While the RESTRICT Act is making its way through the US Congress, the fate of TikTok remains unclear.
What's more, if the TikTok ban bill becomes law, the legality of using circumventing tools like VPN services to access the Chinese video sharing app may also be uncertain.
The broad language of the proposed law strikes again, sounding alarm bells among experts and internet users.
The RESTRICT Act 'should not have any ambiguity'
"The bill’s current language is vague and could potentially be interpreted to mean that someone using a VPN to bypass restrictions to access an application classified as a national security threat could be subject to penalties," wrote Andy Yen, CEO of cybersecurity company Proton, in a blog post.
A VPN is, in fact, security software largely used to bypass online censorship and access blocked apps. VPN use has been soaring worldwide lately, especially in places like Iran and Russia where authorities enforce a stringent grip on internet freedom.
As a reaction to this, authoritarian "governments are increasingly blocking, criminalizing, or imposing regulatory requirements on the circumvention tools themselves," Freedom on the Net reported in its last annual report.
Now, the leader of the company behind privacy-focused tools like Proton VPN and Proton Mail fears that, in its current form, the RESTRICT Act would give new powers to criminalize and punish VPN usage for the first time in a democratic country.
"The bill should not have any ambiguity about whether criminal or civil penalties could apply to individuals who use a VPN to access banned apps," said Yen.
He specifically refers to section 11 of the Act, which aims to regulate the penalties for breaking the law.
Privacy experts at the Electronic Frontier Foundation (EFF) raise a similar concern, pointing out how dangerous it is for the Bill giving "the Commerce Department broad authority to impose crushing criminal penalties on any person trying to evade a mitigation measure.”
The Act doesn't, in fact, explain what these mitigation measures might be. And, being that those guilty of evading them could face up to 20 years in prison, such vague provisions aren't certainly reassuring.
Senator Mark Warner, one of the lawmakers who crafted the RESTRICT Act, has been strongly rejecting such allegations. "This bill wouldn’t enable criminal or civil penalties against anybody just for using a VPN to access a banned app," he assured Proton.
"This bill is aimed squarely at corporations, not users. I’m a firm believer in—and federal courts have consistently upheld—the First Amendment’s protection for Americans to send and receive information. The RESTRICT Act doesn’t change those vital protections."
On the other hand, privacy advocates firmly believe that lawmakers should do their best to ensure the proposed law is not open to interpretation.
The current Administration may not intend to prosecute consumers, but who can vouch for the next government or simply a judge looking at the provisions from another perspective?
"While Senator Warner’s statement makes clear that individuals aren’t the target of this bill, such ambiguity should still be removed from the legislative text," concludes Yen, adding that this would help achieve "the legislative intent with far less risk of unintended consequences to internet freedom."
