Tackling non-consensual intimate image abuse

The list of offences that are within scope of the Criminal Injuries Compensation Scheme is out of date. Crimes perpetrated online, such as non-consensual intimate image abuse, can be just as damaging to a person as those involving physical violence. They can have a catastrophic impact on a person’s mental health. It is essential that victims of such crimes are able to access compensation. (Conclusion, Paragraph 25)

The Ministry of Justice must amend the eligibility criteria of the Criminal Injuries Compensation Scheme to bring claims from victims of sexual offences perpetrated online, specifically non-consensual intimate image abuse, within its scope. (Recommendation, Paragraph 26)

We welcome the inclusion in the Crime and Policing Bill of the new offences of taking an intimate image without consent and of installing equipment for the purposes of enabling the commission of those offences. We also welcome the Government’s recognition that the definition of what constitutes an image for these purposes should be broad in scope - something campaigners had been calling for. These measures represent significant legislative progress in the battle to protect people from NCII abuse and punish those who commit it. (Conclusion, Paragraph 41)

Ofcom’s current enforcement powers, while welcome, are far too slow and not designed to help individual victims get abusive images of themselves on non-compliant websites taken down or have access to them restricted. The duties under the regulatory regime created by the Online Safety Act are a good start. However, further steps are required to effectively tackle the threat posed by NCII at an individual level, particularly where content is hosted overseas. (Conclusion, Paragraph 48) 52

For internet infrastructure providers to take the threat of NCII seriously and block access to websites that refuse to take it down, we believe that there is justification in bringing NCII in line with CSAM in law. (Conclusion, Paragraph 56)

The Government should bring forward an amendment to the Crime and Policing Bill to make possession of NCII an offence, in addition to its creation. This will put NCII on the same footing as CSAM in how it is treated online and—we hope—will provide the necessary encouragement to IIPs to block or disrupt access to such content, including that which is hosted overseas. (Recommendation, Paragraph 57)

The Government should create guidance for internet infrastructure providers and web browser manufacturers on tackling online non-consensual intimate image abuse, similar to that which already exists for online child sexual exploitation and abuse. This guidance should direct both groups to make use of a designated expert body’s registry of NCII material. While there is no legal obligation to act in accordance with the guidance—and we understand the current voluntary approach with CSAM is working—the Government should do all it can to encourage companies to follow it, with a view to potential legislative solutions if there is insufficient take up. (Recommendation, Paragraph 58)

In its illegal content Codes of Practice, Ofcom should direct user-to-user and search engine services to make use of a registry of NCII content, compiled by an expert body, on a similar basis to the provisions that exist for child sexual abuse material. (Recommendation, Paragraph 59)

The law on solicitation was unclear, incomplete and open to misinterpretation by law enforcement agencies and others. We welcome the Government’s proposals to introduce a specific offence of solicitation for synthetic content via an amendment to the Data (Use and Access) Bill. We urge the Government to expand this clause to include all image-based abuse offences, maintaining a focus on criminalising the person in the UK soliciting the image, regardless of the jurisdiction and identity of the provider. (Recommendation, Paragraph 65)

The Government should take a holistic approach to legislating against NCII abuse by introducing a swift, inexpensive statutory civil process, as has been established in other jurisdictions such as British Columbia in Canada. Doing so would recognise survivors’ wishes to access redress beyond the criminal law, as well as empower them to take fast and effective action towards having their NCII taken down or blocked. Such a regime should be alongside and underpin the creation of a registry of NCII content—overseen by an expert body—that internet infrastructure providers are requested to take all reasonable steps to prevent access to. The statutory regime should enable civil courts to make orders, including: 53 a. designating an image as NCII content and ordering its inclusion on a dedicated registry for the purposes of having IIPs take action to prevent access to that content; b. prohibiting the individual from distributing the intimate image; c. requiring the individual to delete any images; d. requiring the individual to take down or disable access to an intimate image; e. requiring the individual to pay compensation for harm caused; f. requiring the provider and/or end user of a social media service, relevant electronic service or designated internet service to remove an intimate image from the service; g. requiring a hosting service provider who hosts an intimate image to cease hosting the image. (Recommendation, Paragraph 71)

There is a gap in the UK’s online regulatory framework for a statutory body to support and champion the rights of individuals affected by non- consensual intimate image abuse, and to work alongside the courts in the civil regime. Such a body is required to help ensure victims are able to secure redress and to oversee the registry of NCII content that we recommend is introduced. Ofcom’s remit is already very wide, and its enforcement mechanisms are designed to act at too a high level for this function - it is ill-suited to the further responsibilities that are required. Existing Commissions, such as the Victims’ Commissioner for England and Wales, do not have the powers or expertise to fulfil such a role. (Conclusion, Paragraph 75)

The Government should set up an Online Safety Commission, similar to the eSafety Commission in Australia, with a focus on support for individuals. The new Commission would act as a trusted flagger of NCII content on behalf of individuals that report it to them. The Commission would be able to apply for and send court orders, generated following a statutory civil process, for example demanding that NCII content is taken down from the websites hosting it. The Commission would oversee a registry of designated NCII content, against which it would be able to recommend that internet infrastructure providers—including ISPs, web browsers, registries, and Mobile Network Operators and others—take steps to block access to NCII content. (Recommendation, Paragraph 76)

The UK already has an excellent organisation doing some of this work in the form of the Revenge Porn Helpline. The Government should discuss the proposals set out above with the RPH to determine what relationship the RPH could have with the proposed Commission, or—preferably, given the 54 expertise at the RPH—whether it can be given additional resources to take on the role of the Commission itself. The removal of images should still be pursued at the earliest opportunity as happens now; the court process that we suggest is a means of escalation in cases of non-compliance. (Recommendation, Paragraph 77)

The Government should explore whether the funding for such a Commission could be generated, at least in part, by a levy on bodies within scope of the OSA on a similar basis to that which exists in other regulated environments. We note that such consideration would need to take into account fees already collected by Ofcom. (Recommendation, Paragraph 78)

Non-consensual intimate image abuse is not always limited to sexually explicit content. For example, in some cultures, countries, or religions, sharing a photograph of someone without their religious clothing—or with their arm around another person—can be disastrous for the victim. (Conclusion, Paragraph 85)

The Government should extend the legal definition of an intimate image to include images where “because of the person’s religious or cultural background, the person commonly wears particular attire of religious or cultural significance when in public; and the material depicts, or appears to depict, the person: (a) without that attire; and (b) in circumstances in which an ordinary reasonable person would reasonably expect to be afforded privacy”. (Recommendation, Paragraph 86)

The Government should introduce an extension to the statutory time limits that apply to current and forthcoming intimate image abuse offences, such that the time limit begins only once the victim(s) is/are aware of the abuse. (Recommendation, Paragraph 93)

Every victim of a sexual offence deserves to be treated with respect and have their case investigated promptly and effectively by the police. However, in many cases police treatment of victims of intimate image abuse has been characterised by a lack of understanding and in some cases misogyny, with officers’ choosing to patronise victims rather than support them. This is unacceptable and must change. (Conclusion, Paragraph 103)

The College of Policing, Ofcom, and the Revenge Porn Helpline should work together to produce guidance to improve the police response to reports of non-consensual intimate image abuse. That guidance should include the steps police officers need to take to help ensure that content is taken down and blocked as a matter of priority. (Recommendation, Paragraph 104)

Cases have been drawn to our attention where, at the end of the criminal justice process, perpetrators have had the devices containing the NCII content returned to them—even in cases where the perpetrator has been 55 served with a restraining order. It is needless for us to say how harrowing that must be for the victims of these crimes. It is staggering that the criminal justice system has allowed this to occur. The measures in the Crime and Policing Bill to make clear that perpetrators found guilty of the new offence of taking NCII can be deprived of that content are very welcome. However, they may not address concerns that people found guilty of sharing that content are not being deprived of the material. (Conclusion, Paragraph 109)

The Sentencing Council must take steps to increase awareness of the ability of the courts to ensure that those charged with NCII offences forfeit all right to continued possession of that material, including both the physical removal of devices on which that material may be stored and deletion of any content stored remotely. In response to this report, the Crown Prosecution Service should also set out what action it will take to stop perpetrators of NCII abuse from retaining that content. The Government should collect data on the use of deprivation orders in NCII cases so that it can satisfy itself and others that the criminal justice system is taking seriously the impact on victims of perpetrators retaining the control of the harmful content. (Recommendation, Paragraph 110)

The Government should ensure that NCII abuse is included when creating a common definition of VAWG, as part of its mission to reduce it by 50% within the next decade. It should also identify what data can be used to measure the specific prevalence of NCII, as part of that mission. (Recommendation, Paragraph 112)

Hash matching technology is a crucial tool in preventing non-consensual intimate image abuse. It is unacceptable that so few platforms receive NCII hashes, not least when they are already able to incorporate similar technologies for preventing the sharing of child sexual abuse material. It is obvious to us that accepting hashes for NCII is the right thing to do, irrespective of whether there is legislation or statutory guidance to require it. It is disappointing that companies, in some cases trillion-dollar companies such as Google, have been unable to make that judgement. Such a company has the means to overcome any interoperability issues which currently exist. (Conclusion, Paragraph 124)

Google should accept the StopNCII.org hash matching technology as a matter of priority. (Recommendation, Paragraph 125)

It is clear that some companies require further persuasion to accept NCII hashes. We welcome Ofcom’s plans to launch a consultation in spring 2025 on expansions to its Codes of Practice that would include proposals on the use of hash matching technology to prevent the sharing of NCII. We are clear in our view that those proposals should include requiring companies to accept the hash matching technology to prevent NCII on their services. (Conclusion, Paragraph 126) 56

The Government’s plans to criminalise the creation of sexually explicit deepfakes/NCII, even if they are not shared, are very welcome and worthy of praise. However, the Government must ensure that the offence is consent- based and does not require the determination of any motivation on the part of the perpetrator. Consistent with our recommendations for non-synthetic content, the offence must also include cultural intimate image abuse, so as to include deepfakes of someone without their attire of religious or cultural significance that they commonly wear in public. (Recommendation, Paragraph 134)

The private sector has innovated to create AI technology. It does not need to wait for legislation to catch up in order to safeguard individuals from harmful AI-generated content. As a starting point tech companies involved in AI content creation should cleanse their datasets of NCII content and commit to responsible sourcing of data to safeguard those datasets from being used as a base from which to create intimate image-based abuse. (Recommendation, Paragraph 135)

There is no legitimate reason whatsoever for the use or existence of nudification apps. The Government should ensure that the use of such an app is considered creation of synthetic NCII and therefore also a criminal offence and Ofcom should investigate the sites that offer this functionality. The Government should make sure that search engines and platforms that are found to promote or facilitate the distribution of such apps can be held to account. (Recommendation, Paragraph 136) 57