...of clueless government ministers failing to have basic grasps of technology and the web.

Why is it less important to protect people on a small site than it is on a big site? Sure, it's expensive, but you can make exactly the same argument for health and safety legislation; big chain stores should have to make sure their products are in date and the shop isn't a dangerous place to walk around cos they can afford it but it's too expensive for small shops to do that so they shouldn't have to do anything to make their shops safe and they can sell out-of-date food if they want to.

Shops aren't run by hobbyists doing it out of love and passion. They're businesses. And use by dates are easier to define than "hate speech" or whatever else people are meant to be protected against.

So - why is it OK that people aren't protected when they are on a hobby site?

You think that these new laws are going to meaningfully protect people? They are largely a bureaucratic burden that is more likely to stifle and kill off small positive sites than reduce existing problematic behaviours. We will lose more than we will gain.

There are already laws protecting against defamation, harrassment, hate, etc - so people are not without protection; the problem is getting the existing laws applied. Got a problem, take a crime report number.

Small shopkeepers are required to ensure that their properties are safe (just as homeowners are rerquired to ensure their homes are safe for visitors - even uninvited ones); shopkeepers are also subject to merchantability laws. However, they might not be required to do all the same paperwork or meet all the same standards as a large store simply because the degree of risk is much less with around 50 visitors a day compared with 2000 a day.

Unfortunately this looks like typical UK 'gold plated' legislation dreamt up by professional bureaucrats and written in the broadest catch-all terms. Ministers will once again say that "it is not intended to ..." - but these words are worthless as it is only the words written in the statute that will be used in determining the application of the law.

For the tech giants the penalties might be a rounding error in their legal department's budget, for small concerns it will be a death knell. Why would anyone want to volunteer to do something positive when the consequences could be personal ruination.

You still haven't answered the question - and I suspect that no one will. Small shops have exactly the same health and safety responsibilties as large shops and the law makes no recognition of size of the business in the case of an H&S breach.

The main problem here is the prevailing view that everything on the internet should be free. If these small hobby sites are so useful to their members then their members won't mind paying a nominal fee to use them and that fee could be used to pay for compliance. You can imagine a Shopify-type setup which provides a compliant set of policy and procedure docs, online training and away you go - follow the rules and you're OK. The problem is, of course, that no matter how "valuable" these sites are claimed to be for their users, when that value is tested then most of the time they come up wanting and about 0% of their users are willing to pay a few quid a year to use them. I really like the Reg. It's the only tech site I read and the only internet site I comment btl on, mainly cos its a nice relatively twat-free zone and there's no stress coming here - not even the downvotes I'll get for these posts. If the Reg started charging me to have an account for commenting I'd stop commenting and if the Reg went behind a paywall I'd almost certainly stop reading it.

You've answered your own question: "If the Reg started charging me to have an account for commenting I'd stop commenting and if the Reg went behind a paywall I'd almost certainly stop reading it."

Small hobby forums only exist because they're free to use, and run by volunteers. They provide much useful benefit and almost entirely zero risk of being used for online harm.

This is nothing like a shop, which is a business. It's more like requiring all community noticeboards to be risk-assessed and monitored by a named person just in case someone pins up a pornographic image: it's possible that someone could do so, but vanishingly unlikely.

'the law makes no recognition of size of the business in the case of an H&S breach.'

Wrong. The Health and Safety at Work Act applies to all organisations above a certain level of employees. The mantra being ' 5 or more or over 4'

The H&S act applies to all businesses. If someone gets killed or injured in a place of business because the business owner is negligent there is no defence of "there are only two employees so we don't have to do H&S".

Again, you are wrong. The Act applies as stated previously therefore 'the law does make recognition of size of the business in the case of an H&S breach.'

That doesn't mean to say that just because you have less employees than specified you are are absolved of all responsibilities. It the case of your ludicrous ' selling out of date food' scenario the 'Act' wouldn't apply for any size of organisation however other legislation would. Most likely in that case it would be covered by Trading Standards legislation.

In the case of 'someone gets killed or injured in a place of business because the business owner is negligent' other overlapping legislation would apply if the organisation is smaller than the stated requirements but not the H+S at Work Act.

I think you're unwilling to accept the answers that have been given. This legislation applies right down to a village run website, which will never have sufficient traffic or 'value' (in your miserable monetary sense) to justify or pay for someone doing a few days worth of legally consequential work.

And the obligation is so severe and vaguely worded that it is like asking your local village store to provide complete supply chain tracking for anything they sell, or face a multi million pound fine.

Most of your argument is the usual 'think of the children' nonsense, relying on the fallacy that no amount of busy work is too much if there is some vague threat that it might tangentially prevent.

"So - why is it OK that people aren't protected when they are on a hobby site?"

The question is invalid - it presupposes that they *are* protected elsewhere, or that the actions to be taken will meaningfully protect them.

Yes but this is more like having your corner store get a team of lawyers to confirm in writing with each of their suppliers that their products don't contain weapons of mass destruction.

Fairly easy if your Costco, a little expensive for a corner shop.

Corner stores have exactly the same liability for the goods and services they provide as do multiple retailers. And, in reality, it's corner stores that are more likely to be selling counterfeit products and knocked-off stock. Yes, it's harder to make a profit on small margins at small volumes but that's not usually an acceptable excuse for lower standards.

Community websites were previously liable to the same extent as big tech for compliance in areas such as libel and illegal contents. They really ought already to have a policy for dealing with it. In future the responsibilities will be more proportionate to the scale of the risk.

What's new is that you must conduct a risk assessment - that doesn't require lawyers or, for most cases, a great investment of itme. But it does require thinking about the possible consequences of what you're doing. If the risk is low, you need to have a stated content policy, a clear channel for reporting inappropriate content and a mechanism for removing it. That's not much different to your current responsibilities, except it's now explicit.

There's an entry-level of responsibility in providing services of all kinds. In this case it's pretty minimal. If you don't want even that level of responsibility, don't do it. There are plenty of other places you can take your group conversation where it's already taken care of. If you want to volunteer to work with children or vulnerable adults - or even provide community meals in the local church hall - you'll be dealing witch considerably higher compliance requirements for activities of considerably greater social value.

But this doesn't scale with the goods. The corner shop buys the goods from reputable wholesalers and assumes they are responsible for the quality that they pay for,

This is like putting all the health and safety requirements for the entire supply chain on the teenager at the counter.

The reason is obvious, the lobbyists paid for the legislation, small local community PHP forums will close down and you will be forced to move your parish Bell Ringing meetup to Whatever-Facebook-Is-Called-Today and the failed cabinet minister behind this will be given the job of vice-president of community at Whatever-Facebook-Is-Called-Today

This is all designed to put an extra burden on small players while the big ones just shrug their shoulders and continue doing whatever they where doing...

(I can definitely see Ofcom getting a poop-emoji from Twatter as a reaction to their request...)

Government has been almost completely captured by the global corporations, who long ago realized that almost all regulation was to their benefit. The rest of the harm has been done by bureaucrats who only want to expand their department.

This! Very definitely. We've seen the burden of State control of us proles increasing steadily over at least the last 2 decades. It's not just a Left- wing thing either - the Tories seem to have been just as willing to circumscribe our freedom to do stuff in the name of various Menckenian Hobgoblins.

Besides the direct compliance costs there's the risk of trolls shutting down the site and exposing the operators to liability by putting up objectionable material and reporting it. There's possible ways around that, but they either kill engagement on the site or require more investment in tech &/or moderators than a single forum operator is likely to be able to handle. This act is going to kill a lot of UK blogs and forums, and I really doubt it's going to put a dent in the availability of child porn or terrorists info or drugs.

No but it does help big sites remove the competition. Handy if you're a deputy PM hoping for a job when you lose an election

I get the feeling that many non-UK websites may end up geofencing the UK so as to not have to worry about this legislation. And the UK websites will end up closing down.

Guess I'm gonna have to start using my VPNs geolocation changing facility, and start visiting non-UK websites.

.

Is TheReg having to go through this BS as well?

"Below-the-line" comments [1]are exempt , but then again have you seen the comments on the Mail, Sun, BBC Speek Yur Brainz, etc...? Perhaps they should be covered after all.

[1] https://www.taylorwessing.com/en/interface/2022/the-online-safety-bill---the-uks-answer-to-addressing-online-harms/online-safety-bill-are-you-caught

El Reg doesn't just have comments on stories, there is a whole [1]user forums section too

[1] https://forums.theregister.com/section/user/

I forgot about them. Probably as good a reason as any to knock them on the head, they're pretty dead.

I thinik theres possibly another way this could be achieved would be to have a DNS record similar to the SFP for email. It could work thus:

TXT "child-safe:true, min-age=13, country=GB"

min-age (see film classifications or something similar)

country (2 letter country code)

- Any website without this record is classed as child unsafe by default.

- Perhaps social media sites could be classed as adult only by default (we'll simply single out the big ones here: any owned by publicly traded company )

- Parents enable parental controls, any time their kid goes to a new website with say a PG or is less than their age the parent gets a notification of the URL so they can check the site and has a log of what they're looking at, then the parent can allow or deny. This should be pretty trivial to implement on all devices and can operate solely on those devices i.e. doesn't need the cloud to compute whether a site is safe or not.

Obviously this is still marking your own homework, but so is the current law also who decides what's safe for their children? the current law doesn't define it and its moving goal posts this gives the tools to parents. The nice thing is this would work globally for everyone, although the age classifications depending on territory could be challenging... but DNS zoning does exist so maybe it would work even with that and using a VPN to a different country.

Connect to a VPN, or even directly to a website, by its raw IP address then, and bypass the whole DNS palaver. Or use DoH. Or a private proxy server running on a domain you control. All stuff I could do at 13 (except for DoH, which mercifully hadn't been invented then, and never should have been, IMO) and presumably many more teens could today.

There's no technical solution here that works for all cases, or that can't be circumvented somehow. The solution isn't to try to legislate or solutionise the problem away, but to apply the existing laws properly, fund police forces to run proper cyber-crime divisions, and tell parents to stop being lazy and pay more attention to what their kids are doing on the computer.

On that last note - I was 15 before I got a private computer in my own room. Prior to that, all my screen time was monitored because the family PC was in the living room, with the screen in full sight from there and the kitchen at all times. And I had a mobile, but I didn't get a smartphone until I was away on my own - prior to that, all I got was a dumb Sony Ericsson, and it did me just fine. If parents want to control their kids' access to the web, they don't need fancy technological solutions, they just need to pay attention and put in a little effort!

Wouldn't a bit field be more flexible?

Then you can code if your 21 year old can see boobies but not alcohol

Or your 12 year old can see ads for machine guns but not Kinder Surprise

Oh piss off.

That's stupidly vague. A train timetable could be information of use to a terrorist, in the right circumstances.

Reading on in the linked document:

"Possession of extreme pornography offence" - kindly define extreme.

"Offences related to articles for use in fraud" - to silence criticism of the banking industry? They're the biggest fraudsters around.

"Foreign interference offence" - so why haven't they demanded Musk be extradited?

>kindly define extreme.

Anything you wouldn't want your wives or servants to see. Especially anything involving game keepers.

This will be a bit like speed-limits on the roads. It is only enforced if you have resource to catch people. Ofcom lack the ability to police and protect the radio spectrum (outside of safety-of-life services). I cannot see, short of employing thousands of people, how they can police every web-forum (and others) in the UK. And what if you set-up your forum with a non UK gTLD and claim it is outside the UK? They are going to have to pester a lot of DNS registrars to find out who owns what in order to chase them.

But, the corollary is that they can take action against anyone if they have a reason to. So "small forum with no problems" could be trolled & reported, then OfCon prosecute the person who runs it who ends up with a criminal record and their life ruined. That's quite a risk.

It looked to me that the penalties were civil, not criminal. Perhaps I missed something?

Unless they decide it comes under some vaguely defined terrorism or computer misuse act - but that would never be misused for trivial offenses

#include < stories_of_local_council_using_RIPA_fly_tipping_dog_shit_leaving >

I suspect the concern is the amount of work needed to have the risk analysis document and the relevant counter-measures ready just in case that is the issue.

I gather that OFCOM has to finance all activity under this act through fines received so I suspect they will be after larger concerns that are flagrant in their defiance initially.

Unless you have a corporate level legal dept., you may as well take down all Web 2.0 interactivity.

So, why is it like this? Three reasons. Some folk in government want to end the ability of individuals to broadcast their opinions or dirt they have on the wealthy and powerful - #MeToo etc. The Horizon scandal took years of concerted pressure from 'Private Eye' to gain traction. The #MeToo movement was much quicker. Public voices on the net make it harder for the rich and powerful to get away with corrupt and evil stuff and hide their failures, so obviously they will suppress Web 2.0. Second, incompetence - the British govt. lacks competence all over, and decent, competent people just don't want to work with them [in part because they do stuff like this]. Finally, activists. This is the age of the screechy activist. Protect the children from the evil internet. Because they were all fine before the net, and their parents have no role in such things. One person suffering from hurt feelings is one too many. Nazi types can leverage this into bans very easily.

China, Russia and Iran already do this. Australia and the EU will follow the UK. Our internet is being taken away from us piece by piece, because it empowered us at the expense of the idiots who ru(i)n our countries.

What can we do? Some distributed services may fill in the gap, but we are in the same place as the Chinese and the others - we can do toss all. Just hate your government for what it is doing and what it is taking away from you. Vote whatever regime you have out at the earliest opportunity. What replaces them won't be any better, but seeing a bunch of them forced to remove their snouts from the trough for what they have done, and leave, feels good. It's all we have as the quality of life in our Orwellian dystopia continues to decline.

I haven't looked at the legislation, yet. But if you are a small, text-based forum, do you even need to bother with the risk assessment? You, ahem, do it when Ofcom write to you and backdate it knowing every case will be low risk.