Posted at 11:30 on 22 Jun 2019 by Pandora / Blake
According to the Guardian, age verification "faces indefinite delay" due to bureaucratic incompetence:
"It is set to be delayed for legal reasons after government officials failed to notify the European commission of key details."
I shouldn't laugh, but this is comedy gold.
The massive privacy failings of this policy should have been a deal-breaker. Legislators should never have tried to regulate the internet by force of law when they don't understand how it works. Thanks to the tireless efforts of campaigners such as myself, Myles Jackman, Jim Killock, Alec Muffett and the rest of Open Rights Group, Backlash UK, Misha Mayfair and others, the threat that age verification represents to the privacy of internet users is well attested, and is now mentioned in any news coverage about the issue.
That alone is a win: it sets the tone of the conversation. That privacy threat should have been enough to persuade the Government to axe the policy. But even if it's sheer incompetence that will see it fail in the long run, the years we've spent emphasising the privacy threats will have been worth it. Centering the narrative that this policy was controversial, flawed and enormously risky makes it clear that if this policy fails, it's good riddance to bad rubbish.
The Secretary of State for Digital, Culture, Media and Sport, Jeremy Wright, made an apology for his Department's administrative error in Parliament this morning, and fielded questions about the delay. Here's what happened:
"In autumn last year, we laid three instruments before the House for approval. One of them—the guidance on age verification arrangements—sets out standards that companies need to comply with. That should have been notified to the European Commission, in line with the technical standards and regulations directive, and it was not. Upon learning of that administrative oversight, I instructed my Department to notify this guidance to the EU and re-lay the guidance in Parliament as soon as possible. However, I expect that that will result in a delay in the region of six months."
He later fleshed out the "six months" timescale in more detail:
"We need to go back to the European Commission, and the rules under the relevant directive say that there must be a three-month standstill period after we have properly notified the regulations to the Commission. If it wishes to look into this in more detail—I hope that it will not—there could be a further month of standstill before we can take matters further, so that is four months. We will then need to re-lay the regulations before the House. As she knows, under the negative procedure, which is what these will be subject to, there is a period during which they can be prayed against, which accounts for roughly another 40 days. If we add all that together, we come to roughly six months."
This policy was doomed from the start. It's gone through three culture secretaries now, and each one must have despaired at the mess he was inheriting. I can only imagine Jeremy Wright's dismay to discover that not only is the policy potentially unworkable, but that there's a legacy of administrative fuck-ups making his job even harder. Perhaps if the hot potato gets passed from hand to hand enough, someone will eventually drop it. We can only hope!
At the very least, this 6 month delay creates an additional opportunity to renew calls for mandatory privacy protections, and not a voluntary "certificate" which the BBFC are completely unable to enforce. MPs raised the privacy flaws of the policy again in today's debate: if we keep up the pressure and continue making our representatives aware of the issues, perhaps we will see a better-informed debate when the regulations are re-laid before Parliament in six months time.
Also hilarious (to me) is the impact these further delays will have on age verification companies, who have invested loads of money into building software solutions to turn the Government's shitty vision into shareholder-owned gold. Perhaps if they hadn't leapt to turn a profit by poorly implementing a policy that represented unavoidable privacy and free expression risks, they wouldn't be facing the risk of a massive loss now.
I have to admit, I'm rather relieved that I haven't wasted loads of time and effort setting up age verification on Dreams of Spanking. I wanted to wait, firstly until the BBFC had launched their privacy certification scheme so I could ensure that any age verification provider I used was fully compliant with it... and secondly until the BBFC actually prompted me to set up age verification. They are likely to have their hands full with the big sites once enforcement begins, and given the inevitable impact age verification will have on my viewers (and my sales!), I have no desire to voluntarily implement it any sooner than absolutely necessary. Now it looks like if I wait long enough, I might not have to...
Will MindGeek launch AgeID anyway?
Security expert Alec Muffett has raised one interesting question. Since MindGeek already has the software in place to implement age verification, and claim to care about "protecting children", surely they should roll it out now - even if the law doesn't require them to? After all, they've been supporting this policy since the beginning, as evidenced by this email from their Director of Digital to DCMS in 2017:
(I particularly love the smiley.)
Since this policy was first mooted, MindGeek have expressed their full support for making a potload of money off harvesting people's data - ahem, sorry, I mean "protecting children".
So come on, MindGeek: why not go ahead with implementing age verification now anyway? Unless there's some reason why that would be a terrible idea...? Heaven forbid.
DNS encryption makes enforcement unworkable
This bureaucratic delay comes on the heels of revelations that Mozilla Firefox is shortly introducing DNS encryption. Somewhat like TOR browser or a VPN, this will prevent nosy officials from seeing what domain names we are visiting - and, as a ticklingly enjoyable side effect, also prevent ISPs from blocking websites that don't comply with age verification. Given this is the main sanction threatened by the Government to make the big overseas sites comply with their policy, it goes to show just how unworkable the whole idea of regulating the internet via national legislation is in the first place.
Mozilla Firefox is thought to be pushing ahead with the roll out “DNS encryption”, despite government "concerns" they and ISPs will be unable to see what website we are looking at and block them.
Speaking at the Internet Service Providers Association's Annual Conference last week, Mark Hoe, from the government’s National Cyber Security Centre (NCSC), said they would not be "able to block" websites that violate the porn block and enforce the new law.
MPs are well aware of this hitch to their plans. As MP Cat Smith said to Jeremy Wright this morning:
"The ultimate sanction under the age verification regime was the power to block rogue sites, with internet service providers compelled to comply, but new encrypted browser software is about to undermine this system fundamentally. The encryption will mean that ISPs are blind to the sites that users visit on the internet, and they will be unable to block rogue sites that compromise the safety of children. That system—DNS over HTTPS—undermines not only the age verification system, but the entire foundations of the regulation laid out by the Government in the online harms White Paper. Does the Secretary of State agree that online companies are outsmarting the Government, and that we urgently need to know how the Government plan to catch up?"
In the famous words of Internet pioneer John Gilmore, "The Net interprets censorship as damage and routes around it." I'd wish the Government good luck making age verification work - they'll need it. But frankly, the whole policy deserves to go down in flames. As I advised in my recent interview for Radio Ava: porn site owners and sex workers, I wouldn't bother scrambling to comply. The whole age verification programme is doomed, and even if it isn't, if might be years before BBFC have the resources to notice you exist.
Lie low, breathe quietly, and it might all blow over before we have to do anything about it.
This article was originally posted on my Patreon. Posts like this (and the campaigning that lead to them) are made possible by my amazing Patrons. Join them, get cool rewards and help me make more positive change happen!