The RESTRICT Act —

TikTok ban bill is so broad it could apply to nearly any type of tech product

RESTRICT Act could be read as criminalizing some VPN use, EFF says.

A large TikTok ad at a subway station.
Getty Images | Bloomberg

Banning TikTok has been a hot topic in Congress lately. But if lawmakers go through with a ban on the social network owned by Chinese company ByteDance, the US could end up banning or restricting access to many more apps and technology products than just TikTok.

A leading "TikTok ban" candidate is the RESTRICT Act, or the Restricting the Emergence of Security Threats that Risk Information and Communications Technology Act. The bipartisan Senate bill was introduced a month ago and endorsed by the White House in an official statement from National Security Adviser Jake Sullivan. The Biden administration reportedly provided feedback on a draft of the proposed law before it was announced.

The bill doesn't actually guarantee that TikTok will be banned—its text doesn't even mention TikTok or ByteDance. But it would give the secretary of Commerce and president broad power to ban mobile or desktop applications and other types of technology products from countries regarded as threats to national security.

For that reason, the RESTRICT Act has received vocal opposition from digital rights activists. The bill's vagueness on which specific products would be banned and the sweeping powers it would give the executive branch have generated speculation that it could criminalize the use of VPNs and authorize additional surveillance of US citizens' online activity.

There has been some "misinterpretation and other overly strained readings of the law [that] have been shared widely on both social media and in the news," which Congress could have prevented by writing a clearer bill, the Electronic Frontier Foundation said in a breakdown of the proposed law published Tuesday. Although the EFF doesn't view the RESTRICT act as a surveillance tool, it says there are many legitimate concerns about the proposal.

"This is sweeping legislation that would have Congress abdicate much of its responsibility in holding the executive branch accountable, and leaving any room for misinterpretation is a problem. The confusing language here is another failure of the bill," wrote EFF employees, including David Greene, a senior staff attorney and the group's civil liberties director.

EFF: Bill can be read as criminalizing some VPN use

Some of the worrisome predictions made about the bill aren't impossible. Even if the Biden administration uses the proposed powers in a limited way, future presidents could be more aggressive in banning products.

There is a chance the bill could lead to punishments of individual Americans for using a VPN or other technologies to access TikTok, the EFF said.

"The bill authorizes the Department of Commerce to impose 'mitigation measures' without any restrictions on what those measures might be. Couple that with a vague enforcement provision that grants the power to broadly punish any person who 'evades' these undefined 'mitigation measures,' and the result is a law that can be read as criminalizing common practices like using a VPN to get a prohibited app, side-loaded installations, or using an app that was lawfully downloaded somewhere else," the EFF said.

The bill language the EFF was referring to says, "No person may engage in any transaction or take any other action with intent to evade the provisions of this Act, or any regulation, order, direction, mitigation measure, prohibition, or other authorization or directive issued thereunder."

The EFF analysis continued:

Even if the bill's sponsors do not intend it, giving the Commerce Department broad authority to impose crushing criminal penalties on any person trying to evade a 'mitigation measure' is dangerous. For example, in the case of a mitigation measure that bars the importation of TikTok into the US, it authorizes penalties, including 25 years of prison time, for any person who brings TikTok into the US, whether by use of a VPN or downloading it while in another country.

Generally speaking, the bill would "give more power to the executive branch and remove many of the commonsense restrictions that exist under the Foreign Intelligence Services Act (FISA)" and the Berman Amendments, the EFF said.

Why so broad? Senators don’t like Whac-A-Mole

The RESTRICT Act was introduced by Sens. Mark Warner (D-Va.) and John Thune (R-S.D.). Including Warner and Thune, the bill was co-sponsored by six Democrats and six Republicans.

Explaining why the bill doesn't just target TikTok, Warner cited other Chinese companies like Huawei and ZTE, and Russian company Kaspersky Lab. "We need a comprehensive, risk-based approach that proactively tackles sources of potentially dangerous technology before they gain a foothold in America, so we aren't playing Whac-A-Mole and scrambling to catch up once they're already ubiquitous," said Warner, who is chairman of the Senate Select Committee on Intelligence.

Thune agreed that "Congress needs to stop taking a piecemeal approach when it comes to technology from adversarial nations that pose national security risks."

The EFF urged Congress to focus instead on passing "comprehensive consumer data privacy legislation that will have a real impact, and protect our data no matter what platform it's on—TikTok, Facebook, Twitter, or anywhere else that profits from our private information... Foreign adversaries won't be able to get our data from social media companies if the social media companies aren't allowed to collect, retain, and sell it in the first place."

Channel Ars Technica