> For instance, consider a DApp like Blockstack that allows users to control their online data and privacy. How would Blockstack be able to comply with legislation for things like names and email addresses when the app is decentralized?<p>They will demand Blockstack builds a 2nd version of their app that send's all the decrypted data to the spy agency, in some hard to detect way that looks like the same internet activity blockstack's app would normally produce. The act requires the pay Blockstack to do this. They will then demand that Blockstack silently download this version of the app to any device the nominate.<p>Notably they won't demand that Blockstack introduce a black door or other weakness into the app they normally supply because the bill forbids introducing a "systemic weakness" others might be able to exploit. They can get away with this fiction because they already have a systemic weakness you could drive the entire fleet of US aircraft carriers through: automatic updates.<p>Nor will they demand Blockstack provide data they don't have access to, maybe because it's encrypted with key they don't have or stored in a place that's difficult to get access. That's because entire point of the bill is to allow them to get access to the data when it's unencrypted, which it must be at some point if the user is going to view it. Why bother going through the time consuming effort of decrypting stuff when you can just demand the unencrypted version be delivered to your door in close to real time?<p>Finally they probably won't ask Blockstack to do any of this. Why bother when they can use the same mechanism to force Google to install back doors in the keyboard, touch screen, microphone, camera, Android javascript libraries that captures everything the user types, taps, says or photographs along with their current position back to them?