LFGSS and Microcosm shutting down 16th March 2025 (the day before the Online Safety Act is enforced)

First Offcom haven't yet released the tool you use to assess the harm. It may be worth waiting until they do that and you can go through it to decide how difficult it will be to comply or not.

The tool will be here:

https://www.ofcom.org.uk/Online-Safety/check-how-to-comply/

Then on your worry about liability, I know it says 10% of annual turnover or £18 million whichever is greater.

However it does NOT say they can impose a higher penalty than your annual turnover. That seems very implausible as it would be an impossible requirement on people like you.

I think if your annual turnover is less than £18 million the max is less than the turnover. They just haven't thought to mention that.

This seems to clarify that:

QUOTE STARTS

A relevant factor in securing this objective of deterrence is the turnover of the regulated body subject to the penalty. Penalties should be set at levels which, having regard to that turnover, will have an impact on the body that deters it from misconduct in future and which provides signals to other bodies that misconduct by them would result in penalties having a similar impact. That is, it must be at a level which can also change and correct any non-compliant behaviour, or potential non-compliant behaviour, by other providers.
...
This is not to say there is a direct linear relationship between the size and turnover of the regulated body and the level of the penalty. While a body with a larger turnover might face a larger penalty in absolute terms, a body with a smaller turnover may be subject to a penalty which is larger as a proportion of its turnover, for example. We will impose the penalty which is appropriate and proportionate, taking into account all the circumstances of the case in the round together with the objective of deterrence.
https://www.ofcom.org.uk/about-ofcom/corporate-policies/penalty-guidelines/

It doesn't say explicitly that the penalty is always less than the turnover but it doesn't make sense in the context of the rest of it for it to be higher. A penalty more than annual turnover would be enforced closure of the business for many businesses and force bankruptcy. That makes no sense given that the aim is to get them to comply not to get them to close down.

So at most you'd risk losing a fraction of your turnover.

Also from what you say then the risk is surely low. It will be easier to know once the tool is available but nothing in your description suggests a high risk of harm to kids or even medium. Surely the risk to kids is very low.

Also the focus would be on large businesses first. They may never get around to businesses as small as yours.

Also if they do, they would give you warning first and give you a chance to comply as that is the point in it - not to close websites down but to get them to comply with the requirements.

If you feel you can't you could close your site down at that point after talking to them, explaining you can't do what they ask of you, get their feedback and then if you still can't comply you can explain that to them. The worst happens at that point is that you have to run the site with not enough income from it due to the fines whatever they are and it might be that members of your site would club together to keep it going.

There is no way they just give you a fine out of the blue forcing you to close down the business without first discussing with you to try to find a way forward for you to achieve compliance.

I'm not sure what the next step would be, perhaps contact Offcom but maybe they are too busy. I expect you tried?

But maybe wait for the online tool to be available, go through it, complete the assessment and send it to them and take it from there. You surely would assess the risk as low. And then see if you can ask them questions about your concerns at that point.

How does that sound?

Welcome to the forum. Do you work for Ofcom?

You are Lynchman, ICM5P!

😂

Lynchman would definitely be the type of person to abuse this if he was smart enough... Too bad he's dead

I'm very late posting here because I've been under the weather all this week.

First, like so many others, I want to express my gratitude to Velocio for the great work done in creating and maintaining this forum.

We users have perhaps abused Velocio's generosity by allowing one person to be so central. This is something which has happened many times in the world of cycling clubs and the result is usually a collapse when that vital person goes (one classic example - Clarence Wheelers and Alf Whiteway).

I feel the only way forward is for some one else to put their head over the top of the parapet, and preferably more than one person.

Since the high point of my own computer literacy is being just about able to use this forum, I'm afraid I have little to offer beyond moral support and a modest cash contribution if that will help matters.

No. I am just a voluntary fact checker who helps scared people. All I have is what I shared, those quotes from Ofcom's own website.

How I know about this is just that this story is spreading virally on the internet. I fact checked it for scared people who worried it meant small businesses and voluntary organizations would have to shut down.

And after fact checking it I thought as a courtesy I'd post back here in case my fact check was useful to Velocio as they don't seem to be aware that the penalty is limited to a fraction of the turnover.

If the main concern is a penalty of £18 million it is pretty clear this simply can't happen. Indeed if the turnover is £0 not sure they can even do any fine. But the text doesn't explicitly say "any fine has to be less than the turnover". So to confirm that, I'd recommend contacting someone from Ofcom if available.

So anyway hope this helps :). Just going the extra mile to help someone in case it helps.

the penalty is limited to a fraction of the turnover.

Indeed if the turnover is £0 not sure they can even do any fine.

That's not really fact checking. That's pure supposition.

LFGSS turnover isn't £0. The income it has from donations goes to pay the server costs. So any fine would/could have a significant financial effect - the money would have to be found from somewhere since there aren't piles of spare cash lying around.

Secondly the admin headache of having to deal with a possible Ofcom investigation should not be discounted. Nor should the possible legal costs that may be required to deal with a possible investigation.

Sure you can say it is "unlikely" but you can't guarantee that is not going to happen. Hence the risk.

My feelings on the whole subject.

1 Attachment

If the main concern is a penalty of £18 million it is pretty clear this simply can't happen.

If you read back in the thread you'll see that there isn't as much concern about that. Setting up as a company or similar will limit liability there.

The greater concern is the possibility of senior management being criminally liable.

I don’t know about anyone else but a general thought as I compulsively check this thread:

The @ user [number] stuff in here is, while offering quite a lot excellent food for thought, hard to follow and understand the intentions and consistency of reasoning and contribution of.

Thanks to anyone who has registered from other communities at this difficult time but I feel it would generally help this thread to give a relevant user name and generally contextualise why you are here to distinguish yourselves from potential troll behaviour.

It's okay - I don't mind what you call this. It is just something I think may be worth you following up if you haven't already.

I think my first comment was a bit confused, this may be clearer. If this is of no interest to you that's fine :).

.1. I was drawing your attention to what Ofcom say on their penalty page, since the concern seemed to be a small risk of a huge penalty of £18 million.

QUOTE While a body with a larger turnover might face a larger penalty in absolute terms, a body with a smaller turnover may be subject to a penalty which is larger as a proportion of its turnover

https://www.ofcom.org.uk/about-ofcom/corporate-policies/penalty-guidelines/

It never suggests it would impose a penalty larger than the turnover. Indeed it seems pretty clear that the penalty would still be a proportion of the turnover even if larger as a proportion for a company with a smaller turnover.

Naturally I can't clarify this further for you. But Ofcom may be able to do so.

.2. Compliance may turn out to be easier than you expect when you go through with the tool. You won't know until it is available.

Then the usual procedure is

1. starts with a complainant or whistleblower or you yourself raising an issue with Ofcom. If that never happens then you don't get investigated.

2. Ofcom considers various factors to see if it will proceed with the case at all. Such as seriousness and strategic significance.

3. optionally it engages with you to try to get it fixed without an investigation.

4. optionally it sends warning letters.

5. may decide to widen the investigation to the industry generally to see if there is some solution

That's from their document here page 11 https://www.ofcom.org.uk/siteassets/resources/documents/online-safety/information-for-industry/illegal-harms/online-safety-enforcement-guidance.pdf?v=387566

So - again it may ease your concerns to ask someone at Ofcom to clarify the procedure.

I can't say myself as I am not Ofcom.

But based on what I found out it seems plausible that [OF COURSE NEEDING CONFIRMATION]

. 1. (NEED TO CHECK). You are likely far too small to be of interest to Ofcom who will focus on the likes of Twitter, Facebook, Google, TikTok first. They most likely never follow up such small websites as ones where the owner only puts a few hours work into them a month.

.2. (NEED TO CHECK) On the remote chance they follow it up, they likely to talk to you over a period of time to help you to comply before considering fines. You could shut down at this point if the process of complying is too much hassle for you.

.3. (NEED TO CHECK) on the very remote chance they go as far as to fine such a small provider as you, the total for any fine is likely to be less than your annual turnover, so if the fine is too much to keep going at that point, you pay the fine, from your assets for the business and donations for that year and then close it down,

.4. (NEED TO CHECK) enforcement doesn't seem to involve court action or legal fees on your part so long as you pay any fine.

Depends on how keen you are to keep it going but if you are this may be useful information. Or maybe not. At any rate that's all I have :).

Okay. There is a process and though it's optional surely with a small organization with only one person working for a few hours per month - first - highly unlikely they ever get to you given limits on their time and much higher profile cases like Facebook, Twitter etc. But if they do - then the normal process would be to talk first and find a way to comply and some action plan for how to comply. At that point if the action plan is too onerous then just shut down [never likely to reach this point]. Then warning letters and only after the warning letters are ignored and something very serious is going on especially causing harm to kids, and being ignored - then they would fine and only consider criminal action if it was very serious indeed.

That is what one would expect of the process. All this WOULD NEED TO BE CHECKED.

But it would be astonishing if they were to spend time fining never mind a court case to imprison someone who does this voluntarily a few hours a month.

I think your risk is likely zero but of course understand wanting to be certain of that. I can't provide the certainty but perhaps Ofcom or someone else can and I hope you find the answers you need.

What you say makes sense, but that's kind of the problem. You're making a very sensible interpretation of how this should play out given how the law is described, but it's the ambiguity in the wording that gives cause for concern.

My financial security being dependent on the common sense of a room full of strangers would personally be extremely anxiety inducing.

There’s also a “what is the source of truth” question in play, more generally- having read a bit more they pulled the requirement for sites to monitor/deal with misinformation- but if the entire moderation team of a site is quite to far right then they may not be able to recognise what is and is not misinformation - the race riots in the UK being caused by “legitimate concerns about immigration” for example, which is (depending largely it seams on your political orientation, but obviously not exclusively) a Tommy Robinson fan position.

I think your risk is likely zero

Personally I'd say the risk is nearly zero but not zero and it's that tiny gap which is going to be the issue for some (not all).

The vast majority are just going to be able to carry on fine, a few may come to Ofcom's attention and never get followed up, an even smaller number may have to jump through some hoops or end up closing their site.

But there's probably going to be a small number of examples being made. Someone not doing something quite as expected, someone at ofcom having a bad day or ofcom needing a sacrificial lamb to hold up and say this is what happens if you don't comply.

We've seen it recently with train fare penalties. Prosecutions for people who missed the small print and saved a couple of pound on their fares. Hugely disproportionate but once you're in the system you're screwed.

Another article this time from Techdirt: https://www.techdirt.com/2024/12/20/death-of-a-forum-how-the-uks-online-safety-act-is-killing-communities/

someone at ofcom having a bad day or ofcom needing a sacrificial lamb to hold up and say this is what happens if you don't comply.

I think Ofcom will end up in court if they did that, Ofcom needs to follow the Human rights act and ECHR. How Ofcom been acting so far its clear they are not ready for any legal challenge on free speech grounds (Tho I know the UK has weak free speech laws)

Oddly, that looks like another forum. Will it be subject to the same legislation?

I keep looking at this to try and predict the likely scale of enforcement/punishment, although no idea if it’s a reasonable comparison

https://en.wikipedia.org/wiki/GDPR_fines_and_notices

Everything you say makes sense... but it's not what the Online Safety Act actually says.

And if we're quoting Ofcom, then they also ominously state that what they published on Dec 16th is "This is just the beginning...": https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/time-for-tech-firms-to-act-uk-online-safety-regulation-comes-into-force/

This is just the beginning

This first set of codes and guidance, which sets up the enforceable regime, is a firm foundation on which to build. In light of the helpful responses we received to our consultation, we are already working towards an additional consultation on further codes measures in Spring 2025. This will include proposals in the following areas:

• blocking the accounts of those found to have shared CSAM;
  
• use of AI to tackle illegal harms, including CSAM;
  
• use of hash-matching to prevent the sharing of non-consensual intimate imagery and terrorist content; and
  
• crisis response protocols for emergency events (such as last summer’s riots).
  

And the Ofcom head herself, on that page, stating:

Those that come up short can expect Ofcom to use the full extent of our enforcement powers against them.

You've focused on a single aspect of risk, and it's the one that is trivial to mitigate... liability of an entity can be solved by setting up a CIC.

But you didn't focus on the risk of criminal liability faced by officers of the entity, which breaks the Ltd structure of a company or a CIC... and for which, if you get arrested you no longer can travel visa-free to the USA or Europe under ESTA / ETIAS... it's an admittedly small risk, but in the last 12 months I've travelled to 17 cities over 21 trips (some cities obviously more than once)... so merely interacting with the law is career ending in my case.

You also didn't focus on the cost of compliance which I outlined in the first post, the cost of legal compliance, technical compliance, training materials, response time, etc, etc... which as the sole person who has been doing this for so long, it's a cliff face of effort to climb. Some of the technical compliance speaks of requirements to use tools that do not yet exist, but I can guarantee won't be open source and free to use, i.e. age verification, AI content scanning, etc... so a real World increase of the cost to operate too (needing more donations).

I outline in the first post the two key documents, published by Ofcom on the 16th December, and called out the specific parts of their own guidance that would describe this site and other fora as "Medium risk" (IANAL, that's my interpretation) and a "Multi-risk service" (IANAL, just experience of being a site admin)... those costs I outline appear to be very real.

The risk is arguably low, but the costs of compliance are high, and presumably if something harmful did occur and we were not compliant then the risk is much much higher.

And remember, this isn't just illegal content, we've always been very good at moderating that as every other forum admin I've ever interacted with... this is "harmful but not illegal" content... and the descriptions of that are vague, are subjective.

A page or two ago I gave a real-World example of an event that happened on this site when a person who could easily be argued to be vulnerable, faked their own death and attempt to fund-raise for their own funeral... this ticks so many of the "harmful but not illegal" boxes, and I have many examples over the years of such things... that example sure, I chose it because people here likely recall it and it ticked all the boxes at once, but so many examples tick a box or two almost daily.

Your words are reassuring, but don't begin to cover the complexity of what the law is, what the guidance is, what the real World experience of moderating a forum is, and the personal circumstances of the admins who run forums.

Unfortunately when I've been appalled at laws in the past and seen them introduced under the promise that they would never be abused, in the UK we so often can cite hundreds of examples of them being abused or mishandled due to incompetence. From councils using terrorism laws to refuse disabled parking permits, through to scandals like the Post Office subpostmaster thing which shows how the slow wheels of bureaucracy just do not care. As a trans person dealing with the health system I can see how malicious a Govt system can be, and I cannot imagine how badly Ofcom will handle a case when it arises - the argument of "they are understaffed so will only focus on the big tech" rings empty to me, I feel they'll just do everything badly, and badly here has consequences for me. The unimaginable happens... it's a failure of imagination to believe that they do not.

Your tolerance threshold for risk is different from mine, you aren't the one accepting liability here or these risks, it seems like you have not seen these things that occur on the internet daily, and you'll forgive me for having the imagination to believe that these risks, for me, are real, as are the costs of compliance.

Techdirt a news site so exempt.

This is a nice example of how - regulation is good actually. Absolutely massive fines for Meta, Google, Amazon etc. Actually confronting these corporate behemoths who act like they are above the law and fuck us all over, all the time, normally with impunity.

I will be as sad as anyone else to see LFGSS close down but I do think that something like the law proposed is necessary, and I'm certain it will leave the world a better place.

As many others have said it's very clear the risk of Ofcom going after LFGSS is so minimal as to be meaningless, when viewed objectively. But obviously, Velocio doesn't have the luxury of viewing it objectively, doesn't owe anyone anything, and frankly doesn't need a reason at all - let alone a good one - if they want to close the forum, after running it so well for so many years.

This is a nice example of how - regulation is good actually. Absolutely massive fines for Meta, Google, Amazon etc. Actually confronting these corporate behemoths who act like they are above the law and fuck us all over, all the time, normally with impunity.

Oh gosh yes, I cannot wait for X to be in the firing line of this law, and I am here for that.

The law should actually encapsulate the spirit of "we only go over those whose negligence carries the most widespread consequence", and enshrine a "this act applies to all whose global annual turnover is 1,000x the UK national average salary" (this phrasing allows the threshold to move over time... today the national average salary is about £36k, meaning the threshold would be £36M... which covers every major company, but excludes all small voluntary, sports clubs, CIC, small business, small charities, etc.

X... holy crap, this law should just block X from operating in the UK and block their domain and IPs.

X... holy crap, this law should just block X from operating in the UK and block their domain and IPs

As I read through the links shared I wondered if both X & FB being turned off in the UK might be an eventual end point.