The UK's Online Safety Bill: Safety or Surveillance?

What is the UK Online Safety Bill?

The UK Online Safety Bill is a regulatory framework that aims to make the Internet a safer place for children and tackle illegal online content. The new set of rules aims to make big tech and social media platforms more responsible for the content they show and their users' safety while using their services.

Platforms that fail to meet the regulations will have to answer to Ofcom, the UK's communication regulator. They could face fines of up to £18m or 10% of their revenue (whichever is higher) or, depending on the seriousness of the violation, being blocked completely.

The first draft of the Online Safety Bill was published in May 2021 and went through extensive Parliamentary scrutiny resulting in multiple changes, cuts, and add-ons.

So, what does the UK Online Safety Bill entail?

The Online Safety Bill is mostly aimed at keeping children and young people safe online. To do this, it will require social media platforms to:

• remove illegal content quickly or prevent it from appearing at all
• prevent children from accessing harmful and age-inappropriate content
• enforce age limits and age-checking measures
• the largest social media platforms will have to be more transparent about the risks and dangers posed to children by publishing risk assessments
• provide parents and children with clear and accessible ways to report problems online when they arise

Further regulations for the protection of adults include removing all illegal content, any content that is banned by the platform's own terms of service, and providing adult users with the tools to tailor the content that they see and who they engage with.

What exactly does it mean by illegal or harmful content?

The Government guidance on the UK Online Safety Bill makes the distinction between illegal content and harmful content by stating that harmful content is content that may be legal but is considered harmful or not age-appropriate for children.

The illegal content includes:

• child sexual abuse
• controlling or coercive behavior
• extreme sexual violence
• fraud
• hate crime
• inciting violence
• illegal immigration and people smuggling
• promoting or facilitating suicide
• promoting self-harm
• revenge porn
• selling illegal drugs or weapons
• sexual exploitation
• terrorism

The “legal but harmful” content includes porn, online abuse, cyberbullying or online harassment, or anything which promotes or glorifies suicide, self-harm, or eating disorders.

This all sounds like a good thing.

If the UK Online Safety Bill will protect people from harmful and illegal, nasty content, then what's the issue?

Well, when you dig into the details, it very quickly starts to look scarily authoritarian on an Orwellian scale. It's not so much what the Bill does, but how it aims to achieve it.

The problems with the UK Online Safety Bill

London-based non-profit, Index on Censorship (IOC), recently published a global index tracking the state freedom of expression. The study shows the UK dropping from “open” to “partially open”, putting the UK in the same category as Moldova, Romania, and Panama.

IOC CEO, Ruth Smeeth, has suggested that the Online Safety Bill is partly to blame.

“...the chilling effect of the UK Government's Online Safety Bill all point to backward steps for a country that has long viewed itself as a bastion of freedom of expression.”

Let's look at why the UK Online Safety Bill has been causing so much concern surrounding growing government surveillance and big-tech control.

Gives more power, not less, to big tech companies

ARTICLE 19, Big Brother Watch, Index on Censorship, and three other organizations expressed their concern for the Bill when it was still a proposal in an open letter to the UN. In the letter, they described how, instead of taking away power from big tech companies, actually gives them more.

Making huge asks of companies (and threatening harsh penalties) but providing little detail of their actual obligations, will result in a breach of human rights. Because of the often difficulty of determining what is “harmful”, the Bill empowers online platforms, and not the justice system, to determine what speech is legal or not and enforce UK law.

Forms of speech allowed “in real life” (IRL) which are protected by international human rights law, could end up being censored online. And the decision of what is to be censored will be decided by big-tech companies effectively held to ransom by the threat of legal action and fines.

Threatens end-to-end encryption

One of the biggest criticisms of the Bill was its approach to end-to-end encryption used by social media platforms for private conversations.

At the proposal stage, the Bill stated that any content communicated via an internet service, publicly or privately should be analyzed for harmful content.

This would require weakening the security of end-to-end encryption message services with a “backdoor” in the form of client-side scanning (CSS). CSS would allow the analysis of message content before they are encrypted.

Adding a vulnerability to end-to-end encrypted chat services not only presents a massive risk to personal privacy and safety but also to national security.

On the individual level, encrypted communication tools are vital for many individuals such as activists, journalists, whistleblowers, victims of domestic abuse, or those from marginalized groups. A backdoor puts these individuals at risk while also undermining their right to privacy and freedom of expression.

At the time, rival encrypted chat apps WhatsApp, Session, Signal, and Viber came together in a rare stand of unity to sign an open letter to the UK government. The letter warned that the Bill would undermine the privacy and safety of UK citizens,

“As currently drafted, the Bill could break end-to-end encryption, opening the door to routine, general, and indiscriminate surveillance of personal messages of friends, family members, employees, executives, journalists, human rights activists, and even politicians themselves, which would fundamentally undermine everyone's ability to communicate securely.”

WhatsApp and Signal were also very vocal about the fact that they would leave the UK market before they would jeopardize the privacy of their users and allow such government surveillance.

There were also concerns on a national scale. Threatening end-to-end encryption can impede a country's security and its ability to defend itself in times of conflict.

Matthew Hodgson, the CEO of Element, a company supplying encryption technology in Ukraine, voiced his concerns that the Bill could jeopardize Ukraine's defense against the Russian invasion.

The Online Safety Bill had included provisions for the automatic scanning of messages before encryption, with the aim of identifying communications related to terrorism. Hodgson gave the example of a scenario where messages containing references to stockpiled bombs may be flagged. Russian state hackers could exploit this feature to identify Ukraine's military capabilities.

It appears that the big tech backlash worked, to a certain extent.

After Signal's President Meredith Whittaker made it very clear that there is no way to add a backdoor that only "bad guys" can walk through, the UK government conceded.

They finally relented on the point of a backdoor, stating that they don't have the technology to scan messages without affecting user privacy and, FOR NOW, won't demand companies comply.

But take note...this is only for now.

The exact wording in the passed Bill is, "until it's technically feasible". This means an encryption backdoor allowing government surveillance is still a possibility down the line.

Age-clarification raises privacy concerns

To prevent younger users from seeing age-inappropriate content, websites will have to implement some form of “age assurance or age verification technologies”. This could be asking users to provide proof of age by uploading an ID or some sort of facial recognition technology. Both of these options have serious privacy implications.

Age verification to access adult sites has already been implemented in states across the US, such as Louisiana and Utah.

The recently passed laws require internet users attempting to access pornographic sites to upload their government-issued ID. But should the verification company's servers be the target of a cyberattack, user personal data could be leaked.

This puts individuals at risk of identity theft and with the potential to expose sexual preferences, could threaten reputations, jobs, and relationships, and open users up to blackmail.

The recent Utah age verification law has caused popular porn site “Pornhub” to withdraw its services from the state. Instead, any Utah resident trying to access the site receives a recorded video message from an adult film actor, Cheri DeVille which states,

“While safety and compliance are at the forefront of our mission, giving your ID card every time you want to visit an adult platform is not the most effective solution for protecting our users and, in fact, will put children and your privacy at risk”.

One Bill to rule them all and in the darkness bind them...

The UK Online Safety Bill becoming an Act of Parliament has set a dangerous precedent. If it is to be replicated in other countries, it could lead to the global erosion of fundamental rights and liberties.

In fact, in the US the controversial EARN IT bill is back in front of Congress after two failed attempts. EARN IT, which stands for “The Eliminating Abusive and Rampant Neglect of Interactive Technologies Act” also proposes dangerous changes to encrypted services under the guise of child protection.

In the EU, a similar proposed “chat controls” regulation is also being considered, and is also attracting the same concern from security and privacy experts.

According to a report in The Guardian, EU lawyers have advised that the proposed regulation poses a “particularly serious limitation to the rights to privacy and personal data”.

The UK Online Safety Bill and those bills proposed in the States and the EU may have great intentions. No one thinks that the Internet couldn't be improved upon and that the safety of children is paramount. But ending end-to-end encryption with government surveillance and big-tech controlled censorship is not the way to go about it.

Society shouldn't have to choose between a safer online environment and giving up their rights to privacy, freedom of speech, and anonymity.

READ MORE: Online Anonymity is Important. Here's How to Protect it