The EARN IT Act Will Eviscerate Communications Privacy ⏤ Even If The Encryption Issue Can Be Solved

Encryption is not the EARN IT Act’s only threat to our privacy.

The EARN IT Act uses the combination of government-led best practices and liability risks to encourage online providers to monitor their systems for child sexual abuse material (CSAM). This will make it harder for courts to reject Fourth Amendment challenges to evidence resulting from provider scanning, because government “encouragement” can convert private searches into government searches subject to the Fourth Amendment.

One solution to the increased risk to prosecutions is to argue that the Fourth Amendment doesn’t apply at all. For example, the government may argue that the Fourth Amendment does not protect online communications held by online providers.

This is not a hypothetical approach to a speculative problem; it is an approach government lawyers are using now in the many CSAM prosecutions facing Fourth Amendment challenges.1 The bill sponsors rely on the government’s argument in their myths & facts document for the EARN IT Act to explain why they don’t think the bill raises any Fourth Amendment issues.

Just recently, a federal court denied a motion to suppress evidence of child pornography violations finding no Fourth Amendment violation, in part, because the “[d]efendant did not have a reasonable expectation of privacy in his Messenger chat or the Video” and could not “invoke the Fourth Amendment’s protection.” United States v. Montijo (M.D. Fla. Jan. 10, 2022).

Rulings like this have wide implications for the privacy of all citizens. But in individual cases, prosecutors and courts know the devastating consequences of finding a Fourth Amendment violation. Just last year, when the Ninth Circuit Court of Appeals found a Fourth Amendment violation, it threw out evidence against a defendant who possessed thousands of CSAM images and the defendant’s conviction was overturned, the indictment dismissed, and he was released. To avoid the increased likelihood of similar results post-EARN IT, the government will likely double-down on their anti-privacy arguments.

Why is the government making this argument?

Many prosecutions of child predators originate from “tips” sent to the National Center for Missing and Exploited Children (“NCMEC”) by online service providers. Since 1998, online services have been required by federal law to report when they become aware of CSAM on their networks. While the reporting law mandates reporting, it is also clear that it does not require online services to monitor. Nonetheless, many online services voluntarily monitor for CSAM. This results in millions of reports to NCMEC’s CyberTipline each year. NCMEC refers these reports to law enforcement for investigation.

Criminal defendants have filed motions to suppress evidence that was obtained based on provider-detected CSAM reported to NCMEC, NCMEC analysis and referral to law enforcement, and resulting law enforcement investigations.2 They argue that online providers are agents of the government when they proactively monitor for CSAM and fulfill their reporting obligations. If courts agree, providers’ searches would be converted to government searches triggering the Fourth Amendment warrant requirement. Because the online provider searches are warrantless, this could result in a Fourth Amendment violation and the evidence may become unusable in the prosecution.

Federal prosecutors attempt to salvage their cases by arguing that there is no Fourth Amendment violation for these activities because users have no reasonable expectation of privacy in their online communications on various online platforms. If there is no reasonable expectation of privacy, there is no Fourth Amendment violation. This would also mean in other contexts, that the government would not need to obtain a search warrant in order to access email, instant messages, photos, and files stored online.

How Can the Government Argue that there is no Fourth Amendment Protection for Private Communications?

In order for the Fourth Amendment to apply to a search, an individual must have a “reasonable expectation of privacy” in the material searched. Traditionally, courts have found that individuals do not have a reasonable expectation of privacy in records held by third parties, such as bank records or telephone records. Until a court case in 2010 held that the government needed a warrant to obtain email from an online service, the government only had to comply with a federal communications privacy law that set a lower standard. Unfortunately, the case is not the “law of the land” ⏤ it is recognized in some jurisdictions, but not others.

In the jurisdictions that have not adopted full Fourth Amendment protection for email and other online communications, the government is able to argue that Americans have no protected privacy interest in such communications because they are held by third-party service providers. Other courts point to provider terms of service and notices about potential monitoring to find that users of that particular service do not have a protected privacy interest.

While in some CSAM cases courts have avoided this question, some courts have agreed with the government’s argument. See, e.g., United States v. Montijo, United States v. Wolfenbarger.

Why Will EARN IT Make it Worse?

The provider-NCMEC-law enforcement relationship is already under tremendous scrutiny from criminal defendants facing CSAM charges. EARN IT will only add fuel to the fire by adding new facts that make it more likely that courts may find a provider is an agent of the government when they search for and report CSAM.

EARN IT is intentionally designed to coerce private companies to monitor their systems for CSAM and they are already legally required to report CSAM for law enforcement investigation. This makes what are generally considered “private searches” today look a lot more like government searches subject to the Fourth Amendment.

For a fuller discussion of this, see https://slate.com/technology/2022/02/earn-it-act-fourth-amendment-violation.html.

If a private party must perform a search-if she can face liability for not doing so-the search “is controlled by the Fourth Amendment…A search carried out voluntarily by a private actor will still be subject to the Fourth Amendment’s strictures if the government “demonstrate[s] a strong [ ] preference for [the search]. United States v. Hart, 3:CR-20–197, at *9 (M.D. Pa. June 14, 2021)(emphasis added).

The risk that provider monitoring and reporting will be treated as a government action increases the risk that the CSAM evidence will be unusable by the prosecution. It also increases the likelihood that defendants will file motions to challenge use of the evidence. The solution for prosecutors is to argue that the Fourth Amendment does not apply at all. One way to do that is for government lawyers to argue that private online communications are not protected by the Fourth Amendment.

What Should Congress Do?

Congress should prioritize the safety of children and pass legislation that will enhance the ability of online providers to develop cutting edge techniques to detect and report CSAM and law enforcement to investigate, without creating new risks to CSAM prosecutions or Americans’ privacy.

Bills have already been written that would fill these needs, for example the bicameral and bipartisan bills the Invest in Child Safety Act and the END Child Exploitation Act.

Congress should also pass the long-called for reform to the Electronic Communications Privacy Act to ensure that online communications have adequate protection regardless of whether they are stored on your device or on a provider’s servers.

— —

Notes:

1. See, e.g., United States v. Miller, 982 F.3d 412, 426–27 (6th Cir. 2020)(discussing argument that defendant had no Fourth Amendment-protected privacy interest in his Google account); United States v. Wolfenbarger, №16-CR-00519-LHK-1, at *17 (N.D. Cal. Aug. 29, 2019)(Court found defendant had no reasonable expectation of privacy in his Yahoo account); United States v. Coyne, 387 F. Supp. 3d 387, 396 (D. Vt. 2018)(“The court rejects the Government’s argument that the user agreements in place between the ESPs and their customers remove any expectation of privacy.”).
2. See, e.g., United States v. Bebris, 4 F.4th 551(7th Cir. 2021); United States v. Meals, №20–40752 (5th Cir. Dec. 30, 2021); United States v. Miller, 982 F.3d 412 (6th Cir. 2020); United States v. Ringland 966 F.3d 731 (8th Cir. 2020); United States v. DiTomasso, 932 F.3d 58 (2d Cir. 2019); United States v. Reddick, 900 F.3d 636 (5th Cir. 2018); United States v. Ackerman, 831 F.3d 1292 (10th Cir. 2016); United States v. Stevenson, 727 F.3d 826 (8th Cir. 2013); United States v. Cameron, 699 F.3d 621 (1st Cir. 2012); United States v. Richardson, 607 F.3d 357 (4th Cir. 2010); United States v. Gianatasio, CRIMINAL ACTION 4:19–40044-TSH (D. Mass. Dec. 17, 2021); United States v. Bonds, CRIMINAL ACTION 5:21-CR-00043-KDB-DCK (W.D.N.C. Oct. 13, 2021); United States v. Soward, CRIMINAL ACTION 20–03-DLB-CJS (E.D. Ky. Apr. 26, 2021); United States v. Bohannon, 506 F. Supp. 3d 907 (N.D. Cal. 2020); United States v. Kendall, CRIMINAL ACTION №18–19-DLB-EBA (E.D. Ky. Nov. 6, 2019); United States v. Gregory, 8:18CR139 (D. Neb. Dec. 7, 2018); United States v. Heleniak, 14CR42A (W.D.N.Y. Feb. 9, 2015); United States v. Drivdahl, 2014 WL 896734 (D. Mont. Mar. 6, 2014); United States v. Keith, 980 F.Supp.2d 33 (D. Mass. 2013); State v. Fristoe, 489 P.3d 1200 (Ariz. Ct. App. 2021); State v. Hunt, 316 So. 3d 271 (Ala. Crim. App. 2020); Adams v. State, 316 So. 3d 260 (Ala. Crim. App. 2020); State v. Harrier, 14 Wash. App. 2d 17 (Wash. Ct. App. 2020); Burwell v. State, 576 S.W.3d 826 (Tex. App. 2019).

The Chamber of Progress (progresschamber.org) is a new center-left tech industry policy coalition promoting technology’s progressive future. We work to ensure that all Americans benefit from technological leaps, and that the tech industry operates responsibly and fairly.

Our work is supported by our corporate partners, but our partners do not sit on our board of directors and do not have a vote on or veto over our positions. We do not speak for individual partner companies and remain true to our stated principles even when our partners disagree.