The Controversial Online Safety Bill
The UK’s Online Safety Bill has passed through Parliament and is set to become law. This wide-reaching legislation is expected to impact all internet users in the UK and the services they access. However, the potential consequences of the bill remain unclear, and some of the new regulations are technologically challenging to comply with.
The Issue of End-to-End Encryption
One of the main concerns regarding the Online Safety Bill is its implications for end-to-end encryption, which is used by messaging services like WhatsApp. End-to-end encryption ensures that no one, including the service provider, can read messages sent between users. However, the new law grants regulator Ofcom the power to intercept and review encrypted data for illegal or harmful content.
The Backdoor Debate
To exercise this power, service providers would need to create a backdoor in their software, allowing Ofcom to bypass the secure encryption. However, this backdoor could potentially be exploited by hackers, and individuals with technical expertise could develop their own encryption software without a backdoor. This creates a security dilemma for the industry.
Jake Moore, a cybersecurity expert at ESET, believes that attempting to locate a backdoor within encrypted messages will only encourage users, including criminals, to switch to other messaging platforms that operate underground.
Alternative Approaches
Another proposed approach is to install software on every device, enabling Ofcom to access unencrypted messages before or after they are sent. However, implementing such a system is complex and faces opposition from privacy advocates who argue that encryption protects private messages and allows secure communication for journalists, human rights defenders, whistleblowers, and academics.
An example highlighting the difficulties of implementing content scanning tools while maintaining privacy is Apple’s attempt to scan images on users’ phones for evidence of child sexual abuse. The tool generated false positives prompting Apple to abandon the project.
The Technical Roadblock
The UK government acknowledged that the demands of the Online Safety Bill cannot currently be met technologically. As a result, the enforcement of certain aspects of the law will be postponed until the required tools are developed. In the meantime, the government continues to push against major tech platforms that plan to encrypt all user data, such as Facebook.
In addition to encryption, the bill introduces mandatory age checks on pornography websites and requires websites to have policies to protect users from harmful or illegal content. However, there is still uncertainty regarding the definition of illegal content and which websites will fall under the scope of the bill.
Enforcement Challenges
Ofcom, the designated regulator, highlighted that work is still underway to determine how to enforce the bill. Companies that allow user comments, publish user-generated content, transmit encrypted data, or host potentially harmful content could potentially be affected. Neil Brown, a lawyer at decoded.legal, expresses concerns that smaller organizations may face significant legal fees in trying to understand if they fall within the bill’s scope and what actions they need to take to comply.
Overall, the enforcement of the UK’s Online Safety Bill poses numerous challenges, particularly in relation to end-to-end encryption and the balancing of privacy and security. The bill’s impact on various online platforms and the obligations placed on them remain ambiguous, creating uncertainty and potential legal burdens for many organizations.
