# Ofcom fast-tracks decision on measures to block illegal intimate images
As anticipated, Ofcom has announced a new general monitoring obligation, for (all? those which have identified a high risk?) regulated user to user services to scan user uploads to attempt to detect illegal intimate images.
Details are scant right now, including where and how everyone in scope can obtain the comparison data to implement this.
Am I understanding the mechanics of this correctly?
A complainant would need to provide copies of the image(s) they believe are being shared non-consensually (to whom?). These would then be hashed and fed into a database. In-scope providers would then compare hashes of images uploaded to their servers with that database.
Is that correct?
illegal intimacy... that's like illegal kindness. Your government just said that kindness is illegal.
Ofcom's consultation on this measure did have scope restrictions, so this is, perhaps, a case of this initial press release not containing all the detail, rather than it being a measure to be imposed on everyone.
But that will make a massive difference in terms of exactly who needs to do what here.
Here is the scoping from Ofcom's consultation.
Providers of user-to-user services which are high risk of intimate image abuse and either:
• whose principal purpose is the hosting or dissemination of regulated pornographic
content; or
• are file-sharing and file-storage services; or
• have more than 700,000 monthly active UK
users.
Providers of large user-to-user services that
are medium risk for intimate image abuse.
("large" meaning "an average, calculated over six months, user base greater than seven million monthly UK users.")
@neil "... are file-sharing and file-storage services ..."
It sounds like this puts things like personal file backup in scope.
@GerardThornley Is the personal file backup service "high risk of intimate image abuse"
@neil they actually specified the size of a thing!? boggle
@castaway In this case, they are not interpreting / potentially fettering their discretion in terms of statutory wording - it is their choice to set this bit of the regime in this way. At least, I think there's a reasonably clear distinction here!
And in related news:
> Tech companies will be ordered to take down intimate images shared without a victim’s consent within 48 hours, under new laws to protect women and girls from this distressing abuse.
I can't find the text of the proposed amendment, but then I am using my phone while having breakfast, so perhaps not optimal research conditions.
I will be interested to see if this law will protect sex workers, in terms of distribution of their own intimate images by third parties (e.g. some "tube" sites, social media accounts reposting clips), giving them a powerful takedown tool, rather than relying on copyright / DMCA measures.
@neil oh so they are actually capable of defining what they mean with numbers, curious...
@el_on_libera In this context, yes, and I suppose one might say that this is not about interpretation of the statutory regime, thereby giving Ofcom more scope for discretion?
@neil If you ask the IWF nicely you can get access to the relevant software and APIs. This was very helpful in our "Measuring eWhoring" project where we were confident there wouldn't be any illegal images, but we were wrong and ended up with a small number to report. Careful design meant no human saw them.
@DanielRThomas The IWF has a separate list of "intimate image abuse" hashes (separate from the CAIC CSAM list), which they want to hand out more broadly? I didn't know that.
(This paper suggests that the IWF assisted with CSAM, not intimate image abuse: https://www.cl.cam.ac.uk/~ah793/papers/2019measuring-ewhoring.pdf)
@neil Ahh sorry I misunderstood what made them illegal. Probably most of the images were nonconsensual.
@DanielRThomas No worries! Ofcom's consultation referenced "third party" lists, as well as providers building their own lists based on knowledge.
But yes, this is separate category to CSAM.
@DanielRThomas Ofcom mentioned StopNCII.org, pricing to be determined.
maybe you fellas are the right people to ask: the only service i know of is arachnid:
https://projectarachnid.ca/en/
my question is how does one go about obtaining a feed of such hashes [other than the arachnid project ones]; my use-case is to scan email attachments and e.g. activitypub/atproto incoming media payloads
as i try to de-google my personal infra by running my own servers, this is a glaring gap in my infosec knowledge
