Ask HN: Online activities to be made impossible by the UK Online Safety Bill

https://news.ycombinator.com/item?id=36919175

by b800h • 3 years ago

195 105 3 years ago

news.ycombinator.com

I thought it might be interesting to compile a list of things which it might be impossible (or at least very difficult) for a private individual to do under the Online Safety Bill.

Starters for ten:

1) Minecraft / MineTest server 2) IRC server 3) Mastodon server 4) BBS 5) ... please continue

I'm not fully sure about all this - as I understand it, if you allow chat or user generated content, you become a private service provider, and then have a host of responsibilities including annual audits of whether a significant proportion of your users are minors. If they are then you need to use a (commercial?) age verification tool and monitor everything assiduously. Difficult to see most people being able to satisfy those requirements.

amriksohata• 3 years ago

I read the title and thought that the legislation had gone through already! Might be worth tweaking

b800h12• 3 years ago

Good shout, I'll try to squeeze in something within the character limit.

mellosouls• 3 years ago

(Ask HN: List...)

b800h12• 3 years ago

Good point. Done.

b800h12• 3 years ago

Interestingly, if you run a BBS through the telephone system, you'll be immune, as the bill specifies "the Internet", but:

1. I think the lines have jitter now they're over IP anyhow.

2. Bit niche...

LeoPanthera• 3 years ago

Has anyone designed a modem to work over VOIP? It would have to cope with audio compression, jitter, dropouts, and so on.

On the other hand, it could assume much less noise than an analogue phone line.

ozfive• 3 years ago

This guy has a tutorial on running modems over VoIP.

https://area-51.blog/2021/01/16/getting-a-dial-up-modem-work...

bityard2• 3 years ago

Sure, it could be made to work, and it might even be able to keep up with your reading speed.

VoIP codecs are heavily optimized for human voice and have just a few kilobits of bandwidth. The analog phone network, before it went entirely digital, had a much higher bandwidth which is why modems were able to reach 56kbps. Phone calls in the 1980s were often crystal clear, almost on par with a broadcast radio station. Cell phones today along with VoIP are a muddy unintelligible mess in comparison.

timthorn• 3 years ago

Yes, making fax machines work over VoIP was important in the early days. The G.711 codec was designed to support endpoints that needed a full 64kbps datapath.

patmcc• 3 years ago

This is a hilarious idea, I love it. Internet Protocol over Voice over Internet Protocol.

Call it IPOVOIP.

darkclouds3• 3 years ago

you'll be immune, as the bill specifies "the Internet"

UK POTS is switching over to an IP based network, so does the bill specify the internet or ip based network?

If you submit a GDPR to your local constabulary, every phone call in the UK has a unique call identify much like a GUID now. Its quite insightful seeing just how much info is given out regarding the phone system capabilities via GDPR requests.

b800h12• 3 years ago

It specifies "the Internet" and doesn't seem to define the term.

pacifika• 3 years ago

This might be useful from June, can’t vouch for correctness.

https://www.taylorwessing.com/en/interface/2022/the-online-s...

b800h12• 3 years ago

Very useful, thanks.

darkclouds3• 3 years ago

My TLDR of that law firms info which could be a wrongful interpretation, in priority or execution order.

Any Non Specified Entity uploading any data which could be accessed by another Non Specified Entity with or without public access is bound by this bill.

Can be used or accessed from the UK. This might be the UK expanding beyond its borders here, because its a given if it not geo restricted it it could be used in the UK. VPN's/Tor may not be able to offer privacy from the state which is my opinion anyway.

Applies to all services with a "significant" number of UK users. No definition of significant so dont know if this is the same use of the word significant found in medical studies or not.

Definition of search engine is a service which can search more than one website or database.

Largest players now have a legal duty to prevent paid-for fraudulent adverts on their service and other regulated content.

Clarification on identifying the users of the service, ie profile pics and other identifying data.

Exempt specified entities:

--------------------------

Software like antivirus, antispam cloud/online submissions where said data is never likely to be used for communication purposes but might be analysed to improve the performance of said software function, ie reverse engineering stuxnet, latest spam techniques.

Published Content with commenting for the content, ie online newspaper comments. Posting a link, with or with comments, including like, dislike buttons and emojis of Published Content to another Non Specified Entity.

SMS & MMS messaging.

Services solely used for specific tasks like education, childcare and possibly health care.

One to One Aural (realtime speech and sound only guessing telephone) communication with identifying data allowed with no additional data communication functionality like visuals, text messaging. No mention of recording said Aural data.

Any public body carrying out their public duty.

Any internal business resource or tool, like company message boards, company chat facility's in all forms. No mention of recording data, would assume business includes official organisations like charities, but not clear.

No mention of private paid for programming language groups which can be accessed using a password of sorts and costs

Case by case reviews and changes made by the secretary of state so the exemption list will probably grow.

So my opinion on the above is if you are a big (US) tech service, you can self regulate, but little users will be watched by the UK state as no one can be trusted. Other laws apply where applicable.

austin-cheney• 3 years ago

Why isn't VPN to an out of country relay a solution?

At any rate situations like these are what partially motivated me to write something like this: https://github.com/prettydiff/share-file-systems/blob/master...

rovr1382• 3 years ago

Costs would be one. That’s yet another cost you have to take on.

OJFord• 3 years ago

I assume:

1) we're talking about the legal situation, not what would be physically possible;

2) that it applies to citizens, not server location (otherwise affected companies wouldn't be saying they'll exit the UK market, they'd just serve UK users from a further away but friendlier 'edge')

tm2t2• 3 years ago

I don't think it would be legal either since VPNs require encryption, too. Maybe some kind of proxy?

b800h12• 3 years ago

It's important to distinguish this from the encryption provisions of the bill. This part of the bill is distinct and means that social sites will need to verify ages of users and fill in lots of forms while they're at it.

yuumei• 3 years ago

Because of cloud flare and the like. If you have spent any time on a VPN you know the issues with captchas destroying the internet

ChrisKnott5• 3 years ago

My understanding is that the OSB creates a responsibility for Ofcom to create a regulatory system for discouraging online harms.

Has Ofcom actually said what these regulations will be?

Is there any reason to expect them to be as dystopian as you predict? The interim codes of practice that the government published don't even apply at all to individuals. They also acknowledge that smaller companies should not be expected to be subject to the same level of regulation as large companies.

My experience with online activists' predictions of imminent dystopia is that they generally turn out to be extremely overblown. Hopefully that's true this time as well.

b800h12• 3 years ago

The bill itself doesn't appear to exempt anyone. From Taylor Wessing:

"[following amendments] The OSB continues to apply to any service that enables content generated, uploaded or shared by one user to be encountered by another user (user-to-user services) or that allows users to search more than one website or database (search services)."

ChrisKnott5• 3 years ago

It actual exempts several categories (email servers etc).

My point is that there is no reason to think the regulations that eventually come into force for services which aren't exempted will be as ridiculous as you suggest.

I agree that the OSB gives Ofcom the power to regulate Minecraft servers, but those regulations must be reasonable and proportionate so I don't believe that it will affect a private individual running a private server, as you appeared to suggest.

rovr1382• 3 years ago

My experience with online activists' predictions of imminent dystopia is that they generally turn out to be extremely overblown.

The questions in my opinion then become,

Is it the law preventing these? Is it some people not yet seeing why they should do it? Are they purposefully not doing it initially to calm people?

If they don’t want to be able to do it, it could be rephrased.

ChrisKnott5• 3 years ago

By way of analogy, the government might make a law that allows, in secondary legislation, the setting of a driving speed limit.

These activists are claiming that the government is secretly intending the speed limit to be 1mph. The government are trying to ban driving!! The activists are demanding the enabling legislation be amended so that the speed limit, when set, must be no lower than Xmph.

But all this does is force all regulation to be done in primary legislation.

The debate about what the regulations should be is separate to there being a regulatory system at all.

It is right that the primary legislation just lays out in broad terms that the regulations must be "reasonable" and "proportionate" etc because it's only real purpose is to allow those regulations to be challenged in court in future.

cjs_ac9• 3 years ago

If you operate an online service, you don't have any actual obligations under the Online Safety Bill until Ofcom taps you on the shoulder. Considering that Ofcom is also responsible for regulating ISPs, all broadcast media, the EM spectrum, the telephone network and the Royal Mail, I don't think they'll have the resources to go after anyone but the social media giants.

Silhouette2• 3 years ago

Is there any reason to expect them to be as dystopian as you predict?

Previous laws relating to policing and investigatory powers have been widely criticised by civil rights groups for their overreach and lack of effective oversight and safeguards. We now know that some of those laws have in fact been abused in ways the critics predicted.

Secondary legislation has been widely criticised when used as a vehicle for government ministers to make rules with statutory authority while bypassing the usual requirements for Parliamentary scrutiny and approval of new laws. Our Home Secretary is currently attempting to use secondary legislation to implement controversial immigration policies after essentially the same measures were already explicitly blocked by Parliament when they were put forward via primary legislation.

So yes - there are unfortunately plenty of precedents both for broad legal powers being abused and for secondary legislation being used to circumvent our normal democratic processes for scrutinising and approving controversial measures.

There also seems to be no good reason to assume that the regulator that would be given these new powers and responsibilities actually has the necessary resources or expertise to understand the issues and perform their new role properly.

None of this looks encouraging and for rules that could have a profound effect on (among other things) our personal safety and the democratic integrity of our country it seems fair to question whether passing a very broad law that delegates the implementation details to a regulator that may or may not be competent to regulate these areas is really a good idea.

ChrisKnott5• 3 years ago

"Previous laws relating to policing and investigatory powers have been widely criticised by civil rights groups for their overreach and lack of effective oversight and safeguards. We now know that some of those laws have in fact been abused in ways the critics predicted."

What are you referring to here?

SXX• 3 years ago

   > Is there any reason to expect them to be as dystopian as you predict?

Bill description on UK Parlament website:

https://www.parliament.uk/business/news/2022/april/have-your...

The Bill has five policy objectives:
to increase user safety online.
to preserve and enhance freedom of speech online.
to improve law enforcement’s ability to tackle illegal content online.
to improve users’ ability to keep themselves safe online.
to improve society’s understanding of the harm landscape.

I guess UK government has solved all the issues include salaries inflation and ever rising price of living so they can finally go "preserve and enhance" freedom of speech.

b800h12• 3 years ago

Should add MUDs, website guestbooks?

scandum• 3 years ago

MUDs are easily hosted abroad. Problem solved.

This reminds me of UK's 90% tax rate, which caused many multi-millionaires to leave the country.

getwiththeprog• 3 years ago

Could you please provide evidence of a 90% tax rate? I don't believe you.

ta86452• 3 years ago

Comment section on your personal blog?

jonatron2• 3 years ago

Exempt under "Schedule 1 — Exempt user-to-user and search services"

ta86452• 3 years ago

Is a comment section user-to-user, though? On its face, it seems more user-to-public, since it's not a private user-to-user transmission. If blog comment sections are exempt, it would seem Reddit is exempt too.

endigma• 3 years ago

Source code hosting; Gitea or Gitlab or Gogs etc all have UGC. The interesting part to me is I'm not sure how this helps the UK citizens who are using the internet be any safer, all you'd have to do is access the rest of the internet to circumvent this.

cjs_ac9• 3 years ago

While I'm not a supporter of the Online Safety Bill, I do find that the opprobrium that it has inspired is consistently hyperbolic.

The Online Safety Bill bans nothing. What it does do is create a regulatory framework for the Office for Communications (aka Ofcom, HM Government's regulator for the communications industry) to operate and enforce. The regulatory framework is based around risk assessments, and sets out specific risks (of the sort that most people would agree need to be minimised). Ofcom is empowered to decide that internet services are within scope, and then demand to see policies relating to ameliorating those risks within a service.

The regulatory framework does specify that end-to-end encryption is incompatible with the reduction of these risks. However, we do have to play the ball and not the person of unspecified gender here.

We are, after all, talking about the UK here. The phenomenon of 'those whom the law protects but does not bind, and those whom the law binds but does not protect' is still very much in effect here. This legislation has also been proposed by a government that responds to increasing crime (caused by insufficient police officers) by giving those police more powers (that they don't have the resources to exercise).

Ofcom has wide-ranging responsibilities: it regulates the press and broadcast media, it allocates EM spectrum bands, it regulates the telephone network, and regulates the Royal Mail. Like all organisations in the Home Civil Service, it is staffed by a core of 'generalists' with humanities degrees, assisted by a small cadre of 'specialists', who are put back in their cupboard once they've given their opinion.

What this all means is that the bill will only have the effects that the government has said it will in its press releases. Ofcom will go after the big social media companies and the likes of 4chan. Your Mastodon server or your Gitea server or your corner of the Tildeverse or whatever will never appear on their radar. Ofcom won't have the budget or the resources to go after individuals or small communities; they won't even know you exist.

In the UK, an energy bill or council tax bill is an important identity document, necessary for opening a bank account, because any time someone starts talking about identity cards, the readers of the Daily Telegraph start muttering about the Gestapo. Ofcom isn't going to audit your homelab for online harms.

GordonS• 3 years ago

It sounds like you're chiding others for complaining about the bill, and excusing this because the bill "only" enables mass surveillance and anti-privacy measures, rather than stipulating them. Might be I'm reading you wrong on this, but that's what I'm taking away.

What this all means is that the bill will only have the effects that the government has said it will in its press releases.

I don't really believe that for a second. Whenever sweeping powers are introduced, there is scope creep. Just look at how anti-terrorism laws have been abused. And it seems Apple and others don't believe it either.

cjs_ac9• 3 years ago

I am chiding people, not for complaining, but for misunderstanding the surrounding context. Legislation is only as powerful as those enforcing it.

And it seems Apple and others don't believe it either.

Yes, Apple, Google, Microsoft, Signal, Meta, and all the other big players else who has turned up to the committee hearings will have their activities curtailed. Individuals running Minecraft and Mastodon servers for their friends needn't worry.

golergka• 3 years ago

I don't agree with this comment, but I upvoted it because it brings a different perspective to HN, and therefore, improves the quality of discussion.

tailspin20192• 3 years ago

While I support some more measured analysis to counter the hyperbole, you're making some strong assertions about what this bill will and won't mean, and I don't think you can have any more certainty about these than those people who are assuming a far worse outcome.

Context matters, and given the context of where we are as a country at the moment, how trustworthy our current government has (not) turned out to be, and even where they are in the election cycle - currently heading for being out of office for a decade - not to mention them pushing to leave the European convention on human rights, I'm a lot more concerned about the potential dangers of this bill than I might have been in a different context.

Even if you're right and I'm wrong, this statement seems a bit naive! (with respect):

the bill will only have the effects that the government has said it will in its press releases.

Edit: I tend to put a lot of stock into analysis put out by the EFF [0]. I think they said it well here:

If it passes, the Online Safety Bill will be a huge step backwards for global privacy, and democracy itself. Requiring government-approved software in peoples’ messaging services is an awful precedent. If the Online Safety Bill becomes British law, the damage it causes won’t stop at the borders of the U.K.

[0] https://www.eff.org/deeplinks/2023/07/uk-government-very-clo...

cjs_ac9• 3 years ago

Perhaps I am being naive, and I will confess that I'm not entirely sure that the future will be as I predicted (but I'm not going to edit my initial comment, out of respect for those disagreeing with me).

But I will think this quote from one of the bill's most dogged critics is illustrative[0]:

... this Bill, whatever DCMS and its ministers may claim, is not a “fixing” Bill, one which has been designed to be constructive and positive in order to fix problems. It is a “getting” Bill, once which has been designed to be vindictive and negative in order to get specific companies. OnlyFans in this particular example, the usual suspects in others.
The second is that this Bill has been designed by people who are so out of touch that OnlyFans is their idea of the average small digital business.
And the third is that this Bill has been designed by people who are so out of touch that they think the harms issues raised by OnlyFans are the harms issues in the average small digital business.

As for your distrust of the government, my opinion on this comes from that same position. My complacency rests not on their goodwill (because I don't think they have any) but on their disinterest in actually understanding anything.

[0] https://webdevlaw.uk/2022/07/13/heres-why-your-project-is-in...

jrmg• 3 years ago

I’m reminded of the hyperbole - which I fell for - around the Regulation of Investigatory Powers act around the turn of the millennium.

It provides a legal mechanism for authorities to require that individuals disclose encryption keys for encrypted data that was legally obtained or intercepted (i.e. with a warrant) by those authorities, and there are penalties (jail time) for refusing to do so.

The worry at the time was that random data is indistinguishable from encrypted content, so there might be times when people are jailed when they don’t even have the keys because there’s no encrypted data - just random bytes! Or, what happens if you lose the keys?

The reality is that there’s a court system that ‘regulates’ all this. No-one is going to be jailed unless the courts find that they are not providing keys they really do have. Of course, in a conspiracy where the authorities and the courts are all colluding, they could jail people pretending that they knew they had the keys - but there are far easier ways for the authorities to do this than some elaborate scheme with fake encrypted data.

At the time I was fully convinced that it was a step down a slippery slope to authoritarianism. Really, it was just bringing the ‘virtual’ world into line with the physical one.

[I suspect there are a few here who were also around at the time and still believe it’s all a nefarious governmental plot - I’d ask them to show where, in the 23 years since it passed, harm - or suspicion of harm - has happened].

Now, maybe this is different. I certainly don’t want end to end encryption to be banned. But there’s a bit of a ‘cried wolf’ happening in my brain.

jl6• 3 years ago

An interesting RIP case here: https://www.bbc.co.uk/news/uk-england-11479831

A person received a 16 week prison sentence for not disclosing a password. In the context, it’s possible that had he disclosed the password, police would have discovered material that would have attracted a far more severe punishment.

So one might argue that the RIP was too weak, and failed to compel disclosure of the password (four months in jail is light in the circumstances).

hau• 3 years ago

Your Mastodon server or your Gitea server or your corner of the Tildeverse or whatever will never appear on their radar

Of course it will when your gitea or mastodon instance is in the right crosshair. Do we just surrender rights on a hope this time we can stay under the radar? If you are not a terrorist or a pedophile you have nothing to worry etc. When you disagree enough you will become a terrorist. That's the reality in my country because it works an have worked for centuries.

Ofcom won't have the budget or the resources to go after individuals or small communities; they won't even know you exist. Ofcom isn't going to audit your homelab for online harms.

Pinky promise?

cjs_ac9• 3 years ago

I've read the bill, and know what it stipulates. Of course, if you don't want to take my word for it, you can download the 302 pages of legislation and check it yourself: https://bills.parliament.uk/bills/3137

collaborative• 3 years ago

You seem to know more than me. I host a fringe e2ee messaging system in the UK that I run under under an LTD. Am I affected?

cjs_ac9• 3 years ago

Disclaimer: I'm not a lawyer, just someone who read the bill a couple of months ago because I was checking to see whether the idea I have in the back of my head for a social media platform was still viable. Heather Burns[0] is an actual lawyer who's a leading authority on this.

The basic principle is that what people do online can have negative consequences in the real world, and the bill basically holds online service operators (such as yourself) at least partially responsible for those negative consequences. Operators need to demonstrate that they're mitigating those consequences risk assessments and policies.

Judging by your profile, you're offering e2ee to family groups, so your intended users are low-risk for sending harmful content. However, your service is freely available to anyone with the app, so it could potentially be used by terrorist organisations, gangs or CSAM sharing groups. e2ee services like this are pretty much the only service that is outright incompatible with the requirements of the bill, so I think you'll be in trouble as soon as Ofcom comes knocking, if they do so. I think the chance of them doing so is small, but that's just my personal opinion, and you will have to make your own decisions.

The family tree and calendar features look like they're low risk, and could be adequately covered by risk assessments, but the file and photo sharing features are also problematic, because (I think) they're encrypted.

You're very unfortunate to be at the intersection of the three factors that could make Ofcom care about you:

* service freely available to the public; * arbitrary user-to-user communication; and * no means of checking for harmful conduct on your service.

The only way forward that I can see for you is to make the backend a selfhost-only affair, which would make your UK-based users responsible under the bill.

[0] https://webdevlaw.uk/about/

ThrustVectoring• 3 years ago

Of course the government is going to enforce only a fraction of the offenses it creates. This is nearly always the case, and is mostly irrelevant to a law's actual effectiveness. That is derived from a combination of targeting the highest-profile offenders and the law acting as a press release as to the government's enforcement priorities.

Like, imagine you're running a team developing an end-to-end encrypted application in Britain, and you're seeking funding. The potential investors are going to ask what your plan is to not get owned by this bill, you won't have a good answer outside of "hope they don't notice us", and they won't invest. This happens merely because the British government publicized the Online Safety Bill, and exactly zero enforcement effort was required to stifle the funding, development, and subsequent use of this hypothetical application.

Anyhow, the short of my point is that government laws have a ton of power to shape behavior outside of prosecuting people, and sensible risk-management shapes the behavior of non-government bureaucrats and decisionmakers.

DoItToMe81• 3 years ago

The UK arrests more people annually for harmless internet activity than any other nation. It does affect them, as its only a matter of time before they actively hunt you down for 'causing psychological harm' over innocent comments.

pmlnr• 3 years ago

One scenario is that Whatsapp and Apple leave the UK market, another is that nobody going to do anything about the "law", which is rubbery enough to be ignored. I'm quite curious how it's going to go down.

osigurdson3• 3 years ago

Certainly the online activities that the bill is meant to address will still continue. Criminals don’t care about following the law unfortunately.

IshKebab2• 3 years ago

While I think this law is bonkers, "then only criminals will have guns" style arguments are terrible counterpoints.

They depend on a 5 year old's view of the world where there are "good guys" and "bad guys" and nobody is a bit in-between. They also use the same oversimplification that economists are famous for - that everyone has perfect information, acts completely rationally, has infinite motivation, etc. etc.

In the real world, criminality is a spectrum and difficulty is a real thing.

pas• 3 years ago

offtopic: economists use these models in places where even these oversimplified ones work pretty well

and usually the issues with results are not because information asymmetry

osigurdson3• 3 years ago

I think the 5 year old’s bimodal criminality distribution is likely more accurate than your posited normal one - unless the spectrum you refer to includes parking tickets, and bylaw infractions.

intunderflow2• 3 years ago

Does it matter? The UK can't enforce anything outside its borders. Just putting another nail in the coffin of UK tech startups that aren't in Financial Services.

b800h12• 3 years ago

It matters if you're in the UK and you're a tech hobbyist.

intunderflow2• 3 years ago

In my opinion the UK has always been against that group and others who stick out, and that's not going to change in the future.

Unfortunately if you're a tech hobbyist in the UK your best option is to leave, especially if you're any good with technology. There are plenty of other countries that will treat you far better than the UK ever would.

KomoD• 3 years ago

you become a private service provider, and then have a host of responsibilities including annual audits of whether a significant proportion of your users are minors. If they are then you need to use a (commercial?) age verification tool and monitor everything assiduously. Difficult to see most people being able to satisfy those requirements.

And then I just block the UK instead, let's hope this just doesn't go through.

justinclift• 3 years ago

"Use Signal" seems like it won't be possible any more.

Ask HN: Online activities to be made impossible by the UK Online Safety Bill

Related Stories