5 ms·

This: OP seems to be throwing the baby out with the bathwater. Im surprised they don’t already have some form of report/flag button.

by orf 2y ago

rob74 2y ago
From how I understood the post, the forums were never self-sustaining financially and always required a considerable amount of time, so the new legislation was probably just the final straw that broke the camel's back?
- simmo9000 2y ago
  Exactly. Adding punitive governance hurdles hinders the small and/or solo. Those that do whist not seeking financial gain are impacted the most. Regulatory capture. https://en.wikipedia.org/wiki/Regulatory_capture https://en.wikipedia.org/wiki/Regulatory_capture
Kostchei 2y ago
OP runs 300 essentially free forums. It's just too much.
bilekas 2y ago
I get the same feeling as the repercussions for bad actors are fines relative to revenue, 10% if I read correctly, given that the OP has stated that they work off a deficit most of the time, I can't see this being an issue. Also if it is well monitored and seems to have a positive community, I don't see the major risk to shut down. Seems more shutting down out of frustration against a law that, while silly on it's face, doesn't really impact this provider.
- trogdor 2y ago
  >the repercussions for bad actors are fines relative to revenue, 10% if I read correctly, given that the OP has stated that they work off a deficit most of the time, I can't see this being an issue. From another commenter: Platforms failing this duty would be liable to fines of up to £18 million or 10% of their annual turnover, whichever is higher.
- pasc1878 2y ago
  Part of the issue is that you have to spend time and money to defend an accusation.
that_guy_iain 2y ago
That's why feeling too. There will always be people who take laws and legal things overly seriously. For example, WordPress.org added a checkbox to the login to say that pineapple on pizza is delicious and there are literal posts on Twitter asking "I don't like pineapple on pizza, does this mean I can't contribute". It doesn't matter if a risk isn't even there, like who is going to be able to sue over pineapple on pizza being delicious or not? Yet, there will be people who will say "Sorry, I can't log in I don't like pineapple on pizza". In this case, it's "I'm shutting down my hobby that I've had for years because I have to add a report button".
buro9 2y ago
I am the OP, and if you read the guidance published yesterday: https://www.ofcom.org.uk/siteassets/resources/documents/online-safety/information-for-industry/illegal-harms/illegal-content-codes-of-practice-for-user-to-user-services.pdf?v=387711 https://www.ofcom.org.uk/siteassets/resources/documents/onli... Then you will see that a forum that allows user generated content, and isn't proactively moderated (approval prior to publishing, which would never work for even a small moderately busy forum of 50 people chatting)... will fall under "All Services" and "Multi-Risk Services". This means I would be required to do all the following: 1. Individual accountable for illegal content safety duties and reporting and complaints duties 2. Written statements of responsibilities 3. Internal monitoring and assurance 4. Tracking evidence of new and increasing illegal harm 5. Code of conduct regarding protection of users from illegal harm 6. Compliance training 7. Having a content moderation function to review and assess suspected illegal content 8. Having a content moderation function that allows for the swift take down of illegal content 9. Setting internal content policies 10. Provision of materials to volunteers 11. (Probably this because of file attachments) Using hash matching to detect and remove CSAM 12. (Probably this, but could implement Google Safe Browser) Detecting and removing content matching listed CSAM URLs ... the list goes on. It is technical work, extra time, the inability to not constantly be on-call when I'm on vacation, the need for extra volunteers, training materials for volunteers, appeals processes for moderation (in addition to the flak one already receives for moderating), somehow removing accounts of proscribed organisations (who has this list, and how would I know if an account is affiliated?), etc, etc. Bear in mind I am a sole volunteer, and that I have a challenging and very enjoyable day job that is actually my primary focus. Running the forums is an extra-curricular volunteer thing, it's a thing that I do for the good it does... I don't do it for the "fun" of learning how to become a compliance officer, and to spend my evenings implementing what I know will be technically flawed efforts to scan for CSAM, and then involve time correcting those mistakes. I really do not think I am throwing the baby out with the bathwater, but I did stay awake last night dwelling on that very question, as the decision wasn't easily taken and I'm not at ease with it, it was a hard choice, but I believe it's the right one for what I can give to it... I've given over 28 years, there's a time to say that it's enough, the chilling effect of this legislation has changed the nature of what I was working on, and I don't accept these new conditions. The vast majority of the risk can be realised by a single disgruntled user on a VPN from who knows where posting a lot of abuse material when I happen to not be paying attention (travelling for work and focusing on IRL things)... and then the consequences and liability comes. This isn't risk I'm in control of, that can be easily mitigated, the effort required is high, and everyone here knows you cannot solve social issues with technical solutions.
pasc1878 2y ago
Yes they do but you need to do more than that. They do not have the resources to find out exactly what they need to do so that there is no risk of them being made totally bankrupt. If that is all - please point to the guidance or law that says just having a report button is sufficient in all cases.
- deleted 2y ago
  [deleted]
codazoda 2y ago
I’m not so sure. It’s a layman’s interpretation, but I think any “forum” would be multi-risk. That means you need to do CSAM scanning if you accept images, CSAM URL scanning if you accept links, and there’s a lot more than that to parse here.
- IanCal 2y ago
  I doubt it. While it's always a bit of a gray area, the example for "medium risk" is a site with 8M monthly users who share images, doesn't have proactive scanning and has been warned by multiple major organisations that it has been used a few times to share CSAM material. Cases where they assume you should say "medium risk" without evidence of it happening are if you've got several major risk factors: > (a) child users; (b) social media services; (c) messaging services; (d) discussion forums and chat rooms; (e) user groups; (f) direct messaging; (g) encrypted messaging. Also, before someone comes along with a specific subset and says those several things are benign > This is intended as an overall guide, but rather than focusing purely on the number of risk factors, you should consider the combined effect of the risk factors to make an overall judgement about the level of risk on your service And frankly if you have image sharing, groups, direct messaging, encrypted messaging, child users, a decent volume and no automated processes for checking content you probably do have CSAM and grooming on your service or there clearly is a risk of it happening.
  - raverbashing 2y ago
    The problem is the following: if you don't have basic moderation your forum will be abused for those various illegal purposes Having a modicum of rule enforcement and basic abuse protections (let's say: new users can't upload files) on it goes a long way
- tzs 2y ago
  That scanning requirement only applies if your site is: • A "large service" (more than 7 million monthly active UK users) that is at a medium or high risk of image-based CSAM, or • A service that is at a high risk of image-based CSAM and either has more than 700000 monthly active UK users or is a file-storage and file-sharing service.
iLoveOncall 2y ago
OP isn't throwing the baby with the bathwater and he explains it very well in his post: the risk of being sued is too great in itself, even if you end up winning the lawsuit.
- ArchOversight 2y ago
  OP uses they/them pronouns.
- dangus 2y ago
  The general risk of being sued is always there regardless of the various things laws say. I think there’s a pretty decent argument being made here that OP is reading too far in the new rules and letting the worst case scenario get in the way of something they’re passionate about. I wonder if they consulted with a lawyer before making this decision? That’s what I would be doing.
  - mmmore 2y ago
    Given: > I do so philanthropically without any profit motive (typically losing money) the cost (and hassle) of consulting with a lawyer is potentially a lot in relative terms. That said, I thought that the rule in the UK was generally that the loser pays the winners costs, so I'd think that limit the costs of defending truly frivolous suits. The downside risks are possibly still high though.
    - robocat 2y ago
      > the loser pays the winners costs Winning against the government is difficult - an asymmetric unfair fight. You can't afford to pay the costs to try: financial, risk, opportunity cost, and most importantly YOUR time.
    - tinbucket 2y ago
      > That said, I thought that the rule in the UK was generally that the loser pays the winners costs That’s generally true… but only happens after those costs have been incurred and probably paid. There’s no guarantee the party suing will be able to cover their own costs and the defendant’s costs. That leaves OP on the hook for defence costs with the hope that they might get them back after a successful and likely expensive defence. In that situation, I can understand why OP wouldn’t want to take the risk.

This: OP seems to be throwing the baby out with the bathwater. Im surprised they don’t already have some form of report/flag button.

by orf 2y ago

This: OP seems to be throwing the baby out with the bathwater. Im surprised they don’t already have some form of report/flag button.

rob74 2y ago

From how I understood the post, the forums were never self-sustaining financially and always required a considerable amount of time, so the new legislation was probably just the final straw that broke the camel's back?

simmo9000 2y ago
Exactly. Adding punitive governance hurdles hinders the small and/or solo. Those that do whist not seeking financial gain are impacted the most. Regulatory capture. https://en.wikipedia.org/wiki/Regulatory_capture https://en.wikipedia.org/wiki/Regulatory_capture

Kostchei 2y ago

OP runs 300 essentially free forums. It's just too much.

bilekas 2y ago

I get the same feeling as the repercussions for bad actors are fines relative to revenue, 10% if I read correctly, given that the OP has stated that they work off a deficit most of the time, I can't see this being an issue. Also if it is well monitored and seems to have a positive community, I don't see the major risk to shut down. Seems more shutting down out of frustration against a law that, while silly on it's face, doesn't really impact this provider.

trogdor 2y ago
>the repercussions for bad actors are fines relative to revenue, 10% if I read correctly, given that the OP has stated that they work off a deficit most of the time, I can't see this being an issue. From another commenter: Platforms failing this duty would be liable to fines of up to £18 million or 10% of their annual turnover, whichever is higher.
pasc1878 2y ago
Part of the issue is that you have to spend time and money to defend an accusation.

that_guy_iain 2y ago

That's why feeling too. There will always be people who take laws and legal things overly seriously. For example, WordPress.org added a checkbox to the login to say that pineapple on pizza is delicious and there are literal posts on Twitter asking "I don't like pineapple on pizza, does this mean I can't contribute". It doesn't matter if a risk isn't even there, like who is going to be able to sue over pineapple on pizza being delicious or not? Yet, there will be people who will say "Sorry, I can't log in I don't like pineapple on pizza". In this case, it's "I'm shutting down my hobby that I've had for years because I have to add a report button".

buro9 2y ago

I am the OP, and if you read the guidance published yesterday: https://www.ofcom.org.uk/siteassets/resources/documents/online-safety/information-for-industry/illegal-harms/illegal-content-codes-of-practice-for-user-to-user-services.pdf?v=387711 https://www.ofcom.org.uk/siteassets/resources/documents/onli... Then you will see that a forum that allows user generated content, and isn't proactively moderated (approval prior to publishing, which would never work for even a small moderately busy forum of 50 people chatting)... will fall under "All Services" and "Multi-Risk Services". This means I would be required to do all the following: 1. Individual accountable for illegal content safety duties and reporting and complaints duties 2. Written statements of responsibilities 3. Internal monitoring and assurance 4. Tracking evidence of new and increasing illegal harm 5. Code of conduct regarding protection of users from illegal harm 6. Compliance training 7. Having a content moderation function to review and assess suspected illegal content 8. Having a content moderation function that allows for the swift take down of illegal content 9. Setting internal content policies 10. Provision of materials to volunteers 11. (Probably this because of file attachments) Using hash matching to detect and remove CSAM 12. (Probably this, but could implement Google Safe Browser) Detecting and removing content matching listed CSAM URLs ... the list goes on. It is technical work, extra time, the inability to not constantly be on-call when I'm on vacation, the need for extra volunteers, training materials for volunteers, appeals processes for moderation (in addition to the flak one already receives for moderating), somehow removing accounts of proscribed organisations (who has this list, and how would I know if an account is affiliated?), etc, etc. Bear in mind I am a sole volunteer, and that I have a challenging and very enjoyable day job that is actually my primary focus. Running the forums is an extra-curricular volunteer thing, it's a thing that I do for the good it does... I don't do it for the "fun" of learning how to become a compliance officer, and to spend my evenings implementing what I know will be technically flawed efforts to scan for CSAM, and then involve time correcting those mistakes. I really do not think I am throwing the baby out with the bathwater, but I did stay awake last night dwelling on that very question, as the decision wasn't easily taken and I'm not at ease with it, it was a hard choice, but I believe it's the right one for what I can give to it... I've given over 28 years, there's a time to say that it's enough, the chilling effect of this legislation has changed the nature of what I was working on, and I don't accept these new conditions. The vast majority of the risk can be realised by a single disgruntled user on a VPN from who knows where posting a lot of abuse material when I happen to not be paying attention (travelling for work and focusing on IRL things)... and then the consequences and liability comes. This isn't risk I'm in control of, that can be easily mitigated, the effort required is high, and everyone here knows you cannot solve social issues with technical solutions.

pasc1878 2y ago

Yes they do but you need to do more than that. They do not have the resources to find out exactly what they need to do so that there is no risk of them being made totally bankrupt. If that is all - please point to the guidance or law that says just having a report button is sufficient in all cases.

deleted 2y ago
[deleted]

codazoda 2y ago

I’m not so sure. It’s a layman’s interpretation, but I think any “forum” would be multi-risk. That means you need to do CSAM scanning if you accept images, CSAM URL scanning if you accept links, and there’s a lot more than that to parse here.

IanCal 2y ago
I doubt it. While it's always a bit of a gray area, the example for "medium risk" is a site with 8M monthly users who share images, doesn't have proactive scanning and has been warned by multiple major organisations that it has been used a few times to share CSAM material. Cases where they assume you should say "medium risk" without evidence of it happening are if you've got several major risk factors: > (a) child users; (b) social media services; (c) messaging services; (d) discussion forums and chat rooms; (e) user groups; (f) direct messaging; (g) encrypted messaging. Also, before someone comes along with a specific subset and says those several things are benign > This is intended as an overall guide, but rather than focusing purely on the number of risk factors, you should consider the combined effect of the risk factors to make an overall judgement about the level of risk on your service And frankly if you have image sharing, groups, direct messaging, encrypted messaging, child users, a decent volume and no automated processes for checking content you probably do have CSAM and grooming on your service or there clearly is a risk of it happening.
- raverbashing 2y ago
  The problem is the following: if you don't have basic moderation your forum will be abused for those various illegal purposes Having a modicum of rule enforcement and basic abuse protections (let's say: new users can't upload files) on it goes a long way
tzs 2y ago
That scanning requirement only applies if your site is: • A "large service" (more than 7 million monthly active UK users) that is at a medium or high risk of image-based CSAM, or • A service that is at a high risk of image-based CSAM and either has more than 700000 monthly active UK users or is a file-storage and file-sharing service.

iLoveOncall 2y ago

OP isn't throwing the baby with the bathwater and he explains it very well in his post: the risk of being sued is too great in itself, even if you end up winning the lawsuit.

ArchOversight 2y ago
OP uses they/them pronouns.
dangus 2y ago
The general risk of being sued is always there regardless of the various things laws say. I think there’s a pretty decent argument being made here that OP is reading too far in the new rules and letting the worst case scenario get in the way of something they’re passionate about. I wonder if they consulted with a lawyer before making this decision? That’s what I would be doing.
- mmmore 2y ago
  Given: > I do so philanthropically without any profit motive (typically losing money) the cost (and hassle) of consulting with a lawyer is potentially a lot in relative terms. That said, I thought that the rule in the UK was generally that the loser pays the winners costs, so I'd think that limit the costs of defending truly frivolous suits. The downside risks are possibly still high though.
  - robocat 2y ago
    > the loser pays the winners costs Winning against the government is difficult - an asymmetric unfair fight. You can't afford to pay the costs to try: financial, risk, opportunity cost, and most importantly YOUR time.
  - tinbucket 2y ago
    > That said, I thought that the rule in the UK was generally that the loser pays the winners costs That’s generally true… but only happens after those costs have been incurred and probably paid. There’s no guarantee the party suing will be able to cover their own costs and the defendant’s costs. That leaves OP on the hook for defence costs with the hope that they might get them back after a successful and likely expensive defence. In that situation, I can understand why OP wouldn’t want to take the risk.