RESTRICT Act: Discussion, Implications, Analysis
Discover more from Hacking, but Legal
RESTRICT Act: Discussion, Implications, Analysis
What is the RESTRICT Act, and what will it mean if it becomes law?
What is the RESTRICT Act, and what will it mean if it becomes law?
Dear Reader,
Ever since I first saw Tulsi Gabbard fear-mongering on Twitter about the surveillance implications of the RESTRICT Act, I knew I wanted to write a clear-eyed analysis of this bill and how it could impact us if it were to become law.
#Disinformation about the RESTRICT Act via consummate liar Tulsi Gabbard: 5.1M views pic.twitter.com/Udocxw6qtf
— Jackie Singh (@HackingButLegal) April 10, 2023
💡
It is important to note that the Act is still a bill, and it has not yet been passed into law. It is possible that the bill will be significantly amended before it becomes law, or even defeated entirely.
Despite the uncertainty surrounding its passing, the Act is a significant piece of legislation, and it is worth considering its potential implications.
What is the RESTRICT Act?
Introduced to the Senate on March 7, 2023, the Restricting and Evaluating Strategic Transactions Involving Countries Threatening the United States, or RESTRICT Act, marks an earnest attempt by the United States to fortify her defenses against relentless attacks from certain foreign countries.
The proposed legislation aims to empower the Secretary of Commerce with the authority to scrutinize and potentially prohibit certain transactions between US entities and these foreign adversaries involving the critical domain of information and communications technology (ICT).
What are ICT organizations? Well, they're tech companies.
💡
The Act was introduced by Sen. Mark Warner (D-VA) and Sen. John Thune (R-SD) and currently has 24 added co-sponsors across the political spectrum.
A new role for the Secretary of Commerce is carved out in this legislation, providing them with the authority to review and possibly prohibit "covered transactions" which involve a foreign adversary.
There are a few limits on the Secretary's authority under the Act:
First, the bill specifically targets foreign adversaries. This means that the Secretary of Commerce would not be able to use the bill to directly target Americans or other persons who are not considered to be citizens of a foreign adversary.
Second, the bill requires the Secretary of Commerce to provide notice and opportunity for comment before prohibiting a transaction. This means that the Secretary of Commerce would not be able to prohibit a transaction without giving the person who is being targeted an opportunity to challenge the decision.
Finally, the bill allows for judicial review of the Secretary of Commerce's decisions. This means that a person who is harmed by a decision by the Secretary of Commerce to prohibit a transaction could petition for a review with the United States Court of Appeals for the Federal Circuit.
The RESTRICT Act, while still in its early stages and yet to be codified into law, represents an effort to bolster the US government's toolkit to shield the nation from foreign adversaries seeking to exploit ICT for nefarious purposes. It is a sign of a government that is looking for new ways to tackle the menace of foreign threats with the gravity they warrant.
Key takeaways from the RESTRICT Act include:
The Secretary of Commerce would have the power to review and potentially inhibit or "mitigate" certain "covered transactions" between foreign "adversaries" and US persons. This broad language could include any number of mitigations as chosen by the Secretary, including significant changes to a company's operations or even its ouster from the country.
Tech companies must have more than 1 million US users in order to be affected by the legislation.
The Secretary's decision to prohibit a transaction would be contingent upon the nature of the transaction, the parties involved, and its potential impacts on national security and the safety of US persons.
An appeals process is established for those wishing to contest a decision by the Secretary.
The Act could fundamentally transform the role of the Secretary of Commerce (a political appointee), who could become more deeply involved in national security decision-making, a departure from traditional responsibilities. The role could also encompass greater regulatory oversight of foreign businesses.
The bill outlines five major categories of risk, stipulating that "covered transactions" could include those which pose some undue or unacceptable risk to US national security or US persons' safety, such as:
Sabotage or subversion of ICT products and services in the US.
Catastrophic effects on the security or resilience of U.S. critical infrastructure or the US digital economy.
Interfering in or altering the result or reported result of a US federal election.
Coercive or criminal activities by a foreign adversary designed to undermine democratic processes and institutions or steer policy and regulatory decisions in favor of a foreign adversary’s objectives.
💡
In its totality, the RESTRICT Act aims to protect national interests by offering a response to threats posed by specific foreign "adversaries" who may leverage technology companies as conduits to attack America.
Who would this bill apply to, exactly?
The Act explicitly lists several entities as foreign adversaries, a roster that not only includes nations but also specific administrative regions. This list offers some basic insight into the current geopolitical and cybersecurity concerns of the sponsors of the bill:
The People's Republic of China, including the Hong Kong Special Administrative Region and Macao Special Administrative Region
The Republic of Cuba
The Islamic Republic of Iran
The Democratic People's Republic of Korea
The Russian Federation
The Bolivarian Republic of Venezuela under the regime of Nicolas Maduro Moros
💡
The inclusion of certain regions under Chinese jurisdiction - Hong Kong and Macao - reflects heightened anxieties over Beijing's growing influence and potential for technological subversion.
Which companies could be affected by the Act?
Several countries listed in the RESTRICT Act have produced ICT products and services that have been used by more than a million people in the United States.
Here are some prominent examples:
Russia: The cybersecurity company Kaspersky Lab, based in Moscow, had millions of users globally, including in the United States, before the US government banned its use on federal computers in 2017 due to security concerns. There have been ongoing discussions in the US regarding the potential for the company to end up on the sanctions list.
China: TikTok, the mega-popular social media platform developed by Beijing-based ByteDance, has amassed millions of American users and many accompanying national security concerns. Other Chinese companies, such as Lenovo, ZTE, Hikvision, and Huawei, have also had a significant presence in the US market and have elicited similar interest.
As noted by Lawfare Blog on March 23, 2023:
The bill did not name TikTok specifically, but it was clearly one of the companies in mind when the bill was written: [Senator] Thune’s press comments on the bill mentioned TikTok seven times, and the other co-sponsors mentioned TikTok in press comments as well. The bill could lead to restrictions on TikTok and non-U.S. technology companies, products, and services.
As for the other countries listed in the RESTRICT Act—Iran, North Korea, Cuba, and Venezuela—those aren't typically associated with ICT products or services used by over a million people in the United States. That said, cyber activities originating from these countries, particularly Iran and North Korea, have been a significant concern for US cybersecurity officials.
China = "Adversary"
The inclusion of China in a list of America's adversaries (as defined in the RESTRICT Act if it passes), would signal a significant moment in US policy. The Act's explicit mention of China as a defined "adversary" underscores Washington's increasing concerns over Beijing's technological ambitions and its potential impacts on America's national security.
China's rapid technological advancement and the growth of Chinese tech firms, especially in the realm of ICT, poses ongoing national security risks. Washington is rightly concerned that Beijing will continue to exploit its technological prowess to conduct surveillance, cyber-espionage, theft of intellectual property, election interference, and other malicious activities that have been detrimental to the United States.
💡
The RESTRICT Act would represent a significant escalation in the US-China technology rivalry.
The bill would give the US government the power to block US companies from doing business with Chinese companies that are involved in the development of cutting edge technologies such as artificial intelligence, quantum computing, and other emerging technologies. The bill would also give the government the power to block US companies from selling technology to Chinese companies that are involved in the development of military equipment.
Since the RESTRICT Act's provisions would give the Secretary of Commerce unprecedented authority to scrutinize and potentially prohibit any transaction in which China has an interest, and Chinese tech companies would be disproportionately affected by this bill, the Act can be seen as a part of a broader strategy to counteract China's influence and protect national interests, including economic and cybersecurity, which follows recent moves by the Biden Administration to impose export controls limiting Beijing from accessing certain semiconductor chips.
However, the implications of this Act would not be solely confined within the borders of the US. It could possibly reshape the global tech landscape, impacting multinational companies that operate in both countries, and potentially leading to a further bifurcation of the global technology industry.
While the bill would help strengthen American cyber-defenses, it would also certainly escalate tensions with China. The diplomatic fallout could be significant, and the potential for retaliatory measures from Beijing cannot be discounted.
What are the risks to Americans?
The Act has been met with mixed reactions. Some have praised the bill as a necessary step to protect the United States from foreign threats, while others have expressed vague concerns that the bill could violate the First Amendment right to free speech.
From a national security perspective, the RESTRICT Act could have a number of positive implications. The bill could help to prevent the proliferation of sensitive technologies to foreign adversaries, and it could also help to protect the United States from cyberattacks or breaches of sensitive data. Additionally, the bill could help to ensure that the United States has access to reliable and secure information and communications technology (ICT) products and services. I believe increasing our nation's governance capability around these types of companies is both prudent and necessary.
However, the RESTRICT Act could also have negative implications for First Amendment rights. The most uncharitable reading of this bill suggests it could be used to censor or restrict speech or used to target and harass individuals or groups who are considered to be disloyal, subversive, or simply unwanted for spurious reasons.
Ultimately, the implications of the RESTRICT Act will depend on how the bill is implemented and enforced. If the bill is used in a way that is consistent with the First Amendment, it could be a valuable tool for protecting the United States from foreign threats. However, if the bill is used in a way that violates the First Amendment, it could have a chilling effect on free speech and political dissent.
The Act raises several First Amendment concerns that bear scrutiny:
First, the bill grants the Secretary of Commerce broad authority to scrutinize and prohibit transactions between individuals within the United States and those deemed foreign adversaries. This power extends beyond transactions that involve sensitive technologies or that pose a direct threat to national security.
Second, the Act is ambiguous when it comes to providing explicit standards guiding how the Secretary of Commerce should wield their authority. This lack of clarity leaves room for potential arbitrary or discriminatory application of the Act, leading to uneven enforcement that may infringe on First Amendment rights.
Third, the Act does not offer clear procedures for challenging a decision made by the Secretary of Commerce to prohibit a transaction. This procedural ambiguity could create barriers for those seeking redress after being adversely affected by the Act's enforcement.
The Act has significant surveillance implications with no added safety rails:
The bill gives the Secretary of Commerce broad authority to review and prohibit transactions between persons in the United States and foreign adversaries. This authority could be used to justify increased surveillance of Americans who have ties to foreign adversaries.
The bill could be used to create a new surveillance bureaucracy within the Department of Commerce. This office would have broad authority to review and prohibit transactions between persons in the United States and foreign adversaries.
The bill does not specify what types of surveillance technologies the government can use to review and prohibit transactions between persons in the United States and foreign adversaries. This could lead to the use of new surveillance technologies that are not currently available to the government.
The surveillance-related implementation of the Act could be impacted by which political party is in power and their views on civil liberties. For example, if a political party that is more supportive of civil liberties is in power, they may be more likely to interpret the bill in a way that protects individual rights. On the other hand, if a political party that is less supportive of civil liberties is in power, they may be more likely to interpret the bill in a way that allows for greater government surveillance.
The Act contains an unnecessary FOIA exemption:
The Act includes a FOIA exemption that would allow the government to withhold information about transactions that have been reviewed or prohibited under the bill. This exemption is broad and could be used to withhold a wide range of information, including information about the nature of the transactions, the identity of the parties involved, and the reasons for the government's decision to review or prohibit the transactions.
If the government is able to withhold information about transactions that have been reviewed or prohibited under the RESTRICT Act, it will be more difficult for journalists and researchers to investigate and report on national security issues.
The FOIA exemption is a significant threat to the public's right to know about the government's national security policies. The exemption is likely to make it more difficult for the public to understand the government's policies, to hold the government accountable, and to engage in informed debate about national security issues.
The Act is written in a manner which could lead to increased geopolitical and diplomatic tensions:
The language used in legislative acts is consequential, and the RESTRICT Act is no exception. Its current definition of an "adversary"–"a foreign country that the Secretary of Commerce determines has engaged in or is engaging in activities that threaten the national security of the United States"–is broad and could potentially encapsulate a wide array of nations.
These are not mere linguistic choices; they are political choices. The US government will need to carefully weigh the advantages and disadvantages of each approach. The verbiage chosen will reflect the nature of the threat perception, strategic objectives, and the diplomatic message the US wants to convey.
💡
The Act's language is a policy statement in itself, a reflection of how the US perceives and seeks to navigate the complex landscape of national security in the digital age.
As the Act remains in the legislative pipeline, changes to its language and scope are possible; likely, even. It may be reshaped, diluted, or even rejected before it becomes law. Yet, the importance of the discourse it has sparked cannot be overstated.
💡
The debate surrounding the RESTRICT Act underscores the ongoing struggle to reconcile national security imperatives with American bedrock principles of free speech and civil liberties in an increasingly digital world.
Suggested changes...
Here are a few specific changes I suggest could be made to the Act to focus its power on foreign adversaries and help limit potential risk of harm to civil liberties:
Provide clearer standards and limits for how the Secretary of Commerce is to exercise their authority. This would help to prevent the bill from being used in a discriminatory or arbitrary manner.
Limit the Secretary of Commerce's authority to transactions that involve sensitive technologies or that pose a direct threat to national security. This would help to ensure that the bill is not used to restrict or censor speech that is critical of the government or that is considered to be a threat to national security.
Provide clearer procedures for challenging a decision by the Secretary to prohibit a transaction. This would help to ensure that persons who are harmed by the bill have a concrete and reliable way to seek redress.
Amend to remove the FOIA exemption. This would help to ensure that the public has access to information about transactions that have been reviewed or prohibited under the bill.
A narrower definition of "adversaries" could enhance the Act's efficacy. Specifying that adversaries are nations actively involved in espionage against the US, and/or those deploying or developing weapons of mass destruction, and/or those supporting terrorist groups, would provide a more precise target for the Act's provisions.
I also believe it is worthy of consideration to shift terminology from "adversaries" to "covered nations". This more neutral term eschews the combative undertones associated with "adversaries", and could potentially help preventing escalating the inevitable diplomatic tension which would result from such a bill becoming law.
Why are some pro-Russian politicians publicly campaigning against this bill?
There are a number of possible explanations for why some political commentators are publicly disseminating outright falsehoods (disinformation) against the RESTRICT Act:
They may believe that the bill is unnecessary and harmful to US-China or US-Russia relations.
They may be sympathetic to the Chinese or Russian governments and their interests.
They may be receiving financial or other support from the Chinese or Russian governments.
Interestingly, the RESTRICT Act could potentially intersect with the Magnitsky Act, which allows the United States government to freeze the assets and ban travel to the United States of individuals who are accused of human rights abuses. For instance, the RESTRICT Act could be used to target Chinese companies that are owned or controlled by human rights abusers.
Tulsi Gabbard, the former U.S. Representative from Hawaii and onetime presidential candidate, was one of only a handful of members of Congress who voted against the Magnitsky Act in 2012.
Tulsi Gabbard say that she doesn’t control the Russian bots that support her, but she did control the hiring of Chris Cooper, the smear campaigner who was paid by Natalia Veselnitskaya and her Russian backed sponsors to smear me and try to repeal the Magnitsky Act in DC https://t.co/pxS1eBmln8
— Bill Browder (@Billbrowder) October 20, 2019
The Magnitsky Act was folded into the National Defense Authorization Act (NDAA) for Fiscal Year 2017. Gabbard voted against the NDAA and later claimed the reason was something to do with Syria. However, Gabbard had made public statements about the Magnitsky Act before it was folded into the NDAA.
In a March 2016 interview with The Hill, Gabbard said that she was "concerned about the Magnitsky Act because it could be used as a tool of political repression." She also said that she was "uncomfortable with the idea of singling out one country for sanctions." More recently, she was caught saying the 'US is not so different' from Russia on freedom of speech.
Who were other members of the small group who voted against the FY2017 NDAA?
Ron Paul has been a vocal critic of the United States' involvement in NATO and has called for the United States to withdraw from the alliance. He has met with Russian President Vladimir Putin on several occasions.
Dana Rohrabacher has been a strong supporter of Russia's annexation of Crimea and has called for the United States to lift sanctions against Russia. He has met with Russian officials on several occasions.
Paul Broun has called for the United States to normalize relations with Russia and has said that he believes that Russia is not a threat to the United States. He has also met with Russian officials on several occasions.
Jean Schmidt has said that she believes that the United States should not be involved in the Syrian civil war and has called for the United States to withdraw its support for Syrian rebels. She has also met with Russian officials on several occasions.
Steven King has made a number of controversial statements about Russia, including calling for the United States to ally with Russia against ISIS. He has also met with Russian officials on several occasions.
The Restrict Act not only bans Americans from using TikTok, it is a Patriot Act 2.0 for the Internet. It would give the govt unfettered access to all the data on our computers, phones, security cameras, internet browsing history, payment applications and more. It throws the… pic.twitter.com/EdvvP1UgFr
— Tulsi Gabbard 🌺 (@TulsiGabbard) April 9, 2023
Here is a breakdown of Tulsi Gabbard's statements about the RESTRICT Act:
"The Restrict Act not only bans Americans from using TikTok, it is a Patriot Act 2.0 for the Internet."
Fact Check: The RESTRICT Act does not directly ban Americans from using TikTok. However, it does give the Secretary of Commerce the authority to prohibit or restrict transactions involving TikTok and other Chinese companies that are deemed to pose a national security threat.
Fact Check: The Patriot Act and the RESTRICT Act are extremely different pieces of legislation. The Patriot Act is a broad and sweeping piece of legislation that gives the government a wide range of powers to surveil its citizens. The RESTRICT Act, on the other hand, is a more targeted and specific piece of legislation that is specifically aimed at companies from nations on a list of "adversaries" that have more than 1 million US users and are deemed by the Secretary of Commerce to pose a national security threat.
"It would give the govt unfettered access to all the data on our computers, phones, security cameras, internet browsing history, payment applications and more."
Fact Check: The RESTRICT Act does not give the government unfettered access to all of the data on our computers, phones, security cameras, internet browsing history, and payment applications. However, it does give the Secretary of Commerce the authority to require companies to provide the government with access to this data if it is necessary to protect national security.
"It throws the Freedom of Information Act out the window."
Fact Check: The RESTRICT Act does not eliminate the Freedom of Information Act (FOIA). However, it does limit the public's ability to obtain information from the government about the RESTRICT Act. For example, the bill would allow the government to withhold information about the RESTRICT Act if it is deemed to be "classified" or "sensitive."
"It cannot be challenged in court."
Fact Check: The RESTRICT Act can be challenged in court. However, the bill does make it more difficult for people to challenge the government's decisions under the RESTRICT Act. For example, the bill would require people to file their challenges in a specific court, and it would allow the government to appeal these challenges to a higher court.
"It criminalizes the use of a VPN with up to 20 years in jail and $1M fine."
Fact Check: The RESTRICT Act does not criminalize the use of a VPN. However, it does make it a crime to use a VPN to evade the RESTRICT Act. For example, it would be a crime to use a VPN to access TikTok if TikTok has been prohibited or restricted under the RESTRICT Act.
Let us think about this both critically, and with an open mind.
Tulsi Gabbard, like any citizen, has the right to express her views and concerns about any proposed legislation. However, it's important for the public to critically evaluate these views and consider them in the broader context of the proposed legislation.
The RESTRICT Act, as we've discussed, has the potential to significantly impact the operations of technology companies, especially those originating from the countries listed in the Act, which includes China and Russia. The Act gives broad discretionary powers to the Secretary of Commerce to restrict transactions with these companies if they are perceived to pose a national security risk. However, it's crucial to note that the Act is not targeted at all companies from these countries, but only those involved in transactions that meet certain risk criteria. The Act also includes provisions for review and revocation of prohibitions, suggesting that not all restrictions would be permanent.
Gabbard's statements, despite her falsehoods and exaggeration, highlight both the importance of careful implementation to avoid overreach and the potential risk of failing to obtain broad support due to the government's failures to properly scope the policy and to communicate the benefits to stakeholder-citizens.
As with any legislation, the impact of the RESTRICT Act will largely depend on how it is implemented and enforced.
In conclusion, the RESTRICT Act sits at a crucial intersection of national security, civil liberties, international business, and global diplomacy. Its intent to safeguard America's national security landscape from harmful external forces is undoubtedly vital in today's interconnected, digital-first world. Yet, it is essential that we do not overlook the potential challenges it could present to speech and to privacy.
Navigating the complex terrain of the RESTRICT Act calls for a delicate balance between protecting the people of our country while simultaneously preserving fundamental rights, fostering international business, and maintaining diplomatic equanimity. As the discourse around this legislation unfolds, it is incumbent upon us all—policy makers, industry stakeholders, and the general public—to engage in informed and balanced debates that consider all these perspectives.
Thanks for reading.