YouTube no longer allows ‘instructional hacking and phishing’ videos [Update]

Yesterday, YouTube updated its list of what it considers “harmful or dangerous content.” One notable addition is of “instructional hacking and phishing” videos, with the Google company reportedly already pulling existing content and issuing strikes to creators.

On July 2nd, YouTube Help added “more examples of content that violates” its policy regarding “harmful or dangerous content.” The list includes “Extremely dangerous challenges,” “Violent events,” and “Eating disorders.”

The last item is now “Instructional hacking and phishing,” which the video site identifies as “showing users how to bypass secure computer systems or steal user credentials and personal data.” The support page does note that “there are no policy changes.”

Enforcement is already underway with one YouTube creator noticing a strike on their channel that creates “videos for aspiring ethical hackers, computer scientists, and the infosec community.” They report that “existing content is being flagged and pulled,” with the strike preventing them from uploading new videos for a week.

Update: YouTube this afternoon restored videos on the Null Byte channel, including one that resulted in the strike. According to the Google company, there were no specific policy changes yesterday and that the new examples just happened to coincide with the mistaken removal. The video service does have an exception for videos where the “primary purpose is educational, documentary, scientific, or artistic (EDSA).”

Thanks to HUNDREDS OF ANGRY COMPUTER NERDS, YouTube has restored our videos, and our video on launching fireworks over Wi-Fi will be going up! I love this community, thank you for supporting me, and stay tuned for more great stuff! https://t.co/wswvRsX82q

— Kody (@KodyKinzie) July 3, 2019

While similar to other rules preventing “Instructions to kill or harm,” “Hard drug use or creation,” and “Instructional theft,” there is an educational and informational purpose to videos that teach about hacking.

A thread on Twitter describes why losing this resource hurts the infosec community, with the original affected YouTuber noting how this could stop those wanting to learn about security in the future.

In enforcing rules against extremism, YouTube has been criticized for inadvertently removing videos dedicated to debunking, and other historical examples posted by educators. The algorithm was not able to distinguish between genuine content and the targeted videos.

YouTube likely does not want to be associated with a place to learn about hacking, but there is clearly a distinction to how videos are used. In the past, the company has been particularly proud of how it’s a resource for millions of learners around the world. We’ve reached out to YouTube for a comment on this change.