Illegal content: Internet crackdown?

• Explores the new duties placed on internet service providers – both user-to-user and search services, in respect of illegal content, following the introduction of the Online Safety Act 2023.
• Explains the new risk assessment duty, which will come into force when Ofcom has finalised its guidance on illegal content risk assessments, expected to be in autumn 2024.
• Highlights the challenge for service providers in addressing the grey areas and untested boundaries of what constitutes illegal or harmful online content, particularly where offences can be inchoate or infringe on the right to freedom of expression.

Last October the Online Safety Act 2023 (“OSA”) finally entered the UK statute book.  Focusing on two key types of internet services, user-to-user and search services,  the OSA aims to make the internet safer for all by placing duties on service providers to identify, mitigate and manage risks of harm arising from illegal content and activities, as well as those posing particular risks to children.

A user-to-user service allows people to create and share content online as well as interact with each other, for instance social media (e.g. Instagram) or instant messaging services (e.g. dating apps). A search service allows users to search content across the web for e.g. products or services offered by companies. Examples include search engines such as Google and Bing but also virtual assistants like Siri and Alexa.  

This article explores the approach that the OSA and its regulator and enforcer, the Office of Communications (“Ofcom”), now require regulated services to take in respect of illegal content.

What is “illegal” content?

The OSA’s definition of illegal content is based on UK criminal offences. The first category, “Priority offences” – listed in Schedules 5, 6 and 7 OSA – cover the most serious and prevalent illegal content and activity online, including, but not limited to, terrorism, child sexual exploitation and abuse (“CSEA”), fraud and proceeds of crime offences.  They also include inchoate offences, such as conspiracy.  Illegal content falling under this definition is often referred to as “priority illegal content”.

The second category – “Other offences” – comprises non-priority offences, where the victim or intended victim is an individual(s).  Particularly relevant are the new criminal online offences created by the OSA such as epilepsy trolling (s182), cyberflashing (s187), assisting or encouraging self-harm (s184) and false communications (s179). Illegal content falling under this definition is often referred to as “other illegal content”.

Duties, including risk assessments

Part 3, Chapters 2 and 3 of the OSA impose specific duties regarding illegal content, which are largely similar for user-to-user and search services. The central duty is that providers of both types of service must take proportionate measures to effectively mitigate and manage the risk of harm to individuals in relation to illegal content. This involves preventing users from encountering such content on their services at the outset. It marks a significant change: online service providers were previously only required to act swiftly in removing unlawful content once they were put on notice of its presence.

However, there are some differences in the respective obligations of providers of user-to-user and search services.  Providers of regulated user-to-user services must take proportionate measures to prevent individuals from encountering priority illegal content, whereas providers of regulated search services need only take steps to reduce the risks that users encounter priority or other illegal content via their services.

To comply with the OSA, service providers must follow risk assessment duties in relation to illegal content, as set out in Part 3, Chapter 2 (s.9) for user-to-user services and Chapter 3 (s.26) for search services. Both sections mandate all service providers to conduct a suitable and sufficient illegal content risk assessment, requiring them to assess all kinds of illegal harm, i.e. user-generated content or behaviour that is illegal. This can include the priority offences and offences such as hate crime or hate speech, harassment, cyber-bullying and online abuse. Providers will also be required to consider their platform’s design, functionalities, algorithms and any other features likely to meet the illegal content and child safety duties. As such, providers must take into account (i) the characteristics of the service (e.g. user base, user numbers etc.); (ii) any relevant aspects of the service’s design and operation (use of proactive technology, governance etc.); and (iii) how the service is used (both in intended and unintended ways).  

This duty will come into force once Ofcom has finalised its guidance on illegal content risk assessments, expected to be in autumn 2024.  Thereafter, services will have three months to complete their first assessment.

Judgement calls

Both forms of services must treat content as illegal if, having considered all reasonably available information: a) they have reasonable grounds to infer that all elements necessary for the commission of the offence, including mental elements, are present or satisfied, and b) they do not have reasonable grounds to infer that a defence to the offence may be successfully relied upon.  

The OSA requires services to make these judgement calls on a reasonable inference basis (Part 11, s.192 (ss.(5) and (6)) which is to a lower threshold than the criminal standard applied in the criminal justice system. 

However, UK criminal offences are complex, nuanced and not always fully defined in legislation, for example, those that involve multifaceted allegations including matters related to fraud, sexual offences and evasion of duty prosecutions. This is partly why Ofcom’s draft guidance on how to identify illegal content runs to 390 pages. Ofcom admits that “while we have tried to set out clear steers and an easy-to-follow approach, there are limits to how much we can simplify the language and concepts in this document.”

Ofcom has been keen to stress that content is not illegal merely because it depicts a crime. Take, for example, an item of content showing one person violently attacking another: the service provider does not need to consider whether the attack itself is a criminal offence and nor, therefore, the conduct, state of mind or defences available to the person depicted as carrying out the attack. Rather, it must consider whether there are reasonable grounds to infer that the person who has posted, uploaded or shared the piece of content has committed an offence by doing so, for example, if it is part of a campaign to harass the victim.

Terms and Conditions

However, nothing in the OSA requires service providers to make illegal content judgements, if the application of that service’s own terms and conditions complies with the duties in other ways. For example, should the service’s own terms and conditions of use prohibit content that is wider than the Act’s definition of illegal content, then the service provider would be considered to have fulfilled its legal duties regarding takedown so long as it applied these terms and conditions properly.

Although some service providers may be tempted to impose stricter terms and conditions than the OSA to avoid the hot potato of illegal content judgements, many user-to-user services will prefer relaxed terms and conditions so as to on-board more users attracted by the idea of free speech. More users equals more engagement, which can boost the platform’s advertising revenue.  

What happens if a service becomes aware of illegal content?

Both user-to-user and search services are required to implement measures to prevent the dissemination of illegal content.  Search services must have mechanisms in place to identify and remove illegal content from search results, as well as taking steps to prevent such content from being indexed or displayed prominently in search listings. User-to-user services are required to put in place content safeguards to protect users from encountering harmful or illegal material on their platforms. 

Most importantly, where a search provider is alerted to the presence of any illegal content, or becomes aware of it in any other way, it is required to swiftly remove such content (Part 3, Chapter 2, s.10(3)(b)). Failure to do so could lead to enforcement action by Ofcom.

Services are not obliged to report illegal content to law enforcement unless it is subject to requirements to report CSEA content to the National Crime Agency (“NCA”), as set out in section 67 of OSA.  Nonetheless, Ofcom has noted that many services already work closely with the police and other enforcement agencies, and it certainly does not intend to discourage them from continuing to do so.

Non-compliance with duties

Ultimately, Ofcom regulates the services captured by the OSA and has powers to enforce compliance and impose fines of up to £18 million or 10% of global annual turnover (whichever is higher). Ofcom could also apply to the court for ‘business disruption measures’ such as blocking non-compliant services (Part 7, Chapter 6, s.144(1)), which would require Ofcom to first consider whether the grounds as set out in Part 7, Chapter 6, s.144, ss.(3) or ss.(4) apply in relation to the service. The grounds in ss.(3) are that (a) the provider has failed to comply with an enforceable requirement, (b) the failure is continuing, and (c) the provider has either failed or is likely to fail to comply with a requirement imposed by a confirmation decision. Alternatively, they have either failed to pay a penalty imposed by a confirmation decision, or the circumstances of the failure or risks of harm to individuals in the UK make it appropriate to apply without provisional notice of a confirmation decision. The grounds set out in ss.(4) are that the provider of the service has failed to comply with a notice under s.121(1) relating to the service (i.e. notices dealing with terrorism or CSEA content) and that failure must be continuing. Furthermore, Ofcom can bring criminal sanctions against individuals at a senior level within such providers who obstruct its investigatory powers.

The regulator’s draft Online Safety Enforcement Guidance is at pains to clarify that Ofcom will not be pursuing enforcement action against every potential compliance breach. The regime is targeted at online safety systems and processes of services rather than regulating individual pieces of content found on these services. It also states that:

 “The presence of illegal content […] does not necessarily mean that a service is failing to fulfil its duties in the Act. We would not therefore necessarily take enforcement action solely based on evidence of harmful content appearing on a service.

“However, evidence of especially harmful material or the prevalence of harmful material on a service (particularly if it is on a service for a prolonged period of time without being removed or presents a particular risk to children because of the type of regulated service on which it appears), would be a potential indicator that a service’s systems and processes were insufficient to protect users from such content. This may be relevant to our assessment of whether the issue is a priority for Ofcom such that enforcement action may be taken following our investigation of the issue.”

Scope

The OSA is wide-ranging in territorial scope – the internet does not recognise geographical boundaries and nor does the OSA.  Overseas service providers with “links to the UK” and are not exempt by virtue of Schedule 1 to the Act (a tightly defined category including services provided by public bodies to exercise their functions and user-to-user services where the only user generated content is either emails/SMS/MMS messages or the ability to post comments generated by the provider itself – such as clicking a “like” button) are caught by the OSA. “Links to the UK” – defined in Part 2, s.4 (ss.5) and (ss.6) – broadly refers to those who target the UK market and/or have a significant number of UK users.

Conclusion

Despite the OSA creating new offences such as false communications and cyberflashing, as Tim Berners-Lee said in 2014, “Some things are just illegal, child pornography, fraud, telling someone how to rob a bank, that’s illegal before the web and it’s illegal after the web.”  In some cases – for instance, child pornography and obvious fraud – it may be easy for service providers to spot illegal content and exercise their duties in compliance. However, the challenge for service providers will be addressing the grey areas and untested boundaries of what constitutes illegal or harmful online content, particularly where offences can be inchoate or infringe on the right to freedom of expression. Service providers could potentially suppress individuals’ Article 10 ECHR rights of freedom of expression by using their own judgement to decipher what is harmful and removing users’ generated content. It is questionable whether Ofcom’s approach – which currently appears to be concerned with systemic failures rather than one-off breaches – will remain so forgiving once service providers have had the opportunity to get their houses in order.

First published in New Law Journal on 4^th October 2024.