The SECURE Act: Reclaiming Our Digital Communications

VI. Passwordless Authentication Standards

To ensure secure, consistent, and user-friendly authentication across all digital communication platforms, providers must implement standardized passwordless authentication systems. This requirement supports the Act's goals of enhanced security, improved user experience, and reduced vulnerability to common attack vectors such as phishing and credential stuffing.

The shift toward biometric authentication represents a fundamental advancement in digital security. Biometric identifiers - including fingerprints, facial recognition, iris scans, and voice patterns - offer unique advantages over traditional passwords. These biological markers cannot be forgotten, are extremely difficult to duplicate, and provide a more natural and efficient user experience. However, their implementation requires careful consideration of privacy implications and secure storage practices. Unlike passwords, biometric data cannot be simply changed if compromised, making their protection paramount.

A. Core Requirements

• Standards Compliance
  • FIDO2/WebAuthn compliance mandatory
  • Support for biometric and hardware security keys
  • Cross-platform compatibility required
• Security Features
  • End-to-end encryption of authentication processes
  • Phishing-resistant design
  • Multiple authenticator support
• Recovery Methods
  • Minimum of two backup authentication options
  • Secure account recovery process
  • Hardware token backup support

B. Privacy Requirements

• Data Protection
  • Biometric data must remain on user devices
  • Biometric templates must be encrypted and securely stored
  • No raw biometric data transmission permitted
  • Regular security audits required
  • Clear user consent required for biometric data collection
  • Right to opt for alternative authentication methods

VII. User Rights and Protections

Define comprehensive user rights regarding data privacy, control, and portability. Establish a "Privacy Bill of Rights" for digital communication users, including the right to access, correct, and delete personal data, and the right to know how their data is being used. Implement universal opt-out mechanisms for unwanted communications.

VIII. Checks on Big Tech Power

The Act would mandate transparency in algorithmic decision-making, enforce strict data privacy standards, and hold platforms accountable for the spread of misinformation. It would prevent arbitrary censorship of lawful communications, ensure interoperability and data portability between platforms, and prohibit the use of personal data for anti-competitive practices.

IX. Open Communication Systems and API Access

This section mandates that large tech companies open their public communication systems through secure and accessible APIs (does not apply to private systems):

• Require large tech companies to provide open, well-documented APIs for their communication systems, including but not limited to messaging, email, and social media platforms
• Mandate that these APIs provide access to core functionalities, allowing third-party developers to create innovative, interoperable services and applications
• Prohibit discriminatory practices in API access, ensuring fair and equal access for all developers, regardless of size or affiliation
• Require that API access be provided at no cost or at a reasonable, non-discriminatory cost that does not create barriers to entry for smaller developers or startups
• Mandate regular updates and maintenance of these APIs to ensure continued compatibility and security
• Establish security standards for API implementation to protect user data and privacy
• Prohibit the arbitrary restriction or revocation of API access as a means to stifle competition
• Require tech companies to provide adequate notice and transition periods for any significant changes to their APIs
• Establish a dispute resolution mechanism for conflicts related to API access and usage
• Mandate transparency in API usage policies and any algorithmic processes that might affect the functionality of third-party applications

This will foster User-Friendly Interfaces: Open APIs that are certain to remain open will encourage third party developers to implement user-friendly interfaces that allow individuals to easily navigate and understand their data. This includes clear explanations of what each piece of data means and how it relates to their overall privacy rights. Innovative ways of filtering these communications will emerge which are superior to what is currently available and considered industry standard while being substandard.

X. Economic Controls on Digital Communications

The U.S. Postal Service has effectively managed physical junk mail through a careful balance of economic incentives. While bulk mail rates make mass mailing possible, the tangible costs of printing, preparation, and postage create natural constraints on volume and encourage senders to target their audiences more carefully. This economic model has proven remarkably effective at preventing the postal system from being overwhelmed by spam while still enabling legitimate marketing communications.

Digital communications currently lack these economic constraints. The near-zero cost of sending email has created a "tragedy of the commons" where the absence of meaningful costs has led to rampant spam, compromising the utility of email for everyone. This Act establishes a similar economic framework for digital communications that has proven successful in physical mail.

A. Transparency in Sender Status

• Status Notification System
  • Real-time dashboard showing sender reputation score
  • Detailed metrics on delivery rates and complaint levels
  • Clear notification when approaching spam thresholds
  • Immediate alerts when classified as a potential spammer
• Violation Explanations
  • Specific reasons for spam classification
  • Data-backed evidence of problematic patterns
  • Historical trend analysis
  • Comparison to industry standards
• Remediation Path
  • Clear steps to restore good standing
  • Graduated system of restrictions and reinstatement
  • Training resources for better practices
  • Direct access to support for remediation assistance

B. Economic Framework

• Cost Structure
  • Personal communications remain free
  • Bulk senders pay graduated rates based on volume
  • Higher rates for less targeted communications
  • Discounts for authenticated senders with good track records
• Quality Incentives
  • Rate reductions for low complaint rates
  • Engagement-based pricing
  • Targeting accuracy bonuses
  • Reputation-based delivery prioritization

C. Appeal and Reinstatement Process

• Appeal Rights
  • Clear process for disputing spam classification
  • Right to present evidence and explanation
  • Independent review of appeals
  • Expedited process for verified business senders
• Reinstatement Requirements
  • Graduated return to full sending privileges
  • Mandatory training completion
  • Probationary period with enhanced monitoring
  • Regular status review meetings

D. Remediation Support

• Resources and Training
  • Best practices documentation
  • Interactive training modules
  • Case studies of successful rehabilitation
  • Expert consultation services
• Compliance Tools
  • Pre-sending content analysis
  • List hygiene tools
  • Engagement monitoring systems
  • Automated improvement suggestions

The system ensures that no sender is permanently banned without due process and clear opportunities for improvement. By combining economic incentives with transparent enforcement and clear remediation paths, this framework promotes responsible digital communication while providing fair treatment and support for all senders working to maintain or restore their good standing.

XI. Digital Communication Provider Responsibilities

Define minimum standards for security, privacy, and user controls. Require regular auditing and public reporting. Mandate the implementation of anti-impersonation measures. Require providers to appoint a Chief Privacy Officer and implement Privacy by Design principles in all product development.

XII. Enforcement and Penalties

Outline clear enforcement procedures and penalties for non-compliance. Establish a whistleblower protection program for employees of digital communication providers. Implement severe penalties for privacy breaches, unauthorized data sharing, and violations of open API requirements.

XIII. Implementation and Review

Set a phased implementation schedule. Establish a framework for regular review and adaptation of regulations to keep pace with technological advancements. Create an advisory board including technology experts, privacy advocates, user representatives, and API specialists. Conduct annual privacy impact assessments and API accessibility reviews of the Act's implementation.

XIV. International Cooperation

Establish frameworks for international cooperation in regulating cross-border digital communications. Promote the adoption of similar standards in other countries to create a globally coherent regulatory environment. Work towards international agreements on data privacy standards, cross-border data protection, and global standards for open APIs in digital communication systems.

XV. Data Transparency

To further strengthen user rights and transparency regarding personal data, the SECURE Act will include provisions that allow users to view their data in a clear and accessible manner. This will involve:

• User Access to Data: All users will have the right to access their personal data as it is stored by digital communication providers. This includes not only the data itself but also metadata that describes how the data is collected, processed, and stored.
• Clear Metadata Display: Users will be able to see detailed metadata associated with their data, including:
  • Collection Date: When the data was collected.
  • Usage History: How and when their data has been used by the provider including views along with full disclosure of the viewer data
  • Applicable Policies: Information about the privacy policies that were in effect at the time of data collection, including any changes made to these policies over time.
• Policy Transparency: Providers must maintain transparency regarding their data handling practices. This includes making their privacy policies readily available and understandable, ensuring that users are aware of their rights and the implications of their data being collected.
• Regular Updates: Users will receive notifications about any significant changes to data policies or practices, ensuring they are always informed about how their data is being managed.

XVI. Large Attachments and Playlists

This section focuses on improving the handling of large files and media content in emails. The main goals appear to be:

1. Enhancing security through cloud storage and encryption
2. Improving user experience with easy-to-use interfaces and clear notifications
3. Optimizing data transfer through compression and streaming protocols
4. Implementing version control and collaborative features

These guidelines would significantly improve how large files are shared via email, addressing common pain points like size limits and security concerns. The emphasis on secure cloud storage and streaming protocols is particularly relevant in our increasingly media-rich digital communications.

XVII. HIPAA Compliance

This section proposes stringent measures—several of which go beyond HIPAA's current baseline—to secure email communications involving protected health information (PHI). (HIPAA does not categorically bar email; it requires reasonable safeguards such as encryption and Business Associate Agreements.) Key points include:

1. Mandatory end-to-end encryption for PHI (HIPAA currently treats encryption as an "addressable" safeguard; this Act would make it a firm requirement)
2. Strict access controls and audit trails
3. Secure options for healthcare providers, including email-to-fax capabilities
4. Employee training and regular audits for email service providers
5. Requirements for Business Associate Agreements (BAAs)

These guidelines would substantially enhance the security and compliance of email communications in healthcare settings. The focus on end-to-end encryption, access controls, and audit trails addresses critical aspects of protecting sensitive health information.

XVIII. Prevention of Government Abuse and Surveillance

This section establishes stringent measures to prevent government overreach and protect citizens from unwarranted surveillance:

• Require warrants for any government access to digital communications, with narrow and clearly defined exceptions for immediate threats to life
• Prohibit bulk data collection and mass surveillance programs
• Mandate transparency reports from both government agencies and digital communication providers regarding government requests for user data
• Establish an independent oversight board to review government surveillance activities and ensure compliance with the law
• Protect whistleblowers who expose unlawful government surveillance
• Ban the use of secret court orders (such as National Security Letters) to compel companies to provide user data without disclosure
• Require notification to users whose data has been accessed by the government, with delays only permitted under strict judicial oversight
• Prohibit the intentional creation of backdoors or vulnerabilities in encryption systems
• Mandate regular audits of government agencies' data access and usage practices
• Establish severe penalties for government officials who abuse their authority to access or use personal data
• Create a public advocate position in the FISA court system to represent privacy and civil liberties interests
• Require detailed logging of all government access to user data, subject to review by the oversight board
• Prohibit the use of parallel construction to hide the origin of evidence obtained through surveillance
• Mandate the destruction of collected data after a specified period unless its continued retention is justified through a transparent, court-supervised process

These measures aim to balance national security needs with individual privacy rights, ensuring that government surveillance is conducted only when necessary, under strict oversight, and with full respect for civil liberties.

XIX. Public Content Moderation Framework

This Act would establish a unified public moderation system for all digital communications and publications. Rather than repealing Section 230 of the Communications Decency Act of 1996, it preserves the host immunity that good-faith platforms depend on and supplements it with a transparency, reporting, and appeals layer that applies across all digital platforms.

The system would:

• Create a public standardized reporting mechanism (API) so users can flag illegal content, misinformation, disturbing material, scams, age-inappropriate content, hate speech, and other harmful communications.
• Create a centralized database of reported content accessible via web and API to law enforcement and authorized moderators and in a redacted format to the public.
• Would require all blocked content to have placeholders with reason for removal, with timestamps and moderation links.
• Platforms would be expected to monitor this database, enforce restrictions on banned material, and point to placeholders
• Encourage development of honest and open public discussion forums about what is banned. The Act would require age and identity verification for sensitive content.
• The moderation placeholder will be public, will have an appeals process, a public comments section and will remain while the content is blocked.
• Establish clear guidelines for content moderation that social media platforms and other digital communication services would be expected to follow.
• Implement a tiered response system based on the severity and frequency of violations.
• Implement a tiered system of user's reporting weight based on deviation from the norm.
• The Act would require platforms and law enforcement to act on verified reports within specified timeframes.
• The Act would mandate transparency in moderation practices and regular public reporting of moderation actions.
• Monitor aggressively for abuse from government officials or other parties involved in the administration and security of the system and Provide for severe penalties for such abuse.

XX. Mandatory Public Service Materials

A. Required Content Categories

B. Implementation Requirements

C. Quality and Accuracy Standards

D. Platform Responsibilities

E. Oversight and Compliance

F. Innovation and Improvement

G. Public Service Materials API

{
    "id": "psa-2024-001",
    "type": "emergency",
    "priority": "high",
    "title": {
        "en": "Emergency Weather Alert",
        "es": "Alerta de Clima de Emergencia"
    },
    "content": {
        "en": "Severe weather warning for...",
        "es": "Advertencia de clima severo para..."
    },
    "metadata": {
        "published": "2024-10-27T10:00:00Z",
        "expires": "2024-10-28T10:00:00Z",
        "version": "1.0",
        "source": "National Weather Service",
        "geographic_scope": {
            "type": "polygon",
            "coordinates": [...]
        }
    },
    "links": {
        "more_info": "https://weather.gov/alert/123",
        "related": [...]
    }
}
            

XXI. Documented Correspondence with Covered Entities

The Bell System was required to publish a directory and to staff operators who would connect a caller to the party they were trying to reach. A citizen who needed to reach a company could find the number, place the call, and be connected. That obligation was not a courtesy; it was a condition of operating the network.

No equivalent obligation exists today. A consumer with a problem is routed through chatbots, phone trees, and no-reply addresses, and at the end of it neither party holds a record of what was asked or what was answered. The company can say it responded. The consumer can say it did not. Nothing in the channel can settle it.

The absence of that obligation has not made access to a person cheap. It has made it a product. LinkedIn, a Microsoft subsidiary, sells the right to attempt contact with a stranger through a credit called an InMail. Sales Navigator Core lists at $99 per month for fifty credits, which is roughly two dollars for one attempted message; the Advanced tier runs about three dollars per attempt; Recruiter Lite is higher still, and enterprise Recruiter carries no public list price at all. A recruiter working a hundred candidates a month is paying a few hundred dollars for the privilege of trying to reach people who never agreed to be reachable.

What that money buys is worth reading closely. The credit is refunded only if the recipient replies, within ninety days. The pricing is therefore explicit that the product is an attempt, not a delivery — silence is the billable outcome, and it is the ordinary one. The sender receives no confirmation that the message was delivered, no confirmation that it was seen, and no stated reason when nothing comes back. The recipient, for their part, never consented to the transaction, cannot tell a paid approach from an unpaid one, and holds no record of it either. Two parties, real money changing hands, and neither of them ends up with proof of anything.

That would be a narrow complaint if the channel stood alone. It does not. LinkedIn has been a wholly owned subsidiary of Microsoft since 2016, when Microsoft acquired it for $26.2 billion, and it now reports more than 1.3 billion registered member accounts. What matters is not that number but what sits beside it inside the same company. Microsoft operates the professional graph on which the approach is made, the Outlook and Exchange systems through which a great deal of the resulting business correspondence travels, the Teams service on which the follow-up conversation happens, the GitHub platform on which much of the work product is stored, the Azure infrastructure that hosts roughly a fifth of the world's cloud capacity, and the Windows operating system on the machine where all of it is typed. It is deploying AI assistants across every one of those surfaces. No competitor sees that stack, and no citizen can opt out of enough of it to matter.

None of those holdings is unlawful, and none of this alleges misconduct. The objection is structural. No regulator sets delivery standards for a social network the way one does for a bank, a carrier, or a broadcaster. There is no obligation to deliver a message, no obligation to explain a message that was not delivered, no audit of the ranking that decides whose approach is seen and whose is buried, and no independent view of any of it. A single firm sets the price of access, the odds of arrival, and the terms of the record — and holds the inbox, the infrastructure, and the endpoint besides. The pattern is not unique to one company; Google assembles the consumer-side equivalent from Gmail, Android, Search, YouTube, and Google Cloud. Microsoft is named here because the professional graph and the working inbox sit under one roof, which makes the concentration easiest to see. In any other channel carrying this much of civic and economic life, that arrangement would have been given a rulebook decades ago.

A first-class stamp buys carriage of a letter, and for a small additional fee it buys certified proof that the letter was delivered and to whom. That has been true for over a century. In the digital channel a sender pays several times the price of a stamp and receives neither.

This section does not answer that larger problem, and should not be read as claiming to. It does not break up a holding, regulate a ranking, or set a price. It makes one narrow demand: that somewhere in the arrangement there exist a channel where the record belongs to both parties. This section does not compel any entity to answer a message. It requires that the message be receivable, that its delivery be provable, and that the resulting record belong to both parties. The Act does not manufacture a reply. It removes the ability to deny that the question was asked.

A. Published Points of Contact

• Directory Obligation
  • Every covered entity shall publish and maintain at least one UDCP address designated for correspondence from natural persons.
  • Designated addresses shall be listed in a public directory maintained by the Digital Communications Division, queryable without charge and without authentication.
  • Entities operating distinct consumer-facing lines of business shall designate an address for each, so that a consumer is not required to guess which division holds their matter.
  • A change of designated address shall be reflected in the directory before it takes effect, and messages to the prior address shall continue to be accepted for not less than one hundred eighty days.

B. Obligation to Receive

• Acceptance
  • A covered entity shall accept UDCP messages transmitted to its designated address from any authenticated sender.
  • An entity may not refuse, discard, or route to an unmonitored destination a message properly addressed and authenticated under the UDCP.
  • Where an entity declines to accept a message, the non-delivery notification requirements of Section IV apply, and the stated reason becomes part of the correspondence record.
  • Volume-based rate limiting is permitted against a single sender only where the pattern meets the bulk-sender thresholds of Section IX, and any such limitation shall itself be disclosed to the sender.
• Automated Acknowledgment
  • Delivery confirmation shall be generated by the protocol under the UDCP delivery-confirmation requirement, not authored by the receiving entity.
  • An acknowledgment records that a message was delivered and, where applicable, retrieved. It is not a substantive response and shall not be represented as one.

C. The Correspondence Record

• Thread Identity
  • Each correspondence initiated under this section shall carry a persistent thread identifier that survives transfer between departments, agents, vendors, and successor entities.
  • A consumer shall not be required to restate a matter because an entity has reassigned it internally.
• Contents of the Record
  • Authenticated identity of each sender, per the UDCP sender-authentication requirement.
  • Transmission and delivery timestamps, and retrieval timestamps where retrieval occurs.
  • Message integrity verification, per the UDCP message-integrity requirement.
  • Any non-delivery event and the reason stated for it.
  • Intervals during which no response was transmitted.
• Symmetrical Access
  • Both parties shall be able to export the complete record in a standardized, machine-readable format at any time, without charge and without requesting it from the other party.
  • Neither party may unilaterally delete, alter, or expire the other party's copy.
  • Retention shall be not less than seven years, or the applicable statute of limitations for the underlying subject matter, whichever is longer.

D. Evidentiary Standing

• Certification
  • A correspondence record exported under subsection C, accompanied by the Division's certification of the cryptographic process that produced it, is intended to be self-authenticating as to the fact and time of transmission, delivery, and retrieval.
  • Self-authentication concerns the genuineness of the record only. It does not render the contents admissible for their truth, and does not displace hearsay, relevance, privilege, or any other rule of evidence.
  • The Division shall publish the certification procedure and the conformance tests a record must pass.
• Prohibited Contradiction
  • A covered entity may not assert in any proceeding, or in any communication to a regulator, that it transmitted a communication that the record shows was not delivered.

E. No Compelled Response

• Limitation
  • Nothing in this section requires a covered entity to respond to any message, to respond within any period, or to respond in any particular manner.
  • An entity may decline to respond. The absence of a response is recorded as an interval in the correspondence record and carries no penalty under this Act.
  • No provision of this section shall be construed to require a covered entity to adopt, endorse, or transmit any statement of position.
• Effect
  • Where another federal or state law, a contract, or a sector-specific regulation already imposes a duty to respond, the correspondence record is available as evidence of compliance or non-compliance with that separate duty.
  • This section creates the record. It does not create the duty.

F. Anti-Circumvention

• Prohibited Practices
  • An entity may not condition the provision of goods or services on a consumer's waiver of the right to correspond under this section.
  • An entity may not require that a matter be raised only through a proprietary channel that produces no exportable record.
  • An entity may not impose materially worse terms, longer delays, or reduced remedies on a consumer for having used the designated address.
  • Proprietary support channels remain permitted and may be offered alongside the designated address. They may not be the only path.

G. Accommodation for Small Entities

• Scaled Obligations
  • Entities below the threshold established by the Division may designate a forwarding address that delivers to an existing mailbox, satisfying subsections A and B without separate infrastructure.
  • Legacy systems may satisfy this section through the single SMTP header contemplated in the UDCP legacy-support provision.
  • The phase-in periods of the Technical Standards section apply, and no obligation under this section takes effect before UDCP implementation is required of that entity.

H. Enforcement

• Violations of this section are subject to the enforcement procedures and penalties of Section XI.
• Failure to maintain a designated address, refusal to accept properly authenticated messages, and the circumvention practices enumerated in subsection F are each independently actionable.
• The Division shall publish annual statistics on directory coverage, acceptance rates, and response intervals by sector, in aggregate and without identifying individual consumers.

The intent of this section is narrow and should not be overstated. It does not make any company helpful. It does not shorten a hold time or improve an answer. It establishes that when a citizen puts a question to an institution, the asking is a matter of record, the delivery is a matter of record, and the silence, if there is silence, is a matter of record too. Every other remedy a consumer might pursue — a regulator, a contract claim, a court — currently fails at the same first step, which is proving what was said and when. This section fixes that step and leaves the rest to the law that already exists.

Areas for Improvement

Recommended Experts to Contact