SOAS ICOP Policy Briefings
To Inform Government and Parliamentary Debates
Online Safety Bill “spy clause” requires Chat Platforms to Scan Private Messages by Dr
Monica Horten, Open Rights Group (2nd December 2022)
The Online Safety Bill is intended to protect children from harmful content. However, it includes arequirement for private messaging (chat) services to intercept and scan the posts of every user beforeupload. This prospect raises deep concerns around interference with privacy and a chilling effect on
freedom of expression. It is a massive expansion in surveillance capacity hidden inside the bill.
More than 40 million British people “chat” every day: Private messaging or chat services are a vitalmeans of communication for many people. These services have largely replaced old-fashioned phones
in daily life, whether for trade and business, or messaging with extended relatives, such as
grandparents. Chats are used around the clock at home, work, and leisure. There are over 40 million
users in the UK, on platforms such as WhatsApp, Telegram and Signal.
Invisible measures: The mandate for chat services to scan is almost invisible due to the obtuse draftingof the Bill. The intended meaning of ‘content communicated publicly or privately’ [S.188 & S.192]
brings private chats in scope of the Bill. S.104 [NC11] gives Ofcom unprecedented powers to require
what is in effect a form of mass surveillance.
Intercept and scan private messages: Compliance with S.104 [NC11] would mean, in practice,interception and scanning chat messages on an ongoing basis, to seek out and identify images andvideos in accordance with a government mandate, and then remove them or prevent access. AI-based
systems would look for matches of content in a database using digital fingerprints, and may also use
text-based classifiers. Ofcom’s powers could impose “‘accredited technology’, a content moderation
system [S.187] designed to government- approved standards [NC11 (2) (b) (ii)].
Compromise security of messages: The end-to-end encryption (E2EE) that provides security formessages and guarantees confidentiality would be compromised. Likely technical solutions involve
creation of “back doors” in the code, or scanning images on the user’s own phone (client-sidescanning). The latter is thought to be the government’s favoured approach, but is not specified in theBill. Both methods put at risk the security of messages across the whole system. It’s a template thatis ripe for abuse by a less benign government, a hostile state or bad actors.
Flawed Impact Assessment: The government’s Impact Assessment assumes stronger privacy
protection that has been deleted from the Bill, reflecting a failure of due diligence in policy-making.
Disproportionate interference with privacy: This is a disproportionate measure, asking privatecompanies to conduct surveillance on behalf of the State, without suspicion or warrant. It’s like putting
a spy in everyone’s pocket. It ignores less intrusive ways to address the policy aim of tackling childsexual abuse. There is no independent authorisation or oversight. The government should balance thepolicy aim against the intrusiveness of the measures.
MPs are urged to drop this dystopian requirement and keep UK citizens safe from mass surveillance
and:•Delete the word “privately” and remove the “spy clause” [S.104 / NC11]•Call on the government for a full review and impact assessment of these measures

For further information contact the author at info@openrightsgroup.org. Contact Professor Alison ScottBaumann for access to other experts at as150@soas.ac.uk, and visit our website for more information. The views
expressed in SOAS ICOP Briefings are those of the authors and do not necessarily represent those of SOAS.