Age verification

The Online Safety Act is in force to block porn sites accessed in the UK now. You have to prove your age.

There is even a petition to repeal and rework it. Do sign, but we all doubt it will help. Maybe if it gets to millions.

Just to be clear - this legislation does not just impact porn sites, or just adult sites, but millions of sites and services, and there are millions more that may be in scope. This is not something where one can say that compliance is a "cost of doing business" as the vast majority of sites and services in scope are not businesses. They do not have money to comply, or even to get legal advice to find out if they have to comply - get it wrong and they face huge fines. That is the crux of the petition.

Let's stick to porn sites for now.

This is a huge invasion of privacy and a largely pointless exercise as there is no real way to stop teenagers that want to access porn from doing so. In my opinion a better approach is education, and especially on the nature of porn as fantasy and fiction so young people do not get the wrong idea about healthy sexual relationships. Blocking will not work, in my view, but it creates a lot of problems.

• It does not just impact kids, it impacts everyone.
• The legislation has huge overreach causing a lot harmless sites to shutdown to avoid the burdens and risk involved. It is not even clear when it applies (what of a shared diary with my wife and nobody else? That seems in scope of risk assessments, at least, as we can each post user content the other sees, and perhaps even AV if anything we add is racy).
• It creates a norm of proving your ID, or camera access, in order to access many web sites (not just porn sites), so opening the floodgates for scammers. Even if some sites have less intrusive means (see SMS below) there will be scammer sites that insist on camera access.
• Even when not scammers it creates the risk of a huge databases of sexual preferences linked to real identities being leaked.
• Teenagers will find ways around it, and even have to help adults to do so (irony!).
• It is questionable as to the extent that porn is actually harmful in the first place, especially with associated education.
• Obviously VPNs are a way to bypass as the restrictions are country specific.

So, let's look at what has happened.

I have done a few checks, and the AV falls in to a few categories as to how it works. This is "legit" AV, scammers may be more creative... Actually I have only checked one site which seems to use "age>>go". Some other sites start by insisting on a sign up to the site and creating a login before they do any more checks, which seems intrusive.

But these are some of the "age>>go" choices...

• A selfie - i.e. allow video/camera access on your device (can you see how that can be abused), and confirm some facial expressions (open mouth). Apparently there are on-line images with expression settings to which you can easily point your camera in order to circumvent this and that is just some games, not even a site set up for this purpose, yet.
• ID upload, like wow - how can that be abused, but also selfie to match ID. No idea if that copes well with edited images in the ID. I was not going to upload an ID, sorry.
• An SMS check, sends a code and they confirm the mobile operator has no age restriction.
• A credit card check. I have not tried this, but they do know kids can have cards? Maybe kids cards are debit not credit cards and that matters somehow. It claims to be a zero value "active card check" - does that show on all card apps? i.e. borrowing a parent's card may work, and leave no trace... Again, I was not going to provide a credit card - but you can see how scam sites will abuse this.

SMS

I looked specifically at the SMS, which concerns me for several reasons. This is, however, by far the least intrusive - as no camera or images or actual ID, just a mobile number.

They take a number and send an SMS with a code to enter, and then do a check with the operator to confirm the number has no age restrictions. This may be an issue in itself - the privacy policy for mobile services can be vague, but sharing whether you have age restrictions with a third party, for a number, is not a clearly identified thing that I can see. So may, in itself, be a GDPR issue.

What they do not immediately say is they then want an email address to which they can send a code. This too is a GDPR issue, as having confirmed you (a) control the number (can get SMS), and (b) the operator confirms no age restrictions, they have no legitimate interest in knowing an email address, and no option to not provide one that works. And this was a "legit" AV site. Scammers will do way more.

What is interesting is the email address has a "remember me" option - but not clear what for. Well, the answer is that you can then verify using "login", i.e. enter the email address and get emailed a code. So the use of the mobile number has now made the email verified with no further need to use the mobile number.

Back of the bike sheds!

This is one of the concerns I had with any age verification system.

So let's assume that..

• Some teenager happens to have access to a mobile with SMS and no age restriction for some reason, or
• A sixth former that is 18 has legitimate mobile SMS with no age restriction, or
• Some guy in a dodgy trench coat has legitimate mobile SMS with no age restriction.

Can they sell (or just give) AV access to horny teenagers?

(Just to be clear, A&A numbers fail to get this to work, the SMS works, but then says you do not have access. This is no surprise as we have no system to allow some third party to check if our SIMs have age restrictions.)

Obviously they can simply provide the code sent to their mobile, and code emailed to them, to their customer to allow them access.

But actually it is even simpler.

Using the mobile number for the first step, and their customer's email address for the second step, the customer tells them the emailed code, or the supplier can tell them the mobile code, either way, but use the customer's email address. Now the customer's email is considered verified, and can be used to login in future without the need for the mobile number. It just needs access to an email address.

By using a domain and mail forwarding the customer's email can be hidden as well, allowing for some ongoing income as the supplier can revoke the mail forwarding at any time.

So yes, this now creates an opportunity for people to exploit others - even adults that want access without giving up any details! Of course those doing the exploiting can be scammy as well, they know the email address, and can even see how often it is used if they wanted.

Testing

I used a mobile (Three data SIM with no age restriction - I am an adult after all) and an email address (one of my @fuck.me.uk addresses) to get access to a dodgy site, yay! But also I can then login using just the email address.

I then did the same, using the same mobile number, but a different email address. This also worked, and both email addresses can now simply login using the email address. I can now forward the second email address to someone else and they can simply login. This has the advantage for them that the site and AV service do not have their details (mobile or real email). No, I am not going to send to a child, obviously.

Now, I do not know if they permanently allow the login or ever re-validate using SMS. It is not even clear how long a site grants access from a login (though clearly at least a day, from my testing).

More data collection

Another issue here is that it allows access to a site to be correlated. With NAT and incognito browsing it is harder to link multiple accesses to be the same person (though browser fingerprinting may allow this). But if there is a login of some sort - or some auth code from the AV service, it can allow all accesses to be linked together, even if not knowing the actual personal identity. With common AV systems it could allow multiple site's accesses to be correlated now without even the need for working cross site cookies / pixels, etc.

Update:

What is interesting is that age>>go have dropped ID check as a verification, and then a bit later dropped credit card check as well. They only have selfie and SMS now, but still - once an email address is validated you only need that working email address!

Update:

Oddly it has changed to Selfie and credit card now. There is shit going down behind the scenes.

🎶 The Internet is really really great... 🎶

I do not watch much conventional TV so rarely see adverts, however I have noticed on the rare occasions I catch TV in another room, or radio in a car (I don't drive either), there appear to be adverts running to advise people of the dangers of entering personal details on the Internet.

I am not sure if these are public service adverts or run by a bank or what, but they are an important message. Checking the web site is secure, is the site you think it is, and why they are asking for details.

Always be wary of web sites asking for personal or banking details!

Except, of course, when it is a porn site, because they are being forced by UK law to ask for details to verify age, or link you to some age verification system that asks details, even when not purchasing anything from the site!

The Open Rights Group rightfully raise concerns over the age verification companies (here). There are also serious issues over competition for age verification services, possible monopoly which may price some sites out of the market, and the AV services run by the main porn site provider, so no real separation of identity from porn preferences.

This is bad, but for me the bigger issue is the number of scams that will be out there. If it becomes normal to have to enter personal details or bank details to prove your age then there will be no end of scam sites offering free porn, or simply redirecting from a fake site to a free site that does not ask after it gets details. They will quote, and even link to, the UK legislation and information sites I am sure, just to add credibility.

And when someone gets charged £10 for some dodgy age verification site, really, how many people will own up to being duped? Especially if the porn in question is even remotely embarrassing or "specialised". Though the issue is bigger than just random charges, that personal data then gets sold on a black market and exploited. Depending on the sites it may be used to blackmail people. Leaked data from actual sites has already led to suicides - this will be way worse.

And none of this "solves" the supposed social issue, if there is an issue to solve even. What we need is better sex and relationship education in schools, simple as that.

But, to add a slightly lighter note, don't forget, as Avenue Q have said...

Very careful blog post...

I blog on many things, some I am closely involved in, some I have views on, and some I am puzzled by or curious of. This is a blog post in which I find I have to be very careful.

This is meant to be a discussion point, honest!

Pedophiles!

The actual definition of the word is simply someone that "likes" children. Well, we all like children, I have 5 and I have 2 grandchildren. I like children... If you are a francophile you like the French. It does not mean you want to have sex with all French people! Pedophile, as a word, has become more refined, not only someone sexually attracted to children but someone that actually commits illegal acts and abuses children. The word has become quite specific.

I have children (grown up) and grandchildren - I would be horrified if any of them, at any time in their life, were at any risk from someone even thinking of abusing them in any way, sexual or otherwise.

I personally have no sexual desire for children, and I feel that I have to make that clear when making such a blog post. I find the whole idea repulsive and wrong. The issue is that even someone wanting to debate such issues is at risk of being branded a pervert!

However, I also have no sexual desire for sex with men, and this is where the whole issue gets complicated.

We now, in society, accept that there are homosexuals. I know several, and I have nothing against them. That sounds condescending somehow, sorry - the fact that a person is gay or not really does not matter to me, and why should it? Yes, if I were not married, and I found a woman sexually attractive, it would matter that she was a lesbian, as I would not pursue sexual relations with her, but in general such things do not matter... We do not need to know or care of such things normally.

We accept that homosexuals, even as a statistical minority, are just as they are, it is the "way they are", and not a choice, and the same goes for a whole spectrum of people that "identify" as a different sex to their organs, etc.

These days the whole notion that we just know another people's gender is rather odd. It is locked in to our language and culture, but why? It probably stems from 500,000 years of that mattering and basically identifying if you can fuck someone or not. But in modern society it is not quite the same.

The world is changing and accepting that people's feelings and desires in relation to gender and sex are a fact of life and not a choice, or an illness, is now the way we view people. It is good.

I support this view. I have my, somewhat conventional, feelings and desires, but I completely respect that other people may have very different feelings and desires.

Except, when people are "cursed" with a sexual desire for children - that is different somehow, and for a very good reason. Children cannot consent to such things, and should not be abused. They are inherently vulnerable and absolutely need protection. The "desire" is not the problem, the "act" is the problem.

The issue is where people are "cursed" with that being "the way they are", and sexually attracted to children. Now, they can never legally, or morally, pursue that desire. Children are out of bounds, and rightfully so! But do we accept that is "the way they are" or do we assume they are "ill"?

If we accept that is "the way they are" then things like "dolls", and "cartoons", and even videos with young looking actors and actresses that are actually of legal age, should not be an issue - surely?

What you do in the privacy of your own home should surely never be an issue if nobody is abused. Right now, legally, it is an issue. Right now, cartoons of child abuse are illegal, and even some dolls are illegal to import, even a video if the person "looks" too young is illegal! The idea that a judge is trying to asses the age that a cartoon looks is crazy, in my view. Imagine if you have videos like Avatar - if that is sex with an alien that is depicted as under 18 Earth years old, as that is how they are depicted as being mature on their world - that matters in law now!? How crazy is that?!?

The idea is that such things are a "gateway" to abusing children. I am no psychologist, but is that true? or is it only true because such things are already the wrong side of the law? If they were all allowed, but actual abuse of children was clearly where the line is drawn, would allowing such things, in the privacy of your own home, help such people live out their lives without actually abusing children? I really do not know!

Maybe this is where I do not know enough? Maybe this is simple and such things lead to actual abuse? If so, then maybe the law is right as now.

It only makes sense to stop them if we consider them "ill" rather than "the way they were born". So that is the question... How is it that a man attracted to a man is "the way you are", but a man attracted to a child is "perverted and ill"? What is the actual difference?

I will now be very non PC, and say that not only do I feel the whole idea of sex with a child is inconceivably repulsive to me, but so is sex with a man. That is "the way I am", somewhat "regular heterosexual". I am not meaning to be offensive, that is just the way I was born.

I imagine some gay men I know would find the idea of sex with a woman repulsive too. At least they may find it unappealing. That is the way they were born. That is life...

That does not mean I do not respect the rights of homosexuals to their life and desires and consensual activities, I do. But apparently sexual desire for a child is placed in a different category - why?

I post this actually to spark debate. I say this as someone promoting privacy, the very privacy that people in the whole transgender, homosexual, whatever, communities now, want and need. Privacy we all want, to be honest! Why is what you do alone or with consenting adults without physical harm in your own home not always legal? If you are one of those wanking over a cartoon or a doll of a child, does that actually harm anyone? Can we have some clear lines of actual harm, and harmless private fantasies here?

I always find it strange that we endorse fantasies over killing and carnage in films with no problem - serious issues, but nobody bats an eyelid over watching Die Hard or some cowboy western. Why are films over sex so much more taboo?

Or, is sexual attraction to a child actually "special" and "a mental illness" and not "the way you are", and if so, why? Really, why is that not just the way those people were born?

Comments welcome, and once again, I have to stress so much that I don't know any pedophiles, and I would not want anyone going near any of my children or grandchildren with such thoughts, sorry. I am rather prejudice myself on this - what I am trying to do is see past any wish to regulate people's private desires and fantasies in their own home. Really, what you do in your mind, your dreams, and your own home with no actual abuse, I really feel is not my concern.

I have a strong view that criminalising one's thoughts is an issue. If we are not careful, one day, we will have "dream police". And whilst I consider myself pretty "normal" in many ways, I would never ever want to be judged on my dreams and desires!

So..., comments?

P.S. Why that picture? Well, Carry-On films were made in a day when the idea of someone dressing up in a school uniform for fun in the bedroom was not seen as being wrong in any way - I am sure that featured in some of them, but could not find the relevant picture. Maybe I am misremembering. These days, a cartoon can be deemed to be depicting someone under age because it shows someone in school uniform, from what I understand of cases I have seen reported.

Porn ID checks set to start in April 2018

As per BBC article. I hate having to repeat myself, so I'll make it quick.

1. Is there a problem to solve? Show us the evidence please.
2. Is there a solution already? PCs can be set up with basic parental controls, and ISPs (even A&A) can help with that, so young kids that have no interest in porn can avoid it.
3. Is this a solution? Older kids that want to see porn will absolutely not be stopped by these measures, so no.
4. Will this work at all? Foreign web sites that are free are not covered, those paid by advertisers cannot be stopped by blocking card payments. Maybe some that take cards now will comply, but they sort of do as they take cards already.
5. Kids can get cards! (albeit pre-pay or debit rather than credit cards) which makes one means of age checking somewhat harder
6. How do you tell my age? It is almost impossible to make an age verification system that works remotely over the internet that cannot be fudged somehow. E.g. use a parents card details, simple as that. Anything an adult can type in can be typed in by a teenager. Even live video chat cannot be trusted - how long before there is an app to make your live face and voice seem a lot older in a convincing way.

Now for where it gets really bad...

1. The age verification companies appear under no special obligation to secure the data, in spite of calls for this. If any are outside the UK they may not even have the Data Protection Act to consider.
2. It is going to be nearly impossible to verify age without verifying identity, and almost impossible to come up with a way that cannot then be correlated to the site, and specific pages and sections of sites that identifiable people are accessing. This data will be hacked and leaked.
3. Free porn sites are simply not covered by the legislation anyway, so what is the point.
4. Web sites offering free porn (even those linking to or copying other sites) will now start asking for personal details to prove you are 18, including card details. They will be able to link to UK law and UK government information to justify asking. People will expect such sites to want lots of personal information. People will give details and then when scammed they are not that likely to complain or claw back as they are too embarrassed to go to their bank.
5. The scams and risks target minorities especially - those that, more than most of us, do not want anyone to know their sexual preferences, even though totally legal.

Also, if you do access a porn site, using incognito or privacy mode so not in your browser history, you won't have cookies, etc, and so will have to do age verification every time?!

Remember, we are talking about legal content from legitimate businesses here...

First they came for the porn sites

If it was not bad enough with the Investigatory Powers Act passing in to law, we are now facing another wave of stupid and dangerous law - the Digital Economy Bill.

Several people have written some good pieces on that - see one of the latest by Jim Killock of Open Rights Group.

What problem are they trying to address?

"THINK OF THE CHILDREN!"

Seriously, it is not clear what the specific problem is here - but the Government have been after porn sites for a long time. Those of us that are cynical see this as just one more step in censoring the Internet, one small justification for more filters and laws to back them, so that more and more can later be added to the filtering lists over time.

I will be delighted if someone reading this has some concrete evidence of studies showing what problem exists to be solved. Are there any MPs that did not see porn before 18 (or a pig's head maybe?).

Personally I see two issues, the first is younger children inadvertently encountering unsavoury content on the Internet. This is easy to address with existing tools and some education of parents. The second is older children that want to access porn on the Internet but are not yet 18 (e.g. people that are 16, can fight in the army, and can get married and have sex, those sort of people as well as those a few years younger). This is not a "problem" to solve - teenage kids have accessed porn, probably forever, and long before the Internet. The only problem is where they see porn as "reality" rather than "entertainment and fiction", and that is solved by education. No amount of blocking will ever stop a teenage kid accessing porn if they want to and that is a simple fact!

What is the solution they propose?

There are two key parts here, both of which have huge issues.

1. Age verification on porn sites. Unlike whisky selling web sites that have "Are you over 18? Yes/No", they mean something that can actually validate that you are over 18.

This is serious - a lot of people (adults) access porn. It is not unusual. However, the fact that people access porn, and the specific preferences for people's fantasies is very personal information - sensitive personal information which is valuable to criminals, may be very embarrassing, and usable for blackmail and who knows what else. Remember, until surprisingly recently a preference for same sex relationships would make you a criminal suspect! If anything, it is one's sexual preferences that are perhaps one of the main reasons for the basic human right to a private life.

The only real way to do any sort of age verification is to identify the user somehow. This is a huge challenge to do "over the Internet". Almost anything that can be used to identify a person can be copied and used by their teenage kid - and something like a credit card is one of the easiest. Also, bear in mind, kids as young as 8 can legitimately get a pre-payment visa/mastercard now.

No matter how you try - the system will be flawed somehow (what can an adult type or do on a computer that a child cannot copy?).

But no matter what you try - there will be an association of the web site access with the identity of the person accessing it. Steps can be taken to try and avoid this linking together cleanly by some means, but ultimately there will be a link somewhere, and that allows for a huge database of sexual preferences for adults in the UK. That will get hacked or sold or both.

We are talking about a database of the sexual preferences of every UK adult! But I suppose the Investigatory Powers Act allows such a database to be created as well - at least tied to an Internet connection if not a person. This database will tie to specific people.

2. Blocking of porn sites. Only UK sites would have to comply (putting them at a commercial disadvantage and hampering minority groups), so they propose that sites that do not comply can be blocked by an order on UK ISPs.

There is plenty of evidence that trying to block illegal sites that assist in copyright infringement in some way simply does not work. It is a massive game of "whack-a-mole" at best, and totally pointless at worst. This has been tried, and it simply does not work.

But trying to censor completely legitimate and legal web sites, which have financial and legal resources, is going to be a much bigger challenge. For a start, there are a lot of them, a hell of a lot. We are not talking of blocking one web site like piratebay, we are talking every single non UK porn web site that is not going to pay for UK age verification services - they would be much more successful investing in ways for UK "users" to bypass government censorship.

But as Jim Killock points out - the second "age verification" becomes the "norm" for UK porn "users", we see massive opportunity for fraud - porn sites that insist you have to enter card details to proceed and even quoting the UK law on this. Quote a law and link to it and the request seems legitimate. If all of the free sites vanish (unless you try a little to find them), then we will be swamped by the bogus sites collecting personal information. And there is almost no end to how much personal information they can ask for in the interests of "age verification" and a promise not to actually charge your card or log the details. There is no way for people to tell the "real" (and supposedly safe) age verification requests from the bogus ones, and there is a massive incentive for people that are defrauded to keep quiet rather than own up to the site they were trying to access. It will be a secret and undercover fraud that will be a nightmare to track down.

What is the right answer?

You have to assume there is a question/problem in the first place, which is not clear, but assuming there is one - what is the answer.

I think it is simple to say - education is the answer, not censorship.

But I'll try and be a tad more helpful.

For young children you need education of parents and guardians on how to use the many tools available to them, and some education that the Internet is not the ultimate baby sitter. There are many tools - just installing any operating system these days will offer a range of "parental controls". There are safe-search settings on search engines and there are controls that can be set in most ISPs systems that offer filtering as an option. ISP filters tend to be whole house and so a tad crude but there are DNS based systems which are easier to set on a per computer basis and provide controls not only on content but times of day, etc. Lots of tools exist, in the control of the parent/guardian. Yes, they are easy for some teenage kid to bypass, but we are talking here of young children not trying to access porn, and for that all of these tools work well.

For older children that want to assess porn the first thing to realise is that there really is no point trying to stop them doing so - it will never work, sorry. But education matters. Along with sex education you need education for teenagers about porn! I know it seems odd, but teenagers need to know porn exists, and that every type of porn and sexual preference you can imagine (and many you cannot) exist somewhere. They need to now that porn is entertainment and not reality. That it is fiction. That there are many things out there, with which they may feel uncomfortable, and that they have the choice of what they look at and what they do not. And that most of all they need to understand that it is not in any way a guide to any real relationship, just as many fictional and entertainment films are not a guide to real life. With some basic education people can enjoy porn, avoid things they do not enjoy, and still have meaningful sexual relationships in the real world.

Latest attempt at filtering the Internet

This is serious stuff - the only hope we have is that every time this exact wording has been tried before it has failed. However, we are in 2016 where stupidity reigns at every level of government in all of the major countries of the world.

The proposed amendments to the Digital Economy Bill are detailed by Open Rights Group here.

So two issues.

1. That a filtered internet *must* be offered by ISPs unless the subscriber “opts in” to subscribe to a service that includes online adult-only content; the subscriber is aged 18 or over; and the provider of the service has an age verification scheme which meets the standards set out by OFCOM in subsection (4) and which has been used to confirm that the subscriber is aged 18 or over before a user is able to access adult-only content.

Now some of that is OK as EVERY SINGLE A&A CUSTOMER HAS OPTED OUT OF ALL FILTERING and confirmed they are 18 or over. We have no interest in contracting with under 18's as that is much harder to enforce and hence get paid. The only issue there is the "age verification" aspect - that has a shit load of issues as explained at length by ORG. I really hope that at least that bit is ditched - otherwise all out signup for new services will have an extra cost for us to pay some age-verification provider to check you are over 18.

REMEMBER! THIS HAS NOTHING TO DO WITH USERS OF THE SERVICE! This is only for subscribers, which we want to be over 18 anyway. Their kids can be accessing all the porn they like and we would be 100% compliant.

2. The other worrying clause is CENSORSHIP of the internet at court order. We have this a bit for copyright law now, but A&A is too small to have ever had such an order, and it has been proved time and time again that such orders simply do not work.

There is NO TECHNICAL WAY for any ISP to actually PREVENT access to some part of the internet. If we allow ANY PACKETS in and out, even just DNS, then ACCESS will be possible so it is IMPOSSIBLE to comply with such orders. This needs knocking on the head now. It is nonsense.

Let's be clear here - if every ISP has to pay some third party age-verification service before they can sign up any customer, that will cost, probably several pounds, and that will be added to cost of signing up. For us it would not change our service, we ONLY do opt-out of censorship and ONLY do 18 or over, so nothing changes but paying an extra fee. Why do that?

P.S. Seems like the amendment has been withdrawn - but why do they keep trying to throw this in to legislation - what is the point?

Taboo and privacy...

There are things we all do that are considered private.

Because they are private, and we have a right to privacy, that information is valuable. What people do in private can be used against them and information used to harm them - to extort from them.

We have seen the case of the Ashley Madison leak where people committed suicide, and marriages were ruined.

But the UK government is trying to create a system that will put in the hands of companies the details of the private sexual preferences of a lot of the adults in the UK.

They are proposing a system of "age verification" for access to pornography web sites, and such a system can only serve, by some means, to associate a real life identity of an adult with a sexual preference.

That data will be valuable, and will be hacked or leaked, and there is no doubt about that.

And why? Well, to reduce the risk of children accessing porn. Even though the filtering of porn sites is standard on so many mobile and fixed internet access in the UK, this is a step to go further.

Personally, in my opinion, this is silly. Young children have no interest in porn, and existing filters, and safe search and parental controls, stop access. Older children, teenagers, will find a way to access porn regardless. There really is no need for any change in this.

I am lucky - I am not in any sort of sexual minority as far as I am aware, liking conventional straight sex, and watching porn of such occasionally. But a lot of people would not be prepared to say that, and a lot of people are "in to" something more controversial. For a lot of people their sexual preferences can be a financial or political level and create a lot of problems.

Why is the UK government so keen on such a system - who knows. From news reports it is MPs that may have the most to fear from such a system.

Of course, any such system, will be flawed, and foreign sites will ignore these new laws as proposed. Kids of any age will have no issue accessing porn. But adults - normal people - will have their sexual preferences profiled and logged and hacked and abused.

Not a law yet, but close - the Digital Economy Bill - it is happening now.

Think of the children!

I just read a rather odd story in arstechnica, on Starbucks banning porn on their free wifi.

Now, please, don't get me wrong. It is crazy that anyone would be watching porn on a phone or device in a McDonalds or Starbucks. That is just daft and nonsense.

It is pretty much as crazy that someone would sneak a porn magazine in to such a venue and "read" it there.

Now, I am not saying there are not crazy people out there, sorry, but there are, and they could do either of those, or strip naked and run through the store, or whatever. Shit happens, but I really do not think this is an issue that needs any special technical measures like blocking porn on the wifi.

It is totally pointless.

But, what is the down side? There are many!

• Once you have technical measures to block some types of content it becomes easy to block other content, and this can be added with far lower levels of justification and almost no costs. How long before Starbucks blocks access to Costa's web site? What about blocking some political web sites?
• Once you try and block something it is quite hard to do it right and "catch 'em all". The WiFi cannot be assumed to be "safe" by parents letting kids use the wifi, but they may assume it is.
• Once you try and block something it is quite hard to do it right and not over block. We see a lot of over blocking were legitimate web sites are blocked by mistake. This makes the wifi less useful, inconvenient even, and is bad for PR. The blocked web sites have big issues knowing they have been blocked and getting the block removed as they have no contract with Starbucks.
• This does not stop someone accessing porn! Lots of people use VPNs on public wifi, and can then access what they like. So this is bad PR if someone is accessing porn on a device on the wifi in Starbucks after they claim to have blocked it.
• Obviously someone could take porn on paper or stored on a phone or device or use 3G or 4G, and access it without the wifi being involved. Again, bad PR.

As I say, who the hell would access porn in a Starbucks? Well, if you make publicity over this there are slightly more people that will! This is because you have now increased the pool from just the nutters to people that deliberately want to create bad PR for them. There are many of those, some cross over the way companies pay tax, etc. People that will create embarrassing scenarios, using the supposedly "safe" WiFi to do it, just to cause bad PR for Starbucks.

One could even be cunning, find a site not blocked (or create one using a proxy) and then use DNS injection on wifi to cause people's phones in a Starbucks to actually serve up porn sites when people try to access normal things like Facebook. Technically easy, and really really bad PR!

And all of this flies in the face of net neutrality and may not even be legal in such places under EU or US laws.

When will people learn, communications systems are neutral (or should be), and they are not there to filter or police what people communicate. We understood this for the postal system for hundreds of years - even having laws to prohibit interference. Most people understand it with telephone - not filtering what people say on the phone. Why do people think it is any more sensible, useful or reasonable to think of filtering communications over IP?

Public Bill Committee Written Evidence #IPBill

I am sorry that it has taken so long to get together a proper report on my findings when considering this Bill. It has been a lot of hard work, and I am very grateful to the assistance of many colleagues on this, including working through much of the Bill with me page by page on a Sunday!

There are, as before, a lot of issues.

My submission (PDF).

If you are thinking of making a submission, please do so ASAP. The first oral hearing is Thursday 24th and they have asked for evidence by Wednesday to allow time to consider it.

Please do feel free to quote me or copy to your MP. Ultimately they are the ones that vote on this.

I am happy to meet with MPs and Lords on this matter.

---

Oh, damn, once again, under this Bill your computer would now be logged as accessing a porn site, just because you read my blog. It would not log that you only accessed a benign favicon image, as that would be content, just that you accessed something on the site. Oops.

Child Safety Online

The government has launched a consultation, and anyone can reply, so read it and express your view even if you do not agree with my view.

So where do I stand?

I see porn like any other fiction entertainment, and like any other fiction entertainment there are themes that are clearly unsuitable for young children. We already avoid exposing very young children to extreme violence or themes they are ill equipped to understand.

I fully support helping parents be parents and managing what their children do and access. As an ISP we have many ways to help with that.

As people get older they can handle such fiction and recognise it as the fiction it is and an escape from reality that we all enjoy. Watching porn is not really any different from watching any other fantasy fiction entertainment.

The problem with society is that unlike most other things - like violence or science fiction - we cannot easily see what is the normal case for things like sex and relationships because of the massive social taboo that surrounds the topic. This is the problem.

People can see that it is not socially acceptable to go all Die Hard and shoot everyone, or even to beam up to a space ship. They cannot easily see it is not right to abuse a woman in private because the private relationships are hidden away. We need more education to explain what is good and bad in such relationships that teenagers can understand. Once we do that, they can understand porn as fiction as much as Die Hard for Star trek. [I am waiting for someone to tell me "Die Hard" is actually a very dodgy porn movie].

To be honest, we already expose children to some seriously screwed up influences from religion with no age verification at all - judgemental sky fairies, talking snakes, rules on keeping slaves, boats that can carry every species after a genocide, stoning, and revering a roman torture and execution device as a jewellery! Some of the shit kids are exposed to is just not right and really should be reserved for when they are 18 and able make their own choice. If your religion only works if you get hold of them young you are pretty insecure, in my opinion.

Thankfully the report seems to cut short of forcing ISPs to filter things - that would be bad for lots of reasons. ISPs are specifically not liable for what they carry for the very reason that the Internet would not exists if they were. We enjoy the benefits of the Internet (and the downsides) because of that mere conduit protection. Take it away and it all falls apart. ISPs could not actually filter any content 100%, and even if 1% then 100% of people can search for the way to use that 1% loophole. It is futile. If ISPs were liable the insurance costs for that passed on to customers would make the Internet unviable.

So let's not try and bottle porn up and censor it - let's make education work and ensure children can cope with what is out there, like the rest of life. The porn industry should be, and is, regulated in most countries to ensure people are paid and not exploited. People may enjoy the fiction entertainment and still be normal in real life, whether watching porn or the X-files.

So, that is my view... comments?

This is basically my reply, which I will be submitting.

Question 1: In your opinion, should age verification controls be placed on all forms of legal pornography (‘sex works’) online that would receive a British Board of Film Classification rating of 18 or R18?

My issue here is that a lot of porn sites are well outside UK jurisdiction and so placing such controls is not going to be effective in any way. I suspect most sites charging for porn will be happy with this as the fact they charge means they have an effective age verification by the fact they want a credit card. So the sites you can make comply already do, and the sites that do not will ignore UK law, so why the hell are we discussing this?

Question 2: Do you think age verification controls should be placed on sites containing still as well as moving images of pornography?

I don't see much difference - porn comes in all sorts - stills and videos.

Question 3: To what extent do you agree with the introduction of a new law to require age verification for online pornographic content available in the UK?

Again, this is not about the UK - most sites are not UK - I have no problem with UK hosted sites having age verification, apart from the commercial disadvantage they will face, but that cannot have realistic impact on non UK sites.

Question 4: If age verification controls are to be required on pornographic websites, how do you think they should work (select all that apply, and please suggest other ideas that you may have).

I do not think there is actually any way to do this - whatever you do a teenager can mimic what an adult did or does, even borrowing their credit card. Nothing will work against an adolescent boy that wants to access porn, sorry. And if they VPN or Tor to an non UK IP, the verification will vanish as UK specific.

Question 5: Do you agree that a regulator should have the power to direct payment and other ancillary services to remove their services from non- compliant websites? Please give reasons.

You could, but that simple means kids will access the thousands of free (paid by adverts) sites instead and not actually help matters at all.

Question 6: Do you have any suggestions for other actions that could be taken to ensure that commercial providers of online pornography comply with the new law? Please give details.

No - everyone outside the UK is not subject to UK law, sorry.

Question 7: Do you think that the regulator should have the power to direct parent and umbrella companies of pornographic websites to comply

No - as such company structures can be re-engineered at a whim and any law that worked would immediately be worked around. That is assuming any of the parties are subject to UK law.

Question 8: Do you agree with the introduction of a civil regime to regulate pornography websites? Please explain your answer.

No - would only work on UK providers - so actually putting UK at a commercial disadvantage and not actually addressing the perceived problem at all.

Question 9: Would the introduction of a new criminal offence be a better form of regulation?

No - would only work on UK providers - so actually putting UK at a commercial disadvantage and not actually addressing the perceived problem at all.

Question 10: To what extent do you agree with the introduction of a new regulatory framework?

Disagree - see top of this blog post. Not the way to solve the problem, if there is one.

Question 11: Should a new framework give powers to a regulator/ regulators to (select all that apply):

Powers only work in UK, so no.

Question 12: Do you think that a co-regulatory approach involving more than one regulator would be appropriate in this context?

Can't see how that helps.

Question 13: Do you agree that the regulator’s approach should focus on having the greatest proportional impact, for instance by looking at the most popular sites, or those most visited by children in the UK?

Again, such sites will be outside UK - so outside jurisdiction.

Question 14: Wherever new regulation is proposed, the Government must consider impacts on smaller and micro-sized businesses (those with fewer than 50 employees) based in the UK, and whether these impacts are proportionate. Should smaller and micro-sized businesses (such as some payments and ancillary services) be exempt from the scope of the policy?

Puzzled by this - why would size of operation change anything? If harm is done, the need exists, if not, then it does not. How is size of company even a consideration?

Question 15: Overall, are you broadly in favour of the proposals set out in the consultation?

No - see top of blog post.

Question 16: How effective do you think the Government’s preferred approach would be in preventing children from accessing online pornography?

Zero - actually negative - there is possible impact on payment providers and advertisers and UK porn industry that would have to comply when competing overseas providers would not have to. The end result being no help to kids in the UK but harm to some UK industries.