Why I'm protecting privacy in our connected world

A new Texas social media law promises to protect minors, while Mississippi lawmakers are aiming at preventing content deemed harmful to minors. A bill in Congress, meanwhile, promises online safety for kids.

Measures to allegedly protect young people will lead to censoring large parts of the Internet, including LGBTQ+ content and information about gender identity, abortion, and trans support. They will be used to justify email surveillance and online speech filtering. These measures are part of the same siege that is already depriving women, LGBTQ+ people, young people, and other vulnerable groups of their fundamental rights to free speech, expression, and assembly, to name a few.

Around the world, a dangerous, discriminatory pattern has emerged in which the powerful are surveilling and seizing control of more aspects of people’s lives.

I’m on the frontlines to protect our online privacy and access to information for communities and individuals. I believe efforts to break encryption, restrict young people’s access to social media, and monitor online activity and communications in the name of “protection” are part of a trend perpetrated by lawmakers and organized groups with political agendas who seek to control and silence the marginalized. Worse, they’re set on portraying and treating people whose sexual identity, race, and gender they consider non-normative as unacceptable and dangerous.

The Heritage Foundation has stated outright that it will use bills like the federal Kids Online Safety Act (KOSA) to “[keep] trans content away from kids.” And KOSA sponsor Sen. Marsha Blackburn of Tennessee has stated that kids need to be protected from “the transgender [sic] in this culture” and referred to education about race discrimination as being “dangerous for kids.”

We must send a loud and clear message to those behind these efforts: We know what lawmakers are trying to do, and we citizens will fight on the local, state, and federal levels to protect the targeted groups.

Attacks on privacy today are fundamentally connected with attacks on abortion, gender nonconformity, and trans healthcare, arising from the same underlying drive to maintain strict social control.

Take KOSA, a censorship bill lawmakers in Washington are teeing up for a vote after it failed to gain traction for the past two years. The bill would increase surveillance and restrict access to information in the name of protecting children online. The bill holds platforms liable if their designs and services do not “prevent and mitigate” a list of societal ills: anxiety, depression, eating disorders, substance use disorders, physical violence, and sexual exploitation and abuse. But who gets to decide what designs or services lead to these “harms” under the bill?

Shutterstock

At the state level, Utah, Arkansas, and Texas already have enacted laws requiring parental approval to create social media accounts; Utah’s law, for example, will ban 17-year-olds from checking Wikipedia after 10:30 pm. In addition, Utah parents must have a copy of the child’s password. In Texas, the law comes with additional content filtering requirements, including content considered “grooming,” which has notably been used to limit or remove queer content.

In just a few decades, the Internet has changed the world by allowing ideas and information to flow quickly and easily. While it’s possible to ban books and restrict education about sex, LGBTQ+ rights, and racial inequities locally, the Internet allows access to ideas beyond the control of school boards, politicians, and parents. This is why uncensored online access threatens those seeking to maintain power.

The drive to control access to the Internet mirrors horrific public policy and legislative measures threatening the lives of LGBTQ+ people. We’ve seen proposals and laws banning gender-affirming care and criminalizing the doctors who provide it, banning drag in public, and investigating parents who provide care for their trans kids as child abusers. These are often the same groups leading the movement to rob women of autonomy over their own bodies, like Alliance Defending Freedom and the misleadingly named American College of Pediatricians.

Limiting access to online information is just part of their plan. Those set on gaining total control see spying on private messages, including encrypted communications, as fair game because they also might harbor content deemed dangerous to children or society.

Past attempts by the U.S. to break encryption, which keeps our private communications from being intercepted by law enforcement, criminals, and governments, led to legal cases that won in favor of privacy protection. Now, authorities usually can’t openly say they want a backdoor into encryption. Instead, they use the best excuse at hand—which today means focusing on stopping the flow of child sexual abuse material (CSAM).

Child exploitation is a serious problem, but even carefully thought-out and narrowly scoped backdoors are still backdoors that can be abused. And it’s impossible to build a scanning system that can only be used for CSAM. Once the backdoors are in place, abortion and LGBTQ+ content can be flagged in private messages not just by local authorities in the U.S. but by governments in countries that have criminalized being gay.

That hasn’t deterred lawmakers here or elsewhere. The United Kingdom’s Online Safety Act mandates screening all content, including encrypted messages. Soon, websites must proactively scan for “harmful content.” In the U.S., the EARN IT Act and the STOP CSAM Act propose similar ideas. Under both, encryption could be introduced as evidence that website hosts or internet providers are actively facilitating illegal material. The sponsors of these bills undoubtedly intend to scan user messages, photos, and files.

All these bills would mandate scanning for existing CSAM on the premise that this scanning is at least theoretically possible, but today’s scanning technology barely works. A Facebook study found that 75% of the messages flagged by its scanning system to detect CSAM were not “malicious” and included messages like bad jokes and memes. In 2020, Irish police received 4,192 reports from the U.S. National Center for Missing and Exploited Children; only 20 percent were confirmed as actual CSAM.

A 2022 New York Times report about fathers falsely flagged as child abusers because they sent medical pictures of their kids to pediatricians demonstrates how such false positives can have lasting effects. Despite being cleared of wrongdoing by local police, Google deleted their accounts, stood by the failed AI system that flagged them, and defended their opaque human review process—likely because companies can’t afford to risk being seen as soft on the issue.

Nearly all cases of child sexual abuse are perpetrated by someone the child already knows. Suppose those attacking encryption are knowledgeable about the most prevalent abuse situations and sincerely want to stop the abuse. In that case, they should focus on issues like abuse happening at home and by attackers the child knows. Assuming they are, in fact, adequately informed, one is left to question whether there are other privacy-invasive reasons to roll back or severely limit encryption.

Shutterstock

The Internet provides access to knowledge and learning. It allows young and old to connect with friends, show their creative side, get support, and feel accepted. Finding that sort of community is even more critical for kids who are marginalized or unwelcome in their daily lives. However, research shows that pervasive surveillance and control has a chilling effect. The vast majority of 8,000 teenagers in 13 EU countries surveyed by European Digital Rights said they “would not feel comfortable being politically active or exploring their sexuality if authorities were monitoring their digital communication.”

This is not acceptable, and it’s dangerous. It’s naive to think lawmakers won’t seek to apply restrictions to broader varieties of content. And when a government considers trans healthcare as child abuse or drag as a step towards pedophilia, they will have no qualms about mandating bans and scans as well.

We must recognize and fight legislation pushing us to give up our power, privacy, and control over our health care and free expression. Many battles are being fought, and none are easy, but we must act.

By speaking up now, we can and will protect our ability to speak freely and share knowledge about LGBTQ+, gender, race, and abortion rights, preserving the right to privacy for vulnerable communities.

Erica Portnoy is a San Francisco-based senior staff technologist at the Electronic Frontier Foundation, where she works to defend and explain encryption and develop free, open-source software that makes websites safer and more secure against attacks by cyber criminals and repressive governments.

Want to share an opinion on an issue? Have an inspiring personal story to tell? Learn more by visiting advocate.com/submit.

Views expressed in The Advocate’s opinion articles are those of the writers and do not necessarily represent the views of The Advocate or our parent company, equalpride.