UK’s Online Safety Bill to become law, but can it be enforced?
After years of political wrangling, wide-ranging online rules are about to become UK law – but complying with and enforcing the regulations won’t be easy
By Matthew Sparkes
20 September 2023
Encryption used by messaging apps is a key sticking point for the UK’s Online Safety Bill
PA Images/Alamy
The UK’s controversial Online Safety Bill has passed through Parliament and will soon become law. The wide-ranging legislation, which is likely to affect every internet user in the UK and any service they access, has taken years to get to this point, but its potential impacts are still unclear and some of the new regulations are technologically impossible to comply with.
A key sticking point is what the legislation means for end-to-end encryption, a security technique used by services like WhatsApp that mathematically guarantees that no one, not even the service provider, can read messages sent between two users. The new law gives regulator Ofcom the power to intercept and check this encrypted data for illegal or harmful content.
Using this power would require service providers to create a backdoor in their software, allowing Ofcom to bypass the mathematically secure encryption. But this same backdoor could be abused by hackers, and anyone with the technical ability could create their own encryption software with no backdoor.
Advertisement
Read more
Australia's anti-encryption law is hurting press and personal privacy
“The request to locate a backdoor through encrypted messages causes a constant security headache and this is likely to push users, including criminals, to other more underground messaging platforms,” says Jake Moore at cybersecurity firm ESET.
An alternative approach is to install software on every device to allow Ofcom to look at unencrypted messages before or after they are sent. This isn’t simple to implement, nor popular with privacy advocates such as Jessica Ní Mhainín at campaign group Index on Censorship.
