Online Harassment and Harmful Communications: Discussion (Resumed)

The purpose of today's meeting is to continue a series of engagements on the matter of online harassment and harmful communications. We are joined this morning by Dr. Mary Aiken, cyberpsychologist and honorary professor at the University of East London; Mr. Ronan Lupton, barrister-at-law; and Dr. T.J. McIntyre, chairman of Digital Rights Ireland, who is no stranger to the committee. They witnesses are all very welcome this morning. I propose to invite the witnesses to speak in the order in which I have introduced them but there is no hierarchy. We will take it in that order if it works.

First I draw the attention of witnesses to privilege. Witnesses are protected by absolute privilege in respect of the evidence they give to the committee. However, if they are directed by the committee to cease giving evidence on a particular matter and continue to so do, they are entitled thereafter only to qualified privilege in respect of their evidence. They are directed that only evidence connected with the subject matter of the proceedings is to be given and are asked to respect the parliamentary practice to the effect that, where possible, they should not criticise or make charges against any person, persons or entity by name or in such a way as to make him, her or it identifiable. Members of the committee are reminded that under the salient rulings of the Chair, they should not comment on, criticise or make charges against a person outside the Houses or an official, either by name or in such a way as to make him or her identifiable. I ask our panellists and visitor to ensure their mobile phones are switched off.

Without further ado, I invite Dr. Mary Aiken to make her opening statement.

Dr. Mary Aiken

I am grateful for the committee's invitation to speak on the topic of online harassment, harmful communications and related offences. Notwithstanding the remit of this committee, the challenge is that in cyberspace, everything is connected, and therefore laws that attempt to address cyberbullying will arguably be ineffective in the absence of addressing a more comprehensive range of online harms. The United Kingdom online harm White Paper offers a thorough treatment of these issues, noting:

Illegal and unacceptable content and activity is widespread online, and UK users are concerned about what they see and experience on the internet. The prevalence of the most serious illegal content and activity, which threatens our national security or the physical safety of children, is unacceptable. Online platforms can be a tool for abuse and bullying, and they can be used to undermine our democratic values and debate. The impact of harmful content and activity can be particularly damaging for children, and there are growing concerns about the potential impact on their mental health and wellbeing ... The internet can be used to harass, bully or intimidate, especially people in vulnerable groups or in public life. Young adults or children may be exposed to harmful content that relates, for example, to self-harm or suicide. These experiences can have serious psychological and emotional impact. There are also emerging challenges about designed addiction to some digital services and excessive screen time.

Notably, the UK approach does not focus exclusively on fragmented aspects of harm. Rather, a broad range of harms is considered simultaneously, including online anonymous abuse, child sexual exploitation and abuse, harassment and intimidation directed at those in public life, cyberbullying, violence online, designed addiction, underage sharing of sexual imagery such as sexting, self-harm and suicide. The point centres on connectivity. There is a relationship between cyberbullying, self-esteem and self-harm. There is also a relationship between "sexted" images, harassment, online coercion and extortion. Many countries are in the process of developing new regulatory approaches to tackle online harms. However, none has as yet established a regulatory framework that tackles the connected range of online harms. The UK will be the first country to do this. I have advised the UK Department for Digital, Culture, Media and Sport on the role of technology in online harm. Significant progress has been made. As an important hub for technology companies, Ireland should be demonstrating cyber leadership but it has unfortunately made little or no progress to date despite numerous investigations and reports. At this point my submission references appendix A, which outlines a timeline going back to the Internet content governance advisory group in 2012.

Technology is new and fascinating. It has a pervasive, profound impact on humans and a highly seductive momentum. It has revolutionised access to knowledge, education and social reform. Nevertheless, left unfettered it has also exploited the vulnerabilities of our children. The influence of the Internet and social media is not an abstract concept. Its impact is not virtual; it impacts real lives in the real world. Monetising harm by designing intelligent algorithms to promote extreme content and harvest dollars from a child in the "attention economy" is not about celebrating access; it is about exploitation. In the bricks-and-mortar world, we have recognised for centuries that defending freedom for adults to speak and express opinions does not mean giving adults a licence to exploit and harm children. I passed an Eason store on the way here. I did not see any glossy magazines promoting self-harm, DIY suicide or anorexia made freely available to children beside the comics on the lower shelves. That is a repugnant idea of course, but this is the reality of the Internet.

We have been here before. We have seen the damage that is done when commercial interests are allowed to exploit vulnerability and addiction and to operate without restraint. We have seen it with big tobacco and more recently with the opioid crisis. We see common themes - wilful and deliberate exploitation and obfuscation; decisions made behind closed doors that either deliberately ignore evidence of harm or try to make it someone else’s problem; denial of responsibility and victim-blaming. While adults debate, posture and play "pass the blame parcel" the social technology industry keeps thriving, money keeps flowing and the online harm continues.

In deliberating on the broad area of online harm, we must ask ourselves the questions of who, what and when. Who is being harmed? Who has sought to exploit that harm, either by designing clever code to profit from it, wilfully ignoring its harmful effect or actively denying responsibility for it? What is the harm - what real lives are being damaged? What are the consequences of doing nothing? When did Internet stakeholders become aware of the damage being caused to children and, importantly, when did we all do something about it?

In 2014 I raised some of these issues in the report of the Internet content governance advisory group, which was convened in 2012. I also advised the Law Reform Commission, whose report on harmful communications and digital safety was published some three years ago. In the intervening five years, thousands more children have been unnecessarily exposed to repugnant, harmful, toxic and life-damaging material. This must stop. It demeans all of us. The Internet was designed on the premise that all users are equal. This is not the case. Some are more vulnerable than others and children are particularly vulnerable. Our challenge as a society is to help shape an Internet that is open and vibrant but also protects its users from harm. The Constitution requires the State and organs of the State to protect and vindicate as best it can from unjust attack. Article 42A affords additional rights by affirming "The State recognises and affirms the natural and imprescriptible rights of all children and shall, as far as practicable, by its laws protect and vindicate those rights." Exposing Irish children to a range of online harms is a fundamental breach of their constitutional rights. Our challenge as policymakers is not to engage in determined myopia and deliberate fragmentation strategies or to allow commercial stakeholders to perpetuate skilful deflection and obfuscation strategies. Our challenge is to urgently develop a new system of accountability in the form of legislative and statutory instruments and oversight that will replace the current failed model of self-regulation. A new Irish regulatory framework regarding online harm is urgently required, one that will make clear the technology industry's responsibility to protect Irish users, particularly our children, online.

Mr. Ronan Lupton

It is not my intention to read my statement, as it runs to 15 pages. However I will very quickly give an overview of the three areas I cover. The statement is available to the committee and deals with these points in more detail. Before I start I would like to make a point about positioning. I represent the telecommunications industry in another guise. Everything I say today is in my full-time role as a lawyer and a member of the Bar and the Law Library. Nothing that I utter is to be connected to any other representation or any other advocacy roles that I may hold.

I will deal with three areas in my submission. The first is the role of hosts under EU Directive No. 2000/31/EC, the electronic commerce directive, and SI 68/2003, particularly regulation 18. I wish to make several points on that. The headline point is that in its deliberations the committee should be careful about declaring hosts to be publishers. The knock-on effect of making such a recommendation and reporting in that fashion could have serious effects for commerce and social interaction online. I acknowledge a lot of what Dr. Aiken has said. I am not in conflict at all with what she says about harm and issues in cyberspace in that sense. However, there is an overarching issue here. European law is directly effective and supreme and reforms to the e-commerce package are en route. Dr. Ursula von der Leyen, who is hopefully the incoming President of the European Commission, has indicated that a package of reforms on digital safety will be brought forward quite shortly.

I want to make a couple of points which are consistent with Dr. Aiken's points. It is somewhat disappointing that the recommendations of the Law Reform Commission report and the Internet content advisory group have effectively sat on a shelf since 2016 and 2014, respectively. There are very good recommendations in those reports and as such I respectfully submit that this committee should not reinvent the wheel.

One issue I now see coming before the courts regularly now concerns applications for Norwich Pharmacal orders, disclosure orders under which so-called anonymous activity online is defrocked, users who purport to act anonymously are unmasked and tortious activity is prosecuted. This prosecution usually takes place through civil lists although it can also be dealt with through criminal legislation. I also refer to a case which was recently before the Court of Justice of the European Union, the Eva Glawischnig-Piesczek case. I am sorry if I got the pronunciation of that lady's surname slightly wrong. It is a technical pronunciation. This decision deals with what the State can and cannot do within the hosting provisions and the related package where injunctive relief through the courts is concerned. It also considers matters this committee might consider, concerning duties of care and how far legislation can go. I am happy to take any questions on that topic.

I would also like to address a point on which Deputy Jack Chambers engaged with some witnesses last week, that is, the issue of counter-speech. I have a particular concern about using that as a defence to defamation or misbehaviour online.

If someone is attacked, that person can and should vindicate his or her good name per the Constitution, defamation laws or the criminal vocabulary of the law. It is not adequate to tell people to pick up a loudhailer, have a go back, defame those responsible or do something as bad in return. That submission does not sync with the constitutional protections of the right to a good name and our legislative instruments.

That addresses the issue of hosts. The committee should refrain from considering that hosts should just be declared as publishers, because that would put us in a position incompatible with European law and frameworks. It would be a dangerous place to go.

My second point is consistent with Dr. Aiken's submission. Self-regulation has been operating in Ireland for approximately 20 years. Self-regulation requires robust laws to ensure that actors behave in a fashion where they are scared or incentivised into behaving properly or disincentivised from behaving in a bad way. However, we have eight Departments dealing with online issues. I set those eight out in my witness statement. A recent example, and one that has been newsworthy, was that of the report of the Data Protection Commission, DPC, into the public services card. If the State tells the DPC to take enforcement action against it, how does that make Ireland look on the international stage in terms of compliance with laws? This is not a political point, but we need to be careful about what messages we send internationally.

That feeds directly into my next point, which is on legislative reform. I have identified six Acts that are old enough to require a re-examination by the committee in the form of a report or by other organisations of the State. The first is the Prohibition of Incitement to Hatred Act 1989, which is a difficult Act to decipher, let alone prosecute, for a member of An Garda Síochána. It deals with actions, broadcasts and materials likely to incite hatred. The levels of prosecution are minute. It is the only area of hate speech legislation that I can find, and it is well out of date and not fit for purpose in light of the Internet and what pervasive access to individuals has created online. The second is the Criminal Justice (Public Order) Act 1994 as it relates to activities. I suggest that activities organised online constitute an area that the committee should consider, particularly in terms of congregations of people and, possibly, riotous behaviour.

Section 10 of the Non-Fatal Offences against the Person Act 1997 has been well ventilated in terms of the recommendations of the Internet Content Governance Advisory Group, ICGAG, and the Law Reform Commission. Deputy Howlin's Bill is useful but will require significant redrafting and overhauls.

The next Act relates to something that is close to my heart, as I have been on a number of Government child protection advisory groups. The Child Trafficking and Pornography Act 1998 is stale and out of date and the wording it contains is wrong. There are issues in terms of good actors holding blocking lists and so forth. The Act needs a full overhaul.

The Criminal Justice (Theft and Fraud Offences) Act 2001 may be a good place in which to codify reforms as regards online criminal activity and malicious communications.

The Defamation Act 2009 is relatively new. Section 5 provides for a revision of the Act within five years, but that has not happened. In the courts, there seems to be a disjoint between what reliefs can be granted in terms of interlocutory injunctive reliefs or just injunctive reliefs and the vindication of rights when it comes to Internet publications, malicious harm, abuse and so forth. The Act needs to be examined.

I made points in my submission about a privacy Bill. Deputy O'Callaghan has raised the matter with other witnesses before the committee. It may be time to consider introducing privacy legislation, albeit not in a similar vein to what has been published previously in draft Bills. I am surprised that an upskirting offence is so far buried in the 2017 sexual offences legislation. Many new offences to do with the Internet and connected to offline activity need to be codified properly. A malicious communications set of provisions is also required, as has been ventilated well in the Houses since before 2007.

The committee should be careful not simply to report on declaring hosts as publishers. If the State is going to take matters seriously, there needs to be reform of where responsibility for Internet, speech and hate speech activity sits within the Government. When the Minister for Justice and Equality, Deputy Flanagan, attended the Joint Committee on Children and Youth Affairs on 21 February 2018, he made it clear that it was unlikely that criminal justice issues would go under any online tsar or role that would be created for protections. That is the correct position. Regarding self-regulation, however, we need robust revisions of the law to make actors behave correctly. I have highlighted six Acts at a quick pace and will happily answer questions on them, but as far as online harm, abusive content and hate speech go, the Statute Book is out of date.

I thank Mr. Lupton. I now call our final panellist, Dr. McIntyre.

Dr. T.J. McIntyre

I focused in my submission on especially serious online harms, including harassment and aggravated racial abuse, for a few reasons. First, they are the most relevant to the committee's work. Second, these are areas where we have a national competence as opposed to wider issues of, for example, platform regulation, which are largely a European competence and will be dealt with by the European Commission in the near future, as Mr. Lupton pointed out. Third, these are the areas where we can get a quick win, as it were, with clear things that we can do to address the most serious types of harm that individuals are facing.

Unfortunately, there is an element of déjà vu for me. The first time I attended an Oireachtas committee was in March 2013. The then Joint Committee on Transport and Communications was discussing issues of online safety. At that hearing, I stated that we needed more resources for the Garda and what is now the DPC, and that we had to make greater use of existing laws. Unfortunately, we are six years on and I will, to a large extent, be repeating some of those comments because the key legal position in Ireland has not changed significantly since then in terms of the statutes and enforcement structures available to deal with the most serious types of online harm.

I will first make a number of specific points about how we enforce the existing legal framework before speaking about how we might reform that framework. In practice, how do gardaí deal with complaints that come to them? If an individual tells gardaí that he or she has been the victim of the distribution of intimate images - so-called revenge pornography - or serious online harassment, how is that handled? In 2013, the Oireachtas hearings followed the suicide of a teenager from Donegal, Erin Gallagher, which was attributed to online bullying. She had been told by gardaí whom she contacted that it was a civil matter and there was nothing they could do. Fast forward to today and committee members will be aware of the case of the Ryan and Mathis family, who have been subjected to horrific racial abuse online following advertising that the family took part in for Lidl. Upon contacting gardaí, the family were told exactly the same thing, namely, that it was a civil matter and there was nothing the Garda could do. Following the case's publicity, however, a Garda investigation has opened.

Even at the outset, though, an investigation could have been commenced into whether the case constituted the existing offence of harassment under the Non-Fatal Offences against the Person Act. As Mr. Lupton pointed out, that is not a perfect offence and many elements of it could be reformed. However, gardaí at a local level appeared to be unwilling to commence criminal investigations in a timely manner. That is not necessarily an issue with individual gardaí but a systemic issue with training and resources. On occasion, individual gardaí have told the media that they have been unable to investigate these types of complaint because they do not have devices in their stations that enable them to view social media. In some cases, they have had to resort to doing that on their own personal devices.

The lack of resources is reflected in the resourcing provided to what is now the Garda National Cyber Crime Bureau. When I first testified on this issue in 2013, it was then the Garda Computer Crime Investigation Unit. Since then it has been rebranded, but the resources given to it have remained essentially unchanged. For the past decade, the number of gardaí within the unit has fluctuated from the low 20s to the high 20s but essentially has remained largely static at a time when the workload has grown exponentially.

The issue is ordinary crimes have become cybercrimes in the sense that if there is evidence on a laptop or phone which needs to be forensically examined, what was the computer crime investigation unit, now the cybercrime bureau, must be involved in that examination. The problem is that, with some recent very limited exceptions, the resources given to the bureau have not kept pace. This has had the effect of crowding out investigations into online harassment, given the need to carry out forensic examinations of other types of crime also. I know that when the head of the bureau, Detective Superintendent Pat Ryan, testified before the committee recently, he indicated that there was a need for 120 staff members within the Garda to deal with these issues, which essentially represents a fourfold increase on the current staffing level of approximately 30. To a very large extent, the statement that we need to reform the existing law needs to be weighed against the fact that we have failed to adequately resource enforcement of the existing law.

Related to this is the question of how gardaí access information on these crimes. There are two distinct issues. One is the question of international co-operation, that is, the use of mutual legal assistance treaties and so on to obtain information from firms which have their headquarters overseas. However, the issue on which I will focus is domestic access to information, that is, when gardaí have information on a particular IP address, for example, how they go about obtaining information on it from service providers such as Eir or Virgin Media. As members of the committee will be aware from recent hearings on the Communications (Retention of Data) Bill, it is done under the Communications (Retention of Data) Act 2011. Since the committee held its hearings on the heads of the Bill that would replace that legislation, the High Court has given its judgment in a case brought by Graham Dwyer to the effect that the core provisions of the legislation, that is, the provisions which require telecoms providers to store certain information and the provisions that allow gardaí to access that information, are contrary to European law. This decision has been stayed, pending an appeal to the Supreme Court which will be heard this December, but it is quite clear that the legislation is now a zombie. It is heading towards the Supreme Court where it will invariably be dispatched, be it by the Supreme Court or, ultimately, on reference to the European Court of Justice. In the meantime it has the effect of undermining both existing convictions obtained using the legislation and ongoing investigations. We must fault the Department of Justice and Equality for failing to respond in a timely manner to the judgments which found this type of legislation to be unconstitutional and contrary to the Charter of Fundamental Rights of the European Union and for failing to provide adequate alternative enforcement mechanisms for gardaí. If gardaí wish to access subscriber information or information on Internet use, the only way they can do so in a way that will stand up to challenge later in the course of a prosecution is by getting either a search warrant or a production order from the District Court. There is no reason there cannot be a streamlined, expedited procedure which would meet the requirements of European Union law in having an independent authority, for example, permitting requests to be made. Without this, however, we are hampering investigations in two ways: we are slowing them down and also creating the risk that prosecutions will ultimately be unsuccessful because of the failure to provide the appropriate tools such that convictions will be overturned or not secured as a result.

They are the points I wanted to make about these practical issues and how we enforce the laws we already have in place. I will also make two brief points about how we introduce new laws. A model that has been adopted, particularly in some of the Private Members' Bills in this area, is the Law Reform Commission's proposal in the form of the draft Bill attached to its report on harmful communications. As Mr. Lupton said, there is much in the report that could have been implemented a long time ago. I agree with the majority of it. I do, however, have some concerns about the model it has recommended for the digital safety commissioner which has essentially since been adopted, subject to some modifications, by the Department of Communications, Climate Action and Environment in the context of its proposed implementation of the audiovisual media services directive. The approach taken by the Law Reform Commission was to state the digital safety commissioner should be established and that, essentially, social media providers - online service providers, generally - should be required to adopt codes of practice which would prohibit harmful content and that a takedown mechanism would then be available, whereby individuals could apply to the providers to have the material taken down and, if they failed to do so, the individual would have a right of appeal to the digital safety commissioner. The difficulty with this is that the Law Reform Commission in its report did not identify what was meant by "harmful content". It set out a few examples of harmful content, for example, material that would constitute the offence of harassment or material that would constitute a so-called revenge pornography offence, but it left it open-ended. Effectively, it would require providers to engage in a very subjective assessment of what constituted harmful content and would then leave the digital safety commissioner in the same position when faced with an appeal in determining what constituted harmful content. It is clear, as a matter of European law, under the European Convention on Human Rights, that this cannot be done. The convention requires that restrictions on rights such as freedom of expression be prescribed by law. The case law in this area makes it clear that this requires that there be a degree of predictability, that we should be able to say clearly what type of speech is and is not covered. The Law Reform Commission's proposals, as adopted, would fail to meet that criterion.

The second point which, in some ways, is more fundamental because it is harder to fix is that the Law Reform Commission's proposals do not address the question of procedural fairness. If an individual's posts are to be taken down from social media, for example, will he or she be given an opportunity to make a comment on it before they are taken down? Will he or she be given a right of appeal if they are taken down? Will there ultimately be recourse to a court in the event that they are taken down? Again, the standards of the European Convention on Human Rights are quite clear in that regard. If state bodies, as distinct from private actors, are to make these decisions, there must be, except in exceptional cases in which there is some special justification, notice, an ability to make representations, some redress mechanism and, ultimately, judicial oversight. Again, the Law Reform Commission's proposals do not provide for this. There is no question of any individual affected by a take-down notice having the ability to appeal to a court. This can be contrasted with, for example, the Data Protection Act and the role of the Data Protection Commission, whereby individuals who are told that they must take down content because it is contrary to the data protection rights of an individual have an appeal mechanism open to them in the form of an appeal to the Circuit Court. Again, therefore, from a procedural fairness aspect, we must consider whether the approach taken by the Law Reform Commission would stand up to challenge. In my view, it would not.

They are, in broad terms, the submissions I wanted to make on this issue. I am open to answering questions the committee might have.

I thank Dr. McIntyre. I have noted some very direct requests from colleagues and others that were not quite so certain. I have on my list Deputy O'Callaghan who will be followed by Deputies Martin Kenny and Jack Chambers and Senator Conway. Senator Ó Donnghaile is still making up his mind. I will add him to the list when he is ready.

I have to attend another meeting and I am not sure if I will be back on time. I thank all of the delegates for their very helpful presentations. I appreciate the time they are giving to the committee. Deputy O'Callaghan will now take over.

I had a sneaking suspicion that after last week, wihen we had representatives of Facebook, Twitter and Google before us, the level of interest would not ratchet up to the same extent this week. The Visitors Gallery was full last week. These are hugely important and very interesting submissions and I record our appreciation of all the delegates for coming before us.

I thank our three guests for coming. It has been very helpful to hear from people who come at this complicated issue with independence and the public interest at heart. May I get an indication from all of them as to whether they agree that regulation needs to be increased through the enactment of laws by the Houses of the Oireachtas?

Dr. Mary Aiken

Yes.

Mr. Ronan Lupton

Yes.

Dr. T.J. McIntyre

Yes.

With regard to increasing regulation, obviously, as Dr. McIntyre mentioned, we already have many laws in place such as those in place to deal with child pornography and incitement to hatred. Do the delegates think those laws need to be changed or should our primary objective be to try to ensure they are applied to what happens on the Internet?

Dr. T.J. McIntyre

The two go hand in hand. Mr. Lupton has provided a list of legislation that is defective in some ways. The problem is that in some respects we are not enforcing the core parts of the legislation because of resourcing and training issues. I include in my written statement a reference to some cases in which there have been delays of up to six years in the cybercrime bureau prosecuting child abuse image cases because it simply has not had the ability to forensically examine laptops or hard drives in that time. As a result, cases have been dismissed and offenders have received suspended sentences, rather than sentences of imprisonment. That resourcing issue will be a problem no matter what the Oireachtas does. There is a role for the Government in properly resourcing investigation and enforcement.

Dr. Mary Aiken

On the resources issue, I agree with Dr. McIntyre. It is not just a human resources issue for the Garda. It will need sophisticated artificial intelligence solutions to help it to deal with these problems because they are big data problems. The volume of cyberbullying and online harassment will require augmentation by machine intelligence. Some 100 or 120 people would not be able to cope with the volume of this content.

Is Dr. Aiken's primary concern and research area the protection of children?

Dr. Mary Aiken

I have a broad range of research interests, but children are certainly on its spectrum.

On the various types of harmful communications, everyone agrees that child pornography is a criminal offence and needs to be taken down from the Internet. Obviously,the children in the images are victims of sexual abuse and other children should not be exposed to looking at it. That is clear. However, there are other forms of harmful communication such as bullying. Is Dr. Aiken suggesting online bullying be made a criminal offence or, rather, that there be an outside regulator with the power to take down posts in which there is online bullying or direct social media companies to remove it?

Dr. Mary Aiken

I broadly agree that we should have some legislative instruments related to online bullying, mostly to create an effective deterrent for the behaviour and allow the general population, children included, to realise there are consequences to their behaviour online, just as there are in the real world. On prosecuting such offences, I would look at more forward-thinking applications such as the work in which I am involved with Europol and, tangentially, the National Crime Agency. We looked at youth hacking, which is a criminal enterprise on the Internet. The current thinking in that area is that although there are laws in place to deter the activity, we do not prosecute according to those laws but, rather, divert the young people in question into a juvenile programme which reinforces that they need to desist. Although we should put laws in place which could be actively prosecuted, we should consider using deterrence programmes, rather than prosecute children for a criminal offence. I do not want to break laws on the backs of children.

We do not have a crime of bullying, but we do have an offence of harassment, as Dr. McIntyre mentioned. Perhaps part of the reason there has been delay on the part of the Garda in investigating and prosecuting online racial abuse is that the Act requires something to be happening persistently. It is an indication that the Act needs to be updated. A once-off activity or communication is not sufficient to constitute an offence under the Act. Is a once-off act of bullying sufficient to require the law to intervene?

Dr. Mary Aiken

In some jurisdictions such as the United States a once-off act of serious bullying constitutes grounds for prosecution. The point I am trying to make is that we cannot take a fragmented approach. We are talking about cyberbullying and harassment, but we must look at all areas of online harm simultaneously if we wish to address them effectively. That is being done very well in the United Kingdom. I note this as an Irish citizen who has been party to advising that process and is proud of what has been achieved there. A very poignant example of the need to address all areas of online harm arose in the comments in July of Mr. Justice Michael White, an esteemed High Court judge, in dealing with a case involving a boy who had sexually exploited his two younger cousins. He spoke about his great concern at the number of cases of young children who were committing serious offences as a result of pornography on their smartphones. There has been an unprecedented surge in the number of such cases coming before the criminal courts. It was reported that the young girl who was the victim in the case had stated she wanted the sexual contact to stop. The young boy sent her text messages outlining that he had pictures and video recordings of their previous sexual contact. The court heard that he told her that he would disseminate them to her friends and others online if she did not continue to have sex. That is revenge porn. After the event had come to light, she told gardaí that she had had sex with the boy again because she was afraid of this threat. One must consider the relationship between the act of revenge porn and the availability of adult pornography to children online. These areas are all connected. If we are to enact legislation in one area, we must consistently look at all of these areas as, otherwise, we will not tackle the problems effectively.

I agree with Dr. Aiken on the issue of child pornography. As legislators, it is probably easier for us to deal with something that everyone recognises is impermissible. It is already a criminal offence and we must protect children from it. However, we need to consider the problem of harmful communications more generally? What do the delegates consider to be harmful? People say they hate politicians. Are we seriously suggesting we should regulate this?

Mr. Ronan Lupton

The Deputy is correct in terms of the subjective assessment of what is harmful and what is not. However, the State has a job to do to implement the recommendations of the Law Reform Commission and the Internet content government advisory group in having somewhere for people with subjective complaints to go. I think the Deputy is making the point that we cannot codify a criminal offence of bullying in law. I agree with him. We have a harassment offence and a form of oppressive conduct offence, but parents and other individuals do not have a place to go to state they have a problem with certain content and ask that it be assessed and the necessary steps be taken in the civil vocabulary of law to stop what is going on, whether it be with a host platform provider or by way of referral to the criminal justice authorities. I have made the point that the Minister for Justice and Equality has stated it will never be the case that criminal justice matters will sit with an online tsar. He is correct in that regard. I acknowledge the Deputy's point that it is a subjective issue. Can one codify an offence of bullying and not open the floodgates? I do not think one can.

It would be problematic to codify an offence of harmful communications in general. We need to come up with a definition of harmful communications for this module. Dr. McIntyre has outlined that he looked for a definition of harm in the Law Reform Commission's report, but did not find one. It may be that the commission experienced the same difficulty we will have and decided to identify several actions that were clearly harmful such as threatening or false messages, harassment, stalking or intimate images. That is how it dealt with it in the report. Mr. Lupton's point is that if we are to legislate, we need to define what is harmful.

Dr. T.J. McIntyre

Absolutely, we do. There is a problem. I hope members will forgive the comparison, but in some ways it is a little like Brexit. There are vague complaints in some cases and lofty goals in others, but when it comes to implementing them in a legal text, things become very difficult. There have been several attempts in the United States and Canada to codify bullying offences, online bullying offences in particular. In every case they have been struck down as insufficiently precise and too vague to be enforceable under the criminal law. That is the situation in Canada where the law is more reflective of the European system and weighted towards the interests of individuals, as well as in the United States where there are strong rights under the First Amendment.

If it is helpful to the committee, I can provide links to some of the cases after the meeting.

Dr. T.J. McIntyre

One sees this if one looks at the issue of harassment. Deputy O'Callaghan made the point in relation to harassment that we have concern about the persistence requirement and that one-off acts of bullying cannot be criminalised. The persistence requirement is what takes individual statements, which might well be toxic but do not rise to the level of criminality, beyond that and to the stage where we say, as a society, that criminal intervention is needed. If we start criminalising one-off statements, it becomes much more difficult to say precisely what type of criminal statement is involved and precisely what type of single speech act of bullying rises to the gravity that justifies the remarkable intervention of the criminal justice system. That is compounded by the fact that we are trying to avoid criminalising children, in particular. In most areas of the law we now seek to avoid dragging children into the criminal justice system. In many ways, it is unhelpful to expand liability further in a way that would do that.

I will make one further point in response to the Deputy's question about the persistence requirement and how we define the threshold that is involved. To an extent, there might be a level of confusion regarding the circumstances in which we are doing it. On the one hand, we might be talking about criminalising an individual for what he or she posts. In other circumstances, we might not focus on the individual and we might ask if we should take down this particular content. It is unhelpful to conflate those two instances because criminalising somebody involves assessing that person's intention. In the case of these harassment and bullying offences, we are usually looking at a pattern of behaviour. Making decisions to take down individual elements of content involves assessing the individual element, usually in isolation. Content moderators for sites like Facebook or Twitter focus on the individual content and do not usually have a pattern of conduct in front of them. It is unhelpful to say that we should have the same standards applying in both contexts because it is very hard to read across.

The law can intervene in a civil or criminal context. Criminal context is one thing but in the context of people having the ability to have certain information taken down, should the Oireachtas create laws that give a civil remedy to individuals to permit that, or should we leave it to the social media companies to have a self-regulatory system whereby somebody contacts a company, it makes an assessment and then take down the content?

Dr. T.J. McIntyre

There are a number of difficulties. One is the assumption that in a legislative context we are looking at a one-size-fits-all solution when we will be looking at a range of very different providers and sites, a range of very different users and, probably, very different standards as to what is expected. Some websites already apply a much more stringent standard. For example, boards.ie is much more strict with its content moderation and takes down material far in excess of what is required by the law. Facebook is notoriously stringent in some regards. For years, it waged a so-called war on breastfeeding which it found to be contrary to its policy on nudity. However, it is much more lenient in other regards. As the committee will have heard recently, Facebook has been subject to many complaints that it does not take down what many people would regard as hate speech.

I apologise for interrupting. Should the Oireachtas intervene and give a civil remedy to people so that they can have the capacity to go to a regulator or the courts to get material taken down, as opposed to doing it in the current system under which people apply to Facebook or some other company?

Dr. T.J. McIntyre

Before one can create a State mechanism to require content to be taken down, one must define what content has to be taken down.

Dr. T.J. McIntyre

That is the stumbling block. We can certainly say there should be a civil mechanism whereby people who are the victims of content which would amount to a criminal offence, for example, content involving intimate images, should be able to go to a State body to have that content taken down if the individual provider does not do so. In fact, in the case of intimate images we already have that because the Data Protection Commission operates as that point of appeal. It is much harder to elaborate from that and say in respect of other kinds of content that we should have that remedy.

Dr. Mary Aiken

We are not just talking about points of law. We are talking about human behaviour, developmental aspects and a scale of escalation. If we do not tackle the pipeline - the beginning of the scale - the lesser offences will escalate over time. In this room, have members, as public figures, anecdotally noticed an escalation in the abuse they receive online on public platforms or has the abuse remained static or diminished over time? Arguably, there has been an escalation because there are no consequences for this cyber-feral behaviour in cyberspace, this psychologically powerful immersive space. There is the minimisation of status and authority online. In his 2004 work, Suler argues that people are disinhibited in this space. We have to address a spectrum, from activities that are not deemed to be as severe - maybe entry into cyberbullying type behaviour - through to extreme harassment and threats because it is an exponential spectrum of behaviour that will escalate over time if we do not put some form of sanctions in place.

While I agree with Dr. Aiken's point on extreme behaviour, why should somebody not be able to abuse me online?

Dr. Mary Aiken

If the Deputy wants to be abused, that is his prerogative.

I do not want to be abused but why should somebody not be allowed to abuse me?

Dr. Mary Aiken

The Deputy is an adult, a public figure, and he is robust and resilient. If he were a child, a minor-----

I agree with Dr. Aiken about that.

Dr. Mary Aiken

-----or if he were vulnerable, had a mental health or physical condition or if we were elderly, the Internet and social media per se are a much harsher environment. Such people will not have the Deputy's resilience.

I know I have gone on too long so I will ask a final question. We hear a great deal about hate speech. The law at present, the Prohibition of Incitement to Hatred Act, is that if one publishes material that is threatening, abusive or insulting, and it is likely to stir up hatred, that is an offence. Do we need to go beyond that for speech online?

Mr. Ronan Lupton

I have already answered that question in my statement. I think we do need to go beyond that. The difficulty with that particular Act is that gardaí are sent to locations where people with loudhailers are protesting or they are saying things on organs or platforms where they have multiple thousands of followers. What can an individual garda from Irishtown Garda station do in terms of prosecuting under sections 2, 3 and 4 of the incitement to hatred legislation? It would be a very brave step to do that and face the baying mob that we have seen in recent times. Is there a need for reform and an update of that legislation? The answer is a categorical "Yes". The question is how does one do it because it is extremely complicated. One is into the discussion of online harms, that is, all of the points that we have just discussed in terms of the turf, as it were. The legislation needs to be brought up to date. As I make clear throughout my statement, there must be a balancing act, as Senator Conway mentioned, between the right to free speech under Article 40.6.1° of the Constitution, the preservation of the good name of citizens in Article 40 and use of the law, perhaps in defamation and other contexts, to vindicate those particular rights. The answer, therefore, is a categorical "Yes". The legislation needs to be brought up to date.

I thank the witnesses for their contributions. There is an issue of resources. At last week's meeting, representatives of the Garda stated they needed a multiple of the numbers they have. I was struck that the expertise required in that particular field of operation is entirely different from what the vast majority of normal Garda training provides for.

Before Deputy O'Callaghan leaves, perhaps he will be able to rejoin us for a photograph with our guests at the end of the meeting.

I am scheduled to be in the Seanad at 10.30 a..m. I suggest my colleague, Senator Ó Donnghaile, speak before me and I can contribute later.

That is fine.

An entirely different level of expertise is required for this type of work. The Garda has made great play of the civilianisation of certain aspects of its work. Should the Garda take in additional resources from outside the force to ensure it has the level of skills required?

That was not made clear in the submission made last week by An Garda. It has been noted that when people complain to An Garda about being victimised, they are told it is a civil matter, between the person complaining and the person being complained about. The problem could not arise, however, without the existence of the platform on which the content is posted. I put the point to the representatives of the platform providers that appeared before the committee last week. The providers step back and say the matter is between the two parties involved and that they just happen to be the platform. They act as bystanders.

I appreciate that our guests believe that some legislation needs to be updated and made fit for purpose. Does it also need to ensure that it will encapsulate what I have outlined, which is left outside? Do the platforms, which currently act as bystanders in such cases, need to be incorporated into the laws to ensure they, too, are held accountable? In the case of litigation, if someone has uploaded something on Facebook or Twitter, for example, he or she can be identified and commented on, but the platform in question will step back and say: "There you go." It is necessary to try to encapsulate the platforms in the law. They would be much more careful if there were consequences for how they act.

Dr. Mary Aiken

Accountability is the key. The use of the metaphor of the bystander is interesting because the bystander effect, which is inherent in psychology, is the premise of diffusion of responsibility. There can be such a diffusion that nobody feels responsible or steps up to be accountable. We have allowed social technology platforms - as opposed to social media, given that search technologies should be considered in the process - to define themselves. Facebook recently described itself as a movement. It is fantastic if it wants to describe itself as such but where is the accountability? It is up to us as policymakers and legislators to say that, in fact, we will define such companies. We will decide whether they are publishers or broadcasters. Whether it is user-generated content is not the issue. Let us imagine that RTÉ Radio left the door open and allowed every man and his dog to walk in off the street and say something on air, and then broadcast it. It is the same model as somebody broadcasting online.

The Garda needs additional expertise, not least in the form of cyberbehavioural scientists, to enhance its efforts. It needs more resources, including machine intelligence, to tackle the problems. It has reached out to me on numerous occasions to hold dedicated workshops and training sessions with it. It is doing its best to keep up in cyberspace but we need to provide additional support and resources, and the country is well placed to do so. Professor Barry O'Sullivan, who is the chair of the European Association for Artificial Intelligence, is based in the country, ready and willing to help, as am I.

Mr. Ronan Lupton

On the mechanics, after one of the meetings of the committee, a headline appeared about telecommunication executives being made criminally liable for content transmitted across pipes. According to the mere conduit defence, in the case of what is transmitted on telecommunications companies' pipes or fibre network, if they do not know what it is, they do not know what it is, until such time as they do, when they have an obligation to act and remove it. That is a separate defence under European law, the same law I deal with on the hosting site.

Platforms above that, such as Facebook, Google and Twitter, have the hosting defence. Similarly, once content becomes known to them, the information is removed and a defence arises. Under both those defences, there is an obligation on the State not to mandate monitoring but it can mandate duties of care. The question is where the line arises between duty of care and monitoring, because the bottom line is that the latter cannot be done. I am concerned that something will arise from a report that indicates that the State will change the law, which may cause a jarring effect and lead to an incompatibility with European law. It is the wrong approach.

On the point on Garda resources, I fully support, accept and associate myself with Dr. McIntyre's statement to the committee. We mentioned each other in respect of the e-commerce elements of our submissions. Two cases, those of Joe O'Reilly and Graham Dwyer, were heavily dependent on telephone records and other types of records that were acquired, such as number plate recognition on the M50. In the context of the Dwyer litigation, triangulation of mobile phones was undertaken by civilian members of An Garda Síochána, who were very clever and managed to gather circumstantial evidence to result in the prosecution. On the question of whether the Garda requires resources in a number of areas, the direct answer is "Yes". Its needs significant resources for combatting child pornography and the most egregious forms of crime that occur on the Internet.

Other forms of crime, such as murder and rape, are no less serious, although I do not want to scale crimes. There should be another unit to deal with such activity. As I noted in my statement, crimes that occur daily go unprosecuted and un-investiagted because tackling serious crimes is so under-resourced that it takes attention away from what is currently pervasive. A person could be subject to a cybercrime and need it addressed but can approach only his or her local Garda station to report it. If the case is not transferred to the central function in Garda headquarters to investigate it properly, good luck. It will be a case of taking one's chances with the vendor or bank in question, which can try to deal with the problem, even though a criminal act has occurred. Significant resources are needed in the area. To return to what Deputy O'Callaghan raised earlier, how do we enable the citizen to seek civil recourse? It may be that a digital safety-type function is required whereby someone can say what has happened but that he or she is not sure if it is a crime, and request an assessment. There is room for the State to do that.

For years I have sat on various groups that deal specifically with the reporting of child content online, such as the Department's Internet advisory board and Internet safety advisory committee, and now the National Advisory Council for Online Safety. A hotline.ie service exists for reports but it does so in isolation and is funded by the telecommunications industry. While its works well and closely with the Garda, I know from first-hand experience that the resources are not available to manage and marry the function, which is voluntary. Its content analysts view horrible reports they encounter from time to time. It is part of the wider European INHOPE network, which receives reports. Telecommunications companies are worried, given the current state of legislation, that holding blocking lists may create a criminal offence for them. That needs to be examined. While I acknowledge that legislation takes time to process, they are the types of quick wins that could create a different approach to behaviour online.

Dr. Mary Aiken

The only way we will modify human behaviour online, in this domain we have created, is by putting in place laws that create consequences for criminal behaviour such as accessing child pornography, or what we call online child abuse material. Ten years ago, the US National Center for Missing and Exploited Children, the body charged with dealing with such content, dealt with a couple of hundred thousand images per year. Last year, it reported that it had dealt with 45 million images in that year. The problems are spiralling out of control because we as a society are failing to tackle the basic human drivers that manifest in cyber contexts.

Dr. T.J. McIntyre

On the Deputy's point about civilianisation, he is correct. As Mr. Lupton pointed out, civilian analysts in the Garda work on such issues.

There are practical problems in that a lot of the training available is restricted to members of police forces. There is a need to make sure people are affiliated with the police forces before they can get into these training programmes and to contact the training programmes to make sure it is available. It can be done and if I may plug University College Dublin, UCD, I might mention that we run a masters programme there in cyberinvestigations. This can be done and that might be a better use of Garda resources than insisting everything be done by members.

I want to tease out the point Mr. Lupton made about hosts being prescribed as publishers, how he has a resistance to that and how that would fall outside of or be incompatible with European law. I understand where that comes from because the idea of the Internet is it is instant. That is what makes it perfect. One pushes a button to search something and he or she has it. One puts something up online and it is there in front of him or her straight away. That instantaneous element of it gives it the edge over every other form of media or publication. They have an argument there but at the same time, that argument cannot be used to avoid responsibility. Is there space somewhere between the two that we need to find? It is like the question of how does one define the harmful content. How does one define where that space is or is it possible to do that?

Mr. Ronan Lupton

I am sorry for saying this in this way but my view is the State needs to engage heavily in the central discussions that will happen on this in Europe. There are papers available, which I have seen, that deal with reforms to this area, such as good samaritan provisions for hosts that become aware of illicit or unlawful content, and take action but say they could be criminally responsible for it. That element to it exists. To answer the key point, there is a disincentive to a business that operates in the e-commerce host space to take steps because they say they do not know something is there until they are told and therefore they will take it down until a later stage. Deputy O'Callaghan was getting at this point earlier. If one reports content to a host provider one does not like or if there is a criminal offence such as hate speech, suddenly one is met with a response saying it will be assessed. One is not told under what law or regulation that assessment will be carried out, and the rejection comes with an explanation that the alleged offence has been assessed under the community rules. That is probably US law being applied but it could be someone sitting in India doing the assessment. Who knows where they are sitting. I said in my witness statement that there is a disjoint between the application of national law - and regional law in the European context - and what should occur versus what does occur. In Ireland, if one wants to take a defamation case and the assessment deems that under the community rules it is not defamatory, the next step is to go to the Four Courts to seek injunctive relief to have the defamatory material taken down or to disclose who posted it.

The Deputy asks how we can find the middle ground. It might be a duty of care situation where some form of legislation is deployed to bring it as close as possible to a provide for duty of care provisions as against the hosts without trampling on the defence and good samaritan provisions. Unfortunately, it is a case of assessing how long a piece of string is because some are in the Facebook category and others are newly developing businesses that want to be able to avail of these defences for whatever reason. I am not saying there is a criminal or a bad reason for that, but it might be they have no resource to moderate content and so forth. That is my take on it but it is a complex question.

Dr. T.J. McIntyre

In response to the Deputy's question, from a practical perspective one way of doing this might be to have an intermediate system, which could be something like a digital safety commissioner where we have clearly defined rules being applied. In this scenario there would be a halfway house for individuals who are affected. These individuals could say this is a clear legal wrong against them and clearly defamatory, and not merely an undefined example of people being nasty to them online. Such an individual might not have the resources to go to the Circuit Court or the High Court but they could go to an intermediate body to make that complaint. That body would assess the complaint and order that the material be taken down after hearing from the other side, without damages being awarded. That would operate in a similar way to the Data Protection Commissioner, DPC, for example. There is no reason why we could not have that form of intermediate structure that could be called something like the digital safety commissioner, provided it is operating within clear and well-defined laws and provided it has clear procedural safeguards in place.

Mr. Ronan Lupton

That is right. I want to add to that and I apologise if I am trampling on my time allowance. If there is a situation with a person who may be unable to afford to go to the courts, there are certain classifications of civil litigation that are not covered by the provisions of free legal aid. Defamation is one of them. It is often found that someone is either subject to an action where he or she has allegedly defamed somebody or vice versa and he or she cannot afford to bring the action. That intermediary body - and I know the ICGAG recommended certain reforms on bodies, as did the Law Reform Commission, LRC - but a form of one-stop-shop would go a long way to fulfilling that duty to care. I come back to the issue of bullying as raised by Deputy O'Callaghan. It might be that somebody in that unit assesses the communication and decides there is no grounds for a report and there is nothing to see, and in the next report the assessor might decide it is a serious issue that is continual and is a harassment offence. The assessor could then assume the shoes of the complainant and pursue the claim, which might be useful. In that case, will the State fund the budget on that sort of function? We have seen anecdotal evidence on what the treatment of the DPC, that regulates three quarters of global tech companies, is. It has to be taken seriously, both from a Department of Public Expenditure and Reform point of view and from a Department of Justice and Equality perspective. I said in the witness statement that there is a role for that function and it marries closely to the point I made about duty of care in response to the Deputy's question.

Dr. Mary Aiken

I want to affirm that we need an independent statutory body to oversee process.

One of the points I was going to make on that is we have the existing platforms. If Senator Ó Donnghaile and I were smart enough to create a new app and we put it out there tomorrow morning, we could do whatever we wanted to do. There is no regulation, whereas if we produced any other piece of technology we would have to get a C certification that it meets certain standards. Yet there are no standards to be met. It always strikes me that the Internet is called the worldwide web, WWW, and yet we are talking about what happens here. While Ireland is important, because we have the headquarters of many of the major tech companies here, at the same time it has to have that reach across the globe. While I agree the issue is European from the point of view of the European Union and what we are doing about that, it goes further than that. All of this is happening everywhere from Singapore to Latin America. For instance, when we go on to Facebook or any of these platforms and we scroll down through our content, we come across sponsored advertising all the time. Surely the organisations that are putting out and hosting those advertisements should also be compelled to include a certain amount of advertising about how people can report issues and about how to stand up for one's rights on this platform. A lot of people do not know where to go with reporting issues.

Mr. Ronan Lupton

That is right and we have seen certain celebrities having to take actions where fake news and fake material have been posted in advertising that has put their reputations and employment in jeopardy. They have no choice but to go to the courts and ask for disclosure on who put that information out there, and that is an expensive process. If an individual was subject to that type of activity with fake news, which has a number of different elements to it, that one-stop-shop provision could facilitate a cheaper mechanism by which those individuals could seek recourse as against the platforms, without having to go to the courts, but they would still have the right to do that as well. The Deputy is right there is a thrust to keep the economic development online so one can put an app together and do what he or she wants with it within certain restrictions with commercial transactions. I made this point because if the State simply makes the hosts publishers, we suddenly encounter an immediate incompatibility with the European framework and law, and there is a huge disincentive to do a lot of things. That does not marry at all with the protection of children online etc., so there is a jarring effect in the point I am making. I am not trying to say the two things are separate. They are not.

The platforms provide those areas to put the content out there, but we need to be careful that we comply. My view is that as a State we need to really engage at European level to ensure we get what we want and try to protect citizens in that sense.

Dr. Mary Aiken

The other point is that we are not standing still in time. While we can talk about European law, it is constantly under review and evolving. I work closely with the EU in various areas, including the audio-visual media services area. One area we are looking at is the availability of video content that is targeting children online. There is a phenomenon known as "dark Peppa Pig", where people embed extreme content in videos that are being played for children who are three or four years old. Parents put on YouTube and allow their toddlers to watch the videos. Then, embedded in the video will be beheadings and other extreme content. This comes from people with psychopathic or sadistic dispositions deliberately trolling children.

The debate in the EU at the moment has been along particular lines. The thinking is that these are big data problems and, to address a point made already, the content is uploaded immediately and is, therefore, distributed or published immediately. Effectively the mechanisms they are looking at involve getting users to flag their own content and label the user-generated content as suitable for children or otherwise. However, if people are deliberately embedding content designed to troll children, they are not going to flag that content. The reason those in the United Kingdom are moving towards the online harms idea is because they are facing a tsunami of problem behaviour - as are our front-line services - in terms of the negative impact of harmful content on children. The child and adolescent mental health services in the UK are being overwhelmed by what is happening to children who are growing up in cyberspace.

That you for that. Senator Niall Ó Donnghaile is next.

I am conscious that I have tabled a Commencement matter in the Seanad due to be taken at 11 a.m. Maybe the panel can refer to my question and I will read it from the transcript.

I am wondering about the addition of a legislative instrument to address these issues. I do not intend to disregard the most serious element of online abuse and harassment, but the vast bulk of people would really simply prefer that it stops, that the person is dealt with and that it simply goes away. The idea is, "Leave me alone, and give my head peace" as we say in Belfast, and simply stop it.

What would happen if we were to introduce some legal instrument to deal with this? Those of us with experience in the legal realm knows that it does not always move quickly. Is there a danger there could still be a prolonged period when this material exists, even if some measure is defined in statute? How does the panel envisage being able to deal with this swiftly and effectively in a legal context? I know that is not always the most doable thing within the legal context. For me, there is obviously a clear rationale in dealing with more dangerous content, especially around children and vulnerable people, as Dr. Aiken identified. Earlier, Deputy O'Callaghan referred to the stuff we see a good deal of. Other people may believe that it is terrible and they simply want it to stop. Is there a way that we can strike a positive balance to ensure that any measure is speedy but also legally grounded and effective? I apologise for having to leave shortly.

The panellists will respond in any event for the benefit of the committee. Who would like to take the question?

Dr. T.J. McIntyre

Much of what we talk about is really an issue not so much about what rules should apply, because the rules are in place, but about access to justice and getting those rules enforced. The point made by Mr. Lupton some minutes ago about the adequacy of responses by social media companies to a large extent is one about their mechanisms for responding to and evaluating reports. Criminalising conduct means getting the Garda involved in some cases. Often, it is not about achieving a criminal justice outcome. Often, it is about people getting in touch with a social media company. In turn, this causes the social media company to take the matter seriously and properly evaluate the content, something the company might not have done previously. To some extent that might answer the question from Senator Ó Donnghaile. If there is greater Garda enforcement, we might get the desired result to take down certain material without it necessarily progressing to criminal justice enforcement.

Are there other ways of doing that? It might be that if we can incentivise companies to act more speedily on complaints of criminal material, we can get that result. That is permissible under the existing legal framework. Germany has the so-called network enforcement law, or netzwerkdurchsetzungsgesetz, which provides for significant fines on companies that fail to take down certain types of content, including extremist content or content promoting terrorism, promptly once notified by a state body. It is a graduated duty and it applies for the most part to firms that have more than 2 million users. It aims not to hinder innovation in the way mentioned earlier by Deputy Conway by imposing too great a duty on smaller providers. Essentially, it is limited to providers operating at scale. That model could certainly be used but it is a model which, to my knowledge, has not really been considered in the Irish debate so far. It may be premature to adopt that model now when the European landscape is so fluid at the moment.

Dr. Mary Aiken

We are talking about points of law but we are almost using Stone Age tools to deal with a highly sophisticated problem. It is a technology problem, aided and abated algorithmically in terms of how negative content is spread and disseminated. When we look to create laws in this area we are going to have to look at sophisticated machine-intelligent solutions that will actually automate the data collection and prosecution processes to create packets for the Garda so that it can prosecute. That brings us into the area of surveillance. However, if there is a criminal act, then maybe that is something that we can consider.

I will offer an example. The largest social media company in this country has approximately 2.5 million users. If 10% of them decide over any given weekend that they have been harassed or bullied and want to bring it to the Garda, that involves 250,000 people turning up. If the number were 1%, that is 25,000 people at the Garda station on a Monday morning. It the number was 0.1%, that would be 2,500 people. The Garda simply will not be able to cope with the volume. We can decide to run up the white flag and do nothing because it is such a big problem or we can decide to come up with sophisticated solutions to what are effectively network-science-type problems.

Mr. Ronan Lupton

I wish to underpin Dr. McIntyre's points. Earlier, I touched on the issue of community standards and rules. Senator Ó Donnghaile made a point about how the longevity of information maintained on a platform could have damaging consequences in both a civil and criminal law context. I guess from that point of view we may consider bringing forward codes of conduct. I am sorry to use the expression, because I do not believe self-regulation has worked the way it should have, but codes of conduct to which platform providers sign up nationally may work. There may be some form of punishment or sanction if they fail to do things that are properly reported and adequately assigned to them by some State intervenor or actor. We could let them sign up to that. Ultimately, it is in their interests to come to the table with solutions and suggestions. Maybe they have with their submissions to the committee.

It is fair to say that the law is in place already, as Dr. McIntyre has said. Is it being enforced properly in a criminal context? No, because we know there are resourcing issues. On the civil side of the house, it is expensive and costly. It takes time to go to court to do these things. Fundamentally, we have only to see the recent clarification on the position in terms of hosting and content and whether injunctions can go a certain way in terms of innocent publication and so forth. Again, it is in my witness statement but I want to underpin the point. Really, the platforms should come to us and suggest we bring in a given model of behaviour to which they sign up and, if they do not, a sanction applies.

That might not be done legislatively but, rather, by way of a code of contact. There are examples within the GDPR in the devising of future codes. I will not get into the debate on that particular turf, but, certainly, it is up to the platform providers to show good behaviour. There is a problem or strain in terms of the community assessment issue, where it is completely out of sync with national law.

I apologise for having to leave the meeting for a time. I join colleagues in thanking the delegates for their engaging and informative presentations. Dr. Aiken has noted that if even 0.1% of Irish customers of a particular social media company were to make a complaint to the Garda, it would amount to some 2,500 complaints and gardaí would not have the resources to deal with them. However, every jurisdiction in the world is in the same boat. Dr. Aiken referred to the United Kingdom, but, as I understand it, that country has not yet implemented the type of complaints process we are discussing. Bearing in mind that we have a population of some 4 million, what other jurisdiction has the infrastructure in place to implement such a model?

Dr. Mary Aiken

None has done so as yet.

In that case, we should not be kicking ourselves that we have not done it.

Dr. Mary Aiken

However, we can show leadership on the issue. This is a small country but also a cybersmart one, with several of the large tech companies having their headquarters here. I would like to see some pioneering work being undertaken to devise effective models to deal with a situation where gardaí are potentially coming into work on a Monday morning and encountering 2,500 or 25,000 complaints. There certainly are machine-intelligent solutions to these problems. We can use technology in a positive way to augment the law enforcement process.

This is a small country and it is not long since we were broke. On the other hand, there are countries like the United States which have vast quantities of resources far beyond what we have and which certainly have an international obligation to devise an infrastructure to deal with this problem. How does Dr. Aiken propose that we find a technological solution? It is all very well saying we should be smart and pioneering, but from where will we get the necessary resources?

Dr. Mary Aiken

The resources to do it include people like me, Mr. Lupton and Dr. McIntyre. We are sitting here in our own time and each of does pro bono work in this area. I have many colleagues who would be prepared to give of their expertise and abilities in working towards the greater good in devising innovative and technical solutions. Senator Conway can hold me to that.

I have no doubts about Dr. Aiken's sincerity. She states in her submission that she has been advising the UK Government on this matter and is proud of what is being achieved in that regard. Should we wait to see what the United Kingdom does and then seek to emulate it? Surely that would be the smart thing to do?

Dr. Mary Aiken

I do not agree. The two can work in tandem. There is a significant body of knowledge in place and Ireland should not wait for the United Kingdom to do something, particularly when there are Irish people engaged in helping to advise the process there. I would like us to show leadership in this area, something we are absolutely capable of doing as we have the expertise.

Why should we replicate the good work being done in the United Kingdom? Would we not be far better off working with the authorities there, sharing resources and seeking to emulate international practice, as opposed to trying on our own to define best practice?

Dr. Mary Aiken

The reason we should try to get ahead of the process is that the legal process takes time. Both Mr. Lupton and I sat on the Internet content governance advisory group which reported some five years ago. My concern is the harm that is being done while we sit and wait and watch what others are doing. Children are engaging with this technology and being harmed by it.

I do not disagree with Dr. Aiken for one minute on that point. What I am highlighting is that this is an international problem. Every country and Silicon Valley are is in the same boat. However, I will move on.

With reference to the report produced by the Law Reform Commission on this area, Mr. Lupton has expressed a concern that the committee could end up confusing the issue if it issues recommendations. Will he elaborate on what he said?

Mr. Ronan Lupton

It is important, if the committee drafts a report or make recommendations on this issue, that it consider both reports in tandem. They are relatively complementary, with several of the LRC recommendations reflecting the work done by the ICGAG. The Senator and I have discussed this topic before at another committee. I would like to see the recommendations being taken as a type of prêt-à-porter or ready-to-wear starting point. Of course, there are structural recommendations within the ICGAG's report which would require the engagement of multiple Departments and a significant budget, something that may not be achievable. I agree with the Senator that we should co-ordinate with other international participants on this issue. If reform is coming centrally through the European legislative reform packages, we should engage with it as fully as we can and see what best practice is elsewhere. It might not be a simple case of cutting and pasting, but there is a certain view on the matter at which we should look. New Zealand and Australia have made inroads in the area.

As a member of the committee, I will be forceful in arguing the case for a European solution to this problem into which we can feed. We might want to be heroes, but that is not possible because this is an international problem. The Chairman and I have attended meetings of the Joint Parliamentary Scrutiny Group on Europol. The latter should be leading the way on this matter. The Government should be using our influence in Europe which is immense, as we have seen in recent times, to seek to identify a European strategy. It is not just Irish children who are being harmed but children throughout Europe and the world. We will play our role in leading a campaign within the European Union to implement a borderless European and international solution to this growing problem.

Dr. Mary Aiken

I work as an adviser to Europol's European Cybercrime Centre.

The clerk and I have visited that centre.

Dr. Mary Aiken

This is a global problem and the question as to why we should act now is important. The Government was put on notice by the ICGAG report that sites advocating self-harm such as cutting, anorexia and suicide were harmful to children. We have since had a period of time in which the Government has been aware of this problem, but it has failed to act. We have been here before in Ireland in allowing forms of abuse to perpetuate. It raises the question of liability. We cannot have class and group actions, but we certainly can have mass actions. Dr. McIntyre is looking at a mass action in another area. What happens when parents start coming forward to say there is a connection between something their child was exposed to and a self-harming behaviour in which that child subsequently engaged and seeking to be compensated?

I do not wish to labour my point, but, again, this is an international issue. None of us wants to see children being exposed to such material, but it is happening in every country. We need a European and international solution. I cannot see why Dr. Aiken should disagree with me.

Dr. Mary Aiken

I work actively on European solutions. I am in a different country every week.

In that case, with respect, Dr. Aiken should be agreeing with me and seeking to have Ireland use its influence in Europe to identify a European solution that will protect children throughout Europe.

Dr. Mary Aiken

I agree with the Senator on that point. I do not agree that we can wait for such a solution.

We will leave it at that.

Dr. T.J. McIntyre

Senator Conway asked about the level at which we should be regulating. He is entirely correct that this is primarily a matter for European and wider international co-operation. One of the problems in this debate is that people sometimes fail to recognise that it is not the role of an individual member state such as Ireland to regulate the Internet industry worldwide, notwithstanding the fact that some of the major companies have their headquarters here.

As a general rule under European law with respect to what are, for the most part, privacy matters, the competence of Ireland is generally limited to residents within Ireland or people with a significant connection with it. We saw this in the example of the digital safety commissioner, where the Law Reform Commission's proposals recognised that the commissioner's role in adjudicating on complaints would have to be limited to people resident in Ireland. It is, therefore, very misleading to say we have an opportunity to provide for a wider form of European legislation.

Dr. McIntyre should withdraw the word "misleading" as I am not in any way trying to mislead. I am trying to engage in a debate and bring a little realism to it in order that we can formulate a European or international solution to what is a large, serious and threatening international problem.

Dr. T.J. McIntyre

I am sorry. I did not mean to give the impression that the Senator was misleading-----

I ask Dr. McIntyre to withdraw the comment, if he does not mind.

Dr. Mary Aiken

As I thought the comment was directed at me, I will defend it.

Dr. Mary Aiken

It might have been.

It was not. Dr. Aiken did not use the word "misleading".

Dr. Mary Aiken

No.

Then it was not directed at her.

Dr. Mary Aiken

I believe Dr. McIntyre-----

Dr. T.J. McIntyre

Perhaps I should explain what I meant.

Dr. T.J. McIntyre

I certainly did not mean to imply the Senator was misleading the committee and withdraw the comment if that is the implication.

Dr. T.J. McIntyre

I meant to say that in evaluating this issue, the Irish role is in adjudicating primarily on matters affecting Irish residents. I meant to say it was misleading to suggest that because the technology industry had many headquarters located here, it gave us an oversized international role.

Dr. T.J. McIntyre

It does so in two distinct contexts. With data protection we have a wider European role as lead regulator. With video sharing service providers, in the forthcoming implementation of the audiovisual and media services directive we will also have a European role. In every other area the position is as the Senator suggests. We are focused primarily on the Irish position and do not have an impact on the wider European or global position. It is in that context that I mean to say it is misleading to suggest we, for example, provide a novel framework that would have a worldwide impact. The framework we create would relate primarily to the Irish position.

Dr. Mary Aiken

I should clarify my comments because that is not what I said. I said that as technology companies had their headquarters here, we could consider innovative solutions that would not be delivered worldwide but rather in our own country and for Irish citizens. Such solutions or models may, in turn, be adopted by other countries according to their legislative framework.

The reason technology companies have their headquarters here is the corporation tax rate. It has little enough to do with our technology expertise.

Mr. Ronan Lupton

I agree with the Senator on the overall position, about which he is clear. There is an adjunct point, about which I have written. There is a role for the Department of Education and Skills, the national curriculum and taking a proper approach to cybereducation. I do not want to spend too long on this point, but it is worth stating for the record. If we educate people properly in the home - there are a number of programmes operating in this sphere, although, again, they are under-resourced, it feeds into a societal awareness of online harm, problems and criminality, etc. This goes hand in hand with holding platforms and companies to account when things go wrong. There is work to be done outside the committe, and I am sorry for adding to it. The curriculum must be examined and there should be support for families, perhaps from Tusla, in educating them on how to engage with the Internet. That is where the Minister for Children and Youth Affairs, Deputy Zappone, sits.

Mr. Ronan Lupton

The Senator may have attended the committee meeting at which an unprecedented four Ministers arrived for a discussion of children and youth affairs to set out their stall on Internet and online safety. The messages were all good.

That was a committee meeting at which the age of consent was discussed.

Mr. Ronan Lupton

That is correct, or it was just afterwards. We had a long discussion on it. The reality is there is still work to be done, both on familial supports from Tusla's perspective and the overall regulation of complaints and societal issues but also the curriculum standpoint, with which we can feed into the youngest in society to educate them properly. We would also assist teachers, principals and so forth to feed into it. If we have an educated society, transactions and behaviour in dealing with platforms take a different approach and there would be better awareness. It feeds into the idea of making Ireland a better place in terms of tech savviness. There was a comment on international manoeuvres and hosting. We must focus on that issue as best we can and bring our influence to bear at that point.

Dr. Mary Aiken

We have had 20 years of education and awareness in how we interact with the Internet, but it has not worked. Considering under-age use of alcohol or driving, we have education and awareness, but we also have legal statutory instruments that work in tandem with that education and awareness.

I apologise again for missing part of the meeting.

That is okay. I thank the Senator for his questions and the panel for the responses.

I have a couple of points to wrap up this discussion. Thinking back on what happened at the previous two meetings, last week we were treated to Twitter and Facebook rules and community standards. A number of us instanced cases to which we had been personally exposed and there was an acknowledgement that the community standards were evolving. That is a word that was employed here earlier with respect to sites generally. They are not fit for purpose. That is where we are.

We do not want to replicate earlier addresses, but we are seeking to point to functional, effective regulation, with real enforceability. How can we do this if it is not through legislation? We are, first and foremost, legislators, something that is often overlooked. It is our primary function in being here. We are the lawmakers and tge legislators have failed to grapple with this issue in all the years indicated by Dr. Aiken. The delegates have touched on this issue in responses to my colleagues, but is the objective of functional, effective regulation, with real enforceability, achievable if the platforms on the Internet are to continue to do the wonderful work they do? They provide a service and access, as I was at pains to point out last week with the service providers. We are honing in on harmful communications and inappropriate utilisation of the services, but it is a small part of the whole. As it is the core of our address, quite obviously it comes to the fore. Is it within our gift to point to regulation that does not have statutory and legislative support?

Dr. Mary Aiken

The problem in dealing with most social justice issues is that we cannot look at the problem space, with due respect to my learned legal colleagues, through the myopic lens of a single discipline. Looking at a legal solution alone will not work. Mr. Lupton spoke about good practice and conduct, but there is also an ethical and moral dimension in speaking about these very large social technology industries. It is a question of fundamental design that must asked. Are they now big enough to fail or not be able to self-regulate in a way?

Let us take a sociological construct. The social media and social technology companies have been designed on the premise that greed is good and that more is better; therefore, the more connections a child has, the better. It could be 1,000 or 2,000 across multiple platforms. In the social sciences we have Dunbar's number.

It is a number that dictates the number of relationships we as humans can maintain and sustain before we begin to suffer from social stress and exhaustion, which can lead to some of those negative behaviours. That number is 150, which is about the size of someone's Christmas card list or the number of people someone asks to one's wedding. The question we could ask is whether we should look at structures whereby we recommend a cap on the number of connections for teens and young people who are going through developmental periods so that they do not get to that point of social stress and exhaustion where other negative behaviours can come into play. The way that we can bring about these solutions is by taking a much broader view at governmental level, involving various Departments, to craft and architect solutions that recognise, in effect, that we are not just talking about points of law. We are talking about children, humans and the impact on the individual and society.

In response to Senator Conway, these problems are uniform worldwide and, collectively, we need to come together in a transdisciplinary way to look at solutions.

Before I move on to Mr. Lupton and Dr. McIntyre, I wish to ask a straight question. Does Dr. Aiken think we can achieve our objective without addressing either existing legislation or introducing new legislation? I take it from her answer that she thinks we can.

Dr. Mary Aiken

Absolutely, in tandem with other measures.

Okay. I just wanted to clarify that for the record.

Mr. Ronan Lupton

I wish to make a couple of points. The first is that the law is going to shift in any event in terms of the e-commerce package. The committee may need to do very little other than to lay a statutory instrument before the House in the usual way for secondary legislation to come through.

The second point is in response to the question on whether we can achieve our ends without legislating. I think the answer is "No". Part 3 of my witness statement deals with a number of civil and criminal statutes that are out of date and they need to be overhauled in terms of language, offences and remedies such as civil applications and sanctions. Unfortunately, there is no avoiding that job of work. In response to the Chairman's question, we do not need to use a sledgehammer to crack a nut, but, to take up Dr. McIntyre's earlier point, if the law that is on the Statute Book was enforced and resources were given to the agents of the State to do what they do so well, but with additional learning and resources, we might be better as a society if we just deployed what is there. There is that conundrum between upgrading and updating and then enforcing what is on the Statute Book and enabling the Garda.

There has been a sea change in the Garda force since the new Commissioner came in, and there is a new impetus in respect of education and training. It will be good to see gardaí who do the beat on the street also able to grapple with these issues on the doorsteps. I am sorry for harping back to the LRC report and the ICGAG report, but there is a space for the State to intervene to provide a one-stop shop by means of civil recourse. It will never be criminal recourse, but it may assist funnelling to State agencies to deal with criminal sanctions in the form of a digital safety commissioner or a national Internet safety advisory group, an actual body set up on a statutory basis with a commissioner or set of commissioners that could then bring in codes of conduct or we could have a legislative basis for codes of conduct to bring the platforms to the table and say: "Your community standards do not work lads. We need to fix them." I am sorry for being colloquial in my expression. That is how we could go.

The Chairman's question is a very good one. We could enforce the current laws, let the legislators work on updating those laws insofar as they are not incompatible with the European frameworks. Going back to Senator Conway's question, the Oireachtas can work as hard as it can, centrally, to make sure that the package that comes forward on the e-commerce side suits and is fit for purpose, without interfering with the good parts of the Internet. I know that is a problem. There are good parts. I hope, then, we will have societal change. Unfortunately, legislation takes time and that is the reality of it. That is my position.

It is qualifying it.

Mr. Ronan Lupton

Yes.

Dr. Mary Aiken

I wish to go on the record to respectfully disabuse the committee of the notion that, following on from Mr. Lupton's point, that it may need to do very little. I disagree with that. The committee needs to act urgently. Harm is being done. Children are being affected. The idea of doing very little is totally unacceptable. I do not want to be part of a process that provides the Government with an alibi for doing nothing while harm is being done.

Mr. Ronan Lupton

My point was in direct response to the legislative question. If the law currently on the Statute Book is deployed and the enforcement of those laws is resourced properly, few reforms, perhaps, are required. I am not suggesting for a second that there are not harms and abuses at present. I am on the same page as Dr. Aiken in that regard. I am not suggesting for a second that we do little, because there are clear issues. That is why the committee is discussing the matter.

We all have responsibilities to ensure that harm is not done to people. It is not just the Internet. There is a raft of other laws on which I would like to see more implementation in this country.

Mr. Ronan Lupton

Yes, exactly.

Before I go to Dr. McIntyre, it is almost a one-all draw. He will have the opportunity to decide. We did not embark on this to end up not making an impact. I assure everyone that, although not all of the committee members are able to be present due to other competing pulls on their responsibilities in these Houses, it is important work for us.

Dr. Mary Aiken

I am very reassured to hear that.

We will make an international impact.

Many of us, in talking to each other, are personally knowledgeable of or exposed to people who have been grievously harmed.

Dr. T.J. McIntyre

The answer to the Chairman's question depends on what type of content we are looking at, and, broadly, there are three in this area. One is content, which amounts to a criminal offence at the moment, and we know the answer to that is some reform of the criminal law, greater resources for the enforcement of the criminal law and greater work on the international co-operation and investigation elements.

The second is the area of civil harms in the form of, for example, defamation and invasion of privacy. We again have a consensus that the answer to that is to a large extent going to be greater enforcement by technology firms of the law when abuses are brought to their attention and ensuring greater access to justice by individuals who, for example, are defamed, although we have no consensus how that might be done in a cost-effective way.

The third area is wider. It is probably one that is at the heart of a lot of this discussion, although perhaps it has been unspoken throughout today's proceedings, that is, the question of content that is not in any in breach of the law but is simply toxic, nasty and unpleasant. The answer to that to a large extent is not to deploy the law. There is a problem in that, speaking as a lawyer and in the context of the legislative process, when one's only tool is a hammer, then every problem looks like a nail and it comes naturally to think about legislative solutions. To a large extent, the answer to dealing with unpleasant environments in the online space will be to address what encourages them to persist. Technology firms predominantly operate on the basis of a profit motive and as long as they allow content on their sites that is unpleasant and they profit from engagement with that, they will continue to do it. The technology industry for the most part is funded through advertising and very often a solution will be for individuals to approach advertisers and say they do not want to use their product or to be associated with them if they are going to continue to prop up that unpleasant environment. That has been very effective in the United Kingdom in the context of the tabloids where a lot of the very unpleasant elements of tabloid culture, for example, some of the casual racism and the abuse of privacy of individuals - elements which are largely without legal sanction - have been toned down by boycotts of advertisers where people have said, "Enough is enough", and they do not want to support that unpleasantness in The Sun, for example, anymore and until it stops they will boycott advertisers who deal with them.

I thank Dr. McIntyre. I was reminded when listening to his reply of something Dr. Aiken said in her opening address in terms of the harm done, namely, that the impact was not virtual. She made the point very well.

Dr. Mary Aiken

I said "exclusively virtual".

The harm done is real harm to real people. That is the drive behind our address of this issue.

It only remains for me to thank the witnesses. We have moved to knowing them by their first names and I hope that is okay. I thank Dr. Mary Aiken, Mr. Ronan Lupton and Mr. T.J. McIntyre, not only for their written addresses but also the very thoughtful replies they have given to each of the members able to attend today.
We will conclude our hearings next week when we have the last of our team of people coming before us. We will have representatives of the Irish Council for Civil Liberties, the National Anti-Bullying Research and Resource Centre, Women's Aid and SpunOut. I thank people outside who have made written submissions to the process. We hope to conclude a report with recommendations that we will launch if we are still here, as there is some uncertainty as to our future in these Houses. I thank the witnesses again for their contributions. I invite any members following this on their screens to join us for a group photograph with our panellists, which we have taken in each of our session hearings.
The joint committee adjourned at 11.25 a.m. until 9 a.m. on Wednesday, 23 October 2019.