Summary

  • Ofcom opened investigations into two unnamed adult services on 26 October. In the image-hosting case, it is checking the provider’s risk assessment and steps to detect and remove known non-consensual intimate images.
  • Ofcom’s code labels its hash-based intimate-image detection measure C14. An unverified first match goes to review; providers must measure false positives and document their settings.

A hash is a compact fingerprint. It lets a service compare an uploaded image with material already identified as non-consensual intimate imagery. That sounds like a tidy job for a machine: compare, flag, remove. Ofcom’s code gives the machine a smaller job and its operator a much larger one.

On 26 October, Ofcom opened two investigations into unnamed adult services: one hosts images; the other shares adult content. The image-hosting investigation asks whether its provider kept a suitable illegal-content risk assessment up to date under section 9 of the Online Safety Act and adopted the Code’s C14 hash-matching measure—or alternatives—under section 10. Ofcom says it withheld the names because of the nature of the sites. C14 is the code’s measure for detecting known non-consensual intimate images with hashes, where the service falls within its scope.

For services covered by C14, a first positive match against an unverified hash at a given perceptual-hash configuration should trigger review. Other matches can be removed when the provider has enough confidence in detection; otherwise they call for review. Human moderators must review an appropriate share, weighing detection assurance, the harm of leaving abuse online and the impact of a false takedown on a user.

That balance has paperwork attached. The hash set should contain a significant number of original items, receive regular updates and resist tampering. Providers should remove hashes they establish are wrong. They must account for false positives, check whether precision and recall remain in balance at least every six months, and keep a written record of how the settings were chosen. A filter that cannot explain its misses and mistakes is a filter with a governance problem.

The controls start before the first scan. Section 9 makes the provider assess the service’s risks and keep that assessment current. Section 10 turns the assessment into proportionate measures: prevent exposure to priority illegal content, manage the identified risks, minimise how long illegal material stays up and take it down swiftly when the service learns of it. A hash system is one instrument in that chain; the service still owns the result.

Ofcom’s programme page says it engaged 25 services it considers high risk. Several are implementing StopNCII hash matching; several have geoblocked UK users, which Ofcom is monitoring. Now two formal investigations sit beside that wider supervision. The public record does not identify the services or disclose their match configurations, error rates or evidence supplied to Ofcom. Those are the facts that will show whether the controls work.

If Ofcom identifies a failure, it says it can fine a provider up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. Section 144 adds a longer reach: Ofcom can apply to a court for an order against ancillary services such as payment, advertising or internet-access providers. The court must find statutory grounds, a link to an ancillary service, necessity to prevent UK harm and proportionality; it must also weigh the rights of the service, the ancillary provider and UK users. The judge holds the switch. Ofcom has to make its case first.

The test is an auditable operating system: risk assessment, matching, human review, correction and removal, with records that show it working.

Sources