What EARN IT actually proposes

EARN IT — short for Eliminating Abusive and Rampant Neglect of Interactive Technologies — is a US bill that keeps coming back with slightly different text. In every version, it sets up a commission that would write best practices for how online platforms handle child sexual abuse material, sometimes called CSAM. Platforms that fail to follow those best practices would lose part of the legal protection they now have under Section 230 of the Communications Decency Act, opening them up to civil lawsuits and state criminal cases.

The bill does not literally ban end-to-end encryption. It never uses the word "backdoor". What it does is create legal risk that a platform that does not proactively scan user content might be liable for what shows up on it. The fear from encryption experts is that this risk pushes platforms to weaken or remove end-to-end encryption to stay safe.

Why encryption experts oppose it

Cryptographers, civil-liberties groups, and many technology companies have opposed every version of the bill. Their argument is not "child safety does not matter". It is that the only way to scan an encrypted message is to break the encryption for everyone. Once a scanning capability exists on your device or in the network, that capability can be pointed at anything — political speech, journalism, activism — and the same technical hole is available to attackers and hostile governments.

The counterproposal from most technical experts is to invest in the things that already work: better reporting tools, funding for the National Center for Missing and Exploited Children, more resources for investigators, and metadata-based signals that do not require reading message contents. Groups that support open-source security tools — including many funded through the Open Technology Fund — have been part of that pushback.

The child-safety debate, honestly

It is fair to say that CSAM is a serious problem and that platforms have real responsibilities. It is also fair to say that many advocates for children's safety have concluded, after listening to the technical arguments, that mandatory client-side scanning is not the answer. Groups that fight child abuse have themselves been split on EARN IT for exactly this reason.

What makes this debate hard is that both sides are describing real problems. Prosecutors do lose leads because content is encrypted. Encryption backdoors do get abused. Both are true. Any honest reading of the fight has to hold both facts at once.

What a "backdoor" really means

The word "backdoor" gets thrown around loosely. Technically it means any mechanism built into a system to let a third party read protected data. The classic version is a master key held by the company. A newer version, floated in the encryption debates, is client-side scanning — software on your device that inspects messages before they are encrypted and reports matches.

  • Any master key can be stolen. Once stolen, everything is readable.
  • Any scanning list can be quietly expanded. What starts as CSAM can grow to political content.
  • Any mandatory hole is a hole for adversaries too, not just for the intended government.
  • Any tool used to detect content can be used to censor it.

These are the arguments cryptographers keep making. They have made them in front of Congress, courts, and journalists. They keep coming up because the underlying math does not change.

Where the bill stands now

EARN IT has been introduced in 2020, 2022, and again since. It has passed committee at various points but has not become law. Similar debates are live in the UK's Online Safety Act, the EU's proposed "CSAM regulation", and Australia's assistance-and-access laws. If you want to follow the fight in real time, watch the US Senate Judiciary Committee, the House Energy and Commerce Committee, and the annual appropriations cycles for the agencies whose funding gets attached to these questions. The story that this domain started telling in 2020, with the letter to Congress, and the story of apps like Signal, is really the same story: whether the everyday encryption people rely on stays intact — and that is why EARN IT keeps mattering.