Ofcom appears to be facing a major enforcement challenge. Despite issuing £3 million in fines under the Cyber ​​Security Act, the regulator received just £55,000.
With controversial platforms such as 4chan now mocking financial threats, Ofcom is moving towards its “last resort.” If implemented, these measures could test the UK’s ability to regulate the internet.
The Internet Safety Act forces Ofcom to follow a strict statutory escalation process. If a website ignores maintenance demands – such as failing to put in place age verification measures – the administrator can issue progressively stiffer penalties.
The article continues below
If those fail to achieve compliance, Ofcom is left with its own business disruption measures (BDM). This allows the administrator to order payment providers and advertisers to withdraw services, or force Internet Service Providers (ISPs) to block the site entirely through an Access Request Order (ARO).
So far, Ofcom has avoided these measures, with a spokesperson admitting that their use would represent a “significant regulatory intervention.” However, even if they are introduced, their impact may not be as direct as the administrator hopes.
BDM is a complex business
Ofcom must protect the court to impose business interruption measures that introduce uncertainty.
Fred Allen, Senior Partner at Kingsley Napley, told TechRadar that the courts are likely to take a closer look at whether the block is really necessary or if a “flawless measure” would achieve the same goal.
He added that although the courts will “give the idea of ​​a professional administrator” they will “carefully consider measures that threaten rights and freedoms.”
There is also the matter of commerce. Under the Internet Security Act, targeted businesses — including ISPs, advertisers, and payment platforms — can appeal the decision.
While it seems unlikely that a national broadband provider will head to court to protect people’s right to access a controversial site like 4chan, the potential for lengthy legal battles and rising costs may explain why Ofcom has been more reluctant to impose financial penalties. However, there are other constraints that Ofcom must consider.
The reality of website blocks
Trying to block websites can also cause headaches for the administrator. Websites often rely on shared infrastructure and malicious blocking may affect sites and services they don’t cover.
Italy’s latest “Piracy Shield” initiative serves as a warning. Designed to block illegal sports broadcasts in real time, the system accidentally brought down official services for hours.
Because a single IP address can be associated with hundreds of innocent websites, and shared Content Delivery Networks (CDNs) means that many services share the same infrastructure, isolating one site without affecting others requires more advanced blocking techniques such as deep packet inspection (DPI).
The adoption of VPNs may also undermine any website blocks in use. Andrew Kernahan, Head of Public Affairs at the Internet Service Providers’ Association (ISPA), stressed that blocking a website should be a “last resort” for an administrator and should not be a “silver bullet.”
He also told TechRadar that although “the use of VPNs and encrypted traffic can undermine their effectiveness, not all users are aware of VPNs.”
However, following website blocks, Ofcom and the Department for Science, Innovation and Technology (DSIT) may face a difficult choice. Rather than being primarily concerned with VPN use among children – as is currently the case – the regulator will need to consider the impact of VPN use by adults.
Ofcom insists that “if there is a continuing breach of security duties and if it is reasonable and proportionate to prevent serious harm to the people of the UK, Ofcom can apply to the court for an order to restrict or prevent access to the website.”
A spokesman for the regulator added that it would “not hesitate” to use the powers, although it was acknowledged that it would be important “because of the impact it has on the availability of online services and information for people in the UK.”
Regarding the low recovery of fines, the regulator is willing to emphasize that most of the deadlines for receiving the funds have not passed and he expects more to be received.
What’s next for the Cybersecurity Act?
Ultimately, the next phase of Law enforcement is likely to be as difficult as those that have gone before it. If the regulator ramps up its use and its “last resort” still reaches technical limits, it could force a dramatic rethink of how the UK handles VPN access and encrypted traffic. With that, digital privacy and access to information can be compromised.
Meanwhile, Preston Byrne – the lawyer representing 4chan – is unfazed by the mounting penalties. Last week, the platform responded to a new £520,000 notice by sending Ofcom an AI-generated image of a giant hamster.
In an email to TechRadar, Byrne made his position clear: “If Ofcom wants to censor British citizens, they have that power,” adding that “my client’s only regulator here is the First Amendment.”
“Ofcom data suggests that around 1.4 million UK users a month access 4chan’s American servers every month. The UK free speech movement could use 1.4 million new activists, especially if those activists are 4chan users,” he said.
