> What this all means is that the bill will only have the effects that the government has said it will in its press releases.
I don't really believe that for a second. Whenever sweeping powers are introduced, there is scope creep. Just look at how anti-terrorism laws have been abused. And it seems Apple and others don't believe it either.
> And it seems Apple and others don't believe it either.
Yes, Apple, Google, Microsoft, Signal, Meta, and all the other big players else who has turned up to the committee hearings will have their activities curtailed. Individuals running Minecraft and Mastodon servers for their friends needn't worry.
Because they're too insignificant to matter, or because they won't be covered by the law? It sounds like the former, but you seem to imply the latter.
Maybe it is me, who has already lived under a very similar set of laws and know that corporations are always the least hit by such laws. These are instruments that infringe on basic individual rights such as right to privacy. These instruments create systemic significant incentives to corruption, totalitarianism, (corporate and international) espionage, and so on.
Rights groups, activists, whistle-blowers, prosecuted or rather marginalised minorities, and other legitimate groups and individuals are going to be impacted by this.
Underplaying this is incredibly naïve and downright dangerous.
Good lord! That's the same logic one may employ as a criminal, say.. an inside trader!
Well of course you won't get nabbed, if they don't know!
So as soon as you do anything interesting, protest, stand up for a right, displease a cop, upset the wrong neighbour, you'll be noticed, eh?
What a great law!
Congrats, you made my neighbours wonder why I'm yelling at myself(seemingly) again.
"Poor bbarnett, yelling in his empty house again, wonder when they'll take him away Marge?"
This is a rather incredible mindset to have, IMO. Even for me who doesn't quite subscribe to the constant Big Brother panic.
This law gives the government a huge loaded gun that they can use to blast pretty much anyone they please with. But no worries, they aren't going to use it on you because you are too unimportant?
And that still completely ignores the various collateral damages - such as if encryption is effectively outlawed because the regulatory hurdles associated with it are simply too high to bother with (just look at how many US websites rather block access from the EU instead of having to deal with GDPR compliance), then even if you aren't a target for the enforcement of this law your life could be very badly affected when your service provider gets hacked or your data get intercepted and some account of yours gets hijacked.
When they suddenly do know you exist, for example because you started protesting about human rights, or climate change, or excessive governmental investigatory powers, or whatever, suddenly someone can show on your doorstep saying “Well well well, what have we got here then” and sucking their teeth.
Your argument isn’t only ill informed, it’s actively dangerous. Shame.
>Legislation is only as powerful as those enforcing it.
While this is generally true, it doesn't necessarily stop the provisions within the bill being used as a political weapon to wield against someone.
In other words, just because it's generally not used against small fry, doesn't mean it won't be used as a club against a particular small fry that's a thorn in the side of someone politically or judicially connected.
But with 10% more votes, this power will go into the hands of Le Pen ... and everyone, including Macron, knows what will happen.
(hell, I kind of suspect this is intentional on Macron's part. He wants to get re-elected by making the alternative to electing him catastrophic. It worked last time, sure, but obviously it needs to become more catastrophic if he's to be reelected)
Also Macron cannot be re-elected in the next elections as there is a term limit.
Context matters, and given the context of where we are as a country at the moment, how trustworthy our current government has (not) turned out to be, and even where they are in the election cycle - currently heading for being out of office for a decade - not to mention them pusing to leave the European convention on human rights, I'm a lot more concerned about the potential dangers of this bill than I might have been in a different context.
Even if you're right and I'm wrong, this statement seems a bit naive! (with respect):
> the bill will only have the effects that the government has said it will in its press releases.
Edit: I tend to put a lot of stock into analysis put out by the EFF [0]. I think they said it well here:
> If it passes, the Online Safety Bill will be a huge step backwards for global privacy, and democracy itself. Requiring government-approved software in peoples’ messaging services is an awful precedent. If the Online Safety Bill becomes British law, the damage it causes won’t stop at the borders of the U.K.
[0] https://www.eff.org/deeplinks/2023/07/uk-government-very-clo...
But I will think this quote from one of the bill's most dogged critics is illustrative[0]:
> ... this Bill, whatever DCMS and its ministers may claim, is not a “fixing” Bill, one which has been designed to be constructive and positive in order to fix problems. It is a “getting” Bill, once which has been designed to be vindictive and negative in order to get specific companies. OnlyFans in this particular example, the usual suspects in others.
> The second is that this Bill has been designed by people who are so out of touch that OnlyFans is their idea of the average small digital business.
> And the third is that this Bill has been designed by people who are so out of touch that they think the harms issues raised by OnlyFans are the harms issues in the average small digital business.
As for your distrust of the government, my opinion on this comes from that same position. My complacency rests not on their goodwill (because I don't think they have any) but on their disinterest in actually understanding anything.
[0] https://webdevlaw.uk/2022/07/13/heres-why-your-project-is-in...
Ok we definitely share common ground on this point then :)
I think it's worth remembering the equal amounts of - what could have been described as - "hyperbole" by remainers about what Brexit would really mean for the country, leading up to that vote. Much of the concern expressed was dismissed or downplayed, and though I voted to remain, I too actually thought the case against Brexit may have been made too strongly at the time. Well I was wrong about that - and many leave voters would also agree now that a lot of those forewarnings turned out to be correct, and in some cases, worse than predicted.
Brexit has had the negative impact on the UK that it has, due to two things. One of those is debatable; whether it was actually a bad idea from the beginning - (I personally think it was) and the second reason is not debatable at all: its very poor implementation by the Government.
The Online Safety Bill also may turn out to be a terrible decision for one or both of these same reasons: a) it was a poor concept b) it was implemented badly by the government. We only need one of those to be true for things to go badly. I worry that both will turn out to be true.
It provides a legal mechanism for authorities to require that individuals disclose encryption keys for encrypted data that was legally obtained or intercepted (i.e. with a warrant) by those authorities, and there are penalties (jail time) for refusing to do so.
The worry at the time was that random data is indistinguishable from encrypted content, so there might be times when people are jailed when they don’t even have the keys because there’s no encrypted data - just random bytes! Or, what happens if you lose the keys?
The reality is that there’s a court system that ‘regulates’ all this. No-one is going to be jailed unless the courts find that they are not providing keys they really do have. Of course, in a conspiracy where the authorities and the courts are all colluding, they could jail people pretending that they knew they had the keys - but there are far easier ways for the authorities to do this than some elaborate scheme with fake encrypted data.
At the time I was fully convinced that it was a step down a slippery slope to authoritarianism. Really, it was just bringing the ‘virtual’ world into line with the physical one.
[I suspect there are a few here who were also around at the time and still believe it’s all a nefarious governmental plot - I’d ask them to show where, in the 23 years since it passed, harm - or suspicion of harm - has happened].
Now, maybe this is different. I certainly don’t want end to end encryption to be banned. But there’s a bit of a ‘cried wolf’ happening in my brain.
A person received a 16 week prison sentence for not disclosing a password. In the context, it’s possible that had he disclosed the password, police would have discovered material that would have attracted a far more severe punishment.
So one might argue that the RIP was too weak, and failed to compel disclosure of the password (four months in jail is light in the circumstances).
He was accused of murder. Ultimately, he was found guilty and sentenced to 33 years: https://www.hampshire.police.uk/news/hampshire/news/news/201...
And then there's the other direction, which I must confess I thought would have involved the RIP Act but ultimately didn't, instead it used anti-terrorism legislation.
A French employee of radical French publishing house that the French government is very cross with, arrived in Britain for a book fair. He was arrested and held for 24 hours using anti-terror legislation. The cops also confiscated his phone and laptop, and held onto them for more than 10 weeks, and they threatened him "with never being able to travel overseas if he failed to hand over a password to his confiscated iPhone and MacBook": https://www.theguardian.com/uk-news/2023/jul/21/police-watch...
The general concern is that France is not allowed to do that, so asked Britain to do it for them, and Britain did it. There wasn't even a hint that he'd broken the law in Britain, and all that was wanted was for the French government to get ahold of the contents of his phone and laptop. Perhaps this is the only reason (that they had absolutely nothing on him) that they didn't twist the knife and use the RIP Act to imprison him simply for not unlocking his devices for them: https://www.theguardian.com/uk-news/2023/apr/19/french-publi...
Of course it will when your gitea or mastodon instance is in the right crosshair. Do we just surrender rights on a hope this time we can stay under the radar? If you are not a terrorist or a pedophile you have nothing to worry etc. When you disagree enough you will become a terrorist. That's the reality in my country because it works an have worked for centuries.
>Ofcom won't have the budget or the resources to go after individuals or small communities; they won't even know you exist. >Ofcom isn't going to audit your homelab for online harms.
Pinky promise?
Not sure what your deflection is in aid of.
The basic principle is that what people do online can have negative consequences in the real world, and the bill basically holds online service operators (such as yourself) at least partially responsible for those negative consequences. Operators need to demonstrate that they're mitigating those consequences risk assessments and policies.
Judging by your profile, you're offering e2ee to family groups, so your intended users are low-risk for sending harmful content. However, your service is freely available to anyone with the app, so it could potentially be used by terrorist organisations, gangs or CSAM sharing groups. e2ee services like this are pretty much the only service that is outright incompatible with the requirements of the bill, so I think you'll be in trouble as soon as Ofcom comes knocking, if they do so. I think the chance of them doing so is small, but that's just my personal opinion, and you will have to make your own decisions.
The family tree and calendar features look like they're low risk, and could be adequately covered by risk assessments, but the file and photo sharing features are also problematic, because (I think) they're encrypted.
You're very unfortunate to be at the intersection of the three factors that could make Ofcom care about you:
* service freely available to the public; * arbitrary user-to-user communication; and * no means of checking for harmful conduct on your service.
The only way forward that I can see for you is to make the backend a selfhost-only affair, which would make your UK-based users responsible under the bill.
Like, imagine you're running a team developing an end-to-end encrypted application in Britain, and you're seeking funding. The potential investors are going to ask what your plan is to not get owned by this bill, you won't have a good answer outside of "hope they don't notice us", and they won't invest. This happens merely because the British government publicized the Online Safety Bill, and exactly zero enforcement effort was required to stifle the funding, development, and subsequent use of this hypothetical application.
Anyhow, the short of my point is that government laws have a ton of power to shape behavior outside of prosecuting people, and sensible risk-management shapes the behavior of non-government bureaucrats and decisionmakers.
The Online Safety Bill bans nothing. What it does do is create a regulatory framework for the Office for Communications (aka Ofcom, HM Government's regulator for the communications industry) to operate and enforce. The regulatory framework is based around risk assessments, and sets out specific risks (of the sort that most people would agree need to be minimised). Ofcom is empowered to decide that internet services are within scope, and then demand to see policies relating to ameliorating those risks within a service.
The regulatory framework does specify that end-to-end encryption is incompatible with the reduction of these risks. However, we do have to play the ball and not the person of unspecified gender here.
We are, after all, talking about the UK here. The phenomenon of 'those whom the law protects but does not bind, and those whom the law binds but does not protect' is still very much in effect here. This legislation has also been proposed by a government that responds to increasing crime (caused by insufficient police officers) by giving those police more powers (that they don't have the resources to exercise).
Ofcom has wide-ranging responsibilities: it regulates the press and broadcast media, it allocates EM spectrum bands, it regulates the telephone network, and regulates the Royal Mail. Like all organisations in the Home Civil Service, it is staffed by a core of 'generalists' with humanities degrees, assisted by a small cadre of 'specialists', who are put back in their cupboard once they've given their opinion.
What this all means is that the bill will only have the effects that the government has said it will in its press releases. Ofcom will go after the big social media companies and the likes of 4chan. Your Mastodon server or your Gitea server or your corner of the Tildeverse or whatever will never appear on their radar. Ofcom won't have the budget or the resources to go after individuals or small communities; they won't even know you exist.
In the UK, an energy bill or council tax bill is an important identity document, necessary for opening a bank account, because any time someone starts talking about identity cards, the readers of the Daily Telegraph start muttering about the Gestapo. Ofcom isn't going to audit your homelab for online harms.