Online Safety Bill must balance security and privacy to be effective

As tech increas­ing­ly dom­i­nates our lives, the dri­ve to keep chil­dren and adults safe online has rapid­ly grown in urgency.

While the Online Safe­ty Bill (OSB) will include the world’s first cyber­safe­ty laws, it is unlike­ly to be a panacea, as the bal­ance between online safe­ty and pri­va­cy seems pre­car­i­ous.

“Plac­ing some account­abil­i­ty on the plat­forms, who cur­rent­ly have almost none, is a pro of the OSB,” says James Bore, a secu­ri­ty con­sul­tant spe­cial­is­ing in online and cyber­se­cu­ri­ty. “Whether the OSB is the right way to go it is very much a debate – I don’t see there being a right answer but what is clear, giv­en the dam­age that plat­forms have done in terms of assist­ing the spread of mis­in­for­ma­tion and manip­u­la­tion of democ­ra­cy cur­rent­ly, is that the bal­ance is very much in their favour.”

He says the stick­ing points sur­round a lack of clar­i­ty over what is con­sid­ered ‘harm­ful’ behav­iour, as this sub­jec­tiv­i­ty will lead to peo­ple chal­leng­ing def­i­n­i­tions as tech­nol­o­gy and soci­ety evolve. 

Char­lotte Ayns­ley is safe­guard­ing advi­sor at Impero Soft­ware, which pro­vides safe­guard­ing advice to schools, con­curs. “The Online Safe­ty Bill will have to be dynam­ic and evolve year-on-year to address emerg­ing trends,” she says. “We haven’t even start­ed think­ing about the meta­verse, for exam­ple, where every­thing is inter­ac­tive and where con­sid­er­able harms to chil­dren have already report­ed. It’s impor­tant that we are respon­sive to devel­op­ments through codes of prac­tice that Ofcom will devel­op along­side indus­try.”

That said, Ayns­ley believes the OSB is an impor­tant step in the right direc­tion towards pro­tect­ing chil­dren and adults online, par­tic­u­lar­ly as the inter­net was not designed for chil­dren and always lacked ade­quate con­trols. “For the first time, tech­nol­o­gy com­pa­nies, includ­ing social media web­sites and search engines, will be respon­si­ble and held account­able for harm­ful con­tent host­ed on their plat­forms,” she says. 

The NSPCC strong­ly backs the OSB but in its report Time to Act, pub­lished in April 2022, it said fur­ther changes are urgent­ly required, unsur­pris­ing giv­en the fact that, in 2021, UK law enforce­ment received 97,727 indus­try accounts relat­ing to online child abuse, a 29% increase from 2020. And online groom­ing offences in 2020/21 reached a high in Eng­land and Wales, increas­ing by almost 70% in three years.

Among its requests, the NSPCC wants the bill to take a proac­tive approach to tack­ling the child abuse risks in pri­vate mes­sag­ing and groups, and to stem the ways in which abuse is facil­i­tat­ed on social net­works, where it may not meet the crim­i­nal thresh­old. Abusers fre­quent­ly use social net­works to post so-called dig­i­tal bread­crumbs that sign­post to ille­gal con­tent host­ed on third-par­ty mes­sag­ing apps, offend­er forums and the dark web. The gov­ern­ment, it adds, must strength­en its approach to tack­ling harm­ful con­tent for chil­dren.

Ayns­ley says the OSB marks a shift from lia­bil­i­ty to account­abil­i­ty and pro­tec­tion, where­by com­pa­nies will need to demon­strate that they have eval­u­at­ed key risks such as mis­in­for­ma­tion, preda­to­ry behav­iour and cyber­bul­ly­ing, and put suit­able pro­tec­tions in place, espe­cial­ly for chil­dren. 

“Fines will be issued to those who fall short and exec­u­tive teams held account­able,” she says. “Shift­ing respon­si­bil­i­ty will ben­e­fit every­one, espe­cial­ly chil­dren, as it puts the onus on big tech com­pa­nies and social media plat­forms to be aware of the con­tent they host.”

But she adds that the spot­light on large tech­nol­o­gy com­pa­nies could mean that harm­ful behav­iour occur­ring else­where is missed, while bil­lion-dol­lar behe­moths may not be suf­fi­cient­ly moti­vat­ed by finan­cial penal­ties. 

Bore agrees: “It’s worth remem­ber­ing that the com­pa­nies tar­get­ed by this law have been shown time and time again to be uncar­ing about the dam­age they know­ing­ly cause to soci­ety and democ­ra­cy,” he says. “Even if indi­vid­u­als with­in them may be well-inten­tioned, their abil­i­ty to soft­en the over­all neg­a­tive impact is neg­li­gi­ble. 

“That’s not to say there aren’t also ben­e­fits to soci­ety that come about, but we need to work to mit­i­gate the harm, and hold­ing these organ­i­sa­tions to account – regard­less of how imper­fect­ly – is a huge step when they have shown for years that noth­ing else will work.”

Accord­ing to the gov­ern­ment, the OSB will “[deliv­er] the government’s man­i­festo com­mit­ment to make the UK the safest place in the world to be online while defend­ing free expres­sion,” but cyber experts beg to dif­fer, warn­ing that the OSB risks dev­as­tat­ing the UK’s online secu­ri­ty.

Robin Wilton, direc­tor of inter­net trust at the Inter­net Soci­ety, is damn­ing, call­ing the OSB “an unwork­able mess, with over­reach­ing pow­ers based on vague def­i­n­i­tions, poor account­abil­i­ty struc­tures, and new cat­e­gories of offence added prac­ti­cal­ly every month”.

The gov­ern­ment, he adds, should refo­cus its approach by admit­ting that the prob­lems it claims it’s solv­ing with the OSB are soci­etal and stop leg­is­lat­ing as if reg­u­lat­ing tech­nol­o­gy is “the mir­a­cle cure”. He is also con­cerned that the bill would force com­pa­nies to under­mine strong encryp­tion, mak­ing every­one less safe, as ser­vice providers weak­en or with­draw end-to-end encrypt­ed ser­vices from their offer­ings. 

“The bill,” he says, “makes [ser­vice providers] liable for the behav­iour of their users if they are unable to mon­i­tor and con­trol their users’ con­ver­sa­tions. The Cul­ture Sec­re­tary recent­ly expressed her delight that cit­i­zens in Ukraine could stay informed via secure mes­sag­ing ser­vices and encrypt­ed news sites. If the UK pass­es the OSB, com­pa­nies will be forced to either leave the UK mar­ket or under­mine the secu­ri­ty and pri­va­cy of all their users, includ­ing the most vul­ner­a­ble in Ukraine and oth­er con­flict areas.

“What the pub­lic doesn’t realise is that the con­tent of all their com­mu­ni­ca­tions will be scanned. Is this the kind of sur­veil­lance state we want in the Unit­ed King­dom?”

Wilton goes on to cau­tion that the OSB will degrade the UK’s secu­ri­ty through­out its online infra­struc­ture, reduc­ing inward invest­ment, as com­pa­nies will have lit­tle incen­tive to invest in a mar­ket for inse­cure prod­ucts, or the inse­cure ser­vices built on them.

Clear­ly, the OSB is a work in progress to hone it into a robust tool that keeps indi­vid­u­als safe and main­tains their pri­va­cy – and avoid­ing the some­what iron­ic poten­tial out­come of leav­ing peo­ple with even poor­er pro­tec­tion online.