foundation for information policy research

Welcome

The Foundation for Information Policy Research is an independent body that studies the interaction between information technology and society. Its goal is to identify technical developments with significant social impact, commission and undertake research into public policy alternatives, and promote public understanding and dialogue between technologists and policy-makers in the UK and Europe.

Announcements

  • The Ticker Tape: Digital Strip Search – about to become even more intrusive?

    Professor Peter Sommer, Visiting Professor of Digital Forensics at Birmingham City University and a Visiting Professor at De Montfort University Cyber Security Centre, discusses changes to the law around the collection of evidence from smartphones.

    A police constable who has legally acquired your smartphone will now be able to explore not only its immediate content but also exploit links on it to external services including those relating to health, personal finance, sexual interests, social media memberships and the activities of employers. 

    That is the effect of S.173 Crime and Policing Act 2026.  It will also remove any ambiguity about the right to probe linked cloud storage facilities such as iCloud, OneDrive, DropBox and their many rivals.  The Act obtained royal assent last April but this section has not yet (as of October 2026) come into force. 

    All that will be required is a sign-off (which can initially be given verbally) from an inspector, the third lowest rank in the police.  Hitherto much of this data was only available via a Production Order granted by a circuit court judge.

    The Crime and Policing Act 2026 (C&PA 2026) is one of those omnibus multi-faceted items of legislation which cover several disparate areas; it has been all too easy to miss some of the new features.  The headline items were: new anti-social behaviour orders,  new laws on retail crime and shoplifting, an expansion of corporate criminal liability, increased penalties for weapon and knife sales, extended laws on child exploitation and stalking in general,  an expansion of  drug testing on arrest to specified Class B/C drugs, more police powers to enter and seize electronically tracked stolen goods without a warrant if impracticable, and a tightening of rules around protests near places of worship.  Small wonder that this extension of powers of interrogating smartphone and computer devices searching did not attract much attention.  

    Digital Strip Searches

    The examination of a smartphone is currently the most intrusive form of investigation used by law enforcement and others.  Unlike interception and bugging which only capture what is being said at the time the relevant equipment is switched on, searches of smartphones and personal computers yield considerable historic data in the form of emails, texts, social media postings, photographs, videos and Internet queries.  The average UK smartphone owner uses it for 4 hours each day.

    There will be substantial documents, letters, notes, spreadsheets, files received from correspondents. There will be lists of contacts. The harvested material will not be limited to what was first originated and received on the immediate device under examination as owners tend to migrate data from an old device when a new one is acquired.

    Digital forensic technicians can access nearly all of this material; in addition some deleted matter can be recovered.  Data not normally visible but embedded within visible files – metadata – can also be extracted which can show the location of a phone, and hence its owner, at a specific time.  This is particularly true of photos taken via the phone’s camera.  Highly detailed accounts of a phone’s movement can be taken from GPS data – what makes the phone’s map app function – and also points at which the phone interacts with a bank ATM, or retail POS terminal or makes a public transport journey.

    In the case of mobile phones law enforcement can apply for communications data which not only reports on who called whom, when and for how long, but also provides detail of the location of the phone when a call was made or received and, though with less detail, when the phone was in data mode to use the Internet including VOIP calls. This is cell-site analysis.

    The Conundrum

    Most people are keen for the police and intelligence/security services to use maximum techniques to prevent harm and detect wrongdoing. However they also have a very strong sense that some activities are private and should not normally be available to others. Balancing these clashing needs is a persistent problem throughout surveillance law.

    The simplistic response to this conundrum is that law enforcement activity should be constrained and confined to what is “relevant” to a particular declared investigation. But achieving this ambition in practical terms is far from straight forward.  There are three main problems.  First, relevancy is established only after an investigation in which irrelevant material has been inevitably viewed and considered.  Second, there is a conflict between ensuring that the acquired digital evidence is reliable, complete and can be trusted but also that any enquiry is limited to “relevancy”.   Third, setting up a policy activity framework within which investigators are expected to comply – everything requires detail in legislation, Codes of Practice, police procedures, and the courts’ own Criminal Procedure Rules.  These are all the more difficult to address as developments in smartphone software, applications and hardware (and indeed in computers more widely) mean that more data, different types of data and new forensic techniques are constantly appearing and are available for investigation.  Laws that are current may not address technical realities. Evidence of compliance implies the making of records and notes.

    Reliable Digital Evidence

    From the perspective of an investigator or prosecutor any evidence said to come from a smartphone or other digital device must be reliable and complete if it is to persuade a court. The content of a smartphone changes millisecond by millisecond. It is listening out for receiving phone calls, texts, Internet traffic including web material, social media postings, VOIP calls, wifi traffic, Bluetooth traffic, over-the-air updates to apps, updates to iOS, Android or other operating system, At any point the owner may decide to edit or delete material. At the same time individual items – emails, photos, chat logs – purportedly extracted from a phone to become evidence can easily be forged.

    To overcome this the practice is to carry out a formal set of steps in freezing the scene at a convenient specific point in time, usually very shortly after the device is in law enforcement possession.   A complete copy of the contents of the phone (the same applies to other digital devices such as laptops, PCs) is created using a combination of specialist hardware, software and procedures.  The complete copy contains much material which would normally be invisible to the regular user.  Falsifying of or contamination of individual items on a phone then requires much greater technical effort if the entire copy – sometimes referred to a forensic image – is available as many visible changes to a file or record are usually accompanied by other changes elsewhere on the phone and exist within an overall context.  

    But at the end, police investigators have technical access to everything on that phone.

    This approach to handling digital evidence has been a standard police procedure since the late 1980s – the so-called ACPO Principles. 

    Law enforcement acquisition of smartphones

    Law enforcement have several routes to acquiring a smartphone for investigation; there have to be two stages – legitimate physical control and then subsequent access for content examination.

    The easiest route is for law enforcement to request access from the owner.  That won’t usually work for suspects but it can for victims and third-party witnesses.  The concern of the victims will be for revelation of what they would prefer to keep private.  Against that will be fear that refusal may mean that a complaint/potential crime will not then be investigated. Particular problems attend cases alleging sex-related crimes. Some re-assurance is provided by procedures set up by the Police, Crime, Sentencing and Courts Act 2022 and turned into some level of practicality by the use of a Digital Processing Notice or DPN which is designed by the College of Policing/ National Police Chiefs’ Council. The DPN defines the purpose of an investigation.

    Where there is no voluntary provision of a device (among other routes):

    • Under s.1 PACE 1984 (Police and Criminal Evidence Act) a constable may stop and search any person in a public place if there are reasonable grounds for suspecting the presence of stolen or prohibited items.  Phones are included under s.1 powers but only as physical objects – separate authorisation is required to examine contents, usually obtained from a JP or judge.
    • Under s.19 PACE, a constable who is lawfully on premises (often under a s.8 PACE search warrant) may seize anything they have reasonable grounds to believe is evidence of an offence under investigation,or has been obtained through the commission of an offence, provided it is necessary to seize it to prevent it being concealed, lost, altered, or destroyed. A s.8 warrant is authorised by a JP (magistrate) or Crown Court judge.  No additional warrant is required for s.19 seizures.
    • Under s.32 PACE, following an arrest, an officer may search the arrested person and their immediate surroundings for anything that might be used to assist escape or that is evidence of an offence. Phones are included under this power. No search warrant is required under s.32, simply reasonable belief on the part of the arresting constable.  Under s.60 Public Order Act 2023 a person and vehicles can be searched without reasonable suspicion if they are within an area previously publicly designated by senior officers where they believe serious violence may occur. 
    • Under s.18 PACE, after arrest for an indictable (serious) offence, officers can search any premises the arrested person was in or controlled, and seize items found there.
    • Under s 50 Criminal Justice and Police Act 2001 (CJPA) if during a lawful search of premises items are found which are thought to be of interest there is power to seize items which may be inextricably linked to others. Powers of seizure include both the seizable property and that from which it is not reasonably practicable to separate it. The items can be taken away and examined elsewhere.
    • Under s 51 CJPA a similar power exists for extended seizure applies to seizure from a person. 
    • Under s 49 Regulation of Investigatory Powers Act 2000 (RIPA) there is a process by which law enforcement can demand access to encryption keys /PINs.  Refusal is a criminal offence.
    • Under Part 5 Investigatory Powers Act 2016 (IPA) an investigator can apply to his/her head of service (usually the Director General of the National Crime Agency) for an “equipment interference” warrant to hack – access remotely – a device.  This warrant is subject to a “double lock” authorisation, which is granted by the Investigatory Powers Commissioner’s Office (IPCO).

    There are, in principle, constraints on subsequent examination. The overarching constraint is under data protection law – GDPR (General Data Protection Regulation) – appearing in English Law via the Data Protection Act 2018. Part 3 of that Act, in a UK extension, deals with law enforcement processing.

    • Necessity and Proportionality: Any interference with an individual’s right to privacy (Article 8 of the European Convention on Human Rights) must be necessary and proportionate to the purpose of the investigation. Investigators must consider less intrusive means of obtaining the information first.
    • Warrants and Authorisation: Entry, search, and seizure often require a search warrant issued by a Justice of the Peace, Judge or the written authority of a senior officer, depending on the circumstances.
    • Legal Professional Privilege (LPP): Material subject to LPP (confidential communications with a legal adviser) is generally protected from seizure. If a device containing LPP material is seized under “seize and sift” powers, it must be isolated and reviewed by an independent lawyer.
    • Documentation and Audit Trail: Investigators must maintain a clear audit trail of all processes followed, and the device owner should generally be provided with a record of what was seized.
    • Return of Property: Seized material can be retained for evidence or forensic examination, but if a copy or image of the data would suffice, the original device should generally be returned to its owner. 

    These principes are reflected in Codes of Practice issued under PACE – specifically Codes A and B. For example, Code B, which deals with searches of premises, includes the following (following ss 50 and 51 (CJPA 2001)

    If an officer considers information stored in any electronic form and accessible from the premises could be used in evidence, they may require the information to be produced in a form which can be taken away and in which it is visible and legible, or from which it can readily be produced in a visible and legible form.

    Practicalities of Examination

    I have been examining computers for over 35 years and smartphones for as long as they have existed. There are very few special places in the storage areas of these devices where you can reliably expect to find definitive material to support a prosecution. Rather most of these devices even those belonging to relatively unsophisticated owners are complex scenes of crime.  Data can be held in many different locations – folders, directories.  The first action of any computer or smartphone investigator has to be to get a strong insight into how a particular device was being used by its owner. A digital forensics examiner will nearly always start with an overview of the device in front of him/her in order to get a sense of how it was used and the preoccupations of its owner.  

    Will the material of interest be in the form of an SMS text, a similar exchange via WhatsApp or its many analogues or via regular e-mail? Which of the many types of social media are being used? Do two people always use exactly the same medium of communication or do they sometimes use one form and then another, almost randomly? Are the first drafts to be found in a regular single location as might be the case for a smartphone where photographs taken on it are of interest or do they appear as attachments to emails or to text or a separate postings? Most people will probably use only one Internet browser but some may use more than one – Chrome and Safari or Firefox or Opera or Brave? If files are being bulk downloaded from elsewhere what software is being used, what records may exist of requests for files, where are the files themselves likely to be located?  If the investigator is looking for the broader interests of the owner – TikTok, YouTube, SnapChat, Discord, Slack and so on.

    The investigator may also want to form a view of the level of technical sophistication of the owner/user as in some cases that may be an alert that attempts have been made to conceal bad behaviour. 

    It follows, alas, from this that there is no easy way for an investigator simply to look at very small parts or a computer or a smartphone which are “relevant”. Rather they have to look at the lot and that means seeing a great deal that is irrelevant to an eventual inquiry and also, particularly in relation to smartphones, a high likelihood of material which is both irrelevant but which is private.

    Two examples from cases of my own:

    • A dealer had been approached by some men who intended to hijack some gold bullion and wanted it sold on.  The dealer didn’t deny the approach but said – and the police and prosecutors eventually accepted – that he wanted nothing to do with any deal.  An examination of his computers showed he was an enthusiastic customer of hostess services.  Was he happy for his wife, family and friends to know?
    • A man boasting he could source firearms was arrested by police.  His computer was examined, among other things for photos of firearms and preferably of him with firearms. In the end not much was found but review of all the photos showed in graphic detail, sexual activity with (I think) his regular partner.

    This means with a great deal of trust has to be placed in the hands of the investigator and the extent to which full notes are taken of the course of an investigation as the investigator justifies courses of action designed to fulfil its overt stated aims. But the reality is most investigators will not have time to write up the detailed notes which might satisfy critics.  Our expectation of what police investigators can achieve has to be seen against the examination backlog – 20-25,000 devices awaiting examinations which are non-urgent.  “Non-urgent” means no threat to life or immediately required to support an-ongoing current enquiry.  The delays are of 6-9 months and the pressure on digital investigators from detectives, victims and the CPS can be intense.  These pressures feed through to that other well-known delay backlog – of 81,000 Crown Court cases and the associated pressure when custody time limits of pre-trial remand of accuseds are breached. Making detailed notes of how “relevancy” was maintained and the care with which non-relevant material was managed may be a bit much.

    The new powers

    And now on to the new powers: Until recently any examination of a smartphone or other electronic device was limited to what was immediately recoverable from its storage.  Or there was a lack of clarity about how access to third party services could be handled.  Under s.173 Crime and Policing Act 2026 examination can be extended to using any online accounts to access remote services.  These can include banking and finance, health information (via the NHS app, for example), remote storage including iCloud, OneDrive, DropBox and their many competitors and also could include situations where the device has access to employer’s computing facilities and those owned by third parties.

    There are criteria:  the information sought must be relevant to a reasonable line of enquiry, it must be necessary and proportionate and there doesn’t appear to be other means of obtaining the same information.  An investigator needs the authorisation of a “senior officer” but this can mean an inspector, a relatively low rank.  The power is limited to what was accessible at the time the device was seized.  Authorisation can be given orally, but the authorising officer must eventually set down reasons in writing.

    What is particularly interesting about this is that hitherto banking, health and similar information was only available to law enforcement by means of a Production Order under s. 9 and Schedule 1 of PACE. S.9 provided arrangements for a police constable to apply to a circuit judge of the Crown Court for access to “special procedure material” and “excluded material”. These are items which are not immediately available under a s. 8 PACE warrant. “Excluded material” includes medical records and journalistic material while  “special procedure material” covers banking and business records.  

    But this same material would now be available once s.173 Crime and Policing Act 2026 comes into force.  Will there be a Code of Practice?  Will, notwithstanding what the legislation says, the Government decides that this level of intrusion requires the authority of a circuit judge?

    Peter Sommer

    The Ticker Tape blog is a collaboration from the Foundation for Information Policy Research and colleagues as a place to present ideas, analysis, arguments, and the latest research on technology, policy, and society.

  • The Ticker Tape: Generative AI and cybercrime

    Ben Collier, chair of FIPR and senior lecturer in Science, Technology, and Innovation Studies at the University of Edinburgh, outlines work at the Cambridge Cybercrime Lab examining claims that recent apparently autonomous attacks by AI frontier models presage a new era of deskilled, AI-powered complex cybercrimes.

    Recent months have seen escalating hacking attacks carried out apparently autonomously by ‘frontier AI’ systems that have broken containment. The first made public came in August, when Anthropic announced that a model under development attacked the model and data sharing platform Hugging Face. Later, the company clarified that the attack was conducted by 1,200 agents acting together. More recently Google reported that its Gemini models have penetrated external companies through similar ‘containment breaches’. The nature of these attacks – in one case simply involving guessing passwords correctly – do not suggest Stuxnet-on-steroids levels of sophistication.

    Leaving aside what these events might imply about the quality of the sandboxing and safety precautions these companies took, it is clear that the frontier AI labs have, through enormous expenditure and the deployment of purpose-built tools and infrastructure, created a new generation of products which can fairly autonomously carry out some aspects of offensive cybersecurity work. But what does this mean for cybercrime outside the lab? Are AI tools really lowering the skill barrier to complex cybercrime?

    Almost all existing research on generative AI and cybercrime deals with simulations, in which highly-resourced teams with enormous amounts of compute, the highest-end tools, and some of the world’s highest-paid computer security experts test what they can make these models do. Real-world data is largely sourced from user activities collected by the AI and cybersecurity companies, which have clear incentives to play up the threat. Although these reports are indeed worrying, it is hard to tell whether they represent a handful of actors experimenting, or show that the whole cybercrime ecosystem is eagerly jumping on the AI bandwagon.

    We can begin to answer some of these questions, at least for the cybercrime underground, which is  easier to study than high-end organised crime or nation-states. The Cambridge Cybercrime Centre has an enormous and growing database of more than 100 million messages scraped from cybercrime forums. At the Centre, we used machine learning and a lot of close reading to explore how these communities are actually adopting AI tools in practice.

    From our previous work, we know that the real conditions in which cybercrime occurs are often rather different from lab simulations. These small gangs don’t have the resources of a high-end computer security lab. They barely understand how the technology they use works, and most of them don’t make much money. That doesn’t mean that they aren’t good at what they do; it just means that what they do isn’t ‘technically sophisticated’ in the sense that a hacker from a sci-fi film might be. Like the rest of us, they use tools others have built.

    First, we looked to see if cybercrime groups were building or buying their own bespoke tools – so-called ‘dark AI’. Despite news reports around things like WormGPT, this is largely not happening in practice. Oddly-named ‘bespoke’ cybercrime AI tools are absolutely circulating, but on further inspection they turn out to be trivially jailbroken versions of open models. In practice (with the exception of pentesting tools built for industry), they aren’t much use for cybercrime: they’ll discuss ‘prohibited’ topics with you, but little else.

    Instead, the cybercrime underground has adopted mainstream tools wholesale. This took longer than you might expect, really taking off with the late 2025 improvements to Claude Code. Even this does little to reduce the skill barrier to entry, as low-skilled actors in the cybercrime underground don’t know enough to ask the model what to do or to check its output. Even if they do get it working, they struggle to cash out or monetise the results. For medium- and higher-skilled actors, however, Claude Code is proving a real game changer – for general coding and admin tasks, logistics, and other basic generic functions that you’d have to do for any software-based business in 2026, but not for malware. That might sound boring (and it is) but in practice, it’s a huge force multiplier, allowing criminals to run larger operations with fewer staff, do things faster, and manage far more things at once. In practice, AI tools allow them to scale up their operations while making it harder to detect that they’re misusing the models. Similarly, there is evidence that other parts of cybercrime logistics – not ‘high end’ innovation, but, for example, taking newly-reported vulnerabilities and weaponizing them – can now be conducted far faster than before.

    From speaking to law enforcement and defenders, we see some anecdotal evidence that AI tools are pretty good at reducing the skill barrier for the type of ‘script kiddie’ who is already an experienced software engineer, even though not experienced in cybercrime. Facilitating this kind of lateral transfer of expertise – reskilling rather than upskilling as a cybercriminal – is particularly worrying given that we observe large numbers of people on the cybercrime forums complaining that they’ve just lost their job in the legit software industry thanks to AI. 

    The other main area of disruption we observe is a scaling up of areas of cybercrime that require producing large amounts of various kinds of  ‘content’ in an automated fashion – phishing emails, romance fraud approaches, social media bots, misinformation, and SEO fraud websites. Here, genAI tools, now genuinely using jailbreaks, are allowing larger-scale automation, and also produce much more convincing content that doesn’t so easily trip the defenders’ ‘bot detection’ or ‘spam detection’ functions. This sector has become something of an arms race, as defenders try to insert enough friction being to force cybercriminals to do a lot of human babysitting and content shaping. The forums also show a lively industry of selling jailbreaks-as-a-service along with compromised accounts for the major chatbots.

    So why is this the case? Why are we seeing a scaling up of ‘industrialised’ cybercrime rather than anything more sophisticated or high-skilled?

    For one thing, ‘exotic weaponry’ is not needed to take out most companies – phoning up a member of staff and asking nicely for their password still works pretty well a lot of the time. When it doesn’t, the next option is to buy, locate, or hire as a service readily-available tools exploiting well-established vulnerabilities that were found and fixed years ago. Companies remain notoriously bad at keeping their systems up to date with the latest patch,, often because they can’t risk patching their most critical systems in case it causes them to accidentally shut down.

    Big companies with well-resourced cybersecurity teams are most easily penetrated via their incredibly complex international supply chains, which often have a lot of hidden weak points. The best resourced company may still be vulnerable to the three-employee family company that provides custom novelty ringtones to the technicians that maintain the fish tanks in the Arkansas division’s employee lounge (who are still running Windows XP Service Pack 2 because interface design peaked in 2004).

    In cybercrime, optimising the business models and logistics is more significant than high-tech innovation. If you can scale up your operations, you can work through more leads and find the ‘low-hanging fruit’ at higher rate and greater volume. AI technologies are extremely good at super-charging logistics for actors who already have a good idea what to ask for and can generally tell when things go wrong.

    For ‘mid-level’ actors, this is a real game-changer. However, this doesn’t give them ‘nation-state’ capabilities. By and large, criminals’ motivations, goals, economics are very different from those of nation-states. Instead, AI is likely to significantly scale up the dynamics of cybercrime-as-a-service. While guardrails don’t prevent motivated, sustained, and targeted use of the models for harm, we directly observe them changing the scale economics as they are incorporated into cybercrime business models. As a result, adding enough friction through these guardrails can in practice make many routes to scale through AI economically infeasible. While guardrails don’t do much good for open models, economics helps policymakers here, too – most cybercriminals do not have the compute and financial resources to run high-performance open models at operational scale.

    A good question to ask about much of this is ‘what happens next?’. If advances in AI agents do eventually dramatically lower the skill barrier, allowing anyone to pick up a tool and use it to hack like a pro, what then? Do we see an initial surge in activity, followed by a massive response by defenders to patch their systems and harden their security? Do we see saturation effects as many different actors crowd in and use up the available resources? Do all these wannabe hackers expose their personal information through poor OPSEC, leading to a wave of arrests? Does anyone actually make money from doing this? If they do, can they cash it out without getting caught? And, if these newbie cybercriminals are all making millions, will they become easy targets for the older, more skilled attackers and organised crime groups (after all, they’re unlikely to call the police)?

    All this is to say that while innovations in Generative AI are indeed having an effect on cybercrime, it is unlikely to be in the science-fiction mode promoted by the major AI companies. The reality is more boring, but potentially just as damaging – a scale transition in volume online crime. There are a range of different technical, legal, and policy changes which can mitigate this, but many of them go against the financial incentives of the AI industry. We’ll have more on those in a future post.

    The Ticker Tape blog is a collaboration from the Foundation for Information Policy Research and colleagues as a place to present ideas, analysis, arguments, and the latest research on technology, policy, and society.

  • Introducing The Ticker-Tape

    “Which is late, isn’t it, for reading club ticker-tapes.”
    “Not my world, old boy.”
    Tinker, Tailor, Soldier, Spy – John Le Carre

    I’m delighted to announce that the Foundation for Information Policy Research are starting up a new blog, called The Ticker-Tape. The intention is for this to serve as a place for ideas, analysis, arguments, and the latest research on technology, policy, and society by the Foundation for Information Policy Research, our friends and colleagues.

    This is a particularly febrile time for the work we do as engineers, academics, policymakers, activists, and journalists with an interest in technology and society.

    A small number of particularly loud industry voices, who may be experts on their own ‘frontier’ technologies but often know little about the social problems or domains into which their technologies are being dropped, have an outsize influence on our politics and on the policymaking process.

    In the other direction, as an understandable reaction to large-scale emerging harms associated with innovation, policymakers often seek to shape the world in their own ways without necessarily understanding what is possible in terms of technology design. Simply ordering technology companies to backdoor encrypted services while retaining security protections for everyday users, for example, does not make this a reality.

    We at FIPR are seeking to promote better links between these different kinds of knowledge – about technology, social issues, law, and policy. We see a political system caught between a desperate need for economic growth through the deus ex machina of technological innovation on the one hand, and revulsion at the harms that appear to spill out of these new technologies on the other.

    There is a need for independent, expert analysis that neither sees technology as the sole cause of social problems, nor as a blank canvas entirely shaped by human users. Rather, we hope to move past the utopian and dystopian narratives that dominate public discourse to explore how we might navigate the complex technical, social, and political dimensions of the problems that we face today.

    Dr Ben Collier

    Chair, Foundation for Information Policy Research

  • Growing up in the online world

    FIPR has responded to the Government’s consultation on Growing up in the online world to express deep concern with the proposals to implement strong Age Verification by default for online services. These will not only affect children, but all adults in the UK. We fully support the ambition to reduce online harm to young people and acknowledge the many deep harms that have emerged in part from the business models of the major online platforms. However, many of the proposed solutions for Age Verification will exacerbate the very harms they are seeking to prevent, as children seek out insecure circumvention methods that will lead them to more harmful content or expose them to the risk of blackmail and abuse. These approaches will also cause serious issues of digital exclusion for many adults in the UK. Any real solution cannot be imposed ‘over the heads’ of the children who it will most affect and those who care for them. While it is tempting to rely on ‘magic’ technological fixes for online harm, these will not work, will concentrate even more power in the hands of large tech platforms, and will risk letting them off the hook for the wider social harms to which they contribute.

    Our full response to the consultation can be read here.

  • Ofcom work plan for 2026

    FIPR has submitted a response to the Ofcom consultation on its work plan for 2026, arguing that the UK needs an ambitious programme of technically-informed work on the digital rights, privacy, and information policy issues that we currently face. We outline key challenges for 2026-27 in relation to AI and communications services, emerging cross-jurisdictional flashpoints and ‘digital sovereignty’, age checks with regard to user-to-user regulated services, and debate and policy on social media and children. Across these policy areas, we suggest that Ofcom engage in further consultation with technical expert groups, including FIPR, on the benefits and negative consequences of potential technical designs, and what is possible — in technical terms — for the implementation of desired government policy, rather than leaving crucial decisions in the hands of industry or for post-legislative implementation.

    We emphasise the importance of policymakers and regulators’ engagement with technical stakeholders and expertise from outside the platform and ‘big tech’ industries, and of renewed consideration of the negative consequences of potential technical designs and restrictions. It is particularly important to consider the challenges — differing technical consequences, effects on rights, and harms — posed for marginalised groups who, in the context of a global resurgence of far right politics, face both the most acute harms in online spaces and the most immediate potential for negative consequences from intensified digital surveillance. We recommend that Ofcom commission further research work on currently proposed technological approaches to regulating platform-based public communication. FIPR is committed to the production of non-partisan expertise in technology and information policy, and would be delighted to support Ofcom in this role, along with stakeholders from civil society.

    Our full response to the consultation can be read here.

  • The Home Office Technical Capability Notice to Apple

    FIPR has written a report explaining the key policy issues at stake regarding the Home Office’s Technical Capability Notice issued to Apple. This notice requires Apple to make technical changes to its Advanced Data Protection service, which provides users with secure encrypted storage, to allow the UK Government to access encrypted user data on request. This order — initially made in secret and which Apple is not allowed to discuss even with the US Congress — effectively requires Apple to build a backdoor into its encrypted systems. It has been the source of significant controversy, with the US Government pushing back against the order and making it an issue in ongoing trade negotiations between the US and UK. We explain the key issues behind the case, arguing that this fundamentally breaks security and privacy for Apple’s users, and outlining some of the many alternatives which law enforcement have to these backdoors.

    Ben Collier, FIPR’s chair, said: “It’s not surprising that the Home Office’s attempt to compel Apple to undermine the security of their products is facing resistance from the US Government. The UK Government’s order would effectively ban Apple from telling the US Congress what they had been asked to do. Our basic human rights and democratic freedoms rely on security, privacy, and the accountability of our institutions. Tactics like issuing encryption removal orders to tech companies will only make every iPhone user in the UK less secure. As the UK government’s own guidance for companies and the public makes clear, strong encryption is at the heart of keeping the services we all use safe and secure. There is no way to undermine encryption which doesn’t leave huge weaknesses that criminals and hostile state actors can exploit. Law enforcement have much more effective tactics — ones which don’t involve undermining our shared security — to investigate and disrupt serious criminal activity where encryption is being used. The government would be sensible to step back and retract this notice, and instead focus on the important work of renewing the UK’s basic infrastructure, digital security, and privacy protections.”

    Read the report HERE.