The UK's proposed under 16s social media ban is ill-considered

 When the history of the first quarter of the 21^st century comes to be written, it will record a period when we took the greatest communications medium in the history of humanity – the internet – and turned it into an invasive, toxic, mass surveillance machine, beyond even George Orwell’s imagination.

For generations, the four horsemen of the infocalypse – terrorists, drug dealers, child abusers and organised crime – have been the staple justifications of choice for a smorgasbord of laws intended to tackle these evils. The Labour government between 1997 and 2010 introduced more than forty major serious crime and counter-terrorism laws.

During the same period, unfettered, private sector mass surveillance & profiling, of a scale unthinkable before the turn of the century, plus addictive, attention- grabbing apps and social media algorithms, became established as the core business model of the internet.

The most profitable firms in the world either monetise or otherwise exploit data through stalker advertising and profiling and/or provide software and hardware services and infrastructure to the economic & state actors who do.

The technology systems built and rolled out by those companies are used, extensively, by states which, like commerce, have a voracious appetite for personal data, in the whole gamut of government services from law enforcement, health and social welfare to border control, military, security and intelligence.

In the wake of the 11th September, 2001 attacks, counter terrorism became the primary excuse for western governments’ expansion of mass surveillance. By the mid-2010s, it remained a core theme for government but the terrorism mantra was wearing thin and the prominent pretext for surveillance moved to immigration and border control.

In parallel, child protection and “online safety” became high profile vehicles for a collection of demands that something must be done about the negativities of the internet and the unethical behaviour of the big technology corporations. By 2023 that led to the introduction by the UK of the Online Safety Act, a complex piece of legislation with the “general purpose of making the use of internet services… safer for individuals in the United Kingdom” through imposing a duty of care on online services providers.

One of the primary effects of the Act seems to have been a boon in the market for age verification services. And, indeed, VPN services, which the government are also now considering restricting. Section 12(4) of the Act mandates the use of age verification or age estimation to prevent children from accessing harmful content. Section 12(6) says this age verification should be “highly effective”. In short, dear reader, age verification is not marginally, let alone highly effective and declaring a mandate for highly effective technology in a statute does not, magically, bring it into existence.

Ahead of the Makerfield byelection and his likely replacement by Andy Burnham, the UK Prime Minister, Keir Starmer, with his teen social media ban proposal, announced plans to polish a capstone on his legacy, such as it is, by forcing everyone to wade through some form of identity and/or age verification service before using the internet. The Open Systems Interconnection (OSI) model - seven layer model of the internet – is about to get an eighth layer in the UK, the insecure layer, if the October 2025 Discord data breach compromising 70,000 users, including their government issued ID images, is anything to go by. Mr Starmer’s insecure layer, retrofitted to a toxic mass surveillance machine, will compromise the privacy and security of every internet user, including children, whilst failing to improve child safety.

Last week the Science, Innovation and Technology Committee of Parliament, following an inquiry on the digital centre of government, published a report Rewiring the state: Delivering digital government.

The report is scathing on government information & data security (highlighting Biobank breaches), unsubstantiated hype about a claimed £45 billion per year savings from digital services, government plans for digital ID (noting operational and security problems relating to the eVisa system and One Login’s temporary loss of certification against the government’s own digital identity framework). On digital sovereignty the report expresses concerns that "The UK’s reliance on a small number of US-based providers for digital infrastructure and public service delivery is a strategic and economic vulnerability."

Most notably, in the context of the proposed teen social media ban, however, it declares government ignorance of technology, “enthusiasm from non-experts at the top” combined with “insufficient skills at the coalface” to be a “dangerous” combination. Dangerous is the word for it, particularly for those teens who rely on internet access for social, educational and mental health support, often exclusively because they cannot find that support elsewhere. 

The petition to parliament not to go ahead with this ban has already, at the time of writing, passed 200,000 signatures. 

A prime minister serious about child protection would firstly insist on enforcing existing regulatory measures, such as the UK GDPR articles 8 and 9, against social media companies and secondly, pursue orders of magnitude greater investment in social and sports facilities and infrastructure, children’s services, parental support, social welfare, education, health, mental health services and, where necessary, policing; with properly coordinated, local interdisciplinary teams across all these services working in tandem, the whole being greater than the sum of the parts.

Also, as Cory Doctorow says, we need to protect kids from online surveillance, the precise opposite of what the UK government is proposing: “Your kids can't be targeted by algorithms without the surveillance data that's being used to target them. They can't be funneled into pro-anorexia content or extreme misogyny forums without that funnel being primed by commercial spying.”

The Brazilian government, unlike the UK, Australia and many others proposing similar bans, has taken a different approach to provide for the protection of children in digital environments, Decree No. 12,880, of March 18, 2026. According to Victor Oliveira Fernandes, Brazil's National Secretary for Digital Rights, the decree tackles the problem at source by banning dark patterns and addictive design targetted at children, including infinite scroll, autoplay, time-based rewards, excessive notifications, obstruction of privacy controls and exploitative cognitive vulnerabilities. Maximum penalities can be 10% of a company's revenue in Brazil. It will be interesting to see how that plays out in practice. As Prof Fernandes admits, passing the law is only the start, it's efficacy will depend on how and how well it is enforced, what economic actors it covers and to what degree it causes a change in their unethical business practices.

Notably, the early evidence on the effects of an under 16s social media ban in Australia shows that it has led to little substantive reduction in reported social media use by adolescents under 16. It doesn't work.

Peddling a headline grabbing social media ban is just another ineffective but also corrosive and dangerous attempt at a quick fix to a challenging and complex sociotechnological problem. If, however, after two and a half decades of digital technology enabled mass surveillance and failed government technical quick fixes in relation to all four infocalyptic horsemen, you still believe the PM’s claim that a social media ban decimating everyone’s privacy is the solution to the complex issue of children’s safety, I wonder if I could interest you in the purchase of a couple of bridges, one in London, one in Brooklyn?

Court of Appeal Palestine Action proscription judgment - the Home Secretary's national security blanket

The Court of Appeal has decided the Home Secretary was right to designate Palestine Action a terrorist organisation. 

Press Summary - Huda Ammori v Secretary of State for the Home Department
Appeal No: CA-2026-000583
Neutral Citation Number: [2026] EWCA Civ 721 

 Apparently, amongst other things, "The Divisional Court... adopted an excessively analytical approach to the interpretation of the Proscription Policy." (Para 88 of the judgment). An appeal court admonishing a lower court for being excessively analytical requires a closer look... 

On a first scan, the judgment appeared to be saying a Home Secretary has a licence to do whatever they like, as long as they cite national security as the justification. A close read of the whole thing confirms that impression.

The Court seems to have started with the outcome they wanted and worked backwards from there, focussing on deference to the Home Secretary on matters of national security. Basically they declare the Divisional Court at first instance was wrong because they didn't show sufficient deference to or respect for the Home Secretary; and if it wasn't for that pesky Human Rights Act, they would not have had to go to the trouble of dealing with this nonsense of questioning the government.  We don't know what classified evidence they considered in the closed hearing but if the selective quotation of the evidence we do know about is a guide it won't have made a great deal of difference. 

Section D of the opinion, paras 21-32, is quite a nice summary of how wide ranging and wide reaching the Terrorism Act 2000 is. It really does vastly over specify what might count as terrorism to a degree most people are not aware of. As the UN Special Rapporteur on counter-terrorism and human rights pointed out to the Court and multiple human rights experts have made clear over the years, the Act's definition of terrorism is excessively broad and wrongly conflates ordinary criminal acts with terrorism, in breach of UN standards.

Moving rapidly on to paragraph 48, Lady Carr of Walton-on-the-Hill, CJ (delivering the judgment of the court) says:

 

 The Joint Terrorism Analysis Centre JTAC report did state that Palestine Action (PA) could be considered terrorists under the wide definition of terrorism in the 2000 Act but also emphasised that PA stressed its non-violent action against people. 

Onwards to paragraph 81, the Appeal Court judges consider that when policies include awkward details that might interfere with what a Home Secretary wants to do they should not be "read in a complicated or excessively analytical way". Policies "are not rules, but guides" and they are not there to constrain the Home Secretary.

 

Paragraph 87 & 88 - Even if the Divisional Court was right that the policy constrained the Home Secretary, she could still consider operational benefits. So is it ok for a Home Secretary to proscribe an organisation if the operational benefits amount to government, political, policing or other public service convenience?

 

 Paragraph 104 - The Court would not be reviewing the Home Secretary's decision at all if not for the Human Rights Act. But since they have to, they "must... respect... the balance of rights... struck by the Home Secretary".

 

Section M of the judgment, para 104 to 117 on the margin of appreciation rejects Liberty, Amnesty International and UN special rapporteur on human rights submissions to the Court, emphasising government and Home Secretary perspectives on national security should be deferred to.

  

  Section N, para 118 to 182, on the Court's evaluation of the proportionality of proscription again is about deferring to the Home Secretary on national security. When the Home Secretary designates an organisation terrorists, proscription is proportionate. 

 

 

In paragraph 152, agreeing with the Divisional Court, the appeal judges quickly dismiss the plight of the thousands of pensioners arrested for terrorism offences while protesting the genocide and the proscription of Palestine Action. People opposing genocide and supporting Palestine Action "ought to have realised" they were wrong. 

The judgment then basically says, at paragraph 153, that "many people may be subject to [a] chilling effect" but that chilling effect is not real if there is no legal jeopardy. I'll be blunt here. That is simply illogical.

 

 At paragraph 164 Palestine Action are judged to have "little or nothing in common with the suffragettes or the anti-apartheid or Iran War protest groups" and the Home Secretary & her advisers are best placed to assess them as "a threat to third party individuals and property". Let's just be generous and suggest the Court's sojourns into history, particularly when using the suffragettes as an exemplar are ill-advised. Left wing journalist, Owen Jones, is a little more severe: "The lady chief justice has desecrated our history - and erased the truth about activists who fought for the rights of women like herself." 

Para 171 to 174 says proscribing Palestine Action degrades the organisation and its finances - a "key benefit" - and the Home Secretary was best placed to make that decision given matters of national security.

At para 175 the Court say they looked at all materials available to the Home Secretary, open and classified and "are satisfied that the Proscription Decision was a justified and proportionate interference with ECHR rights."

There is one small dent in the Court's absolute deference to the Home Secretary at paragraph 180 where they admit that the Home Secretary's proscription decision "may have been borderline."

But 

 But that doesn't matter because she had the latitude to make the decision and she was right...

 

They then conclude the Home Secretary should be deferred to on matters of national security or matters she decides to be national security related. The Divisional Court erred on interpreting the proscription policy and on assessing proportionality. Palestine Action are correctly designated terrorists. 

 

 

In light of this Court of Appeal decision it is worth reading the Joint Terrorism Analysis Centre (JTAC) proscription assessment report on the group. JTAC specifically state their assessment that Palestine Action is a terrorist group is entirely based on the broad definition of terrorism in the 2000 Act which considers criminal damage to property to be terrorism. They also report that the majority of the direct action undertaken by Palestine Action would not be classified as terrorism, even under the broad definition used in Section 1 of the Terrorism Act 2000. 

 

 

 

 

The overriding impression, as I noted above, is of a court that started out with the outcome it decided it wanted and worked back from there to mould their reasoning to that outcome; the core theme being absolute deference to the government and the Home Secretary, in particular, when it comes to matters of national security. It is a license for government to cite national security as an excuse for any action. I've taken to considering it the Home Secretary's national security blanket.

For what it is worth,

I oppose genocide.

I oppose the state of Israel's ongoing genocide against the Palestinian people. 

I do not support Palestine Action.

Unlike the Appeal Court judges, I remain unconvinced that proscription, in this case, is proportionate. 

 

David Anderson QC asks and answers the question, "Do terrorists have human rights?"

Terrific  British Institute of International and Comparative Law (BIICL) 12 minute video, aimed at schools, where David Anderson explains the importance of the rule of law in the context of terrorism. He covers the outline and shape of UK law in this area and the fact that yes, those horrible people we suspect of terrorism or are convicted of terrorism are rightly entitled to human rights.

A question of trust: notes on the terror watchdog report

The Terror Watchdog’s Report

The UK government has finally got round to releasing the report of the investigatory powers review by the independent reviewer of terrorism legislation, David Anderson QC and his team. Mr Anderson submitted the report to the Prime Minister on 6 May, just prior to the general election.

As Mr Anderson predicted, the report “won’t please everybody (indeed it may not please anybody)” but it is a substantive piece of work and deserves careful reading and consideration in full. In the press release accompanying the 379 page report he says:

“Modern communications networks can be used by the unscrupulous for purposes ranging from cyber-attack, terrorism and espionage to fraud, kidnap and child sexual exploitation.  A successful response to these threats depends on entrusting public bodies with the powers they need to identify and follow suspects in a borderless online world.

  But trust requires verification.  Each intrusive power must be shown to be necessary, clearly spelled out in law, limited in accordance with international human rights standards and subject to demanding and visible safeguards.

 The current law is fragmented, obscure, under constant challenge and variable in the protections that it affords the innocent.  It is time for a clean slate.  This Report aims to help Parliament achieve a world-class framework for the regulation of these strong and vital powers.”

So far so good. 

The report itself summarises the importance of privacy, threats to the UK, technologies implicated, laws, powers, safeguards and practices and the views from a disparate variety of actors from law enforcement and the intelligence services to service providers and civil society. It closes with a set of 5 governing principles and 124 specific recommendations. It was not limited to counter-terrorism considerations but also included counter-espionage, missing persons investigations, internet enabled crime (fraud, cyber-attacks, child sexual exploitation) and crime in general. 

The purpose of the report is:

a. to inform the public and political debate on these matters, which at its worst can be polarised, intemperate and characterised by technical misunderstandings; and

b. to set out proposals for reform, in the form of five governing principles and 124 specific recommendations. 

I think it’s fair to say it succeeds with both, even if I can’t agree with some of the recommendations.  Mr Anderson has had unrestricted access, at the highest level of security clearance, to the responsible government departments whilst conducting his review.

Key issues arising from the report seem to be:

•               The need to start from scratch on a comprehensive and comprehensible, fit-for-purpose legislative framework for investigatory powers – including the retirement of the “incomprehensible to all but a tiny band of initiates” Regulation of Investigatory Powers Act (RIPA) 2000

•               Continuation of communications data retention under the Data Retention and Investigatory Powers Act (DRIPA) 2014

•               There should be judicial rather than Secretary of State authorisation of communications data warrants – the report itself describes this recommendation as “radical” departure

•               The approval of bulk collection of communications data.

•               Lack of acceptance of government’s glossy claims for the magic, unimpeachable value of government access to bulk communications data and recommendations for improved oversight of same

•               Approval of extraterritorial reach of DRIP Act, for now, until improved international framework for data sharing is in place

•               Abolition of existing oversight commissioners and replacement with Independent Intelligence and Surveillance commission

•               The power, in Theresa May’s beloved snoopers’ charter, for the retention of internet searches should only apply where “a detailed operational case can be made out and a rigorous assessment has been conducted of the lawfulness, likely effectiveness, intrusiveness and cost”.

•               An emphatic rejection of David Cameron & Theresa May’s notion of blanket encryption backdoors for government

 

Why Theresa and Dave are Glum

Though there is a lot in there, it’s becoming clear why the government delayed publication and both Theresa May and the Prime Minister’s spokeswoman seem to be already distancing themselves from the report.

You can understand why Theresa and Dave might be a bit miffed that Mr Anderson disapproves of blanket encryption backdoors (pointing out the agencies don’t want it and it would undermine security for everyone), has the nerve to suggest judicial rather than Executive oversight of interception warrants might be appropriate, kneecaps the snoopers’ charter and notes some of the claims about the value of communications data in the investigation of nefarious actors might be somewhat overblown.

You would expect them, however, to be positively dancing in the aisles as a result of his apparent support for the continuation of the bulk collection and retention of communications data and the continuation of the extra territorial reach of DRIPA beyond its sunset at the end of 2016.

I have to admit I share Privacy International’s disappointment that Mr Anderson didn't condemn bulk interception. However, whatever cheer the government’s senior Cabinet members derive from the nominal support for bulk collection will be tempered by Mr Anderson’s qualification of this approval by saying   "Though I seek to place the debate in a legal context, it is not part of my role to offer a legal opinion (for example, as to whether the bulk collection of data as practiced by GCHQ is proportionate). A number of such questions are currently before the courts..." [1.12].  

This continual emphasis in the report that he and the government should respect the courts as the requisite arbiters in determining the proportionality of indiscriminate bulk collection, within the framework of the European Convention on Human Rights (ECHR), is interesting. Even as he approves, also, of blanket data retention under DRIPA, he insists that retention would have to comply with the ECHR and the European Court of Justice decision in Digital Rights Ireland case in 2014, which banned indiscriminate data retention.

On the approval of the extra territorial DRIPA powers Mr Anderson is again careful to note:

"I understand those who argue that extraterritorial application sets a bad example to other countries, and who question whether it will ever or could ever be successfully enforced. It is certainly an unsatisfactory substitute for a multilateral arrangement under which partner countries would agree to honour each others’ properly warranted requests, which must surely be the long-term goal.”

So Mr Anderson’s report has turned out to be nothing like the useful excuse for pushing through the snoopers’ charter that the Home Secretary must have hoped it would be.

 

Why the report might not please anybody

It’s a real pity that, even within the constraints within which he was working, and the reasonable set of 5 principles outlined for underpinning investigatory powers, laid out in Part IV of the report, Mr Anderson did not condemn bulk collection of communications data. I accept it is not part of his role to offer a legal opinion on whether bulk collection is proportionate. 

Yet I find the justification for supporting bulk collection is rather weak and not commensurate with the deeper consideration of the rest of the report. It is linked to a principle of minimising no go areas for law enforcement as far as possible, whether in the physical or the digital world and justified on the grounds of 6 sample cases briefly outlined in Annex 9 of the report. None of these 6 cases provide the detail to demonstrate that bulk collection was the primary source leading to the identification of these criminals in the first instance.  

It is not in dispute that if law enforcement or the intelligence services have just cause to suspect some person/group of involvement in criminal activity, the availability of bulk data which includes the data of the suspect/s, will enable data mining that may be useful in an investigation. Bulk collection facilitates the significant discovery of multiple details about anyone once they become a suspect or a person of interest. Authorities simply do not have the resources to engage deep data mining the lives of everyone even if they have that data available.

Since the turn of the century, time and again from the 9/11 attacks to the murders of Fusilier Rigby and people at the Charlie Hebdo offices in Paris,  information overload caused by bulk data collection has been a primary factor in the failure to prevent terrorist attacks by known dangerous individuals. It is simply not proportionate to engage in bulk data collection in the hope that it will be useful when the authorities decides to look into someone they disapprove of. It actually actively impedes already over stretched investigatory authorities, who would be better served by putting the resources apparently available for such bulk collection, into recruiting more and better trained investigators and analysts.

Mrs May and Mr Cameron would do well to note that the opportunity costs of engaging in the security theatre that is bulk data collection and data retention, undermines security for everyone by making the jobs of those tasked with protecting us more difficult, whilst simultaneously denying them the resources to be more effective.

Update: the airline worker example from Annex 9, according to Joshua Rozenberg is Rajib Karim, who was convicted in 2011 and jailed for 30 years.

Ancilla Tilia dreams about talking to her granddaughter in the future

A gentle but powerful reminder from Ancilla Tilia that we don't appreciate freedom until it's gone and in the meantime refuse to notice it drip drip dripping away.


Ironically, given the subject matter, the video cuts out half way through demanding a full name and email address. Put in a dummy name and email to get it to continue.

Email to MP re Counter Terrorism and Security Bill

The 2nd reading of Counter Terrorism and Security Bill is due in the House of Commons tomorrow.

Prompted by the Open Rights Group I've written to my MP, Nicola Blackwood, about it. Copy of my email below. Some of ORG's concerns are outlined in their briefing on the Bill.

Dear Nicola,

The latest government proposal, the Counter Terrorism and Security Bill, gives me cause for significant concern.

The ill-judged Data Retention and Investigatory Powers Act was, as you know, rushed through as emergency legislation without proper parliamentary scrutiny in the summer, the week before MPs went on holiday.  The use of the murder of Fusilier Lee Rigby as an excuse for introducing these new measures, expanding DRIPA and the further expansion of additional surveillance powers, is unconscionable.

With an election round the corner, we should hardly be surprised that party managers might be encouraging senior figures to ramp up their “tough on terrorism” rhetoric. However, Lee Rigby, who dedicated his life to defending the freedoms we enjoy in the UK, deserves better from our political leaders.

The UK survived two world wars, the cold war, multiple other military adventures and domestic bombing and violence orchestrated by groups like the IRA. Yet in the face of small numbers of violent religious extremists, successive UK governments, in the past 15 years, have normalised mass surveillance and done more damage to the legal infrastructure protecting our fundamental freedoms than any collection of deranged vicious clowns with access to dangerous weapons could do in a lifetime.

The Counter Terrorism and Security Bill is unfortunately building further on that trend.

1.       It introduces an obligation on public bodies including universities, schools, nurseries and councils to prevent terrorism. I've read this section 21 provision of the Bill repeatedly in the hope of making some sense of it. Yet the truth is, as a university educator with an interest in law and technology, I have genuinely no idea of what it is going to mean in practice.

   

2.       It expands the kind of meta-data that ISPs are being required to hold onto to help identify our IP addresses. This fundamentally misses the subtlety that an IP address denotes a device, not a human being.

3.       Mobile Phone companies do not currently log IP addresses because of differences in the technology to mainline broadband providers. They have been told they have to find a way. This will cost the taxpayer £100m over 10 years.

4.       The problems with the Bill are much wider than digital rights concerns. It also includes temporary exclusion orders, banning suspects from Britain for two years, even if they are British citizens.

5.       We are not currently facing a national emergency, so Parliament should not rush through this kind of legislation. We need proper scrutiny by MPs, Peers and civil society.

6.       The European Court of Justice (in the Digital Rights Ireland case this year) ruled that blanket data retention was incompatible with of articles 7, 8 and 52(1) of the Charter of Fundamental Rights of the EU. New laws should comply with that judgment. Neither DRIPA nor this proposed new Bill do so.

7.       The ECJ said that there should be a relationship between the data being retained and a threat to public security. However there are no restrictions to time, place or people in this Bill.

8.       DRIPA is even now the subject of a legal challenge, brought by the Open Rights Group and Liberty challenge. It may well be found illegal, while these new provisions are still being paid for.

Could I recommend for your review, the same Open Rights Group's analysis of the proposals in this Bill, available at https://www.openrightsgroup.org/ourwork/reports/briefing-on-counter-terrorism-and-security-bill  

Again you will not be surprised, given our previous correspondence, that I'm of the view that existing mass surveillance activities and powers need reigning in not expansion. Indeed the coalition government came to power on a promise of cracking down of the worst excesses of the previous government's database state. Rather than fulfilling that promise the current government has normalised and expanded these operations and powers. I hope when history comes to be written it will not judge the coalition's performance favourably on that score. Only then will we be sure that fundamental freedoms, under sustained attack by comparatively tiny numbers of terrorists and the bulk of the current, often well-intentioned but scientifically, mathematically and technically illiterate mainstream political classes, have survived intact.

Regards,

Ray