Congress and in the administration,” Schiff said in a statement. “This discussion draft will surely trigger an intensified discussion and debate about the important interests at stake, as well as the technical questions raised.”
While he reviews the bill, Schiff said he plans to meet with “leaders from law enforcement, the privacy community, the intelligence agencies, and technology leaders” to discuss the best way forward.
“In my view, the best result would be a negotiated agreement that we can live with here at home and that we can hold up around the world as the standard for balancing security and privacy is a globalized, technology-driven world,” he said.
This story has been updated to include Schiff and Wyden’s comments and ACLU’s statement.
