A look at how tech firms and government keep failing to curb the sharing of child sexual abuse images, long after the PROTECT our Children Act was passed in '08
Online predators create and share the illegal material, which is increasingly cloaked by technology.
New York Times
Context & Ripple Effects
This piece lands eleven years into a pattern, not an exception: Congress passed the PROTECT our Children Act in 2008, and the same year saw COPPA already a decade old, yet both statutes have been hollowed out by court rulings, uneven enforcement, and technological change that outpaces them. The Times' follow-up coverage found tech companies still lack even a common standard for identifying illegal video content years after the law's deadline.
What has changed since is the volume and the stakes: reporting shows abuse material growing larger and more complex while exploiting platforms' blind spots, with Instagram cited for leaving accounts up months after a seller was charged. The policy response is now splitting along a fault line — Five Eyes governments pushing scanning mandates and senators threatening Section 230 removal on one side, and an EU privacy law restricting message monitoring on the other.
First-order effects
Tech firms face immediate legal exposure: the Senate bill introduced alongside the Five Eyes guidelines would strip Section 230 protections from platforms that fail to police child sexual abuse material, converting a moral failing into direct liability.
Platforms are caught between incompatible mandates right now — US-aligned pressure to scan private messages collides with the EU law taking effect December 20, 2020 that would prohibit exactly that monitoring for email and messaging services.
Second-order effects
Because detection standards remain fragmented across companies, predators migrate to whichever service scans least — a whack-a-mole dynamic that punishes compliant platforms competitively and rewards laggards until liability rules force a floor.
The compliance burden pushes platform operators toward automated scanning infrastructure and shared hash databases, shifting spending toward trust-and-safety tooling vendors and making detection capability a procurement decision rather than a per-company research problem.
Third-order effects
If the pattern holds, child-safety enforcement becomes the wedge case for ending distribution-layer liability broadly: once Section 230 protection is made conditional for one category of content, the same structure is available to legislators for every other harm category.
The deeper structural shift is that end-to-end encrypted services become the last unscanned refuge, forcing a permanent legislative standoff between public-safety scanning mandates and communications privacy — a fight the EU restriction shows is now jurisdictional, not just corporate.
The trend: Child sexual abuse material is becoming the test case where governments convert platform self-policing into enforceable legal duties, with privacy-protective jurisdictions like the EU setting the counterweight.
for months, my colleague @mhkeller and i have been investigating one of the darkest, most depraved topics i've ever encountered: online child sexual abuse material, also known as child pornography. what we found is deeply troubling. 1/ https://www.nytimes.com/...
The tech companies “knew the house was full of roaches, and they were scared to turn the lights on. And then when they did turn the lights on, it was worse than they thought.” https://www.nytimes.com/...
“The companies have known for years that their platforms were being co-opted by predators, but many of them essentially looked the other way, according to interviews and emails detailing the companies' activities. And..they were slow to respond.” https://www.nytimes.com/...
Last year, tech companies reported 45 million+ online photos and videos of children being sexually abused. More than double the previous year. This is the first part of an investigative series on child sexual abuse. It contains graphic descriptions. https://www.nytimes.com/...
This is a really important series and I'm glad the NY Times is talking to the incredible people who work on child safety every day. One point they seem to be a bit confused about: the companies that report the most CSAM are not the worst actors, but the best. https://twitter.com/…
The Times is right to bring up the difficult trade-off between privacy and child safety raised by the growth of E2E encryption. This is why we ran a workshop on non-backdoor options to deal with this issue, as covered by @CaseyNewton: https://twitter.com/...
I wish this had delved a bit more into what law enforcement is looking/asking for in terms of solutions, rather than just documenting the problem. There were nods to “more resources/platform accountability,” but the subtext seemed to be weaken encryption?
Important read for anyone working in internet freedom,privacy,encryption, &digital rights. “The Internet Is Overrun With Images of Child Sexual Abuse. What Went Wrong?” https://nyti.ms/2mIrcJ1 survivors stories & analysis of federal response, corporate apathy, @tumblr @bing etc
This is not easy reading, and reflects why people in government are pretty much contemptuous when tech companies base their argument for encryption on ‘we want to protect our users’ privacy'. https://twitter.com/...
the apple vs fbi fight laid it bare friends on the west coast believed it was the cost of protecting users friends on the east coast asked why apple supported terrorists
sorry if that's confusing — point im making is that it's both, always has been, but is basically inherently political (and l partisan around surveillance types/governments vs the west coast technolibertarians) i feel like for normals it will always be a moving target
the dynamic i have been fixated on for the past six or seven years is how far the pendulum has swung away from the Snowden-era revelations — where once “we” looked at encryption as a safeguard against oppressive government, now it is the refuge of the worst of actors