Facebook under pressure to resume scanning messages for child abuse in EU

Half of referrals for child sexual abuse material could be falling under the radar after changes to EU e-privacy directive

 Data shows a 46% fall in referrals for child sexual abuse material coming from the EU since Facebook turned off scanning. Photograph: Graeme Robertson/The Guardian

Alex Hern - @alexhern-Wed 20 Jan 2021

The children’s charity NSPCC has called on Facebook to resume a programme that scanned private messages for indications of child abuse, with new data suggesting that almost half of referrals for child sexual abuse material are now falling below the radar.

Recent changes to the European commission’s e-privacy directive, which are being finalised, require messaging services to follow strict new restrictions on the privacy of message data. Facebook blamed that directive for shutting down the child protection operation, but the children’s charity says Facebook has gone too far in reading the law as banning it entirely.

“It’s striking that Facebook has interpreted the failure to reach agreement before Christmas as requiring them to stop scanning, when what that seems to be is a breaking of ranks from the rest of the industry,” says Andy Burrows, the charity’s head of child safety online policy. The rest of the industry, including Google and Microsoft, has come to a different conclusion about the continued legality of such scanning, Burrows added.

“What’s important here is that we don’t lose sight of what this means,” he said, adding that 250,000 reports come from the EU each month.

“There has to be a clear risk from Facebook right now that abusers are seeing this as an opportunity to target children using Facebook services, because this is a period when most of the monitoring services are turned off,” he said.

The US National Center for Missing & Exploited Children has released data showing a 46% fall in referrals for child sexual abuse material coming from the EU in the first three weeks since Facebook turned off scanning. In the UK, which is no longer covered by the directive, Facebook continues to operate its scanning programme, as it does in the rest of the world.

Polling shows that 18% of UK adults trust Facebook to make the right decisions when it comes to protecting children from child abuse online, against 55% who disagree with the statement. The NSPCC’s fear is that the social network is using the new regulations as a pretext to stop scanning for child abuse imagery, since it is openly planning technological changes which would make such scanning impossible.

In 2019, Mark Zuckerberg announced a “pivot to privacy” for Facebook, with a plan to integrate the company’s messaging services (Messenger, Instagram and WhatsApp) and encrypt the contents. “When the rest of the industry has arrived at the conclusion that scanning is permissible, and recognised that the immediate impacts of stopping it are considerable, it feels highly improbable that Facebook’s alternative reading isn’t directly related to where they want to go with end-to-end encryption,” Burrows said.

In a joint statement, four of Facebook’s competitors, including Google, Microsoft and Roblox, said last year that they would continue to scan their platforms. “We believe the only responsible approach is to remain steadfast in honouring our safety commitments that European users – and, indeed, users around the world – expect and rely upon,” the four said.

But Facebook denied it had a choice, and disputed the allegation that it was seeking other reasons to stop scanning. “We’re committed to complying with the European commission’s e-privacy directive (ePD) in the EU,” a spokesperson said.

“We continue to be concerned with parts of the ePD and the proposed amendment. We have suggested changes that would permit us to use metadata to help keep people safe while retaining important privacy protections.

“Our compliance with the e-privacy directive does not mean we are stopping our fight against child sexual abuse and we still have a number of tools in place to help keep people safe. We’ve invested heavily in technology and people to prevent, detect and respond to potential harm and abuse, and will continue to invest in these tools as allowed under the law.”

The EU is finalising the new rules through its trialogue process, in which the European commission, council and parliament negotiate a final version of the text. When that is concluded, which could be as soon as next week, there may be more explicit permission for Facebook to resume its scanning.