Please note this podcast contains mention of child sexual abuse. In 2015, the Independent Inquiry into Child Sexual Abuse was set up to investigate where institutions failed to protect children in their care. The inquiry's final report, published in October 2022, laid out a set of powerful recommendations to address past failings and protect future generations of children from abuse.
Recommendations for Change is a five part podcast series from NSPCC Learning, examining why these recommendations are needed, how they'll work if implemented, and what impact they will have on the prevention of child sexual abuse. Episode four: online safety. Being online is an integral part of children and young people's lives, but it can expose them to risks, including sexual abuse.
The past five years has seen a proliferation in child sexual abuse (CSA) material online data from the Internet Watch Foundation, the UK hotline for reporting and removing online child sexual abuse material, shows that the number of reports of web pages assessed as containing CSA increased from 78,000 in 2017 to 255,000 in 2022. IICSA published an investigation report into the growing problem of online-facilitated CSA in March 2020.
It investigated the response of law enforcement, industry and government to three types of offending: indecent images of children offences, the grooming of a child, and live streaming of child sexual abuse. It found that whilst the last five years have seen improvements in the responses to these issues, there was no evidence to suggest a decrease in online child sexual abuse offences and, quote, "law enforcement is struggling to keep pace".
A step forward was made in October 2023 with the passing of the Online Safety Act, which gives online service providers new legal responsibilities to keep children safe on their platforms. However, there is still much work that needs to be done in order to eradicate child sexual abuse online. In this episode, we will be exploring the scale of the online abuse problem and how the recommendations seek to tackle the issue. Susie Hargreaves is the Chief Executive of the Internet Watch Foundation.
We spoke to Susie about the importance of implementing strong online protections for children in October 2023, a couple of weeks before the Online Safety Act was signed into law.
The internet is a really positive space, and of course, children get so much out of use of the internet, their entertainment, their social networking, their education. But unfortunately it has a really dark side as well, which is that children are very easily exploited on the internet, and, without protections being put in place, there will always be people who will try and take advantage of the most vulnerable people in society.
So, we would always say, you know, it's not that technology is bad, it's not that the internet is bad, but the reality is that there is a lot of very, very bad stuff on the internet, and we need to do everything we can to keep our children safe. Now, the IWF, the area I work with, we deal with illegal content, so we're dealing with the very worst of the content. So this is illegal content. It's illegal for everybody. It's illegal to make, to share, to distribute and to
produce. So, you know, basically we need to make sure that nobody has access to this content. But of course, looking at this content is not the worst thing. The worst thing is that actually children are sexually abused in the making of this content. And in fact, every single time somebody looks at that content, that child is revictimised, their abuse reoccurs, and it's not a victimless crime.
So what we need to do is do everything we can to put safety protections around children online so that this really hideous, heinous crime doesn't happen because children carry it with them for the rest of their lives.
What does the IICSA final report say about the challenge presented by online-facilitated child sexual abuse?
Well, the IICSA final report made a number of recommendations. Obviously only a few of them were related to online child sexual abuse. We were privileged enough to be co-participants in the IICSA inquiry on the online space, and it was very clear that we needed to put some specific protections in place for children. Of course, this was aligned to what was happening at that time. The Online Safety Bill was going through Parliament at the time, and actually IICSA was taking that into account.
So specifically on the online space, it made a number of recommendations. The first, which totally relates to our area of work, was the need to screen for child sexual abuse. So instead of sort of just relying on people might do it, companies might do it. There would then be, a commitment from companies to have to pre-screen/screen to ensure that child sexual abuse did not go onto their platforms using a range of technologies to enable them to do that. And that was really important for us.
The second was the age verification side. So whilst the IWF is not an organisation that deals with inappropriate content that children are accessing, we are also, co-directors of the UK's Safer Internet Centre, so obviously we care very, very much about children's access to that material. So we want to ensure that children do not have access to pornography. We also want to ensure that children who are under 13 don't have access to social media.
So we really want to see robust age verification and age appropriate tools put in place on the online safety bill. And the third was the CSE/A, the Child Sexual Exploitation and Abuse Code of practice, which of course, is, under the Online Safety Bill.
You mentioned the Online Safety Bill, which is soon to be given royal assent and will become the Online Safety Act. How does the Online Safety Act dovetail with the final recommendations?
Now, prior to the, bill going through in relation to online child sexual abuse, companies worked on a voluntary basis. So they were obliged kind of morally to do what they could to keep their platforms clean of child sexual abuse, or to do as much as they possibly could to ensure that it didn't get loaded onto their platforms, but there was no kind of transparency or accountability around
that. Now, what's really important about the Online Safety Bill is that will no longer be a voluntary thing, but they will actually have to legally comply with that. So they will have to demonstrate, how they are doing the best they can to keep their platforms as clean as possible. And that will be to ensure that there are robust online safety tools, that there are robust tech solutions. So we provide a number of tech solutions to companies.
So when we talk about screening platforms, what we're talking about is we provide things like a hash list, which is a list of digital fingerprints of known child sexual abuse images — we currently have about 1.2 million of these — and companies will deploy that across their platform to stop anybody uploading a duplicate image. If it has a match, it won't go onto the platform. So that's really important so that that content doesn't get onto the platform to begin with.
We also provide things like a blocking list, a URL list, a list of web pages that currently contain child sexual abuse and haven't been removed from the internet yet. They will be obliged to make sure that people can't access that material. It's really important that these elements of the IICSA report, which raised awareness of the fact that that a lot of companies weren't doing that, they now will be legally obliged to do
that. The other thing that's important to say in relation to how the Online Safety Act, as it will be, in a couple of weeks, dovetails with the IICSA final report, is an awful lot of the detail has yet to be worked through. So, whilst we have some fundamental principles in place around the Online Safety Act, the actual operational side is really still to play for.
So we need to ensure that when the consultation comes out, and they'll be dealing with illegal material in the first instance, which is the area we work in, but some of the sort of knottier, more difficult questions around harmful content and making sure that we keep children safe online have to be worked through. So it's not a job
done yet. And that's why it's really important to keep the pressure on about the IICSA recommendations, because we are all, across the child protection spectrum, online and offline, we're working together to keep people focused on these are our recommendation. These are the things we want to see. And we can't just sit there and be complacent and think, well, the Online Safety Bill is done and dusted, so that's going to cover everything. So there's still a lot of work to do.
And finally, what can professionals working with children and young people do to keep them safe online?
Well, one of the things we would always say about the ways in which professionals working with children and young people can help them keep safe online is that it's not just a one thing is the solution. You know, actually you have to take a joint approach. So, we work in technology. Now technology is part of the solution. It's a major part of the solution. And the internet companies have got a lot more to do to ensure that they keep children safe online. But that's not the whole picture.
We also need to have proper legislative and law enforcement support. Hopefully this will be resolved through the Online Safety Bill. But also we need a really strong education and awareness programme. And that's why it's really important that a lot of us work together.
So the IWF, the organisation I lead, we are very much dealing with technical solutions, but it's really important we work with organisations like the NSPCC, because we don't deal directly with children, we don't have that level of expertise, but we can share our knowledge between us. And that's really
important. And a great example of that is that we run a project called Report Remove together, where we enable young people to self-refer nudes of themselves for us to get them removed, to stop them being criminalised and to get those taken off the internet. We deal with the kind of technical, how do you take it down off the internet, and the NSPCC deal with the safeguarding aspect, but we join together on some of the education and awareness around that.
So I think what's really important is that everybody works together and we recognise that there isn't a single solution to this. But the other thing we really feel strongly — and I know this is shared across the board — that parents and carers, they do have a responsibility to make sure they do the best to keep children safe online. And you can't just bury your head in the
sand on this. So, in the same ways you would on any element of children's safety, you need to not be scared by the internet. There's lots of help out there. There's lots of resources. There's lots of practical know-how points to help you keep yourself safe online. And one of the things we've discovered through the research we've done is that, you know, one meaningful conversation can make all the difference. So it's really important that people talk about that.
So you have to think about and learn about platforms that your children are on. You have to talk to them about what they're doing. You have to set family rules and family guidelines that everybody sticks to, and you have to take a sensible approach to this. But I think being scared of the internet is not helpful. Let's just all accept the internet is a wonderful thing, wonderful. But we have a responsibility to tackle that really dangerous, unsafe
element. And if you've got a six- or seven-year-old, they really shouldn't be in that bedroom on their own with a camera-enabled device and an internet connection without supervision. So don't think just because they're in your house that they're safe. You have a responsibility to know what they're doing. But don't panic because the help is out there as well.
As Susie said earlier, the Online Safety Act introduces legal requirements for companies to prevent illegal content from appearing on their platforms. This includes content depicting, promoting or facilitating child sexual abuse. If age inappropriate content, such as pornography, is present on a platform, companies must also use age verification tools to prevent children from accessing this content. This can be seen as a fulfilment of IICSA's recommendations on online safety.
Recommendation 12 proposes that providers of internet search services and user-to-user services pre-screen uploaded content for known child sexual abuse material. Recommendation 20 proposes that the UK government change the law to make sure that social media platforms and other companies that provide online services introduce better age verification measures.
However, as Susie says, we will have to wait and see whether this legislation has the desired effect or whether more steps are needed to tackle online-facilitated CSA. I wanted to find out more about how law enforcement responds to online-facilitated child sexual abuse, so I spoke to Ian Critchley, the National Police Chiefs Council lead for child protection.
I genuinely feel this is one of the most critical areas in society that we are now now dealing with: the explosion of the internet. As we know, it's a real positive with opportunities for us all, and particularly for young people, but also brings with it a great threat and challenge that we must we must address.
And it's that area that I feel that we have a great responsibility for, both law enforcement and our partners, parents and carers — and I'm a parent of three children myself — but also, most importantly, the industry and the companies who should take the greatest responsibility. The accessibility now to young people, 12- to 15-year-olds. And there's a doubling of, since 2011, of access to smartphones.
So we will be in the 90% now of 12- to 15-year-olds, but of 8- to 11-year-olds; we're over 20% now of 8- to 11-year-olds who have a social media account. So we must ensure that we protect young people from harm. What does that harm look like? It is of the highest level, from adults who seek to groom exploit young children by meeting with them, having facilitated meetings online, seek to blackmail them to share further images of themselves.
And we see some of the worst offending that we know has huge, huge impact for the rest of children's lives. And clearly, myself, my colleagues, NCA, other law enforcement, both in the UK and around the country, are working tirelessly to identify these offenders. We're also seeing a rise in relation to peer-on-peer offending.
We saw from the Everyone's Invited campaign, which called out offending within the school, particularly within the school environment, of high harm offences that were being committed between peers of which there is absolutely criminal justice route for high harm offending. But what we also saw was what we say is a normalisation of behaviour in this area. So what do I mean by that?
Young people taking imagery of themselves, self-generated imagery, sharing it with their partners, consensual partners. And of course, they might be the partners at the time but clearly once an image is shared, it can be lost and therefore used across the internet in many different ways. We don't want to criminalise young people in this area. It's important that we're able to safeguard and protect them as well.
And this is just where we are now, clearly, on top of that, we have a growing development of artificial intelligence, children going into what we call the metaverse as well, young children going into, you know, social media, gaming, and not knowing who they are dealing with or confronting.
So, really important that we take our responsibilities as law enforcement and partners, really important as parents and carers that we have those challenging conversations — I know how difficult they are, but we have them — and give trust and confidence to the young people to engage. But most importantly, that industry steps up to the mark, much more so than it's doing now. And I really welcome the Online Safety Bill and the impact of that should have for you.
For you, do the IICSA recommendations on online safety go far enough?
I think IICSA really identified the critical issues here for us all, working together, that young people are facing now in an ever changing society. So I think it fulfilled its role in making the recommendations and dovetailing across into the Online Safety Bill, without seeking to try and duplicate or replicate what needs to be coming in law.
And it's that aspect that is absolutely crucial to make sure that companies are able to prevent, first of all, the loading of child abuse material onto their platforms that they make millions and billions of pounds from. We're not talking just about, you know, we're not talking about dark web here. We are talking three clicks. Three clicks — which again was highlighted in the report — to access child abuse material. So first of all, stop it being on their platforms in the first place.
Secondly, a legal duty to identify and report to the authorities once it's there. And thirdly, to remove it from their platforms, as well. We do have, to some extent, good engagement with industry where this happens, particularly with partnerships with, for example, the Internet Watch Foundation, in order to be able to report and remove this material. But it is... We are talking about the tip of an iceberg when we consider the extent of offending that I've outlined already.
And, no matter what is done — by parents, carers, by law enforcement — until industry plays its role, not because they're forced to, because there are legal duties. Because for me, they should have a moral duty to make sure that those people who are using their platforms, that they have created these communities, they have a moral duty to keep those communities safe. And if they don't, frankly, then they'll find that people will walk away, quite rightly, from that.
I believe this area, the online area, also much wider than we're talking about child abuse, because of course, we've seen children access to other harmful material. We've seen the impact on suicides in some really dreadful cases that have been highlighted in the news and inquests that have taken place as a result of the impact of harmful material that young people have seen. But I genuinely feel this is one of the biggest public health issues facing
children. I'm really grateful for the panel within IICSA making this area really prominent. I also believe it will feature prominently in the rewrite of Working Together that is ongoing and being consulted with at this moment in time. I don't think at this moment partners consider the threats around online probably quite as much as we do in terms of some more traditional threats around child protection. But I think that is starting to change. And we take a responsibility for that.
And you mentioned the Online Safety Bill earlier. Does this piece of legislation do enough to address CSA? There are concerns around the ability to enforce the proposals laid out in a technology space where end-to-end encryption exists, for example.
I do believe it's an effective piece of legislation. Clearly it's only effective subject to how then it is implemented and how it is regulated. And Ofcom are clearly the main regulatory body in this regard. The main duty in relation to child sexual abuse is the necessity to prevent, report and remove around it. I think the first year or two will require companies to outline to Ofcom how they are going to mitigate and manage that risk of harm. They will have a specific duty around risk
assessments. They will have to demonstrate how they are proactively identifying child sexual abuse material and how they are seeking to take reasonable steps with technology to prevent it in the first place. And I think that's going to be absolutely the key in terms of what and who defines what reasonable steps are being used to prevent it. I am concerned around the impact of end-to-end encryption.
That seems to separate the need and the societal need to protect children, being pitched against a privacy argument. This isn't the privacy issue. And I totally understand the necessity for privacy for young people, but there are sufficient technical, enablers to allow privacy and contact between consenting people to that that protects children and identifies offenders. It's unfortunate that the language is being used to try and conflict the two.
All of us have a duty to protect and safeguard children. There will be a legal duty to do that for the companies. They cannot water that down, or should not be able to water that down, by saying, "well, we've brought end-to-end encryption in and therefore we can't see
what's going on on our platforms. Therefore, how can we prevent it or how can we report it or remove it?" They have the technical capabilities to ensure there is encryption of message yet to be able to identify, report and remove indecent images of children. That is a must. That is my concern. I think my other concern is the speed in which we move from implementation and enactment to be able to identify non-compliance around it.
So, the duty for companies to manage and mitigate risk, to complete risk assessments, to demonstrate what they're doing, and then for Ofcom to assess that and then determine and identify where there is non-compliance; I'm just concerned about the time scale. I think this area is moving so quick. We're already talking about— it's not something in the future when we're talking about artificial intelligence and virtual reality. It's already here.
We're already seeing child sexual abuse material within the metaverse. We are dealing with a huge increase in what will start to become an even bigger increase of demand in that area. And ultimately, where should we really be in this area? We should be preventing it rather than having to respond to it in the first place. I often will get and accept and acknowledge the need for law enforcement
to step forward. We've worked with Her Majesty's Inspectorate of Constabulary and Fire and Rescue Service to take forward recommendations for policing, so I acknowledge and take responsibility, as the national lead, that policing needs to do much more.
But being able to predict the demand that we've got here, being able to deal with this, as well as many of the things that policing needs to do, being able to concentrate on those who are committing the highest level of harm will best be done if industry prevents such material being on their platforms in the first place. It will still be there; people will still find their way to the dark web and other areas but absolutely it will make it safer
for children. It will mean that it reduces volume demand on us, and it will mean we can concentrate on those who are committing the highest level of harm. It's a real challenge, but one in which we must all strive to make sure that that community, that online community, is as safe as we would want our streets and our neighbourhoods to be.
Thanks to Ian Critchley and Susie Hargreaves. You can find a link to the Internet Watch Foundation's latest annual report in the podcast show notes. For more online safety advice, visit nspcc.org.uk/onlinesafety. In the next episode of Recommendations for Change, we'll be looking at justice and redress. What can be done to improve victims and survivors experiences of the criminal justice system?
If you've been affected by any of the issues raised in this podcast, you can reach out to the NSPCC Helpline for support, call 0808 800 5000 or email help@nspcc.org.uk. This podcast series was produced in Autumn 2023. All information was correct at the time of recording, but the world of child protection is ever-changing. To stay up to date, visit the NSPCC Learning website at nspcc.org.uk/learning.