Returning from their summer recess, United Kingdom politicians are poised to enact a deeply misguided and flawed law that will make the internet less safe for everyone on Earth—and the United States and European Union aren’t far behind.
The House of Lords this summer squandered a key opportunity to amend the Online Safety Bill)" href="https://urldefense.com/v3/__https://bills.parliament.uk/bills/3137__;!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkhxPRpCEw$">Online Safety Bill —truly a misnomer for the ages—so that it won’t erode vital protections for all digital communications. Amendments could still be offered until Sept. 6, but this seems less likely with each passing hour.
U.K. government officials, for years, have voiced concerns that online services don’t do enough to tackle illegal content, particularly child sexual abuse material. The “solution” was the Online Safety Bill, ostensibly seeking to make the U.K. the world’s safest place to use the internet.
ADVERTISEMENT
But the bill in its current form would achieve the opposite—by requiring websites and apps to proactively prevent harmful content from appearing on messaging services. That necessarily must lead to universal scanning of all user content: All users’ text messages, images, and videos would be checked and monitored before being posted.
It’s a 21st-century form of prior restraint)" href="https://urldefense.com/v3/__https://www.openrightsgroup.org/app/uploads/2023/04/HOL-Briefing-OSB-illegal-content.pdf__;!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkg2vo-gog$">21st-century form of prior restraint, violating the very essence of free speech. It’s a death knell for end-to-end encryption, and with it, every internet user’s right to privacy.
Private communication is a fundamental human right, and in the online world, the best tool we have to defend this right is end-to-end encryption. It ensures that governments, tech companies, social media platforms, and other groups cannot view or access our private messages, the pictures we share with family and friends, or our bank account details. This is a particularly vital protection for the most vulnerable in society, such as children seeking relief from abuse or human rights defenders working in hostile environments.
Civil society organizations)" href="https://urldefense.com/v3/__https://www.apc.org/en/pubs/online-safety-bill-civil-society-organisations-urge-uk-protect-global-digital-security-and__;!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkg6k7OhXw$">Civil society organizations, security experts)" href="https://urldefense.com/v3/__https://www.openrightsgroup.org/publications/open-letter-protect-encrypted-messaging/__;!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkjdH2s6pw$">security experts, and tech companies)" href="https://urldefense.com/v3/__https://wire.com/en/blog/open-letter-to-the-british-government-on-the-online-safety-bill/__;!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkjHFD-Oxg$">tech companies have clearly and unequivocally asked for this bill’s anti-encryption sections to be withdrawn; Apple in June)" href="https://urldefense.com/v3/__https://www.bbc.com/news/technology-66028773__;!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkj4YHFKnQ$">in June joined the chorus of voices warning that the bill “could put U.K. citizens at greater risk.” Secure communications providers, including Signal)" href="https://urldefense.com/v3/__https://www.bbc.com/news/technology-64584001__;!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkjMb2f-9A$">Signal and WhatsApp)" href="https://urldefense.com/v3/__https://www.theverge.com/2023/3/10/23633601/uk-online-safety-bill-encryption-whatsapp-leave__;!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkjJoSlWgA$">WhatsApp, have said they will halt all U.K. service if the law is passed as written.
The consensus is that there’s no backdoor to encryption that won’t be exploited by bad actors such as cyber criminals, rogue employees, domestic abusers, and authoritarian governments.
“But think of the children!” the bill’s supporters might exclaim.
Yes, indeed, let’s think of the children: This bill badly erodes their rights to privacy, agency, and safety.
Children, like adults, rely on encrypted communication apps like WhatsApp or Signal, and have legitimate expectations to not be subjected)" href="https://urldefense.com/v3/__https://tbinternet.ohchr.org/_layouts/15/treatybodyexternal/Download.aspx?symbolno=CRC*2FC*2FGC*20*2F25&Lang=en__;JSUlJQ!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkj2LQXJhQ$">subjected to mandatory identity verification, arbitrary filtering, and surveillance. More specifically, abused children need private and secure channels to report what is happening to them. Yet the bill, while intending to protect children, fails to respect their privacy and disregards internationally recognized principles on children's rights.
Make no mistake, this awful bill won’t just affect the U.K.—it will be a blueprint for repression around the world. The bill’s defenders are quick to highlight the worst content that exists online, like pro-terrorism posts and child abuse material, but the surveillance clearly won’t end there. Companies will be pushed to monitor wider categories of content, and to share information about users between jurisdictions. Journalists and human rights workers inevitably will become targets. And users will never be certain of whether their private messages are being read and intercepted by private companies.
Yet Parliament has taken no heed. Worse yet, the U.K. is not alone in this effort: Unable to build public support for the idea of police scanning every digital message, lawmakers in other liberal democracies also have turned to work-arounds, claiming encryption backdoors are needed to inspect files for the worst crimes. They’ve claimed falsely that certain methods of inspecting user files and messages, like client-side scanning, don’t break encryption at all.
In the United States, it’s the EARN IT Act)" href="https://urldefense.com/v3/__https://www.congress.gov/bill/118th-congress/senate-bill/1207__;!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkjKn_04aw$">EARN IT Act; in the European Union, it’s the draft Regulation to Prevent and Combat Child Sex Abuse.)" href="https://urldefense.com/v3/__https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM*3A2022*3A209*3AFIN__;JSUl!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkgB2JewvQ$">Regulation to Prevent and Combat Child Sex Abuse. Government agencies also tried—and, thank goodness, failed—to pressure Apple into adopting a system of software scanners on every device)" href="https://urldefense.com/v3/__https://www.wired.com/story/apple-photo-scanning-csam-communication-safety-messages/__;!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkgfBRO2WQ$">software scanners on every device, constantly checking for child abuse images and reporting back to authorities.
Signal president Meredith Whittaker put it succinctly)" href="https://urldefense.com/v3/__https://www.bbc.com/news/technology-64584001__;!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkjMb2f-9A$">put it succinctly: “Encryption is either protecting everyone or it is broken for everyone."
There is no middle ground, no “safe backdoor” if the internet is to remain free and private. It may now be too late to stop the Online Safety Bill—to which the only solution now might be litigation—but its still-nascent American and European counterparts must be either substantially reworked or abandoned entirely.
Paige Collings is Senior Speech and Privacy Activist at the Electronic Frontier Foundation)" href="https://urldefense.com/v3/__https://www.eff.org/__;!!LsXw!QbCuMzAWgtMvrGq9s_naBFiUFtF4t_wRPzCNabU1YvgSd40et1_WS5EskTmtKoAohtJBFpAOVbsGunGDQkiUi9hLkg$">Electronic Frontier Foundation, a nonprofit digital civil liberties organization headquartered in San Francisco.
