The RESTRICT Act’s vague and overbroad language is a threat to a free and open internet

In recent months, it has been almost impossible to escape the numerous conversations about a potential ban of the social media platform TikTok. Many of the discussions relate to concerns around national security and the company’s Chinese parent company ByteDance. 

In early March, a bipartisan group of senators led by Mark Warner and John Thune introduced the Restricting the Emergence of Security Threats that Risk Information and Communications Technology Act. The RESTRICT Act seeks to address security concerns around technologies owned by companies from countries with governments hostile to the United States. In addition to now having more than two dozen senate co-sponsors, the Biden Administration has also endorsed the legislation.

Unfortunately, as written, the RESTRICT Act is a vague, overbroad bill that would give the federal government nearly unrestrained power to monitor and target U.S. citizens on the internet. 

What does the RESTRICT Act actually do? 

Broadly, the bill would establish new authority for a security review by the U.S. secretary of commerce of certain technologies owned by companies from any “foreign adversary,” including China, Cuba, Iran, North Korea, Russia, and Venezuela. (Congress or the secretary of commerce may add other countries to the list later.) As explained by the bill’s sponsors, the RESTRICT Act would require the establishment of “procedures to identify, deter, disrupt, prevent, prohibit, and mitigate transactions involving information and communications technology products in which any foreign adversary has any interest and poses undue or unacceptable risk to national security.”

FIRE Statement on Free Speech and Social Media

Issue Pages

Social media and free speech.

Read More

Although not specifically mentioned in the bill, TikTok would fall under the purview of this legislation. The legislation would also apply to companies such as the Chinese-owned technology company Huawei and the Russian-owned security firm Kaspersky. 

Following a review, the secretary of commerce could then take a series of mitigating steps up to and including a broad ban on a particular technology. The bill states that the commerce secretary “is authorized to and shall take action to…[enforce] any mitigation measures to address any risk” from a particular product or service “that the Secretary determines poses an undue or unacceptable risk.” 

Those categories of risk detailed in the bill include sabotage of “information and communications technology products and services” in the U.S., catastrophic effects on the security of critical U.S. infrastructure or the digital economy, interference with federal elections, or coercive or criminal activities “that are designed to undermine democratic processes and institutions.”

The RESTRICT Act is troublingly vague and overbroad

Notably, the bill also includes broad language that allows the secretary of commerce to decide that a technology “otherwise poses an undue or unacceptable risk to the national security of the United States or the safety of United States persons,” even if the risk does not fit into one of the predefined categories. As other critics of this language correctly point out, this catch-all provision introduces a highly subjective risk assessment without guarantee of transparency or due process. 

While the bill does say that the secretary should publish explanations of decisions if “practicable,” those disclosures still need to be “consistent with the national security and law enforcement interests of the United States.” 

Government interference in citizens’ use of a free and open internet is akin to the actions of authoritarian regimes, not a liberal democracy.

That means the American public may still be denied clear, transparent explanations of why technologies they use every day are no longer available to them. 

Another concern about the bill relates to whom it targets. Sen. Warner’s office said that the bill’s criminal penalties only apply when “someone is engaged in ‘sabotage or subversion’ of communications technology in the U.S., causing ‘catastrophic effects’ on U.S. critical infrastructure, or ‘interfering in, or altering the result’ of a federal election.” However, as Elizabeth Nolan Brown points out in Reason, there are other possible interpretations. 

Of particular concern is the following provision: 

No person may engage in any transaction or take any other action with intent to evade the provisions of this Act, or any regulation, order, direction, mitigation measure, prohibition, or other authorization or directive issued thereunder.

This passage can be reasonably interpreted to mean that even a single individual user attempting to evade a ban for their own personal use could be subject to the bill’s penalties. Those penalties include fines (up to a million dollars) or up to 20 years in prison. Something as simple as using a virtual private network to access any banned technology might incur these penalties.

There are many reasons to use VPNs, which are private, secure connections that help to obscure a user’s internet activity, including a user’s location. Citizens of authoritarian regimes that cut off or severely limit access to parts of the internet use VPNs to access information their governments don’t want them to see. VPNs also provide an extra layer of security when using unsecured Wi-Fi connections (like at your local coffee shop) or used to view streaming content that is geo-blocked from your physical location. 

Unfortunately, as written, the RESTRICT Act is a vague, overbroad bill that would give the federal government nearly unrestrained power to monitor and target U.S. citizens on the internet.

Imposing penalties on someone who uses a VPN to access banned communications technologies, such as TikTok, raises serious First Amendment concerns. Furthermore, FIRE is troubled by how the government could enforce the overbroad provisions of the RESTRICT Act. For instance, if the secretary can take a “mitigation measure . . . ordered by the Federal Government . . . in any matter addressed under this Act to address any risk arising” from a particular technology, the federal government could be statutorily authorized to undertake a wide range of action against both citizens and foreign technology companies, severely threatening unfettered access to the internet.  Government interference in citizens’ use of a free and open internet is akin to the actions of authoritarian regimes, not a liberal democracy. 

The RESTRICT Act threatens a free and open internet

This bill introduces expansive new powers while ostensibly seeking to address serious concerns about hostile countries and foreign technology companies. Although there may be significant national security concerns associated with TikTok and other foreign technology companies, any government statute or regulation seeking to address them must use the least restrictive means possible. This is critical to ensuring the privacy and security of American citizens without unduly burdening First Amendment rights. The RESTRICT Act does not meet this standard. 

Even if the sponsors of the legislation do not intend for it to be used to target individual American citizens, it confers wide-ranging authority to the executive branch to do just that. As FIRE’s long history defending against similarly vague and overbroad speech codes in the campus context shows, such authority is ripe for abuse. 

Legislators should heed the warnings of FIRE and other civil liberties organizations: They must revise the bill to ensure that the internet in America remains a robust marketplace for free expression.