Senate bill crafted with DEA targets end-to-end encryption, requires online companies to report drug activity

A bill requiring social media companies, encrypted communications providers and other online services to report drug activity on their platforms to the U.S. Drug Enforcement Administration (DEA) advanced to the Senate floor Thursday, alarming privacy advocates who say the legislation turns the companies into de facto drug enforcement agents and exposes many of them to liability for providing end-to-end encryption.

The bipartisan Cooper Davis Act — named for a Kansas teenager who died after unknowingly taking a fentanyl-laced pill he bought on Snapchat — requires social media companies and other web communication providers to give the DEA users’ names and other information when the companies have “actual knowledge” that illicit drugs are being distributed on their platforms.

Many privacy advocates caution that, if passed in its current form, the bill could be a death blow to end-to-end encryption services because it includes particularly controversial language holding companies accountable for conduct they don’t report if they “deliberately blind” themselves to the violations.

Officials from the DEA have spent several months honing the bill with key senators, Judiciary Committee Chairman Dick Durbin (D-IL) said Thursday.

Providers of encrypted services would face a difficult choice should the bill pass, said Greg Nojeim, Senior Counsel & Director of Security and Surveillance Project at the Center for Democracy and Technology.

“They could maintain end-to-end encryption and risk liability that they had willfully blinded themselves to illegal content on their service and face the music later,” Nojeim said. “Or they could opt to remove end-to-end encryption and subject all of their users who used to be protected by one of the best cybersecurity tools available to new threats and new privacy violations.”

The bill’s “deliberately blind” provision also worries Cody Venzke, the senior policy counsel for surveillance, privacy, and technology at the American Civil Liberties Union, who said it would “target” encryption.

“The entire purpose of privacy-protecting technology like end-to-end encryption is to protect us from platforms’ surveillance,” Venzke added.

Meredith Whittaker, the president of the foundation behind the popular encrypted Signal app, attacked the bill’s “willfully blind” language in a tweet sent Friday, saying, “Failing to put cameras in everyone's bedrooms? Not tracking all residents with location? Using E2E? All willful blindness by this logic.”

The effort to eliminate privacy in the name of 'safety' continues. Anything ≤ total surveillance of everyone = 'willful blindness.'

Failing to put cameras in everyone's bedrooms? Not tracking all residents with location? Using E2E? All willful blindness by this logic. https://t.co/GJeedPUbiW

— Meredith Whittaker (@mer__edith) July 14, 2023

A threat to E2E encryption

Law enforcement has long complained about how end-to-end encryption creates what the Department of Justice has called a “lawless space that criminals, terrorists, and other bad actors can exploit for their nefarious ends.”

Two Mexican drug cartels trafficking most fentanyl and methamphetamine into America use social media applications to “coordinate logistics and reach out to victims,” the DEA said in a May press release. The agency named Facebook, Instagram, TikTok, and Snapchat along with encrypted platforms WhatsApp, Telegram, Signal, Wire, and Wickr as examples.

More than 1,100 cases in a recent DEA operation targeting Mexican drug cartels involved social media applications and encrypted communications platforms through which fentanyl and meth were trafficked, the agency said.

“These social media platforms understand there is no legal application for the sale of many of these substances and yet they continue with impunity,” Judiciary Committee Chairman Dick Durbin (D-IL) said at a Thursday Senate markup hearing for the bill, noting a similar reporting mechanism already in place which requires the companies to report child sexual abuse material.

Privacy advocates counter that determining what constitutes child sexual abuse imagery on platforms is much easier than patrolling speech, particularly in various languages and with street slang, to sniff out drug sales.

Senator Alex Padilla (D-CA) told the Judiciary Committee that, unlike online sexual imagery of children, language is harder to police on a mass scale since “context is pretty important.”

“Do we really want to effectively deputize untrained tech companies led by people like Elon Musk to serve as law enforcement?” Padilla said. “This bill will empower them to disclose people's private data to federal law enforcement without a warrant or oversight based only, on quote, a reasonable belief that someone is committing an offense.”

Padilla also criticized the bill for potentially “criminalizing companies that offer encrypted services,” citing how beneficial encryption has been for people in marginalized communities and women seeking reproductive care in the post Dobbs world.

A Thursday press release from sponsor Sen. Jeanne Shaheen (D-NH) highlighted statistics from the DEA supporting the need for the legislation.

Within a five-month period, Shaheen said, DEA investigated 390 drug-poisoning investigations and found that 129 had direct ties to social media.

“Unfortunately, federal agencies have not had access to the necessary data to intervene, which has allowed the crisis to worsen,” the press release said.

It added that the law will establish a “comprehensive and standardized reporting regime that would enable the DEA to better identify and dismantle international criminal networks and save American lives.”

But Nojeim said there is a bigger question in play and it is one that society must confront sooner rather than later as all manner of social interactions, and problems, play out online.

“We live our lives online nowadays,” he said. “One question that we have to answer as a society is whether we want these communication service providers, with whom we can't communicate without, to be close to agents of the government.”

They already are, according to Carl Szabo, vice president and general counsel of the web communications provider membership association NetChoice. Szabo said social media sites voluntarily work with law enforcement to stop the trafficking of drugs on their sites.

He said that if the bill is enacted all reporting by social media sites “would be subjected to Fourth Amendment processes, and it will actually become harder for law enforcement to identify these threats."