We all want to be able to address abuse on the internet.
In the UK, the government is trying to achieve this through the Online Safety Bill (OSB). Developing such a bill is difficult as technology evolves far faster than legislation.
But even allowing for that challenge, and that the OSB has some genuinely good intentions, the proposed legislation is still remarkably poor.
What could have been a constructive piece of legislation has ended up as a bloated and overreaching proposal, drafted with little technical prowess. As it currently stands the bill weakens the UK’s digital security, threatens basic privacy, stymies the UK tech industry, and introduces the prospect of ever-creeping censorship and blanket surveillance.
Instead of setting a principled example to the rest of the world, the OSB sees the UK proposing state surveillance and censorship. It’s far closer to the approach seen from regimes in Russia and China than anything in Europe or the US.
Wrecking privacy
The bill takes a wrecking ball to the very fabric of encryption, by requiring encrypted messaging apps to scan for abusive content within the app (or the app’s underlying operating system).
This fundamentally undermines encryption, by providing a mechanism that can be hijacked and abused to access arbitrary user data. It is the online equivalent of installing a CCTV camera into everyone’s bedroom, hooked up to an artificial intelligence (AI) classifier which sends footage back to the authorities whenever it thinks it sees something illegal happening.
Today’s built-in scanning AI from Apple can’t even distinguish a cow from a horse – so even if blanket surveillance was a good idea in the first place, the chances of AI scanning causing your phone to upload any and all remotely questionable photos to the authorities (Ofcom, no less) would be enormous. The privacy implications are catastrophic.
By forcing this ‘backdoor’ into end-to-end encryption (E2EE), the resulting surveillance mechanisms would be able to access anyone’s messages, at any time, forwarding them to the authorities if suspected as illegal. This weakens security for everyone; from the 99 percent of normal law-abiding people through to businesses and governments.
And if you think that competing nation states, terrorists and criminals won’t be able to make use of that same access you’re sorely mistaken.
It means that healthcare information, financial details, conversations regarding air traffic control, electricity grids, nuclear power stations, military manoeuvres…. none of it would be protected by end-to-end encryption.
And all that loss of
