Really grateful that a project like this took on the task to ask for legal advice, and extra kudos for actually releasing a statement based on their understanding of the legal advice. Hopefully will be useful to lots of similar organizations.
Libera.chat seems to say that even if Ofcom thinks they have a case, they don't as Libera's user base doesn't have enough UK users:
> The exact fraction of the UK’s online population that must use a given service to be considered “significant” is unknown, but based on our counsel’s observations of Ofcom’s previous regulatory actions, it appears to be much higher than our internal estimates of how large our UK user base is.
You're right in the sense that they can pursue whomever they want based on whatever interpretation of "significant" they may hold. But it is not Ofcom that ultimately decides on the meaning of the term, that is for a court to decide and that court would likely rely on the same authorities and principles that Libera's lawyers did in their advice.
> But it is not Ofcom that ultimately decides on the meaning of the term, that is for a court to decide and that court would likely rely on the same authorities and principles that Libera's lawyers did in their advice.
assuming of course libera don't fold the moment they receive a nastygram ("enforcement notice")
like they did when andrew lee commandeered freenode
They weren't in a strong legal position then: a few mistakes over the course of decades substantially weakened their ability to fight back against Andrew Lee (without significant personal expense). Libera's legal structure is much stronger, and (importantly) the Ofcom has nothing to gain from going after them. (Libera aren't, after all, part of the problem.)
Not sure why your comment has been received negatively when it seems to be obviously true. Yes, "significant" is ambiguous and I wouldn't be surprised if the intention is to give themselves discretion to go after whoever they choose. The OSA is insidious.
> Speaking of which, the memo implies that “significance” in this context is interpreted as being relative to the population of the UK, not relative to the user base of the service. We have seen risk assessments that take the other interpretation and consider their UK user base to be “significant” because it makes up a large portion of their overall user base, but the advice we received suggests we should not use this interpretation.
Interesting - this implies that the vast majority of niche communities are not considered to be in scope, so long as they're not on a service like Discord I guess.
Perhaps, but this sort of thing is a part of the problem: the law itself is written vaguely enough that Ofcom could at any time change their interpretation and decide that previously out-of-scope communities are now in-scope, and go after them.
Laws in general tend to leave a bit of room for interpretation, and then those are to be cemented in specific contexts/scenarios by precedents, that's how I understand many systems of law at at least, maybe it works differently where Libera.chat and Ofcom are based.
I was expecting/hoping that the legal advice was that an IRC network isn't subject to the law, but it seems like the only advice here was "you're based in Sweden and have only trivial ties to the UK, so the UK/Ofcom can't reasonably go after you".
That feels like a kinda "duh" thing? Even though the UK believes they can enforce this law abroad, if I were running a service outside of UK jurisdiction that would otherwise be subject to the Online Safety Act, I certainly wouldn't comply with it.
In what universe is that "not a big deal?" That makes an entire country a no-go zone. Worse if it's an offense they could reasonably extradite for.
I don't intend to ever travel to Russia or North Korea, but that's not some trivial anecdote about modern life, those are regimes so hostile to rule of law and individual safety that it's not reasonable to travel there.
What if there's a conference you want to go to, but it's in the UK? Or you have friends you want to visit? Or family, or whatever.
That's also an egregious degradation of the UK's position with regard to Western-norms around personal liberties, which itself is worthy of remark.
> those are regimes so hostile to rule of law and individual safety that it's not reasonable to travel there
And now the UK joins the ranks as well. I should add that the US is also a member of this club if you’re foreign or you appear to be foreign, we are no paragon of virtue either.
Some people have friends/family/etc in Russia too yet it does not make it less of a shitty country. Here in Lithuania we there’s at least one or two sob stories every year about somebody visiting relatives in (bela)rus and ending up in prison there.
I’m more afraid that anglosphere is showing the way for the rest of west-y world. Looking at chat control stuff and all that jazz, it’s matter of time same stuff becomes a thing in the rest „free“ world.
Honestly though, I’ve done almost all the travel to the UK I need. It would be kind of an outlaw badge if honor to be banned from a first world country for something like sharing memes they don’t like.
> end result is the same: a denial of service to people in the UK solely because of the country they live in.
This would also probably help sway the public opinion in the UL to stop electing representatives that come up with laws like this - so a win either way.
If you consider all we know about the excesses and influences of big tech companies, and then blunt that down to a more lay perspective, it's pretty easy to understand why we've landed up here.
Not a lawyer but from depths of GDPR meetings and implementation work years ago, my understanding was if you do not have any exposure in a given jurisdiction (typically office or employees etc) then you can tell them to get lost.
UK should not be able to regulate nature of photons being sent from outside of their borders.
It comes up in every thread about this sort of thing. It is basically true, although keep in mind that the UK is basically a “friendly” country to most of the other countries that are in the sort of… liberal/capitalist/democracy clique, so hypothetically it wouldn’t be that surprising if some of our countries ended up with some reciprocity some day for the fines or whatever.
> TL;DR: the legal firm we’ve engaged has sent us a memo indicating that in their opinion we can reasonably argue we do not have sufficient links to the UK for the Online Safety Act to be applicable to us. They also believe we would be at low risk of attempted enforcement action even if Ofcom does consider us to be in-scope for the OSA. We will continue to ensure that this is the case by keeping internal estimates of our UK user base and by continuing with our current efforts to keep Libera.Chat reasonably safe. We have no plans to institute any ID requirements for the forseeable future.
Is it just me or is this not super confidence inspiring for what happens in the future? This just seems like an arbitrary time in future when they either have enough UK users or if Ofcom suddenly lowers or entirely removes the arbitrary "size" estimate, OSA will become applicable? As far as I can tell, we don't even know what this arbitrary "size" estimate is?
Sure, but if you're forward looking, the rules could change and it's not predictable.
This kind of a memo is a useful CYA. An interpretation of the current situation and likely risk factors, and when the situation changes in the future, an artifact that justifies their current non-compliance. Will Ofcom/courts accept it and not require compliance if the situation changes? No, but it might eliminate or reduce penalties for non-compliance.
It used to be that a lot of free and open source developers would hang out on Freenode IRC to communicate with users; then things happened, and Libera was forked from Freenode.
Really grateful that a project like this took on the task to ask for legal advice, and extra kudos for actually releasing a statement based on their understanding of the legal advice. Hopefully will be useful to lots of similar organizations.
Libera.chat seems to say that even if Ofcom thinks they have a case, they don't as Libera's user base doesn't have enough UK users:
> The exact fraction of the UK’s online population that must use a given service to be considered “significant” is unknown, but based on our counsel’s observations of Ofcom’s previous regulatory actions, it appears to be much higher than our internal estimates of how large our UK user base is.
Related submission with 788 comments from ~1 week ago: "4Chan Lawyer publishes Ofcom correspondence" - https://news.ycombinator.com/item?id=45614148
significant can mean anything ofcom want it to
their entire post is sophistry and wishful thinking, neither of which will work if ofcom decide to go after them
the intention of the OSA is to attempt to regulate user-to-user communications services, of which IRC is one
they're probably right that they're near bottom of the list though
(at least until this blog post ends up on their desk monday morning)
> significant can mean anything ofcom want it to
You're right in the sense that they can pursue whomever they want based on whatever interpretation of "significant" they may hold. But it is not Ofcom that ultimately decides on the meaning of the term, that is for a court to decide and that court would likely rely on the same authorities and principles that Libera's lawyers did in their advice.
> But it is not Ofcom that ultimately decides on the meaning of the term, that is for a court to decide and that court would likely rely on the same authorities and principles that Libera's lawyers did in their advice.
assuming of course libera don't fold the moment they receive a nastygram ("enforcement notice")
like they did when andrew lee commandeered freenode
They weren't in a strong legal position then: a few mistakes over the course of decades substantially weakened their ability to fight back against Andrew Lee (without significant personal expense). Libera's legal structure is much stronger, and (importantly) the Ofcom has nothing to gain from going after them. (Libera aren't, after all, part of the problem.)
If they were persued, I assume they'd shut down. At the same time, a new IT service called "freechat" or "librenode" would start up.
In these games involving companies with no physical presence in the UK, OfCom has only two realistic enforcement strategies:
1. Arrest the founders or officers at the UK border if they attempt to enter.
2. Direct UK ISPs to block access to their services.
Let's see if they are so PR-insensitive that they will want to actually do that.
Not sure why your comment has been received negatively when it seems to be obviously true. Yes, "significant" is ambiguous and I wouldn't be surprised if the intention is to give themselves discretion to go after whoever they choose. The OSA is insidious.
> Speaking of which, the memo implies that “significance” in this context is interpreted as being relative to the population of the UK, not relative to the user base of the service. We have seen risk assessments that take the other interpretation and consider their UK user base to be “significant” because it makes up a large portion of their overall user base, but the advice we received suggests we should not use this interpretation.
Interesting - this implies that the vast majority of niche communities are not considered to be in scope, so long as they're not on a service like Discord I guess.
Perhaps, but this sort of thing is a part of the problem: the law itself is written vaguely enough that Ofcom could at any time change their interpretation and decide that previously out-of-scope communities are now in-scope, and go after them.
It's just a variation of selective enforcement.
Laws in general tend to leave a bit of room for interpretation, and then those are to be cemented in specific contexts/scenarios by precedents, that's how I understand many systems of law at at least, maybe it works differently where Libera.chat and Ofcom are based.
The frog wants a plan for when they inevitably turn up the heat by reinterpreting significance. The time to hop out may be now.
I really don’t get it. Just blanket block all UK ips. All sites should be doing this—large or small. I’m going to on my small blog even.
I was expecting/hoping that the legal advice was that an IRC network isn't subject to the law, but it seems like the only advice here was "you're based in Sweden and have only trivial ties to the UK, so the UK/Ofcom can't reasonably go after you".
That feels like a kinda "duh" thing? Even though the UK believes they can enforce this law abroad, if I were running a service outside of UK jurisdiction that would otherwise be subject to the Online Safety Act, I certainly wouldn't comply with it.
If you step foot in the UK, you would be arrested on the spot.
IANAL and this is a genuine question: do you have personal liability in this case if your website is owned and operated by a corp?
That seems like not a big deal? I never intend to travel to Russia either, or even go near its airspace.
What if you're flying to France and your plane has to make an emergency landing in the UK?
Genuine question.
[delayed]
In what universe is that "not a big deal?" That makes an entire country a no-go zone. Worse if it's an offense they could reasonably extradite for.
I don't intend to ever travel to Russia or North Korea, but that's not some trivial anecdote about modern life, those are regimes so hostile to rule of law and individual safety that it's not reasonable to travel there.
What if there's a conference you want to go to, but it's in the UK? Or you have friends you want to visit? Or family, or whatever.
That's also an egregious degradation of the UK's position with regard to Western-norms around personal liberties, which itself is worthy of remark.
> those are regimes so hostile to rule of law and individual safety that it's not reasonable to travel there
And now the UK joins the ranks as well. I should add that the US is also a member of this club if you’re foreign or you appear to be foreign, we are no paragon of virtue either.
Some people have friends/family/etc in Russia too yet it does not make it less of a shitty country. Here in Lithuania we there’s at least one or two sob stories every year about somebody visiting relatives in (bela)rus and ending up in prison there.
I’m more afraid that anglosphere is showing the way for the rest of west-y world. Looking at chat control stuff and all that jazz, it’s matter of time same stuff becomes a thing in the rest „free“ world.
There’s a lot of non-UK world to walk around in.
Honestly though, I’ve done almost all the travel to the UK I need. It would be kind of an outlaw badge if honor to be banned from a first world country for something like sharing memes they don’t like.
> end result is the same: a denial of service to people in the UK solely because of the country they live in.
This would also probably help sway the public opinion in the UL to stop electing representatives that come up with laws like this - so a win either way.
Are you making a common mistake of assuming laws like this don't represent public opinon?
https://www.ipsos.com/en-uk/britons-back-online-safety-acts-...
Middle England is conservative and authoritarian.
To steel-man this - the public have become more wary of the internet's influence on society generally: https://yougov.co.uk/topics/technology/trackers/how-optimist...
If you consider all we know about the excesses and influences of big tech companies, and then blunt that down to a more lay perspective, it's pretty easy to understand why we've landed up here.
People have lost faith in us.
Yeah, sadly the average thought on this law starts and ends with "think of the children" and "it's just like buying alcohol"
Not a lawyer but from depths of GDPR meetings and implementation work years ago, my understanding was if you do not have any exposure in a given jurisdiction (typically office or employees etc) then you can tell them to get lost.
UK should not be able to regulate nature of photons being sent from outside of their borders.
What am I missing?
I’ve wondered why more people don’t talk about this approach. Is it because you might get arrested if you ever do step foot in the UK?
It comes up in every thread about this sort of thing. It is basically true, although keep in mind that the UK is basically a “friendly” country to most of the other countries that are in the sort of… liberal/capitalist/democracy clique, so hypothetically it wouldn’t be that surprising if some of our countries ended up with some reciprocity some day for the fines or whatever.
> TL;DR: the legal firm we’ve engaged has sent us a memo indicating that in their opinion we can reasonably argue we do not have sufficient links to the UK for the Online Safety Act to be applicable to us. They also believe we would be at low risk of attempted enforcement action even if Ofcom does consider us to be in-scope for the OSA. We will continue to ensure that this is the case by keeping internal estimates of our UK user base and by continuing with our current efforts to keep Libera.Chat reasonably safe. We have no plans to institute any ID requirements for the forseeable future.
Is it just me or is this not super confidence inspiring for what happens in the future? This just seems like an arbitrary time in future when they either have enough UK users or if Ofcom suddenly lowers or entirely removes the arbitrary "size" estimate, OSA will become applicable? As far as I can tell, we don't even know what this arbitrary "size" estimate is?
I think the goal is not to provide confidence (at least not artificially so). The situation is just not great. This letter:
* At least reassures their users that they are doing their best, at least, even though that might not be much.
* Emphasizes the difficulty of the situation that the UK created.
* Shares, at least, a description of the advice they got (properly caveated that they or their lawyers weren’t giving anybody actual legal advice).
Sure, but if you're forward looking, the rules could change and it's not predictable.
This kind of a memo is a useful CYA. An interpretation of the current situation and likely risk factors, and when the situation changes in the future, an artifact that justifies their current non-compliance. Will Ofcom/courts accept it and not require compliance if the situation changes? No, but it might eliminate or reduce penalties for non-compliance.
For anyone who read the post title incorrectly, as I did initially:
Libera.chat: an IRC network
LibreChat: an open-source chat application that supports multiple AI models and provides a UI similar to ChatGPT
I was only familiar with the latter, which is a very cool and useful project. Currently reading up on the prior.
It used to be that a lot of free and open source developers would hang out on Freenode IRC to communicate with users; then things happened, and Libera was forked from Freenode.