Skip to main content

POST Web regulation the UK way, part 97: age verification

Next month, a year behind schedule, the UK Government’s new online age verification (AV) law comes into effect. The Department for Culture, Media and Sport (DCMS), the section of the British government “in charge” of the web decided to stop children from watching porn online (which I’m sure we would all agree with) by bringing in the new law. It excludes websites on which less than a third of content is pornographic material and where it is provided free of charge. So web sites that have more than one-third pornographic content (I know, I know, it depends on what you mean by one-third and it depends what you mean by pornographic and it won’t make the slightest difference, but whatever) will have to implement age verification. 

But how?

When this legislation was originally introduced, OFCOM put forward the idea of using credit cards or the electoral register, both of which are bad ideas and certain to lead to disaster. Hence I was surprised to see in the The Daily Mail, that one of the "suggested methods" to verify the age of viewers is to require browsers to input bank card details to all pornographic websites they visit.

Suggested by whom, I wondered? It could not be anyone who knows how anything actually works, which made me suspect it must have come from someone in government. A bit of ducking* and the BBC indeed confirms that “ministers have suggested” this idiotic, backward-looking, anti-competitive and life-threatening approach to the problem.

It is idiotic because making people provide personal details in order to access web sites could lead to their data being compromised and there is an extreme risk of privacy loss for any person using the service.

It is backward-looking because it bends a fifty year old technology to a purpose it was never designed for. Indeed, the idea that people have one identity is fundamentally outdated.

It is anti-competitive because it is inevitable that the AgeID system offered by Mindgeek (who own the biggest porn sites) will come to dominate. Hence Mindgeek will know who is watching what porn even when it is not on their own sites.

It is life-threatening because, as I have pointed out before, when the adult sites get hacked, as they inevitably will be, the personal details of the customers will be available to all. And, as actually happened in the case of the Ashley Madison hack, people will die. It’s not funny.

The introduction of age verification for adult services should have been the perfect opportunity to create a national infrastructure for digital identity designed for the future rather than the past. In a sane world, the government, the banks, the mobile operators, the service provider and big retailers would be working together to develop a secure and privacy-enhancing platform based on cryptography and connectivity. Instead, as I see on Sky News, “thanks to its ill-conceived porn block, the government has quietly blundered into the creation of a digital passport - then outsourced its development to private firms”.

The parasitic vitality that adult services offer to digital identity is too good to waste, but it looks as if the UK is going to waste it.

*I use DuckDuckGo for searching.

Comments

Popular posts from this blog

We could fix mobile security, you know. We don't, but we could

Earlier in the week I blogged about mobile banking security , and I said that in design terms it is best to assume that the internet is in the hands of your enemies. In case you think I was exaggerating… The thieves also provided “free” wireless connections in public places to secretly mine users’ personal information. From Gone in minutes: Chinese cybertheft gangs mine smartphones for bank card data | South China Morning Post Personally, I always use an SSL VPN when connected by wifi (even at home!) but I doubt that most people would ever go to this trouble or take the time to configure a VPN and such like. Anyway, the point is that the internet isn’t secure. And actually SMS isn’t much better, which is why it shouldn’t really be used for securing anything as important as home banking. The report also described how gangs stole mobile security codes – which banks automatically send to card holders’ registered mobile phones to verify online transactions – by using either a Trojan...