What is the RESTRICT Act and how will it affect the tech industry?

The dispute between the US government and the Chinese-owned social media app TikTok has reached a new high, with a wave of regulations forbidding its use on government devices spreading through the Western world. 

An outright ban for all US citizens seems to be the White House's final goal, though, making VPN services a necessity for maintaining access to the app. However, legally speaking achieving such a ban hasn't been easy.

A new proposed legislation introduced in the US Senate could be the key to fast-tracking a TikTok ban. However, the RESTRICT Act has the potential to impact way more than the Chinese-owned video-sharing app. Here's what's at stake for US users.

What is the US RESTRICT Act?

Short for the Restricting the Emergence of Security Threats that Risk Information and Communications Technology Act, the RESTRICT Act was first introduced in the Senate on March 7 in a bipartisan effort led by Senators Mark Warner and John Thune.

As the name suggests, the bill seeks to empower the Department of Commerce to review and prohibit certain technologies where US user data interacts with "foreign adversaries."

China, Cuba, Iran, Russia, Venezuela and North Korea are currently the six named adversaries posing a significant risk to US national security, although the blacklist is open to new entries in the future.

"This bill presents a systematic framework for addressing technology-based threats to the security and safety of Americans," reads an official statement, urging lawmakers to quickly forward the proposed law to the President’s desk. 

After receiving the White House's blessing, it's currently passing through the Congress for review. Also, the Guardian reported the government to be 'very in favor' of the bill, gaining support from both Republicans and Democrats.

At the same time, critics are growing on the web and beyond. 

Commentators are increasingly criticizing the RESTRICT Act as it will de-facto empower the Secretary of Commerce to decide which technologies Americans can or cannot access.

They also warn of the far-reaching negative impact that the proposed legislation and its broad language will have on citizens' digital rights. 

A spokesperson for popular VPN provider Private Internet Access told TechRadar: "Prohibiting the use of certain technologies or social media sites bleakly opposes the vision of an open and free digital world and raises serious concerns over the future of digital freedom in the US.

"The US government should worry less about restricting access to certain technologies and instead work towards strengthening the nation’s laws protecting citizen’s privacy and data security, which are currently inconsistent and provide inadequate protection of citizens’ rights."    

TikTok ban: not easy as it looks

Before getting deeper into the concerns around the bill and how these could play out if it becomes law, let's look at the motivations lying behind it. 

Despite TikTok not being specifically named in the Act, it's undoubtedly one of the leading reasons for bringing lawmakers together to draw up a framework for coping with similar conundrums. 

Whether or not the most downloaded social media app is a worse privacy nightmare compared to other platforms, banning TikTok for all Americans is easier said than done.

After all, the Trump Administration already attempted something similar in 2020—a year after he successfully banned Chinese tech firm Huawei from doing business with any companies operating in the country.

Plans to sell part of the social media firm to an American company were then halted as TikTok filed a lawsuit against the US government. President Biden eventually revoked all these measures once he came into power.

Two years later, the US government hasn't yet brought up concrete evidence to justify either an outright block or force sale—digital rights advocacy group the Electronic Frontier Foundation (EFF) objected. 

So, even though not explicitly targeting the video-sharing app, the RESTRICT Act can quite clearly be seen as an attempt to finally make a TikTok ban a lawful thing to achieve. 

Not just a TikTok problem

Despite appearing to target TikTok, however, the RESTRICT Act appears to be far from a one-trick pony.

Instead, the directives are targeting an awful lot of digital technologies as long as they are used by more than 1 million US users. These include all web applications, AI software, machine learning, quantum computing, post-quantum cryptography and more.

The ACT indicates five categories that these technologies need to fall into to warrant any restrictions and/or other limitations. These are:

1. Sabotage or subversion of IT communications products and services
2. Catastrophic effects on US critical infrastructure and digital economy security or resilience
3. Interfering in, altering results or reported results of US federal elections
4. Coercive or criminal activities undermining the democratic processes and institutions or steer policy and regulatory decisions in favor of foreign adversaries
5. Undue or unacceptable safety risk to US national security or persons

These provisions seem to be more detailed than the ANTI-SOCIAL CCP Act, a similar bill currently under consideration. However, the language appears to be still too broad and vague, opening up to potential misuses.

Critics also object to how such executive power in the hands of the US government will inevitably consolidate the central role of US tech lobbies. 

Let's look at Meta as an example. The 2018 Cambridge Analytica scandal clearly showed how the Silicon Valley giant behind Facebook, Instagram and WhatsApp unlawfully exploited its platforms to influence the US elections. Last year, the Big Tech company was also found guilty of paying a Republican-backed firm to spread public distrust around TikTok.

Meta wasn't banned or restricted in the US for its wrongdoings. What's more, under the RESTRICT Act the social media giant will be granted a seat on the advisory committee responsible for deciding how to deal with the risks posed by TikTok and other foreign technologies. It isn't so difficult to spot the conflict of interest here, is it?   

Does the RESTRICT Act criminalize VPNs?

Another concern growing across the internet community is whether or not the proposed bill will make it illegal to use a VPN or other circumvention tools to grant access to restricted applications. 

Its creators have strongly rejected such allegations arguing that punishments, which can reach up to 20 years of jail time, would not be used against ordinary citizens.

"This legislation is aimed squarely at companies like Kaspersky, Huawei, and TikTok that create systemic risks to the United States' national security—not at individual users," explained Senator Warner.

Again, though, the broad language used in the bill still makes this scenario a real possibility. 

As experts at EFF pointed out, under the Act the Department of Commerce has the power to impose "mitigation measures" (it doesn't really articulate what measures might be, though) as well as punish any person who "evades" these measures.

Even though the current Administration claims not to be interested in prosecuting consumers, these vague definitions open up to potential abuses in the future.  

"Congress absolutely should tighten this penalty language to remove all possibility of prosecution against individuals who use an app," wrote EFF.   

Digital rights at risk

Critics are also fearing that the RESTRICT Act will compromise Americans' overall digital rights.

For starters, the Section 12 of the Bill exempts lawmakers from providing details around their decision process. Simply put, citizens would not know if the reasons to ban TikTok or any other apps are actually sound. This lack of transparency will also prevent challenging decisions, the base for a democratic nation. 

While the US government accumulates more power for deciding whether or not a foreign technology can operate on US soil, citizens' freedom of expression will be curbed, and online censorship will be deepened. 

According to experts, this not only negatively impacts people's rights, but it will also weaken the credibility of the United States at an international level when condemning similar behavior carried on by its enemies. 

"The free flow of information, even if it’s your enemy speaking, is an essential democratic principle," wrote EFF.

What's next?

As we have seen, while the RESTRICT Act wants to be a better solution to the game of whack-a-mole when dealing with potentially disruptive new technologies, it's managed to collect lots of criticism in just about a month of being introduced. 

Besides the aforementioned issues affecting Americans more broadly, some commentators are also concerned about the logistics of enforcing such provisions in the current IT market. 

Many US companies, even the biggest like Apple, carry out parts of their operations overseas, including the enemy #1 of the United States: China.

Currently passing through the Congress, the Act still needs to gain its way in the Senate before falling on President Biden's desk. However, many believe that a comprehensive data privacy regulation like the proposed ADPPA should be the real priority.

"If Congress is concerned about foreign powers collecting our data, it should focus on comprehensive consumer data privacy legislation that will have a real impact, and protect our data no matter what platform it’s on," states EFF, urging citizens to reach out their representatives for opposing the bill.

"Foreign adversaries won't be able to get our data from social media companies if the social media companies aren't allowed to collect, retain, and sell it in the first place."