Once the “good politician” has successfully forced risk metrics to remain high-level, the corporate apparatus requires a mechanism to formalise the deception. It is not enough to simply avoid the flashlight; the executive suite must construct an elaborate, defensible paper trail that simulates rigorous oversight while achieving absolute operational stagnation.

This is the birth of the weaponised paper trail the structural transformation of corporate governance from a system of protection into an administrative shield for leadership.

In a functional enterprise, governance pathways steering committees, risk registers, and audit reviews exist to expose vulnerabilities, allocate capital, and enforce remediation. But when an organisation develops a truth tolerance problem, these pathways are quietly re-engineered. They cease to be operational forums and become legalistic insurance policies.

The process begins with the deliberate inflation of administrative noise. Because executives cannot be seen to be ignoring risk, the system responds by generating vast quantities of low-value, unevidenced compliance data. Governance agendas are flooded with hundreds of pages of high-level policy frameworks, maturity self-assessments, and procedural checklists. This is not an accidental byproduct of bureaucracy; it is a calculated strategy of risk suppression.

By burying critical, material exposures under a mountain of trivial administrative tasks, the corporate machine ensures that systemic failures are structurally impossible to spot. When everything is reported as a priority, nothing receives genuine executive focus.

If an urgent escalation manages to cut through the noise and land directly in an executive inbox, the weaponised paper trail activates its primary defence: the administrative response. The goal of this response is never to evaluate or remediate the actual exposure; the goal is to close the file while keeping executive hands clean.

The risk is acknowledged with polite, structured stalling tactics. It is deferred to a future sub-committee, sent back to the technical team with requests for “further clarification”, or quietly filed away with a letter thanking the sender for their correspondence. A tracking number is generated, a ticket is marked as updated, and the escalation is administratively resolved.

On paper, the process was followed impeccably. In reality, the unmitigated risk continues to float in the electronic ether, completely untouched.

This creates the ultimate corporate paradox: a paper trail of absolute negligence.

The executive suite can stand before auditors, board members, and stakeholders to point at mountains of meeting minutes, policy sign-offs, and administrative logs as proof of due diligence. They have built an environment where they are permanently proximate to the conversation, yet entirely insulated from the accountability.

But a paper trail cannot patch an unsegmented network, and an administrative brush-off cannot prevent a systemic operational failure. The illusion of governance functions flawlessly right up until the moment it collides with reality. And when the system inevitably breaks, the paper trail is weaponised one final time not to explain why the failure occurred, but to prove that executive leadership gave all the right orders, leaving the technical team to take the fall.

Coming Next: Chapter 4

In the next chapter, I will be looking at The M&A Blind Spot (Unbounded Integration Risk). We will examine how aggressive corporate growth and deal-making completely bypass digital due diligence, leaving enterprises inheriting catastrophic financial and operational liabilities behind a wall of optimistic synergy targets.

About the Author

Naveen Vasudeva is a veteran security executive with over 30 years of operational experience managing systemic, material risk across multi-billion pound global enterprises. His writing integrates technical control analysis with behavioural risk intelligence, stripping away the corporate theatre of the C-suite to expose the unvarnished reality of institutional risk governance and corporate accountability.

Read the full series and join the conversation at naveenvasudeva.com.

You can read a government before it governs. Not from its promises, which are written to be liked, but from its conduct, which is written for no one.

Behavioural risk intelligence rests on a single premise: serious harm is rarely a sudden event. It is cumulative, and it shows upstream, in patterns of behaviour, long before it becomes a headline. The work is to read the pattern early, while it can still be changed.

So read Andy Burnham’s first week as data, not theatre. Not as a charge sheet. The office he takes on Monday is one of the hardest anyone can hold, and no one who has ever held it got everything right. This is written in that spirit: not to mark him down, but to name early the one thing that is easiest to miss and hardest to undo. On Monday he walks into Downing Street1 on a promise to take back control of the essentials.

Housing. Water. Energy. Transport. Within days of making that promise, his officials were reportedly asked to draw up plans to abolish the department that holds Britain’s technology. The coverage treated that as a Whitehall turf row, a reorganisation, a waste of six months.

Almost no one read it as what it is: a signal about how this government values control of the one layer every essential now runs on.

What the speech tells you, and what it leaves out

Burnham built his first speech as leader around five distinct pillars2 Read for structure rather than applause and they resolve cleanly:

1. Build one Labour team and end the factionalism.

2. Build a new politics of problem-solving rather than point-scoring.

3. Set a distinctively Labour direction.

4. Govern for all places, not only the North.

5. Take power back from Westminster and Whitehall and give it to the place where you live.

Four of the five are method: discipline, tone, identity, reach, and the mechanism of devolution. Only the third carries a programme. His diagnosis is that Britain took a wrong turn in the 1980s, handed the essentials to private hands, and left the public exposed to rising costs. His remedy is public control over the cost of those essentials, delivered downward through city regions rather than outward from Whitehall.

On its own terms this is coherent, and I say that as someone who has spent thirty years assessing where organisations and systems fail.

Affordability is the right spine. Devolution is a credible mechanism, and Burnham has the only real evidence in British politics that it can produce visible change, because he produced some of it in Manchester. His first two pillars, unity and a calmer politics, are simply the two most common ways incoming governments destroy themselves, turned into promises not to. That is a government that has read its own failure modes.

Now read the speech for what is absent, because in behavioural terms an omission under pressure is itself a signal. Search it for a single word.

It is not there. Nor is compute, cloud, artificial intelligence, or sovereignty. In a mission built entirely on control of the essentials, the one set of essentials he never names is the digital infrastructure the others run on. That is signal one.

The conduct behind the words

The speech was silent. The days since have not been, and that is what makes signal two firmer than signal one, not weaker. Every move Burnham has made in the digital domain since Friday points the same way, and every one of them is subtractive. He is not ignoring technology. He is engaging it only to cut it.

Start with the department. Over the weekend the Guardian reported that Burnham has asked officials to work up plans to abolish the Department for Science, Innovation and Technology, folding much of its work into a larger business department, and to hand oversight of artificial intelligence in the public sector to the cabinet secretary rather than a minister.

The plan is not signed off, and he may still change it. But the direction is the data.

A leader whose entire pitch is pushing power towards the public and their elected representatives is reported to be routing the most consequential capability of the century to an unelected official, and reclassifying the department that holds it as an input to industrial policy. The department of the future, as one of his own MPs put it, is the one he is thinking of removing from the table3

Then the first policy pledge itself. Burnham’s opening move as Prime Minister, trailed for Monday, is to scrap the government-issued digital ID scheme for all British adults, and to redirect the resources towards the cost of living4 Set the three acts side by side: abolish the department, scrap the scheme, redirect the money.

Watch what he reaches for in the same breath. Alongside the ID decision he is expected to move on new oil and gas from the North Sea. Energy sovereignty you can drill for, he understands instinctively. He grasps sovereignty in atoms and misses it in bits. The barrel of oil is national power; the cloud the state runs on stays rented, by the month, from firms in another country, and that does not register as the same kind of dependency at all.

And notice the one moment technology does enter his politics. It enters as privacy. The case for scrapping digital ID is made in the language of protecting people from a state that holds too much of their data, of over-reach into everyday lives. That is the retail register of the word sovereignty, the people against the database. The strategic register, who owns the compute, the models and the systems the nation depends on, is exactly the one that stays missing. When data finally surfaces in his government, it is data as a thing to be kept off people, never data as a thing to be owned by the country.

Who is at the table

Signal three is the hardest to see and the most important, because it is about who gets to tell him he is wrong.

There is a discipline that separates good intelligence from comfortable advice, and it is uncomfortable by design. The counsel you most need is rarely the counsel that agrees with you. It comes from people positioned to see what you cannot, and often from people you would not have chosen as allies. Political operations are built to do the opposite. They exist to reduce friction, protect the principal and hold the line.

Burnham’s very first pillar, one team and an end to factionalism, is a commitment to exactly that cohesion. It is wise politics. Read coldly, it is also a centre engineered against internal challenge, at the precise moment he is making a call on a domain where he has shown no instinct of his own.

So as he assembles his top team this weekend, one question matters more than the identity of any single secretary of state. Who at that table is qualified to talk to him about technology, and positioned to disagree with him about it?

On the names circulating so far, the answer is drawn from politics and Whitehall, not from technology.

If his inner circle is composed entirely of political operators, however able, then the most important structural decision of the coming decade will be taken in a room where no one is equipped to challenge it. That is not a technology problem. It is a governance problem, and it belongs to the country, not only to him.

Why this is the story

These three signals matter together, and not as a technology argument. As a control argument, which is the ground Burnham has chosen to fight on.

You cannot take back control of energy if the systems that price it, balance it and trade it are foreign-owned and foreign-operated. You cannot take back control of water, or transport, or the delivery of housing, if the data and software that run them sit on infrastructure the country neither owns nor governs. Control that stops at the software layer is not control. It is the appearance of control, rented by the month from someone else.

The same logic breaks his fifth pillar. Devolving power to a city region that runs on cloud it does not own, platforms it cannot govern and models it cannot see inside is not a transfer of power. It is a transfer of cost. Real devolution requires that the thing being devolved is controllable at the level you devolve it to, and much of the digital layer is not.

And the dependency is already being built. Britain’s AI infrastructure is going up on the back of American firms, Microsoft, Google, Nvidia, OpenAI5 and serious analysts have called it a premature trade of the country’s sovereignty for scale6 The vehicle for much of it, the US-UK Tech Prosperity Deal signed in September 2025, is itself the warning: when Washington paused the pact last winter to force concessions on tax and regulation7 Britain learned how quickly a dependency becomes a lever.

Yvette Cooper, one of the party’s most senior figures, recently called artificial intelligence the biggest foreign-policy question of the coming years. The country’s own senior figures are naming technology as a question of national power. The machinery built to answer it is the machinery reportedly being stood down.

The reframe

The mistake, if it is made, will come from treating technology as a sector. Sectors compete for attention and money, and inside a giant business department technology competes with steel and loses. But sovereignty over the digital layer is not a sector. It is the foundation the other pillars stand on.

Reframed correctly, it is not a rival to Burnham’s mission. It is the precondition for it. Sovereign control over data, compute and the systems the essentials run on is what makes public control of the essentials real rather than rhetorical, and what turns devolution into a transfer of power rather than a transfer of cost. It belongs at the base of the five pillars, not outside them. Call it the sixth pillar, the one that holds up the other five.

The decision point

An assessment that cannot be proved wrong is not intelligence. So here is the interpretation, committed before the event rather than after it. One thing is already fixed: his first move on the digital state was to cut it, not to build it. What is still open is whether anything in the days ahead offsets that, and the answer will resolve into one of three branches, each carrying a different reading.

Branch one: he dismantles the department and hands oversight of public-sector AI to an official rather than a minister. The signal is not merely that technology has been downgraded. It is that the capability his current foreign secretary calls the defining question of national power has been placed beyond democratic accountability and reclassified as an input to industrial policy.

For a leader whose whole pitch is pushing power towards the public and their representatives, routing the most important lever of the century to an unelected official is the tell. And the generous reading collapses into the same place: even if the intent is to make technology serve place-based growth, that is still treating sovereignty as a means to jobs, which is precisely how a country gives it away.

Branch two: he leaves the department standing but still says nothing about who controls the systems the essentials run on. This is the sharper signal, and in one respect the worse one. It tells you the gap is not in the wiring but in the idea. A department can be rebuilt in a reshuffle. A missing concept cannot be reorganised into existence. On this reading, keeping the department is the more revealing outcome, not the reassuring one.

Branch three: a single line, in the cost-of-living package or the machinery announcements, connects control of energy, water, transport or housing to control of the data and infrastructure beneath them. Then he has seen it, this assessment is wrong, and the sixth pillar is already being laid. Naming this outcome is what makes the other two credible.

Notice what the three branches do together. A weekend reversal cannot embarrass this reading, because every outcome is already interpreted. “He kept the department” is not a hole in the argument. It is branch two, and you already know what branch two means.

What this is really about

Return to where behavioural intelligence starts. The harm here is not an event that lands on Monday. There will be no crisis, no headline, nothing to attribute. It is cumulative, and it accrues quietly: in dependency deepened, in a capability administered rather than owned, in a decision taken by a room with no one in it equipped to question it. That is precisely the kind of harm that is only ever obvious in hindsight, by which point it is structural.

Burnham has named the right goal. He wants a country where the essentials work and where power sits closer to the people who depend on them. He is more right about that than his critics allow. But he has named the goal and missed the dependency. And his early conduct is no longer silence about the digital state; it is retrenchment. He is dismantling it, piece by piece, and calling that a saving. A department a country can rebuild in a reshuffle. The habit of mind that treats a nation’s digital foundation as a cost to be cut is far harder to reverse.

The signal is already on the table. On Monday we learn whether anyone at his table has read it.

Sources and notes

I once watched an executive study a risk heat map for a full thirty seconds before delivering his verdict. He did not challenge a single finding. He did not question the evidence. He simply asked whether we could “soften the reds” before it went to the board. Three quarters later, the same committee was still requesting “less detail.” The findings never changed. Only the colour palette did.

That is what suppression looks like in a modern enterprise. Not conflict. Choreography.

The immediate aftermath of a cancelled briefing or a shelved steering committee is rarely marked by overt confrontation. There are no dramatic scenes in the corridor, no heated emails, and no explicit orders to bury the data. Instead, there is a polite, suffocating silence. The system simply closes ranks, reverts to its comfortable equilibrium, and relies on the practised theatre of executive leadership.

When a major new initiative is announced on the internal stage, whether it is an enterprise-wide digital transformation or an aggressive global M&A integration, the executive suite reacts with predictable, rehearsed enthusiasm. They nod sagely in town halls. They stand on stage at industry forums and champion the grand vision. They act, in every measurable sense, like good politicians.

But wanting a capability and being able to build it are two entirely different things.

The fundamental mistake made by idealistic risk professionals is treating the C-suite as a unified body working toward a singular enterprise goal. It is not. A modern executive team is a collection of distinct, highly protective fiefdoms. Every leader has a specific budget to defend, immediate operational metrics to hit, and a personal reputation to insulate from failure.

When you introduce real, evidence-backed risk analysis into this environment, you are not just presenting a technical report. You are shining a blinding flashlight into the dark corners of these individual fiefdoms.

The flashlight effect is the exact moment an executive realises that objective truth threatens their operational comfort. It is the moment they look at the data and see that their legacy tech debt, their unverified internal controls, or their flat manufacturing networks are now visible to the rest of the organisation.

Suddenly, the public political posture of unyielding support vanishes behind closed doors. It is replaced by a sophisticated, unspoken strategy of risk suppression.

Executives do not push back against real risk metrics because they fail to comprehend them; they push back because they understand the personal liability completely. To acknowledge a critical vulnerability means accepting ownership of a ticking time bomb. If they ignore it once it is on a formal log, they are exposed to accusations of negligence. If they fund a fix, it slows down their delivery timeline, eats into their quarterly budget, and jeopardises their short-term performance loop.

Faced with this equation, the corporate politician changes the game. They do not argue with the data directly. That would look unsupportive. Instead, they attack the mechanism of delivery, and they do it in a vocabulary every risk professional will recognise.

The unvarnished exposure is labelled “alarmist.” The level of detail is “too granular” or “too direct.” You are advised to keep things high-level and focus on the basics. You are told the findings need to be “socialised” before they can be tabled. You need to “get buy-in” first. Perhaps this is better “taken offline.” There is concern about “alignment.” Each phrase sounds like process. Each phrase is a delay mechanism. None of them engages with a single data point, because engaging with the data would mean owning it.

This is the polite, corporate sabotage of accountability. By forcing metrics to stay superficial, the executive suite ensures that no individual fiefdom is ever truly exposed. It allows them to maintain the public narrative of progress while ensuring that if the system eventually breaks, the liability can be neatly pushed down the chain to the technical team. They protect the illusion, because the illusion protects them.

Coming Next: Chapter 3

In the next chapter, I will be looking at The Weaponised Paper Trail (The Illusion of Governance). We will strip back the corporate machine to expose how systems are engineered to spend months generating tracking numbers, distributing administrative brush-offs, and closing files, all to ensure leaders stay close to the conversation, but entirely insulated from the consequences.

About the Author

Naveen Vasudeva is a veteran security executive with over 30 years of operational experience managing systemic, material risk across multi-billion pound global enterprises. His writing integrates technical control analysis with behavioural risk intelligence, stripping away the corporate theatre of the C-suite to expose the unvarnished reality of institutional risk governance and corporate accountability.

Read the full series and join the conversation at naveenvasudeva.com.

Yet the cancellation notice arrived with no offer to reschedule, no request for a summarised brief, and absolute silence from the executive suite.

In that single, quiet moment of corporate avoidance, a fundamental truth of thirty years in this industry became unavoidable: the executive suite does not have a cybersecurity translation problem; they have a truth tolerance problem.

Meaningless vanity metrics are not an accidental by-product of a complex industry they are a political necessity designed to protect executive fiefdoms and preserve a paper trail of plausible deniability until the inevitable breach allows them to simply blame the IT guy.

For decades, the prevailing narrative in the security industry has been one of patronising pity towards business leaders. “We just aren’t speaking the language of the business,” the pundits say. “We need to translate bits and bytes into pounds and pence.”

This is a profound misunderstanding of the corporate dynamic. It assumes that executives are well-meaning, technically overwhelmed individuals who are desperately craving the truth if only it could be delivered in a prettier spreadsheet.

It completely ignores the structural reality of how a corporate hierarchy functions. Executives do not need cybersecurity translated for them. They understand perfectly well that if a core enterprise resource planning (ERP) system has unverified controls, or if a manufacturing facility can be laterally traversed by a simulated threat actor without a single alarm going off, the business is exposed.

The issue is not comprehension; it is the fact that real, objective risk metrics disrupt the carefully curated equilibrium of the C-suite.

In a listed environment, the executive team operates under a crushing, short-term performance loop. Every decision is weighed against quarterly revenue, operational speed, and market perception. When a security leader brings hard, evidence-backed exposure to the table, they are not just presenting a risk profile they are presenting a financial and operational debt that must be paid.

To acknowledge that risk means someone must allocate capital away from a growth initiative to fix a foundational vulnerability. It means someone must slow down an M&A integration timeline to perform due diligence. It means an executive must look at their own domain, accept a substantial liability, and sign their name to it.

Faced with the choice between an uncomfortable, expensive reality and a comfortable, unevidenced dashboard, the system will choose the dashboard every single time.

This creates a systemic demand for noise over signal. The industry responds by feeding risk owners exactly what they want: tick-box compliance, high-level maturity scores based on self-assessment rather than evidence, and charts that track security activity instead of actual enterprise resilience. It is an unspoken pact.

The security team delivers a green dashboard that protects the executive from discomfort, and in return, the executive provides a public, political display of “support” for the security programme.

But when the normal governance pathways are deactivated when steering committees are quietly shelved for months at a time and critical escalations sit unacknowledged in inboxes the entire apparatus transforms into an illusion.

That is the estimated annual revenue from online child sexual exploitation, according to the University of Edinburgh’s Childlight initiative.

Not stolen funds. Not laundered crypto. Revenue. Moving through payment systems, clearing through banks, sitting in accounts at institutions most of us use every day.

That money does not disappear. It becomes infrastructure.

Now hold that figure alongside these.

300 million children a year are victims of online sexual exploitation and abuse. One in eight of the world’s children. Not in their lifetimes. This year.

63 million files reported to global authorities in 2024. Images and videos of documented child abuse.

37,000 recorded crimes in the UK alone last year. 100 every day. Four every hour. One every fifteen minutes.

1,894 children in the UK used a single confidential service to report sexual images of themselves. A 66% increase on the year before. More than a third were being blackmailed. The majority were boys aged 14 to 17.

Those are the children who found the service. Who knew it existed. Who had the courage to use it.

The financial system processing $172 billion in exploitation revenue was not built to see any of this. In most cases, it is not looking.

Proximity without accountability is not neutrality. It is complicity by another name.

I recorded a short video on this. It is attached above.

The debate that followed became one of the most divisive political arguments in modern British history. Economists argued over growth, politicians over sovereignty, campaigners over immigration, and commentators over whether the entire project was a historic triumph or a catastrophic mistake.

A decade later, those exact same arguments continue. We are still asking the wrong questions. The most critical question is not whether Brexit was right or wrong. It is whether Brexit was a profound behavioural signal a warning that something much larger was already shifting beneath the surface of British society. A signal we have still failed to interpret.

The Concept of a Visibility Event

Viewed through a Behavioural Risk Intelligence lens, Brexit looks less like an isolated political event and more like a visibility event.

In risk analysis, a visibility event is the moment an accumulating, unaddressed risk finally forces itself into the open. It is not the cause of a crisis — it is the point at which a crisis becomes impossible to ignore.

The warning signs had been flashing for years before 2016:

• Trust in core institutions was in measurable, steady decline.

• Economic gains were increasingly perceived as concentrated — and unevenly distributed.

• National identity had become deeply contested.

• Communities feeling culturally, economically, or politically disconnected were growing louder.

The signals were visible. The trajectory was simply misread.

Before the vote, the political establishment believed the existing settlement remained broadly stable. The electorate disagreed. Behavioural Risk Intelligence is fundamentally concerned with understanding how risk forms before it manifests. Brexit demonstrated what happens when those underlying conditions are allowed to accumulate without ever being properly read.

The Ten-Year Report Card

If we issued an honest report card on where Britain stands today against what was promised, the marks are stark.

Have we become a wealthier country? No. Have we become a more united country? No. Have we built a more efficient state? No.

Instead, the nation has settled into a state of systemic paralysis. We have become a country that talks endlessly about its problems rather than solving them regurgitating the same arguments, watching the gap between institutional promise and lived reality widen, and observing the fracture lines deepen.

When an expectation gap opens this wide, public opinion does not simply sour. It poisons. It divides the country into distinct, hostile camps. And then it causes those camps to fracture internally into increasingly radical sub-categories of grievance.

The Russian Doll of Fractured Politics

The traditional two-party system is buckling. The political landscape has not just fragmented; it has shattered into nested layers of disillusionment.

Look at the right. It is no longer a monolith. It has become a Russian doll of escalating nativism: the Conservatives flanked by Reform UK, who are now themselves being flanked by the harder anti-establishment position of Restore Britain. Each sub-faction accuses the previous of being too soft, too institutional, too slow.

The left and centre are under their own version of this pressure. Voters dissatisfied with the mainstream are dispersing towards the Greens and the Liberal Democrats.

The potential composition of any future Parliament may look less like a decisive mandate and more like a fragile patchwork trying to govern a fundamentally fractured nation.

Signals and Structures Are Not the Same Thing

Can Behavioural Risk Intelligence predict the precise outcome of the next election? No. No serious analytical framework should claim that kind of certainty. What it can do is assess trajectories.

The strongest observable trajectory today is continued fragmentation rather than consolidation. But behavioural signals do not automatically translate into institutional outcomes because signals and structures are not the same thing.

Under the UK’s First-Past-The-Post system, fragmented support produces dramatically fewer seats than equivalent support concentrated within a single party. Winning public attention is not the same as winning constituencies. Winning constituencies is not the same as winning a government.

This creates a structural dam. It is entirely possible for alternative parties to command substantial combined vote shares whilst remaining electorally inefficient. The system suppresses the outcome but it does nothing to release the pressure building behind it.

The Disappearance of the Centre

Whilst the fringes fracture and mutate, the pragmatic centre has effectively disappeared. Delivery-focused, problem-solving politics has been swallowed by the noise.

Strip away the ideological tribalism, and the vast majority of the public wants the same fundamental things: life to be affordable; dependable access to healthcare and education; opportunity for their communities; safety for their children.

To deliver those things, a country has to build. To build, you need growth. But you cannot generate growth when you spend a decade relitigating the same argument about who was right and who was wrong.

The tragedy of the post-Brexit decade is not simply the division. It is the catastrophic opportunity cost. Whilst the political class wages internal warfare, the basic machinery of the state rusts. The system is so consumed by reacting to the latest behavioural tremor that it has lost the capacity to solve basic problems.

There Is No Clean Ending

We are not waiting for a resolution, because there is no clean ending to find. We are on a hamster wheel because the political establishment is attempting to solve 21st-century problems with a 20th-century playbook.

Look at how the nation talks to itself. Decades on, our primary reference point for British resilience remains the Second World War. There are timeless lessons to be drawn from that generation but an obsession with an era that concluded over eighty years ago has limited applicability to a modern, technology-enabled society.

If Brexit was about reclaiming sovereignty, we have to look honestly at the ledger. Where are the transformative trade deals? Where is the global expansion? Where is our standing on the world stage? None of it has materialised because our definition of sovereignty is obsolete.

True sovereignty in the 21st century is not about borders or fishing rights. It is about technological autonomy.

Britain has virtually no data sovereignty and no meaningful technological independence. We are entirely dependent on foreign digital infrastructure. When superpowers or private technology monopolies leverage control over foundational AI systems, the reality becomes impossible to ignore: you cannot claim genuine independence when your entire technological nervous system is leased from somewhere else.

Yet this reality is almost entirely absent from our political debates. Instead, we squabble over labels that have lost their modern meaning. “Capitalism.” “Social Democracy.” “Labour.” “Conservative.” What value do these 20th-century badges carry if they cannot unite a country around its most basic needs?

We do not need to invent a radical new language. But we are so attached to the old one that we cannot get out of our own way.

The real lesson of Behavioural Risk Intelligence is this: the greatest danger a system faces is rarely an external shock. It is cognitive obsolescence the failure to read the signals of a changing world until it is too late to respond to them.

Those signals are everywhere right now. In our fractured politics. In our economic stagnation. In our technological vulnerability.

The question is whether we are finally ready to interpret them.

The Exchange

A British regulator wrote to an American company owned by a Japanese entrepreneur and informed it that British law applied.

The company’s response amounted, in substance, to a shrug. Ofcom issued enforcement action against 4chan under the Online Safety Act; 4chan disputed not the facts but the premise, questioning why a foreign regulator should hold any meaningful authority over a company that operates beyond its borders.

The fine itself is modest, almost incidental to the dispute it has exposed. What matters is the shape of the exchange.

A sovereign state, acting through Parliament and a statutory regulator, issued an instruction. A company many people will never use, indifferent to the instruction, declined to follow it. Stripped of legal language, the exchange reduces to two sentences: one side said, “you must comply”, and the other said, “make us”.

Authority and Enforcement

That is a more consequential sentence than it first appears, because it inverts an assumption that has underpinned state authority for centuries. Banks breach regulations and regulators intervene. Airlines ignore safety requirements and regulators intervene. The mechanism varies; the principle does not. Authority sits with the state because the instruments of enforcement, fines, licences, prosecutions, ultimately sit with the state too. A company that has no UK office, no UK employees and no UK assets has effectively removed itself from that machinery without needing to argue the point in court.

Beyond 4chan

This is where the 4chan dispute stops being a story about a fringe website and starts being a story about everything else. The geography of the case is unusually fragmented, but the underlying condition is not unusual at all. Most of the digital infrastructure through which contemporary British life now passes is owned elsewhere.

The operating systems in people’s pockets were designed in California. The platforms carrying political argument, family photographs and commerce are overwhelmingly foreign-owned. Cloud infrastructure underpinning swathes of the public and private sector sits with a small number of global firms, and the next generation of artificial intelligence systems looks set to arrive from outside Britain’s borders as well.

The country regulates these systems, depends on them, and owns almost none of them. Ownership confers leverage; dependency erodes it.

The 4chan case is simply the moment that trade-off became visible.

A Question of Category

It is tempting to treat this as a jurisdictional puzzle, solvable with better treaties or more assertive courts. But the more instructive reading treats it as a question of category.

A factory, a bank branch and a power station all exist somewhere, which is precisely why states have historically found it straightforward to regulate them: physical presence creates a point of leverage. Digital platforms exist, functionally, everywhere and nowhere simultaneously.

The regulatory frameworks built for an economy of fixed addresses are being applied to an economy that has none.

Some of these platforms have become so deeply embedded in communication, identity and commerce that they resemble infrastructure more than they resemble websites, without yet carrying any of the governance obligations that the word “infrastructure” usually implies.

Critical national infrastructure attracts oversight because its failure is catastrophic and visible.

The platforms in question fail more quietly, but at far greater scale, and the absence of an equivalent governance category is starting to look less like an oversight and more like a structural gap.

The Leverage Problem

Even granting that such a category should exist, enforcing it runs into a second problem: leverage is unevenly distributed, and not along lines that map neatly onto law. The United States can sanction foreign actors because access to its financial system is close to indispensable. The European Union can shape global corporate behaviour because access to its market is too large to forfeit.

The United Kingdom’s position is murkier.

A platform earning substantial revenue from British users has every commercial incentive to comply with British law. A platform with negligible exposure, as 4chan appears to have, has correspondingly little incentive to comply with anything.

Enforcement, in other words, is becoming a function of commercial dependency rather than legal principle, which is an uncomfortable conclusion for any state that still thinks of its laws as sovereign by default rather than sovereign by negotiation.

A Different Version of the Same Problem

There is a narrower version of this problem that has occupied much of my work over the past three years, and it sharpens rather than resolves the wider question. Regulatory and safety regimes have generally assumed a cooperative platform: one that will hand over data when asked, suspend an account when instructed, or at minimum answer the regulator’s letter.

The 4chan case illustrates what happens when that assumption fails, and the same failure occurs, for different reasons, inside encrypted messaging services and closed platforms that were never built to be inspected by anyone, regulator or otherwise.

The instinctive conclusion is that visibility disappears along with cooperation.

Behavioural patterns, the shape of escalating contact, coercion, grooming or distress, leave traces that are independent of whether the hosting company is willing to show them to you.

Content can be withheld. Behaviour is harder to hide completely.

That distinction will not solve the sovereignty problem Ofcom has run into, but it suggests the sovereignty gap and the safety gap may be the same structural failure observed from two different vantage points: both arise once a system stops assuming it will be let in.

Where Power Resides

None of this yields a tidy resolution, and pretending otherwise would flatter the problem more than it deserves. What the 4chan case demonstrates, with unusual clarity for such a small dispute, is that modern states are discovering the limits of authority over systems that operate inside their citizens’ lives while sitting outside their legal reach.

Whether the answer lies in new categories of regulated infrastructure, in treaties that have not yet been written, or in techniques that no longer require a platform’s cooperation in order to function, is not yet settled.

What is settled is the question itself, and it deserves to be treated as a serious one rather than a curiosity arising from an obscure image board’s bad manners. A company telling a sovereign government to make it comply is not, in the end, a story about enforcement.

I left both times.

It wasn’t because I couldn’t do the work, and it wasn’t because I failed. The truth is far more mundane, and it probably sounds ridiculous in today’s qualification-obsessed world: I was bored.

Today, so much of the cultural conversation revolves around the rigid planning of youth getting into the right university, collecting the right qualifications, and building a career through formal education. But at eighteen and nineteen, I simply couldn’t see the value in sitting in a classroom learning things that felt entirely disconnected from the world I wanted to be in.

I wasn’t making a grand statement about higher education. I wasn’t rejecting academia on principle, nor was I trying to prove anything. I was just a dyslexic kid who couldn’t see his future in a lecture theatre.

What happened next was not part of a plan. In fact, looking back thirty years later, one of the strange things is how little of it I can remember clearly. People often tell their career stories as though every decision was strategic, as though they knew exactly where they were heading.

I didn’t. Most of the time I was simply trying to figure out what came next.

The Company Above the Chip Shop

My first job was with a software company somewhere in Egham. For the life of me, I cannot remember how I got it. I don’t remember applying, I don’t remember the interview, and I have no idea who introduced me to them. I think the company name had three initials followed by the word Software.

The office wasn’t really an office; it was more like a flat or a house above a chip shop.

There were only a handful of people there. The two founders were extraordinarily odd, though their names are long forgotten. One of the other developers was an Ivy League graduate who, from memory, didn’t seem particularly delighted that I was there. And then there was me: a dyslexic teenager with no degree and only the most rudimentary understanding of technology, spending my days writing HP 3000 code on green-screen terminals.

The one thing I remember vividly was getting paid. Every week they handed me a cheque for about £650. To me, it felt like a fortune. What annoyed me wasn’t the amount, but the cheque itself. Even then, I couldn’t understand why they weren’t paying directly into a bank account. This was the 1990s, not the 1970s. I would walk to the bank to pay it in, wondering why everything felt so strangely old-fashioned for a technology company.

If you had shown me my future at that point, I would have assumed you had the wrong person. There was absolutely nothing about that tiny company above a chip shop that suggested it was the beginning of a thirty-year career. Yet somehow, it was.

Reuters and Learning by Doing

After that, I joined Reuters. Today, that sounds much more impressive than it actually felt at the time. I wasn’t designing trading systems or making strategic technology decisions. I was building hardware.

Reuters had these Dealing 3000 systems that would sit on trading floors or under traders’ desks. I spent my time physically assembling machines, installing components, testing connectivity, loading software, putting systems into racks, and making sure everything worked before it was deployed. I knew very little about hardware when I started, so I learned because the job required me to. I found myself in another strange environment—a small lab, a handful of people, a lot of equipment, and a lot of learning.

Again, there was no grand career strategy. I wasn’t trying to become anything; I was simply learning whatever was in front of me.

Discovering What I Didn’t Want To Do

After Reuters, I ended up on an IT helpdesk. I think it was for PwC, but some of these memories are now nearly thirty years old and the details have become blurred around the edges.

What I do remember is that I was terrible at it. Not technically I could solve the problems I just didn’t care about them. Every day seemed to involve somebody else’s password, somebody else’s printer, or somebody else’s issue. I was bored out of my mind.

Looking back, it was probably one of the first times I realised there is a difference between being capable of doing a job and actually wanting to do it. I could do helpdesk work; I just had absolutely no interest in spending my life doing it.

The Deutsche Bank Interview

Then something happened that changed everything. The opportunity came through a recruitment agency I think it was a temporary staffing agency. They asked me questions about various technologies and bits of experience I had accumulated over the previous few years, and then they asked me to put together a CV.

I remember sitting at my sister’s computer building it, using whatever version of Windows and whatever word processor existed in the late 1990s. I was trying to make myself sound more impressive than I probably was. Like most people at that age, I spruced it up.

Eventually, they sent me to an interview at Deutsche Bank. At the time, that name meant very little to me. I wasn’t chasing investment banking, I wasn’t targeting cybersecurity, and I wasn’t trying to join one of the world’s largest financial institutions. I was simply looking for the next job. I didn’t even really know what a Security Administrator was.

During the interview, I met the regional head of security. He asked me a lot of questions. Some I could answer, some I couldn’t. Then, he asked me a very specific technical question about a programming language that appeared on my CV.

The problem was, I didn’t really know the programming language. I had included it because it sounded good.

So, I did the only thing I could do. I told him the truth.

“Honestly, I don’t know the answer to that question.”

He looked slightly surprised. I continued:

“It sounded good, so I put it on my CV.”

Looking back, that probably wasn’t the answer he expected. It certainly wasn’t the answer a recruitment consultant would recommend. I left the interview convinced I had ruined my chances, never expecting them to call me back.

Instead, they invited me back for a second interview. A short time later, they offered me the permanent role of Security Administrator. The salary was £27,500 a year. I was twenty-one years old.

Looking Back

I had no degree, no investment banking experience, and no cybersecurity experience. I remember staring at the offer and struggling to comprehend it. The salary felt enormous, the opportunity felt unreal, and most of all, I couldn’t understand why they had chosen me.

The strange thing is that even now, thirty years later, part of me still doesn’t fully understand it.

By every conventional measure, I wasn’t supposed to be there. I was dyslexic, I had left university twice, and I had no degree. My career consisted of a software company above a chip shop, building Reuters hardware, and being bored on a helpdesk. Yet somehow, I was walking into one of the world’s largest investment banks.

The older I get, the more I realise that this isn’t really a story about degrees. Nor is it a story about rejecting education. It is a story about how unpredictable life can be.

At twenty-one years old, I had absolutely no idea what investment banking would mean. I had no idea what cybersecurity would become, or that I would spend the next thirty years working across security, intelligence, risk, technology, and entrepreneurship. I wasn’t executing a master plan; I was simply taking the next step.

Perhaps that is why I find the whole thing so fascinating when I look back. If somebody had shown me my life today and asked me to predict it from where I stood at twenty-one, I would have failed completely.

The path only looks obvious in hindsight. When you are living it, it rarely does. All I knew at the time was that somebody had given me an opportunity I didn’t expect and didn’t fully understand. I accepted it. And without realising it, I had just walked through a door that would shape the next thirty years of my life.

What Changes On The Day The Ban Comes Into Force

Spring 2027. The legislation has passed. Enforcement begins.

A thirteen-year-old in Birmingham who previously spent three hours an evening on TikTok, Instagram, and Snapchat can no longer access those platforms legally. The platforms are obligated to prevent her from creating an account or maintaining an existing one. Age assurance mechanisms are in place. Compliance is being monitored.

Here is what her digital life actually looks like.

She is on WhatsApp. She is on Signal. She is on gaming platforms where voice chat with strangers is standard. She is on Discord, which is not on the banned list. She is on YouTube wait, YouTube is banned. She moves to alternative video platforms that are not. She is on platforms that didn’t exist when the legislation was drafted. She is in group chats, private chats, and digital spaces that no regulatory framework currently reaches.

The people who want to reach her know this. They have always known this. They will find her where she is, not where she used to be.

This is not an argument against the ban. It is a description of what the ban does and does not do, stated plainly, without the noise of either celebration or reflexive criticism.

What The Ban Actually Delivers

It delivers three things of genuine value.

First, it establishes a legal and cultural norm. Under sixteen means under sixteen. Platforms that knowingly allow access face consequences. That matters, and it will over time alter the landscape of what is considered acceptable.

Second, it reduces a category of ambient exposure. A child who is not on Instagram is not scrolling through content algorithmically optimised to extend her session at the expense of her wellbeing. That is a real benefit and should not be dismissed.

Third, it creates accountability infrastructure. Platforms can now be held to obligations they previously avoided. That is a meaningful shift in the regulatory relationship between government and technology companies.

These are genuine achievements. They are worth having.

What The Ban Does Not Deliver

It does not make grooming harder to execute.

It does not make coercion easier to detect.

It does not interrupt the process by which a child moves from a first conversation to dependency to exploitation.

It does not give a parent any earlier warning that something is wrong.

It does not give a teacher any additional visibility into whether a child’s behaviour is changing in ways that matter.

It does not give a safeguarding professional any new capability for understanding how risk is forming before it becomes a referral.

It does not map the behavioural mechanism that produces harm. It does not slow that mechanism. It does not surface it. It relocates it.

Where Risk Goes When It Moves

The harms that motivated this ban grooming, coercive manipulation, sextortion, radicalisation, exploitation are not native to any particular platform. They are behavioural. They travel.

When Australia implemented its ban in December 2025, researchers began tracking what happened next. The early signals were consistent with what most serious practitioners expected. Risk migrated. Children moved to less regulated environments. Some of those environments offered considerably less visibility than the platforms they had left.

The ban reduced exposure to a known set of environments. It increased exposure to an unknown set. The net effect on harm not on usage, not on compliance, but on actual harm remains, at this stage, genuinely unclear.

This is not Australia’s failure. It is the predictable consequence of an access-control intervention applied to a behavioural problem. The intervention changes the environment. It does not change the mechanism.

The Path Nobody Is Talking About

Here is where I want to be direct, because I have spent eighteen months trying to have this conversation and I have not yet found a satisfactory explanation for why it isn’t happening.

The path forward is not more restrictions. It is not better moderation. It is not stronger enforcement, though all of those things have value. The path forward requires building a capability that does not yet exist at scale in this country.

The strange thing about safeguarding is that everyone understands progression and almost nobody measures it.

Ask an experienced safeguarding lead how grooming develops and they will describe a sequence rather than an event. Ask them how coercion develops and they will describe a sequence rather than an event. Ask them how exploitation develops and they will describe a sequence rather than an event. The lived understanding already exists.

Nobody believes a child moves from complete safety to serious harm in a single moment. Trust forms. Relationships develop. Boundaries shift. Influence accumulates. Dependency emerges. The consequence that eventually becomes visible is usually the final stage of a much longer process.

Yet much of the safeguarding ecosystem remains organised around the point at which that process finally surfaces. Referrals begin when concerns become visible. Investigations begin when evidence becomes visible. Interventions begin when harm becomes visible.

The contradiction is difficult to ignore.

We understand that many forms of harm develop progressively, yet we continue to invest predominantly in systems designed to activate once that progression has already crossed a threshold of visibility.

The question that follows is obvious.

If safeguarding professionals already recognise that harm develops through progression, why are we investing so little in developing a capability specifically focused on understanding that progression before it culminates in a disclosure, referral or criminal investigation?

Why Nobody Is Saying It

I have thought carefully about why this conversation isn’t happening, because it isn’t a question of intelligence or intention. The people working in child safety are serious. The policymakers are not indifferent. The researchers are not incurious.

The answer, I think, is structural.

A ban is announceable. It has a date. It has a list of platforms. It has a press conference and a Prime Minister and a headline that every parent in the country can read and feel something about. It is legible. It is communicable. It produces a moment.

Behavioural risk intelligence does not produce a moment. You cannot hold a press conference about modelling risk progression signals. You cannot put confidence calibration in a tabloid headline. You cannot tell a grieving parent that you are working on upstream behavioural inference and have that land with the same force as “we banned the platforms that harmed your child.”

So the conversation doesn’t happen. Not because the answer is wrong. Because the answer is hard to announce.

This is how important capabilities remain unbuilt for years after the need for them is visible. Not through malice. Through the structural mismatch between what politics can communicate and what safety actually requires.

What The Next Phase Actually Needs

The ban will come into force in Spring 2027. At some point after that, probably quietly, researchers will begin to ask whether harm has reduced not usage, not compliance, but harm. The answer will be complicated, partial, and politically inconvenient.

At that point, the conversation will need to move.

What the next phase requires is not a replacement for what has been built. Moderation matters. Enforcement matters. Access controls matter. The question is whether they are sufficient on their own, and the honest answer is that they are not.

What is needed alongside them is a capability focused on the period before harm becomes visible. A system that understands behavioural progression across time. That models how trust forms, how dependency develops, how influence accumulates, how the signals that experienced safeguarding professionals recognise as early indicators of escalating risk can be surfaced before those risks have crystallised into something a family has to survive.

Not surveillance. Not content inspection. Not message monitoring. Behavioural inference the same logic that underlies fraud detection, threat intelligence, and insider risk management applied to the domain where the consequences of missing the signal are most severe.

This is what SecureHaven is building. I am stating that plainly rather than burying it, because I have spent long enough being indirect about it and indirectness has not served the conversation.

The capability gap is real. The need is urgent. The path exists.

What it currently lacks is anyone with the platform, the resources, or the political will to say so clearly.

I am saying so clearly. The question is who is listening.

SecureHaven is a UK-based behavioural risk intelligence company working on behavioural risk intelligence for child online safety. If you work in safeguarding, education, policy, or investment and want to understand more, the conversation is welcome.

Today, Lewis Hamilton won his first race for Ferrari.

It has nothing to do with online child safety, social media bans, or government policy. And yet it stopped me because for a few hours, watching someone who had been written off by the paddock, doubted by commentators, and written out of the narrative simply refuse to accept that story, it felt like a reminder that difficult things can still work out. That persistence still matters. That conviction, maintained long enough against sufficient resistance, occasionally produces something worth watching.

I needed that reminder more than I had realised. Because tomorrow, if the reports are accurate, the United Kingdom is about to make one of the most consequential decisions on online child safety in a generation. And whilst the country debates whether that decision is right or wrong, I find myself thinking about something that will barely feature in the coverage.

The Question I Could Not Find An Answer To

Eighteen months ago, I started with what seemed like a perfectly reasonable assumption. Surely somebody, somewhere, was already working seriously on understanding how risk forms before harm becomes visible not how we detect harmful content after the fact, not how we remove it or investigate it, but how risk itself develops in the period before any of those responses become necessary.

It seemed obvious to me, because every serious discipline I have spent time in across thirty years treats this as a foundational question. In cybersecurity, the serious work happens in understanding how attacks develop before compromise occurs. In intelligence, the value lies in understanding how threats form before they become actions. In fraud prevention, the craft is in reading how deception accumulates before the loss crystallises. The entire logic of professional risk management rests on the premise that understanding formation is more valuable than managing consequences.

So I assumed that child safety online would reflect the same logic. I assumed I would find serious, sustained inquiry into how grooming develops before the disclosure, how coercion builds before the safeguarding referral, how vulnerability deepens in the period before damage becomes irreversible. I assumed I would find a field organised around the upstream question, not just the downstream response.

What Eighteen Months of Looking Actually Found

What I found instead was a landscape of genuine sophistication and genuine importance but almost entirely organised around a single point in time. The point where risk had already become visible. Consequence management. Incident response. Harm reduction after harm had already occurred. I am not dismissing any of it; the people doing that work are serious, the need is real, and the outcomes matter. But if the earliest moment at which we understand what is happening to a child is the moment after something has already gone badly wrong, then we are not solving the problem. We are processing its aftermath with increasing efficiency.

That distinction lodged itself somewhere and refused to leave. I spent months attempting to find the counterargument speaking to safeguarding professionals, engaging with government, examining academic research, participating in consultations, submitting evidence, looking for the serious work on the upstream question that I must simply have missed. What I found, repeatedly, was that the question itself was not being treated as a priority. There were pockets of interest. There was no sustained effort.

Eventually, I stopped looking for the answer and arrived at a different conclusion. The capability was not underdeveloped. It was missing. And if it was missing, somebody needed to attempt to build it.

What I Built, And Why

So I built it. What emerged over the following eighteen months became SecureHaven not another parental control application, not another content moderation tool, not another mechanism for reporting harm after it has occurred, but a behavioural risk intelligence system designed to do something that, as far as I could establish, nothing else was doing.

Before the disclosure. Before the referral. Before the moment a parent discovers that something had already been happening for weeks or months and they had no means of knowing.

I want to be clear about what this is and what it is not, because the distinction matters. It is not surveillance. It does not read messages, intercept communications, or require access to private conversations. What it does is model behaviour over time the patterns, progressions, and shifts in how a child moves through their digital environment and surface signals that experienced safeguarding professionals would recognise as indicators of escalating risk, before those risks have crystallised into incidents that require a response rather than a conversation.

The simplest way I have found to explain it is this: there is a difference between a smoke alarm and a fire investigation. One tells you something is already burning. The other tells you that conditions are forming that need attention now. We have built considerable capability around the fire investigation. We have invested almost nothing in the smoke alarm. SecureHaven is the smoke alarm.

The Last Eighteen Months, Honestly

I want to be honest about what building this has actually looked like, because the polished version of a founder’s journey tends to obscure the texture of the experience in ways that do nobody any favours.

More than two hundred investor conversations. The vast majority ending with some version of “not for us right now” which is a perfectly reasonable response, and one I have long since stopped taking personally, but which accumulates weight over time regardless. Government engagement that moves at the pace government engagement moves at. Institutional interest that rarely converts into institutional action on any timeline that matches the urgency of the underlying problem. Progress that has often felt painfully slow against the scale of what is at stake.

None of it has altered my conclusion. If anything, the cumulative weight of two hundred conversations in which I could not find a compelling argument that the question itself was wrong has strengthened it. I have encountered reluctance. I have encountered caution, and timing concerns, and uncertainty about market readiness. What I have not encountered is a persuasive case that understanding how risk forms before harm becomes visible does not matter. The question has survived everything I have thrown at it, including two hundred attempts at honest stress-testing.

On Tomorrow, And What Comes After

Tomorrow’s announcement may prove genuinely successful. It may reduce certain risks in ways that make a meaningful difference to children’s lives, and I am open to that possibility without reservation. The people making these decisions are attempting to respond to a real crisis with the tools available to them, and that deserves acknowledgement rather than reflexive criticism.

But thirty years working across risk, cybersecurity, and intelligence has left me unable to ignore something that I think will matter in the period after the announcement. Complex systems adapt. Environments change in response to interventions, and changed environments produce new behaviours, and new behaviours produce new forms of risk some of which are predictable, and some of which are not, and the most consequential of which tend to be the ones that emerge from changes we thought we had understood. This is not a counsel of despair or an argument against action. It is an argument for maintaining the upstream question alongside whatever downstream interventions we implement.

Whatever is announced tomorrow, the question does not go away. How does risk form before harm becomes visible? Are we doing enough to understand it? Are we building the capability to surface it before it becomes something a family has to survive rather than something they were warned about in time to act?

Why I Am Still Here

I began this journey expecting to find that someone else had already done the serious work. I am continuing it having spent eighteen months building what I could not find. SecureHaven exists because a capability was absent and a child’s safety is not something that waits for a more convenient moment to address that absence.

The parents I have spoken to throughout this process are not, in my experience, asking primarily for bans or regulatory frameworks or algorithmic solutions. They are asking for something considerably simpler and considerably harder to build. They are asking to know. To have some means of understanding that something is wrong before it is too late to do anything about it except grieve the fact that they did not know sooner.

That is what I am building. That is what I intend to keep building, through whatever comes next. And today, watching Lewis Hamilton stand on the top step of a Ferrari podium for the first time, I was reminded that sometimes if you keep going long enough, and you believe in what you are doing with enough conviction to absorb the weight of everything that pushes back things do eventually break your way.

SecureHaven is a UK-based behavioural risk intelligence company working on child online safety. If you work in safeguarding, education, policy, or investment and want to understand more about what we are building, I would welcome the conversation.

The discussion about children’s online safety has become increasingly polarised.

On one side are those who argue that digital platforms have become fundamentally harmful and that stronger restrictions, age limits, or outright bans are now necessary. On the other are those who emphasise the benefits of technology connectivity, education, creativity, and participation in modern life.

Both sides are responding to genuine concerns. Both contain elements of truth.

Yet there is a growing possibility that the debate itself is focused on the wrong problem.

The question dominating public discussion is whether children should have access to particular platforms. The more important question may be whether the adults responsible for children can still see enough to protect them.

Children do not simply use digital platforms. Increasingly, they inhabit them.

Friendships are formed online. Social status is negotiated online. Conflict, belonging, identity exploration, emotional support, and communication now occur within digital spaces woven into the fabric of everyday life. Whether we view that development positively or negatively, it has become a structural reality.

The challenge is that whilst digital participation has become more deeply embedded within childhood, visibility into what occurs within those environments has moved in the opposite direction.

A decade ago, many forms of online interaction were comparatively easier to observe. Communication was more public. Platforms were more bounded. Harmful behaviour was more likely to leave visible traces before significant escalation occurred.

Today, a growing proportion of interaction takes place across encrypted messaging systems, private groups, gaming environments, disappearing-message platforms, pseudonymous communities, and increasingly AI-mediated spaces.

Privacy has improved. Visibility has diminished.

Neither statement is inherently good or bad. They are simply observations about how the digital environment has evolved. The consequences, however, are significant. Built for a world where harm eventually became visible

Most safeguarding systems were built around a world in which harmful behaviour eventually became visible. A report was filed. A moderator intervened. A parent discovered evidence. A teacher noticed a change. A disclosure was made.

Intervention followed visibility.

That model is under strain. Many forms of harm do not begin with an event. They develop through a process.

Grooming rarely begins with criminal behaviour. Coercive relationships rarely begin with obvious threats. Manipulation, dependency, social exclusion, and exploitation often emerge gradually through persistence, trust-building, reinforcement, and escalation over time.

In many cases, the behavioural process is the harm. The visible event merely represents the point at which that process becomes impossible to ignore.

As digital environments become more private, safeguarding systems remain strongest at precisely the moment visibility finally emerges long after the conditions for harm were already forming.

Much of the current policy response focuses on platforms age assurance, moderation, recommendation systems, harmful content, and platform accountability. These are important and deserve serious attention.

But platform-focused interventions have structural limitations.

Behaviour does not remain confined to a single platform. Children move fluidly between messaging applications, gaming environments, social networks, livestream communities, group chats, and emerging AI-powered services. Relationships span multiple environments. Interactions migrate. Communities relocate.

When a platform is restricted, risk may be reduced within that environment. In some circumstances that is entirely appropriate. But behavioural risk does not disappear simply because a platform becomes less accessible. Sometimes it moves.

A reduction in platform activity is not always the same thing as a reduction in underlying risk.

This becomes even more significant as artificial intelligence becomes integrated into everyday digital life. The internet was built around human-to-human interaction. That assumption is beginning to change. AI systems are becoming more conversational, more adaptive, more personalised, and more capable of sustained engagement. Future safeguarding discussions will need to consider synthetic identities, AI-mediated interaction, and automated persuasion environments far more complex than those existing systems were designed to govern.

The answer is not surveillance. It is behaviour.

The deeper challenge is not social media. It is not smartphones. It is not even individual platforms. It is visibility itself.

The same device that connects a child to a digital environment can, in principle, recognise the behavioural patterns that precede harm. Not by reading content. Not by breaking encryption. Not by turning a child’s phone into a surveillance instrument.

By reading behaviour.

Escalating contact patterns. Shifting communication rhythms. The gradual narrowing of a child’s digital world towards a single relationship or community. These signals exist. They are detectable. And they do not require anyone to see what a child is saying in order to understand that something is changing.

That capability exists today.

The question is no longer whether the visibility gap can be closed. It is whether we are willing to build the infrastructure that closes it and whether we move quickly enough to matter.

The choice is not between privacy and protection. It never was. The choice is between safeguarding infrastructure built for the world as it was, and safeguarding infrastructure built for the world as it is.

One of those is still being debated. The other needs to be built.

This problem is solvable. But only if we build for it. This is not an abstract policy question. It is a practical one and the window for getting ahead of it is narrowing.

The problem is defined. The behavioural signals are detectable. The architecture to read them privately, on-device, without surveillance exists today. What is needed now is the will to build it at scale.

If you work in government, education, or child protection and recognise the gap this article describes, I would welcome a conversation about what closing it requires in practice.

If you are an investor who understands that the next generation of child safety infrastructure will not be built on content moderation and platform restriction alone, I would welcome that conversation equally.

And if you are a parent who has looked at your child’s phone and wondered what you are not seeing you are asking exactly the right question.

The infrastructure to answer it is being built. Get in touch.

nv@securehaven.uk

For most of my career, if not all of it, I have worked in cybersecurity, behavioural geopolitical , digital risk and resilience.

One of the stranger aspects of working in those fields is that success can be surprisingly difficult to demonstrate.

When a major cyber attack succeeds, everybody notices. There are headlines, emergency meetings, investigations, regulatory scrutiny and lengthy reviews of what went wrong. The consequences are visible. Evidence exists. People can point to the damage and understand why action is required.

When a major cyber attack is prevented, very little happens.

Systems continue operating. Customers remain unaware. Business carries on. The board moves on to other priorities. In many cases, nobody outside a small group of specialists ever knows there was a threat in the first place.

After thirty years in cybersecurity, I have become increasingly convinced that many of the most serious failures are not technical failures at all. They are management failures, governance failures, prioritisation failures and failures of judgement. The technology is often blamed because technology is where the failure finally becomes visible.

The real problem usually began much earlier.

Critical systems were not understood. Risks were not prioritised. Responsibilities were unclear. Known issues remained unresolved. Warnings were overlooked. Decisions were postponed. In many cases the organisation already possessed most of the information required to avoid the problem.

• What was missing was not knowledge.

• What was missing was recognition.

• The warning signs existed.

• Their significance was not understood.

Over time I found myself spending less time thinking about technology and more time thinking about risk itself. Why do some warning signs trigger action while others disappear into the background? Why do some organisations recognise emerging problems while others ignore them? Why do certain risks only receive attention once they become impossible to ignore?

Those questions eventually led me somewhere unexpected. They led me to intelligence.

They can recall 9/11. They can recall the Iraq weapons of mass destruction controversy. They can recall espionage scandals, terrorist attacks and security breaches. Failures become part of public memory because failures leave evidence behind. There are victims, inquiries, headlines and consequences.

What most people cannot name are intelligence successes.

How many attacks were prevented last year? How many hostile-state operations were quietly disrupted before they achieved their objective? How many espionage activities were identified and dismantled before they became public scandals? How many lives were saved because somebody recognised a pattern before it became a crisis?

Most of us have no idea. In many cases we are not supposed to. The more I thought about it, the stranger it seemed.

An intelligence service can spend years successfully preventing harm and leave almost no visible evidence of the value it has created. The attack never occurs. The operation never succeeds. The victims never exist. The story never becomes public.

Increasingly, I am beginning to wonder whether it is something much broader.

Then I Started Seeing The Same Pattern Elsewhere

Once the thought had occurred, it became difficult to ignore. A few weeks earlier I had been thinking about the NHS. Like many people in Britain, I have a deep sense of confidence in what happens when something goes seriously wrong. If I suffered a heart attack tomorrow or was involved in a major accident, there are few countries where I would rather be.

The NHS remains remarkably effective at responding when a crisis becomes visible.

Yet many frustrations with the health service emerge elsewhere. Rehabilitation. Mental health provision. Social care. Long-term treatment. The challenge often begins not when the patient arrives in crisis, but when they leave it.

The same thought resurfaced when I looked again at cybersecurity. Organisations devote enormous effort to responding to breaches. Incident response teams, digital forensics specialists, legal advisers and recovery programmes mobilise around a visible event. Yet the conditions that enabled the breach often developed quietly over many years. Technical debt accumulates. Governance weakens. Risks compound. The breach attracts attention. The gradual formation of risk rarely does.

Then I noticed the same thing in safeguarding. Most safeguarding systems become active when concern becomes visible. A disclosure. A report. A behavioural incident. An identifiable event. At that point professionals can act. Yet the circumstances that created the concern may have been developing for months or years beforehand.

What struck me was not the differences between these fields.

It was the similarities.

Healthcare appeared to be expressing the same pattern as cybersecurity.

Cybersecurity appeared to be expressing the same pattern as safeguarding.

Safeguarding appeared to be expressing the same pattern as intelligence.

At some point I stopped thinking about the individual sectors altogether and started wondering whether I was looking at the same phenomenon appearing in different forms.

Looking Across Britain

At around the same time, I began noticing something else. Regardless of where one looks, an increasing number of British institutions appear to describe themselves in remarkably similar terms.

The NHS talks about capacity pressures and waiting lists. Police forces talk about rising demand and stretched resources. Local authorities discuss growing obligations and shrinking room for manoeuvre. Schools, social care services, safeguarding teams and courts often describe operating under persistent pressure.

The causes are clearly not identical.

Healthcare challenges are not policing challenges. Housing is not safeguarding. Social care is not national infrastructure.

Yet the language feels strikingly familiar.

Across an extraordinary range of institutions, the conversation increasingly revolves around backlogs, waiting lists, crisis response, emergency funding, rising demand and constrained capacity. Different sectors use different terminology, but the underlying experience often sounds remarkably similar.

It is tempting to treat these as separate problems that happen to be occurring at the same time. Perhaps they are. But I increasingly find myself wondering whether there is another possibility.

What if at least some of these institutions are confronting a challenge that intelligence services have wrestled with for decades?

• Not a challenge of competence.

• Not a challenge of commitment.

• Not even necessarily a challenge of resources.

• A challenge of recognising significance before consequence creates visibility.

Across a growing number of domains, institutions appear to be encountering problems at the point where those problems have become visible and urgent. By the time the issue enters public consciousness, demand has accumulated, options have narrowed and intervention becomes more expensive, more difficult and more reactive.

This does not mean the warning signs were absent. In many cases they may have been present for years.

The difficulty is that weak signals rarely compete successfully against visible consequences.

1. People see the waiting list.

2. People see the cyber attack.

3. People see the safeguarding failure.

4. People see the infrastructure outage.

5. People see the overcrowded prison.

What remains far harder to see are the conditions that allowed those outcomes to emerge in the first place.

The Pattern

The longer I sit with this idea, the more I find myself returning to intelligence. Not because intelligence services are unique.

Quite the opposite.

Because they may be the clearest expression of a challenge that increasingly appears elsewhere. Intelligence services have always operated in environments characterised by incomplete information, uncertainty, fragmented evidence and competing interpretations. They rarely have the luxury of certainty. If they wait for certainty, the event they are attempting to prevent may already have occurred.

Their task is not simply to collect information.

• It is to recognise significance.

• To identify the difference between noise and signal.

• To understand which patterns matter and which do not.

• To act before consequence provides the proof.

Increasingly, many other institutions appear to be facing the same challenge.

Healthcare faces versions of it. Cybersecurity faces versions of it. Safeguarding faces versions of it. National resilience faces versions of it.

The question is no longer whether information exists. The question is whether we recognise its significance before the consequences arrive.

The Question I Keep Returning To

Perhaps that is what continues to fascinate me about intelligence services.

The most successful intelligence operation is often the one nobody ever hears about.

The attack never happens.

The crisis never emerges.

The victims never exist.

The evidence disappears alongside the threat.

Looking across Britain today, I increasingly wonder whether many of our institutions are confronting a similar problem.

Not because they lack information. Not because they lack capable people.

But because recognising the significance of emerging risk is inherently difficult, particularly when the consequences remain invisible. I am not entirely sure what follows from that observation.

But the pattern appears often enough, and across enough different domains, that it is becoming increasingly difficult to dismiss as coincidence. Perhaps the most interesting thing about intelligence services is not what they tell us about espionage, terrorism or national security.

Perhaps it is what they tell us about the difficulty of recognising risk before consequence creates visibility. And looking across Britain today, I increasingly wonder whether that challenge is no longer confined to the intelligence community.

The UK Government has confirmed that a preliminary scoping exercise has been commissioned to determine the viability of a feasibility study into whether a formal review should be undertaken to examine the case for exploring strategic options regarding the potential reacquisition of America.

Officials have characterised this development as a significant procedural milestone.

The programme remains fully aligned with baseline expectations.

1. Background

• 1776: Unilateral asset divestment by the counterparty. Formal consultation windows were bypassed.

• 1812: Bilateral dispute resolution attempted via informal field exercises. The counterparty declined to reintegrate. The matter was logged and archived.

• 1941: Joint venture initiated regarding external third-party market disruptions. The counterparty provided short-term operational support. The legacy structural dispute was paused without prejudice.

• 2003: Reciprocal operational support provided on a counterparty-led regional restructuring initiative. Analysts noted potential precedent-setting implications for the broader portfolio. No formal reconciliation of accounts was commissioned.

• 2026: Commissioning of a preliminary scoping exercise to evaluate the necessity of a future review. Officials describe this as meaningful administrative momentum.

2. Terms of Reference (Scope)

The exercise will examine a number of core operational variables within its strict terms of reference. These include:

• Asset Availability: To ascertain whether the territory has been otherwise encumbered, subdivided, or subject to alternative long-term leasing arrangements.

• Stakeholder Consultation: To determine if adjacent dominions (specifically Canada) hold an actionable view, or if their current geographical proximity constitutes tacit alignment.

• Supply Chain Optimisation: To assess current regional beverage preparation methodologies and identify opportunities for harmonisation with statutory tea-brewing standards.

• Orthographic Standardisation: To evaluate the fiscal and administrative resource requirements of retroactively reintroducing the letter ‘u’ across all regional documentation.

• Notification Protocols: To establish whether the counterparty is aware that a scoping exercise has been initiated, or if continued administrative silence may be interpreted as acquiescence.

Officials have confirmed that the counterparty has not been notified. This is entirely consistent with standard framework governance and prevents premature market speculation.

3. Due Diligence: Preliminary Assessments

Language

The English language has been subject to extensive, unauthorised localised modifications since the 1776 divestment. A comprehensive audit has not been authorised. Early sampling indicates that orthographic and lexical drift is widespread (e.g., the substitution of ‘z’ for ‘s’ in regulatory terms). The use of the word ‘gotten’ remains under active monitoring.

Sovereignty

The counterparty has maintained an uninterrupted independent sovereign position for approximately two hundred and fifty years. Departmental analysts have flagged this as a material complicating factor. No mitigation strategy has been proposed at this stage.

The Metric System

Transition to standardised international weights and measures has failed to occur. The Department has maintained a passive monitoring brief on this non-compliance since the late 18th century. The current position is static; no corrective escalation is recommended.

Nomenclature (Field Sports)

A high-level conflict has been identified regarding the designation of ‘Football’. The matter has been referred to an inter-departmental working group. The working group’s inaugural meeting has been deferred pending internal consensus on the definition of a ‘pitch’.

Fiscal Impact Assessment

The Treasury has conducted an initial high-level costing of the proposed programme. Preliminary econometric modeling suggests that the capital expenditure required for full asset remediation significantly exceeds the current national allocation for regional pothole repair.

The Treasury has indicated that any future business case must demonstrate a robust return on investment, potentially via the retroactive collection of outstanding colonial stamp duties. A revised business case has been requested; no timeline has been set for its submission.

4. Programme Architecture

The initiative will proceed via a highly structured, iterative delivery framework:

• Phase One (Active): Determining whether the conditions exist to justify initiating Phase Two.

• Phase Two: Evaluating the outputs of Phase One to establish if a Framework Directive can be drafted.

• Phase Three: Scoping the precise Terms of Reference for a potential future Review.

• Phase Four: Establishing the governance arrangements required to oversee any subsequent decision-making architecture.

• Phase Five: Assessing counterparty appetite and market readiness.

Current projections indicate that Phase Five will conclude no earlier than the third quarter of 2276. Internal auditors note that this represents a highly aggressive timeline, comfortably outperforming recent domestic rail infrastructure benchmarks.

5. Ministerial Statement

A Government spokesperson issued the following clarification to the House:

“This is not an operational proposal to reacquire the Americas. This is a preliminary scoping exercise designed to evaluate the viability of commissioning a feasibility study into whether a formal review should be undertaken to examine the case for exploring strategic options.

No decision has been taken. No decision is imminent. Indeed, the administrative mechanism required to take such a decision has itself not yet been designed. Any characterisation of this update as indicative of momentum is entirely inconsistent with the spirit of the documentation.

We will update the House in due course.”

The spokesperson confirmed that a subsequent statement would be issued following the formal sign-off of Phase One. Phase One remains subject to ongoing risk adjustments and has no scheduled completion date.

Document Ref: CO/776-2026/TAR-01
Cabinet Office, London
RESTRICTED

A Personal Note

Most of what I write about is serious.

Child safeguarding. Online harm. Behavioural risk. Public policy. The gap between what institutions say they are doing and what is actually happening to children in digital environments.

I saw a hat that said *Make America Great Britain Again*.

It occurred to me that the funniest version of that story was not Britain wanting America back. It was Britain spending two hundred and fifty years on stakeholder engagement before deciding whether to ask.

That felt entirely plausible.

Because nobody in this debate has answered that question yet.

This week the UK government made two significant announcements on child online safety. The first concerns device-level controls intended to prevent children from creating, storing and transmitting explicit imagery. The second concerns restrictions on social media access for under-16s, widely described as a “ban”.

Both announcements reflect something real.

Parents are worried. Teachers are worried. Safeguarding professionals are worried.

Many families have watched something change in their children’s digital lives and felt increasingly uncomfortable with only seeing what is happening after something has already gone wrong.

The pressure on government to act is entirely understandable. The intent behind these announcements deserves acknowledgement rather than dismissal.

But intent and impact are not the same thing.

Before we decide whether these policies are successful, it is worth asking the one question that nobody in this debate has yet publicly answered.

What would success actually look like?

Device Controls and the Limits of Technical Friction

The first announcement has been presented as a significant intervention into the circulation of explicit imagery involving children. In practice, it is more accurate to describe it as a mandate to enforce existing capabilities more consistently.

Apple and Google already deploy a range of child safety technologies. Sensitive content warnings. Communication safety controls. Image blurring. Restricted child accounts. Parental supervision frameworks. What is changing is not the existence of those capabilities. What is changing is the expectation that they become enabled as mandatory defaults.

That has genuine value. Many families never configure these settings. Many do not know they exist. Raising the default level of protection will prevent certain forms of harm in certain circumstances. That should be recognised.

At the same time, it is important to understand the true scope of what is actually being governed.

The public discussion has often implied a universal intervention across children’s digital lives. The reality is considerably narrower.

This is not a criticism. It is a map of the territory. The policy focuses on the environments government can most readily influence. Much of the wider digital ecosystem including the alternative devices and gaming networks children use every day remains entirely outside its scope.

There is a second consideration. And it is the harder one. By the time a child is sending an explicit image, the image itself is rarely the beginning of the problem. In most cases it is the visible outcome of a much longer sequence.

Trust-building. Relationship formation. Emotional dependency. Manipulation. Coercion.

The image appears near the end of that process. Not the beginning.

A child prevented from sending an image today may still be inside the same relationship tomorrow. The intervention disrupts the transmission. It does not disrupt the trust, the dependency, or the coercion that produced it.

That does not make the intervention unhelpful. It simply means it must be understood for what it is.

A friction mechanism. Not a complete safeguarding model. The Australian Example - a Cautionary Tale, Not Template

The second announcement concerns social media access restrictions for under-16s. The Australian experience is frequently cited as proof that this approach works. It is worth examining what Australia actually implemented and what six months of evidence genuinely shows.

Australia did not prohibit social media. It required a defined group of platforms to take reasonable steps to prevent under-16s from creating accounts. There was no single mandated technical solution. No standardised enforcement architecture. Platforms were largely left to determine how compliance would be achieved.

The result was meaningful friction on named platforms. The government pointed to 4.7 million accounts disabled in the first month a figure widely reported as evidence of success. But that figure only tells us that platforms deleted accounts. It does not tell us whether a single child became safer.

Discord remained available. Roblox remained available. Steam remained available. Private messaging remained available. Within weeks of the legislation coming into force, researchers observed these exempt environments becoming the new social infrastructure for Australian teenagers.

Same children. Less governance. Fewer obligations. No accountability framework whatsoever.

The platforms changed. The underlying behaviour did not disappear. It moved.

Australia is not a template. It is a six-month-old cautionary tale about what happens when access restriction is mistaken for harm reduction. The UK has a genuine opportunity to learn from that before replicating it.

What Problem Are We Actually Solving?

At this point it is worth returning to the question we started with. What does success look like? Because that depends entirely on what problem we believe these policies are solving.

Both announcements can succeed entirely on their own terms.

Images can be blocked. Accounts can be removed. Implementation targets can be achieved. The more difficult question is whether any of those process metrics tell us that fewer children are being broken.

That is a different question entirely.

The Question Nobody Is Asking

Most of the public debate has focused on implementation. Which platforms. Which devices. Which age groups. Which enforcement mechanisms. Those are important questions. They are not the same as asking whether children are safer.

Success for a child is not an implementation metric. It is not an account deletion figure. It is not a compliance report. It is not a count of blocked images.

Success looks like fewer children being groomed. Fewer children being manipulated. Fewer families experiencing the slow, quiet accumulation of harm that develops long before it triggers a digital tripwire.

Those outcomes are genuinely difficult to measure. A serious longitudinal assessment of whether these policies reduce actual harm to actual children would take years. Perhaps a decade. Even then attribution would be extraordinarily difficult the children most affected today will take years to understand, process and disclose what happened to them.

That does not mean these policies should not be implemented. It means we should be honest about what they can and cannot tell us and resist the temptation to declare success when the compliance figures look clean.

The Upstream Visibility Gap

Both announcements share a fundamental characteristic. They intervene after something becomes visible. An image. An account. A platform interaction. A measurable event that has already occurred.

Neither intervention materially improves our ability to understand what is happening before that point. Yet that is precisely where the most serious harm develops.

Grooming does not announce itself. It develops through persistence, gradual trust-building, emotional dependency, progressive isolation fragmented across multiple platforms that never see the full picture. By the time any existing mechanism is triggered a device control, a moderation threshold, a safeguarding referral the relational architecture of exploitation may already be fully established.

This is the upstream visibility gap. The space between where harm forms and where our current systems are positioned to see it.

It is entirely absent from both announcements. It has not featured in the public debate. It remains the most consequential unanswered question in child online safety.

What Comes Next

The government is responding to a real problem with genuine intent. Both announcements may reduce specific forms of harm and create useful friction. Neither should be dismissed.

But neither constitutes a complete response.

The harder conversation remains ahead. How do we develop meaningful visibility into harm before it becomes obvious? What forms of earlier awareness are proportionate? What is compatible with privacy, encryption and civil liberties? What does safeguarding look like in increasingly fragmented digital environments? Those questions are not being asked. Yet they may prove to be the most important questions of all.

A Personal Note

I am the founder of SecureHaven.

We are building privacy-compatible, on-device behavioural intelligence designed to identify escalating risk patterns before they become visible without content monitoring, without weakening encryption, and without surveillance architectures that would rightly face serious civil liberties challenge.

I do not claim to have solved this problem. Nobody has. The upstream visibility gap is genuinely hard technically, legally, ethically. It demands careful thinking about proportionality, privacy, human oversight and constitutional boundaries.

But I believe it is the right problem to be working on. And it matters most for the children whose harm develops slowly, privately, in environments no platform ban reaches and no device control touches.

If you work on these issues in government, safeguarding, policy, research or technology I would genuinely welcome the conversation. Not because I have all the answers. Because the question is too important to leave unasked.

In my next piece I will set out what a structurally serious answer to the upstream visibility gap actually looks like and why it is harder, more important, and more urgent than anything currently being discussed.

Ten minutes later, the AI model in front of them would answer questions about ricin dosages, chlorine gas dispersal, and child sexual abuse. Questions it had been specifically trained to refuse.

Nothing new had been built. No capability had been created that didn’t already exist. The journalist had simply used a free tool, downloaded from GitHub, to remove the part of the model that said no.

That’s it. That’s the whole finding.

And if you work in child safety, online protection, or AI governance, I think it should stop you in your tracks. Not because of what it demonstrates about artificial intelligence. Because of what it reveals about the systems we’ve built to protect children from it.

What Actually Happened

In May 2026, the Financial Times published a joint investigation with Alice an AI security company examining whether safety controls built into open-weight AI models could be removed after release.

They could.

The tool used is called Heretic. It works through a process called abliteration. The mechanics matter, so bear with me for a moment.

When AI developers train models to refuse harmful requests, that training doesn’t weave safety throughout the model’s architecture. It creates specific, identifiable pathways neural clusters dedicated to recognising harmful requests and generating refusals. Abliteration finds those pathways and removes them. The rest of the model its intelligence, its fluency, its ability to hold complex conversations remains entirely intact.

The result is a model that can do everything the original could do. It simply no longer declines.

By the time the investigation published, the tool’s creator reported that more than 3,500 modified model variants had already been created and distributed. Thirteen million downloads.

A second toolkit called OBLITERATUS arrived in March 2026, supporting 116 models across multiple compute tiers. Consumer hardware. No training required.

This is not a niche research curiosity. This is a commoditised ecosystem. It exists, it is growing, and it is largely invisible to the institutions we rely on to keep children safe.

Why This Is Different

I want to address something directly, because I know it will come up.

Automated harm isn’t new. Bots have been sending manipulative messages at scale for years. Click farms have been running fake social media identities since before most current policymakers understood what social media was. Surely this is more of the same?

It isn’t. And the distinction matters.

A script can send many messages. It cannot read emotional context. It cannot adapt dynamically when a child becomes hesitant or frightened. It cannot recover from an unexpected response. It cannot generate technically accurate, contextually appropriate manipulation tailored to a specific child’s vulnerabilities and then sustain that over days, weeks, and months without a human operator intervening.

An abliterated large language model can do all of those things. Simultaneously. Without anyone watching.

That is not scale.

That is cognitive adaptability.

And it changes the threat environment for child protection in ways that existing frameworks were simply not designed to address.

Think about the scenarios. A modified model sustaining a synthetic online relationship not one, but dozens simultaneously each one personalised, each one adaptive, each one patient in ways a human predator cannot afford to be. Trust built not through a single grooming conversation but through weeks of contextually intelligent interaction that no keyword filter will catch, because it doesn’t use the words keyword filters look for.

I am not telling you this is happening at scale right now. I am telling you that the capability exists, that the barrier to access it is lower than at any previous point in history, and that our safeguarding systems were not built to see it.

Where The System Breaks Down

Here is what troubles me most. Not the technology. The architecture.

The UK has serious, capable institutions working on AI safety and child protection.

The AI Security Institute evaluates models. Ofcom regulates platforms under the Online Safety Act. The National Crime Agency investigates serious exploitation. The Home Office manages public protection frameworks.

Each of these institutions does what it was designed to do. That is precisely the problem.

1. The AI Security Institute assesses models at the point of release. But the modification I’ve described happens after release on a consumer laptop, outside any developer’s infrastructure, in minutes.

2. Ofcom regulates platforms. But an abliterated model can operate entirely outside regulated platform environments. The harm, if it occurs, happens in a messaging app, a gaming environment, a direct channel not on a platform that Ofcom’s compliance regime was designed to reach.

3. The National Crime Agency engages when criminal conduct is identified. But the capability modification I’m describing isn’t criminal conduct. It’s a technical operation that happens upstream of any harm, in a space where no law enforcement threshold has been crossed.

Risk forms upstream. Governance engages downstream.

Between those two points, there is a gap. And in that gap, something is changing that none of our existing institutions are positioned to see.

This is not a criticism of any institution. It is a structural observation. The systems we built were built for a different threat environment. The threat environment has changed.

The Visibility Problem

When I talk to policymakers about this, the instinct is understandable. If the modification happens on a local laptop, can’t we monitor that? Can’t we track what models people are downloading and what they’re doing with them?

No. And we shouldn’t try.

Monitoring what a person downloads and modifies on their own device is not a proportionate response in a liberal democracy. It would require surveillance infrastructure that would face and should face significant civil liberties objections. It is neither technically feasible at scale nor legally appropriate. That path leads somewhere we don’t want to go.

But here’s what I keep coming back to. If we cannot see the model being modified, can we see what the modified model does?

An abliterated model, operating in an adversarial context, leaves behavioural signatures. The scale of simultaneous engagement. The adaptability of manipulation across different targets. The absence of the hesitations and inconsistencies that characterise normal human interaction. The persistence over time.

These are not content signals. Keyword filters won’t catch them. But they are signals. They are observable, if you have infrastructure designed to look for them at the right layer not the model layer, not the platform layer, but the interaction layer. The place where behaviour actually occurs.

That is a different kind of detection infrastructure from anything that currently exists in the child protection ecosystem. It requires different technical architecture, different legal frameworks, and a different institutional home.

Why I Building SecureHaven

I have spent a long time thinking about where harm begins.

Not where it becomes visible. Not where it becomes prosecutable. Where it actually begins in the behavioural patterns that precede consequence, in the signals that exist before disclosure, before detection, before a child finds the words to describe what has happened to them.

The systems we rely on for child protection are, almost without exception, reactive. They engage after harm has occurred. Sometimes long after. The evidence base they rely on is consequence reports, disclosures, investigations. By the time the system sees the risk, the risk has already become real for a child.

This is why I founded SecureHaven. Not because I thought the model layer needed policing. Because the interaction layer needed infrastructure that didn’t exist.

SecureHaven is a privacy-preserving behavioural safeguarding platform. It works by identifying the behavioural signatures of harm not the content of communications, but the patterns of interaction that precede and accompany exploitation before harm becomes the first point of visibility.

It is built on a simple conviction. We should not be waiting for children to tell us they have been harmed. We should be building systems that can see risk forming while it is still forming.

The FT/Alice findings matter to me because they confirm something I have believed for years. The threat environment for children online is not primarily a content problem. It is a behavioural problem. And the gap between where risk forms and where our systems currently engage is not a technical failure. It is a design choice we can reverse.

What Needs To Happen

I am not going to tell you the answer is more regulation. Or less regulation. The structural question whether safeguard removability is an inherent property of open-weight AI architectures that requires statutory response is genuinely open, and it deserves serious parliamentary examination rather than a rushed policy reaction.

What I will say is this.

The conversation needs to change. We have spent years debating AI safety in terms of content moderation, platform compliance, and model evaluation at release. Those conversations matter. They are not sufficient.

The questions that matter now are different. Can restrictions on harmful capability remain effective after a model is released? Where does risk actually form in the capability lifecycle? And what kind of infrastructure do we need to see it forming not after the fact, but in real time?

These are governance questions. They are also design questions. And they are questions that the institutions we currently rely on were not built to answer.

I think they are the most important questions in child online safety right now. I think the window to engage with them before the ecosystem of modified models grows further, before the behavioural signatures become harder to distinguish from noise is narrower than most policymakers realise.

The model isn’t the problem. The visibility gap is.

Naveen Vasudeva is the founder of SecureHaven, a privacy-preserving behavioural safeguarding infrastructure platform focused on child safety in AI-mediated digital environments. He writes on policy, online safety, and strategic risk.

For the last thirty years, society has become increasingly sophisticated at managing the consequences of harm. We have built larger safeguarding systems, expanded victim support services, created specialist policing units, introduced reporting mechanisms, strengthened regulation and developed more detailed ways of calculating what harm costs once it has occurred.

Child sexual abuse shows this clearly. In 2021, the Home Office estimated the lifetime economic and social cost associated with children who experienced contact child sexual abuse during a single year at least £10.1 billion. That figure did not simply reflect immediate public spending. It attempted to capture healthcare costs, social care costs, criminal justice costs, lost economic output and the long-term impact of trauma.

Thirty years ago, society knew children were being harmed. Today, we can estimate the financial and social consequences of that harm with a level of precision that would once have been difficult to imagine. We can model the burden across public services. We can calculate future economic loss. We can attach a lifetime cost to a single year’s victims.

That is an extraordinary capability, but it also exposes an uncomfortable imbalance. We have become far better at calculating the cost of harm than measuring the value of preventing it.

The Prevention Contradiction

For decades, we have repeated the same phrase: prevention is better than cure. Governments say it. Healthcare systems say it. Safeguarding bodies say it. Businesses say it. Cybersecurity teams say it. The idea is almost impossible to disagree with. If we can prevent exploitation, illness, abuse, crime, fraud or system failure before the damage occurs, then we should.

Yet our systems often behave differently. Funding increases after harm becomes visible. Urgency appears after consequences emerge. Measurement improves after victims enter systems, crimes are recorded, patients arrive in hospital, breaches occur or public services absorb the cost.

This is the contradiction at the centre of downstream consequence management. We claim to value prevention, but most of our evidence, funding and accountability still sit after the event.

This cannot be explained by a lack of intent. The last thirty years have included public health campaigns, early intervention programmes, safeguarding reforms, community initiatives, risk management frameworks, awareness campaigns and prevention strategies. The language exists. The policy intent exists. The moral argument exists.

Yet the centre of gravity remains downstream.

Why Consequences Win

The reason may sit in the way evidence is created. Consequences produce records. A victim enters a system. A crime appears in statistics. A patient receives treatment. A breach generates a report. A cost appears in a budget. Once harm becomes visible, it becomes easier to count, easier to explain and easier to fund.

Prevention works differently. When prevention succeeds, the outcome disappears. The crime does not happen. The child does not enter the safeguarding system as a victim. The hospital admission does not occur. The breach does not need to be investigated. The cost is never incurred.

That means the better prevention works, the harder it becomes to see.

The Measurement Problem

This creates a measurement problem that sits underneath almost every debate about early intervention. We can calculate victims, incidents, arrests, prosecutions, admissions, referrals, breaches and costs. We are much less confident when asked how many people were protected, how many harmful pathways were interrupted, how many victims never came into existence, or how much public cost was avoided because action happened earlier.

That does not mean prevention has failed. It means consequence measurement has matured faster than prevention measurement.

For child sexual abuse, the Home Office can estimate the lifetime cost associated with a single year’s victims. What is much harder to find is an equivalent measure showing how many children were protected before abuse occurred, how many grooming pathways were interrupted, or how much lifetime cost was avoided by earlier intervention.

What We Count Shapes What We Fund

This is not a small gap. It helps explain why downstream systems keep attracting weight. Societies tend to fund what they can count. They count harm more easily than the absence of harm. They count failure more easily than interruption.

For thirty years we have invested heavily in understanding the consequences of harm. We have improved reporting. We have improved data collection. We have improved economic modelling. We have improved our understanding of trauma and long-term societal impact.

The result is that we now possess increasingly sophisticated evidence explaining why harm is expensive.

What remains far less developed is an equivalent body of evidence explaining the value of preventing that harm in the first place.

Measuring Interruption

The prevention question may therefore need to change. Instead of asking how we prove what would definitely have happened if nobody acted, we may need to ask whether a harmful trajectory was identified and interrupted before it became harm.

That distinction matters. Cybersecurity already works in this way. Security teams do not prove that every blocked attack would have become a breach. They measure attacks disrupted, vulnerabilities remediated, intrusion attempts prevented and threat pathways interrupted. The interruption itself becomes evidence of value.

Safeguarding has historically focused on victims, incidents, referrals and consequences. These measures are essential, but they tell us what happened after the fact. They tell us very little about the pathways that were successfully disrupted before harm became visible.

The challenge is not proving that every interrupted pathway would have ended in harm. That is impossible. The challenge is recognising that interruption itself may be a meaningful indicator of value.

The Next Challenge

For thirty years, we have become increasingly skilled at calculating the cost of harm after it occurs. The Home Office’s £10.1 billion estimate demonstrates just how sophisticated that capability has become.

The next challenge may be very different. It may not be learning more about the consequences of failure. It may be learning how to recognise, measure and value success before failure occurs. Because if prevention is genuinely better than cure, then understanding the cost of harm is only half of the equation.

The other half is understanding the value of harm that never happened.

The United Kingdom is currently engaged in one of the most significant safeguarding debates of the digital age. The Online Safety Act has moved from legislation to implementation, political pressure continues to build for further action, and international examples such as Australia’s social media restrictions are increasingly being cited as evidence of what should happen next.

Supporters point towards reductions in underage access and argue that meaningful action is finally being taken. Critics point towards VPNs, alternative accounts and migration into other digital environments as evidence that such interventions are ultimately ineffective.

What struck me, however, was not the policy itself. It was the way success was being discussed.

The assumption sitting beneath much of the debate appears relatively straightforward. If access to a platform is reduced, then harm should reduce as well. At first glance that feels entirely reasonable. Social media restrictions are not being introduced because policymakers object to account ownership. They are being introduced because they believe doing so will reduce grooming, exploitation, coercion, cyberbullying, harmful content exposure and a range of other safeguarding concerns.

The more I reflected on the debate, the more I found myself returning to a question that extends far beyond Australia, social media or even safeguarding itself. Before we can determine whether something is working, we first need to understand what success looks like. More importantly, we need to understand whether the things we are measuring actually tell us what we think they do.

When Metrics Become Outcomes

One of the recurring lessons from nearly three decades working in cybersecurity, governance and behavioural risk is that organisations rarely suffer from a lack of measurement. More often, they suffer from an abundance of it.

Every organisation has dashboards, metrics and reports designed to demonstrate progress. Audit functions produce measurements. Compliance functions produce measurements. Security functions produce measurements. Regulators demand measurements. Boards consume measurements. Entire governance structures are built around them.

The challenge is not the existence of metrics. The challenge is what happens when the metric becomes detached from the outcome it was originally intended to represent.

A company passes an audit and assumes risk has reduced. An organisation completes mandatory awareness training and assumes behaviour has improved. A regulatory requirement is met and assumes resilience has increased. None of these conclusions are necessarily wrong. They are simply assumptions that require further evidence. The metric demonstrates that an activity occurred. It does not automatically demonstrate that the objective was achieved.

What makes this particularly difficult is that institutions have powerful incentives to optimise for what can be measured. Boards require evidence. Regulators require reporting. Governments require demonstrable progress. Investors require assurance. The result is entirely rational. Organisations naturally gravitate towards metrics that are visible, reportable and defensible because those metrics allow accountability to be demonstrated.

Over time, however, a subtle shift can occur. The metric begins life as a proxy for success but gradually becomes the thing being optimised for. The original objective remains, but it becomes increasingly difficult to distinguish from the measure that was created to represent it.

Watching the safeguarding debate unfold, I increasingly wondered whether online safety might be vulnerable to exactly the same dynamic.

Children Do Not Inhabit Platforms

Much of the public discussion continues to treat platforms as though they are the primary unit of analysis. That is understandable because platforms are visible. Platforms can be regulated. Platforms can be audited. Platforms can be measured.

Yet when we shift our perspective from regulation to safeguarding, the picture becomes less straightforward.

Children do not inhabit platforms. They inhabit relationships.

A friendship may begin on one platform, continue through a gaming environment, move into a group chat, migrate into an encrypted messaging application and eventually extend into entirely different digital spaces. Relationships are fluid. They move. They evolve. They are not constrained by platform architecture in the same way regulators, technology companies and policymakers often are.

This matters because many forms of harm are fundamentally relational rather than technological. Grooming does not occur because a platform exists. Coercion does not emerge because an application was installed. Dependency, manipulation and exploitation develop through human interaction. Technology provides the environment within which they occur, but the behavioural dynamics themselves frequently operate across multiple environments rather than within a single one.

Platforms are where policymakers regulate, where companies moderate and where compliance is measured. Relationships operate according to none of those boundaries. The more digital interaction becomes distributed across multiple environments, the more we may find ourselves measuring the characteristics of the platform whilst losing sight of the dynamics of the relationship itself.

The Visibility Problem

Historically, many safeguarding systems benefited from visibility. Something happened. Someone observed it. Evidence existed. A concern was raised. An intervention followed. Whilst imperfect, this model broadly reflected the environments within which many safeguarding frameworks evolved.

Today, the visibility conditions themselves appear to be changing. Communication increasingly spans multiple environments. Interaction becomes fragmented across platforms. Encryption continues to expand. Private communities are becoming more prevalent. Artificial intelligence-mediated interaction is beginning to emerge as a meaningful factor in its own right. Behaviour develops across time, across platforms and across contexts. Many of the conditions associated with harm emerge gradually rather than through singular observable events.

Trust forms long before exploitation becomes visible. Dependency develops long before concern is raised. Manipulation often occurs long before an external observer has sufficient evidence to intervene. The challenge is therefore not simply whether harm exists. The challenge is whether the people and institutions responsible for safeguarding retain sufficient visibility to recognise what is happening before harm becomes obvious.

Increasingly, I find myself viewing visibility as a safeguarding resource in its own right. Not visibility in the surveillance sense, but visibility in the safeguarding sense: the ability to recognise behavioural patterns, changes in relationships and emerging indicators of concern before they mature into something more serious.

The challenge is therefore not simply whether visibility is changing. The more important question is what role visibility actually performs within safeguarding systems. That distinction becomes clearer when we separate two functions that safeguarding discussions often treat as equivalent.

Upstream Risk Visibility Versus Downstream Protection

One of the assumptions sitting beneath many safeguarding discussions is that visibility and protection are largely the same thing. In practice, they are often very different.

Most safeguarding systems are designed around downstream protection. They intervene once concerns become visible, once sufficient evidence exists, once reports are raised, or once behaviour crosses a threshold that justifies action. These capabilities remain critically important. They prevent harm, support victims and provide mechanisms through which society can respond when concerns emerge.

The difficulty is that many forms of grooming, coercion, manipulation and exploitation do not begin at the point where intervention occurs. They begin much earlier. Relationships form before concerns are raised. Trust develops before coercion becomes visible. Dependency emerges before exploitation is recognised. Behavioural escalation often occurs long before any individual event appears sufficiently significant to trigger a safeguarding response.

This distinction highlights the difference between recognising harm and recognising progression.

• Downstream protection concerns our ability to respond once harm becomes visible.

• Upstream risk visibility concerns our ability to recognise the conditions through which harm is developing before escalation occurs.

Historically, safeguarding systems often benefited from a degree of upstream visibility. Parents, teachers, communities and institutions possessed contextual awareness that allowed behavioural changes, relationship dynamics and emerging concerns to be recognised before they matured into more serious problems. Those signals were imperfect. They were also structurally available in ways that are no longer guaranteed.

As interaction becomes fragmented across multiple platforms, encrypted environments and private digital spaces, the availability of upstream visibility appears less certain than it once was. Safeguarding systems may remain highly effective at downstream protection whilst simultaneously losing sight of the earlier conditions through which harm develops. A system can continue intervening successfully, investigating effectively and protecting appropriately. Yet if the point at which visibility begins moves progressively further downstream, intervention may occur later in the lifecycle of the problem than it once did.

What Does Behavioural Risk Look Like?

If the safeguarding challenge increasingly concerns upstream visibility rather than simply downstream response, an obvious question follows.

What exactly are we attempting to make visible?

Historically, safeguarding systems have focused upon incidents, disclosures, reports, policy violations and observable harms. These remain essential. They provide the basis upon which intervention occurs. Yet they are fundamentally event-driven measures. They tell us that something has happened.

Behavioural risk operates differently.

Rather than focusing upon individual events in isolation, behavioural risk concerns the progression of conditions through which harm may develop over time. The question is not whether a particular message, image or interaction is harmful. The question is whether a pattern of behaviour is emerging that begins to resemble pathways associated with grooming, coercion, manipulation, dependency, exploitation or other forms of harm.

This distinction matters because many harmful outcomes are preceded by a period of behavioural progression that appears unremarkable when viewed as a series of isolated events. Trust develops gradually. Boundaries shift incrementally. Dependency forms over time. Influence accumulates through persistence rather than through singular moments. What appears insignificant on a given day may become highly significant when understood as part of a broader trajectory.

The challenge therefore is not simply detecting events. It is understanding progression.

Understanding behavioural progression requires us to think differently about risk. The significance of a pattern often emerges not from a single interaction but from the accumulation of many interactions across time. Persistence may matter more than intensity. Repeated boundary testing may matter more than any individual exchange. A gradual shift in the nature of a relationship may be more significant than a single observable event. What appears ordinary when viewed in isolation can take on a very different meaning when understood as part of a broader behavioural trajectory.

Viewed through this lens, behavioural risk is not a prediction problem. It is not an attribution problem. Nor is it an attempt to determine what someone is thinking. It is an attempt to understand whether observable behavioural patterns are increasingly aligning with pathways that have historically been associated with harmful outcomes.

The safeguarding question therefore changes.

Instead of asking whether harm is visible, we begin asking whether the conditions through which harm develops are becoming visible.

The Friction-Visibility Trade-Off

This is one of the reasons I find the Australian experiment so interesting.

Restricting access creates friction. Friction matters. It changes behaviour, alters pathways and may reduce exposure to certain forms of risk. In many respects that is precisely what policymakers hope to achieve.

The more difficult question concerns what happens beyond the immediate effects of the intervention.

If interaction migrates towards environments that are more fragmented, more private or more difficult to observe, then the intervention is affecting more than participation. It is also affecting visibility. That does not make the intervention wrong, nor does it imply that restrictions should not exist. It simply suggests that we may be dealing with two different variables operating simultaneously. One concerns access. The other concerns visibility.

• One may be measurable within months.

• The other may take years to properly understand.

• The friction may be temporary.

• The change in visibility may be structural.

If visibility is a safeguarding resource, then interventions that inadvertently diminish it deserve the same scrutiny as interventions that fail to reduce harm. The objective cannot simply be compliance, participation reduction or platform accountability. The objective must remain safeguarding effectiveness.

The Question That Remains

Perhaps Australia’s restrictions will ultimately prove highly successful. Perhaps they will demonstrate meaningful reductions in harm. Perhaps they will become a model adopted elsewhere. It is still too early to know.

What interests me more is the possibility that the Australian experience is exposing a much larger question about how modern societies evaluate safeguarding itself.

For decades, safeguarding systems have operated within environments where visibility, evidence and intervention were closely connected. As digital environments become more fragmented, more persistent and increasingly distributed across multiple platforms, those assumptions become harder to take for granted. The challenge is no longer simply whether harmful behaviour exists. The challenge is understanding whether our ability to recognise, interpret and respond to that behaviour is evolving at the same pace as the environments within which it develops.

That is why I keep returning to the issue of measurement. Not because metrics are unimportant, but because they shape how institutions understand progress. What gets measured gets reported. What gets reported gets governed. What gets governed ultimately influences where attention, resources and policy intervention are directed.

The longer I think about the current safeguarding debate, the less I see it as a debate about social media and the more I see it as a debate about visibility. Not whether visibility should be unrestricted, but whether safeguarding systems can remain effective if the conditions that make behavioural risk observable continue to diminish.

If that is the challenge, then the question facing policymakers may not simply be how to reduce access to harmful environments. It may also be how to preserve, create or enhance the forms of visibility that allow safeguarding systems to recognise risk before harm becomes obvious.

For much of the past two decades, the debate has focused on content, platforms and access. The next phase of safeguarding may require us to think much more seriously about behavioural progression, upstream visibility and the conditions through which harm develops long before it becomes visible enough to trigger a response.

In the late 1990s, British investigators uncovered something hidden inside the early internet that would fundamentally change how governments understood online harm.

The investigation became known as Operation Cathedral.

At the centre of the operation was an international online network known as the Wonderland Club, a hidden community operating through password-protected forums and anonymous identities during the earliest years of the public internet. Members distributed abusive material, exchanged information, coordinated activity internationally, and operated largely beyond traditional institutional visibility. This was before smartphones, before social media feeds, before recommendation algorithms, and before artificial intelligence entered ordinary life.

At the time, the internet still felt slow, technical, and strangely innocent.

Families connected through noisy dial-up modems that occupied household phone lines. Parents bought home computers believing they were educational. Schools spoke about digital futures with optimism. Chat rooms and message boards were becoming popular, but the language we now use constantly, online grooming, behavioural manipulation, algorithmic amplification, digital radicalisation, barely existed in mainstream public discourse.

Most adults simply did not understand what the internet was becoming. Governments largely viewed it as infrastructure: a communications tool sitting on top of ordinary life rather than an environment capable of reshaping human interaction itself. Then investigators from the UK’s National Crime Squad discovered hidden online communities operating internationally through anonymity, secrecy, reinforcement, and coordinated exploitation.

One of the moments that accelerated the wider international investigation involved the live-streamed abuse of an eight-year-old girl over the internet while offenders watched remotely and encouraged the assault in real time. That detail matters because it completely changes the historical context of today’s debate.

Long before modern social-media platforms existed, investigators were already confronting digitally mediated exploitation operating across borders under conditions of anonymity and fragmented visibility.

The victims were not statistics.

They were children growing up inside a new kind of environment society itself barely understood yet.

At the time, many parents still viewed the internet as educational, technical, or harmlessly experimental. Children used chat rooms and online services from family homes while parents often had little understanding of who they were interacting with, how identities could be concealed online, or how hidden communities were already forming underneath the surface of the early web. For investigators, the discovery was deeply alarming not simply because of the criminality itself, but because of what it revealed structurally.

The internet had removed geography.

Offenders no longer needed to operate locally. Hidden communities could now form internationally, persist continuously, reinforce behaviour collectively, and remain largely invisible to traditional policing structures built around physical locations, observable communities, and geographically constrained offenders.

Modern cyber forensics barely existed. Investigators manually traced digital evidence across multiple countries while governments themselves were still trying to understand what the internet was becoming. Computers were seized. Deleted material was recovered. Hidden online identities were painstakingly linked back to real individuals. Victims were identified across multiple jurisdictions.

The resulting convictions did not simply put offenders behind bars. They shattered the illusion that digital distance provided anonymity without consequence.

Public reaction at the time was a mixture of shock, confusion, and disbelief. For many people, the internet had still largely been perceived as futuristic, educational, and commercially exciting. The idea that hidden international exploitation networks were already operating inside these emerging digital environments was deeply unsettling. But society still largely interpreted the issue through the lens of criminality and illegal material.

What far fewer people yet understood was that the internet itself was beginning to evolve from a communications system into something far more psychologically immersive. That distinction may be one of the most important and least understood transitions of the modern era.

The Pattern We Still Haven’t Fully Understood

Looking back now, what is striking is how familiar many of the dynamics revealed during Operation Cathedral still feel today. Anonymous identities. Hidden communities. Manipulation operating privately beyond ordinary visibility. Reinforcement unfolding inside environments parents, schools, and institutions struggled to fully see or understand.

The technologies changed dramatically over the next twenty-five years.

The underlying human dynamics changed far less.

That is why many modern debates around online harm increasingly feel incomplete. The discussion often collapses into highly binary positions: social media versus children, phones versus mental health, regulation versus free speech, platforms versus parents. Comparisons are frequently drawn with the tobacco industry, implying digital platforms function primarily as harmful products requiring stronger restriction and liability.

There is truth within that comparison. Platforms absolutely amplify immersion, emotional dependency, psychological reinforcement, and social influence at unprecedented scale. But the comparison is also structurally incomplete.

Cigarettes do not adapt. Human systems do.

The internet did not create coercion. It did not create predatory behaviour. It did not create manipulation. It did not create exploitation. Human beings did that long before the internet existed.

What technology changed was the scale, persistence, anonymity, accessibility, and invisibility through which those behaviours could now operate. The dark web strengthened anonymity. Social media mainstreamed immersion. Smartphones made digital identity continuous. Artificial intelligence may now industrialise synthetic manipulation itself. But the underlying architecture was already visible during the earliest years of the public internet.

That is the part history makes difficult to ignore.

Safeguarding Has Seen This Pattern Before

In many ways, this follows a much older historical pattern. For most of modern British history, safeguarding evolved around environments society could physically observe: homes, schools, families, and communities. Harm was still often hidden, but the environments themselves remained visible.

· The Children and Young Persons Act 1933 focused primarily on visible abuse, neglect, and physical cruelty.

· Wartime evacuations during the Second World War exposed hidden neglect and abuse inside ordinary homes that institutions had previously failed to see.

· The death of Dennis O’Neill forced Britain to confront failures in foster-care oversight.

· The murder of Maria Colwell exposed catastrophic failures in information-sharing between agencies already aware of risk.

· The Children Act 1989 shifted safeguarding further toward emotional wellbeing and developmental harm.

· The deaths of Victoria Climbié and Baby P again revealed systems where multiple agencies each held fragments of visibility but failed to connect them in time.

The pattern is remarkably consistent.

Major safeguarding reforms usually arrive after society realises existing systems were seeing harm too late. Digital environments changed that relationship entirely.

Today, interactions increasingly occur privately inside encrypted systems. Manipulation develops gradually rather than explicitly. Synthetic identities complicate attribution. Parents, schools, platforms, police, and safeguarding agencies often each see only fragments of a much larger picture. We are now trying to police a hyper-connected, algorithmic world using visibility models largely designed for the era of the neighbourhood watch.

The environment evolved faster than the visibility model. That may ultimately be the real lesson connecting Operation Cathedral to the present day. Not that technology suddenly became dangerous. But that digital environments evolved into socially immersive systems faster than institutions, governments, and societies fully understood the implications of living inside them.

The Real Challenge Is Upstream Visibility

The question, then, is not whether societies should simply become more technologically restrictive. Nor is it whether platforms alone should carry the entire burden of responsibility.

The deeper challenge is whether safeguarding systems built around explicit evidence and downstream visibility can still operate effectively once harmful trajectories increasingly form upstream of obvious intervention thresholds. Historically, institutions intervened once harm became visible: a visible injury, a disclosure, an identifiable offender, a criminal image, a direct threat.

But exploitation rarely begins at the point society finally recognises it. It develops gradually through interaction, trust formation, coercion, dependency, secrecy, emotional manipulation, reinforcement, and escalating isolation long before a single moment clearly announces itself as dangerous.

That is what makes modern digital environments so difficult to govern.

The challenge is no longer simply detecting explicit harmful content once it appears. It is the difference between waiting for evidence of harm after escalation and recognising patterns of grooming, dependency, secrecy, and isolation before crisis becomes explicit.

That does not require abandoning privacy. If anything, the opposite may be true.

The more psychologically immersive digital environments become, the more important it becomes to develop safeguarding models capable of operating under conditions of partial visibility rather than assuming unrestricted access to human communication itself. No single institution will ever hold complete visibility inside modern digital environments. Parents see fragments. Schools see fragments. Platforms see fragments. Law enforcement sees fragments. Safeguarding professionals see fragments.

Which means safeguarding increasingly becomes a problem of partial signals, contextual interpretation, and coordinated response rather than centralised control. The roadmap forward is unlikely to emerge from any single intervention alone. It will require layered safeguarding models capable of combining human judgement, behavioural context, privacy-preserving signal analysis, institutional coordination, and proportionate escalation without collapsing into either mass surveillance or institutional blindness.

Continuing to rely entirely on downstream visibility in environments increasingly shaped by encryption, anonymity, immersion, and AI-mediated interaction is becoming progressively harder to defend. Societies repeatedly realise harm was forming long before existing systems were designed to properly see it.

The uncomfortable possibility is that we may be approaching another one of those moments now.

Why I Keep Coming Back To This

My interest in this subject is not ideological. I am neither fundamentally anti-technology nor blindly optimistic about it.

There are legitimate concerns on all sides of the current debate: privacy, state overreach, platform accountability, free expression, surveillance, child protection, parental responsibility, and the developmental impact of persistent digital immersion. To be objective requires examining those tensions honestly.

But my own focus increasingly comes back to one underlying question: How do societies reduce preventable downstream harm if harmful trajectories are increasingly forming before explicit visibility exists?

That, ultimately,is why I have spent the past several years focused on earlier safeguarding visibility. Not because I believe technology itself is inherently good or evil. But because safeguarding history repeatedly shows the same pattern emerging across generations:

harm often develops gradually, relationally, and invisibly long before institutions clearly recognise the trajectory unfolding in front of them.

And if Operation Cathedral revealed anything more than twenty-five years ago, it may be this: the greatest danger was never simply what the internet allowed people to see.

It was how quickly it changed the conditions under which harmful human behaviour itself could hide, scale, and evolve before society fully understood what it had become.

I still remember being woken early in the morning by my father and told to come into my parents’ room. The BBC World Service was playing quietly in the background while adults around me tried to understand what was unfolding.

At some point, I remember hearing a statement broadcast along the lines of: “If there is any outside interference, Kuwait will become a graveyard.” At fourteen, words like that do not fully land immediately.

You hear them. But you do not yet understand what they mean. What I remember more clearly was the atmosphere. The sudden shift in behaviour.

Adults moving differently. Phone calls. Confusion. Urgency. Conversations happening in fragments.

The feeling that something invisible had changed in the environment before I fully understood what that change actually was. My sister and I still believed everything would somehow return to normal by the evening because we had a party to go to later that day.

That now feels surreal to me. I think children often adapt psychologically to dangerous environments before they fully comprehend the danger itself.

The realisation came more slowly. A few days later, a palace close to where we lived was shelled. That was the moment the abstraction disappeared. We were no longer watching a geopolitical event unfolding somewhere else.

We were inside it.

As British nationals, there was also an underlying awareness that visibility itself could become dangerous. Kuwait had effectively become a police state overnight. People were being identified, tracked, and in some cases taken as what Iraq referred to as “guests”. I remember my father and older relatives organising food, water, and supplies. Adults trying to project calm while quietly calculating risk around us.

As a child, what stays with you is not always the chronology. It is the emotional texture. The uncertainty. The waiting. The feeling that normal life had somehow fractured, even though parts of daily life still continued around you. Months later, we eventually left Kuwait by bus alongside dozens of other people.

The journey took days. Some memories remain strangely vivid. Others barely exist at all. I remember sitting on the bus eating boiled eggs at one point, though I cannot remember where they came from. I remember people singing. I remember a man playing a guitar. I remember a woman holding a baby. I cannot remember most of their faces. I remember where I was sitting, but not who was sitting beside me.

Memory does strange things under prolonged uncertainty.

Eventually we reached the Iraq–Jordan border. I remember the relief. I remember something else as well. The strange emotional emptiness that comes after surviving something your mind has not fully processed yet. People slept beside luggage. Adults stayed awake. Nobody seemed entirely certain where life would go next.

At fourteen, I did not yet have the language for that feeling.

I only understood much later that human beings adapt to altered environments remarkably quickly, often before they fully understand what those environments are doing to them psychologically. That pattern would reappear many times throughout my life.

In coercive control. In cybersecurity. In behavioural manipulation.

Eventually, in the digital environments children now grow up inside every day. Because the most consequential threats are rarely the ones that arrive loudly. They are the ones that slowly reshape the environment around us until a new reality begins to feel normal.

Part II continues next week.

Most governments still believe the answer to online child safety is greater visibility.

· More scanning.

· More moderation.

· More inspection.

· More access to private communications.

But there is a problem with that assumption. Modern digital harm no longer develops primarily through explicit content. It develops through:

• trust

• manipulation

• coercion

• escalation

• emotional dependency

• behavioural conditioning

Increasingly, it develops inside encrypted environments that platforms themselves cannot fully see. This is the structural shift very few people are willing to confront directly. The internet has moved from: visible platforms to: private digital ecosystems

At the exact same moment that artificial intelligence is making manipulation dramatically easier. That means governments are now facing a collision between two realities:

1. Encryption and privacy rights are becoming foundational to digital life.

2. Traditional safeguarding systems depended on visibility.

The result is policy panic. The instinctive response is now: “If we can inspect more content, we can stop more harm.” But that logic is increasingly flawed. Predatory behaviour adapts. If one platform becomes hostile to exploitation, activity migrates elsewhere:

• Discord

• Telegram

• gaming chat

• peer-to-peer ecosystems

• smaller encrypted applications

• voice interaction

• ephemeral communication

• AI-generated personas

The adversary changes behaviour faster than the regulatory model changes architecture. That is why this debate matters far beyond Meta, Instagram, or one particular platform decision. This is not simply a moderation problem anymore. It is now a systems problem.

Weakening encryption may create more visibility in the short term, but it also creates:

• new attack surfaces

• new insider risks

• new abuse potential

• new surveillance concerns

• new cybersecurity vulnerabilities

This is why many technologists, cryptographers, and privacy experts strongly oppose blanket inspection models. At the same time, governments are not wrong about the safeguarding problem either. Children are increasingly exposed to:

• grooming

• sextortion

• synthetic manipulation

• AI impersonation

• coercive escalation

• behavioural exploitation

inside environments where traditional systems cannot intervene early. That is the real tension and it is why the current debate feels so unstable. The uncomfortable reality is that there are only four broad models available:

Model - Consequence

1. Full encryption with no safeguarding layer - Privacy preserved, visibility collapses

2. Full inspection and surveillance - Visibility improves, privacy collapses

3. Platform moderation only - Reactive and incomplete

4. Privacy-preserving behavioural safeguarding - Technically difficult, but potentially sustainable

Privacy-preserving behavioural safeguarding that identifies escalating risk patterns without centralising private conversations. Because the deeper truth is this:

The future of safeguarding cannot depend on destroying the privacy architecture the modern internet now relies upon, but equally, the current model of waiting until harm becomes visible is no longer sufficient either. That is the real policy challenge emerging underneath this entire debate and most systems are not yet designed for it.