Under the the draft Online Safety Bill legislation, adult websites (i.e. pornographic) site operators will be legally required to verify the age of website visitors or face tough penalties.

Online Safety Bill

For those who run commercial porn sites, the bill, which expected to be introduced to parliament in the next few months, looks likely to mean that:

– Their users may be asked to prove their age, e.g. by proving they own a credit card or confirming their age using a third-party service.

– Failure to comply with the legislation could see commercial porn site bosses held criminally liable. Also, for their business, this could also mean fines up to 10 per cent of their global turnover, or Ofcom (the UK’s communications regulator) blocking their websites from being accessible in the UK.

A Step In The Right Direction

Child safety groups, who have been seeking age verification on porn sites (and who were disappointed when similar measures dropped in 2019), have welcomed the measures in this now strengthened bill as a step in the right direction. However, the NSPCC, for example, has noted that the “legislation still falls short of giving children comprehensive protection from preventable abuse and harmful content”.

Reddit & Twitter Users Too

The draft Online Safety Bill also applies to a wide variety of online services and social media platforms. For example, when the bill moves into law, UK users of platforms such as Twitter and Reddit, on which can be found quantities of explicit adult material, may find that they need to verify their age before being able to login. The alternative, which would be complicated and challenging for social media platforms, would be to somehow remove all adult material from their services in the UK.

Also, Facebook & TikTok

Other obvious platforms which may require age verification under Online Safety Bill laws could be Facebook and TikTok.

What Does This Mean For Your Business?

For those who operate commercial porn websites, this new bill, when it moves into law, could obviously be a threat. For third-party verification service providers, the bill is clearly an opportunity. For the big social media platforms such as Facebook, although the idea has been welcomed, the details of the bill are unlikely to be popular. Nevertheless, platform bosses will be aware that executives can be personally given serious penalties (with a two-year grace period) which is likely to make them take some notice. Facebook, however, is already moving into a new, more controllable area with its Metaverse. Although parents and child safety advocates may take some comfort that the bill may provide better protection for their children, there is an argument that proving age verification may not provide protection from other sites where pornography exists and could threaten the privacy and security of users (i.e., data breaches and scammers). Furthermore, there is an argument that the need to scan social posts could, as highlighted by the Open Rights Group, mean encryption will need to be halted, further affecting privacy and security.

Following recent announcements of a toughening-up of the (draft) Online Safety Bill, we look at what the bill is, and what its implications are.

What Is The Online Safety Bill For?

The UK government’s Online Safety Bill is (draft) legislation that’s designed to place a ‘duty of care’ on internet companies which host user-generated content in order to limit the spread of illegal content on these services.

The idea of the Online Safety Bill is essentially to prevent the spread of illegal content and activity (e.g., images of child abuse, terror material, and hate crimes), as well as to protect children from harmful material, and also to protect adults from legal but harmful content.

The Bill applies to social media platforms, video-sharing platforms, search engines, and other tech services, and requires them to put in place systems and processes to remove illegal content as soon as they become aware of it. The Bill also requires these services to take additional proactive measures with regards to the most harmful ‘priority’ forms of online illegal content.

Priority

The kinds of priority offences listed in the draft bill are terrorism, child sexual abuse, and exploitation. The Department for Digital, Culture, Media and Sport’s Secretary of State also has powers to add further priority offences (with Parliament’s approval) via secondary legislation once the bill becomes law.

Other Illegal Behaviour

The Bill can also be applied to other illegal behaviour including more activities recently made illegal, which have emerged alongside the ability to target individuals or communicate en masse online.

In summary, the main groups of offences that the Bill now covers are are:

– Encouraging or assisting suicide

– Offences relating to sexual images (revenge and extreme pornography)

– Incitement to and threats of violence

– Hate crime

– Public order offences (harassment and stalking)

– Drug-related offences

– Weapons / firearms offences

– Fraud and financial crime

– Money laundering

– Controlling, causing or inciting prostitutes for gain

– Organised immigration offences

Strengthened Recently

Following Criticism that the original draft Bill’s scope hadn’t gone far enough and that services/firms would only have been forced to take such content down after it had been reported to them by users, the Bill has now been strengthened (hence the quite extensive list of offences shown above). On 4 Feb this year, Digital Secretary Nadine Dorries announced that the Bill had been strengthened in the following ways:

– The addition of extra priority illegal offences; i.e. revenge porn, hate crime, fraud, the sale of illegal drugs or weapons, the promotion or facilitation of suicide, people smuggling and sexual exploitation. The naming of the new offences is designed to remove the need for them to be set out in secondary legislation later. The government says that it will also enable Ofcom (which issues the fines under the Bill) to take quicker enforcement action against tech businesses which fail to remove the named illegal content.

– The requirement for services to be proactive and prevent people being exposed in the first place rather than waiting for users to report incidents before taking the content down.

Three More New Offences Being Considered

The government is also considering the Law Commission’s recommendations for three other offences to be created and added to the Online Safety Bill, namely. cyberflashing, encouraging self-harm, and epilepsy trolling.

Back in July, the Commission recommended other new offences which the Digital Secretary has only just cofirmed will be created and legislated for in the Online Safety Bill. These are harmful and abusive emails, harmful social media posts and WhatsApp messages, as well as ‘pile-on’ harassment (where many people target an individual with abuse e.g., in a comments section). These new offences do not apply to regulated media – print and online journalism, TV, radio, and film.

Named Individuals

One large aspect of the debate around the Online Safety Bill is the naming of specific individuals/executives in offending companies. The draft Bill, for example, already included the ability to impose criminal sanctions of named tech executives. These sanctions (i.e. prison sentences) however, were originally due to be delayed for two years (a grace period) after the laws are passed but some UK MPs have been asking the government to remove this long grace period before criminal sanctions can be faced. Digital Secretary Nadine Dorries, who has personal experience of having been targeted by trolls, is believed to favour a six months timeline (grace period) before the imposition of prison terms for those tech execs who fail to remove “harmful algorithms”.

Freedom and Legal Commentators

Freedom groups, such as the Index on Censorship and the Open Rights Groups have expressed concerns about Silicon valley companies making outsourced decisions about whether speech is harmful or not. Some legal commentators have also expressed concern that the Bill essentially allows the government to delegate all aspects of investigating and making judgements about online crimes to the tech companies/social media platforms.

Tech Companies

The big social media platforms have expected the Bill for some time and although they have given no major reactions to the most recent announcements, they are thought to be broadly in agreement with its aims. For example, Monica Bickert, vice-president of content policy at Meta (Facebook) said recently (in the Telegraph): “While we won’t agree with all the details, we’re pleased the Online Safety Bill is moving forward.”

Other Comments and Criticism

The NSPCC recently criticised the Bill for (in an open letter to Nadine Dorries) for not doing enough to put children at its the heart. Also, the Labour Party has said that the bill needs to go further in terms of tougher sanctions on executives who breach the new laws.

Enforcement

Ofcom, the UK’s communications regulator will be in charge of issuing the fines for offences under the bill.  For example, Ofcom will be able to issue fines of up to 10 per cent of annual worldwide turnover to non-compliant sites or block them from being accessible in the UK.

What Does This Mean For Your Business?

Tech companies, particularly social media platforms, have been forced to make changes for several years now in response to a series of trust-damaging events (e.g. Facebook’s Cambridge Analytica scandal, the platform’s use for influence in the previous US election and UK referendum), pressure from governments, and widespread concerns from users about the safety of young and vulnerable people online. The government sees the recently boosted powers of the (draft) Online Safety Bill as a way to send a much clearer message now to online services, particularly social media platforms that these issues now need to be taken more seriously, with the threat of possible prison terms for executives designed to make companies take more notice and make more changes. Facebook already appears to have started morphing into something different for the future (Meta) and, for example, Twitter’s co-founder Jack Dorsey stepped down last November. The aims of the bill appear noble in terms of the extra protections against a much wider range of offences that it may offer, but it remains to be seen how well it will work in reality when it passes into law, and whether it needs to be strengthened further.

Microsoft recently announced that it will be blocking Visual Basic for Applications (VBA) macros by default as a way to stop the spread of malware. Since these macros are important automation tools for Microsoft Office apps, how is this going to work?

What Are Visual Basic for Applications (VBA) Macros?

Visual Basic for Applications (VBA) for Office is the programming language behind Excel and other office apps. VBA can accomplish almost every operation that can be performed with a mouse, keyboard, or a dialog box. Also, it is the automation of repetitive tasks that is one of the most common uses of VBA in Office. VBA macros, therefore, are a series of instructions written (in VBA) into a single command to automate tasks e.g., with a single click.

What’s The Problem?

Microsoft says that although VBA macros are tools designed to make routine entry work simpler, they have long been abused by hackers and bad actors to deliver malicious payloads such as ransomware to unsuspecting users. For example, Tom Gallagher from Microsoft’s Office Security team recently said that “A wide range of threat actors continue to target our customers by sending documents and luring them into enabling malicious macro code”. Mr Gallagher has also highlighted how malicious code is usually part of a document that originates from the internet (email attachment, link, internet download, etc.). Once enabled, the malicious code can gain access to the identity, documents, and the network of the person who enabled it.

Safest Option – Block Them By Default

Since, as described by Microsoft’s Tom Gallagher, VBA macros are obtained from the internet, Microsoft says, therefore, that the most secure option is now to simply block them by default.

Message Displayed

With macros being blocked, instead of being allowed to enable macros just by clicking a button, users will instead see a message bar notifying them that macros are blocked, next to an option to learn more. Although it will still be possible to enable macros, this will require users to travel go through more layers, thereby reducing the possibility of accidentally clicking on a phishing email.

What And When?

Microsoft says that, for now, the functionality will be limited to the Windows version of Microsoft Office and will be enabled in Access, Excel, PowerPoint, Visio, and Word.

The new change will be rolled out in a preview (version 2203) in the Current Channel, due in early April. This will then be gradually rolled out to the Monthly Enterprise Channel and Semi-Annual Enterprise Channel.

What Does This Mean For Your Business?

This change by Microsoft, which was prompted by ongoing cloud migration and increased remote and hybrid working, is designed to increase safety and security, particularly for remote workers. What it essentially does is to make it much more difficult for users to be fooled into running malicious code via social engineering while, at the same time, keeping a path for legitimate macros to be enabled through a trusted route where appropriate. The advice to IT and security teams is to work with any parts of the business that use macros in their Office files and, with any independent software vendors that are critical to the business who use macros within Office files.

The UK government’s Department for Digital, Culture, Media & Sport has announced funding of up to £23 million for AI and data conversion courses in England.

Help Underrepresented Groups To Join World-Leading Industry

The government says that the funding will create (postgraduate) conversion courses that could help underrepresented groups get tech jobs, even if they have no previous experience in the field.  The intention is that the courses will help these underrepresented groups, including women, minorities and people with disabilities not just get tech jobs, but to become a new generation of experts the UK’s world-leading Artificial Intelligence (AI) and data science industries.

Companies Encouraged To Contribute To Funding

Also, the government is encouraging companies to play their part in creating a future pipeline of AI talent by match-funding the AI scholarships for the conversion courses. The idea is that industry support could help to get more people into the AI and data science job market quicker, as well as strengthening their businesses. The government says that an independent organisation, to be announced later this year, will be responsible for encouraging industry participation and investment into the AI Scholarships scheme.

Part of National AI Strategy

The new scholarships and courses are part of the government’s ‘National AI Strategy’ to invest in (and plan) the AI ecosystem over the next ten years, with the intention of boosting the UK’s leadership as a global science and AI superpower. The scholarships follow on from the ‘Industrial Funded AI Masters’ programme supported by the government since 2019 to increase AI skills across the UK with industry investment.

The DCMS Minister for Tech and the Digital Economy, Chris Philp said: “We are doubling the number of AI scholarships previously available to underrepresented groups to build a diverse and inclusive workforce fit for the future of tech.”

Also, the Science Minister George Freeman said of the new £23 million investments in AI scholarships and courses: “The UK is one of the world’s most advanced AI economies, with AI already playing a key role in everything from climate science and medical diagnostics to factory robotics and smart cities.”

“It is therefore essential that we continue to equip our workforce with the skills they need in this important technology, while also making the industry accessible to talented people from all backgrounds.”

First Round of Courses In 2019 Successful

The government says that the new courses will build on the success of the first round of AI conversion courses in 2019, delivered by the Office for Students. These supported 28 universities in England to set up and provide degree conversion courses in AI and data science. This  £13.5 million AI Scholarship programme resulted in successes including:

– A diverse group of students being able to study AI and data science – 76 per cent were women (twice the traditional masters computing courses rate), nearly half (45 per cent) of scholarship students were Black, and 24 per cent had disabilities.

– 70 per cent of the total students, and 84 per cent of the scholarship students were from outside London and the Southeast.

What Does This Mean For Your Business?

The UK has long had a tech/digital skills gap as well as problems attracting and helping women and other underrepresented groups into the tech industry. The UK government is also keen to carve out a place for the UK as a world leader AI. These challenges and this big ambition (from skills gap to world leader) is clearly going to require some serious funding and organisation and that’s where the National AI Strategy, the 2019 scholarships, plus this new funding come in. The size of the ambition and its associated costs mean that the government is also keen to get the help of match-funding from companies with the promise that their business and the AI and data science job markets will be helped. Another benefit of the investment in these scholarships could be not just boosted representation, but that more students from many different backgrounds could contribute fresh perspectives and innovation to data science and artificial intelligence. AI is going to play an increasing role within business in our lives going forward so it makes sense that the economy and UK businesses could benefit from the UK becoming a centre for AI development and expertise.

Windows 11 has Microsoft Teams as a pre-installed app that users can access from the Taskbar by clicking the ‘Chat’ icon. To connect with anyone, if they’re on iOS, Android or Mac, here’s how:

– Click on the Chat icon in Windows 11 Taskbar and click on the Get started button.

– Confirm the Microsoft Teams account.

– Next, click the ‘Let’s go’ button.

– Find your contact and click on it.

– Type and send your message or select the ‘Meet’ icon > ‘Copy meeting’ link to organise a meeting.

In a worrying trend, oil facilities in Germany, Belgium and the Netherlands have all recently been targeted by cyber-attacks.

Germany

The attack on German oil, vehicle fuel and petroleum products company Oiltanking Deutschland GmbH & Co. KG happened just over a week ago. Some reports have suggested that the company’s systems were hit by ransomware, thereby seriously limiting capacity. Also, the German oil company ‘Mabanaft’ was the victim of an attack on its production systems.

Belgium

In Belgium too, the day before the German attack, SEA-Invest terminals including the company’s largest in Antwerp (called SEA-Tank), were hit by a cyber-attack. The attack also affected every European port run by SEA-Invest, as well as ports in Africa.

The Netherlands

In the Netherlands, gas, and oil storage company Evos was also targeted resulting in the IT services at its Terneuzen terminal being disrupted, causing delays in operations.

Disruptive

Attacks on oil companies can be extremely disruptive and costly. For example, American oil pipeline company Colonial Pipeline Co. was hit by a ransomware attack last April that resulted in Colonial paying hackers a $4.4 million ransom. The hackers are believed to have been affiliates of the Russia-linked cybercrime group ‘DarkSide’ who also stole nearly 100 gigabytes of data in the attack.

Investigations revealed that the attackers gained access using the login details of a VPN account that were part of a batch of leaked passwords on the dark web. The account didn’t use multifactor authentication, which meant that the hackers could breach the network using just a compromised username and password!

Costly

It’s estimated that it typically costs between 650,000 and 1.5+ million euros for organisations, such as oil companies, to recover from a big ransomware attack

Linked / Coincidence?

Although it has not yet been conclusively proven who was behind the attacks, or whether they were linked, some commentators have noted that the timing, with Russia threatening to close its oil pipelines to Europe over the crisis in Ukraine, may be more than a coincidence. Some have also noted that with Germany being a major European consumer of Russian fuel, an attack of this kind could act as a way to pressure Germany.

What Does This Mean For Your Business?

The situation between Russia and Ukraine led to warnings last week that US and European businesses needed to prepare themselves for possible Russian-based cyber-attacks. Russia currently supplies around 35 percent of the European Union’s natural gas (with Germany buying the most) and exports most of its crude oil to Europe. It is perhaps not surprising, therefore, that coupled with the threat of shutting off the gas pipeline, Russia could (if they were behind the attacks) apply more pressure and create huge disruption to multiple businesses along many supply chains in many different countries. One important thing about these and similar attacks (e.g., the Colonial Pipeline Co attack) is that it can take something as small one set of stolen login details (and no 2FA) and/or an old account that hasn’t been shut down to cause untold damage to a business of any size. A chain is only as strong as its weakest link and with more attacks likely, now would be a good time for businesses and organisations to tighten-up on basic security measures and remind staff of the threats and best practice (policy) to deal with them e.g., have strong passwords changed regularly, no password sharing and ensuring nobody clicks on unknown links in emails, to name but a few.