Clarifying press releases such as the above presume that all individual items of content are classified for appropriateness under the Online Safety Act; but for example:
- Reddit has a ~20 year history of classifying content EITHER/BOTH individual items of content AND ALSO entire forums as “Not Safe For Work” (NSFW) which is what some* security people refer to as “advisory” or “discretionary access control”, a kind of “here be dragons” which keeps the user safe at their own discretion
- But the OSA comes from a worldview where all individual items of content can be (and are) labelled as “porn” or “violence” or “drugs”, and where there is no discretion
- So: when the OSA demands that the “NSFW” classification becomes age-verified — which converts the discretionary access control into “please present your credentials” mandatory access control — what happens is that NOT ONLY the individual items of NSFW content BUT ALSO the entire NSFW forums (Addiction Recovery, LGBTQ issues, Politics, Gender, etc…) become blocked to the British public, irrespective of individual content.
- Tip: this is not Reddit’s problem. The regulations have been passed 20+ years after Reddit got started, and the UK Government is suddenly requiring mandatory access controls to individual items of content. Reddit is not equipped to do this, and moreover it does not want to be in the business of classifying individual pieces of content, not by humans nor by AI, because (apart from anything else) that puts them into an editorial role.
- So: the UK Government has basically forced Reddit to overblock content, because they are obligating a 20 year old advisory/discretionary access control model to become a mandatory access control model. Reddit is not going to re-engineer their global data model and legacy content permissions just to make Ofcom & various UK academics happy.
- Civil Society too, if it is wise, does not want Reddit to adopt fine-grained classification of individual items of content, because it enables censorship and copyright blocks and all manner of illiberal badness which they have spent years already combating.
- And the users will just walk around all this with a VPN.
* Professional notes on Access Control
The above post is written for normal people. If you want to know more about various forms of access control and to nitpick their precise nomenclature:
- https://en.wikipedia.org/wiki/Access_control
- https://en.wikipedia.org/wiki/Discretionary_access_control
- https://en.wikipedia.org/wiki/Mandatory_access_control
- https://en.wikipedia.org/wiki/Bell–LaPadula_model
As far as I am aware, the TCSEC did not strictly name “there be dragons”.
Leave a Reply