I think we are about to see some more unexpected consequences of government technology strategy. It starts with the new requirement for age verification for access to adult services. I mean services that grown up people might want to use that they do not necessarily want other people to know about: gambling, fantasy football leagues, Daily Mail comments, Dungeons and Dragons discussions groups and so on. The focus is naturally on porn, which is understandable, but in a way it is also useful. If we can fix the “identity problem” for porn then we can fix it for most other things. But let’s start at the beginning.
The government wanted age verification for adult services to start earlier in the year but announced a nine month delay in the proposed introduction because they are still consulting (not with me, incidentally) on how to do it. In fact they’ve never known how to do it. When the government first came up with the idea to require age verification, they had no real idea how to implement it. Ofcom’s guidance suggested option such as confirmation of credit card ownership to cross-checking a user’s details with information on the electoral register.
These ideas are bad and are certain to lead to disaster, because they require the adult service provider to know who you are. This means that when they get hacked, as they inevitably will be, the personal details of the customers will be available to all. And, as actually happened in the case of the Ashley Madison hack, people will die. It’s not funny. Whether its adult web sites, or counselling services, or gay dating, or drug addiction helplines or whatever, where I go online is my business so long as I’m not breaking the law.
None of us would disagree with the need to protect children from the excesses of the online world and age verification is a good thing. But how you implement it makes a huge difference to outcomes, and having some knowledge of identity management, the internet and the real world can help to steer policy. The government seems short in these areas, with the consequence that in the Department of Culture, Media and Sport (DCMS) impact assessment report noted that “age verification solutions could increase the risk of online fraud…”
I’d assumed that banks would seize this opportunity to establish a modern, sophisticated version of the Nordic “Bank ID” to create a platform that would keep their customers safe and open up a revenue stream that is not based on payments. In essence, I was thinking that when you go to create an “Adult ID” you would get bounced to your bank where you would log in using the mandatory two-factor authentication (2FA) and the bank would then return a cryptographic token confirming that a) you exist, b) the bank knows who you are and c) you are over 18. They could add an optional d) you can charge against this token, but that’s not the focus of this discussion.
Since adult payments are lucrative, and since an effective privacy-enhancing age check would increase the use of such services, and since a tokenised approach would also reduce fraud and chargebacks, there are real incentives for the stakeholders to get out their and put something in place
The banks haven’t developed anything to help their customers online, so as has so often been the case in the history of technology, the porn guys have stepped in to fix it for themselves (just as they did with credit card payments and video streaming). Mindgeek, the company behind PornHub is launching its own “AgeID” service in the UK and is anticipating 25 million users.
Their system will require users to sign up with an email address and password, provide their name, address, date of birth and telephone number. Mindgeek will then use a “third party mechanism” to determine whether the user is 18. Users will then use AgeID to access pornographic sites around the web. MindGeek will charge other pornography sites to use its solution. But because of its market dominance, campaigners fear it will end up the defacto age verification standard, handing even more power to the biggest porn provider around. The articles I’ve read don't mention how AgeID will identify customers and establish that they are over 18, but given earlier comments on the topic by the then-minister for digital things, I assume that they will do stuff like ask you to show your passport. Since the Home Office are the only people who can check wether passports are valid, this means that they will know that you’ve been naughty. What they will do with foreign passports I’ve no idea. Given that in the famous case of Malaysian Flight 370 it turned out that two people were on board with stolen passports, I should imagine that the theft of passports will shoot up because if airport security can’t spot a stolen passport, I’m pretty sure that porn security won’t either.
You can see why Mindgeek is keen to do this. If they can establish themselves as the UK’s standard log in for adult services of all kinds, then they will amass a treasure trove of data on who has been visiting what and how often.
Comments
Post a Comment