UK Internet Censorship

The government is pushing forward with an internet censorship bill which will punish people and companies for getting it wrong without the expense and trouble of tying to dictate rules on what is allowed.

In an interesting development the Times is reporting that the government want to introduce a "senior management liability", under which executives could be held personally responsible for breaches of standards. US tech giants would be required to appoint a British-based director, who would be accountable for any breaches of the censorship rules.

It seems a little unjust to prosecute a token fall guy who is likely to have absolutely no say in the day to day decisions made by a foreign company. Still it should be a very well paid job which hopefully includes lots of coverage for legal bills and a zero notice period allowing instant resignation at the first hint of trouble.

The Government has reiterated its plans as outlined in the Online Harms white paper. It seems that the measures have been advanced somewhat as previous references to pre-legislative scrutiny have been deleted.

The Queens Speech briefing paper details the government's legislative plan for the next two years:

Online Harms

“My ministers will develop legislation to improve internet safety for all.”

• Britain is leading the world in developing a comprehensive regulatory regime to keep people safe online, protect children and other vulnerable users and ensure that there are no safe spaces for terrorists online.

• The April 2019 Online Harms White Paper set out the Government’s plan for world-leading legislation to make the UK the safest place in the world to be online. The Government will continue work to develop this legislation, alongside ensuring that the UK remains one of the best places in the world for technology companies to operate.

• The proposals, as set out in the White Paper were:

  ○ A new duty of care on companies towards their users, with an independent regulator to oversee this framework.
  ○ The Government want to keep people safe online, but we want to do this in a proportionate way, ensuring that freedom of expression is upheld and promoted online, and that the value of a free and ndependent press is preserved.
  ○ The Government is seeking to do this by ensuring that companies have the right processes and systems in place to fulfil their obligations,
  rather than penalising them for individual instances of unacceptable content.
   

• The public consultation on this has closed and the Government is analysing the responses and considering the issues raised. The Government is working
  closely with a variety of stakeholders, including technology companies and civil society groups, to understand their views.

• The Government will prepare legislation to implement the final policy in response to the consultation.

• Ahead of this legislation, the Government will publish interim codes of practice on tackling the use of the internet by terrorists and those engaged in child
  sexual abuse and exploitation. This will ensure companies take action now to tackle content that threatens our national security and the physical safety of
  children.

• The Government will publish a media literacy strategy to empower users to stay safe online.

• The Government will help start-ups and businesses to embed safety from the earliest stages of developing or updating their products and services, by publishing a Safety by Design framework.

• The Government will carry out a review of the Gambling Act, with a particular focus on tackling issues around online loot boxes and credit card misuse.

• What the Government has done so far:
   

  • The joint DCMS-Home Office Online Harms White Paper was published in April 2019. The Government also published the Social Media Code of Practice, setting out the actions that social media platforms should take to prevent bullying, insulting, intimidating and humiliating behaviours on their sites.

  • In November 2018 the Government established a new UK Council for Internet Safety. This expanded the scope of the UK Council for Child Internet Safety, and was guided by the Government's Internet Safety Strategy.

  • The UK has been championing international action on online safety. The Prime Minister used his speech at the United Nations General Assembly to champion the UK's work on online safety.

The Information Commissions Office (ICO) earlier in the year presented draft internet censorship laws targeted at the commendable aim of protecting the personal data of younger website users. These rules are legally enforceable under the EU GDPR and are collectively known as The Age Appropriate Design Code.

The ICO originally proposed that website designers should consider several age ranges of their users. The youngest users should be presented with no opportunity to reveal their personal data and then the websites could relent a little on the strictness of the rules as they get older. It all sounds good at first read... until one considers exactly how to know how old users are.

And of course ICO proposed age verification (AV) to prove that people are old enough for the tier of data protection being applied.

ISO did not think very hard about the bizarre contradiction that AV requires people to hand over enough data to give identity thieves an orgasm. So the ICO were going to ask people to hand over their most sensitive ID to any websites that ask... in the name of the better protection of the data that they have just handed over anyway.

The draft rules were ridiculous, requiring even a small innocent site with a shopping trolley to require AV before allowing people to type in their details in the shopping trolley.

Well the internet industry strongly pointed out the impracticality of the ICO's nonsense ideas. And indeed the ICO released a blog and made a few comments that suggest it would be scaling back on its universal AV requirements.

The final censorship were delivered to the government on schedule on 23rd November 2019.

The industry is surely very keen to know if the ICO has retreated on its stance, but the ICO has now just announced that the publication date will be delayed until the next government is in place. It sounds that their ideas may still be a little controversial, and they need to hide behind a government minister before announcing the new rules.

More than £2m of taxpayers' money was spent preparing for the age verification for porn censorship regime before the policy was dropped in early October, the government has revealed.

The bulk of the spending, £2.2m, was paid to the BBFC to do the detailed work on the policy from 2016 onwards. Before then, additional costs were borne by the Department for Digital, Culture, Media and Sport, where civil servants were tasked with developing the proposals as part of their normal work.

Answering a written question fromthe shadow DCMS secretary, Tom Watson, Matt Warman for the government added: Building on that work, we are now establishing how the objectives of part three of the Digital Economy Act can be delivered through our online harms regime.

It is not just government funds that were wasted on the abortive scheme. Multiple private companies had developed systems that they were hoping to provide age verification services.

The bizarre thing was all this money was spent when the government knew that it wouldn't even prevent determined viewers from getting access to porn. It was only was only considered as effective from blocking kids from stumbling on porn.

So all that expense, and all that potential danger for adults stupidly submitting to age verification, and all for what?

Well at least next time round the  government may consider that they should put a least a modicum of thought about people's privacy.

It's not ALL about the kids. Surely the government has a duty of care for adults too. We need a Government Harms bill requiring a duty of care for ALL citizens. Now that would be a first!

The focus of Age Verification has been on the censorship of general porn websites since the Digital Economy Act was passed in April 2017. However there is a smaller subset of adult Video on Demand websites that have been under the cosh, under the auspices of the EU's Audio Visual Media Services directive, since several years earlier. 

Don't ask what's difference between a general porn website and a Video on Demand website subjected to AVMS Rules. The EU law governing this is pitiful and it is impossible to determine this difference from the law as written. ATVOD, the first official porn censor to have addressed this issue, must have wasted thousands of pounds trying to refine the laws into something that may make sense to the business affected. They failed, and so then Ofcom wasted thousands more arbitrating on this impossible task and writing some incredibly long explanations to justify their decisions.

Peter Johnson was the chief censor at ATVOD and he put in motion the morality campaign against porn in the name of age verification. He put in place onerous rules, requiring strict age verification for access to porn. The rub was that the rules only applied to British business, and this effectively put an end to the British adult internet trade. UK companies simply could not compete with overseas websites that are free and open to access. Nearly all British businesses had to either close, move their operations abroad, or sell out to foreign companies.

For example Simply Broadband was very successful up and coming business that could have become a major competitor with its knowledge of British pron favourites. The company was promptly sold abroad. Another major loss was the European branch of Playboy TV that operated from the UK at the time. The company simply moved somewhere else.

Eventually Ofcom saw where this was going, Ofcom sacked ATVOD and took on the censorship role itself. A few small niche websites were saved, but the vast majority of the UK business had already been lost to foreign interests.

And of course no kids were being protected by the AVMS rules. Foreign tube sites rules the roost, and if anything they gained from British competitors being snuffed out.

Presumably it was this observation that led to the introduction of porn censorship via age verification in the Digital Economy Act. This time round the Age Verification would also apply to foreign companies.

Recalling that there still a few British businesses that are still subject to age verification requirements via Ofcom's AVMS regime, Ofcom decided that it needed to update the AVMS rules to reflect the changes expected through the Digital Economy Act. Ofcom more or less proposed to adopt the DEA rules into its own codes. Ofcom launched a public consultation in September 2018 to square away its proposed rules with the remnants of the British adult trade.

In fact, rather confirming the mass extinction of British business, only two VoD companies responded to the the consultation. Portland TV (who run the softcore Television X channel) and Virgin Media who runs a Video on Demand service which includes a few 18 rated softcore porn films.

In fact Virgin Media was pretty miffed that the new rules meant that 18 rated porn material had to be brought into the age verification regime. In particular it noted that it was not easy for set top boxes to be adapted for age verification, not to mention the fact that customers electing to use such boxes were probably not those most computer literate types who would be happy to mess round with apps to get their age verified.

Ofcom decided to more or less rewrite the AVMS rules to reflect the BBFC censorship regime, and the updated rules are given below. However thankfully Ofcom made it clear that the rules would not come into force until the Digital Economy Act rules came into force. So presumably these updated rules are now also canned.

So the few remaining British porn companies can heave a sigh of relief, at least until the next moral panic, maybe the Information Commissioner's Age Appropriate Design rules to be announced towards the end of next month (November 2019).

Ofcom's censorship proposed rules for British Video on Demand services

Rule 11: Harmful Material: Protection of Under-18s (Specially Restricted Material)

An ODPS must not contain any specially restricted material unless the material is made available in a manner which secures that persons under the age of 18 will not normally see or hear it.

“Specially restricted material” means—

(a) a video work in respect of which the video works authority has issued a R18 classification certificate;
(b) material whose nature is such that it is reasonable to expect that, if the material were contained in a video work submitted to the video works authority for a classification certificate, the video works authority would issue a R18 classification certificate; or
(c) other material that might seriously impair the physical, mental or moral
development of persons under the age of 18;
(d) a video work—

• (i) in respect of which the video works authority has issued an 18 certificate, and

• (ii) whose nature is such that it is reasonable to assume that its principal purpose is to cause sexual arousal, or

(e) material whose nature is such that it is reasonable—

• (i) to assume that its principal purpose is to cause sexual arousal, and

• (ii) to expect that, if the material were contained in a video work submitted to the video works authority for a classification certificate, the video works authority would issue an 18 certificate.

In determining whether any material falls within (b) or (e), regard must be had to any guidelines issued by the video works authority as to its policy in relation to the issue of classification certificates.

Guidance on ‘Specially restricted material’:

In considering any particular case, Ofcom’s approach in the first instance will be to determine whether the content in question falls within the definition of ‘specially restricted material’.

Content which complies with the Ofcom Broadcasting Code, or that has been classified by the British Board of Film Classification (BBFC) in any category except ‘R18’ or as a ‘sex work’ at ‘18’, would not normally be considered as material that “might seriously impair” and would not normally be subject to the requirements of Rule 11.

R18 and R18-equivalent material, sex works at 18 and material equivalent to sex works at 18, and any other material which might seriously impair under 18s is subject to the requirements of Rule 11. All ‘material’ in the ODPS, including still images and other non-video content is subject to this requirement.

By ‘sex works’ we mean works whose primary purpose is sexual arousal or stimulation. Sex works at ‘18’ includes sex works that contain only sexual material which may be simulated. The R18 certificate is primarily for explicit works of consenting sex (including non-simulated sexual activity) or strong fetish material involving adults.

The R18 certificate and the 18 certificate are issued by the British Board of Film Classification in respect of video works being supplied on a physical video recording such as a DVD. There is no requirement for material being provided on an ODPS to be classified by the BBFC, but Ofcom must have regard to the BBFC Classification Guidelines when determining whether material on an ODPS is R18-equivalent (i.e. if it was contained in a video work submitted for classification it is reasonable to assume that the BBFC would issue an R18 certificate). Ofcom must also have regard to the BBFC Classification Guidelines when determining whether material on an ODPS is equivalent to sex work material at 18 (i.e. it is reasonable to assume that its principal purpose is to cause sexual arousal and if it was contained in a video work for classification the BBFC would issue an 18 certificate).

For more information on the R18 certificate and the 18 certificate for sex works, and the type of content likely to be awarded  these certificates, see the British Board of Film Classification’s website: www.bbfc.co.uk .

We note that the BBFC has regulatory duties to assess whether ‘pornographic material’ is not normally accessible by under 18s on online commercial services available in the UK (excluding the ODPS regulated by Ofcom). In outline, ‘pornographic material’ includes both R18 equivalent material, and 18-equivalent material with a principal purpose of sexual arousal. In assessing whether content falls within the definition of ‘specially restricted material’ under Rule 11, Ofcom will have regard to any advice issued by the BBFC on its approach to assessing whether content is ‘pornographic material’, including advice on what content can be displayed without age-verification.

Guidance on Age Verification:

Provided the material is not illegal or otherwise prohibited (see Rule 14), content which Ofcom considers to fall under this Rule (i.e. ‘specially restricted material’) may be made available on an ODPS, provided access is controlled in a manner which secures that people aged under eighteen ‘will not normally see or hear’ such material.

In assessing age-verification arrangements under Rule 11, Ofcom will follow the BBFC’s principle-based approach for assessing the compliance of age-verification solutions on online commercial services available in the UK. Ofcom recognises that the BBFC’s principles were designed in relation to online services, and that age-verification solutions on ODPS in practice may vary across different platforms. However, the same principles apply on ODPS regardless of the platform on which the service is delivered.

The criteria against which Ofcom will assess whether an age-verification solution secures that ‘specially restricted material’ is not normally seen or heard by those under 18 are set out below:

• a. An effective control mechanism at the point of registration or access to the specially restricted material by the end-user which verifies that the user is aged 18 or over at the point of registration or access

• a. [note repeated (a) is in original document] Use of age-verification data that cannot be reasonably known by another person, without theft or fraudulent use of data or identification documents or be readily obtained or predicted by another person

• b. A requirement that either a user age-verify each visit or access is restricted by controls, manual or electronic, such as, but not limited to, password or personal identification numbers. A consumer must be logged out by default unless they positively opt-in for their log in information to be remembered

• c. The inclusion of measures which authenticate age-verification data and measures which are effective at preventing use by non-human operators including algorithms

The following are features which Ofcom does not consider, in isolation, comply with the age-verification requirement under this Rule:

• a. relying solely on the user to confirm their age with no cross-checking of information, for example by using a 'tick box' system or requiring the user to only input their date of birth

• b. using a general disclaimer such as 'anyone using this website will be deemed to be over 18'

• c. accepting age-verification through the use of online payment methods which may not require a user to be over 18. (For example, Ofcom will not regard confirmation of ownership of a Debit, Solo or Electron card or any other card where the card holder is not required to be 18 or over to be verification that a user of a service is aged 18 or over.)

• d. checking against publicly available or otherwise easily known information such as name, address and date of birth

When considering the compliance of age-verification solutions with Rule 11, we will have regard to the BBFC’s assessments of age-verification used by online adult services to ensure compliance with the regulatory requirements, as published on its website.
Ofcom recommends that ODPS providers adopt good practice regarding data protection in the design and implementation of age-verification solutions. The Information Commissioner’s Office (ICO) is responsible for enforcing data protection legislation and providers should have regard to its guidance in this area.

Where they are required, age-verification solutions must be fit for purpose and effectively managed so as to ensure that people aged under eighteen will not normally see or hear specially restricted material. Ofcom will consider the adequacy and effectiveness of age-verification solutions on a case by case basis and keep them under review in the context of ODPS. Responsibility for ensuring that any required age-verification solution is in place and is operating effectively rests at all times with the person with editorial responsibility for the ODPS. The ‘Guidance on who needs to notify’ document explains how to determine the person with ‘editorial responsibility’ for the ODPS.

Nicky Morgan, Secretary of State for Digital, Culture, Media and Sport, issued a written statement cancelling the government's current plans to require age verification for porn. She wrote:

The government published the Online Harms White Paper in April this year. It proposed the establishment of a duty of care on companies to improve online safety, overseen by an independent regulator with strong enforcement powers to deal with non-compliance. Since the White Paper's publication, the government's proposals have continued to develop at pace. The government announced as part of the Queen's Speech that we will publish draft legislation for pre-legislative scrutiny. It is important that our policy aims and our overall policy on protecting children from online harms are developed coherently in view of these developments with the aim of bringing forward the most comprehensive approach possible to protecting children.

The government has concluded that this objective of coherence will be best achieved through our wider online harms proposals and, as a consequence, will not be commencing Part 3 of the Digital Economy Act 2017 concerning age verification for online pornography. The Digital Economy Act objectives will therefore be delivered through our proposed online harms regulatory regime. This course of action will give the regulator discretion on the most effective means for companies to meet their duty of care. As currently drafted, the Digital Economy Act does not cover social media platforms.

The government's commitment to protecting children online is unwavering. Adult content is too easily accessed online and more needs to be done to protect children from harm. We want to deliver the most comprehensive approach to keeping children safe online and recognised in the Online Harms White Paper the role that technology can play in keeping all users, particularly children, safe. We are committed to the UK becoming a world-leader in the development of online safety technology and to ensure companies of all sizes have access to, and adopt, innovative solutions to improve the safety of their users. This includes age verification tools and we expect them to continue to play a key role in protecting children online.

The BBFC sounded a bit miffed about losing the internet censor gig. The BBFC posted on its website:

The introduction of age-verification on pornographic websites in the UK is a necessary and important child protection measure. The BBFC was designated as the Age-verification Regulator under the Digital Economy Act 2017 (DEA) in February 2018, and has since worked on the implementation of age-verification, developing a robust standard of age-verification designed to stop children from stumbling across or accessing pornography online. The BBFC had all systems in place to undertake the role of AV Regulator, to ensure that all commercial pornographic websites accessible from the UK would have age gates in place or face swift enforcement action.

The BBFC understands the Government's decision, announced today, to implement age-verification as part of the broader online harms strategy. We will bring our expertise and work closely with government to ensure that the child protection goals of the DEA are achieved.

I don suppose we will ever hear the real reasons why the law was ditched, but I  suspect that there were serious problems with it. The amount of time and effort put into this, and the serious ramifications for the BBFC and age verification companies that must now be facing hard times must surely make this cancelling a big decision.

It is my guess that a very troublesome issue for the authorities is how both age verification and website blocking would have encouraged a significant number of people to work around government surveillance of the internet. It is probably more important to keep tabs on terrorists and child abusers rather than to lose this capability for the sake of a kids stumbling on porn.

Although the news of the cancellation was reported today, Rowland Manthorpe, a reporter for Sky News suggested on Twitter that maybe the idea had already been shelved back in the summer. He tweeted:

When @AJMartinSky and I  broke the news that the porn block was being delayed again, we reported that it was on hold indefinitely. It was. Then our story broke. Inside DCMS a sudden panic ensued. Quickly, they drafted a statement saying it was delayed for 6 months

The April 2019 Online Harms White Paper set out the Government's plan for world-leading legislation to make the UK the safest place in the world to be online.

The proposals, as set out in the White Paper were:

• A new duty of care on companies towards their users, with an independent regulator to oversee this framework.

• We want to keep people safe online, but we want to do this in a proportionate way, ensuring that freedom of expression is upheld and promoted online, and businesses do not face undue burdens.

• We are seeking to do this by ensuring that companies have the right processes and systems in place to fulfil their obligations, rather than penalising them for individual instances of unacceptable content.

• Our public consultation on this has closed and we are analysing the responses and considering the issues raised. We are working closely with a variety of stakeholders, including technology companies and civil society groups, to understand their views.

We are seeking to do this by ensuring that companies have the right processes and systems in place to fulfil their obligations, rather than penalising them for individual instances of unacceptable content.

Our public consultation on this has closed and we are analysing the responses and considering the issues raised. We are working closely with a variety of stakeholders, including technology companies and civil society groups, to understand their views.

Next steps:

• We will publish draft legislation for pre-legislative scrutiny.

• Ahead of this legislation, the Government will publish work on tackling the use of the internet by terrorists and those engaged in child sexual abuse and exploitation, to ensure companies take action now to tackle content that threatens our national security and the physical safety of children.

• We are also taking forward additional measures, including a media literacy strategy, to empower users to stay safe online. A Safety by Design framework will help start-ups and small businesses to embed safety during the development or update of their products and services.

David Austin, CEO of the BBFC, has been named in Business Insider's UK Top Tech 100 for the BBFC's work on age-verification under the Digital Economy Act.

Every year, Business Insider publishes the UK Tech 100 204 a list of the 100 most interesting, innovative, and influential people shaping the UK tech scene. David Austin is a new entry, and enters the list at number 96.

David Austin said:

I'm very pleased to be included in the UK tech 100 on behalf of the BBFC. It's recognition of the innovation that the BBFC brings to developing regulatory solutions to help families and protect children in the online space.

Under the Digital Economy Act 2017, all online commercial pornography services accessible from the UK will be required to carry age-verification controls to prevent children from seeing content that isn't appropriate for them. Nor may they carry extreme pornography. These services mainly take the form of websites and apps.

The UK Government appointed the BBFC as the Age-verification Regulator because of the BBFC's expertise in regulating pornography; its understanding of age verification; and knowledge of online regulation.

House of Commons, 3rd October 2019.

The Secretary of State for Digital, Culture, Media and Sport (Nicky Morgan):

THon. Members will be aware of our ongoing work to keep people safe online and our proposals around age verification for online pornography. I  wish to notify the House that the standstill period under the EU's technical services and regulations directive expired at midnight last night. I  understand the interest in this issue that exists in all parts of the House, and I  will update the House on next steps in due course.