Communications and Digital Committee
Tuesday 27th October 2026
Skip to latest contribution
This debate has concluded
(began 1 day, 9 hours ago)
Watch LiveSkip to latest contribution
This debate has concluded
14:30
14:30
Baroness Keeley
-
-
Baroness Keeley
Thank you. I'd like us first to focus on what impact the Act has had so far. We did in fact see last week. Last week, Ofcom just published a report concluding that the Online Safety Act has not brought significant change relating to content harmful to children. So we know that much. But if we can focus on the other duties too. So is there any. I'd like to come to each of you with a question. Is there any evidence that the illegal content duties have reduced the harms your organisation deals with since they came into force?
Yes. I'll start with.
Yes. I'll start with.
14:30
Speaker 2
-
Speaker 2
In the context of fraud. Unfortunately, no. If the evidence is out, there actually is that many areas of fraud are generated via user generated content like, for example, purchase scams. Romance scams have actually increased. So and that is not kind of surprising because we have not seen any such action from Ofcom actually enforcing the code in relation to fraud. There is also something to bear in mind relation to fraud , that there are other codes that need to be implemented that have not been implemented yet, that are related to fraudulent advertising, which is a route to get fraud as well, that actually will be implemented.
Now it means in mid 2027, and because of delays in terms of Ofcom developing the code. So from a fraud perspective we are seeing no evidence that it's having any impact. Thank you.
Now it means in mid 2027, and because of delays in terms of Ofcom developing the code. So from a fraud perspective we are seeing no evidence that it's having any impact. Thank you.
14:31
Speaker 3
-
Speaker 3
Yeah. I think in terms of the harms that we research online, so we look at online hate speech and particular types of online frauds. We have not seen things improve. What we've sort of seen is that online hate speech still spikes around key events and still has a consistent and persistent presence online that doesn't appear to have changed. And as mentioned, other online harms like financial scams appear to be thriving and in fact, sort of embedding themselves even more into the business model of a lot of these platforms. But I think what is important to sort of note in this is that other areas that are outside of a legal harm.
So things like children's access to pornography, we have seen changes. We have seen changes in the number of age checks that are taken. We have seen changes in the way that those platforms operate. And I think that suggests that, you know, the important thing to hold onto is where regulation is clear and where it's enforced. It can make changes to platforms. It's just not what we've seen in the illegal content space so far.
So things like children's access to pornography, we have seen changes. We have seen changes in the number of age checks that are taken. We have seen changes in the way that those platforms operate. And I think that suggests that, you know, the important thing to hold onto is where regulation is clear and where it's enforced. It can make changes to platforms. It's just not what we've seen in the illegal content space so far.
14:32
14:33
Speaker 4
-
Speaker 4
Unfortunately, with regards to terrorists and violent extremist content, there's no evidence to suggest any causal connection between the Online Safety Act and the volume of material available. There is really no controlled experiment. Unfortunately, there is no way to know because there is very limited systematic analysis or monitoring of what's available on large or small platforms. And when I set up tech against terrorism more than a decade ago, it was in the heyday of ISIS using social media. Of course, unfortunately, these days we're seeing almost as much, if not more , content from violent Islamist extremist groups, the extreme far right, and also nihilistic, violent extremist content.
So we gravely concerned, paradoxically, in some respects, could argue that as a result of the Online Safety Act, platforms are now doing less because they know what the minimum standards are, and therefore it's become a situation of lowest common denominator content moderation, in my view.
So we gravely concerned, paradoxically, in some respects, could argue that as a result of the Online Safety Act, platforms are now doing less because they know what the minimum standards are, and therefore it's become a situation of lowest common denominator content moderation, in my view.
14:34
14:34
Speaker 1
-
Speaker 1
I think I'd just start by saying that we've been dealing with child sexual abuse material for 30 years now. And it the problem is certainly getting worse. Last year we actioned over 310,000 reports of images and videos of child sexual abuse material. That was the worst year on record for finding this illegal material. But I think it is important to say that the Online Safety Act has established minimum standards for technology companies with regards to measures they have to take to block child sexual abuse material. So this is known as hash matching. And for the first time, we do have requirements on platforms to introduce hash matching to prevent the upload upload of known child sex abuse material in the illegal harms codes.
We actually were very pleased to see that this requirement was extended to all file sharing and file storage sites. That's something that we had called on Ofcom to do, and we have seen proposals in the additional safety measures consultation that they may also extend this to all pornography platforms. So I think it is important to recognise that there is requirements in the Act which which have really important potential, you know, and if more and more platforms are introducing these requirements are using our hash lists. We've seen this. We have a tool called image intercept. This is for companies that are very small and they can use this for free.
We've seen uptake in that service and therefore the blocking of child sexual abuse material. So that is positive. But but I guess I would reference back to my first point of saying, we know this problem is getting worse. There are new risks, evolving threats as well, which aren't being tackled adequately.
We actually were very pleased to see that this requirement was extended to all file sharing and file storage sites. That's something that we had called on Ofcom to do, and we have seen proposals in the additional safety measures consultation that they may also extend this to all pornography platforms. So I think it is important to recognise that there is requirements in the Act which which have really important potential, you know, and if more and more platforms are introducing these requirements are using our hash lists. We've seen this. We have a tool called image intercept. This is for companies that are very small and they can use this for free.
We've seen uptake in that service and therefore the blocking of child sexual abuse material. So that is positive. But but I guess I would reference back to my first point of saying, we know this problem is getting worse. There are new risks, evolving threats as well, which aren't being tackled adequately.
14:35
14:36
Speaker 3
-
Speaker 3
Look, in my perspective, access to comprehensive data is a real stumbling block. So we look at we do loads of research on different types of harms, from hate speech to scams to content that harms children. So we have this sort of cross harm approach in our work, which means we need we need all sorts of data. That's about what content is available online, but also how platforms respond to content when it's reported and whether content is amplified in algorithms and these sorts of things. And it's really challenging to create the data sets that are necessary to evaluate that.
We're definitely living in in what's been described as a post API age, where we used to have things like Crowdtangle and free access to platform APIs and tools that would make this sort of research easier. What we've seen is a real step back, a rolling back of those services to the point where we now have APIs that you have to pay thousands of pounds a month for. You have unclear legal status. And what you get is organisations like ourselves that are building these technological fixes that aren't necessarily comprehensive, nor are they necessarily stable. And we spend a lot of time trying to build our systems to capture this sort of data in ways that might not have been necessary in years gone by.
And I know that the government actually has a clear path to ensure some sort of robust routes for data access in principle, but I don't think this has been followed by action. I know that we're still waiting on DCMs to release their consultation around data access, and organisations like ours are waiting with bated breath for that process to continue, because the amount of resource and effort it takes to acquire the data sets to evaluate what's going on online at the moment are pretty unsustainable for those in the not for profit sector.
We're definitely living in in what's been described as a post API age, where we used to have things like Crowdtangle and free access to platform APIs and tools that would make this sort of research easier. What we've seen is a real step back, a rolling back of those services to the point where we now have APIs that you have to pay thousands of pounds a month for. You have unclear legal status. And what you get is organisations like ourselves that are building these technological fixes that aren't necessarily comprehensive, nor are they necessarily stable. And we spend a lot of time trying to build our systems to capture this sort of data in ways that might not have been necessary in years gone by.
And I know that the government actually has a clear path to ensure some sort of robust routes for data access in principle, but I don't think this has been followed by action. I know that we're still waiting on DCMs to release their consultation around data access, and organisations like ours are waiting with bated breath for that process to continue, because the amount of resource and effort it takes to acquire the data sets to evaluate what's going on online at the moment are pretty unsustainable for those in the not for profit sector.
14:37
14:37
Speaker 4
-
Speaker 4
So in terms of the information required to evaluate the the prevalence and quantity of terrorist content online at Tech Against Terrorism, we've developed our own technology that works to crawl and scrape across smaller platforms. They're surprisingly easy to do this. It's extremely difficult to do so on large platforms because of anti-bot protection measures and deliberate mechanisms that have been put in place by the large companies to prevent widespread analysis of material. And I completely agree that the APIs that are available are either extremely expensive or or inadequate in some ways. In fact, the ECS API is quite expensive.
And also I believe that it expressly forbids the use of that API for research purposes. Unlike in the European Union, there is no, as far as I'm aware, mechanism to force platforms to share researcher access. So there is unfortunately no way of doing this at present at scale. Certainly no way to do so without violating terms of of service. So I would say there are two ways of approaching this. One is to try to establish the total amount of content available. That's difficult. It can be done using statistical methods at tech against terrorism. Our analysts have to do this manually on a large platforms, which is extremely limited and expensive.
Of course, we also think there are other ways of going about this. For example, measuring the ease with which terrorist content can be found on platforms. So next month we'll be launching what we're calling the Terrorist Content Discovery Index. And instead of trying to measure the amount of content because that's very difficult, instead trying to measure how easy it is to find ISIS or Al-Qaeda material on platform. So we think there are ways around the lack of data access, but fundamentally, we would argue that how is a regulator indeed, how is the government supposed to regulate the internet if it doesn't have any way of looking at the internet?
I would also finally say that there is a more fundamental challenge here, which is the internet, I think is largely ignored by the government in terms of, let's say, the defense budget, considering how critical the internet is to our society. What proportion of the defense budget is spent on understanding the internet? I genuinely don't know. 0.01% less or more. What should that be? So I think there is a question there about how important the internet is to us and how seriously we're taking it, but also within government. I know there are concerns about the Regulatory Investigatory Powers Act and the effect that has on officials even doing cursory analysis of the internet.
So so I think there's a much broader problem here about legislation where the internet is concerned and resources that have been allocated to understanding the threats that we're facing.
And also I believe that it expressly forbids the use of that API for research purposes. Unlike in the European Union, there is no, as far as I'm aware, mechanism to force platforms to share researcher access. So there is unfortunately no way of doing this at present at scale. Certainly no way to do so without violating terms of of service. So I would say there are two ways of approaching this. One is to try to establish the total amount of content available. That's difficult. It can be done using statistical methods at tech against terrorism. Our analysts have to do this manually on a large platforms, which is extremely limited and expensive.
Of course, we also think there are other ways of going about this. For example, measuring the ease with which terrorist content can be found on platforms. So next month we'll be launching what we're calling the Terrorist Content Discovery Index. And instead of trying to measure the amount of content because that's very difficult, instead trying to measure how easy it is to find ISIS or Al-Qaeda material on platform. So we think there are ways around the lack of data access, but fundamentally, we would argue that how is a regulator indeed, how is the government supposed to regulate the internet if it doesn't have any way of looking at the internet?
I would also finally say that there is a more fundamental challenge here, which is the internet, I think is largely ignored by the government in terms of, let's say, the defense budget, considering how critical the internet is to our society. What proportion of the defense budget is spent on understanding the internet? I genuinely don't know. 0.01% less or more. What should that be? So I think there is a question there about how important the internet is to us and how seriously we're taking it, but also within government. I know there are concerns about the Regulatory Investigatory Powers Act and the effect that has on officials even doing cursory analysis of the internet.
So so I think there's a much broader problem here about legislation where the internet is concerned and resources that have been allocated to understanding the threats that we're facing.
14:40
Speaker 5
-
Speaker 5
Yes. Good afternoon. There's been lots of concern about the way that the categorisation of category one and and and two A has been has been allocated by Ofcom and that the emphasis is on the size rather than the risk. And it's important because only category one and category two have to do full risk assessments. And what should be done about this. Does the the the the Isa need to be altered to ensure that risk is built into the categorisation of services? We thought in Parliament when we were passing it, that risk was. But that's not the way it's been interpreted by Ofcom.
Maybe start with Hannah.
Maybe start with Hannah.
14:41
Speaker 1
-
Speaker 1
Thank you. I would it is fair to say there is a gap between the risk assessment and then the mitigation obligations. And I think that is a real concern for us. It's a challenge when we've got the issue of Safe Harbour, and we know that platforms don't necessarily have to take all measures to address, address what's in the risk assessment. That is something that ourselves and many partners and I'm sure colleagues here have highlighted before as a challenge. So there is also the technical feasibility aspect, which again, we find as a barrier to requirements for platforms.
They can assess that there is risk. But if they deem that something is not technically feasible in order to mitigate it, then they don't have to do anything about it. And that is a real concern for us.
They can assess that there is risk. But if they deem that something is not technically feasible in order to mitigate it, then they don't have to do anything about it. And that is a real concern for us.
14:42
14:42
Speaker 1
-
Speaker 1
I think that the safe harbour element needs to be looked at. The Online safety network has provided some really strong recommendations in terms of reform or removal of safe harbour within the act. I certainly think that is something for government to look at, and indeed, I know that it's something that Ofcom has raised as well and recognises as a challenge with regards to technical feasibility. We have urged Ofcom to provide further details on how they are assessing technical feasibility, and also to ensure that there is regular updates because something that might not be technically feasible last year and there is a lot of innovation when it comes to safety tech, so we need to be ensuring that guidance around technical feasibility is being regularly updated and the codes reflect that as well.
So I think action for both the Government and Ofcom, they're right.
So I think action for both the Government and Ofcom, they're right.
14:43
14:43
Speaker 4
-
Speaker 4
I don't have any particular views on categorisation, but on risk assessments it does strike me as slightly strange that platforms are effectively marking their own homework and and the extent to which they're upholding their own risk assessments is rather subjective, as is the determination of technical feasibility. Of course, in a day and age of of AI, I think it's pretty much anything is technically feasible. It's not really a question of feasibility, but rather will of the platform and the extent to which they're willing to pay for that technical solution.
14:44
14:44
Speaker 4
-
Speaker 4
Well, there's a broader question there about the extent to which platforms should be compelled to invest in safety technology, full stop. And perversely, we've seen platforms pulling back quite significantly over the past few years , with significant reductions in the number of staff, all of the major social media platforms, ostensibly because they claim AI is more effective in doing much of the content moderation. So there is a bit of a contradiction here. On the one hand, platforms are saying they're using AI to moderate more. On the other hand, they're saying that basic measures such as hash matching are not technically feasible.
It really doesn't make much sense to me.
It really doesn't make much sense to me.
14:44
Speaker 3
-
Speaker 3
Yeah. Look, I mean, I think to answer your question, there's certainly a role, a space for a simple revision to the Online Safety Act to ensure that Ofcom are interpreting the size and the risk of platforms when they decide the categorisation. I think that that was the intent of Parliament as the Bill was being passed. And I think that, you know, I know that the Online Safety Network have put forward, you know, specific language that would enable that to happen. And I think that's a sort of quite simple reform to, to make. I think if we're sort of talking about risk assessments and other simple reforms to make, I mean, at the moment, you know, there is no direct requirement for regulated services to take action to mitigate against the risks they identify in their risk assessment.
So you've got this risk assessment process that just exists on paper because platforms just do their risk assessment, and then they look at what the codes require them. And the codes become a ceiling that lock things in because they get safe harbour. And so I think that there's simple reforms, you know, other reforms that could be made about removing safe harbour. I think that there's guidance that could be given about how to interpret what the standard or the expectation of codes is meant to be. I think there's a lot of emphasis on codes being clear and detailed, which means that the the nuanced and complicated risks that platform identify in their risk assessments tend to get hollowed out in the codes because we want there's a there's a focus on trying to meet the sector wide clarity sort of definition set of rules in the codes.
And I think that guidance to Ofcom around that could could be changed. And certainly, I think as other panelists have mentioned, reforms around what happens if a platform relies on technical feasibility or non-technical feasibility as a defence against mitigation, that should trigger some sort of further inquiry or some sort of further continuing update or analysis, because at the moment, I think what we see is platforms are just saying something's not technically feasible, achieving safe harbour, and then they sort of stop.
So you've got this risk assessment process that just exists on paper because platforms just do their risk assessment, and then they look at what the codes require them. And the codes become a ceiling that lock things in because they get safe harbour. And so I think that there's simple reforms, you know, other reforms that could be made about removing safe harbour. I think that there's guidance that could be given about how to interpret what the standard or the expectation of codes is meant to be. I think there's a lot of emphasis on codes being clear and detailed, which means that the the nuanced and complicated risks that platform identify in their risk assessments tend to get hollowed out in the codes because we want there's a there's a focus on trying to meet the sector wide clarity sort of definition set of rules in the codes.
And I think that guidance to Ofcom around that could could be changed. And certainly, I think as other panelists have mentioned, reforms around what happens if a platform relies on technical feasibility or non-technical feasibility as a defence against mitigation, that should trigger some sort of further inquiry or some sort of further continuing update or analysis, because at the moment, I think what we see is platforms are just saying something's not technically feasible, achieving safe harbour, and then they sort of stop.
14:46
14:46
Speaker 2
-
Speaker 2
I used to be on the safe harbour thing. I think that we all agree. I mean, at the moment they put all the responsibility on the regulator in the codes to specify what they need to do when actually are the technology companies that they know what is feasible for them to do. So if the responsibility was in say, rather than say, if you commit what is in the code you are, you cannot be in breach. Actually, what it should be is that you need to show that you are managing the risks that have been identified proactively and on the risk.
The risks are quite important. This is not just a technical thing in the code because depending on what level of risk you are as a platform, you have different levels of requirements and in particular on fraud, on what is expected from you. And that takes me to the point that actually Ofcom need to be looking. They are self-assessment rates, but obviously you have the regulator to look. You have to look at these risks and challenge them. If they don't think that actually are being, you know, honest and maybe underestimating the risk because you underestimate the risk.
You have less duties to comply with. The other thing I will say is that those categorised services will have to now publish in November the risk assessment or summary risk assessment, which can be quite interesting for organisations like us to actually take a look at risk assessment and see whether we are seeing there is an underestimation of the risk by some of these platforms.
The risks are quite important. This is not just a technical thing in the code because depending on what level of risk you are as a platform, you have different levels of requirements and in particular on fraud, on what is expected from you. And that takes me to the point that actually Ofcom need to be looking. They are self-assessment rates, but obviously you have the regulator to look. You have to look at these risks and challenge them. If they don't think that actually are being, you know, honest and maybe underestimating the risk because you underestimate the risk.
You have less duties to comply with. The other thing I will say is that those categorised services will have to now publish in November the risk assessment or summary risk assessment, which can be quite interesting for organisations like us to actually take a look at risk assessment and see whether we are seeing there is an underestimation of the risk by some of these platforms.
14:48
14:48
Speaker 2
-
Speaker 2
Well, the question is why we are not you know, again, I'm talking from the point of view of fraud. What having no more enforcement of that. What is Ofcom is not challenging this more and enforcing this and saying, well, actually we don't think that these risk assessments are fit for purpose that you are doing. You should do more. You need to be more honest about this race. So I think that there is also a role for Ofcom on that.
14:49
14:49
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
And you're starting to to get there, it's really helpful around. I think there's widespread agreement that the safe harbor provisions are problematic. So the question is what should we do instead? Do we go back to where this whole process of the Online Safety Act started and impose a duty of care? It could be a different duty, a duty to prevent harm on platforms. That then means that the risk assessment has to be followed where and we've heard different voices around possible solutions.
Rocio, do you have a view?
Rocio, do you have a view?
14:49
14:49
Speaker 2
-
Speaker 2
I don't have a particular proposal on the way to do this. What I will say when I'm hearing about, you know, going to the debate from the beginning, I get really worried about delaying what we already have fully implemented. So my, my, my position will be like, let's make sure that these assets is properly enforced to the maximum effective capacity at the same time that in parallel, we are having that debate about the best way to deal with the safe harbor rather than delaying and, you know, more than the implementation of what is in place.
14:50
14:50
Speaker 3
-
Speaker 3
Yeah. Look, I think the safe harbor issue provisions sort of could have been less of an issue if the codes were more outcome focused and ambitious. But currently what we've got is this sort of, I don't know, perfect storm where the requirements for risk assessments that have no real requirements to act on the issues identified, combined with then codes that do not reflect the the scale and the size of the online risks. Because of that interpretation, that codes need to be clear and detailed rather than reflect risk assessment and safe harbour. That kind of creates the perfect storm.
But as I'm saying that I realize that storm is a particularly bad metaphor because a storm is very active and releases a lot of energy. This kind of creates the conditions for a storm, if you will, like inertia and, you know, not much changing. To get to your question, I don't think we need to sort of throw away the Online Safety Act and start again. I think that there are some really good proposals around reforms that could be made to the existing Online Safety Act.
But as I'm saying that I realize that storm is a particularly bad metaphor because a storm is very active and releases a lot of energy. This kind of creates the conditions for a storm, if you will, like inertia and, you know, not much changing. To get to your question, I don't think we need to sort of throw away the Online Safety Act and start again. I think that there are some really good proposals around reforms that could be made to the existing Online Safety Act.
14:51
14:51
Speaker 3
-
Speaker 3
Absolutely. And I think that would get to sort of closer to what the intent of Parliament was when the bill was being passed initially. I can I just sort of speak from a comparative perspective here. I work on sort of digital regulation issues all around the world. And one of the things that I see constantly taking full advantage of my NAF accent as an Australian here is that online safety acts are passed. We see if they work, we see what doesn't, and then we go back and we review, we iterate, we change on this. And this is something that we've seen in every country that has tried to regulate the online world.
And I think that this is this is part of the process of what we're seeing now.
And I think that this is this is part of the process of what we're seeing now.
14:52
14:52
Speaker 4
-
Speaker 4
Well, I mean, there's, there's, there's a fundamental flaw in the Online Safety Act, which is it's predicated on regulating something that's not observable. So how are we supposed to know if anything is if the Online Safety Act is working, how are we supposed to know if platforms are upholding any principles if we're not measuring it? There is no way to measure this. And indeed, obtaining information from platforms. Even simple information such as the number of removals is really very difficult.
14:52
14:53
14:53
14:53
Lord Kirkhope of Harrogate
-
-
Lord Kirkhope of Harrogate
Well, you're very welcome. I was very privileged to be a champion for the Internet Watch Foundation when I was in Europe. We worked together very closely on a lot of European legislation at the time. But my question really is this. I mean, it's a question of is prevention better than the cure in terms of the activities here of Ofcom and the use of its codes? It does seem to me, and I'd like your your opinions on this, please. Do you think really, that the codes as they stand at the moment, have enough in them to actively prevent the harm rather than.
Well, as we know they do have within them, of course, the detection and the removing of content, those proposals and their actions and so on. So can you tell me on the balance there what where you think it is or isn't in terms of Ofcom's use of codes? It's for all of you, actually, this question , please.
Well, as we know they do have within them, of course, the detection and the removing of content, those proposals and their actions and so on. So can you tell me on the balance there what where you think it is or isn't in terms of Ofcom's use of codes? It's for all of you, actually, this question , please.
14:54
Speaker 2
-
Speaker 2
I can't I can't talk from the point of view of fraud. So at the moment the code is a lot of the focus is in reactive measures and and proactive measures. However, of, of very soon is going to publish the decision on proactive technologies for those. And this is where the risks are quite important because that only will affect those platforms that have been, you know, they see themselves as a high risk and there will have been requirements about how they can use proactive technology to identify certain fraud to prevent it. So at the moment, doesn't hopefully when Ofcom published that decision and implement it and enforce it, we will see more proactive measures there.
14:55
Speaker 3
-
Speaker 3
I'll be in short, no. I think the codes and their interpretation mean that the focus has become on individual pieces of content and that kind of whack a mole takedown approach, particularly in the sort of space of illegal content and illegal duties, even within that sort of individual focus, there could be improvements by requirements for things like okay, sure, detect and take down, but also there's no staydown requirements. Content can just be reposted. So even if you're going to stick to that individual focus, we could make improvements. But what would be better still is that broader shift to the preventative upstream measures that goes beyond the focus on the, you know, the I, C, G and identifying content that fits within that and onto the systems that platforms deploy and putting requirements around things like terms of service that have to be constantly improved and robust eligibility for algorithmic promotion.
There's loads of systems and requirements that could be sort of better addressed in the codes.
There's loads of systems and requirements that could be sort of better addressed in the codes.
14:56
Speaker 4
-
Speaker 4
Well, unfortunately, where terrorist content's concerned platforms are already doing far too little. And in many cases, we're talking about obvious examples of ISIS material, you know, with a logo with with words that would make it very easy to discover this material. So, so I think I wish there were whack a mole on this platform on this content, because in fact, that's not what we're seeing. Prevention is an interesting word here because I think it's important to remind everyone of the prevent statistics. The number of individuals being referred to the prevent scheme are the highest since records began.
The police publicly on the record saying that they are overwhelmed with a huge number of referrals. So prevention in general is critical, but it would appear that the only organisations focused on prevent are the ones associated with the government. I think this is going to become particularly acute with regards to child radicalisation and mobilisation. So if you like traditional terrorist activity by ISIS or the extreme far right is is problematic enough. But when we're talking about nihilistic violent extremism, which is often subthreshold activity, we're not talking about illegal content. I think we should we should be asking a lot more of platforms to try to understand the radicalisation pathways and the broader context of activity online that is leading to children becoming violent.
So I think there needs to be a much broader conversation about prevent and about prevention, and how platforms can use their awesome technology to help prevent harm, because that's not forget, these platforms and their profitability are based on understanding the minutest detail of our psychology and what we want to buy. And if it's possible to target adverts with such accuracy, surely it's possible to become better at preventing harm.
The police publicly on the record saying that they are overwhelmed with a huge number of referrals. So prevention in general is critical, but it would appear that the only organisations focused on prevent are the ones associated with the government. I think this is going to become particularly acute with regards to child radicalisation and mobilisation. So if you like traditional terrorist activity by ISIS or the extreme far right is is problematic enough. But when we're talking about nihilistic violent extremism, which is often subthreshold activity, we're not talking about illegal content. I think we should we should be asking a lot more of platforms to try to understand the radicalisation pathways and the broader context of activity online that is leading to children becoming violent.
So I think there needs to be a much broader conversation about prevent and about prevention, and how platforms can use their awesome technology to help prevent harm, because that's not forget, these platforms and their profitability are based on understanding the minutest detail of our psychology and what we want to buy. And if it's possible to target adverts with such accuracy, surely it's possible to become better at preventing harm.
14:58
Speaker 1
-
Speaker 1
So I think it is fair to say that there is more focus on detection, removal, and before going on to some of the measures, I think that we do need when it comes to prevention, it is important to recognise that detection and removal, such as hash matching, are foundational measures, and particularly when it comes to preventing revictimization, preventing things like sexual extortion. I don't want to lose sight of how important those measures are within within the act. And we you know, I've mentioned before, but we've mentioned a number of measures, measures that were in the additional safety measures consultation, particularly such as relating to proactive detection, which which look quite positive there.
But it is really important that we also have a balanced approach to preventing harm from occurring in the first place. And we are really keen to see more measures relating to things like deterrence messaging. We know the Lucy Faithful Foundation have really important services to support people who might be at risk of causing harm, those kind of measures, they have a chat bot service are really important and we'd like more companies to to use them. We also want to see further measures tackling grooming. That is a, you know, a key issue there. And there is more to do.
I'd also say beyond specific solutions, we do need more clear and kind of cross-cutting safety by design measures across the board. So that is a challenge there. We may come to this later, but you know, we don't have a clear set of what safety by design means in practice. And it's become a kind of all encompassing word that also risks not meaning enough. So certainly we would welcome more of a focus on what that looks like in practice and requirements to fulfill those duties.
But it is really important that we also have a balanced approach to preventing harm from occurring in the first place. And we are really keen to see more measures relating to things like deterrence messaging. We know the Lucy Faithful Foundation have really important services to support people who might be at risk of causing harm, those kind of measures, they have a chat bot service are really important and we'd like more companies to to use them. We also want to see further measures tackling grooming. That is a, you know, a key issue there. And there is more to do.
I'd also say beyond specific solutions, we do need more clear and kind of cross-cutting safety by design measures across the board. So that is a challenge there. We may come to this later, but you know, we don't have a clear set of what safety by design means in practice. And it's become a kind of all encompassing word that also risks not meaning enough. So certainly we would welcome more of a focus on what that looks like in practice and requirements to fulfill those duties.
15:00
Lord Kirkhope of Harrogate
-
-
Lord Kirkhope of Harrogate
Well, Mr. Hadley, you've already, I think, touched on the question, obviously, of fraud and terrorist content. You talked about it twice now, I think in answer to questions, I mean, obviously this is not in the present Ofcom codes as I understand it. So what I really wanted as a supplementary to ask you and perhaps Miss Concha as well, is really, you know, we identify where the problem. You've identified it very clearly, but what more preventative measures could actually now be taken to tackle that content more than you've already said. I mean, have you got any other ideas about this or Miss Concha might want to comment to, as I said.
15:00
Speaker 4
-
Speaker 4
The the role that content plays in radicalisation and mobilisation of terrorism is, is significant. And I would certainly ask the Home Office to share more detailed statistics about the role that the internet is playing. But certainly, anecdotally, having spoken to many in the police, the vast majority of cases involving children start online. The internet is not only it's not incidental, it's causal where terrorism is concerned, not only in the UK but globally. And it's not just about. Bomb making , manual or official propaganda. It's about all of the content and activity that leads up to this.
So first of all, though, we don't have much data on exactly what role the internet plays in radicalisation, it's very difficult to get this from courts, as I'm sure you're aware. So there isn't very, very much evidence. But of course anecdotally we know this is very important. So so I would say in terms of practical measures, well first and foremost, I would I would want to be sure that platforms weren't actually recommending this content in the first place. So one of the methods that we use at Tech Against Terrorism to detect content on large platforms is to like or reshare or engage some of terrorist content.
And then we wait to see what the platform recommends to us. In many cases, the these powerful algorithms are actually identifying terrorists, which we then obviously then refer to the police. And so there are all sorts of measures that are possible, but we need more engagement from the platforms. And I think content recommendation algorithms are part of this, as is off ramping and which we heard about just now. So there are dozens of measures that have already been established and experimented with and tried out. But certainly in my experience, and I'm not sure what the other panelists are experiencing, there's very little engagement from tech platforms these days.
It's really diminished quite considerably. And often the only people that are willing to talk to us are the lawyers as a result of regulation.
So first of all, though, we don't have much data on exactly what role the internet plays in radicalisation, it's very difficult to get this from courts, as I'm sure you're aware. So there isn't very, very much evidence. But of course anecdotally we know this is very important. So so I would say in terms of practical measures, well first and foremost, I would I would want to be sure that platforms weren't actually recommending this content in the first place. So one of the methods that we use at Tech Against Terrorism to detect content on large platforms is to like or reshare or engage some of terrorist content.
And then we wait to see what the platform recommends to us. In many cases, the these powerful algorithms are actually identifying terrorists, which we then obviously then refer to the police. And so there are all sorts of measures that are possible, but we need more engagement from the platforms. And I think content recommendation algorithms are part of this, as is off ramping and which we heard about just now. So there are dozens of measures that have already been established and experimented with and tried out. But certainly in my experience, and I'm not sure what the other panelists are experiencing, there's very little engagement from tech platforms these days.
It's really diminished quite considerably. And often the only people that are willing to talk to us are the lawyers as a result of regulation.
15:02
Speaker 2
-
Speaker 2
You know, something very simple, for example, again, in the context of fraud is identity verification. So at the moment it's very easy to for anyone to advertise, you know, to set a, for example, a dating profile in a, you know, in a dating dating app, there is no checking about your identity. It's very easy. And we prove it very recently with an investigation that we did in booking.com, which is a platform where actually we advertise we're not checking number ten. So you can rent number ten in a booking.com. Nobody asks us for a proof that we own number ten, which obviously we don't.
Nobody asks for for a verify our identity. These are preventative, very simple, not very technologically advanced measures that actually the platforms can put in place and they are not doing it.
Nobody asks for for a verify our identity. These are preventative, very simple, not very technologically advanced measures that actually the platforms can put in place and they are not doing it.
15:03
15:03
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Hannah let me come to you on a specific issue, which really went to one of the biggest problems when the act was put together, which is the trade off between privacy and harm, as expressed through what we did about encrypted end to end services. And you've argued that the technology already exists to detect known Csam imagery before it's shared. My view is that the act ended up being a fudge around the technical notices and so on. How much is the technology changed in the intervening time that makes it realistic that we could do something better?
That's in the act.
That's in the act.
15:04
Speaker 1
-
Speaker 1
So yes, just to completely kind of reinforce that point that we do believe that it's technically feasible, we see the harms or clear indicators of harms happening in end to end encrypted environments. We know from surveys with offenders that the end to end encryption environments are kind of their preferred place to share material, to sell child sexual abuse material. And really, we refer to this as upload prevention, where you can do the checks before something is uploaded into an end to end encrypted environment. In the same way that you use automated detection for hash matching, you know, on, on other platforms to do this in a privacy preserving way.
And we often find it very unhelpful where there are some arguments made around kind of trade offs, but actually you can have both of these things. And I think, I guess before going into the your point on the technology, also saying for us, the experience of victims and survivors are so important here and actually their privacy is really important. And I think that often gets missed when we talk about issues relating to end to end encryption. There has certainly been developments in the last couple of years, and we do really believe that upload prevention is a market ready method to detect for for Csam.
I've got a copy of our report which covers this in detail. And also I think we've got some examples. You know, unfortunately we don't have any companies who are implementing this at point right now. And often the tech feasibility argument is made, but we can see how this works in practice when it comes to scanning for malware. WhatsApp, for example, you know, when you when you send a message, it comes up with a rich preview link that is very similar to upload prevention in terms of there are scanning there for that URL that you are sending.
So there are examples not relating to child sexual abuse material where something very similar is happening, you know, often for scams and things like that as well. And we believe very strongly that this should be required for Csam. And I think actually Adam's point earlier on around this is more to do with will not technical ability is certainly something that we would strongly agree with.
And we often find it very unhelpful where there are some arguments made around kind of trade offs, but actually you can have both of these things. And I think, I guess before going into the your point on the technology, also saying for us, the experience of victims and survivors are so important here and actually their privacy is really important. And I think that often gets missed when we talk about issues relating to end to end encryption. There has certainly been developments in the last couple of years, and we do really believe that upload prevention is a market ready method to detect for for Csam.
I've got a copy of our report which covers this in detail. And also I think we've got some examples. You know, unfortunately we don't have any companies who are implementing this at point right now. And often the tech feasibility argument is made, but we can see how this works in practice when it comes to scanning for malware. WhatsApp, for example, you know, when you when you send a message, it comes up with a rich preview link that is very similar to upload prevention in terms of there are scanning there for that URL that you are sending.
So there are examples not relating to child sexual abuse material where something very similar is happening, you know, often for scams and things like that as well. And we believe very strongly that this should be required for Csam. And I think actually Adam's point earlier on around this is more to do with will not technical ability is certainly something that we would strongly agree with.
15:06
Lord Knight of Weymouth
-
-
Lord Knight of Weymouth
Two quick follow ups. One would be, is there should we be looking at device level regulation? You know, Apple had a desire that they then withdrew to do some of that scanning. And then is there anything technically that we can do around the ease with which you can move from, say, iMessage to FaceTime, that you can move from WhatsApp messaging to video to do something about the live stream Csam that is prevalent.
15:07
15:07
Speaker 1
-
Speaker 1
In response to that, I think it's important to recognize that there's an ecosystem here and you have to have multi-layered responses. So on device is certainly very important. We need them at every level. So you need them at on device. You need them at that level. You need internet service providers to be blocking material. So those measures are positive. But we need we need all of those measures in place. And with regards to live streaming, there are certainly innovation in this area. This was one we did a long response to Ofcom, additional safety measures codes.
I don't think I can give you a kind of simple response here, but it is something that's worth looking into.
I don't think I can give you a kind of simple response here, but it is something that's worth looking into.
15:08
15:08
15:08
Speaker 2
-
Speaker 2
We have seen again, no evidence of that. And we have done we did a survey of victims of a scam in, I think it was 2024 and 30. 37% of people told us that they found it very difficult to report scams in the platforms. We did the same survey in 2026, and 47 people told us that it's too difficult to report. So actually have may have been worse. And just to give you a benchmark, when we asked the victims, for example, how easy is to report, for example, to the banks, 19% said that it's too difficult.
So compared to the 47%. So you can see that the banks are doing much, much better. So in terms of the code and making any difference, we have not seen a lot of different on that.
So compared to the 47%. So you can see that the banks are doing much, much better. So in terms of the code and making any difference, we have not seen a lot of different on that.
15:09
Speaker 3
-
Speaker 3
Yeah, sure. So we we run projects where we report illegal content en masse around the world and track what happens when content is reported and what's the process. Full disclosure, we don't run that in the UK yet. We are setting that up. But what we've seen in the UK around the reporting of illegal content is that it hasn't changed. So there's a first issue of the interface isn't great for users, and we've actually seen it become more user unfriendly in recent years. So I just checked on Friday to make sure and report in content under the UK's Online Safety Act, on matter takes nine clicks, including identifying which of 17 options of illegal content you were reporting and providing your name, email and the link again to the content that you're reporting, even if you click through from it.
So it's not a flow that's conducive to regular users. And this is complicated by a trend that we've seen from platforms sort of all around the world, where after a piece of content is reported as illegal, what they will quite often do is rather than reviewing it and giving you a decision, they will email the user who reported it back and say, can you give us more information? Can you give us a timestamp where in the video you think the illegal content is? Or can you tell us exactly which law you think it's violated? So they expect the user to sort of mount the legal case around the content for them.
So the user reporting process hasn't been helpful. I think secondly, the commitment from platforms has been underwhelming as well. So globally, what we're seeing is that platforms are reversing or stepping backwards on their terms of service and their commitments to which content they adequately moderate and which content they don't as well, which has not helped in terms of sort of content moderation policies. And the last piece is that the sort of last challenge we see is that determining the threshold is what counts as illegal, particularly in the UK, is a real challenge even for specialist organisations like us.
So we have in-house legal counsel to help us do this. In the projects that we run, we have we rely on AI to identify illegal content, and then that goes through two phases of human review to sort of make sure that it works. That's daunting for a specialist organisation with a bunch of tech. I can only imagine how daunting it must be for users, to the extent that it would just put people off using these reporting services. So I think that, you know, even where Notice and takedown is relied on, it is it is left as a challenge for the users to resolve.
So it's not a flow that's conducive to regular users. And this is complicated by a trend that we've seen from platforms sort of all around the world, where after a piece of content is reported as illegal, what they will quite often do is rather than reviewing it and giving you a decision, they will email the user who reported it back and say, can you give us more information? Can you give us a timestamp where in the video you think the illegal content is? Or can you tell us exactly which law you think it's violated? So they expect the user to sort of mount the legal case around the content for them.
So the user reporting process hasn't been helpful. I think secondly, the commitment from platforms has been underwhelming as well. So globally, what we're seeing is that platforms are reversing or stepping backwards on their terms of service and their commitments to which content they adequately moderate and which content they don't as well, which has not helped in terms of sort of content moderation policies. And the last piece is that the sort of last challenge we see is that determining the threshold is what counts as illegal, particularly in the UK, is a real challenge even for specialist organisations like us.
So we have in-house legal counsel to help us do this. In the projects that we run, we have we rely on AI to identify illegal content, and then that goes through two phases of human review to sort of make sure that it works. That's daunting for a specialist organisation with a bunch of tech. I can only imagine how daunting it must be for users, to the extent that it would just put people off using these reporting services. So I think that, you know, even where Notice and takedown is relied on, it is it is left as a challenge for the users to resolve.
15:11
Baroness Owen of Alderley Edge
-
-
Baroness Owen of Alderley Edge
Just to add before you jump in, Mr. Hadley, a further question to the mix, because it's merging together and I think it's important for the report. You mentioned the platforms becoming more user unfriendly. So it's I'm keen to we're keen to get into how much of a burden of identifying and repeatedly reporting illegal content still falls on specialist organisations, and whether platforms could be required to play a greater role. So you've touched on that, Doctor Farthing.
So if you could also touch on that in your answer, Mr. Hadley?
So if you could also touch on that in your answer, Mr. Hadley?
15:12
Speaker 4
-
Speaker 4
Well, I think it's unfair to to blame the deterioration of content moderation standards wholly on the Online Safety Act. So it's played a substantial part in doing so. Political pressure from the US to do less job cuts, you know, diverting money into AI development and also lack of clear political will here have all contributed to content moderation standards collapsing. But in terms of the reporting processes, we developed our own tool called the Terrorist Content Analytics Platform, that helps to aggregate and process referrals to platforms. Last month, we shared 30,000 human verified referrals of terrorist content to platforms.
This month it's 100,000. This is a substantial volume of material. And all of this content is from organisations that are prescribed in the United Kingdom. So I can't really understate the, you know, the volume of material that we're coming across and we report this material to more than 150 platforms. Not a single platform supports any of the work that we're doing. It's completely pro bono, even though you'd have thought we're doing them a favor by reporting illegal content to them. In many cases. Some of these platforms then completely ignore these referrals. And major social media platform, which I won't name, completely ignores obvious examples of ISIS material.
They really don't care. They really don't. It's quite remarkable, I would say. So the burden of reporting appears to be completely, as far as I'm aware, on civil society organisations, none of which are funded to do this work. And I'm not really aware of what the government is doing to refer content either, because going back to the point I was making earlier, there is limited open source intelligence capability. There isn't a consolidated approach to open source intelligence, which is the point that I've made to the Southport inquiry publicly, which is if we're going to take the internet seriously, we need to have a serious approach to understanding what's on the internet and not relying on underfunded non-profits to do the work on behalf of government and on platforms.
This month it's 100,000. This is a substantial volume of material. And all of this content is from organisations that are prescribed in the United Kingdom. So I can't really understate the, you know, the volume of material that we're coming across and we report this material to more than 150 platforms. Not a single platform supports any of the work that we're doing. It's completely pro bono, even though you'd have thought we're doing them a favor by reporting illegal content to them. In many cases. Some of these platforms then completely ignore these referrals. And major social media platform, which I won't name, completely ignores obvious examples of ISIS material.
They really don't care. They really don't. It's quite remarkable, I would say. So the burden of reporting appears to be completely, as far as I'm aware, on civil society organisations, none of which are funded to do this work. And I'm not really aware of what the government is doing to refer content either, because going back to the point I was making earlier, there is limited open source intelligence capability. There isn't a consolidated approach to open source intelligence, which is the point that I've made to the Southport inquiry publicly, which is if we're going to take the internet seriously, we need to have a serious approach to understanding what's on the internet and not relying on underfunded non-profits to do the work on behalf of government and on platforms.
15:14
Speaker 4
-
Speaker 4
Well, so somewhat shockingly, there are hundreds of websites operated by ISIS, by al Qaeda, by all sorts of organisations. You can type in the website name and you can then view a nice website. Some of these are protected by services such as Cloudflare, and they stay online for quite considerable amount of time. I obviously won't name any of them, but actually it is surprising how easy it is to find terrorist content online. And I mean, we wonder how they're allowed to stay online. There seems to be no focus on them at all. And we have worked with the government in New Zealand, and this is public to help them understand terrorist operating websites and how to block these.
It certainly is possible to block terrorist operating websites. It obviously wouldn't stop the tenacious user to find them, but it would reduce accidental access. So it's completely possible. I'm not sure why this isn't being done. We provide lists of these terrorist operated websites to all governments we work with. So also I think it's unfair completely to blame platforms from the government side as well. There seems to be quite a lot of inertia.
It certainly is possible to block terrorist operating websites. It obviously wouldn't stop the tenacious user to find them, but it would reduce accidental access. So it's completely possible. I'm not sure why this isn't being done. We provide lists of these terrorist operated websites to all governments we work with. So also I think it's unfair completely to blame platforms from the government side as well. There seems to be quite a lot of inertia.
15:15
Speaker 1
-
Speaker 1
So when we find Csam that's hosted in the UK, we do issue a takedown notice and we have that power based on an MoU . With the Npcc and the CPS, we do find that when it comes to UK hosts, 88% of the time they will remove that content within 24 hours. And actually last year I think the fastest was within one minute. So that is positive. But we do need the platforms to be doing more of the heavy lifting and not always, you know, relying on that. We have different ways in which public can report into us.
We work very closely with law enforcement. But but obviously, and I've mentioned before, when it comes to the ecosystem, we need more players to play a bigger role. You've mentioned internet service providers. We have a URL list. So when there are URLs that are hosting Csam and they are not doing anything about it, we will add them to our list. And internet service providers will proactively block access, but that is really reliant on voluntary action by internet service providers. It's something that we, you know, we very much welcome. We work with them. But actually, in order to encourage further action across the board and also when it comes to other harms as well, I think it is important to look at what more internet service providers can be doing on that.
And then I just really echo the point around reliance on specialist services challenges with funding, of course, and that, you know, when we're supporting statutory duties, supporting victims, things like that, it's really important to recognise that and ensure it is adequately funded.
We work very closely with law enforcement. But but obviously, and I've mentioned before, when it comes to the ecosystem, we need more players to play a bigger role. You've mentioned internet service providers. We have a URL list. So when there are URLs that are hosting Csam and they are not doing anything about it, we will add them to our list. And internet service providers will proactively block access, but that is really reliant on voluntary action by internet service providers. It's something that we, you know, we very much welcome. We work with them. But actually, in order to encourage further action across the board and also when it comes to other harms as well, I think it is important to look at what more internet service providers can be doing on that.
And then I just really echo the point around reliance on specialist services challenges with funding, of course, and that, you know, when we're supporting statutory duties, supporting victims, things like that, it's really important to recognise that and ensure it is adequately funded.
15:17
15:17
Baroness Elliott of Whitburn Bay
-
-
Baroness Elliott of Whitburn Bay
This is one for all of you. We've heard that the current online safety regime is poorly equipped to deal with the increasingly complex ways in which illegal activity takes place online. What I want to know is to what extent that reflects your own experience and where, if anywhere, does the current framework fall short? And if I just go along the line, probably.
15:17
Speaker 1
-
Speaker 1
So first point on this is regarding commercialisation. We see that commercial incentives have a strong influence on the generation and distribution of child sexual abuse material. And, you know, often for service providers, this is part of their income generation. We've seen a real growth in this, particularly in the last year. And actually the amount of sites that are commercially driven hosting Csam doubled in 2025 compared with the previous year. So we have payment brand alerts, and we work with financial services to alert them when we see ways in which, for example, you can pay and that's being advertised.
So we will go and tell that financial company and say, look, you need to block this. But again, this is based on voluntary action. And actually one area we want to see is the introduction of mandatory duties with regards to financial institutions to proactively tackle this. That would that would be a key piece for us. And that is a real challenge. The other area I'd mentioned perhaps I can come back to is with regards to AI, because that is a real gap right now.
So we will go and tell that financial company and say, look, you need to block this. But again, this is based on voluntary action. And actually one area we want to see is the introduction of mandatory duties with regards to financial institutions to proactively tackle this. That would that would be a key piece for us. And that is a real challenge. The other area I'd mentioned perhaps I can come back to is with regards to AI, because that is a real gap right now.
15:18
15:18
Speaker 4
-
Speaker 4
Where terrorist content is concerned, it is fundamentally cross-platform and that's the same, but different depending on the type of terrorist content we're talking about. So jihadists will, will, will share material in a certain way in the extreme far right in another. And, and those and content relating to nihilistic violent extremists also is cross-platform. So, so we provide platforms with Uranus, a bit like the internet watch foundation and hashes. So the technology is there, the data is available, the interest from large platforms is non-existent. So we have a URL sharing API and and other services. And quite a large number of small platforms are signed up to these and they're quite engaged.
But a large platforms are completely not interested, even though there are many examples of, of content being linked to them. An example would of this would be in June this year, we found a network of ISIS fundraising that covered Facebook, Instagram, telegram, and WhatsApp. And it had been obviously available for at least nine months. And this is with ISIS logos and essentially saying fund ISIS in Arabic. So really easy to find. I mean, we found it fairly easily. So the cross-platform nature of this is fundamental to terrorist activity. But yet actually some of the platforms with the most terrorist content are the least engaged with some of these measures.
And it does seem quite strange to me, considering the Online Safety Act is supposed to encourage exactly that sort of tech adoption.
But a large platforms are completely not interested, even though there are many examples of, of content being linked to them. An example would of this would be in June this year, we found a network of ISIS fundraising that covered Facebook, Instagram, telegram, and WhatsApp. And it had been obviously available for at least nine months. And this is with ISIS logos and essentially saying fund ISIS in Arabic. So really easy to find. I mean, we found it fairly easily. So the cross-platform nature of this is fundamental to terrorist activity. But yet actually some of the platforms with the most terrorist content are the least engaged with some of these measures.
And it does seem quite strange to me, considering the Online Safety Act is supposed to encourage exactly that sort of tech adoption.
15:20
15:20
Speaker 3
-
Speaker 3
Yeah. I'm just reflecting on similarities in the scam space that we track. So one of the things that we track is networks of scammers and they are becoming more complicated, more coordinated. So we're seeing a lot more coordination of actors, a lot of cross platform activity, and a range of different technologies used from sort of snatched web domains to sort of inserted web text in websites that you sort of pointed to from some of the larger platforms. And in this growing complexity, what we still see is a response on notice and takedown. So it's like you will report a scam and a platform will remove the scam ad, but that that network behind the coordinated network behind it on other platforms, the technology behind it stays active.
So you get this sort of response constantly, as if the problem is a sort of iceberg. And there's this constant removal of the very visible tip of the iceberg when it becomes obvious. But the complex problem remains underneath that.
So you get this sort of response constantly, as if the problem is a sort of iceberg. And there's this constant removal of the very visible tip of the iceberg when it becomes obvious. But the complex problem remains underneath that.
15:21
15:21
Speaker 2
-
Speaker 2
Can I add on that? And this is not related to the online safety app, but this point about these criminals using different platforms. And you stop them in one point and they will choose another point. And by the way, they are incredibly innovative in the way that they, you know, deliver their criminal activities. But there have been a discussion in government about this data sharing between different platforms , the banks, the telecoms, the government to actually to prevent that, to be more proactive about this. This is broader than the Online Safety Act and say, well, if we are finding this criminal activity in this particular route, can we alert others because of this, you know, particular individual or organization and actually others to block that?
And this has been a discussion. There have been some pilots in terms of run by the Home Office, but there is far more than it to be done and actually more urgency in that. So that would be the only contribution on that.
And this has been a discussion. There have been some pilots in terms of run by the Home Office, but there is far more than it to be done and actually more urgency in that. So that would be the only contribution on that.
15:22
Lord Tarassenko
-
-
Lord Tarassenko
Thank you very much, sir. I have one follow up for Adam and then one for all four of you. So, Adam, you made three statements. I'm going to try and link together in the evidence so far, which I think are very interesting. First of all, you said there's little engagement in terms of terrorist or extremist content from the large tech platforms. Secondly, you said it is possible to reduce access. But thirdly, and I think this was a really interesting statement to hear from you. The OSA is not predicated on measuring metrics which are observable. So I'm going to try and link all those three together in my question to say so if it's not the OSA, how would you suggest that we do?
Is it new legislation? Is it other means to reduce access to these terrorists and extremist content platforms?
Is it new legislation? Is it other means to reduce access to these terrorists and extremist content platforms?
15:23
Speaker 4
-
Speaker 4
Well, going back to the first comment I made, if we if we don't know what's on the internet, how can we regulate it effectively if we're relying on risk assessments or transparency reports from platforms, I think we're going to be in deep trouble. Clearly, the internet is providing huge economic and social benefits to the country, but obviously adversaries, hostile nation states, terrorist organizations are also using the internet to harm our society. But yet we there's no observability now in the EU under the Digital Services Act, there is provision there for researcher access to platforms. It's not particularly good, but it's a start.
I'm not aware of any provisions that have been enacted here. So really the main thing I would say is we need to understand what's on the internet before we can do anything about it. Ofcom doesn't, as far as I'm aware, have the powers to do that. I don't think the Home Office would either. The police certainly don't or don't have the capacity to do it. So it's a really no one is looking at the internet and the research community has has been defunded for the most part. Many non-profits have gone out of business and have been defunded.
So there isn't really much data. So from the from the perspective of big platforms, it's a, it's probably quite a positive situation, right? Because there's less scrutiny, there's almost no information available except anecdotal to demonstrate just how bad their content moderation has become. So yeah, I would argue that the government should take this seriously. It should establish a dedicated unit looking at understanding what's on the internet. It shouldn't just be focused on disinformation or it shouldn't just be focused on one harm, but it should bring together all the capabilities, because the problem with open source intelligence is that anyone can do it.
And the result of that is the capability can become quite fragmented and have limited effect as a result.
I'm not aware of any provisions that have been enacted here. So really the main thing I would say is we need to understand what's on the internet before we can do anything about it. Ofcom doesn't, as far as I'm aware, have the powers to do that. I don't think the Home Office would either. The police certainly don't or don't have the capacity to do it. So it's a really no one is looking at the internet and the research community has has been defunded for the most part. Many non-profits have gone out of business and have been defunded.
So there isn't really much data. So from the from the perspective of big platforms, it's a, it's probably quite a positive situation, right? Because there's less scrutiny, there's almost no information available except anecdotal to demonstrate just how bad their content moderation has become. So yeah, I would argue that the government should take this seriously. It should establish a dedicated unit looking at understanding what's on the internet. It shouldn't just be focused on disinformation or it shouldn't just be focused on one harm, but it should bring together all the capabilities, because the problem with open source intelligence is that anyone can do it.
And the result of that is the capability can become quite fragmented and have limited effect as a result.
15:25
Lord Tarassenko
-
-
Lord Tarassenko
Okay, well, just to follow up with everybody on generative AI. So As a result. Okay, well, just to follow up with everybody on generative AI. So since the Online Safety Act was being designed, we've had JV AI really happen and increasing or. exacerbating existing harms, new risks, etc.. Now, the Internet Watch Foundation's argued that the regulation of AI is a significant gap. Some services may be in the scope of of the USA, but Ofcom has explained that chatbots are not really subject to. regulation yet. I think we've got some amazing statistics here from the center for Countering Digital Hate.
Eight out of the ten leading. chatbots were willing to assist accounts posing as. teenagers with planning violent.
Eight out of the ten leading. chatbots were willing to assist accounts posing as. teenagers with planning violent.
15:26
15:26
15:26
Speaker 1
-
Speaker 1
Primary legislation, starting with Hannah and working our way across? Thank you. As you've said, AI generated child sex abuse material is an evolving and really growing risk. And we're seeing how harm is now being produced at scale. Victims are having their images used to create new images. We find when it comes to AI generated material, that the vast. majority is category A, which is the most severe form of child sexual abuse material.
15:26
15:26
Speaker 1
-
Speaker 1
Offenders are using AI to create the worst levels of child sexual abuse material, as we've said, certainly pointed out that regulation is largely of AI is largely missing only certain. In scope. Platforms are required to fill duties. And I think there's a couple of things there in terms of next steps. One, we we would really urge there to be new primary legislation to address risks relating to AI. AI can be a really important source for good, including when it comes to tackling child sexual abuse material. But we need requirements on AI companies to make their products safe by .
15:27
15:27
Speaker 1
-
Speaker 1
Not being in a situation as we've been in the last year, where a product is is opened out to users, and then we see vast amounts of harm being created. So certainly, and that is something that the government had previously committed to in the manifesto. And we continue to call for legislation to regulate AI and introduce these requirements. We also have the Crime and Policing Act, which includes some really important measures that we fought for, and we're really pleased to see relating to ban on. notification apps relating to red teaming to test AI models to see if they can generate this.
15:28
15:28
15:28
15:28
15:28
15:28
15:28
15:28
Speaker 3
-
Speaker 3
By smaller, hostile nation states should be a major national security priority. Two years ago, we released a. report assessing the likelihood of terrorists using generative AI for content production. Of course, that's since become ubiquitous. Every terrorist group. imaginable is using AI to produce content. The threat is much graver than this.
15:29
15:29
15:29
15:29
15:29
15:29
15:29
15:29
15:30
15:30
Speaker 3
-
Speaker 3
Chemical, biological, etc., threats. And there are very few measures or. mechanisms to establish how safe AI is. This month, we launched our own benchmark, the. Counter-Terrorism AI benchmark, which benchmarked. 160 AI models to see or evaluate which ones would provide meaningful answers for terrorist type of queries. Things like I am a terrorist. Will you help me conduct a mass casualty attack?
15:30
15:30
15:30
15:30
15:30
15:30
Speaker 3
-
Speaker 3
And one of them is benchmarks. So benchmarks are. fundamental to the valuation of AI industry. So we know everything there is to know about how fast an AI model is, how clever it is. We know very little about how safe they are. So what we're calling for is government. support into safety benchmarks. How do we measure the extent to which a model will support fraud, or will support terrorist requests, or support hostile activity relating to children's safety, because these don't exist. And the AI Security Institute is very well funded, and it's only focused on. misalignment and chemical and biological weapons.
And I think we've really got to step up now, because we may only have a number of months left before we can. influence AI. There are things that we can do. But going back to the point of making throughout this hearing, if we don't understand what's going on, if we've got no.
And I think we've really got to step up now, because we may only have a number of months left before we can. influence AI. There are things that we can do. But going back to the point of making throughout this hearing, if we don't understand what's going on, if we've got no.
15:31
15:31
Speaker 3
-
Speaker 3
How can we hope to mitigate those harms? So it's not just about social media content and what terrorist content is there. It's also about. understanding how models are performing. And I would hope that with political pressure and awareness of the public of which models are safe, that we might be able to devise measures to.
15:32
15:32
Speaker 3
-
Speaker 3
And AI providers to build better technology before it's too late. So primarily, I would say, you know. benchmarks are could be helped to, to improve this. But, you know, we should be really worried. Finally, just to point out, it's not just about content production by terrorist groups. A couple of weeks ago, anthropic released its threat. report that. highlighted a militant group in northern Yemen. Almost certainly, the Houthis had used Claude code, presumably paid to use Claude code, which would be a sanction. Sanctions violation, if true had used Claude code to improve missile guidance technology. A few weeks later, what have we seen but the Houthis striking targets in Saudi Arabia and killing people?
So? So this is not a theoretical issue.
So? So this is not a theoretical issue.
15:33
15:33
15:33
15:33
15:33
15:33
15:33
15:33
15:33
15:33
15:33
Speaker 5
-
Speaker 5
And Miss Culture want to come in as well or we go to the next question. I don't have anything to add. I mean yeah, I'll just add sort of thinking about chatbots specifically, the sort of long lesson learned from the impact of technology on society is that some regulation is needed and necessary alongside industry measures and safety by design features. And I think that the Online Safety Act is actually really solid piece of legislation. It's a strong.
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
15:34
Baroness Keeley
-
-
Baroness Keeley
15:34
Baroness Fleet
-
-
Baroness Fleet
On the time. But if you're all right to to stick with us. Veronica. Thank you so much. It really is very helpful what you're telling us today. This is one for all of you. If we could perhaps start with Hannah. Do you think that Ofcom's approach to supervision and. enforcement has been effective in. securing meaningful changes from. platforms since the illegal content duties came into force?
15:35
15:35
15:35
Speaker 1
-
Speaker 1
Specific examples of where supervision enforcement has been effective file storage and file sharing sites. There has been a specific enforcement. program to tackle the kind of platforms that are hosting child sex abuse material, and we have seen some positive action there. We've seen. platforms introduce hash matching that weren't doing so.
15:35
15:35
Speaker 1
-
Speaker 1
And also some platforms which actually have now been made available to UK users because they continue to host that material. I think the other thing I wanted to reference here appreciate it's not a legal harms, but there has been some. important action relating to access to pornography sites with regards to highly effective age assurance. There's more to be done there. But but there has been positive action. And I think it's also important to recognise that the Online Safety Act is.
15:36
15:36
15:36
15:36
15:36
15:36
15:37
Speaker 3
-
Speaker 3
Impact from from. legislation from this country, although I would say the E-safety Commission in Australia has encouraged quite a few platforms to approach us. Under Australian law, platforms are obliged to share terrorist content with us so that we can hash this and share it with other platforms for removal. And we've had a number of. platforms .
15:37
Speaker 5
-
Speaker 5
Result of the Australian legislation. Thank you. Can I sort of build on that and also speak comparatively, because I think one of the very real debates that's happening in Australia now that is also revising its Online Safety Act, is the debate about the need for a private right of action. So in Australia, there is already a public facing complaint mechanism that people can use to access e-safety, to report content, to report harms and seek redress. And there are sort of further debates and discussions happening about how you can take that further. Should there be a private right of action?
I think they're interesting to reflect on. I have no particular opinion about those yet in the UK.
I think they're interesting to reflect on. I have no particular opinion about those yet in the UK.
15:37
15:37
15:37
15:37
15:38
15:38
15:38
15:38
15:38
15:38
15:38
15:38
15:38
15:38
15:38
Speaker 6
-
Speaker 6
As you know, but it's for the regulators really to. enforce the codes that they are. responsible for. So I don't think that it's instead it's obviously having that complement. But unless the regulator is seeing. determined in. implementing and. enforcing the code, the deterrent effect will not be there. And that is why we see the platforms not doing, not doing, not doing much.
15:39
15:39
Speaker 6
-
Speaker 6
A stronger right to seek redress? Well, of course, I would like victims to have that. But this is not instead of of the role that the regulators I mean, it's not by the way, it's not easy in this country to take a particular big tech by. victims to the court. It's incredibly expensive. And and they have, you know,
15:39
15:39
15:39
15:40
15:40
Baroness Caine of Kentish Town
-
-
Baroness Caine of Kentish Town
Question, final question, Diana King, Baroness Cohen, thank you very much. It's been a really rich session, I think, in terms of the. contributions that you've all been making and to a degree, some of the questions that are tending to get iterative. Now in terms of your response, and this is the most iterative one, because I'm going to ask you, of all the shortcomings you've.
15:40
15:40
15:41
15:41
15:41
15:41
15:41
15:41
15:41
15:41
15:41
Speaker 5
-
Speaker 5
Then having this discussion about the safe harbour. Thank you. I think, you know, removing safe harbour, requiring platforms to mitigate against all of the risks that identify in their risk assessment, revising the tests that's given rise to this, this proposal that we have that codes must be clear and detailed over actually. comprehensive and broad scale. But alongside those sort of nitty gritty, specific reforms, I think there's broader reforms that could fold into the Online Safety Act around more attention to business models and the way that business models pay creators to create this content at the same time as the way they profit from content creators.
15:41
Speaker 3
-
Speaker 3
Thank you. We've got your evidence to look at as well. Adam, I the single most impactful thing in my opinion, would be there being an online harms dashboard. That's. Generated with data coming from. platforms as a result of enforcing section. 154 A of the Online Safety Act. And to my point throughout this hearing, if we don't have .
15:42
15:42
15:42
Speaker 1
-
Speaker 1
Thank you. And Hannah. Finally. So echo are the points being made around safety by design. We would we would welcome having adoption of a safety by design code of practice, safe harbour. We've heard loud and clear is an issue and we would certainly agree. And then with regards to end to end encryption, there is measures that Ofcom can take with regards to technical feasibility and using section 1 to 1 powers.
That is a really important measure in the Online .
That is a really important measure in the Online .
15:42
15:43
15:43
15:43