The Online Safety Bill is still going through parliament and we are back to the question of end-to-end encryption

I quite like the UK government’s Online Safety Bill. It compels the Big Tech companies to take action over child sex abuse material (CSAM) and promises huge fines if they fail to do so. However, the requirement to monitor communication apps with end-to-end encryption (E2EE), for CSAM causes me a problem.

Draft Online Safety law requires encrypted chat CSAM scans • The Register

Developers could insert a CSAM scanner into their apps, but as the provider would not know which messages may contain CSAM, they would have to scan them all! Yours, mine, politicians, police officers, etc., etc. Now the service would no longer be a secure channel for communications. Somewhere in among all the messages examined would be law breakers passing CSAM. Of course, the only law breakers, passing CSAM on these monitored channels would be the idiots, who did not understand that their messages were no longer secret. Those who understood the risks of communicating without encryption, would have moved to other channels.

For paedophiles that would probably mean going back to the 1960s and leaving cryptic messages scrawled on public toilet walls. Do we now ban public toilets?

Then there is the issue of false positives. These will be inevitable and if the developers of these CSAM scanners say they will not happen, they are not telling the truth. Have you ever seen a false positive from your anti-virus software? Of course you have – but that bad result does not ruin lives or intrude on people’s privacy.

I have a lot of questions:

• So how will these false positives be dealt with?
• Who will have the right to look at your legal content, because an algorithm said it was CSAM?
• Will it be someone in a data centre, somewhere in the world, working for minimum wages? If they were not CASM images but photos of your night in a hotel with a significant other – perfectly legal – but now I wonder how much those images would sell for?
• How do we know that only CSAM is being scanned for?
• If it works for that type of law breaking how long before a politician who wants to make a name for themselves, or just wants to get more votes, suggests terrorist material is scanned for?
• When in the process will the police come knocking on your door?

Somewhere in this mix has to be measure of due process. If the police have suspicions and evidence of law breaking may be that is when they start the scanning of the suspect’s messages, once they have a warrant to do so.

However if there is a backdoor into our secure messages, it will not take long for the threat actors to find that backdoor and build their own scanners.

Smart Thinking Solutions supports this UK Government initiative:

Let’s stop abuse together – Stop Abuse Together (campaign.gov.uk)

Further Reading

Online Safety Bill articles (Smart Thinking Solutions)

Online Safety Act publications – Parliamentary Bills – UK Parliament

Another attack on privacy in the name of protecting children – Smart Thinking Solutions