\n<\/p>\n
The U.K.\u2019s newly empowered Internet content regulator has published the first set of draft Codes of Practice under the Online Safety Act<\/a> (OSA) which\u00a0became law late last month<\/a>.<\/p>\n More codes will follow but this first set \u2014 which is focused on how user-to-user (U2U) services will be expected to respond to different types of illegal content \u2014 offers a steer on how Ofcom is minded to shape and enforce the U.K.\u2019s sweeping new Internet rulebook in a key area.<\/p>\n Ofcom says its first priority as the \u201conline safety regulator\u201d will be protecting children.<\/p>\n The draft recommendations on illegal content include suggestions that larger and higher risk platforms should avoid presenting kids with lists of suggested friends; should not have child users appear in others\u2019 connection lists; and should not make children\u2019s connection lists visible to others.<\/p>\n It\u2019s also proposing that accounts outside a child\u2019s connection list should not be able to send them direct messages; and kids\u2019 location information should not be visible to other users, among a number of recommended risk mitigations aimed at keeping kids safe online.<\/p>\n \u201cRegulation is here, and we\u2019re wasting no time in setting out how we expect tech firms to protect people from illegal harm online, while upholding freedom of expression. Children have told us about the dangers they face, and we\u2019re determined to create a safer life online for young people in particular,\u201d said dame Melanie Dawes, Ofcom\u2019s chief executive, in a statement.<\/p>\n \u201cOur figures show that most secondary-school children have been contacted online in a way that potentially makes them feel uncomfortable. For many, it happens repeatedly. If these unwanted approaches occurred so often in the outside world, most parents would hardly want their children to leave the house. Yet somehow, in the online space, they have become almost routine. That cannot continue.\u201d<\/p>\n The OSA puts a legal duty on digital services, large and small, to protect users from risks posed by illegal content, such as CSAM (child sexual abuse material), terrorism and fraud. Although the list of priority offences in the legislation is long \u2014 also including intimate image abuse; stalking and harassment; and cyberflashing, to name a few more.<\/p>\n The exact steps in-scope services and platforms need to take to comply are not set out in the legislation. Nor is Ofcom prescribing how digital businesses should act on every type of illegal content risks. But detailed Codes of Practice it\u2019s developing are intended to provide recommendations to help companies make decisions on how adapt their services to avoid the risk of being found in breach of a regime that empowers it to levy fines of up to 10% of global annual turnover for violations.<\/p>\n Ofcom is avoiding a one-size-fits all approach \u2014 with some more costly recommendations in the draft code being proposed for only larger and\/or riskier services.<\/p>\n It also writes that it is \u201clikely to have the closest supervisory relationships\u201d with \u201cthe largest and riskiest services\u201d \u2014 a line that should bring a degree of relief to startups (which generally won\u2019t be expected to implement as many of the recommended mitigations as more established services). It\u2019s defining \u201clarge\u201d services in the context of the OSA as those that have more than 7 million monthly users (or around 10% of the U.K. population).<\/p>\n \u201cFirms will be required to assess the risk of users being harmed by illegal content on their platform, and take appropriate steps to protect them from it. There is a particular focus on \u2018priority offences\u2019 set out in the legislation, such as child abuse, grooming and encouraging suicide; but it could be any illegal content,\u201d it writes in a press release, adding: \u201cGiven the range and diversity of services in scope of the new laws, we are not taking a \u2018one size fits all\u2019 approach. We are proposing some measures for all services in scope, and other measures that depend on the risks the service has identified in its illegal content risk assessment and the size of the service.\u201d<\/p>\n The regulator appears to be moving relatively cautiously in taking up its new responsibilities, with the draft code on illegal content frequently citing a lack of data or evidence to justify preliminary decisions to not<\/em> recommend certain types of risk mitigations \u2014 such as Ofcom not proposing hash matching for detecting terrorism content; nor recommending the use of AI to detect previously unknown illegal content.<\/p>\n Although it notes that such decisions could change in future as it gathers more evidence (and, doubtless, as available technologies change).<\/p>\n It also acknowledges the novelty of the endeavour, i.e. attempting to regulate something as sweeping and subjective as online safety\/harm, saying it wants its first codes to be a foundation it builds on, including via a regular process of review \u2014 suggesting the guidance will shift and develop as the oversight process matures.<\/p>\n \u201cRecognising that we are developing a new and novel set of regulations for a sector without previous direct regulation of this kind, and that our existing evidence base is currently limited in some areas, these first Codes represent a basis on which to build, through both subsequent iterations of our Codes and our upcoming consultation on the Protection of Children,\u201d Ofcom writes. \u201cIn this vein, our first proposed Codes include measures aimed at proper governance and accountability for online safety, which are aimed at embedding a culture of safety into organisational design and iterating and improving upon safety systems and processes over time.\u201d<\/p>\n Overall, this first step of recommendations look reasonably uncontroversial \u2014 with, for example, Ofcom leaning towards recommending that all U2U services should have \u201csystems or processes designed to swiftly take down illegal content of which it is aware\u201d (note the caveats); whereas \u201cmulti-risk\u201d and\/or \u201clarge\u201d U2U services are presented with a more comprehensive and specific list of requirements aimed at ensuring they have a functioning, and well enough resourced, content moderation system.<\/p>\n Another proposal it\u2019s consulting on is that all general search services should ensure\u00a0URLs identified as hosting CSAM should be deindexed.\u00a0But it\u2019s not making it a formal recommendation that users who share CSAM be blocked as yet \u2014 citing a lack of evidence (and inconsistent existing platform policies on user blocking) for not suggesting that at this point. Though the draft says it\u2019s \u201caiming to explore a recommendation around user blocking related to CSAM early next year\u201d.<\/p>\n Ofcom also suggests services that identify as medium or high risk should provide users with tools to let them block or mute other accounts on the service. (Which should be uncontroversial to pretty much everyone \u2014 except maybe X-owner, Elon Musk.)<\/p>\n It is also steering away from recommending certain more experimental and\/or inaccurate (and\/or intrusive) technologies \u2014 so while it recommends that larger and\/or higher CSAM-risk services perform URL detection to pick up and block links to known CSAM sites it is not suggesting they do keyword detection for CSAM, for example.<\/p>\n Other preliminary recommendations include that major search engines display predictive warnings on searches that could be associated with CSAM; and serve crisis prevention information for suicide-related searches.<\/p>\n Ofcom is also proposing services use automated keyword detection to find and remove posts linked to the sale of stolen credentials, like credit cards \u2014 targeting the myriad harms flowing from online fraud. However it is recommending against using the same tech for detecting financial promotion scams specifically, as it\u2019s worried this would pick up a lot of legitimate content (like promotional content for genuine financial investments).<\/p>\n Privacy and security watchers should breathe a particular sigh of relief on reading the draft guidance as Ofcom appears to be stepping away from the most controversial element of the OSA \u2014 namely\u00a0its potential impact on end-to-end encryption<\/a>\u00a0(E2EE).<\/p>\n