We're now ready for our next session on a verification to over to you.
All right.
Yeah, small announcement as you might see, Felix was not able to join us today due to the
flu that is I think spreading around.
I am Elina or CaliC, I'm a spokesperson of the K's Computer Club and I'm primarily
doing EU policy stuff and have been working on the so-called chat control file for the
last four years now with my lovely colleague, Ella, who is head of policy gear at Adry.
And we will talk about a verification today and both the legal and the technical aspects
and why we think that the open source communities need also to have that eye on this
topic because it's coming for us hard.
So Ella, I feel like to start it with the law stuff.
Thank you, CaliC, yet I am a legal and policy person, so I'm just going to set the scene
around what we're seeing at EU level when it comes to age verification in the last few years.
We wanted to talk about age verification because for us following closely EU law making,
it is one of the hottest topics right now.
We have law makers left, right, and centre proposing it as the solution to almost any kind
of online harm that you can imagine.
And we are super concerned about that from a digital human rights perspective.
It's a very blunt tool and it comes with a lot of intended and unintended consequences.
So together and with our colleagues, we've been really resisting this flood, this rise in
thinking that age verification is the silver bullet.
So around why it's such a big digital rights issue for us.
We kind of see it on three levels, there's the data protection level, the privacy level
and the discrimination level, at the data protection level.
If you have to verify your age to get onto chunks of the internet, by definition, you're
giving up some of your personal data and that's always going to come with risks of leaks,
of facts, of what's going to happen with that information.
And we've seen it already.
Pornhub, for example, in the past used to require all of their content creators to upload
a scan of their passport, which they held in a non-secure space.
That was a few years ago.
So you're putting yourself at risk your personal data at risk potentially.
But then let's say you could theoretically, and we'll come to that, build a system that was
completely data protection compliant.
We're still opposing that as edgery because the privacy impacts are potentially so profound.
There is a step change for our free expression by saying that suddenly big parts of the internet
are contingent on showing your identity documents.
And I'm also a sociologist of tech.
If we think back in some of the worst atrocities that have happened in human history,
they have been linked to really strictly controlled identity protocols.
So we really have to think of it in that sense.
There's also in the privacy bucket the chilling effect that comes from the use of these tools.
Even if your government or a service provider is telling you, yet trust us everything's fine,
we know that a lot of people will choose not to use certain services because of the age verification.
And that then links to the issue of discrimination, which is that there are chunks of society
disproportionately minoritized people for whom these systems do not work as well or do not work at all.
And all that we get then with these systems is the entrenchment of the discrimination and the
marginalization that communities like undocumented people, racialized people, sex workers,
and other targeted communities already face online.
In the past in the last few years at EU level, it has been possible for providers of
different types of online services, social media, apps, other kind of services to use age verification
if they want to. And increasingly under the GDPR and the digital services act,
we have seen regulators more and more saying that especially for services that have a lot of
miners on them, so social media, that the interpretation is they do need to start using
age verification more. But we're now in a place where it's creeping towards being
de facto mandatory or potentially completely mandatory. So we have some new interpretive guidelines
under the Digital Service Act article 28 specifically that are quite prescriptive about how
especially social media services probably should be using age verification systems.
But potentially even more worrying than that, we have the child sexual abuse regulation
more commonly known as chat control. And although it's the mass surveillance and the encryption
breaking that's generally getting the most attention from chat control, what a lot of people don't
know is that that law also has potentially mandatory age verification for private chats.
So your signal, your WhatsApp, your telegram DMs, your emails, potentially all of these channels
if this law passes could be subject to age verification because this law is based on the premise
that sending a private message is inherently risky. So we could be potentially a few months away from
if certain lawmakers get their way whereby we cannot exercise our right to communicate with other
individuals privately in the digital age without using our identities. And bringing it also
specifically to the open source context, it's not just the communication services themselves,
where they might have to use age verification, it's also app stores. There's going to be a big
obligation potentially put on app stores to verify the age of their users and control access
then to all the apps in their app stores. And this chat control bill, it relies on the definitions
that are in a law called the Digital Markets Act, which is actually aimed at kind of raining in
the power of big tech. So in principle, we support the Digital Markets Act, it's got a lot of
potential to open up fair competition and to be really beneficial for the open source community.
But the chat control bill does not limit this to gatekeepers. It doesn't say it's only the
Google's and the app stores that have to use age verification, although that's problematic too.
But it would also impact, for example, after it being forced to then bring in age verification
controls to access the app store as well as to access a lot of individual apps. So we're potentially
seeing an absolute landslide, in fact, it's my final slide. This is what is in the chat control bill
around software application stores. It's not that they may do this, they shall take what's
considered by the European Commission as reasonable measures. But as I've already explained,
the risk profile of this law is done so that communicating privately is seen as inherently the highest
risk thing you can do online, along with sharing pictures and sharing URLs. So 10 minutes left.
So I will then move on to Kelly C to give you the technical side of this.
Yeah, I think like very early on, I want that the chat control file will lead to age verification
and also like to force decentralization of the open source ecosystem. Before I get to those
impacts, maybe get some terminology clear. There has been a workshop by the internet architecture board
and what web consortium late last year. So all like the definitions I have here can also be
read up in the summary of their workshop. And I think it's really good to have some more terminology
here to understand the risks and the harms that the age verification architect just could do.
Also to evaluate them further because we are at a time where age verification or age assurance
like the umbrella term for everything that provides some identity with information about the
age of their user. While age verification is like a really specific thing, mostly tied to your
national identity. And then there are other technologies like age estimation where there is a
see like your face and the difference of just that are being classified or like your behavioral
data. So what age are you leaning towards and your behavior or the social media platform. There's
also something that is being done. And of course like the third thing is like inference, we all know
that if you buy cigarettes, you need to use your credit card, if you're buying that somewhere in
an automatic to verify that you of age. So that being all those technical possibilities being
late out, which can be inherently problematic, as Ella said, like porn upstairs issues in the
past as well as a discord using a lot of data for doing age assurance. But there are also other
problems when it comes to the implementation. So the question is where are we implementing that?
Of course, what most policymakers think of is like service level, right? So any social media platforms
very fine the age of their users before they are able to join. But there are also other things being
discussed in other jurisdictions, which is like browser levels. So the browsers would have like
your age flag and presented to all like sites you're surfing to. And that would be really problematic
because then it's way harder to circumvent. And the same goes for the operating system level, which
is very similar to parental controls for those who don't have kids and don't know it. So you can
set up a device as a for a child user and then you have a certain control over what apps they're
able to download the age that is being set and operating system level and so on and so forth,
most of the operating system providers offer that. And this is also like deeply then
embedded into the operating system, which makes it also harder to circumvent but also more
riskier depending on what data is being collected and being stored. The next thing which I think
is even more important when it comes to rating the risk and the harms of a certain architecture
is the different roles that are needed. So of course there is usually a verifier in the case of
most age verification situations. It's like a perperterian software provider that's health
the service to you as a service. And then there's a forcer, it would be usually like the platform
for example on the app store and forcing what is needed. But then there's also something that
makes the things more complicated because we are speaking of like a global construct and there
might be different laws and different jurisdictions. So you need to also probably select the policy
that is being enforced and lastly but most importantly there's also like a need for rating because
the content needs to be rated in order to decide who should be able to exit and this is like
with like platforms it might be rather easy saying like social media as band for people under
16 but if we talk about the broader web then that might be very difficult. And in all those
constructs those different parties can be also merged in some kind of way because like meet
their minds apply their own age assurance service and so they are handling the data by other
would argument it's always due to have a third party doing the verification because then
the provider doesn't have to deal with the data so there are a lot of technical and playing
locations here that haven't been evaluated probably I would say. Basically what we are seeing here
is like rolling out a release without every testing it because we don't know what the impact
will be on the broader web we don't know what the impact will be on the open source ecosystem
and nobody ever talks about that and this is like very problematic and this is not a theoretical
thing when we look at different laws the most public one right now is the social media
minimum age in Australia I think you all heard about it and they are requiring social media platforms
to verify the age of their users and when there are under 16 they are needing them to band them
actually this is like Felix parts so we could pull in some experience from GitHub because
GitHub actually has been contacted by the Australian thesafety commission and they considered that
GitHub might fall under this bill and might need to verify their users and band users under 16
from their platform luckily GitHub was able to convince the Australian thesafety commissioner
that GitHub is exempt from the law but we can see here that is getting it's getting very problematic
for code host of themselves and I think another example would be the UK where Wikimedia is
suing against the online safety act which is also going for age verification in order to not have
Wikimedia or Wikipedia under required age assurance regime which would be very problematic also
leaning towards like access to open knowledge and it even got worth because the Germans are also in
we have a treaty in Germany that nobody really talks about it's the German treaty and protection
of mine as in the media or as we say the young media starts for track and it requires all
providers of operating systems that are typically used by children to include a chart protection
filter in the operating system but even worse they also need the operating system to only run
app stores that also have a child protection filter and that's not enough they also need
the users only be able to use browsers that also enforce some kind of child protection filters
so child-proofing the internet the German way and this is very problematic on so many levels
I think for open source distributions one could argue like yet children typically
don't use them well I think it's a bad argument as we try right now to run more people on open
source but secondly it also leads to the direction of criminalizing open source projects
the argument being okay they don't adhere to our laws so they can only be used by criminal persons
so we try to ban them and this is also not theoretical that happened in France before
and as I said before there are a lot of implications here because if you do age verification
you need a verify I have to need a verify I need to have some part of like centralization
and if you want to do a decentralized then you need to build your own solutions and this is problematic
so you might go back to centralization then you need to compute the data somewhere so there's a lot of
things that needs to be considered and yeah I think now is really the time to speak up
only from a privacy perspective but also like go back to your communities to your projects
think about what that would mean for your projects if that would be a problem and what would
be the implications and what also would be the risk of rolling out such an infrastructure
without evaluating the risk but also like the harms that it could for could cause yeah
okay