Friday, June 26, 2026

The UK's proposed under 16s social media ban is ill-considered

 When the history of the first quarter of the 21st century comes to be written, it will record a period when we took the greatest communications medium in the history of humanity – the internet – and turned it into an invasive, toxic, mass surveillance machine, beyond even George Orwell’s imagination.

For generations, the four horsemen of the infocalypse – terrorists, drug dealers, child abusers and organised crime – have been the staple justifications of choice for a smorgasbord of laws intended to tackle these evils. The Labour government between 1997 and 2010 introduced more than forty major serious crime and counter-terrorism laws.

During the same period, unfettered, private sector mass surveillance & profiling, of a scale unthinkable before the turn of the century, plus addictive, attention- grabbing apps and social media algorithms, became established as the core business model of the internet.

The most profitable firms in the world either monetise or otherwise exploit data through stalker advertising and profiling and/or provide software and hardware services and infrastructure to the economic & state actors who do.

The technology systems built and rolled out by those companies are used, extensively, by states which, like commerce, have a voracious appetite for personal data, in the whole gamut of government services from law enforcement, health and social welfare to border control, military, security and intelligence.

In the wake of the 11th September, 2001 attacks, counter terrorism became the primary excuse for western governments’ expansion of mass surveillance. By the mid-2010s, it remained a core theme for government but the terrorism mantra was wearing thin and the prominent pretext for surveillance moved to immigration and border control.

In parallel, child protection and “online safety” became high profile vehicles for a collection of demands that something must be done about the negativities of the internet and the unethical behaviour of the big technology corporations. By 2023 that led to the introduction by the UK of the Online Safety Act, a complex piece of legislation with the “general purpose of making the use of internet services… safer for individuals in the United Kingdom” through imposing a duty of care on online services providers.

One of the primary effects of the Act seems to have been a boon in the market for age verification services. And, indeed, VPN services, which the government are also now considering restricting. Section 12(4) of the Act mandates the use of age verification or age estimation to prevent children from accessing harmful content. Section 12(6) says this age verification should be “highly effective”. In short, dear reader, age verification is not marginally, let alone highly effective and declaring a mandate for highly effective technology in a statute does not, magically, bring it into existence.

Ahead of the Makerfield byelection and his likely replacement by Andy Burnham, the UK Prime Minister, Keir Starmer, with his teen social media ban proposal, announced plans to polish a capstone on his legacy, such as it is, by forcing everyone to wade through some form of identity and/or age verification service before using the internet. The Open Systems Interconnection (OSI) model - seven layer model of the internet – is about to get an eighth layer in the UK, the insecure layer, if the October 2025 Discord data breach compromising 70,000 users, including their government issued ID images, is anything to go by. Mr Starmer’s insecure layer, retrofitted to a toxic mass surveillance machine, will compromise the privacy and security of every internet user, including children, whilst failing to improve child safety.

Last week the Science, Innovation and Technology Committee of Parliament, following an inquiry on the digital centre of government, published a report Rewiring the state: Delivering digital government.

The report is scathing on government information & data security (highlighting Biobank breaches), unsubstantiated hype about a claimed £45 billion per year savings from digital services, government plans for digital ID (noting operational and security problems relating to the eVisa system and One Login’s temporary loss of certification against the government’s own digital identity framework). On digital sovereignty the report expresses concerns that "The UK’s reliance on a small number of US-based providers for digital infrastructure and public service delivery is a strategic and economic vulnerability."

Most notably, in the context of the proposed teen social media ban, however, it declares government ignorance of technology, “enthusiasm from non-experts at the top” combined with “insufficient skills at the coalface” to be a “dangerous” combination. Dangerous is the word for it, particularly for those teens who rely on internet access for social, educational and mental health support, often exclusively because they cannot find that support elsewhere.

The petition to parliament not to go ahead with this ban has already, at the time of writing, passed 200,000 signatures.

A prime minister serious about child protection would firstly insist on enforcing existing regulatory measures, such as the UK GDPR articles 8 and 9, against social media companies and secondly, pursue orders of magnitude greater investment in social and sports facilities and infrastructure, children’s services, parental support, social welfare, education, health, mental health services and, where necessary, policing; with properly coordinated, local interdisciplinary teams across all these services working in tandem, the whole being greater than the sum of the parts.

Also, as Cory Doctorow says, we need to protect kids from online surveillance, the precise opposite of what the UK government is proposing: “Your kids can't be targeted by algorithms without the surveillance data that's being used to target them. They can't be funneled into pro-anorexia content or extreme misogyny forums without that funnel being primed by commercial spying.”

Peddling a headline grabbing social media ban is just another ineffective but also corrosive and dangerous attempt at a quick fix to a challenging and complex sociotechnological problem. If, however, after two and a half decades of digital technology enabled mass surveillance and failed government technical quick fixes in relation to all four infocalyptic horsemen, you still believe the PM’s claim that a social media ban decimating everyone’s privacy is the solution to the complex issue children’s safety, I wonder if I could interest you in the purchase of a couple of bridges, one in London, one in Brooklyn?

Wednesday, June 17, 2026

Court of Appeal Palestine Action proscription judgment - the Home Secretary's national security blanket

The Court of Appeal has decided the Home Secretary was right to designate Palestine Action a terrorist organisation

Press Summary - Huda Ammori v Secretary of State for the Home Department
Appeal No: CA-2026-000583
Neutral Citation Number: [2026] EWCA Civ 721 

 Apparently, amongst other things, "The Divisional Court... adopted an excessively analytical approach to the interpretation of the Proscription Policy." (Para 88 of the judgment). An appeal court admonishing a lower court for being excessively analytical requires a closer look... 

On a first scan, the judgment appeared to be saying a Home Secretary has a licence to do whatever they like, as long as they cite national security as the justification. A close read of the whole thing confirms that impression.

The Court seems to have started with the outcome they wanted and worked backwards from there, focussing on deference to the Home Secretary on matters of national security. Basically they declare the Divisional Court at first instance was wrong because they didn't show sufficient deference to or respect for the Home Secretary; and if it wasn't for that pesky Human Rights Act, they would not have had to go to the trouble of dealing with this nonsense of questioning the government.  We don't know what classified evidence they considered in the closed hearing but if the selective quotation of the evidence we do know about is a guide it won't have made a great deal of difference. 

Section D of the opinion, paras 21-32, is quite a nice summary of how wide ranging and wide reaching the Terrorism Act 2000 is. It really does vastly over specify what might count as terrorism to a degree most people are not aware of. As the UN Special Rapporteur on counter-terrorism and human rights pointed out to the Court and multiple human rights experts have made clear over the years, the Act's definition of terrorism is excessively broad and wrongly conflates ordinary criminal acts with terrorism, in breach of UN standards.

Moving rapidly on to paragraph 48, Lady Carr of Walton-on-the-Hill, CJ (delivering the judgment of the court) says:

 

 The Joint Terrorism Analysis Centre JTAC report did state that Palestine Action (PA) could be considered terrorists under the wide definition of terrorism in the 2000 Act but also emphasised that PA stressed its non-violent action against people. 

Onwards to paragraph 81, the Appeal Court judges consider that when policies include awkward details that might interfere with what a Home Secretary wants to do they should not be "read in a complicated or excessively analytical way". Policies "are not rules, but guides" and they are not there to constrain the Home Secretary.

 

Paragraph 87 & 88 - Even if the Divisional Court was right that the policy constrained the Home Secretary, she could still consider operational benefits. So is it ok for a Home Secretary to proscribe an organisation if the operational benefits amount to government, political, policing or other public service convenience?

 

 Paragraph 104 - The Court would not be reviewing the Home Secretary's decision at all if not for the Human Rights Act. But since they have to, they "must... respect... the balance of rights... struck by the Home Secretary".

 

Section M of the judgment, para 104 to 117 on the margin of appreciation rejects Liberty, Amnesty International and UN special rapporteur on human rights submissions to the Court, emphasising government and Home Secretary perspectives on national security should be deferred to.

  

  Section N, para 118 to 182, on the Court's evaluation of the proportionality of proscription again is about deferring to the Home Secretary on national security. When the Home Secretary designates an organisation terrorists, proscription is proportionate. 

 

 

In paragraph 152, agreeing with the Divisional Court, the appeal judges quickly dismiss the plight of the thousands of pensioners arrested for terrorism offences while protesting the genocide and the proscription of Palestine Action. People opposing genocide and supporting Palestine Action "ought to have realised" they were wrong. 

The judgment then basically says, at paragraph 153, that "many people may be subject to [a] chilling effect" but that chilling effect is not real if there is no legal jeopardy. I'll be blunt here. That is simply illogical.

 

 At paragraph 164 Palestine Action are judged to have "little or nothing in common with the suffragettes or the anti-apartheid or Iran War protest groups" and the Home Secretary & her advisers are best placed to assess them as "a threat to third party individuals and property". Let's just be generous and suggest the Court's sojourns into history, particularly when using the suffragettes as an exemplar are ill-advised. Left wing journalist, Owen Jones, is a little more severe: "The lady chief justice has desecrated our history - and erased the truth about activists who fought for the rights of women like herself." 

Para 171 to 174 says proscribing Palestine Action degrades the organisation and its finances - a "key benefit" - and the Home Secretary was best placed to make that decision given matters of national security.

At para 175 the Court say they looked at all materials available to the Home Secretary, open and classified and "are satisfied that the Proscription Decision was a justified and proportionate interference with ECHR rights."

There is one small dent in the Court's absolute deference to the Home Secretary at paragraph 180 where they admit that the Home Secretary's proscription decision "may have been borderline."

But 

 But that doesn't matter because she had the latitude to make the decision and she was right...

 

They then conclude the Home Secretary should be deferred to on matters of national security or matters she decides to be national security related. The Divisional Court erred on interpreting the proscription policy and on assessing proportionality. Palestine Action are correctly designated terrorists. 

 


 

In light of this Court of Appeal decision it is worth reading the Joint Terrorism Analysis Centre (JTAC) proscription assessment report on the group. JTAC specifically state their assessment that Palestine Action is a terrorist group is entirely based on the broad definition of terrorism in the 2000 Act which considers criminal damage to property to be terrorism. They also report that the majority of the direct action undertaken by Palestine Action would not be classified as terrorism, even under the broad definition used in Section 1 of the Terrorism Act 2000

 

 

 

 

The overriding impression, as I noted above, is of a court that started out with the outcome it decided it wanted and worked back from there to mould their reasoning to that outcome; the core theme being absolute deference to the government and the Home Secretary, in particular, when it comes to matters of national security. It is a license for government to cite national security as an excuse for any action. I've taken to considering it the Home Secretary's national security blanket.

For what it is worth,

I oppose genocide.

I oppose the state of Israel's ongoing genocide against the Palestinian people. 

I do not support Palestine Action.

Unlike the Appeal Court judges, I remain unconvinced that proscription, in this case, is proportionate. 

 

Monday, May 18, 2026

ICO publishes advice to government on diluting online advertising rules

 In September last year I submitted a response to the ICO consultation on their approach to regulation of online advertising.

Today I got an email from the ICO's interim Group Manager - Online Tracking:

Thank you for your response to the ICO’s call for views on our approach to regulating online advertising last year.

I am writing to let you know that today we have published the outcomes of our review of regulation 6 PECR requirements for online advertising purposes.

Please see a blog from Executive Director for Regulatory Risk and Innovation, William Malcolm, with an overview of the work:  Our advice to government on potential changes to online advertising rules | ICO

We have also published:

Separately, you may be interested in the progress update on our Online Tracking Strategy, published in April: Online tracking strategy update – April 2026 | ICO

Many thanks again for your input to this work.  

 Let me quote from just one of the documents linked, the ICO report for DSIT: Advice on a viable approach to creating online advertising exception(s) to regulation 6 PECR, Section 6, page 29:

"Our proposed approach would offer a new way to deliver online advertising without consent. It wouldn’t revolutionise the ecosystem, but it would provide a way to provide publishers with new revenue opportunities for users who they currently can’t legally deliver any online advertising to, because they don’t grant consent."

The UK data protection authority is proposing to government "a new way to deliver online advertising without consent."  

As the Open Rights Group said recently

Your data is precious. It reveals who you are, what you like, where you live and much more. Lots of people and organisations want to get their hands on it – including governments who want to track us, companies that want to profit from us and criminals who want to steal from us.

This is why we need strong data protection laws and a strong regulator who will make sure they are followed.

In the UK, this regulator is the Information Commissioner's Office's (ICO) and they are failing to to protect our data privacy.

Sign the petition for a reset of the ICO.