Ministers have attempted to head off a threatened exodus of messaging apps from the UK by assuring tech firms they cannot be forced to scan encrypted texts indiscriminately for illegal content.
WhatsApp and Signal have threatened to quit the UK over a provision in the online safety bill that allows Ofcom to order a messaging service to use “accredited technology” to look for and take down child sexual abuse material.
The companies and privacy advocates have argued that the clause is a threat to end-to-end encryption, a technology that means only the sender and recipient of a message can see it.
The minister for arts and heritage, Stephen Parkinson, said Ofcom would only be able to intervene if scanning content was “technically feasible” and if the process met minimum standards of privacy and accuracy.
Outlining the series of assessments that the watchdog must make before ordering tech firms to act on Wednesday, Lord Parkinson said: “A notice can only be issued where technically feasible and where technology has been accredited as meeting minimum standards of accuracy in detecting only child sexual abuse and exploitation content.”
Referring to the controversial clause, he told the House of Lords: “If the appropriate technology doesn’t exist which meets those requirements, then Ofcom will not be able to use clause 122 to require its use.”
The president of Signal, Meredith Whittaker, said the statement was a “victory” and represented “vital clarity”. Writing on X, the platform formerly known as Twitter, she posted: “I’m hopeful that it opens the door for changes to the text of the bill in the final stages.”
However, the government has not changed the wording of the bill, which still gives Ofcom the power to issue an accredited technology notice. A government spokesperson said: “Our position on this matter has not changed”.
Will Cathcart, the head of WhatsApp, which is owned by Mark Zuckerberg’s Meta, said on Wednesday scanning messages would destroy privacy and that the app remained “vigilant” against any threats to break encryption.
The fact remains that scanning everyone’s messages would destroy privacy as we know it. That was as true last year as it is today. @WhatsApp will never break our encryption and remains vigilant against threats to do so. https://t.co/iHsBOhkp8r
— Will Cathcart (@wcathcart) September 6, 2023
Martin Albrecht, a professor of cybersecurity at King’s College London and a critic of the contested clause, said it was hard to see how message-scanning technology could ever be feasible in terms of accurately identifying abuse material or protecting privacy.
“I am relieved to see the government accepting the scientific consensus that the technology does not exist to scan encrypted messages without violating users’ privacy. However, it is not clear what test the government plans to apply to decide on whether the technology is feasible in the future,” he said.
The NSPCC, the children’s protection charity, said the statement did not change the bill.
Richard Collard, the head of child safety online policy at the NSPCC, said: “This statement reinforces how the online safety bill sets out a balanced settlement that should encourage companies to mitigate the risks of child sexual abuse when designing and rolling out features like end-to-end encryption. It does not change the requirements in the legislation.”
A spokesperson for the campaign organisation Index on Censorship said: “The online safety bill as currently drafted is still a threat to encryption and as such puts at risk everyone from journalists working with whistleblowers to ordinary citizens talking in private. We need to see amendments urgently to protect our right to free speech online.”
