The SECURE Act: Reclaiming Our Digital Communications

VI. Passwordless Authentication Standards

To ensure secure, consistent, and user-friendly authentication across all digital communication platforms, providers must implement standardized passwordless authentication systems. This requirement supports the Act's goals of enhanced security, improved user experience, and reduced vulnerability to common attack vectors such as phishing and credential stuffing.

The shift toward biometric authentication represents a fundamental advancement in digital security. Biometric identifiers - including fingerprints, facial recognition, iris scans, and voice patterns - offer unique advantages over traditional passwords. These biological markers cannot be forgotten, are extremely difficult to duplicate, and provide a more natural and efficient user experience. However, their implementation requires careful consideration of privacy implications and secure storage practices. Unlike passwords, biometric data cannot be simply changed if compromised, making their protection paramount.

A. Core Requirements

• Standards Compliance
  • FIDO2/WebAuthn compliance mandatory
  • Support for biometric and hardware security keys
  • Cross-platform compatibility required
• Security Features
  • End-to-end encryption of authentication processes
  • Phishing-resistant design
  • Multiple authenticator support
• Recovery Methods
  • Minimum of two backup authentication options
  • Secure account recovery process
  • Hardware token backup support

B. Privacy Requirements

• Data Protection
  • Biometric data must remain on user devices
  • Biometric templates must be encrypted and securely stored
  • No raw biometric data transmission permitted
  • Regular security audits required
  • Clear user consent required for biometric data collection
  • Right to opt for alternative authentication methods

VII. User Rights and Protections

Define comprehensive user rights regarding data privacy, control, and portability. Establish a "Privacy Bill of Rights" for digital communication users, including the right to access, correct, and delete personal data, and the right to know how their data is being used. Implement universal opt-out mechanisms for unwanted communications.

VIII. Checks on Big Tech Power

The Act would mandate transparency in algorithmic decision-making, enforce strict data privacy standards, and hold platforms accountable for the spread of misinformation. It would prevent arbitrary censorship of lawful communications, ensure interoperability and data portability between platforms, and prohibit the use of personal data for anti-competitive practices.

IX. Open Communication Systems and API Access

This section mandates that large tech companies open their public communication systems through secure and accessible APIs (does not apply to private systems):

• Require large tech companies to provide open, well-documented APIs for their communication systems, including but not limited to messaging, email, and social media platforms
• Mandate that these APIs provide access to core functionalities, allowing third-party developers to create innovative, interoperable services and applications
• Prohibit discriminatory practices in API access, ensuring fair and equal access for all developers, regardless of size or affiliation
• Require that API access be provided at no cost or at a reasonable, non-discriminatory cost that does not create barriers to entry for smaller developers or startups
• Mandate regular updates and maintenance of these APIs to ensure continued compatibility and security
• Establish security standards for API implementation to protect user data and privacy
• Prohibit the arbitrary restriction or revocation of API access as a means to stifle competition
• Require tech companies to provide adequate notice and transition periods for any significant changes to their APIs
• Establish a dispute resolution mechanism for conflicts related to API access and usage
• Mandate transparency in API usage policies and any algorithmic processes that might affect the functionality of third-party applications

This will foster User-Friendly Interfaces: Open APIs that are certain to remain open will encourage third party developers to implement user-friendly interfaces that allow individuals to easily navigate and understand their data. This includes clear explanations of what each piece of data means and how it relates to their overall privacy rights. Innovative ways of filtering these communications will emerge which are superior to what is currently available and considered industry standard while being substandard.

X. Economic Controls on Digital Communications

The U.S. Postal Service has effectively managed physical junk mail through a careful balance of economic incentives. While bulk mail rates make mass mailing possible, the tangible costs of printing, preparation, and postage create natural constraints on volume and encourage senders to target their audiences more carefully. This economic model has proven remarkably effective at preventing the postal system from being overwhelmed by spam while still enabling legitimate marketing communications.

Digital communications currently lack these economic constraints. The near-zero cost of sending email has created a "tragedy of the commons" where the absence of meaningful costs has led to rampant spam, compromising the utility of email for everyone. This Act establishes a similar economic framework for digital communications that has proven successful in physical mail.

A. Transparency in Sender Status

• Status Notification System
  • Real-time dashboard showing sender reputation score
  • Detailed metrics on delivery rates and complaint levels
  • Clear notification when approaching spam thresholds
  • Immediate alerts when classified as a potential spammer
• Violation Explanations
  • Specific reasons for spam classification
  • Data-backed evidence of problematic patterns
  • Historical trend analysis
  • Comparison to industry standards
• Remediation Path
  • Clear steps to restore good standing
  • Graduated system of restrictions and reinstatement
  • Training resources for better practices
  • Direct access to support for remediation assistance

B. Economic Framework

• Cost Structure
  • Personal communications remain free
  • Bulk senders pay graduated rates based on volume
  • Higher rates for less targeted communications
  • Discounts for authenticated senders with good track records
• Quality Incentives
  • Rate reductions for low complaint rates
  • Engagement-based pricing
  • Targeting accuracy bonuses
  • Reputation-based delivery prioritization

C. Appeal and Reinstatement Process

• Appeal Rights
  • Clear process for disputing spam classification
  • Right to present evidence and explanation
  • Independent review of appeals
  • Expedited process for verified business senders
• Reinstatement Requirements
  • Graduated return to full sending privileges
  • Mandatory training completion
  • Probationary period with enhanced monitoring
  • Regular status review meetings

D. Remediation Support

• Resources and Training
  • Best practices documentation
  • Interactive training modules
  • Case studies of successful rehabilitation
  • Expert consultation services
• Compliance Tools
  • Pre-sending content analysis
  • List hygiene tools
  • Engagement monitoring systems
  • Automated improvement suggestions

The system ensures that no sender is permanently banned without due process and clear opportunities for improvement. By combining economic incentives with transparent enforcement and clear remediation paths, this framework promotes responsible digital communication while providing fair treatment and support for all senders working to maintain or restore their good standing.

XI. Digital Communication Provider Responsibilities

Define minimum standards for security, privacy, and user controls. Require regular auditing and public reporting. Mandate the implementation of anti-impersonation measures. Require providers to appoint a Chief Privacy Officer and implement Privacy by Design principles in all product development.

XII. Enforcement and Penalties

Outline clear enforcement procedures and penalties for non-compliance. Establish a whistleblower protection program for employees of digital communication providers. Implement severe penalties for privacy breaches, unauthorized data sharing, and violations of open API requirements.

XIII. Implementation and Review

Set a phased implementation schedule. Establish a framework for regular review and adaptation of regulations to keep pace with technological advancements. Create an advisory board including technology experts, privacy advocates, user representatives, and API specialists. Conduct annual privacy impact assessments and API accessibility reviews of the Act's implementation.

XIV. International Cooperation

Establish frameworks for international cooperation in regulating cross-border digital communications. Promote the adoption of similar standards in other countries to create a globally coherent regulatory environment. Work towards international agreements on data privacy standards, cross-border data protection, and global standards for open APIs in digital communication systems.

XV. Data Transparency

To further strengthen user rights and transparency regarding personal data, the SECURE Act will include provisions that allow users to view their data in a clear and accessible manner. This will involve:

• User Access to Data: All users will have the right to access their personal data as it is stored by digital communication providers. This includes not only the data itself but also metadata that describes how the data is collected, processed, and stored.
• Clear Metadata Display: Users will be able to see detailed metadata associated with their data, including:
  • Collection Date: When the data was collected.
  • Usage History: How and when their data has been used by the provider including views along with full disclosure of the viewer data
  • Applicable Policies: Information about the privacy policies that were in effect at the time of data collection, including any changes made to these policies over time.
• Policy Transparency: Providers must maintain transparency regarding their data handling practices. This includes making their privacy policies readily available and understandable, ensuring that users are aware of their rights and the implications of their data being collected.
• Regular Updates: Users will receive notifications about any significant changes to data policies or practices, ensuring they are always informed about how their data is being managed.

XVI. Large Attachments and Playlists

This section focuses on improving the handling of large files and media content in emails. The main goals appear to be:

1. Enhancing security through cloud storage and encryption
2. Improving user experience with easy-to-use interfaces and clear notifications
3. Optimizing data transfer through compression and streaming protocols
4. Implementing version control and collaborative features

These guidelines would significantly improve how large files are shared via email, addressing common pain points like size limits and security concerns. The emphasis on secure cloud storage and streaming protocols is particularly relevant in our increasingly media-rich digital communications.

XVII. HIPAA Compliance

This section proposes stringent measures—several of which go beyond HIPAA's current baseline—to secure email communications involving protected health information (PHI). (HIPAA does not categorically bar email; it requires reasonable safeguards such as encryption and Business Associate Agreements.) Key points include:

1. Mandatory end-to-end encryption for PHI (HIPAA currently treats encryption as an "addressable" safeguard; this Act would make it a firm requirement)
2. Strict access controls and audit trails
3. Secure options for healthcare providers, including email-to-fax capabilities
4. Employee training and regular audits for email service providers
5. Requirements for Business Associate Agreements (BAAs)

These guidelines would substantially enhance the security and compliance of email communications in healthcare settings. The focus on end-to-end encryption, access controls, and audit trails addresses critical aspects of protecting sensitive health information.

XVIII. Prevention of Government Abuse and Surveillance

This section establishes stringent measures to prevent government overreach and protect citizens from unwarranted surveillance:

• Require warrants for any government access to digital communications, with narrow and clearly defined exceptions for immediate threats to life
• Prohibit bulk data collection and mass surveillance programs
• Mandate transparency reports from both government agencies and digital communication providers regarding government requests for user data
• Establish an independent oversight board to review government surveillance activities and ensure compliance with the law
• Protect whistleblowers who expose unlawful government surveillance
• Ban the use of secret court orders (such as National Security Letters) to compel companies to provide user data without disclosure
• Require notification to users whose data has been accessed by the government, with delays only permitted under strict judicial oversight
• Prohibit the intentional creation of backdoors or vulnerabilities in encryption systems
• Mandate regular audits of government agencies' data access and usage practices
• Establish severe penalties for government officials who abuse their authority to access or use personal data
• Create a public advocate position in the FISA court system to represent privacy and civil liberties interests
• Require detailed logging of all government access to user data, subject to review by the oversight board
• Prohibit the use of parallel construction to hide the origin of evidence obtained through surveillance
• Mandate the destruction of collected data after a specified period unless its continued retention is justified through a transparent, court-supervised process

These measures aim to balance national security needs with individual privacy rights, ensuring that government surveillance is conducted only when necessary, under strict oversight, and with full respect for civil liberties.

XIX. Public Content Moderation Framework

This Act would establish a unified public moderation system for all digital communications and publications. Rather than repealing Section 230 of the Communications Decency Act of 1996, it preserves the host immunity that good-faith platforms depend on and supplements it with a transparency, reporting, and appeals layer that applies across all digital platforms.

The system would:

• Create a public standardized reporting mechanism (API) so users can flag illegal content, misinformation, disturbing material, scams, age-inappropriate content, hate speech, and other harmful communications.
• Create a centralized database of reported content accessible via web and API to law enforcement and authorized moderators and in a redacted format to the public.
• Would require all blocked content to have placeholders with reason for removal, with timestamps and moderation links.
• Platforms would be expected to monitor this database, enforce restrictions on banned material, and point to placeholders
• Encourage development of honest and open public discussion forums about what is banned. The Act would require age and identity verification for sensitive content.
• The moderation placeholder will be public, will have an appeals process, a public comments section and will remain while the content is blocked.
• Establish clear guidelines for content moderation that social media platforms and other digital communication services would be expected to follow.
• Implement a tiered response system based on the severity and frequency of violations.
• Implement a tiered system of user's reporting weight based on deviation from the norm.
• The Act would require platforms and law enforcement to act on verified reports within specified timeframes.
• The Act would mandate transparency in moderation practices and regular public reporting of moderation actions.
• Monitor aggressively for abuse from government officials or other parties involved in the administration and security of the system and Provide for severe penalties for such abuse.

XX. Mandatory Public Service Materials

A. Required Content Categories

B. Implementation Requirements

C. Quality and Accuracy Standards

D. Platform Responsibilities

E. Oversight and Compliance

F. Innovation and Improvement

G. Public Service Materials API

{
    "id": "psa-2024-001",
    "type": "emergency",
    "priority": "high",
    "title": {
        "en": "Emergency Weather Alert",
        "es": "Alerta de Clima de Emergencia"
    },
    "content": {
        "en": "Severe weather warning for...",
        "es": "Advertencia de clima severo para..."
    },
    "metadata": {
        "published": "2024-10-27T10:00:00Z",
        "expires": "2024-10-28T10:00:00Z",
        "version": "1.0",
        "source": "National Weather Service",
        "geographic_scope": {
            "type": "polygon",
            "coordinates": [...]
        }
    },
    "links": {
        "more_info": "https://weather.gov/alert/123",
        "related": [...]
    }
}
            

Areas for Improvement

Recommended Experts to Contact