Florida’s New Social Media Bill Says The Quiet Part Out Loud And Demands An Encryption Backdoor
At least Florida'sSB 868/HB 743, Social Media Use By Minors" bill isn't beating around the bush when it states that it would require social media platforms to provide a mechanism to decrypt end-to-end encryption when law enforcement obtains a subpoena." Usually these sorts of sweeping mandates are hidden behind smoke and mirrors, but this time it's out in the open: Florida wants a backdoor into any end-to-end encrypted social media platforms that allow accounts for minors. This would likely lead to companies not offering end-to-end encryption to minors at all, making themlesssafe online.
Encryption is the best tool we have to protect our communication online. It's just as important for young people as it is for everyone else, and the idea that Florida can protect" minors by making them less safe is dangerous and dumb.
The bill is not only privacy-invasive, it's also asking for the impossible. As breaches likeSalt Typhoon demonstrate, you cannot provide a backdoor for just the good guys," and you certainly cannot do so for just a subset of users under a specific age. After all, minors are likely speaking to their parents and other family members and friends, and they deserve the same sorts of privacy for those conversations as anyone else. Whether social media companies provide a mechanism to decrypt end-to-end encryption" or choose not to provide end-to-end encryption to minors at all, there's no way that doesn't harm the privacy of everyone.
If this all sounds familiar, that's because we saw asimilar attempt from an Attorney General in Nevadalast year. Then, like now, the reasoning is that law enforcement needs access to these messages during criminal investigations. But this doesn't hold true in practice.
Inour amicus brief in Nevada, we point out that there aresolid argumentsthat content oblivious" investigation methods-like user reporting- are considered more useful than monitoring the contents of users' communications when it comes to detecting nearly every kind of online abuse." That remains just as true in Florida today.
Law enforcement can and does already conduct plenty of investigations involving encrypted messages, and even with end-to-end encryption, law enforcement can potentially access the contents of most messages on the sender or receiver's devices, particularly when they haveaccess to the physical device. The bill also includes measures prohibiting minors from accessing any sort of ephemeral messaging features, like view once options or disappearing messages. But even with those features, users can still report messages or save them. Targeting specific features does nothing to protect the security of minors, but it would potentially harm the privacy of everyone.
SB 868/HB 743 radically expands the scope of Florida's social media lawHB 3, which passed last year and itself has not yet been fully implemented as it currently faces lawsuits challenging its constitutionality. The state wasimmediately suedafter the law's passage, with challengers arguing the law is an unconstitutional restriction of protected free speech. That lawsuit is ongoing-and it should be a warning sign. Florida should stop coming up with bad ideas that can't be implemented.
Weakening encryption to the point of being useless is not an option. Minors, as well as those around them, deserve the right to speak privately without law enforcement listening in. Florida lawmakers must reject this bill. Instead of playing politics with kids' privacy, they should focus on real, workable protections-like improving consumer privacy laws to protect young people and adults alike, and improving digital literacy in schools.
Reposted from the EFF's Deeplinks blog.