The UK is to be blamed for a bad law on the internet

The UK Online Safety Bill will return to the House of Commons if Parliament is Voted in 2019. Pret a Manger’s Note on Cheese and Crabberry

Pret a Manger put writing on the back of a packet for a cheese and cranberry sandwich. Those notes, from discussions between academics Lorna Woods and William Perrin about how to make tech companies responsible for online harms, became an influential white paper in 2019. The aim of the Online Safety Bill was to make the United Kingdom the best place in the world to be online by regulating harmful content, such as child sexual abuse imagery, and misinformation.

The current government is widely expected to be voted from power next year, but the draft law returns to the House of Commons today, where members of parliament will have their final chance to debate its content. “It is very different from the sandwich packet, not least because there’s no brie smears on it,” says Woods, a law professor at the University of Essex. Each Conservative administration left their own mark on it. “I think perhaps that has added to the baroque ornamentation,” Woods says.

Many others are far less measured in their criticism. The bill as it stands today is more than 260 pages and is a reflection on how ministers and MPs prioritised their own interests. Many of the misinformation provisions have been watered down. Additions to the bill include a controversial requirement that messaging platforms scan content for child sexual abuse images, something that tech companies and privacy campaigners say can only be achieved by weakening end-to-end encryption.

If the law is passed, Signal and other platforms threatening to pull out of the UK. The bill will pass because they probably aren’t bluffing.

A Victory for the End-to-End Encryption Reform Act of the Day the UK Government Gives up the Powers under the Law

Tech companies and privacy activists are claiming victory after an eleventh-hour concession by the British government in a long-running battle over end-to-end encryption.

“It’s absolutely a victory,” says Meredith Whittaker, president of the Signal Foundation, which operates the Signal messaging service. Whittaker has been lobbying for the bill to be changed, and has been meeting with activists. “It commits to not using broken tech or broken techniques to undermine end-to-end encryption.”

The technology that platforms should use to detect CSAM being sent on encrypted services was not specified by the UK government, so the most popular solution was client-side scanning. The sender and recipients can’t see the content of the message if it’s end-to-end encryption is used.

Client-side scanning would mean examining the content of the message before it was sent—that is, on the user’s device—and comparing it to a database of CSAM held on a server somewhere else. Alan Woodward is a visiting professor in cybersecurity at the University ofurrey and believes that that is a government-sanctionedspyware scanning of your images and possibly yourtexts.

Apple said it could not make the system work without violating its users’ privacy when it paused its plans to build client side scanning technology in December.

Opponents of the bill say that putting backdoors into people’s devices to search for CSAM images would almost certainly pave the way for wider surveillance by governments. “You make mass surveillance become almost an inevitability by putting [these tools] in their hands,” Woodward says. “There will always be some ‘exceptional circumstances’ that [security forces] think of that warrants them searching for something else.”

Although the UK government has said that it now won’t force unproven technology on tech companies, and that it essentially won’t use the powers under the bill, the controversial clauses remain within the legislation, which is still likely to pass into law. “It’s not gone away, but it’s a step in the right direction,” Woodward says.

James Baker, campaign manager for the Open Rights Group, a nonprofit that has campaigned against the law’s passage, says that the continued existence of the powers within the law means encryption-breaking surveillance could still be introduced in the future. He says that the powers should be removed from the bill.

But some are less positive about the apparent volte-face. “Nothing has changed,” says Matthew Hodgson, CEO of UK-based Element, which supplies end-to-end encrypted messaging to militaries and governments. It is what is actually written in the bill that matters. Scanning is fundamentally incompatible with end-to-end encrypted messaging apps. Scanning bypasses the encryption in order to scan, exposing your messages to attackers. The door is open for scanning in the future if it is technically feasible. It’s not a change, it’s kicking the can down the road.”

Whittaker acknowledges that “it’s not enough” that the law simply won’t be aggressively enforced. It is major. She said that we can recognize a win without thinking of it being the final victory.

Whittaker says the implications of the British government backing down will reverberate far beyond the UK. Security services around the world have been pushing for measures to weaken end-to-end encryption, and there is a similar battle going on in Europe over CSAM, where the European Union commissioner in charge of home affairs, Ylva Johannson, has been pushing similar, unproven technologies.

“It’s huge in terms of arresting the type of permissive international precedent that this would set,” Whittaker says. “The UK was the first jurisdiction to be pushing this kind of mass surveillance. It stops that momentum. And that’s huge for the world.”