As I sit here in my newly redecorated office, mid-week stress of the three present aspects of my life - Digital Systems Implementation internship at a 103+ year old company, MSc Advanced Computer Science studies and my Software Start-up, Parentull - float around my mind. I've got lots to manage, regulation to adhere to and assignments to submit; but I had to take some time out to blog about this because it's really important, not just for me because this is my industry; but for everyone else too.
I'm speaking of course, of "David's Law", otherwise known as the "Online Safety Bill". It came into the spotlight this week after the murder of David Amess MP, which I won't comment on except to say that his murder wasn't commited by words. It was committed by a real object, in person. Tweets, memes and emojis did not kill him, a stabbing did; so I find it strange that his colleagues immediate reaction is to call for further regulation of words... on the internet.
In any case, I'm not here to have that debate, I'm here to talk about the actual proposals because truly they are "Amess" and I think it would be quite a pity if this poor MP was saddled with the legacy of abysmal legislation.
Lets start with what Mark Francois said during his speech. He said "For this, we are now systematically vilified day after day, and I simply say to you, ladies and gentlemen, that enough is enough. We all have one thing in common: we are legislators. So I humbly suggest that we get on and do some legislating. I suggest that if we want to ensure that our colleague did not die in vain, we all collectively pick up the baton, regardless of party, and take the forthcoming Online Safety Bill and toughen it up markedly. If I may be so presumptuous, let us put “David’s law” on to the statute book, the essence of which would be that, while people in public life must remain open to legitimate criticism, they could no longer be vilified or their families subjected to the most horrendous abuse, especially from people who hide behind a cloak of anonymity, with the connivance of the social media companies for profit. The mood I am in, I confess that I would like to drag Mark Zuckerberg of Facebook and Jack Dorsey of Twitter to the Bar of the House, kicking and screaming if necessary, so that they could look us all in the eye and account for their actions, or rather their inactions, which are making them even richer than they already are."
That all sounds very positive. A message of "We're going to stop abuse and clear up all the mean words!"; but are they, really? I don't think Mark really understands what he's talking about given he referred to social media collectively as "the Twitter swamp" which might actually indicate that he has a problem with Twitter. That's probably a good sign, given the majority of Twitter users are lefties, and hard lefties at that. They're not representative of the wider population, they're not representative of most working class families or most internet users either - for instance, has Mark considered taking a venture over to Reddit, Discord, Youtube, Matrix, Telegram, Tusky, Signal or any of the other numerous social media sites? If he hasn't done in-depth research into all of them, then he cannot possibly make judgements about a "Twitter swamp" or the internet based on such little knowledge.
Ironically, having made his judgement, Mark went onto LBC to call internet users "sad little bastards" after making the assertion that 'internet trolls' were "<>typically young, male, living with parents and have difficulty forming relationships".
The sad little bastards was supposedly a quote from a police liason who was giving MPs training adding further irony because if mean words are uttered, it is the police who investigate and yet, we are to believe that MPs glorify the police when they spew mean words? What if these "sad little bastards" are disabled, have mental issues or as was the case with Alan Turing, are vilified for the wrong reasons by idiots in their time?
Further, the Police don't exactly have a good track record of understanding 'internet culture' or technology all that well themselves either despite having a 'hack' community (which is probably worse). For example, Last year West Midlands Police was laughed into taking down posters it produced begging parents to report their children for using Linux, Discord and Virtual machines. Imagine you're a teenager learning Cyber Security with your friends because that's what the Government and School has been pushing as the big 'money maker' and then your parents have you arrested because Police Constable Dimwit doesn't understand technology.
That's big brain energy. /s
To conclude, Mark doesn't know what he's talking about where the internet or technology is concerned. He's simply trying to score brownie points off the back of a murder. The Police equally don't know what they're talking about and frankly, they should stick to policing, not being political or passing judgement - that's the judicaries job; that said, the police do already the power to trace and arrest people for mean words on the internet.
We know this firstly because threats via email/social media/etc carry the same legal weight as a letter and so that would allow the police to act immediately. An example of relevant legislation can be seen in the Malicious Communications Act 1988; therefore, whenever an MP bleats on about getting death threats, rape threats and any other such messages; please understand that the police already have powers to act and they likely are acting.
Tracing who sent this information, if it hasn't been sent by a user who knows how to hide themselves, is not difficult. Most of the large companies (Microsoft, Google, Apple, Facebook etc) DO already have backend systems in place to comply with requests from law enforcement and courts; this will include logs of how an account was used and connections to and from it.
Similarly, when a person is traced, Police can request logs from the persons ISP (Internet Service Provider) depending on the circumstances and if the threshold meets the requirements for the Investigatory Powers Act. Conveniently, MPs made an exclusion from the Investigatory Powers Act for themselves because MPs have nothing to hide and so why would they need to have their ISP or any other data collected by authorities.... right? It's not like MPs ever, ever do any shady stuff!
The police also have dedicated teams who conduct digital forensics. Some of these teams have access to Cellebrite and Greyshift which allow for both iPhone and Android devices to be exploited, even when encrypted. This was widely reported years ago.
This shouldn't really be surprising given the UK is the 'home' of such surveillence projects as ECHELON, DISHFIRE as well as participating in illegal NSA projects, like XkeyScore.
In any event, we have a test case for "mean words on the internet" thanks to Harry Miller who retweeted a 'transphobic' tweet. The police repeatedly followed up Harry Millers retweet; despite initial investigations concluding he had not commited a crime. Eventually, the officer visited Harry Millers work place to contact him after other attempts failed. This incident led to legal action against Humberside Police.
A non-crime hate incident is: "Any non-crime incident which is perceived, by the victim or any other person, to be motivated by a hostility or prejudice against a person who is transgender or perceived to be transgender".
The non-crime hate incident was recorded because: Mrs B read the tweets when a friend told her about them. She regarded them as ‘transphobic’. They were recorded by the police as a non-crime hate incident. Of all the people who read the tweets, Mrs B was the only person to complain.
If it isn't clear already, Mrs. B read vicariously - through someone else, her friend - tweets that she would not have otherwise known about. She then decided to call the police. The tweets were not directed at her and did not impact her life; yet she felt the need to call the police. Subsequently, vast sums of money, time and resources were consumed to conclude that Harry Miller was perfectly within the law to retweet whatever the tweet was and that Humberside Police are akin to the Gestapo and Stasi.... seriously, here's the quote from the Judgement:
"The effect of the police turning up at [the Claimant’s] place of work because of his political opinions must not be underestimated. To do so would be to undervalue a cardinal democratic freedom. In this country we have
never had a Cheka, a Gestapo or a Stasi. We have never
lived in an Orwellian society." - Mr. Justice Julian Knowles
The very same judge had this to say about "the right to be offended".
To clarify then, we've established that we have an MP who didn't do any research, we know the laws that already exist and we have a good test case which proves that people do in fact have the right to say offensive things, whether on or offline.
So lets now take a look at what the Online Safety Bill proposes..... Here's a link to the bill by the way, if you want to follow along.
The first proposal is that OFCOM will become a 'regulator' for certain online platforms, dubbed "regulated services". Let's just consider that for a moment. OFCOM decribes itself as "Ofcom is the UK's communications regulator. We regulate the TV, radio and video on demand sectors, fixed line telecoms, mobiles, postal services, plus the airwaves over which wireless devices operate".
It's fair to say then that OFCOM regulates services that could traditionally be controlled within a confined area, like a country, or a county. That is certainly in line with my own experiences of OFCOM when I worked in radio when OFCOM officials were more like 1960s nerd throwbacks than forward thinking individuals. That's one of the first issues, internet culture is very "Rock music is ruining our kids"; there's a generation clash. One persons meme is another persons offensive material. What's to say OFCOM isn't going to go on a moral crusade? But there's a more worrying difference; the traditional services it regulates require a UK presence with infrastructure; most internet services do not.
A website / app can be served from anywhere in the world, it's served from the closest point to the user for speed, convinence and resource savings; but that doesn't have to be the case. What is to stop Facebook, Twitter, Google etc from simply closing up shop in the UK and deciding to disregard UK laws whilst operating safely from the EU and the USA? For such big companies, that might seem like a daft and unlikely move, but if the costs outweigh the benefits of remaining in the UK, why would they stay? It would only be the same as US sites which block EU/UK visitors because they do not wish to comply with GDPR. And why should they?
Startups and inventors are most likely to move abroad. The irony being that Brexit Britain has seen unrivalled fundraising for its startup communities, with London alone raising £30bn and Yorkshire on track to create 42,000 digital jobs. The very last thing Britain needs now is a brain drain, but that is what will happen if the barrier to innovation becomes to high. At the start of this article, I mentioned my own startup, Parentull. I had hoped to target the UK market specifically because I have experienced and can see a lot of issues with how family courts currently operate, but fuck me, I've already had to pay the ICO for data I'm not even processing yet, adhere to GDPR + other requirements; and if the Online Safety Bill passes, OFCOM will want to see risk assessments that simply do not make sense.
Take for example: Illegal Content Risk Assessment? Children's Risk Assessment? Adults Risk Assessment?
What exactly is 'illegal content'? I'm skeptical about the fact that this has to be done for user-to-user services where the organisation has little editoral oversight. We've also already established through Harry Miller that people have the right to say offensive things.
What about if someone uploads a picture / video of a cat being tortured? That would be a crime, right? But what if the person uploading it is trying to catch the person torturing the cat. As was the case in Don't F**k with Cats.
There is a grand assumption that organisations will be able to see user data to be able to determine what the content actually is; this in itself could constitute a privacy violation because users should be guaranteed that their communications are secure. More over, it's the users themselves who upload the content; how can the platform possibly determine the users intentions?
It is damn near impossible to generate a risk assessment based on user-to-user content on these requirements for most digital companies. It requires extreme legal knowledge, but also digital services operate because of human interaction - ergo - humans are random as hell, their mental health fails, they think something is funny in the moment, they have issues in their lives, something is popular for a 15 minutes, they have different interests, they might be protesting or whatever; the fact is these risk assessments are needless paper pushing that will not stop online services operating as they always have; be that in the UK or otherwise.
For startups like Parentull, this would be a very large obstacle to overcome as I know it would be for other business contacts. But this also applies to any online service where content sharing functionality is available.
That doesn't just affect social media, that affects gaming, chat services, streaming services, email, meme sites, self-hosted stuff, RSS feeds, bookmarks, browsers, mobile operating systems, desktop operating systems, and on and on...........
Browsers allow their users to make collections of bookmarks and tag content they like, don't they? Most allow you to sync your content across devices. Android / iOS allow you to add emojis via online messengers. MacOS / Windows have inbuilt search. Whatsapp allows you to share your location.
Imagine if these services were limited or stopped for the UK market because of this legislation. What would you lose/gain? As I said at the beginning, this affects everyone. It's not about 'making mean words go away', Mark is using the murder of Amess to scaremonger and stir political rhetoric in the bills favour. Don't fall for it. His claims that "The mood I am in, I confess that I would like to drag Mark Zuckerberg of Facebook and Jack Dorsey of Twitter to the Bar of the House, kicking and screaming if necessary, so that they could look us all in the eye and account for their actions, or rather their inactions, which are making them even richer than they already are." are sheer rhetoric. It is the type of thing you might hear a working class kid say to impress his friends; "Next time I see that [Insert big kid name here], I'm going to give him a kick in the teeth!" which says a lot about his character, alongside laughing at the coppers snide comments, of course.
If this bill passes, it will be bad for the UK Digital Economy and it will see further services shut themselves off from the UK as they did when GDPR was introduced. For the UK to succeed following Brexit, we need to cut legislation and regulation, not introduce more. That was one of the main faults of the EU - believing that more and more paperwork would solve the worlds problems, when in fact, it does not. In this case, it simply means that people will find another route to their service, or build underground peer-to-peer networks to avoid OFCOM. Don't believe me? Why do you think Gab came into existence, or the Gab browser? Because "right wing?" - No, because a system tried to stop people doing what people wanted to do on the internet, so people used the internet for its intended purpose: route around lost nodes. I think perhaps, MPs have forgotten that the precursor to the modern day internet was built as a military network to withstand nuclear missle impacts; what do they think legislation is going to do? Legislators need to be smarter than this, seriously.