Gov Publish UK Online Safety Bill to Censor “Harmful” Content UPDATE

After much delay the UK Government will today publish a draft of their new Online Safety Bill (Online Harms), which among other things hands Ofcom a new “legal duty of care” that can be used to force websites into removing “harmful” internet content. Failing to do so may risk being fined or blocked by mobile and broadband ISPs.

The proposed legislation, which is intended to replace the old model of self-regulation that has struggled to keep pace with the changing online environment (i.e. the Government believes too much “harmful” content is allowed to slip through a fairly weak net), faces the unenviable task of trying to strike the right balance between freedom of expression and outright censorship.

Various examples exist for “harmful” content (e.g. terrorism, child abuse, self-harm and suicide imagery etc.), such as the rise of the ISIS terrorist group online a few years ago, as well as state sponsored propaganda from hostile countries, online bullying, the spread of COVID-19 related 5G conspiracy theories (encouraging criminal attacks against infrastructure and engineers) and so forth. Social media firms did eventually catch-up, but they’re often late to the party.

The draft Online Safety Bill (OSB), which is to be “scrutinised by a joint committee of MPs before a final version is formally introduced to Parliament,” is the Government’s response to this. Essentially, it proposes to introduce new laws for websites and online content providers that would be enforced by Ofcom through a Code of Practice (CoP).

The key focus is clearly on bigger “companies” (e.g. Facebook, Twitter and YouTube), although there’s still a risk that masses of smaller sites (blogs, forums etc.) could face some of the same rules, but in practice that may be unworkable. At the time of writing, we haven’t yet been able to see the draft, so it’s difficult to know what has changed since last year’s outline was published (here).

Summary of Key OSB Proposals

➤ New additions that they claim will “strengthen people’s rights to express themselves freely online“, while seeking to protect journalism and democratic political debate in the UK.

➤ Further provisions to tackle prolific online scams such as romance fraud, which have seen people manipulated into sending money to fake identities on dating apps.

➤ Social media sites, websites, apps and other services hosting user-generated content or allowing people to talk to others online [i.e. internet messaging services] must remove and limit the spread of illegal and harmful content such as child sexual abuse, terrorist material and suicide content.

➤ Ofcom will be given the power to fine companies failing in a new duty of care up to £18 million or 10% per cent of annual global turnover, whichever is higher, and have the power to block access to sites. But as we know, ISP based website blocks are inherently easy to circumvent and anybody who goes actively looking for such content will no doubt still be able to find it if they want (unless it’s removed at source when requested).

➤ A new criminal offence for senior managers has been included as a deferred power. This could be introduced at a later date if tech firms don’t step up their efforts to improve safety.

One obvious challenge in all this is whether the Government can actually do a better job through legislated regulation than the industry has done via self-regulation. Simply adding new laws doesn’t make this any easier. Sadly, trying to police the common public expression of negative human thought, while balancing that against free speech, is often fraught with difficulty.

At present it’s also unclear whether the Government will still be shopping out their responsibility by expecting commercial companies to define things like “legal but harmful” content in their terms, which was what they seemed to be suggesting last year. The Government must take responsibility for such a critical aspect themselves.

Digital Secretary, Oliver Dowden MP, said:

“Today the UK shows global leadership with our groundbreaking laws to usher in a new age of accountability for tech and bring fairness and accountability to the online world.

We will protect children on the internet, crack down on racist abuse on social media and through new measures to safeguard our liberties, create a truly democratic digital age.”

The announcement expressed an “aim to create the most progressive, fair and accountable system in the world,” which makes it all sound very positive but perhaps glosses over some looming challenges, particularly when extended to the greyer areas of speech. But first, here’s a more detailed summary of the different areas that this bill intends to tackle (directly quoted).

Take note that the bill doesn’t extend to fraud via advertising, emails or cloned websites (financial harms), although the Government has pledged to publish a Fraud Action Plan after the 2021 Spending Review and the Department for Digital, Culture, Media and Sport (DCMS) will consult on online advertising, including the role it can play in enabling online fraud, later this year.

✦ Duty of care

In line with the government’s response to the Online Harms White Paper, all companies in scope will have a duty of care towards their users so that what is unacceptable offline will also be unacceptable online.

They will need to consider the risks their sites may pose to the youngest and most vulnerable people and act to protect children from inappropriate content and harmful activity.

They will need to take robust action to tackle illegal abuse, including swift and effective action against hate crimes, harassment and threats directed at individuals and keep their promises to users about their standards.

The largest and most popular social media sites (aka – Category 1 services) will need to act on content that is lawful but still harmful such as abuse that falls below the threshold of a criminal offence, encouragement of self-harm and mis/disinformation. Category 1 platforms will need to state explicitly in their terms and conditions how they will address these legal harms and Ofcom will hold them to account.

The draft Bill contains reserved powers for Ofcom to pursue criminal action against named senior managers whose companies do not comply with Ofcom’s requests for information. These will be introduced if tech companies fail to live up to their new responsibilities. A review will take place at least 2 years after the new regulatory regime is fully operational.

The final legislation, when introduced to Parliament, will contain provisions that require companies to report child sexual exploitation and abuse (CSEA) content identified on their services. This will ensure companies provide law enforcement with the high-quality information they need to safeguard victims and investigate offenders.

✦ Freedom of expression

The Bill will ensure people in the UK can express themselves freely online and participate in pluralistic and robust debate.

All in-scope companies will need to consider and put in place safeguards for freedom of expression when fulfilling their duties. These safeguards will be set out by Ofcom in codes of practice but, for example, might include having human moderators take decisions in complex cases where context is important.

People using their services will need to have access to effective routes of appeal for content removed without good reason and companies must reinstate that content if it has been removed unfairly. Users will also be able to appeal to Ofcom and these complaints will form an essential part of Ofcom’s horizon-scanning, research and enforcement activity.

Category 1 services will have additional duties. They will need to conduct and publish up-to-date assessments of their impact on freedom of expression and demonstrate they have taken steps to mitigate any adverse effects.

These measures remove the risk that online companies adopt restrictive measures or over-remove content in their efforts to meet their new online safety duties. An example of this could be AI moderation technologies falsely flagging innocuous content as harmful, such as satire.

✦ Democratic content

Ministers have added new and specific duties to the Bill for Category 1 services to protect content defined as ‘democratically important’. This will include content promoting or opposing government policy or a political party ahead of a vote in Parliament, election or referendum, or campaigning on a live political issue.

Companies will also be forbidden from discriminating against particular political viewpoints and will need to apply protections equally to a range of political opinions, no matter their affiliation. Policies to protect such content will need to be set out in clear and accessible terms and conditions and firms will need to stick to them or face enforcement action from Ofcom.

When moderating content, companies will need to take into account the political context around why the content is being shared and give it a high level of protection if it is democratically important.

For example, a major social media company may choose to prohibit all deadly or graphic violence. A campaign group could release violent footage to raise awareness about violence against a specific group. Given its importance to democratic debate, the company might choose to keep that content up, subject to warnings, but it would need to be upfront about the policy and ensure it is applied consistently.

✦ Journalistic content

Content on news publishers’ websites is not in scope. This includes both their own articles and user comments on these articles.

Articles by recognised news publishers shared on in-scope services will be exempted and Category 1 companies will now have a statutory duty to safeguard UK users’ access to journalistic content shared on their platforms.

This means they will have to consider the importance of journalism when undertaking content moderation, have a fast-track appeals process for journalists’ removed content, and will be held to account by Ofcom for the arbitrary removal of journalistic content. Citizen journalists’ content will have the same protections as professional journalists’ content.

✦ Online fraud

Measures to tackle user-generated fraud will be included in the Bill. It will mean online companies will, for the first time, have to take responsibility for tackling fraudulent user-generated content, such as posts on social media, on their platforms. This includes romance scams and fake investment opportunities posted by users on Facebook groups or sent via Snapchat.

Romance fraud occurs when a victim is tricked into thinking that they are striking up a relationship with someone, often through an online dating website or app, when in fact this is a fraudster who will seek money or personal information.

Analysis by the National Fraud Intelligence Bureau found in 2019/20 there were 5,727 instances of romance fraud in the UK (up 18 per cent year on year). Losses totalled more than £60 million.

Fraud via advertising, emails or cloned websites will not be in scope because the Bill focuses on harm committed through user-generated content.

At this stage it’s probably safe to assume that Category 1 companies will include those such as Facebook, TikTok, Instagram and Twitter etc. However, at the time of writing the government have yet to clarify exactly what measures may be required by smaller organisations under Category 2 etc.

A minefield of legislation

Naturally, for all the positive aspects in the new law, it also seems set to come with a few possible caveats. For example, the threat of huge fines might result in companies trying to reduce their liability for such content by introducing automated filtering systems, which are notorious for being overzealous and unable to understand context (e.g. people joking about blowing up a city in a video game vs actual terrorists). Only bigger sites could actually afford to do this and the end result is usually significant over-blocking of lawful content (mass censorship).

The Government hopes that their provisions will “remove the risk that online companies adopt restrictive measures or over-remove content in their efforts to meet their new online safety duties“, but it also seems to make it much harder for those systems to function properly and may thus require many more human moderators.

Indeed, it’s stated that Ofcom’s new codes will require “having human moderators take decisions in complex cases where context is important,” which sounds like something many people would welcome, but it overlooks the reality of how they may be needed for masses of decisions because CONTEXT IS ALWAYS IMPORTANT.

The economic models for internet content are radically different from the offline world. Many websites are written by just one person or a few people and yet can be read by millions, despite running off a shoestring budget (this is how the internet works and remains one of its core appeals). Forcing such sites to implement unaffordable measures, which will also need to work across lots of different software, may thus be unworkable – it remains to be seen if Category 2 will offer some protection.

One of the biggest issues of all is also the age-old problem of how you define things like bullying or hate speech in the first place and then separate that from related content or context, which may include criticism of the same subject, as well as satire, the right to cause offence (allowed under current freedom of speech rules), political free speech and so forth. Automated filters rarely get this stuff right and moderators can also struggle.

Similarly, trying to act against content that is deemed “lawful but still harmful” sounds like something that will keep the lawyers busy for many years to come, particularly when those same companies are also being asked to “put in place safeguards for freedom of expression.” The legislation believes it can deliver a balance here, but we’re not at all convinced it’ll succeed without causing plenty of its own harm.

A question of encryption

At present, it seems as if the Government, at almost every opportunity, is still trying to find ways of banning end-to-end encryption methods. The OSB announcement clearly states that these rules will apply to any services that are “allowing people to talk to others online“, which has previously been linked to internet messaging services like WhatsApp and closed social media groups etc.

Such a requirement would be difficult for any service that uses end-to-end encryption because not even the service owner can see what’s being said. Some will thus see this as an attempt to ban such encryption on those platforms, which would be somewhat of a double-edged sword as it also makes them less secure (i.e. encryption keys controlled by the company rather than hidden).

Finding a balance on this front is difficult because encryption is not a specific service, it’s a method that is used all over the place from financial transactions to website communications (HTTPS etc.), and there’s absolutely nothing that anybody could do to stop people making their own encryption (this is common). As security experts often warn, you can’t allow one state or group to have special access and then expect that not to be abused by others (e.g. hackers or less democratic countries).

Closing thoughts

Like it or not, this is not just about policing online platforms but about policing what YOU all do and say online. Granted some people go to extremes, but those often cross over into more clearly defined aspects of illegality, while what is talked about above extends to the murky area of “lawful but still harmful.” As such it’s hardly surprising that the Government has taken so long to piece the draft OSB together, it’s an absolute minefield.

On this point we can’t always assume we will, in the future, be governed by a truly democratic system that protects our freedoms and privacy. Giving a future anti-democratic government such control over what we can access and how we communicate would thus seem to be unwise, which is something worth considering as the OSB debate runs its course over the next couple of years. Future mission creep could easily make it dangerous.

At this point we note how the announcement itself makes no mention of the much-delayed proposals for a new system of Internet Age Verification (here), which was supposed to have been rolled into it. This was originally due to be implemented by commercial websites and “apps” containing pornographic content (i.e. ISPs would have to block those that failed to comply).

The aforementioned approach faced delays and became beset by concerns over weak privacy controls (e.g. handing passports and payment details to companies linked with porn peddlers), cost, the potential impact upon sex workers (i.e. pushing them off-line and back onto the streets), freedom of expression and technical limitations (easy to circumvent, not least via VPN or DNS over HTTPS etc.). We’ll update later once we’ve had a chance to read the OSB.

Meanwhile we’re still left with plenty of questions, such as how long will such platforms be given to remove such content? A time span of just 1 hour was mentioned before, but that is unworkable on smaller sites (humans need to sleep and take breaks) and on bigger sites would encourage automated filtering.

Likewise, it remains unclear how far the new rules will go toward tackling conspiracy theories and fake news, which some politicians often exploit (e.g. Donald Trump). The announcement merely mentions “mis/disinformation.” But if speech is only deemed “free” when it can be found to be objectively and demonstrably true then that carries other problems (consider the case of different “religions” while you ponder this).

As it stands the Government faces an incredibly difficult balancing act. On the one hand they need to do more to tackle harmful online content, but on the other they have to avoid the risk of creating a draconian censorship regime and harming free speech, even though that might not be their intention.

Finally, the Culture Secretary, Oliver Dowden, has previously said that the most important provision in the new bill is “to make what’s illegal on the street, illegal online“, which sounds fair except there’s no Ofcom for the street, and no street owner duty of care for what pedestrians say to each other.

However, Dowden has agreed that there are cases where anonymity may be required and thus a blanket ban on anonymous posting (the source for a lot of abuse) is unlikely. “For example if you are looking to flee domestic violence or if, for example, you’re a teenager exploring your sexuality, you don’t want others to know about it – there are legitimate grounds for preserving anonymity. So, whilst we continue to keep this under review, I’m just a bit concerned about a blanket ban on anonymity.”

UPDATE 13th May 2021

The Online Safety Bill is now published and it does not appear, at present, to contain the Age Verification proposal for porn sites. But that’s not to say it won’t be re-introduced, in some form, as the bill makes it way through parliament.