Freedom on the Net 2018 - United States

Key Developments, June 1, 2017 – May 31, 2018

• The Federal Communications Commission (FCC) voted in December 2017 to overturn net neutrality provisions established by the 2015 Open Internet Order that required network service providers to treat internet traffic equally. The vote also diminished the FCC's regulatory authority over broadband service providers (see Regulatory Bodies).

• Though intended to crack down on websites that unlawfully promote prostitution or sex trafficking, the "Allow States and Victims to Fight Online Sex Trafficking Act of 2017," signed into law in April 2018, has led companies to preemptively censor legitimate content to avoid penalties (see Content Removal).

• The proliferation of disinformation – particularly on social media – remained a prominent concern in the aftermath of the November 2016 presidential election, leading to greater scrutiny of social media platforms (see Media, Diversity, and Content Manipulation).

• Two new laws were enacted affecting privacy, surveillance, and data collection: the reauthorization of Section 702 of FISA until 2024, and the passage of the Clarifying Lawful Overseas Use of Data Act (CLOUD) (see Surveillance, Privacy, and Anonymity).

Introduction:

Internet freedom in the United States declined over the past year due to the repeal of net neutrality rules that had ensured that internet service providers (ISPs) treated internet traffic equally. There were also concerns about the proliferation of toxic content and disinformation on social media platforms, and the passage of legislation that threatens to undermine protections from intermediary liability.

In December 2017, the Federal Communications Commission (FCC) overturned net neutrality provisions established by the 2015 Open Internet Order. Without these rules, ISPs are able to speed up or slow down certain websites in favor of others. The decision was sharply criticized by public interest groups and open internet advocates, who argued that the lack of net neutrality protections will likely harm consumers and threaten access to information online.

Meanwhile, the "Allow States and Victims to Fight Online Sex Trafficking Act of 2017" (also referred to as SESTA/FOSTA) signed into law in April 2018 weakened protections from intermediary liability. While the law aims to address the very real problem of sex trafficking facilitated through the internet, opponents argued that it establishes liability for companies that host user-generated content, which can lead companies to preemptively censor legitimate content to avoid penalties. Indeed, the law's ramifications took immediate effect: after the law was passed, Craigslist announced that it was removing its "Personals" section from its website altogether. Advocates for sex workers' rights also argued that the law threatens their safety by diminishing safe spaces for workers to communicate with one another online.

Disinformation and hyperpartisan content continued to plague the online sphere in the past year, particularly on social media platforms. As the public learned more about how different actors spread disinformation online, scrutiny of social media platforms intensified. In October 2017, executives from Facebook, YouTube, and Twitter were called to testify before Congress in response to concern over revelations that Russia may have used social media platforms to spread disinformation and sow discord among the American public, particularly during the 2016 presidential election. Their testimonies revealed that 126 million Facebook users may have seen content produced by Russian operatives, while Twitter later disclosed it had discovered over 3,800 real accounts related to Russia's Internet Research Agency and 36,000 bot accounts originating in Russia. Facebook's founder and CEO Mark Zuckerberg was also called to testify in April 2018 about how his company had exposed the data of up to 87 million users to a third-party researcher, who sold that data to company Cambridge Analytica for political consulting purposes during the 2016 elections season. Stemming such manipulation tactics has been a key focus of concerted efforts by the U.S. government and companies to prevent foreign interference during the 2018 congressional midterm elections.

Government surveillance of online communications came back under the spotlight in January 2018, when Congress voted to reauthorize the FISA Amendments Act – including Section 702, which enabled the incidental collection of Americans' communications and metadata – for another six years. Despite calls for reform, the bill passed without meaningful additional privacy protections.

The breadth of law enforcement access to user data held by companies was expanded under the Clarifying Lawful Overseas Use of Data Act, or CLOUD, signed into law on March 23, 2018. Under the act, law enforcement requests sent to US companies for user data applies to data in the companies' possession regardless of where it is stored, including overseas. Previous requests for user data were limited to data stored within the US's jurisdiction. CLOUD also allows foreign governments to directly petition US companies to hand over user data.

In a positive development, on June 22, 2018 (outside of this report's coverage period), the Supreme Court ruled on a significant decision regarding access to device data in the case of Carpenter v. United States. Ruling in favor of the plaintiff, the court decided that the government is required to obtain a warrant to collect subscriber location information records from third parties like cell phone providers. Privacy advocates lauded the decision, noting that the privacy protections of cell phone location information have broader impacts on the privacy protections of other information that companies collect and store about their users.

Obstacles to Access:

The Federal Communications Commission (FCC) voted in December 2017 to overturn net neutrality provisions established by the 2015 Open Internet Order, enabling internet service providers (ISPs) to speed up or slow down certain websites in favor of others. The vote also diminished the FCC's regulatory authority over broadband ISPs.

Availability and Ease of Access

Although the United States is one of the most connected countries in the world, the speed, affordability, and availability of its broadband networks lags behind several other developed countries. According to the latest data available from the International Telecommunication Union, internet penetration in the United States stood at 76 percent at the end of 2016.^[1] Broadband adoption rates are high, although home broadband use has declined slightly in recent years: 65 percent of US adults reported being home broadband users in January 2018, compared to 73 percent as of November 2016.^[2] While the broadband penetration rate is high by global standards, it lags significantly behind countries such as Switzerland, the Netherlands, Denmark, and South Korea.^[3] Moreover, access, cost, and usability remain barriers for some Americans, particularly senior citizens, people who live in rural areas, and low-income households.^[4] However, internet access rates for those 65 years of age and older has steadily increased over the past decade, with 68 percent of individuals in this age bracket using the internet as of 2018, according to data from Pew Research.^[5]

The cost of broadband internet access in the United States continues to be higher than many countries in Europe with similar internet penetration rates.^[6] In March 2016, the FCC announced plans to expand its Lifeline program – which allows companies to offer subsidized phone plans to low-income households – to include broadband internet access as a subsidized utility.^[7] However, on November 16, 2017, the FCC released a proposal to place restrictions on this program.^[8] The proposal would limit the program to "facilities-based providers," meaning internet resellers who do not own the network infrastructure connecting to customers' houses would not be able to participate in the program. Public interest advocates argue that, if implemented, the measures would significantly hamper the program's reach and make it more difficult for low-income households to obtain affordable broadband internet access. Currently, 68 percent of Lifeline recipients receive service from nonfacilities providers, and in some cases there is no alternative provider in the area.^[9] Research from the Brookings Institution notes that this policy would be especially detrimental to those living on tribal lands.^[10]

Uptake rates for internet-enabled mobile devices have increased dramatically throughout the United States in the past decade. In 2018, 95 percent of adults reported that they owned a mobile phone, and 77 percent of adults owned a smartphone, up from 35 percent in 2011.^[11] A growing number of people use their cell phones to view streaming video services offered by companies such as Netflix or Hulu.^[12] Pew Research reported in early 2018 that younger adults, people of color, and those with lower household incomes are more likely to be "smartphone-dependent," with limited options for internet access other than their phones.^[13]

Restrictions on Connectivity

Internet users in the United States face few government-imposed restrictions on their ability to access content online. The backbone infrastructure is owned and maintained by private telecommunications companies, including AT&T and Verizon. In contrast to countries with only a few connections to the backbone internet infrastructure, the United States has numerous connection points, which would make it nearly impossible to disconnect the entire country from the internet.

At the same time, law enforcement agencies in the United States have occasionally wielded their power to inhibit wireless internet connectivity in emergency situations. The federal government has a secret protocol for shutting down wireless internet connectivity in response to particular events, some details of which came to light following a lawsuit brought under the Freedom of Information Act in 2013.^[14] The protocol, known as Standard Operating Procedure (SOP) 303, was established in 2006 on the heels of a 2005 cellular-activated subway bombing in London. It codifies the "shutdown and restoration process for use by commercial and private wireless networks during national crises." What constitutes a "national crisis" and what safeguards exist against abuse remain largely unknown, as the full SOP 303 documentation has never been released to the public.^[15]

State and local law enforcement also have tools to jam wireless internet.^[16] In December 2014, the FCC issued an Enforcement Advisory clarifying that it is illegal to jam cell phone networks without federal authorization, even for state and local law enforcement agencies.^[17]

ICT Market

While many broadband service providers operate in the United States, the industry has trended toward consolidation. On May 6, 2016, the FCC announced that it had voted to approve Charter Communications Inc.'s acquisition of Time Warner Cable and Bright House Networks; this was subsequently approved by the California Public Utilities Commission.^[18] As of mid-2016, two companies – Comcast and Charter Communications – controlled an estimated 70 percent of the market for fixed-line broadband internet access, with approximately 24 million and 22 million subscribers respectively.^[19] AT&T is the third-largest broadband provider with 15.6 million subscribers, followed by Verizon with 7 million and CenturyLink with 6 million.^[20] Although average broadband speeds have increased over the past decade, the majority of American households have access to only one broadband provider that offers download speeds of at least 25 Mbps.^[21]

Further consolidation of the telecom sector threatens to limit consumer access to information and communication technologies (ICT) services. Most recently on June 14, 2018, AT&T announced that it had acquired media and entertainment company Time Warner.^[22] On July 12, the Justice Department announced that it would appeal the court decision that had allowed the merger to proceed.^[23]

The FCC has made some attempts to mitigate these threats in recent merger approvals. For example, the commission included provisions within the 2016 Charter-Time Warner Cable deal that required Charter Communications to expand broadband availability to close the digital divide, including establishing new cable lines in areas of California without internet access, and providing affordable access to at least 525,000 low-income families.^[24] Other conditions prohibit the companies from taking steps that would privilege cable services over online video competitors, such as imposing data caps on online content that would discourage subscribers from streaming video.^[25] In 2015, regulators had blocked a proposed merger between Time Warner Cable and Comcast, citing concerns about Comcast's ability to interfere with over-the-top services (such as Netflix), as well as increased market concentration.^[26]

Americans increasingly access the internet via mobile technologies, as wireless carriers deploy advanced Long-Term Evolution (LTE) networks. Following a decade of consolidation, the US wireless market is dominated by four national carriers – AT&T, Verizon, Sprint, and T-Mobile. Verizon leads the wireless services market with 143 million subscribers, followed by AT&T with 132 million, T-Mobile with 67 million, and Sprint with 58 million.^[27]

In April 2018, Sprint and T-Mobile announced that they had reached an agreement to merge the two companies; it is unclear whether the proposed deal will go through, since previous merger attempts have been unsuccessful.^[28] The US government has looked unfavorably on further consolidation of mobile networks. Regulators had blocked AT&T's proposed merger with T-Mobile in 2011 and separately signaled that they would block a rumored merger between Sprint and T-Mobile in 2014.^[29]

Moreover, the government has promoted mobile broadband through a series of spectrum auctions. In March 2016, the FCC began the process of buying back airwaves set aside for TV broadcasters to increase the available spectrum for wireless broadband, as outlined in the government's 2012 National Broadband Plan, which set a goal of establishing universal broadband by 2020.^[30]

In January 2015, then-president Barack Obama announced an initiative to encourage the development of community-based broadband services and asked the FCC to remove barriers to local investment.^[31] One month later, the FCC preempted (overturned) state laws in Tennessee and North Carolina that restrict local broadband services, arguing that such laws create barriers to broadband deployment.^[32] In August 2016, a federal court ruled that the FCC does not have the authority to preempt these state laws,^[33] which are also on the books in many other states. Critics contend that the ruling threatens to limit affordable broadband options for small remote communities.

Regulatory Bodies

No single agency governs the internet in the United States. The FCC is charged with regulating radio and television broadcasting, interstate communications, and international telecommunications that originate or terminate in the United States. The FCC has jurisdiction over a number of internet-related issues, though this authority was curtailed when the FCC voted in December 2017 to reverse the 2015 Open Internet Order, which had provided the legal authority for the FCC to regulate broadband internet providers as common carriers.

The FCC is led by five commissioners, nominated by the president and confirmed by the Senate, with no more than three commissioners from one party. President Donald Trump nominated Republican commissioner Ajit Pai to serve as chair on January 23, 2017.^[34] The FCC is currently controlled by a Republican majority.

Other government agencies, such as the Commerce Department's National Telecommunications and Information Administration (NTIA), play advisory or executive roles with respect to telecommunications, economic and technological policies, and regulations.

Since assuming his role as chair of the FCC, Pai has taken a number of steps toward deregulating the telecommunications industry, most notably the decision to diminish the FCC's ability to regulate internet service providers and roll back net neutrality protections. On March 1, 2017, the Commission voted to freeze the broadband privacy guidelines that the FCC had passed the previous October.^[35] The guidelines would have required broadband providers to obtain opt-in consent from consumers before they could use and share information such as a user's web browsing history and app usage data, and would have given consumers the ability to opt-out of the use and sharing of other types of personally identifiable information.^[36] In late March, Congress went a step further and voted to repeal the broadband privacy guidelines under the Congressional Review Act,^[37] which effectively prevents the FCC from enacting similar rules in the future.^[38] In February 2017, the FCC also ended its review of whether zero-rating practices, which provide free internet access under certain conditions, violate net neutrality principles and enabled the practice to continue.^[39] Critics argue that zero-rating services could harm competition.^[40]

During this report's coverage period, in December 2017, the FCC voted to reverse the net neutrality rules established by the 2015 Open Internet Order, which had prohibited network operators from giving preferential treatment to favored content or from blocking disfavored content on both fixed and wireless networks. The repeal went into effect outside the coverage period, on June 11, 2018,^[41] allowing internet service providers to speed up, slow down, or block some websites in favor of others at will. The repeal also overturned some of the FCC's regulatory authority over broadband ISPs.^[42] FCC chairman Ajit Pai argued that this decision would reinstate a light-touch regulatory model that is good for innovation and for consumers.^[43] However, the decision was sharply criticized by civil society and public interest groups, who argued that the decision will harm consumers,^[44] is an abandonment of the FCC's responsibility to protect freedom of expression online,^[45] and will likely result in a less free and open internet.^[46] Polls indicate that the majority of Americans are in favor of net neutrality.^[47]

Several state legislatures, attorneys general, and civil society groups have since taken up the fight to reinstate net neutrality on the local and federal levels. Following the FCC's decision, 21 state attorneys general filed a lawsuit with the US Court of Appeals in the DC circuit, claiming that the FCC's decision was "arbitrary and capricious" and violated several aspects of federal law.^[48] Civil society groups and nonprofits including Mozilla,^[49] Public Knowledge,^[50] the Open Technology Institute,^[51] and Free Press^[52] filed protective petitions urging the US Courts of Appeals for the DC and First Circuits to review the FCC's decision. The governors of Montana and New York signed executive orders barring state agencies from conducting business with ISPs that violate net neutrality,^[53] and several other state legislatures are considering bills that would requires ISPs in the state to abide by net neutrality principles.^[54] In September 2018, California passed its own net neutrality law; the Department of Justice announced plans to sue the state hours after the bill was signed into law.^[55]

The scaling back of the Lifeline program and the ending of review of zero-rating practices (see "Availability and Ease of Access") have contributed to a range of critics, from Democratic lawmakers to the New York Times editorial board to public interest groups, decrying Pai's FCC agenda as putting corporations ahead of consumers and circumventing the public process.^[56]

Limits on Content:

The passage of the "Allow States and Victims to Fight Online Sex Trafficking Act of 2017," or SESTA/FOSTA, in March 2018 to address the problem of sex trafficking facilitated through the internet has had the unintended consequence of pushing companies to preemptively remove legitimate content. Meanwhile, the growing prevalence of disinformation and partisan media continued to have a significant impact on the online media landscape.

Blocking and Filtering

In general, the US government does not force ISPs or content hosts to block or filter online content. Some states require publicly funded schools to install filtering software on their computers to block obscene, illegal, or harmful content.^[57] The Children's Internet Protection Act of 2000 (CIPA) requires public libraries that receive certain federal government subsidies to install filtering software that prevents users from accessing child pornography or visuals that are considered obscene or harmful to minors. Libraries that do not receive the specified subsidies from the federal government are not obliged to comply with CIPA, but more public libraries are seeking federal aid in order to mitigate budget shortfalls.^[58] Under the Supreme Court's interpretation of the law, adult users can request that the filtering be removed without having to provide a justification. However, not all libraries allow this option, arguing that decisions about filtering should be left to the discretion of individual libraries.^[59]

Content Removal

A recent legislative initiative to address the problem of sex trafficking facilitated through the internet has had the unintended consequence of pushing companies to preemptively remove legitimate content. On March 21, 2018, the Senate passed the "Allow States and Victims to Fight Online Sex Trafficking Act of 2017," also referred to as SESTA/FOSTA, which President Trump signed into law on April 11. The law establishes legal liability for internet services that are used to "promote or facilitate prostitution of five or more persons, or [...] acts with reckless disregard that such conduct contributes to sex trafficking."^[60] Previously, under Section 230 of the Communications Decency Act, companies would not generally be held liable for the illegal content of their users unless notified of its existence (see more on Section 230 below). Civil society advocates criticized the bill for undermining internet freedom, since companies would be forced to preemptively censor their users or face the threat of legal action.^[61] After the bill was passed by the Senate but before it became law, reports surfaced of companies already censoring content: Craigslist announced that it was removing its "Personals" section from its website altogether,^[62] and sex workers reported that they could no longer access some of their Google Drive files containing adult content.^[63] Further, sex workers and community advocates argue that the bill threatens their safety, since platforms that have been targeted – such as Backdoor, sections of Craigslist, and other online forums – made it possible for sex workers to leave exploitive situations, communicate with one another, and build protective communities.^[64]

The government does not directly censor any particular political or social viewpoints online, although legal rules do restrict certain types of content on the internet. Illegal online content, including child pornography and content that infringes on copyright, is subject to removal through a court order or similar legal process if it is hosted within the United States. Aside from these examples, government pressure on ISPs or content hosts to remove content is not a widespread issue. Social media companies and other content providers may remove content that violates their terms and conditions.^[65]

One of the most significant protections for online free expression in the United States is Section 230 of the Communications Decency Act of 1934 (CDA 230), amended by the Telecommunications Act of 1996, which generally shields online sites and services from legal liability for the activities of their users, allowing user-generated content to flourish on a variety of platforms.^[66] However, public concern over intellectual property violations, child pornography, protection of minors from harmful or indecent content, harassing or defamatory comments, publication of commercial trade secrets, gambling, financial crime, and terrorist content have presented a strong impetus for aggressive legislative and executive action, and some laws, such as SESTA/FOSTA, have threatened to undermine the broad protections for intermediaries of CDA 230.^[67]

Congress has passed several laws designed to restrict adult pornography and shield children from harmful or indecent content online, such as the Child Online Protection Act of 1998 (COPA), but these laws have been overturned by courts due to their ambiguity and potential infringements on the First Amendment of the Constitution, which protects freedom of speech and the press. On the other hand, advertisement, production, distribution, and possession of child pornography – on the internet and in all other media – is prohibited under federal law and can carry a sentence of up to 30 years in prison. According to the Child Protection and Obscenity Enforcement Act of 1988, producers of sexually explicit material must keep records proving that their models and actors are over 18 years old. In addition to prosecuting individual offenders, the Department of Justice, the Department of Homeland Security, and other law enforcement agencies have asserted their authority to seize the domain name of a website allegedly hosting child abuse images after obtaining a court order.^[68]

Intended to help protect against sex trafficking of children, the SAVE Act became law in May 2015.^[69] The final text of the legislation was changed to make it illegal to knowingly advertise content related to sex trafficking, a higher requirement than an earlier draft that would have established liability for "knowledge of" or "active disregard for the likelihood of" hosting such content.^[70] At the same time, the law still establishes federal criminal liability for third-party content, which could lead to companies choosing to over censor rather than face criminal penalties, or to limit the practice of monitoring content altogether so as to avoid "knowledge" of illegal content.^[71]

For copyright infringement claims, the removal of online content is dictated by the safe harbor provisions created in Section 512 of the Digital Millennium Copyright Act (DMCA).^[72] Operating through a "notice-and-take-down" mechanism, internet companies are shielded from liability if they remove infringing content upon receipt of a DMCA notice. However, because companies have the incentive to err on the side of caution and remove any hosted content subject to a DMCA notice, there have been occasions where overly broad or fraudulent DMCA claims have resulted in the removal of content that would otherwise be excused under free expression, fair-use, or educational provisions.^[73] In some cases, the immediate removal of content through DMCA requests has been used to target political campaign advertisements, since they result in content being unavailable during the campaign season and are unlikely to be challenged in court after the campaign ends.^[74]

Media, Diversity, and Content Manipulation

While the online environment in the United States continues to be vibrant and diverse, the growing prevalence of disinformation and partisan media over the past few years has had a significant impact on the online media landscape. Internet users continue to exercise self-censorship due to concerns of government surveillance as well as online harassment by other internet users.

The proliferation of disinformation – particularly on social media – remained a prominent concern in the aftermath of the November 2016 presidential election. Over the past year, scrutiny of social media platforms intensified, as the public learned more about how different actors spread disinformation online. In October 2017, executives from Facebook, YouTube, and Twitter were called to testify in a hearing before Congress in response to concern over revelations that Russia may have used social media platforms to spread disinformation and sow discord among the American public, particularly during the 2016 presidential election.^[75] Their testimonies revealed that 126 million Facebook users may have seen content produced by Russian operatives,^[76] while Twitter later disclosed it had discovered over 3,800 real accounts related to the Internet Research Agency in Russia and 36,000 bot accounts originating in Russia.^[77] It remains unclear what effect this content may have had on the election, though the companies have each taken steps to remove such content or accounts from their platforms.^[78]

In April 2018, Facebook founder and CEO Mark Zuckerberg testified in two congressional hearings about his company's role in the Cambridge Analytica scandal, in which it was revealed that Facebook had exposed the data of up to 87 million users to a third-party researcher, who sold that data to company Cambridge Analytica for political consulting purposes.^[79] While the focus of the hearings was largely on consumer privacy issues regarding Facebook's collection and sharing of user information, the hearings also touched on questions related to what Facebook executives knew about how Russian actors like the Internet Research Agency used Facebook's platform and to what end. In February 2018, Robert Mueller, Special Counsel for the Department of Justice, issued an indictment of Russian operatives including the Internet Research Agency.^[80] The indictment detailed ways in which the group conspired to use social media platforms, including Facebook, Instagram, Twitter, and YouTube, with the "stated goal of spread[ing] distrust towards candidates and the political system in general."^[81]

Hyperpartisan media outlets and social media users continued to flourish online and affect the visibility of and attention paid to more balanced sources of news and information.^[82] In mid-2018, several tech companies separately decided to ban and remove content from the conspiracy theorist Alex Jones for violating the companies' terms of service on hate speech.^[83] Most notably, Jones had regularly propagated a false theory that the 2012 school shooting in Sandy Hook, Connecticut, had been staged, a theory that had led to harmful threats against the victims' parents. Apple first removed podcasts from Jones' Infowars network from its iPhone Podcast app in August 2018; Facebook, Spotify, YouTube, PayPal, and eventually Twitter followed suit with similar bans and removals. In September, Apple subsequently removed the Infowars app itself from the App Store after the ban on the network's podcasts led to a spike in the app's popularity.^[84]

Trump continued to place restrictions on the press and access to information, which extended to the online sphere as well. On May 23, 2018, a federal judge ruled that President Trump's practice of blocking his critics from following his Twitter account was unconstitutional, finding that the president's Twitter feed acts as a public forum and thus blocking members of the public from interacting with the account violates the First Amendment.^[85]

Reports of self-censorship among journalists, lawyers, and everyday internet users persist. Online harassment is one of the driving forces behind self-censorship. A report published by Amnesty International in November 2017 found that 33 percent of women in the United States had experienced online harassment, and that of the women surveyed across eight countries who had experienced online harassment, 76 percent changed how they used social media as a result.^[86]

Journalists report that government pressure and threats to the security of their digital communications has had a chilling effect on their ability to investigate and publish freely in recent years. Although the Constitution includes core protections for freedom of the press, the government does bring some enforcement actions against whistleblowers and journalists. Several recent studies have concluded that the aggressiveness with which the Department of Justice investigates leaks – as well as pervasive government surveillance programs such as those disclosed by Edward Snowden in 2013 – causes journalists and writers to self-censor and raises concerns about whether they are able to protect the confidentiality of their sources.^[87]

Everyday American citizens also change their behavior in response to extensive government surveillance. A study published in Journalism & Mass Communication Quarterly in February 2016 found that priming participants with subtle reminders about mass surveillance had a chilling effect on individuals' willingness to publicly express minority opinions online.^[88]

Digital Activism

Political activity in the United States has increasingly moved online in recent years.^[89] Some of the most visible social movements over the last few years – the Black Lives Matter movement, the Women's March, the #MeToo movement, and the student-led gun control movement – have augmented on-the-ground organizing with online social media tools. A study by Crimson Hexagon and the PEORIA Project at George Washington University found that on Twitter in the fall of 2017, the #MeToo hashtag was used to talk about sexual harassment more than 7 million times.^[90]

The Black Lives Matter movement – which started in 2013 with the hashtag #blacklivesmatter – has become a prominent example of a "decentralized but coordinated"^[91] social justice movement that has strategically used social media to organize protests against police violence and shift national conversations about race. Information released by Twitter revealed that the #blacklivesmatter hashtag had been used over 12 million times since it was created, making it the third-most-used hashtag on the platform.^[92]

Violations of User Rights:

During the reporting period, a few arrests were reported in relation to online activities, while journalists and citizens were continually harassed for covering protests on social issues. Two new laws were enacted affecting privacy, surveillance, and data collection: the reauthorization of Section 702 of FISA until 2024, and the passage of the Clarifying Lawful Overseas Use of Data Act, or CLOUD.

Legal Environment

The First Amendment of the Constitution includes protections for free speech and freedom of the press. In 1997, the Supreme Court reaffirmed that online speech has the highest level of constitutional protection.^[93] Lower courts have consistently struck down attempts to regulate online content.

Companies are generally shielded from liability for the activities of their users by Section 230 of the Communications Decency Act, though the enactment of SESTA/FOSTA in April 2018 weakened liability protections in an effort to address the problem of sex trafficking facilitated online (see "Content Removal"). Meanwhile, the DMCA provides a safe harbor to intermediaries that take down allegedly infringing material after notice from the copyright owner (see "Content Removal").^[94] A number of US laws also protect speech from harmful corporate actions, including corporate surveillance that may lead users to self-censor, and failure of private actors to sufficiently protect internet users' personal information from unauthorized access (see "Surveillance, Privacy, and Anonymity").

Nonetheless, aggressive prosecution under the Computer Fraud and Abuse Act (CFAA) of 1986 has fueled criticism of the law's scope and application. It is illegal to access a computer without authorization under CFAA, but the law fails to define the term "without authorization," leaving the provision open to interpretation in the courts.^[95] In one prominent case from 2011, programmer and internet activist Aaron Swartz secretly used Massachusetts Institute of Technology servers to download millions of files from JSTOR, a service providing academic articles. Prosecutors sought harsh penalties for Swartz under CFAA, which could have resulted in up to 35 years imprisonment.^[96] Swartz committed suicide in 2013 before he was tried. After his death, a bipartisan group of lawmakers introduced "Aaron's Law," a piece of legislation that would prevent the government from using CFAA to prosecute terms of service violations and stop prosecutors from bringing multiple redundant charges for a single crime.^[97] The bill was reintroduced in 2015, but did not garner enough support to move forward.^[98]

There are no legal restrictions on user anonymity on the internet, and constitutional precedents protect the right to anonymous speech in many contexts. There are also state laws that stipulate journalists' right to withhold the identities of anonymous sources, and at least one such law has been found to apply to bloggers.^[99] The legal framework for government surveillance, however, has been open to abuse. In June 2015, President Obama signed the USA Freedom Act into law, introducing some restrictions on the way the National Security Agency (NSA) can access information about American citizens from their phone records. Other laws used to authorize surveillance have yet to be reformed (see "Surveillance, Privacy, and Anonymity").

On April 3, 2017, President Trump signed S.J. Resolution 34, which nullified the FCC's broadband privacy guidelines (see "Regulatory Bodies").^[100] The joint resolution rolled back regulations introduced in October 2016 that would have given consumers more control over how their personal information is collected and used by broadband ISPs. In contrast, several states have considered legislation to protect internet users' privacy rights.^[101] As of May 2018, the Illinois "right to know" bills (SB 1502 and HB 2774) were still being considered by the state legislature. The Minnesota bill had passed the state Senate with widespread bipartisan support but was later removed from a larger spending bill during private negotiations.^[102] On June 8, the California state legislature enacted AB 375,^[103] also known as the California Consumer Privacy Act of 2018, which allows Californians to demand information from businesses in the state about how their personal data is collected, used, and shared.^[104]

Prosecutions and Detentions for Online Activities

Prosecutions or detentions for online activities, particularly for online speech, are relatively infrequent given broad protections under the First Amendment. However, there have been prosecutions related to threats posted on social media, arrests related to filming police interactions, and problematic prosecutions under the CFAA. In addition, Customers and Border Patrol agents at international airports are increasingly forcing travelers, including American citizens, to turn over their cell phone passcodes or risk detention (see "Surveillance, Privacy, and Anonymity").

Reported arrests in relation to online activities in the past year include:

• In December 2017, police arrested Christopher Daniels, also known as Rakem Balogun, in part because of his Facebook posts that Federal Bureau of Investigation (FBI) agents claimed advocated for violence against police.^[105] Members of his community accused the FBI of targeting Daniels as a "black identity extremist." Daniels was indicted for unlawful possession of a firearm, but the charges were dropped in May.

• On April 3, 2018, Manuel Duran, a journalist who runs the local Spanish-language news website Memphis Noticias, was arrested while covering an immigration protest.^[106] Charges against him were dropped but he was detained and held by Immigration and Customs Enforcement (ICE) officials after his hearing.

Police have periodically detained individuals who uploaded images or broadcasted live video of police activity with their phones, posing a threat to First Amendment protections.^[107] Most of the arrests have been made on unrelated charges, such as obstruction or resisting arrest, since openly filming police activity is a protected right. In July 2016, police in Louisiana detained store owner Abdullah Muflahi for six hours and confiscated his cellphone after he filmed the fatal shooting of Alton Sterling by police.^[108] Chris LeDay, a Georgia-based musician who shared another video of the same incident on Facebook, was arrested soon after for unpaid traffic fines.^[109] In contrast, in July 2017, federal courts upheld the right of bystanders to use their smartphones to record police actions.^[110]

Previously, the government used the CFAA to prosecute Matthew Keys, a former Tribune Company journalist and social media editor who had given log-in credentials to the hacking group Anonymous. Keys was convicted in October 2015 and sentenced to two years' imprisonment on April 13, 2016.^[111] Some critics of CFAA argued that Keys' sentencing was overly harsh, and that many of his crimes could be charged as misdemeanors.^[112] Many states also have their own laws related to computer hacking or unauthorized access. Several smaller cases in the past few years highlighted the shortcomings and lack of proportionality of these laws.^[113]

Surveillance, Privacy, and Anonymity

During the reporting period, new laws were enacted affecting privacy, surveillance, and data collection, including the reauthorization of Section 702 of FISA until 2024 and the passage of the Clarifying Lawful Overseas Use of Data Act (CLOUD Act). Warrantless searches of travelers' cell phones at the border also continued to be a significant problem, with new policies released from Customs and Border Protection (CPB).

Modern surveillance by law enforcement in the United States is governed by the USA PATRIOT Act, which was passed following the terrorist attacks of September 11, 2001, expanding government surveillance and investigative powers in terrorism and criminal investigations.^[114] On June 2, 2015, President Obama signed the USA FREEDOM Act into law, extending expiring provisions of the PATRIOT Act, including broad authority to conduct roving wiretaps of "John Doe" targets and "lone wolf" surveillance.^[115] At the same time, the law significantly reformed the bulk collection of phone records under Section 215, a program detailed in documents leaked by former NSA contractor Edward Snowden in 2013^[116] that was later ruled illegal by the Second Circuit Court of Appeals in May 2015.^[117]

The USA FREEDOM Act replaced the bulk collection program with a system that allows the NSA to access records held by phone companies with an order from the Foreign Intelligence Surveillance court (FISA court).^[118] Requests for that access require the use of a "specific selection term" (SST) representing an "individual, account, or personal device,"^[119] which is intended to prohibit broad requests for records based on zip code or other indicators, and can only be extended or renewed in certain circumstances.^[120] The SST provision also applies when intelligence agents use FISA pen registers and trap and trace devices (instruments that will capture a phone's outgoing or incoming records) and to national security letters (secret subpoenas to request call records issued by the FBI).^[121]

The USA FREEDOM Act further changed the way private companies publicly report on government requests they receive for user information. The Department of Justice (DOJ) limits the disclosure of information about national security letters, including in the transparency reports voluntarily published by some internet companies and service providers.^[122] In 2014, the DOJ reached a settlement with Facebook, Google, LinkedIn, Microsoft, and Yahoo that would permit the companies to disclose the number of government requests they receive, but only in aggregated bands of 0-249 or 0-999.^[123] Twitter, not a party to the settlement, filed suit against the DOJ in October 2014 on grounds that the rules amounted to an unconstitutional prior restraint that violates the company's First Amendment rights.^[124] In May 2016, a judge partially dismissed Twitter's case but gave the company the opportunity to refile.^[125] The USA FREEDOM Act allows companies the option of more granular reporting, though reports containing more detail are still subject to time delays and their frequency is limited.^[126]

The USA FREEDOM Act also required that the FISA court appoint an amicus curiae, an individual (or several) qualified to provide legal arguments that "advance the protection of individual privacy and civil liberties."^[127] Five individuals are currently designated to serve as amicus curiae.^[128]

Despite these improvements, other surveillance programs revealed by the NSA leaks were authorized under laws that, though partially reformed since they were exposed in 2013, still contain scope for surveillance that lacks oversight, specificity, and transparency:

• Section 702 of FISA Amendments Act of 2008: Section 702 was used to authorize "Downstream" (also known as PRISM) and "Upstream" collection (see below), the controversial programs under which the NSA reportedly collects users' communications data – including the content – directly from US tech companies and through the physical infrastructure of undersea cables.^[129] Section 702 only authorizes the collection of information about foreign citizens, yet the content of Americans' communications incidentally swept up in this process is also collected and stored in a searchable database.^[130] The USA FREEDOM Act made no changes to this practice or to the NSA's access to the communications content collected. Rather, it limits the use of information about US citizens in court or in other government proceedings, but only if the NSA did not follow existing procedures to minimize the likelihood of collecting that information. The FISA court determines whether or not those procedures were followed.^[131]

In October 2016, during the FISA court's annual review and reauthorization of surveillance conducted under Section 702, the government notified the FISA court judge that it had reported widespread violations of protocols intended to limit access to Americans' communications by NSA analysts (these details were revealed when the information was declassified in May 2017).^[132] "Upstream" collection, which captures any communications that mention a foreign target – not just communications to and from a foreign target – is more likely than other programs to incidentally collect communications sent between US citizens, which is outside the scope of lawful surveillance.^[133] The report showed analysts had failed to take steps to ensure that they are not searching the upstream database when conducting queries.

In response, the court delayed reauthorizing the program, and in April 2017 the NSA director recommended that the agency halt its collection of Americans' communications if they merely mentioned a surveillance target (referred to as "about collection"), and instead only collect communications to and from the target.^[134] Privacy advocates welcomed the NSA decision to halt this type of collection, and emphasized that the government's findings underscore the need for legislative reform of Section 702.

As Congress prepared to reauthorize the FISA Amendments Act, including Section 702, for another six years toward the end of 2017, a bipartisan coalition of members of Congress sought to amend the draft law to include increased privacy protections. One amendment, which was cut during the drafting process, would have required officials to obtain a warrant before accessing information belonging to US citizens that is swept up in process of foreign data collection. However, the final bill, passed on January 18, 2018, did contain a similar-sounding provision^[135] requiring a warrant only in cases where an FBI agent wants to read the content of emails belonging to an American who is already part of an investigation; observers noted that the wording is too narrow to apply in most cases.^[136]

Section 702 was ultimately reauthorized with few changes and did not address the issue of "about" collection, which means that nothing in the law would prevent the NSA from restarting the program. The final text included some measures to increase transparency, such as requiring the NSA to notify Congress in the event that it resumes the practice of "about" collection, and requiring the Attorney General to brief members of Congress about how the government uses information collected under Section 702 in official proceedings such as criminal prosecutions.^[137] However, privacy and civil liberties advocates warn that the reauthorization effectively codifies some of the more problematic aspects of Section 702 surveillance practices, including "about" collection and the backdoor search loophole.^[138]

• Executive Order 12333: Originally issued in 1981, Executive Order (EO) 12333 outlines how and when the NSA or other agencies may conduct surveillance on US citizens and other individuals within the United States,^[139] authorizing the collection of US citizens' metadata and the content of communications if that data is collected "incidentally."^[140] The extent of current NSA practices authorized under EO12333 is unclear, but documents from the NSA leaks suggest that EO12333 was used to authorize the so-called MYSTIC program, which was reportedly used to capture all of the incoming and outgoing phone calls of one or more target countries on a rolling basis. The Intercept identified the Bahamas, Mexico, Kenya, and the Philippines as targets in 2014.^[141] In December 2014, Congress passed a law that included a requirement that the NSA develop "procedures for the retention of incidentally acquired communications" collected pursuant to EO12333, and that such communications may not be retained for more than five years except when subject to certain broad exceptions.^[142] In January 2015, then-president Obama updated a 2014 policy directive that put in place important new restrictions relevant to EO12333 on the use of information collected in bulk for foreign intelligence purposes.^[143] Civil society groups continue to campaign for its complete reform.^[144]

Under a set of complex statutes, US law enforcement and intelligence agencies can monitor communications content and communications records, or metadata, under varying degrees of oversight as part of criminal or national security investigations. The government may request that companies store such data for up to 180 days under the Stored Communications Act, but how they otherwise collect and store communications content and records varies by company.^[145]

Law enforcement access to metadata generally requires a subpoena issued by a prosecutor or investigator without judicial approval;^[146] a warrant is only required in California under the California Electronic Communications Privacy Act, which has been in effect since January 1, 2016.^[147] In criminal probes, law enforcement authorities can monitor the content of internet communications in real-time only if they have obtained an order issued by a judge, under a standard that is actually a little higher than the one established by the Constitution for searches of physical places. The order must reflect a finding that there is probable cause to believe that a crime has been, is being, or is about to be committed.

The status of stored communications is more uncertain. One federal appeals court has ruled that the Constitution applies to stored communications, so that a judicial warrant is required for government access.^[148] However, the 1986 Electronic Communications Privacy Act states that the government can obtain access to email or other documents stored in the cloud with a subpoena.^[149] In April 2016, the House of Representatives passed the Email Privacy Act, which would require the government to obtain a probable cause warrant before accessing email or other private communications stored with cloud service providers.^[150] The bill was reintroduced in January 2017, passed the House, and has been referred to the Committee on the Judiciary in the Senate.^[151]

The breadth of law enforcement access to user data held by companies was expanded under the Clarifying Lawful Overseas Use of Data Act, or CLOUD (S. 2328^[152] and H.R. 4943^[153] ), signed into law on March 23, 2018, as part of a government spending bill.^[154] Introduced with the intention of updating the 1986 Stored Communications Act to clarify policies governing cross-border data transfers,^[155] CLOUD determined that law enforcement requests sent to US companies for user data under the Stored Communications Act applies to data in the company's possession regardless of where it is stored, including overseas. Previous requests for user data were limited to data stored within the US's jurisdiction. CLOUD also allows foreign governments to directly petition US companies to hand over user data.^[156] Proponents of the law, including several large US tech firms,^[157] argued that the previous legal framework was outdated and cumbersome, requiring law enforcement to go through the potentially lengthy mutual legal assistance treaty (MLAT) process between countries to obtain information pertaining to local crimes because that data happens to be stored overseas.^[158] Civil liberties advocates argue that the law undermines privacy by giving governments new powers to compel companies to hand over user data.^[159]

In addition to surveilling private communications, law enforcement agencies have also monitored websites and social media platforms for suspected criminal activity. In October 2016, the ACLU reported that police were conducting social media surveillance using a tool called Geofeedia, which allows users to aggregate social media content by location (such as a protest site); the company specifically marketed its service to law enforcement agencies.^[160] Following the ACLU's report, Facebook, Twitter, and Instagram shut off Geofeedia's access to their data.^[161]

In recent years, there has been a significant increase in warrantless searches of travelers' cell phones by border agents when they attempt to enter the United States, tripling from 857 searches in October 2015 to 2,560 searches in October 2016.^[162] In one case, an American NASA engineer who was flying back from South America was detained and told to hand over the passcode for his phone, even though it was the property of the NASA lab where he worked.^[163] On April 4, 2017, several senators introduced legislation that would require border patrol agents to obtain a warrant before searching the contents of a cell phone, and would prohibit agents from detaining people for more than four hours while trying to get them to unlock their phones. As of mid-2018, the bill had not been voted on.^[164] Meanwhile, in March 2018, the Trump administration announced plans to require anyone applying to immigrate to the United States to submit five years of social media history.^[165]

User data is otherwise protected under Section 5 of the Federal Trade Commission Act (FTCA), which has been interpreted to prohibit internet entities from deceiving users about what personal information is being collected and how it is being used, as well as from using personal information in ways that harm users without offering countervailing benefits. In addition, the FTCA has been interpreted to require entities that collect users' personal information to adopt reasonable security measures to safeguard it from unauthorized access. State-level laws in 47 states and the District of Columbia also require entities that collect personal information to notify consumers – and, usually, consumer protection agencies – when they suffer a security breach leading to unauthorized access of personal information. Section 222 of the Telecommunications Act prohibits telecommunications carriers from sharing or using information about their customers' use of the service for other purposes without customer consent. This provision has historically only applied to phone companies' records about phone customers, but following the FCC's net neutrality order, it also applied to ISPs' records about broadband customers.^[166]

While there are no legal restrictions on anonymous communication online, some social media platforms require users to register using their real names through Terms of Service or other contracts.^[167] Online anonymity has been challenged in cases involving hate speech, defamation, or libel. In one recent example, a Virginia court tried to compel the crowdsourced review platform Yelp to reveal the identities of anonymous users, before the Supreme Court of Virginia ruled that it did not have the authority.^[168]

Recent cases have also raised the question of the degree to which the courts can force technology companies to comply with court orders, particularly those that would require the companies to alter their products. Following a terrorist attack in San Bernardino in December 2015, the federal government sought to compel Apple to unlock a passcode-protected iPhone belonging to one of the perpetrators. Because some iPhones are programmed to permanently block access to all of the phone's encrypted data once an incorrect passcode is entered too many times, the government issued a court order that would compel Apple to create new software enabling the FBI to access the phone.^[169] Security experts argued that requiring companies to create "backdoors" for law enforcement to access encrypted data would undermine security and public trust.^[170]

Conversely, there have been efforts to codify rules that would bar the government from requiring surveillance backdoors. In June 2018, a bipartisan effort renewed a push to pass the Encrypt Act that would prohibit state and local governments from mandating "backdoor" access to devices.^[171] The bill had originally been introduced in 2016.

Despite vigorous debate, there have been no legislative changes regarding the use of encryption, nor is there any indication that the government is currently planning to move forward with the technical solutions it has proposed.^[172] While the Communications Assistance for Law Enforcement Act (CALEA) currently requires telephone companies, broadband carriers, and interconnected Voice over Internet Protocol (VoIP) providers to design their systems so that communications can be easily intercepted when government agencies have the legal authority to do so, it does not cover online communications tools such as Gmail, Skype, and Facebook.^[173] Calls to update CALEA to cover online applications and communications have not been successful. In 2013, 20 technical experts published a paper explaining why such expansion (known as "CALEA II") would create significant internet security risks.^[174]

Other legal implications of law enforcement access to devices have been debated in the courts. In March 2016, a Maryland state appellate court issued a ruling stating that law enforcement must obtain a warrant before using "covert cell phone tracking devices" known by the product name Stingray.^[175] Several court decisions subsequently affirmed that police must obtain a warrant before using these devices.^[176] Stingray devices act like cell phone towers, causing nearby cell phones to send identifying information and thus allowing law enforcement to track targeted phones or determine the phone numbers of people in a nearby area. In its decision, the Maryland court rejected the argument that individuals are effectively "volunteering" their private information when they choose to turn on their phones, since doing so allows third parties (the phone company's cell towers) to send and receive signals from the phone.^[177] This was the first court decision addressing whether a warrant is required in the use of Stingray devices.^[178]

On May 18, 2017, The Detroit News obtained court documents showing that police had used Stingray devices to find and arrest an undocumented immigrant.^[179] Privacy advocates argue that because Stingray devices collect information from cell phones in the area surrounding the target, and thus constitute mass surveillance, their use by law enforcement should be limited to serious cases involving violent crimes, not immigration violations.^[180]

In a positive development, on June 22, 2018 (outside of this report's coverage period), the Supreme Court ruled on a significant decision regarding access to device data in the case of Carpenter v. United States. Ruling in favor of the plaintiff, the court decided that the government is required to obtain a warrant in order to collect subscriber location information records from third parties like cell phone providers.^[181] Privacy advocates lauded the decision, noting that the privacy protections of cell phone location information have broader impacts on the privacy protections of other information that companies collect and store about their users.^[182] The decision also significantly diminishes the third-party doctrine, or the idea that Fourth Amendment protections to privacy do not extend to most types of information one voluntarily hands over to third parties (such as telecommunications companies).^[183] While the full impact of this decision on the privacy landscape in the United States will continue to unfold for years to come, it is regarded as a step forward in protecting people's private information from unwarranted and unfettered government access.

Intimidation and Violence

Journalists continue to face increased levels of harassment and threats online. An issue that has become more prominent during the #MeToo movement is the plight of female journalists, who face "rampant online gendered harassment" in the course of doing their jobs, according to a study published in April 2018.^[184] Journalists also face threats for writing about political topics, particularly in the highly charged and often vitriolic environment of online public discourse. Several journalists have reported being doxxed – having their home addresses, phone numbers, and other personal details posted online – and have received violent threats directed at themselves or their family members, causing them to think twice before writing about potentially controversial topics.^[185]

Harassment and threats online, particularly aimed at certain groups, also undermined the ability of users to exercise their rights to freedom of expression. The Pew Research Center found that one in four black Americans has faced online harassment because of their race or ethnicity.^[186] A report by Amnesty International found that 33 percent of women in the United States had experienced online abuse or harassment at least once.^[187]

The growing trend of citizens filming or livestreaming protests with mobile devices has been met with undue harassment at the hands of the authorities. Researcher Dragana Kaurin interviewed people who had used their phones to film high-profile videos of the violent arrests and police killings of African Americans – including Freddie Gray, Eric Garner, Walter Scott, Philando Castile, Alton Sterling, and others – in recent years. Her research documented numerous reports of police retaliation, harassment, physical violence, doxxing, and other forms of intimidation to deter community members from filming police brutality.^[188]

For example, in September and October 2017, journalists and citizen "vloggers" (video bloggers) covering protests in St. Louis, Missouri, were subjected to pepper spray and arrest or detainment by police:^[189]

• Independent live-streamer and photographer Heather DeMain was pepper sprayed by police while covering the protests on September 29.^[190]

• Independent live-streamer Jon Ziegler was arrested and pepper sprayed while covering protests on September 17. Though he was arrested amid police "kettling," during which about a hundred people were boxed in and arrested indiscriminately, it appears that several of the police officers recognized Ziegler from his work.^[191]

• On October 3, several more arrests took place, and Jon Ziegler was arrested for a second time. Two journalists, a reporter and a cameraman, from the online news outlet The Young Turks were also arrested, despite the fact that they were wearing press badges and informed police officers that they were journalists.^[192]

Besides while at protests, bloggers and other ICT users generally are not subject to extralegal intimidation or violence from state actors. However, police have used intimidation and threats to discourage bystanders from filming or uploading footage, particularly surrounding protests related to police violence against African Americans, despite citizens' legal right to film police interactions openly if they are not interfering with police activities.

Technical Attacks

Cyberattacks continue to threaten the security of networks and databases in the United States. In May 2017, a massive cyberattack dubbed "WannaCry" infected hundreds of thousands of computers and spread through networks around the world, freezing users' files and demanding payment to unlock them.^[193] Though the impact on the United States was less severe than other countries, it did affect several corporations and health care networks.^[194] In December 2017, the US government officially blamed North Korea for the attack.^[195]

In March 2018, the Trump administration publicly accused Russia of targeting US infrastructure in a series of cyberattacks that began in late 2015. The attacks targeted US and European nuclear power plants and water and electrical systems, compromising some of them, though the attacks did not go so far as to shut down these systems.^[196]

In response to these incidents and others, the United States has taken a series of legal and policy measures to address growing cyber threats. On May 11, 2017, President Trump issued an executive order on "Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure," which holds government agency heads accountable for securing the IT infrastructure of their departments, and promotes sharing IT resources across agencies in order to secure a "more resilient executive branch IT architecture."^[197]

In December 2015, President Obama signed an omnibus bill that included a version of the Cybersecurity Information Sharing Act already passed in the Senate. The law requires the Department of Homeland Security to share information about threats with private companies, and allows companies to voluntarily disclose information to federal agencies without fear of being sued for violating user privacy.^[198] Civil liberties advocates said that privacy protections in the final text of the bill were not strong enough, and valuable requirements had been eliminated from earlier drafts that would have removed from disclosures any personal information not needed to identify cybersecurity threats. Critics also said that allowing companies to voluntarily disclose data to any federal agency – including the Department of Defense and the NSA – undermines civilian control of cybersecurity programs and blurs the line between the use of this data for cybersecurity and law enforcement purposes.^[199]

Notes:

1 International Telecommunication Union, "Percentage of Individuals Using the Internet, 2000-2016," http://bit.ly/1FDwW9w.

2 "Internet broadband fact sheet," Pew Research Center, January 2018, http://www.pewinternet.org/fact-sheet/internet-broadband/

3 OECD Broadband Statistics, "OECD Fixed (Wired) Broadband Subscriptions per 100 Inhabitants, by Technology, June 2014," December 2014, http://bit.ly/1cP4RGV; "OECD Terrestrial Mobile Wireless Broadband Subscriptions per 100 Inhabitants, by Technology, June 2014."

4 Andrew Perrin, "Digital gap between rural and nonrural Americans persists," Pew Research Center, May 19, 2017, http://www.pewresearch.org/fact-tank/2017/05/19/digital-gap-between-rural-and-nonrural-america-persists/.

5 "Internet / Broadband Factsheet," Pew Research Center, February 5, 2018, http://www.pewinternet.org/fact-sheet/internet-broadband/

6 "The Cost of Connectivity 2014," Open Technology Institute, October 30, 2014, https://www.newamerica.org/oti/policy-papers/the-cost-of-connectivity-2014/.

7 John D. McKinnon, "Phone Subsidy for Poor Could Expand to Include Broadband," Wall Street Journal, March 8, 2016, https://www.wsj.com/articles/phone-subsidy-for-poor-could-expand-to-include-broadband-1457460517.

8 https://transition.fcc.gov/Daily_Releases/Daily_Business/2017/db1201/FCC-17-155A1.pdf

9 https://www.newamerica.org/oti/press-releases/fcc-passes-proposal-would-destroy-lifeline-program/

10 https://www.brookings.edu/blog/the-avenue/2017/11/27/rollback-of-the-fccs-lifeline-program-can-hurt-households-that-need-broadband-the-most/

11 "Mobile Fact Sheet," Pew Research Center, February 5, 2018, http://www.pewinternet.org/fact-sheet/mobile/

12 Monica Anderson, "More Americans using smartphones for getting directions, streaming TV," Pew Research Center, January 29, 2016, http://www.pewresearch.org/fact-tank/2016/01/29/us-smartphone-use/.

13 Aaron Smith, Smartphone Use in 2015, Pew Research, http://pewrsr.ch/19JDwMd.

14 The Electronic Privacy Information Center (EPIC) filed suit against the Department of Homeland Security (DHS) in 2013 for information about the protocol. After winning an appeal in the DC Circuit, the DHS retained exemption from disclosing SOP 303, and in July of 2015 released a redacted version of the protocol. Electronic Privacy Information Center, EPIC v. DHS – SOP 303, http://bit.ly/1GscPWS; Electronic Privacy Information Center, SOP 303 Updated Release, http://bit.ly/1WI9hZV.

15 Electronic Privacy Information Center, EPIC v. DHS – SOP 303.

16 Melissa Bell, "BART San Francisco Cut Cell Services to Avert Protest," The Washington Post, August 12, 2011, http://wapo.st/1GscX8T

17 Federal Communications Commission, WARNING: Jammer Use Is Prohibited, December 8, 2014, http://fcc.us/1L1RV2O.

18 Meg Jones, "California regulators approve Charter's takeover of Time Warner Cable," Los Angeles Times, May 12, 2016, http://www.latimes.com/entertainment/envelope/cotown/la-et-ct-charter-puc-20160512-snap-story.html.

19 Jon Brodkin, "Comcast and Charter may soon control 70% of 25Mbps Internet subscriptions," ArsTechnica, January 26, 2016, http://arstechnica.com/business/2016/01/comcast-and-charter-may-soon-control-70-of-25mbps-internet-subscriptions/.

20 Jon Brodkin, "Cable expands broadband domination as AT&T and Verizon lose customers," Ars Technica, August 16, 2016, https://arstechnica.com/information-technology/2016/08/cable-expands-broadband-domination-as-att-and-verizon-lose-customers/.

21 Prepared Remarks of Federal Communications Commission Chairman (FCC) Tom Wheeler "The Facts and Future of Broadband Competition". September 4, 2014 https://apps.fcc.gov/edocs_public/attachmatch/DOC-329161A1.pdf

22 https://www.nytimes.com/2018/06/14/business/media/att-time-warner-injunction.html

23 https://www.nytimes.com/2018/07/12/business/justice-department-plans-appeal-of-att-time-warner-merger-approval.html

24 Meg Jones, "California regulators approve Charter's takeover of Time Warner Cable," Los Angeles Times, May 12, 2016, http://www.latimes.com/entertainment/envelope/cotown/la-et-ct-charter-puc-20160512-snap-story.html.

25 Jon Brodkin, "Comcast and Charter may soon control 70% of 25Mbps Internet subscriptions," ArsTechnica, January 26, 2016, http://arstechnica.com/business/2016/01/comcast-and-charter-may-soon-control-70-of-25mbps-internet-subscriptions/.

26 Federal Communications Commission, "Statement from FCC Chairman Tom Wheeler on the Comcast-Time Warner Cable Merger," news release, April 24, 2015, http://bit.ly/1OfzSug; U.S. Department of Justice, "Comcast Corporation Abandons Proposed Acquisition of Time Warner Cable After Justice Department and Federal Communications Commission Informed Parties of Concerns," press release, April 24, 2015, http://1.usa.gov/1Qrf57U.

27 Mike Dano, "How Verizon, AT&T, T-Mobile, Sprint, and more stacked up in Q2 2016," Fierce Wireless, August 15, 2016, http://www.fiercewireless.com/wireless/how-verizon-at-t-t-mobile-sprint-and-more-stacked-up-q2-2016-top-7-carriers.

28 https://www.npr.org/sections/thetwo-way/2018/04/29/606900032/t-mobile-sprint-announce-a-plan-for-merger

29 Michael J. De La Merced, "Sprint and Softbank End Their Pursuit of a T-Mobile Merger," DealB%k (blog), New York Times, August 5, 2014, http://nyti.ms/1KW0LBh.

30 Colin Lecher, "How the FCC's massive airways auction will change America – and your phone service," The Verge, April 21, 2016, http://www.theverge.com/2016/4/21/11481454/fcc-broadcast-incentive-auction-explained.

31 The White House, Office of the Press Secretary, "FACT SHEET: Broadband That Works: Promoting Competition & Local Choice In Next-Generation Connectivity," press release, January 13, 2015, http://1.usa.gov/1GUJIQ9.

32 Federal Communications Commission, "FCC Grants Petitions to Preempt State Laws Restricting Community Broadband in North Carolina, Tennessee," news release, February 26, 2015, http://bit.ly/1Z3DrZO.

33 See State of TN vs. FCC, http://www.ca6.uscourts.gov/case_reports/rptPendingAgency.pdf; Brian Fung, "Cities looking to compete with large Internet providers just suffered a big defeat," Washington Post, August 1-, 2016, https://www.washingtonpost.com/news/the-switch/wp/2016/08/10/the-government-just-lost-a-big-court-battle-over-public-internet-service/.

34 David Shepardson, "Trump taps net neutrality opponent Ajit Pai to head FCC," Reuters, January 23, 2017, http://www.reuters.com/article/us-usa-trump-fcc-idUSKBN1572RK.

35 Jim Puzzanghera, "FCC halts Internet privacy rule that imposes data security requirements on broadband providers," Los Angeles Times, March 1, 2017, http://www.latimes.com/business/la-fi-fcc-privacy-delay-20170301-story.html.

36 Federal Communications Commission, "FCC Adopts Privacy Rules to Give Broadband Consumers Increased Choice, Transparency and Security for Their Personal Data," October 27, 2016, https://apps.fcc.gov/edocs_public/attachmatch/DOC-341937A1.pdf.

37 Brian Fung, "Republicans voted to roll back landmark FCC privacy rules. Here's what you need to know," Washington Post, March 28, 2017, https://www.washingtonpost.com/news/the-switch/wp/2017/03/28/republicans-are-poised-to-roll-back-landmark-fcc-privacy-rules-heres-what-you-need-to-know/?utm_term=.ac278467b9c0.

38 Mike Snider, "How set to unplug broadband privacy rules," USA Today, March 28, 2017, https://www.usatoday.com/story/tech/news/2017/03/28/house-set-unplug-broadband-privacy-rules/99707178/.

39 https://www.wsj.com/articles/fcc-ends-zero-rating-review-1486157682

40 https://www.wired.com/2017/02/fcc-oks-streaming-free-net-neutrality-will-pay/

41 https://www.fcc.gov/document/fcc-releases-restoring-internet-freedom-order

42 https://www.washingtonpost.com/news/the-switch/wp/2017/12/14/the-fcc-is-expected-to-repeal-its-net-neutrality-rules-today-in-a-sweeping-act-of-deregulation/?utm_term=.08592864e476

43 https://apps.fcc.gov/edocs_public/attachmatch/FCC-17-166A2.pdf

44 https://www.newamerica.org/oti/press-releases/ignoring-widespread-and-bipartisan-opposition-fcc-votes-kill-net-neutrality-rules/

45 https://www.publicknowledge.org/press-release/fcc-abandons-consumer-protection-responsibility-with-net-neutrality-repeal

46 https://cdt.org/press/the-fcc-moves-to-destroy-the-open-internet-by-overturning-net-neutrality-protections/;

47 https://www.newamerica.org/oti/blog/american-people-broadly-support-net-neutrality/; https://www.washingtonpost.com/news/the-switch/wp/2017/12/12/this-poll-gave-americans-a-detailed-case-for-and-against-the-fccs-net-neutrality-plan-the-reaction-among-republicans-was-striking/?utm_term=.5d0f9dd1335b, http://www.publicconsultation.org/wp-content/uploads/2017/12/Net_Neutrality_Quaire_121217.pdf; https://www.cnbc.com/2017/11/28/net-neutrality-loses-support-poll-from-morning-consult-and-politico.html.

48 https://ag.ny.gov/sites/default/files/petition_-_filed.pdf

49 https://blog.mozilla.org/wp-content/uploads/2018/01/AS-FILED-Mozilla-Protective-Petition-16Jan2018-1.pdf

50 https://www.publicknowledge.org/press-release/public-knowledge-files-protective-petition-in-dc-circuit-regarding-net-ne

51 https://www.newamerica.org/oti/press-releases/oti-challenges-fcc-chairman-pais-net-neutrality-repeal-filing-protective-petition-review-dc-circuit/

52 https://www.freepress.net/sites/default/files/resources/free_press_petition_for_review.pdf

53 https://www.wired.com/story/states-and-cities-keep-the-battle-for-net-neutrality-alive/

54 https://arstechnica.com/tech-policy/2018/02/fccs-attempt-to-kill-net-neutrality-challenged-by-new-washington-state-law/; https://www.sfchronicle.com/business/article/First-of-two-California-net-neutrality-bills-move-12535116.php https://www.sfchronicle.com/business/article/First-of-two-California-net-neutrality-bills-move-12535116.php

55 https://www.cnn.com/2018/10/01/tech/california-net-neutrality-law/index.html

56 https://www.newamerica.org/oti/blog/one-year-our-updated-progress-report-fcc-chairman-ajit-pai/; https://www.nytimes.com/2017/02/10/opinion/an-anti-consumer-agenda-at-the-fcc.html; https://motherboard.vice.com/en_us/article/j5qzm8/democratic-lawmakers-blast-trumps-fcc-for-anti-consumer-agenda

57 National Conference of State Legislators, "Laws Relating to Filtering, Blocking, and Usage Policies in Schools and Libraries," June 12, 2015, http://bit.ly/1zvIfGT.

58 American Library Association, "Public Library Funding Landscape," 2011-2012, accessed June 4, 2015, 15, http://bit.ly/1KW2uql.

59 See, e.g., Bradburn v. North Central Regional Library District (Washington state Supreme Court) No. 82200-0 (May 6, 2010); Bradburn v. NCLR, No. CV-06-327-EFS (E.D. Wash. April 10, 2013).

60 https://www.congress.gov/bill/115th-congress/house-bill/1865

61 https://www.eff.org/deeplinks/2018/03/how-congress-censored-internet

62 https://www.craigslist.org/about/FOSTA

63 https://motherboard.vice.com/en_us/article/9kgwnp/porn-on-google-drive-error

64 https://motherboard.vice.com/en_us/article/neqxaw/sex-trafficking-bill-sesta-fosta-vote; https://survivorsagainstsesta.org/the-impact-of-sesta-fosta/

65 Justin Fenton, "Korryn Gaines case: Video posting by suspects poses new challenges for police," Baltimore Sun, August 3, 2016, http://www.baltimoresun.com/news/maryland/crime/bs-md-ci-facebook-police-deactivate-20160803-story.html.

66 47 U.S.C. §230 (1998), http://bit.ly/1hlnlbP; see Electronic Frontier Foundation, "Section 230 of the Communications Decency Act," http://bit.ly/1EYGbk1.

67 Scott Higham and Ellen Nakashima, "Why the Islamic State leaves tech companies torn between free speech and security," Washington Post, July 16, 2015, http://wapo.st/1O9SVUQ.

68 Treating domain names as property subject to criminal forfeiture, 18 U.S.C. §2253.

69 The Justice for Victims of Trafficking Act of 2015, Pub. L 144-22, May 29, 2015, https://www.congress.gov/bill/114th-congress/senate-bill/178.

70 Sophia Cope and Adi Kamdar, "SAVE Act Passes in House, Comes One Step Closer to Unnecessarily Chilling Online Speech," Electronic Frontier Foundation, January 29, 2015, https://www.eff.org/deeplinks/2015/01/save-act-passes-house-coming-one-step-closer-chilling-online-speech.

71 "Coalition Statement in Opposition to Federal Criminal Publishing Liability," Center for Democracy and Technology, January 29, 2015, https://cdt.org/insight/coalition-statement-in-opposition-federal-criminal-publishing-liability/.

72 17 U.S.C.§ 512, https://www.law.cornell.edu/uscode/text/17/512.

73 Electronic Frontier Foundation, "Lenz v. Universal," https://www.eff.org/cases/lenz-v-universal.

74 Electronic Frontier Foundation, "Once Again, DMCA Abused to Target Political Ads," November 17, 2015, https://www.eff.org/deeplinks/2015/11/once-again-dmca-abused-target-political-ads.

75 https://www.washingtonpost.com/news/the-switch/wp/2017/10/31/facebook-google-and-twitter-are-set-to-testify-on-capitol-hill-heres-what-to-expect/

76 https://www.washingtonpost.com/news/the-switch/wp/2017/10/31/facebook-google-and-twitter-are-set-to-testify-on-capitol-hill-heres-what-to-expect/?utm_term=.e8f7761db96e

77 https://www.recode.net/2018/1/19/16911538/twitter-russia-congress-2016-election-trump

78 https://www.facebook.com/zuck/posts/10104771321644971; https://techcrunch.com/2017/10/11/google-shuts-youtube-channel-implicated-in-kremlin-political-propaganda-ops/; https://www.recode.net/2018/1/19/16911538/twitter-russia-congress-2016-election-trump.

79 https://www.nytimes.com/2018/04/04/us/politics/cambridge-analytica-scandal-fallout.html

80 https://www.justice.gov/file/1035477/download

81 https://www.justice.gov/file/1035477/download, p. 6

82 "CPJ chairman says Trump is threat to press freedom," Committee to Protect Journalists, October 13, 2016, https://cpj.org/2016/10/cpj-chairman-says-trump-is-threat-to-press-freedom.php

83 https://www.theverge.com/2018/10/2/17930534/apple-ceo-tim-cook-alex-jones-infowars-ban-independent-decision

84 https://www.businessinsider.com/infowars-app-downloads-spike-on-iphone-after-apple-removes-alex-jones-show-podcast-2018-8; https://www.nytimes.com/2018/09/07/business/infowars-app-alex-jones-appl...

85 https://www.nytimes.com/2018/05/23/business/media/trump-twitter-block.html

86 https://www.amnesty.org/en/latest/news/2017/11/amnesty-reveals-alarming-impact-of-online-abuse-against-women/

87 Human Rights Watch and American Civil Liberties Union, With Liberty to Monitor All: How Large-Scale US Surveillance is Harming Journalism, Law and American Democracy, 2014, http://bit.ly/1uz3CL1; PEN America, Global Chilling: The Impact of Mass Surveillance on International Writers, January 5, 2015, http://bit.ly/1VBgCYT; see also PEN America, Chilling Effects: NSA Surveillance Drives U.S. Writers to Self-Censor, November 2013, http://bit.ly/1rZ3LXt; and Jesse Holcomb, Amy Mitchell, and Kristen Purcell, Investigative Journalists and Digital Security: Perceptions of Vulnerability and Changes in Behavior, Pew Research Center, February 5, 2015, http://pewrsr.ch/1xqJh6i.

88 Elizabeth Stoycheff, "Under Surveillance: Examining Facebook's Spiral of Silence Effects in the Wake of NSA Internet Monitoring," Journalism & Mass Communication Quarterly, 2016, http://m.jmq.sagepub.com/content/early/2016/02/25/1077699016630255.full.pdf; Karen Turner, "Mass surveillance silences minority opinions, according to study," Washington Post, March 28, 2016,https://www.washingtonpost.com/news/the-switch/wp/2016/03/28/mass-surveillance-silences-minority-opinions-according-to-study/.

89 Karen Mossberger et al., "Digital Citizenship: Broadband, Mobile Use, and Activities Online," (paper presented at International Political Science Association conference, Montreal, Canada, July 2014), http://paperroom.ipsa.org/papers/paper_36182.pdf.

90 https://www.washingtonpost.com/news/the-intersect/wp/2018/01/22/how-metoo-really-was-different-according-to-data/?utm_term=.b33cbcf58567

91 Bijan Stephen, "How Social Media Helps Black Lives Matter Fight the Power," Wired, November 2015, https://www.wired.com/2015/10/how-black-lives-matter-uses-social-media-to-fight-the-power/.

92 Tanya Sichynsky, "These 10 Twitter hashtags changed the way we talk about social issues," Washington Post, March 21, 2016, https://www.washingtonpost.com/news/the-switch/wp/2016/03/21/these-are-the-10-most-influential-hashtags-in-honor-of-twitters-birthday/?utm_term=.64b45645b2d3.

93 Reno, Attorney General of the United States, et al. vs. American Civil Liberties Union et al, 521 U.S. 844 (1997), http://bit.ly/1OT33VQ.

94 Center for Democracy and Technology, "Intermediary Liability: Protecting Internet Platforms for Expression and Innovation," April 2010, http://bit.ly/1hlr3Cj.

95 Electronic Frontier Foundation, "Computer Fraud and Abuse Act Reform," accessed May 14, 2014, https://www.eff.org/issues/cfaa

96 "Deadly Silence: Aaron Swartz and MIT," The Economist, August 3, 2013, http://econ.st/1L21COJ.

97 Representative Zoe Lofgren, official website, "Rep Zoe Lofgren Introduces Bipartisan Aaron's Law," press release, June 20, 2013, http://1.usa.gov/1QUsnbx.

98 Kaveh Waddell, "'Aaron's Law' Reintroduced as Lawmakers Wrestle Over Hacking Penalties," National Journal, April 21, 2015, http://bit.ly/1Pf4m0u.

99 "Apple v. Does," Electronic Frontier Foundation, accessed August 1, 2012, http://www.eff.org/cases/apple-v-does

100 S,J. Resolution 34 – 115th Congress (2017-2018); Public Law no. 115-22, April 3, 2017, https://www.congress.gov/bill/115th-congress/senate-joint-resolution/34.

101 Jon Brodkin, "ISP privacy rules could be resurrected by states, starting in Minnesota," Ars Technica, March 31, 2017, https://arstechnica.com/tech-policy/2017/03/isp-privacy-rules-could-be-resurrected-by-states-starting-in-minnesota/; See also: Conor Dougherty, "Push for Internet Privacy Rules Moves to Statehouses," New York Times, March 26, 2017,https://www.nytimes.com/2017/03/26/technology/internet-privacy-state-legislation-illinois.html?_r=0.

102 Erin Golden, "Internet privacy measure removed as lawmakers debate budget," Star Tribune, May 2, 2017, http://www.startribune.com/internet-privacy-measure-removed-as-lawmakers-debate-budget/421030613/.

103 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375

104 https://money.cnn.com/2018/06/28/technology/california-consumer-privacy-act/index.html

105 https://foreignpolicy.com/2018/01/30/is-a-court-case-in-texas-the-first-prosecution-of-a-black-identity-extremist/

106 https://pressfreedomtracker.us/all-incidents/journalist-manuel-duran-arrested-while-covering-immigration-protest-could-be-deported-ice/

107 Frank Eltman, "Citizens filming police often find themselves arrested," Albuquerque Journal, August 30, 2015, http://www.abqjournal.com/636460/citizens-filming-police-often-find-themselves-arrested.html.

108 Democracy Now! "Meet Abdullah Muflahi: He Filmed Alton Sterling Shooting and Was Then Detained by Baton Rouge Police," July 13, 2016, https://www.democracynow.org/2016/7/13/meet_abdullah_muflahi_he_filmed_alton.

109 Rachel Ravesz, "Alton Sterling shooting: Man who posted video of killing arrested," The Independent, July 15, 2016, http://www.independent.co.uk/news/world/americas/alton-sterling-shooting-man-who-posted-video-of-killing-arrested-and-allegedly-harassed-by-police-a7139241.html.

110 https://www.theatlantic.com/politics/archive/2017/07/a-major-victory-for-the-right-to-record-police/533031/

111 Christopher Mele, "Matthew Keys Gets 2 Years in Prison in Los Angeles Times Hacking Case," New York Times, April 13, 2016, http://www.nytimes.com/2016/04/14/business/media/matthew-keys-gets-2-years-in-prison-in-los-angeles-times-hacking-case.html.

112 Kim Zetter, "Matthew Keys Sentenced to Two Years for Aiding Anonymous," Wired, April 13, 2016, https://www.wired.com/2016/04/journalist-matthew-keys-sentenced-two-years-aiding-anonymous/.

113 Joe Johnson, "Georgia Tech student who hacked into UGA computer network gets pretrial diversion," Athens Banner-Herald, February 26, 2015, http://bit.ly/1FSEllk; See also: Josh Solomon, "Middle school student charged with cybercrime in Holiday," Tampa Bay Times, April 9, 2015, http://bit.ly/1ybpTBg.

114 "Patriot Act Excesses," New York Times, October 7, 2009, http://www.nytimes.com/2009/10/08/opinion/08thu1.html.

115 "USA Freedom Act: What's in, what's out," Washington Post, June 2, 2015, https://www.washingtonpost.com/graphics/politics/usa-freedom-act/.

116 E.g. Glenn Greenwald, "NSA Collecting Phone Records of Millions of Verizon Customers Daily," The Guardian, June 5, 2013, http://www.guardian.co.uk/world/2013/jun/06/nsa-phone-records-verizon-court-order.

117 Marty Lederman, "BREAKING: Second Circuit rules that Section 215 does not authorize telephony bulk collection program," Just Security, May 7, 2015, http://bit.ly/1j9kTqO.

118 Aarti Shahani, "Phone Carriers Are Tight-Lipped On How They Will Comply With New Surveillance Law," NPR, June 4, 2015, http://www.npr.org/sections/alltechconsidered/2015/06/04/411870819/phone-carriers-are-tight-lipped-over-law-that-overhauls-nsa-surveillance.

119 Rainey Reitman, "The New USA Freedom Act: A Step in the Right Direction, but More Must Be Done," Electronic Frontier Foundation, April 30, 2015, https://www.eff.org/deeplinks/2015/04/new-usa-freedom-act-step-right-direction-more-must-be-done.

120 "USA Freedom Act of 2015," Council on Foreign Relations, June 2, 2015, http://www.cfr.org/intelligence/usa-freedom-act-2015/p36594.

121 Uniting and Strengthening America by Fulfilling Rights and Ensuring Effective Discipline Over Monitoring Act of 2015 (USA FREEDOM Act), Pub. L. 114-23, June 1, 2015, https://www.congress.gov/bill/114th-congress/house-bill/2048/text.

122 Craig Timberg & Adam Goldman, "U.S. to Allow Companies to Disclose More Details on Government Requests for Data," Washington Post, January 27, 2014, http://wapo.st/LhuLxw.

123 Office of the Deputy Attorney General, email correspondence fto Facebook, Google, LinkedIn, Microsoft, and Yahoo general counsels, January 27, 2014, http://1.usa.gov/1IuJYqL.

124 Ben Lee, "Taking the fight for #transparency to court," Twitter Blog, October 7, 2014, http://bit.ly/Zc3Mtm; Alexei Oreskovic, "Twitter Sues U.S. Justice Department for Right to Reveal Surveillance Requests," Reuters, October 7, 2014, http://reut.rs/1yLKbRe.

125 "Twitter lawsuit partly dismissed over U.S. information requests," Reuters, May 2, 2016, http://www.reuters.com/article/us-twitter-government-ruling-idUSKCN0XT1RK

126 For additional information on reporting standards, please reference: USA Freedom Act, H.R. 2048 (2015), http://1.usa.gov/1jKsHzc.

127 USA FREEDOM Act of 2015, Sec. 401.

128 United States Foreign Intelligence Surveillance Court, "Amici Curiae," http://www.fisc.uscourts.gov/amici-curiae.

129 Brett Max Kaufman, "A Guide to What We Know About the NSA's Dragnet Searches of Your Communications," ACLU, August 9, 2013, https://www.aclu.org/blog/guide-what-we-now-know-about-nsas-dragnet-searches-your-communications.

130 Dia Kayyali, "The Way the NSA Uses Section 702 is Deeply Troubling. Here's Why." Electronic Frontier Foundation, May 7, 2014, https://www.eff.org/deeplinks/2014/05/way-nsa-uses-section-702-deeply-troubling-heres-why.

131 See USA FREEDOM Act of 2015, Sec. 301, and 50 U.S.C. 1881a(i)(3), available at: https://www.gpo.gov/fdsys/pkg/USCODE-2011-title50/pdf/USCODE-2011-title50-chap36-subchapVI-sec1881a.pdf.

132 Charlie Savage, "How Trump's NSA Came to End a Disputed Type of Surveillance," New York Times, May 11, 2017, https://www.nytimes.com/2017/05/11/us/politics/nsa-surveillance-trump.html.

133 Charlie Savage, "How Trump's NSA Came to End a Disputed Type of Surveillance," New York Times, May 11, 2017, https://www.nytimes.com/2017/05/11/us/politics/nsa-surveillance-trump.html.

134 Charlie Savage, "N.S.A. Halts Collection of Americans' Emails About Foreign Targets," New York Times, April 28, 2017, https://www.nytimes.com/2017/04/28/us/politics/nsa-surveillance-terrorism-privacy.html.

135 https://www.congress.gov/bill/115th-congress/senate-bill/139/text

136 https://www.nytimes.com/2018/01/18/us/politics/surveillance-congress-snowden-privacy.html

137 https://cdt.org/blog/fisa-702-what-happened-and-whats-next/

138 https://www.eff.org/deeplinks/2018/02/how-congresss-extension-section-702-may-expand-nsas-warrantless-surveillance

139 Executive Order 12333 – United States Intelligence Activities. Federal Register, National Archives. http://www.archives.gov/federal-register/codification/executive-order/12333.html.

140 "Executive Order 12333," Electronic Privacy Information Center, https://epic.org/privacy/surveillance/12333/.

141 Barton Gellman and Ashkan Soltani, "NSA surveillance program reaches 'into the past' to retrieve, replay phone calls," Washington Post, March 18, 2014, https://www.washingtonpost.com/world/national-security/nsa-surveillance-program-reaches-into-the-past-to-retrieve-replay-phone-calls/2014/03/18/226d2646-ade9-11e3-a49e-76adc9210f19_story.html; Ryan Devereaux, Glenn Greenwald, Laura Poitras, "Data Pirates of the Caribbean," The Intercept, May 19, 2014, https://theintercept.com/2014/05/19/data-pirates-caribbean-nsa-recording-every-cell-phone-call-bahamas/.

142 H.R. 4681, Intelligence Authorization Act for Fiscal Year 2015 Sec. 309, 113th Cong. (2014).

143 Presidential Policy Directive – Signals Intelligence Activities PPD-28, January 17, 2014, http://1.usa.gov/1MUm5Yz.

144 Human Rights Watch, "Strengthen the USA Freedom Act," May 19, 2015, https://www.hrw.org/news/2015/05/19/strengthen-usa-freedom-act.

145 Electronic Frontier Foundation, "Mandatory Data Retention: United States," https://www.eff.org/issues/mandatory-data-retention/us.

146 Electronic Frontier Foundation, "Mandatory Data Retention: United States;" Center for Constitutional Rights, "Surveillance After the USA Freedom Act: How Much Has Changed?," Huffington Post, December 17, 2015, http://www.huffingtonpost.com/the-center-for-constitutional-rights/surveillance-after-the-us_b_8827952.html.

147 American Civil Liberties Union, "California Electronic Communications Privacy Act (CalECPA) – SB 178," https://www.aclunc.org/our-work/legislation/calecpa.

148 United States v. Warshak, 09-3176, United States Court of Appeals for the Sixth Circuit.

149 Ibid.

150 Sophia Cope, "House Advances Email Privacy Act, Setting the Stage for Vital Privacy Reform," Electronic Frontier Foundation, April 27, 2016, https://www.eff.org/deeplinks/2016/04/house-advances-email-privacy-act-setting-stage-vital-privacy-reform.

151 H.R. 387 Email Privacy Act, https://www.congress.gov/bill/115th-congress/house-bill/387/text

152 https://www.congress.gov/bill/115th-congress/senate-bill/2383/text

153 https://www.congress.gov/bill/115th-congress/house-bill/4943/text

154 https://www.eff.org/deeplinks/2018/03/responsibility-deflected-cloud-act-passes

155 http://thehill.com/policy/technology/372637-hatch-introduces-bipartisan-bill-to-clarify-cross-border-data-policies

156 https://lawfareblog.com/cloud-act-welcome-legislative-fix-cross-border-data-problems

157 https://www.wsj.com/articles/u-s-tech-firms-warn-against-internet-monitors-privacy-tightening-1521115200

158 https://www.washingtonpost.com/opinions/a-global-game-of-whack-a-mole-overseas-data-rules-are-stuck-in-the-19th-century/2018/03/05/f24851e6-2096-11e8-86f6-54bfff693d2b_story.html?utm_term=.94efc6b1a92d

159 https://cdt.org/press/omnibus-spending-bill-fails-to-protect-privacy-of-americans/

160 Jonah Engel Bromwich, Daniel Victor, and Mike Isaac, "Police Use Surveillance Tool to Scan Social Media, A.C.L.U Says," New York Times, October 11, 2016, https://www.nytimes.com/2016/10/12/technology/aclu-facebook-twitter-instagram-geofeedia.html.

161 Jonah Engel Bromwich, Daniel Victor, and Mike Isaac, "Police Use Surveillance Tool to Scan Social Media, A.C.L.U Says," New York Times, October 11, 2016, https://www.nytimes.com/2016/10/12/technology/aclu-facebook-twitter-instagram-geofeedia.html.

162 Cynthia McFadden, E.D. Cauchi, William M. Arkin, and Kevin Monahan, "American Citizens: U.S. Border Agents Can Search Your Cellphone," NBC News, March 13, 2017, http://www.nbcnews.com/news/us-news/american-citizens-u-s-border-agents-can-search-your-cellphone-n732746.

163 Loren Grush, "A US-born NASA scientist was detained at the border until he unlocked his phone," The Verge, February 12, 2017, https://www.theverge.com/2017/2/12/14583124/nasa-sidd-bikkannavar-detained-cbp-phone-search-trump-travel-ban.

164 Cora Currier, "Lawmakers Move to Stop Warrantless Cellphone Searchers at the U.S. Border," The Intercept, April 4, 2017, https://theintercept.com/2017/04/04/lawmakers-move-to-stop-warrantless-cell-phone-searches-at-the-u-s-border/.

165 https://www.cnn.com/2018/03/29/politics/immigrants-social-media-information/index.html

166 Alex Bradshaw, Stan Adams, "FCC Should Act to Protect Broadband Customers' Data," CDT, January 20, 2016, https://cdt.org/blog/fcc-should-act-to-protect-broadband-customers-data/.

167 Erica Newland, et. al., Account Deactivation and Content Removal: Guiding Principles and Practices for Companies and Users, Global Network Initiative, September 2011, http://cyber.law.harvard.edu/node/7080

168 Justin Jouvenal, "Yelp won't have to turn over names of anonymous users after court ruling" Washington Post, 16 April 2015, http://wapo.st/1MbcE48.

169 Julia Angwin, "What's Really At Stake in the Apple Encryption Debate," ProPublica, February 24, 2016, https://www.propublica.org/article/whats-really-at-stake-in-the-apple-encryption-debate.

170 Press Release, "Open Technology Institute Opposes Government Attempt to Mandate Backdoor into Apple iPhone," Open Technology Institute, February 17, 2016, https://www.newamerica.org/oti/press-releases/open-technology-institute-opposes-government-attempt-to-mandate-backdoor-into-apple-iphone/.

171 https://thehill.com/policy/cybersecurity/391157-lawmakers-renew-push-to-preempt-state-encryption-laws

172 Cory Bennett, "Lawmakers skeptical of FBI's encryption warnings," The Hill, April 29, 2015, http://bit.ly/1bGPbwO.

173 Charlie Savage, "U.S. Tries to Make it Easier to Wiretap the Internet." New York Times, September 27, 2010, http://nyti.ms/1WIzNlX; See also Declan McCullagh, "FBI: We Need Wiretap-Ready Websites – Now," CNET, May 4, 2012, http://cnet.co/1iRh6vA.

174 Ben Adida et al, CALEA II: Risks of Wiretap Modifications to Endpoints, Center for Democracy & Technology, May 17, 2013, http://bit.ly/1Gsv12v.

175 Spencer S. Hsu, "A Maryland court is the first to require a warrant for covert cellphone tracking," Washington Post, March 31, 2016, https://www.washingtonpost.com/world/national-security/a-maryland-court-is-the-first-to-require-a-warrant-for-covert-cellphone-tracking/2016/03/31/472d9b0a-f74d-11e5-8b23-538270a1ca31_story.html.

176 https://www.washingtonpost.com/news/true-crime/wp/2017/09/21/police-use-of-stingray-cellphone-tracker-requires-search-warrant-appeals-court-rules/?utm_term=.149b30afa00b

177 Joshua Kopstein, "Maryland Attorney General: If You Don't Want To Be Tracked, Turn Off Your Phone," Motherboard, February 4, 2016, https://motherboard.vice.com/read/maryland-attorney-general-if-you-dont-want-to-be-tracked-turn-off-your-phone.

178 Alex Emmons, "Maryland Appellate Court Rebukes Police for Concealing Use of Stingrays," The Intercept, March 31, 2016, https://theintercept.com/2016/03/31/maryland-appellate-court-rebukes-police-for-concealing-use-of-stingrays/;

179 Robert Snell, "Feds use anti-terror tool to hunt the undocumented,"

180 Adam Schwartz, "No Hunting Undocumented Immigrants with Stingrays," Electronic Frontier Foundation, May 19, 2017, https://www.eff.org/deeplinks/2017/05/no-hunting-undocumented-immigrants-stingrays.

181 https://www.nytimes.com/2018/06/22/us/politics/supreme-court-warrants-cell-phone-privacy.html

182 https://www.aclu.org/blog/privacy-technology/location-tracking/supreme-courts-groundbreaking-privacy-victory-digital-age

183 https://www.justsecurity.org/58520/broad-reach-carpenter-v-united-states/

184 http://journals.sagepub.com/stoken/default+domain/10.1177/1464884918768500/full

185 Carlett Spike and Pete Vernon, "It was super graphic:' Reporters reveal stories of online harassment," Columbia Journalism Review, July 28, 2017, https://www.cjr.org/covering_trump/journalists-harassment-trump.php.

186 http://www.pewresearch.org/fact-tank/2017/07/25/1-in-4-black-americans-have-faced-online-harassment-because-of-their-race-or-ethnicity/

187 https://www.amnesty.org/en/latest/news/2017/11/amnesty-reveals-alarming-impact-of-online-abuse-against-women/

188 https://motherboard.vice.com/en_us/article/evqw9z/filming-police-brutality-retaliation

189 https://rsf.org/en/news/us-rsf-concerned-second-wave-journalist-arrests-st-louis

190 https://pressfreedomtracker.us/all-incidents/independent-livestreamer-heather-demian-pepper-sprayed-st-louis-police/

191 https://pressfreedomtracker.us/all-incidents/independent-livestreamer-jon-ziegler-pepper-sprayed-and-arrest-louis/

192 https://rsf.org/en/news/us-rsf-concerned-second-wave-journalist-arrests-st-louis

193 https://www.washingtonpost.com/news/the-switch/wp/2017/05/15/how-to-protect-yourself-from-the-global-ransomware-attack/

194 https://www.recode.net/2017/6/27/15881666/global-eu-cyber-attack-us-hackers-nsa-hospitals

195 https://www.wsj.com/articles/its-official-north-korea-is-behind-wannacry-1513642537

196 https://www.nytimes.com/2018/03/15/us/politics/russia-cyberattacks.html?rref=collection%2Fsectioncollection%2Ftechnology

197 Executive Order No. 13800, CFR Vol. 82, No. 93, "Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure," May 11, 2017, https://www.gpo.gov/fdsys/pkg/FR-2017-05-16/pdf/2017-10004.pdf.

198 Consolidated Appropriations Act, 2016, Pub. L. 114-113, December 18, 2015, https://www.congress.gov/bill/114th-congress/house-bill/2029/text.

199 Jadzia Butler, Greg Nojeim, "Cybersecurity Information Sharing in the 'Ominous' Budget Bill: A Setback for Privacy," Center for Democracy and Technology, December 17, 2015, https://cdt.org/blog/cybersecurity-information-sharing-in-the-ominous-budget-bill-a-setback-for-privacy/