4 ms·

While I'm not a supporter of the Online Safety Bill, I do find that the opprobrium that it has inspired is consistently hyperbolic. The Online Safety Bill bans

by cjs_ac 3y ago

While I'm not a supporter of the Online Safety Bill, I do find that the opprobrium that it has inspired is consistently hyperbolic. The Online Safety Bill bans nothing. What it does do is create a regulatory framework for the Office for Communications (aka Ofcom, HM Government's regulator for the communications industry) to operate and enforce. The regulatory framework is based around risk assessments, and sets out specific risks (of the sort that most people would agree need to be minimised). Ofcom is empowered to decide that internet services are within scope, and then demand to see policies relating to ameliorating those risks within a service. The regulatory framework does specify that end-to-end encryption is incompatible with the reduction of these risks. However, we do have to play the ball and not the person of unspecified gender here. We are, after all, talking about the UK here. The phenomenon of 'those whom the law protects but does not bind, and those whom the law binds but does not protect' is still very much in effect here. This legislation has also been proposed by a government that responds to increasing crime (caused by insufficient police officers) by giving those police more powers (that they don't have the resources to exercise). Ofcom has wide-ranging responsibilities: it regulates the press and broadcast media, it allocates EM spectrum bands, it regulates the telephone network, and regulates the Royal Mail. Like all organisations in the Home Civil Service, it is staffed by a core of 'generalists' with humanities degrees, assisted by a small cadre of 'specialists', who are put back in their cupboard once they've given their opinion. What this all means is that the bill will only have the effects that the government has said it will in its press releases. Ofcom will go after the big social media companies and the likes of 4chan. Your Mastodon server or your Gitea server or your corner of the Tildeverse or whatever will never appear on their radar. Ofcom won't have the budget or the resources to go after individuals or small communities; they won't even know you exist. In the UK, an energy bill or council tax bill is an important identity document, necessary for opening a bank account, because any time someone starts talking about identity cards, the readers of the Daily Telegraph start muttering about the Gestapo. Ofcom isn't going to audit your homelab for online harms.

GordonS 3y ago
It sounds like you're chiding others for complaining about the bill, and excusing this because the bill "only" enables mass surveillance and anti-privacy measures, rather than stipulating them. Might be I'm reading you wrong on this, but that's what I'm taking away. > What this all means is that the bill will only have the effects that the government has said it will in its press releases. I don't really believe that for a second. Whenever sweeping powers are introduced, there is scope creep. Just look at how anti-terrorism laws have been abused. And it seems Apple and others don't believe it either.
- cjs_ac 3y ago
  I am chiding people, not for complaining, but for misunderstanding the surrounding context. Legislation is only as powerful as those enforcing it. > And it seems Apple and others don't believe it either. Yes, Apple, Google, Microsoft, Signal, Meta, and all the other big players else who has turned up to the committee hearings will have their activities curtailed. Individuals running Minecraft and Mastodon servers for their friends needn't worry.
  - generalizations 3y ago
    > Individuals running Minecraft and Mastodon servers for their friends needn't worry. Because they're too insignificant to matter, or because they won't be covered by the law? It sounds like the former, but you seem to imply the latter.
    - cjs_ac 3y ago
      It's a bit of both. The law states that Ofcom has to ask you for your risk assessments, and they can't ask you for those if they don't know you exist.
      - hanniabu 3y ago
        That's not a legitimate defense
      - monsieurbanana 3y ago
        I don't know if I'm missing some British humor here, that's absolutely not bit of both, that's squarely "because they're too insignificant to matter"
      - mrd3v0 3y ago
        I am amazed by how okay you seem with this. Wow. Maybe it is me, who has already lived under a very similar set of laws and know that corporations are always the least hit by such laws. These are instruments that infringe on basic individual rights such as right to privacy. These instruments create systemic significant incentives to corruption, totalitarianism, (corporate and international) espionage, and so on. Rights groups, activists, whistle-blowers, prosecuted or rather marginalised minorities, and other legitimate groups and individuals are going to be impacted by this. Underplaying this is incredibly naïve and downright dangerous.
AlbertCory 3y ago
[flagged]
golergka 3y ago
I don't agree with this comment, but I upvoted it because it brings a different perspective to HN, and therefore, improves the quality of discussion.
tailspin2019 3y ago
While I support some more measured analysis to counter the hyperbole, you're making some strong assertions about what this bill will and won't mean, and I don't think you can have any more certainty about these than those people who are assuming a far worse outcome. Context matters, and given the context of where we are as a country at the moment, how trustworthy our current government has (not) turned out to be, and even where they are in the election cycle - currently heading for being out of office for a decade - not to mention them pushing to leave the European convention on human rights, I'm a lot more concerned about the potential dangers of this bill than I might have been in a different context. Even if you're right and I'm wrong, this statement seems a bit naive! (with respect): > the bill will only have the effects that the government has said it will in its press releases. Edit: I tend to put a lot of stock into analysis put out by the EFF [0]. I think they said it well here: > If it passes, the Online Safety Bill will be a huge step backwards for global privacy, and democracy itself. Requiring government-approved software in peoples’ messaging services is an awful precedent. If the Online Safety Bill becomes British law, the damage it causes won’t stop at the borders of the U.K. [0] https://www.eff.org/deeplinks/2023/07/uk-government-very-close-eroding-encryption-worldwide https://www.eff.org/deeplinks/2023/07/uk-government-very-clo...
- cjs_ac 3y ago
  Perhaps I am being naive, and I will confess that I'm not entirely sure that the future will be as I predicted (but I'm not going to edit my initial comment, out of respect for those disagreeing with me). But I will think this quote from one of the bill's most dogged critics is illustrative[0]: > ... this Bill, whatever DCMS and its ministers may claim, is not a “fixing” Bill, one which has been designed to be constructive and positive in order to fix problems. It is a “getting” Bill, once which has been designed to be vindictive and negative in order to get specific companies. OnlyFans in this particular example, the usual suspects in others. > The second is that this Bill has been designed by people who are so out of touch that OnlyFans is their idea of the average small digital business. > And the third is that this Bill has been designed by people who are so out of touch that they think the harms issues raised by OnlyFans are the harms issues in the average small digital business. As for your distrust of the government, my opinion on this comes from that same position. My complacency rests not on their goodwill (because I don't think they have any) but on their disinterest in actually understanding anything. [0] https://webdevlaw.uk/2022/07/13/heres-why-your-project-is-in-scope-of-the-online-safety-bill/ https://webdevlaw.uk/2022/07/13/heres-why-your-project-is-in...
jrmg 3y ago
I’m reminded of the hyperbole - which I fell for - around the Regulation of Investigatory Powers act around the turn of the millennium. It provides a legal mechanism for authorities to require that individuals disclose encryption keys for encrypted data that was legally obtained or intercepted (i.e. with a warrant) by those authorities, and there are penalties (jail time) for refusing to do so. The worry at the time was that random data is indistinguishable from encrypted content, so there might be times when people are jailed when they don’t even have the keys because there’s no encrypted data - just random bytes! Or, what happens if you lose the keys? The reality is that there’s a court system that ‘regulates’ all this. No-one is going to be jailed unless the courts find that they are not providing keys they really do have. Of course, in a conspiracy where the authorities and the courts are all colluding, they could jail people pretending that they knew they had the keys - but there are far easier ways for the authorities to do this than some elaborate scheme with fake encrypted data. At the time I was fully convinced that it was a step down a slippery slope to authoritarianism. Really, it was just bringing the ‘virtual’ world into line with the physical one. [I suspect there are a few here who were also around at the time and still believe it’s all a nefarious governmental plot - I’d ask them to show where, in the 23 years since it passed, harm - or suspicion of harm - has happened]. Now, maybe this is different. I certainly don’t want end to end encryption to be banned. But there’s a bit of a ‘cried wolf’ happening in my brain.
- jl6 3y ago
  An interesting RIP case here: https://www.bbc.co.uk/news/uk-england-11479831 https://www.bbc.co.uk/news/uk-england-11479831 A person received a 16 week prison sentence for not disclosing a password. In the context, it’s possible that had he disclosed the password, police would have discovered material that would have attracted a far more severe punishment. So one might argue that the RIP was too weak, and failed to compel disclosure of the password (four months in jail is light in the circumstances).
  - amiga386 3y ago
    This guy went to prison for a year and 2 months, for not disclosing his Facebook password: https://www.bbc.co.uk/news/uk-england-hampshire-45365464 https://www.bbc.co.uk/news/uk-england-hampshire-45365464 He was accused of murder. Ultimately, he was found guilty and sentenced to 33 years: https://www.hampshire.police.uk/news/hampshire/news/news/2019/july/lucy-mchugh-murder--stephen-nicholson-found-guilty/ https://www.hampshire.police.uk/news/hampshire/news/news/201... And then there's the other direction, which I must confess I thought would have involved the RIP Act but ultimately didn't, instead it used anti-terrorism legislation. A French employee of radical French publishing house that the French government is very cross with, arrived in Britain for a book fair. He was arrested and held for 24 hours using anti-terror legislation. The cops also confiscated his phone and laptop, and held onto them for more than 10 weeks, and they threatened him "with never being able to travel overseas if he failed to hand over a password to his confiscated iPhone and MacBook": https://www.theguardian.com/uk-news/2023/jul/21/police-watchdog-investigating-arrest-french-publisher-ernest-moret https://www.theguardian.com/uk-news/2023/jul/21/police-watch... The general concern is that France is not allowed to do that, so asked Britain to do it for them, and Britain did it. There wasn't even a hint that he'd broken the law in Britain, and all that was wanted was for the French government to get ahold of the contents of his phone and laptop. Perhaps this is the only reason (that they had absolutely nothing on him) that they didn't twist the knife and use the RIP Act to imprison him simply for not unlocking his devices for them: https://www.theguardian.com/uk-news/2023/apr/19/french-publisher-arrested-in-london-was-asked-about-support-for-macron https://www.theguardian.com/uk-news/2023/apr/19/french-publi...
hau 3y ago
>Your Mastodon server or your Gitea server or your corner of the Tildeverse or whatever will never appear on their radar Of course it will when your gitea or mastodon instance is in the right crosshair. Do we just surrender rights on a hope this time we can stay under the radar? If you are not a terrorist or a pedophile you have nothing to worry etc. When you disagree enough you will become a terrorist. That's the reality in my country because it works an have worked for centuries. >Ofcom won't have the budget or the resources to go after individuals or small communities; they won't even know you exist. >Ofcom isn't going to audit your homelab for online harms. Pinky promise?
- cjs_ac 3y ago
  I've read the bill, and know what it stipulates. Of course, if you don't want to take my word for it, you can download the 302 pages of legislation and check it yourself: https://bills.parliament.uk/bills/3137 https://bills.parliament.uk/bills/3137
  - jabradoodle 3y ago
    The comment you are replying to isn't discussing the bill but refuting your assertion the powers it affords will be used only in a specific set of circumstances. Not sure what your deflection is in aid of.
collaborative 3y ago
You seem to know more than me. I host a fringe e2ee messaging system in the UK that I run under under an LTD. Am I affected?
- cjs_ac 3y ago
  Disclaimer: I'm not a lawyer, just someone who read the bill a couple of months ago because I was checking to see whether the idea I have in the back of my head for a social media platform was still viable. Heather Burns[0] is an actual lawyer who's a leading authority on this. The basic principle is that what people do online can have negative consequences in the real world, and the bill basically holds online service operators (such as yourself) at least partially responsible for those negative consequences. Operators need to demonstrate that they're mitigating those consequences risk assessments and policies. Judging by your profile, you're offering e2ee to family groups, so your intended users are low-risk for sending harmful content. However, your service is freely available to anyone with the app, so it could potentially be used by terrorist organisations, gangs or CSAM sharing groups. e2ee services like this are pretty much the only service that is outright incompatible with the requirements of the bill, so I think you'll be in trouble as soon as Ofcom comes knocking, if they do so. I think the chance of them doing so is small, but that's just my personal opinion, and you will have to make your own decisions. The family tree and calendar features look like they're low risk, and could be adequately covered by risk assessments, but the file and photo sharing features are also problematic, because (I think) they're encrypted. You're very unfortunate to be at the intersection of the three factors that could make Ofcom care about you: * service freely available to the public; * arbitrary user-to-user communication; and * no means of checking for harmful conduct on your service. The only way forward that I can see for you is to make the backend a selfhost-only affair, which would make your UK-based users responsible under the bill. [0] https://webdevlaw.uk/about/ https://webdevlaw.uk/about/
  - deleted 3y ago
    [deleted]
ThrustVectoring 3y ago
Of course the government is going to enforce only a fraction of the offenses it creates. This is nearly always the case, and is mostly irrelevant to a law's actual effectiveness. That is derived from a combination of targeting the highest-profile offenders and the law acting as a press release as to the government's enforcement priorities. Like, imagine you're running a team developing an end-to-end encrypted application in Britain, and you're seeking funding. The potential investors are going to ask what your plan is to not get owned by this bill, you won't have a good answer outside of "hope they don't notice us", and they won't invest. This happens merely because the British government publicized the Online Safety Bill, and exactly zero enforcement effort was required to stifle the funding, development, and subsequent use of this hypothetical application. Anyhow, the short of my point is that government laws have a ton of power to shape behavior outside of prosecuting people, and sensible risk-management shapes the behavior of non-government bureaucrats and decisionmakers.
DoItToMe81 3y ago
The UK arrests more people annually for harmless internet activity than any other nation. It does affect them, as its only a matter of time before they actively hunt you down for 'causing psychological harm' over innocent comments.

by cjs_ac 3y ago

GordonS 3y ago

It sounds like you're chiding others for complaining about the bill, and excusing this because the bill "only" enables mass surveillance and anti-privacy measures, rather than stipulating them. Might be I'm reading you wrong on this, but that's what I'm taking away. > What this all means is that the bill will only have the effects that the government has said it will in its press releases. I don't really believe that for a second. Whenever sweeping powers are introduced, there is scope creep. Just look at how anti-terrorism laws have been abused. And it seems Apple and others don't believe it either.

cjs_ac 3y ago
I am chiding people, not for complaining, but for misunderstanding the surrounding context. Legislation is only as powerful as those enforcing it. > And it seems Apple and others don't believe it either. Yes, Apple, Google, Microsoft, Signal, Meta, and all the other big players else who has turned up to the committee hearings will have their activities curtailed. Individuals running Minecraft and Mastodon servers for their friends needn't worry.
- generalizations 3y ago
  > Individuals running Minecraft and Mastodon servers for their friends needn't worry. Because they're too insignificant to matter, or because they won't be covered by the law? It sounds like the former, but you seem to imply the latter.
  - cjs_ac 3y ago
    It's a bit of both. The law states that Ofcom has to ask you for your risk assessments, and they can't ask you for those if they don't know you exist.
    - hanniabu 3y ago
      That's not a legitimate defense
    - monsieurbanana 3y ago
      I don't know if I'm missing some British humor here, that's absolutely not bit of both, that's squarely "because they're too insignificant to matter"
    - mrd3v0 3y ago
      I am amazed by how okay you seem with this. Wow. Maybe it is me, who has already lived under a very similar set of laws and know that corporations are always the least hit by such laws. These are instruments that infringe on basic individual rights such as right to privacy. These instruments create systemic significant incentives to corruption, totalitarianism, (corporate and international) espionage, and so on. Rights groups, activists, whistle-blowers, prosecuted or rather marginalised minorities, and other legitimate groups and individuals are going to be impacted by this. Underplaying this is incredibly naïve and downright dangerous.

AlbertCory 3y ago

[flagged]

golergka 3y ago

I don't agree with this comment, but I upvoted it because it brings a different perspective to HN, and therefore, improves the quality of discussion.

tailspin2019 3y ago

While I support some more measured analysis to counter the hyperbole, you're making some strong assertions about what this bill will and won't mean, and I don't think you can have any more certainty about these than those people who are assuming a far worse outcome. Context matters, and given the context of where we are as a country at the moment, how trustworthy our current government has (not) turned out to be, and even where they are in the election cycle - currently heading for being out of office for a decade - not to mention them pushing to leave the European convention on human rights, I'm a lot more concerned about the potential dangers of this bill than I might have been in a different context. Even if you're right and I'm wrong, this statement seems a bit naive! (with respect): > the bill will only have the effects that the government has said it will in its press releases. Edit: I tend to put a lot of stock into analysis put out by the EFF [0]. I think they said it well here: > If it passes, the Online Safety Bill will be a huge step backwards for global privacy, and democracy itself. Requiring government-approved software in peoples’ messaging services is an awful precedent. If the Online Safety Bill becomes British law, the damage it causes won’t stop at the borders of the U.K. [0] https://www.eff.org/deeplinks/2023/07/uk-government-very-close-eroding-encryption-worldwide https://www.eff.org/deeplinks/2023/07/uk-government-very-clo...

cjs_ac 3y ago
Perhaps I am being naive, and I will confess that I'm not entirely sure that the future will be as I predicted (but I'm not going to edit my initial comment, out of respect for those disagreeing with me). But I will think this quote from one of the bill's most dogged critics is illustrative[0]: > ... this Bill, whatever DCMS and its ministers may claim, is not a “fixing” Bill, one which has been designed to be constructive and positive in order to fix problems. It is a “getting” Bill, once which has been designed to be vindictive and negative in order to get specific companies. OnlyFans in this particular example, the usual suspects in others. > The second is that this Bill has been designed by people who are so out of touch that OnlyFans is their idea of the average small digital business. > And the third is that this Bill has been designed by people who are so out of touch that they think the harms issues raised by OnlyFans are the harms issues in the average small digital business. As for your distrust of the government, my opinion on this comes from that same position. My complacency rests not on their goodwill (because I don't think they have any) but on their disinterest in actually understanding anything. [0] https://webdevlaw.uk/2022/07/13/heres-why-your-project-is-in-scope-of-the-online-safety-bill/ https://webdevlaw.uk/2022/07/13/heres-why-your-project-is-in...

jrmg 3y ago

I’m reminded of the hyperbole - which I fell for - around the Regulation of Investigatory Powers act around the turn of the millennium. It provides a legal mechanism for authorities to require that individuals disclose encryption keys for encrypted data that was legally obtained or intercepted (i.e. with a warrant) by those authorities, and there are penalties (jail time) for refusing to do so. The worry at the time was that random data is indistinguishable from encrypted content, so there might be times when people are jailed when they don’t even have the keys because there’s no encrypted data - just random bytes! Or, what happens if you lose the keys? The reality is that there’s a court system that ‘regulates’ all this. No-one is going to be jailed unless the courts find that they are not providing keys they really do have. Of course, in a conspiracy where the authorities and the courts are all colluding, they could jail people pretending that they knew they had the keys - but there are far easier ways for the authorities to do this than some elaborate scheme with fake encrypted data. At the time I was fully convinced that it was a step down a slippery slope to authoritarianism. Really, it was just bringing the ‘virtual’ world into line with the physical one. [I suspect there are a few here who were also around at the time and still believe it’s all a nefarious governmental plot - I’d ask them to show where, in the 23 years since it passed, harm - or suspicion of harm - has happened]. Now, maybe this is different. I certainly don’t want end to end encryption to be banned. But there’s a bit of a ‘cried wolf’ happening in my brain.

jl6 3y ago
An interesting RIP case here: https://www.bbc.co.uk/news/uk-england-11479831 https://www.bbc.co.uk/news/uk-england-11479831 A person received a 16 week prison sentence for not disclosing a password. In the context, it’s possible that had he disclosed the password, police would have discovered material that would have attracted a far more severe punishment. So one might argue that the RIP was too weak, and failed to compel disclosure of the password (four months in jail is light in the circumstances).
- amiga386 3y ago
  This guy went to prison for a year and 2 months, for not disclosing his Facebook password: https://www.bbc.co.uk/news/uk-england-hampshire-45365464 https://www.bbc.co.uk/news/uk-england-hampshire-45365464 He was accused of murder. Ultimately, he was found guilty and sentenced to 33 years: https://www.hampshire.police.uk/news/hampshire/news/news/2019/july/lucy-mchugh-murder--stephen-nicholson-found-guilty/ https://www.hampshire.police.uk/news/hampshire/news/news/201... And then there's the other direction, which I must confess I thought would have involved the RIP Act but ultimately didn't, instead it used anti-terrorism legislation. A French employee of radical French publishing house that the French government is very cross with, arrived in Britain for a book fair. He was arrested and held for 24 hours using anti-terror legislation. The cops also confiscated his phone and laptop, and held onto them for more than 10 weeks, and they threatened him "with never being able to travel overseas if he failed to hand over a password to his confiscated iPhone and MacBook": https://www.theguardian.com/uk-news/2023/jul/21/police-watchdog-investigating-arrest-french-publisher-ernest-moret https://www.theguardian.com/uk-news/2023/jul/21/police-watch... The general concern is that France is not allowed to do that, so asked Britain to do it for them, and Britain did it. There wasn't even a hint that he'd broken the law in Britain, and all that was wanted was for the French government to get ahold of the contents of his phone and laptop. Perhaps this is the only reason (that they had absolutely nothing on him) that they didn't twist the knife and use the RIP Act to imprison him simply for not unlocking his devices for them: https://www.theguardian.com/uk-news/2023/apr/19/french-publisher-arrested-in-london-was-asked-about-support-for-macron https://www.theguardian.com/uk-news/2023/apr/19/french-publi...

hau 3y ago

>Your Mastodon server or your Gitea server or your corner of the Tildeverse or whatever will never appear on their radar Of course it will when your gitea or mastodon instance is in the right crosshair. Do we just surrender rights on a hope this time we can stay under the radar? If you are not a terrorist or a pedophile you have nothing to worry etc. When you disagree enough you will become a terrorist. That's the reality in my country because it works an have worked for centuries. >Ofcom won't have the budget or the resources to go after individuals or small communities; they won't even know you exist. >Ofcom isn't going to audit your homelab for online harms. Pinky promise?

cjs_ac 3y ago
I've read the bill, and know what it stipulates. Of course, if you don't want to take my word for it, you can download the 302 pages of legislation and check it yourself: https://bills.parliament.uk/bills/3137 https://bills.parliament.uk/bills/3137
- jabradoodle 3y ago
  The comment you are replying to isn't discussing the bill but refuting your assertion the powers it affords will be used only in a specific set of circumstances. Not sure what your deflection is in aid of.

collaborative 3y ago

You seem to know more than me. I host a fringe e2ee messaging system in the UK that I run under under an LTD. Am I affected?

cjs_ac 3y ago
Disclaimer: I'm not a lawyer, just someone who read the bill a couple of months ago because I was checking to see whether the idea I have in the back of my head for a social media platform was still viable. Heather Burns[0] is an actual lawyer who's a leading authority on this. The basic principle is that what people do online can have negative consequences in the real world, and the bill basically holds online service operators (such as yourself) at least partially responsible for those negative consequences. Operators need to demonstrate that they're mitigating those consequences risk assessments and policies. Judging by your profile, you're offering e2ee to family groups, so your intended users are low-risk for sending harmful content. However, your service is freely available to anyone with the app, so it could potentially be used by terrorist organisations, gangs or CSAM sharing groups. e2ee services like this are pretty much the only service that is outright incompatible with the requirements of the bill, so I think you'll be in trouble as soon as Ofcom comes knocking, if they do so. I think the chance of them doing so is small, but that's just my personal opinion, and you will have to make your own decisions. The family tree and calendar features look like they're low risk, and could be adequately covered by risk assessments, but the file and photo sharing features are also problematic, because (I think) they're encrypted. You're very unfortunate to be at the intersection of the three factors that could make Ofcom care about you: * service freely available to the public; * arbitrary user-to-user communication; and * no means of checking for harmful conduct on your service. The only way forward that I can see for you is to make the backend a selfhost-only affair, which would make your UK-based users responsible under the bill. [0] https://webdevlaw.uk/about/ https://webdevlaw.uk/about/
- deleted 3y ago
  [deleted]

ThrustVectoring 3y ago

Of course the government is going to enforce only a fraction of the offenses it creates. This is nearly always the case, and is mostly irrelevant to a law's actual effectiveness. That is derived from a combination of targeting the highest-profile offenders and the law acting as a press release as to the government's enforcement priorities. Like, imagine you're running a team developing an end-to-end encrypted application in Britain, and you're seeking funding. The potential investors are going to ask what your plan is to not get owned by this bill, you won't have a good answer outside of "hope they don't notice us", and they won't invest. This happens merely because the British government publicized the Online Safety Bill, and exactly zero enforcement effort was required to stifle the funding, development, and subsequent use of this hypothetical application. Anyhow, the short of my point is that government laws have a ton of power to shape behavior outside of prosecuting people, and sensible risk-management shapes the behavior of non-government bureaucrats and decisionmakers.

DoItToMe81 3y ago

The UK arrests more people annually for harmless internet activity than any other nation. It does affect them, as its only a matter of time before they actively hunt you down for 'causing psychological harm' over innocent comments.