Tech firms must tame toxic algorithms to protect children online
ofcom.org.uk
ofcom.org.uk
> 1. Carry out robust age-checks to stop children accessing harmful content
> Our draft Codes expect much greater use of highly-effective age-assurance[2] so that services know which of their users are children in order to keep them safe.
> In practice, this means that all services which do not ban harmful content, and those at higher risk of it being shared on their service, will be expected to implement highly effective age-checks to prevent children from seeing it. In some cases, this will mean preventing children from accessing the entire site or app. In others it might mean age-restricting parts of their site or app for adults-only access, or restricting children’s access to identified harmful content.
Before people try to brush aside these regulations as only applying to sites you don't think you use, the proposal is vague about what is included in the guidelines. It includes things like "harmful substances", meaning any discussion of drugs or mushrooms could be included, for example.
Think twice before encouraging regulations that would bring ID checking requirements to large parts of the internet. If you enjoy viewing sites like Reddit or Hacker News or Twitter without logging in or handing over your ID, these proposals are not good for you at all.
The problem is how to make the provider side anonymized so that they don't know what sites your visiting, but that could be probably solved with legislation. In California, at least. I wouldn't trust Congress with a bill like this.
I'm not familiar with the system, but I assume it would necessarily have to reveal the sites you're verifying with to the State of California.
So it's less of a big deal, as long as you're okay with sending a record to the government about what site you're visiting every time you want to sign up somewhere or re-verify your age.
I'm sure someone in the comments will propose some cryptographic solution where neither party knows anything other than the fact that someone, somewhere, possesses a token associated with a person over the age of 18. If you think this is viable, you're not thinking like a kid trying to get around this system, nor a blackhat trying to take advantage of it: Many people would immediately set up a service that handed out age verification tokens in exchange for viewing some ads (the file sharing site model) if there were no limits and nobody could trace it back to the source. Any ID verification system must necessarily have some party able to verify the person to avoid abuse like this.
Yes, I think you are right. There is probably a way to make a fully anonymous scheme.
A fully anonymous scheme would be ripe for abuse: People would immediately take their keys and set up websites that exchanged age verification tokens for watching ads. Kids would visit these websites, watch an ad for 60 seconds, and get a fully anonymous age verification token in exchange.
Identity verification systems only work if everyone involved has some incentive to protect their identity. If the identity means nothing and nothing can be traced back to you, the tokens will be generated for next to nothing and handed out freely.
The idea is DOA.
No good technological solutions which min-max on maximizing user sovereignty and privacy will allow the possibility of [GREENTEXT].
By this I mean, no more fucking around with timeline. We agree that any corporation introducing a feed based on anything other than date from newest to oldest is subject to penalties and sanctions.
Will it stop 'innovation'? God I hope so. I am tired of innovation that farms up rage.
edit: From here we can start working on what algos CAN be included in customer facing crapola.
You want your elders build you a home for you. No deal. Best I can do is help you along by pulling you away from your cell and saving your attention span a little.
I'll happily pay many multiples of what homes used to cost - just make it legal to build homes.
Let us do the things we want without having to cut through a thicket of laws intended to help and protect us. We don't want them.
Please, we've had more than enough of y'all's help.
Many people (myself included) think this is the true nature and shape of the world. There are lots of layers, institutions, and policy built on top, but what matters is ultimately who holds the hammer and what do they want.
This isn't as cynical as it might sound. Most people ultimately hold some real-world power, and have organized into systems that help them get what they want. Anger a human enough and they will withhold work, anger them more and they will resort to violence. This is the basis of all society.
I'm only half joking: The issue isn't the supply of new housing, it is the cost of building new housing. If we fix the cost issue, the new houses will follow.
I fail to see the distinction. The cost barriers (most of which are legal/zoning related) reduce quantity supplied.
I don't believe it costs 2 million in materials or labor to make a condo in California.
Cities actually building or mandating new 2 million condos for the poor would be an example of trying to fix supply without fixing the cost issue (which happens).
In general, reduction of regulation is needed to decrease cost.
I have family that just built a home in a county without zoning or building codes, and I can assure you it was quite cheap.
However, the alternative is very grim. It is essentially conceding that the average human is not capable of directing their actions, and they should be controlled by a higher power.
Im for regulatory options that put more power in the hands of users so that they can solve their problems. I haven't decided what this means for age verification and algorithms, but there are some interesting options in this thread.
The best solution would be a government or banking API that emits a one-time token. No logging, and it self-destructs upon verification.
But aside from the user, no other party has detriment from the current situation.
From banking to buying concert tickets, a way to prove one is human could be invaluable to ridding the system of the myriad proxies we currently use that inevitably result in discrimination.
The crazy thing is it would be dead simple, the hardest part, having physical infrastructure all over the country is already done. The US Postal Service already verifies people's identity for US passports.
Combine this with a constitutional inalienable right to receiving and transferring money to an electronic money account operated by the federal government, and we could get rid of so many inefficiencies.
As an overly simple thought experiment, you could generate a random ed25519 ephemeral public key, hash it, then send it (blinded, and thus unreadable) to an age verification service (with some long term age verification credential or similar).
The age verification provider does a blind signature on your (blinded) public key hash, and sends it back to you. You un-blind that signature (meaning that provider can't identify which identifiable request led to it, but now it bears the hash of your public key), and you can now authenticate to a service by signing a challenge with your ephemeral ed25519 private key.
The service only knows your ephemeral public key, and that it has been "vouched" (signed) by the age verification provider.
The age verification provider knows "you" asked for a token , but doesn't know what public key you used.
Clearly there are challenges with replaying (authorised user could share the private key every day with a group of others), and revocation of a credential whose private key gets shared among a group is hard (beyond providers blocking a public key).
The risk is that this becomes a race towards "DRM" and platform attestation/authentication to try and prevent private keys being exported.
Surely this is a better application of that rather than proposing another L2 to scale Ethereum?
By my understanding , in principle yes you could use ZK proofs - you can imagine it as a way to prove a certain assertion (age >= 18) in a way that isn't directly linked to other data. You sometimes see this in conceptual ID card specifications - using keys on a smart card to give a signed attestation about a single attribute without sharing other ones.
Ultimately though, when you need to actually implement it, you'll end up needing the same core concept as the thought experiment above - you'll need one or more "trusted central authorities" whose word is trusted on a given asserted attribute (age, etc).
They'll need a way to prove that they vouched for a user (as there's no digital way to validate their age as that's an unverifiable claim). You'll then need a way for the "bearer" of a ZK proof to tie themselves to that trusted central authority's attestation, and you'll need a way to prevent the information needed to generate that ZK proof being shared with others for replay.
A ZK proof will still need that external trusted authority for an attribute like age, because age isn't something you can root some kind of cryptographic trust from.
I'm not an expert in the ZK crypto either, but it doesn't deliver a magical ability to prove a (biological analog world claim) without chaining back to a trusted verifier of said claim, and effectively delivering that sort of "thought experiment" protocol.
Sometimes though, the complex solutions tend towards the simple - you could issue people "age verification" smart cards (if you have enough confidence in CC EAL6 or similar cards, and their side channel resistance) which are "group keyed" with common attestation signing keys for every million (or another suitable anonymity threshold) users, and share the public keys used (to allow verification you haven't been given a special unique public key), and then allow signed card-issued anonymous attestations. That would work for as long as you can keep the smartcard-backed key secure against side channel/ key extraction attacks.
The user adoption challenge in all this is getting users onboard and demonstrating it's a private solution rather than an excuse to oversee their online activities more, but I do believe you could do this in a manner that's going to make it easier to just identify them from IP address and adtech trackers or similar external means.
Whereas if their claims are true, and they do know the age of their website users, then these so-called "tech" companies can solve this problem without needing to do age verfication. By not targeting people in certain age brackets with certain content, they can stop the politicians from proposing legislation that requires age verification. But they refuse to do so.
Interesting.
you can easily tell a 30 year old from a 10 year old. but can you tell a 12 year old from a 15 year old? or a 15yr old from a 20yr old?
so tech companies want a system that is approved so that they are not responsible if it fails
I live in Norway and it doesn't seem that the problem is so severe here. Or is it simply that English speaking media is more willing to latch on to extreme events and make out that they are the norm?
Their culture regards anything sexual as Taliban regards women not covering their head. As an extreme taboo. As a fellow European, yes, I know, it's crazy.
With a century of public policy fuggery, the domestic stock has been induced into a situation where it refuses to effectively breed its next generations in comparable numbers to other competing stocks. It could be mistaken for accidental if the elite weren't then back-stopping tax and investment losses with importing supply from those other stocks.
If The West is purely cultural/ideal, then mere assimilation should be enough for its persistence. If The West is its people then this situation spells certain doom if not arrested.
The West's place at the top of the world is going to be toppled by a nation with less feminism and anti-natalism this century, unless The West can destroy all other effective competition.
Youtube is full of weirdass kid content. The ones I've seen are mostly weird / scary, on the border.
It's all garbage, but youtube algorithm recommends it more and more the kids I've seen because it notice the longer screen time.
I wouldn't say it's downright illegal content, but definitely not tasteful.
Well, Myanmar had a genocide blamed on social-media (at least in-part), so arguably things are worse there, not just equally-bad.
Oh hell yes it is. Everywhere that Russia has interest in has been fraught with serious issues. Germany, Poland, France come to my mind - there have been reports concerning especially the spread of far-right and/or pro-Russian content for years now.
> I live in Norway and it doesn't seem that the problem is so severe here. Or is it simply that English speaking media is more willing to latch on to extreme events and make out that they are the norm?
You guys are simply too small to matter and have been in NATO from the start. In Sweden and Finland though, I had read reports of pro-Russian propaganda problems when they were in the process of joining NATO.
The unifying link is always Russia.
So, on most countries this proposal would be completely useless.
And Russia paid a lot of people to think that way, either directly (Schröder) or with extremely cheap gas.
>far right that
>*crickets* far left *crickets*
Man I am glad years ago I watched Yuri Bezmenov's interview with G. Edward Griffin.
Do tell. Content? Main ideas? A link? Anything?
/watch?v=s2b-I0Yqisc
/watch?v=9apDnRRSOCk
There is a larger population of bad actors, a greater variety of underlying cultural/philosophical differences and thus conflict, and the algorithms that seem fine for a smaller contained country like Norway can produce a different quality of topics at a larger scale. It's not just algorithm thresholds either - people are simply more naturally prone to follow fads when there is multinational scale affecting the quantity and rapidity of the content and replies/likes that they see (dopamine and confirmation bias).
Unsure what the solution is - maybe more location-based weighting of suggestions? Conversely you don't want to empower local predators. So far attempts at moderating the entire English speaking world by the standards of SF-cloistered young professionals and PhDs has also been unwieldy and led to backlash.
But these algorithms will totally curate wildly disturbing playlists of content because it has learned that this can be incredibly addicting to minds unprepared for it.
And what's most sinister is how opaque the process is, to the degree that a parent can't track what is happening without basically watching their kids activity full-time.
Idk if OFCOM is implementing this right or not, but I think there would be a much greater outcry if more people saw the breadth of these algorithms' toxicity.
Isn't it quite obvious that it's never been their prerogative. Nor protecting copyright.
If we're going to randomly throw blame around, then why not throw it on the ISP too? They're the ones ultimately serving the content. But I don't think anybody wants to open up that can of worms.
ISPs don't know what content they're serving up other than what host it's coming from 99% of the time.
Because you're the parent?
Yeah you can't monitor 100% of the time but like.. moderating your child's experiences is kind of part of the job isn't it?
Edit: I'm not saying the tech companies have no responsibility at all here, but surely the parent is the final responsibility in these matters?
When I was a kid if I went over to a kid's house and their parents let us watch R rated movies or whatever, if my parents didn't like that they would talk to the parents. If that didn't change, I wasn't allowed to go over there anymore
Why not the same with YouTube? If YouTube won't change, isn't it your responsibility to remove access?
Is the subtext here "don't have children if you can't do the job"?
If it is, then it's valid to discuss the difficulty of predicting what exactly the job of parent involves when it can drastically change due to technology and social norms over the interval of 5-10-15 years between making the decision and executing the role.
This isn't a blanket statement to abdicate responsibility, nor a blank check for unlimited responsibility, but certain unanticipated challenges are expected and some grace must be given in light of a dynamic environment.
Responsibility is an abstract concept that we operationalize in order to make judgements and decisions. Like any operationalization problem, how can you be transparent around its construction?
I was going more for "you made the choice to have a kid. You have the job whether you want it or not, so you better step up and do it"
But I suppose the corollary of that is what you said. I don't think it's very valuable to say that to someone who already made that choice though
Anyways, like I said, I don't think Tech companies have zero responsibility here, but the buck stops at the parents, period
This generations parents should not be trusting algorithms not to show their kids bad content any more than 90s parents trusted the teenagers at the movie rental place not to rent children R rated VHS tapes
Edit: Television was a highly regulated and curated feed of media, maybe parents got a bit too comfortable letting their children sit in front of that without concern. But treating on-demand internet content like Television is a mistake
And expecting "the algorithm" to deliver a similarly highly regulated and curated feed is also a mistake
When it comes to content that is illegal specifically - that of course, should fall on tech companies to moderate. But that is the exception, in my view.
In short, your child's oversight is not one-size-fits-all - it is strictly your business, and perhaps your school's and childcare professionals'.
- Should McDonalds be allowed to put crack in their happy meals or is it the parents responsibility to keep those meals away from their children?
- Should kids clothing be free of asbestos or is it the parents job to avoid buying that?
- Should baby formula be free of lead or is that the parents responsibility to check for?
If a company is deliberately pushing a product that is harmful and (arguably in this case) addictive to children, that is a problem regardless of the parental role.
For a fun and controversial example, one could look at the RNA vaccines for COVID. Those had some properties that separated them from traditional vaccines such that people relying on the class of "vaccine" might have felt misled. As such, you would have expected government regulation to inform the consumer on the difference to expect in that scenario (which the government did).
The biggest difficulty is coordinating this approach with other parents and institutions - it is punishing to be the only kid without a smartphone when peers (and increasingly, institutions) require you to have one to participate.
But that issue aside - it is still strange to allow for this class of products tailored to kids but parents are just supposed to universally agree should not be bought. There is clearly a society-wide issue here that we've left for individuals to solve. Predictably, it is not going well.
The US is all about freedom. We also allow people to smoke even though smoking kills more than AIDS, alcohol, car accidents, illegal drugs, murders, and suicides combined. That's weird...but we still allow it. Conversely, I would expect the EU to implement the kind of legislation you're advocating for.
A recent example of an algorithm going wrong is Reddit. Home used to show you strictly a feed of reddits you subscribed to, and it was shown as a timeline. The most recent changes not only removed the timeline approach to the feed, it's now injecting subreddits you don't subscribe to and asks if you're interested in them.
For those unfamiliar Ofcom is basically the UK telecoms regulator.
It is obvious that even adults are suffering negative consequences from social media, and if it isn't obvious, take a look at any of the studies showing the negative impact on adults of social media usage.
Every single consumer is outmatched. The only winning choice is to not play at all.
If someone can't handle their social media usage, you're right that they should stay away.
But this idea that "every single consumer" can't handle it is patently false. The vast majority of social media users aren't completely sucked in to their apps and phones. The time spent on platform graph for every platform has a long tail where the addicts reside, but most people just don't get in that deep.
It can seem that way when you're surrounded by addicts or, more commonly, when your social interaction comes primarily through social media (because addicts are over-represented, obviously). However, what you're missing is all of the people who aren't engaged in social media all day every day.
I take steps by not using my phone during work or after a certain time but it is extremely difficult and I still fall into the trap and watch some shorts for 2-3 hours at a time. I'm not stupid either, graduated with honors in CS and people consider me really smart. My brain just likes how it makes me feel.
Now, I have a fear what all this stuff will do to my child, if even I have trouble with it.
I hate almost everything about the modern commercialized web and really miss irc and forums.
reddit is 95% bots echoing the sentiments of a few liberal elites and the 5% of real users are childless aged women. No sexism, this is facts.
Reddit is one of the worst offenders for rage bait, algorithmic feeds, content farming, and vacuous content.
> (forced refresh if you turn your screen off on mobile, minimum and deliberately bad moderating).
Reddit absolutely refreshes your feed under certain circumstances depending on the platform, such as hitting the back button.
Your claims about moderation are also completely backward. People complain about Facebook being too sensitive about moderation, but Reddit is basically the wild west. Nearly anything goes on Reddit and the mainstream subreddits are frequently full of highly upvoted misinformation.
I had a friend who developed a problem with alcoholism. He went through a period of time where he'd stop by the bar several nights a week to have a single beer because he thought it was important to his social circle.
To no one's surprise, that one drink often turned into two drinks. Two became four, then six, then eight, then he was blacked out on a Wednesday again.
It took some time, but he finally admitted that his habit of visiting the bar was a trigger for the exact behavior he was trying to avoid.
When I see someone talk about how they have a severe social media addiction that they're trying to overcome, but then go on to talk about how they're a moderator on the platform they're trying to avoid, I see the exact same thing.
I don't know what else to say, other than that my friend is doing fantastic now that he's stopped visiting bars at all. He discovered that once he removed the bar as an option for his free time, he realized how many healthier alternatives there were in the real world. He wasn't constantly playing the game of moderating his alcohol intake because he wasn't in environments where he had to. He's much happier now.
Privacy reasons aside, a big reason I ditched social media and much of the normiesphere technology is the distract-ability. I take great care and pride in reducing unwanted automated interruptions to zero. My phones only make a noise if a cleared human on the other side is initiating the noise. There are zero "check this out" or "your coins reward is ready" crap pinging me, and I won't have it!
ADDENDUM: my abridged phone stack is:
GrapheneOS (there is nothing better)
Mullvad (audited by police raid) & Tor
Syncthing-Fork (because f' the cloud)
Fennec (+uBlock Origin,Sponsorblock,Tampermonkey)
Tor Browser Bundle (anti-glowie browsing)
BraveNewPipe (multiplatform and search settings)
Seal (decent yt-dlp wrapper)
Session F-Droid & Briar (anti-glowie messaging)
If the adult an protect themselves, they can protect the children they're responsible for too
Why should my mandatory social and medical insurance taxes go fix issues created by such wrong choices? Should the society not cover them? E.g. smokers with lung cancer should pay out of pocket? Or should society try to minimize wrongdoing instead?
You have essentially two polar options.
First option is that social services come with strings attached that entitle the providers to control the lives of the recipients.
Second is that social services are freely given, and the recipients have not given up their autonomy. the givers can choose to stop giving, or place conditions on gifts, but they dont get direct control over the recipients.
Either are fine in theory, but the problem is with ex-post recontracting. for example, when a gift or service is freely given, and then someone demands payment later.
There are some interesting works of fiction that explore alternatives. For example, allowing adults to choose how much of their autonomy they want to abdicate for differing levels of entitlements and guarantees.
This isn't exactly true.... All societies always have footed the bill, modern or not. If you cast the person out in a middle age society then expect to get robbed by bandits on your next visit to the town next door.
Which emphasizes why you should attempt to minimize wrongdoing before it gets expensive, when you don't it turns into that story of "there was an old lady who swallowed a fly"
I would agree with this, in the sense that the people who institute predatory algorithmic human interfaces are the ones who chose "unwisely".
Every single person living in modern society is "protectected":
- You're protected from people deciding which side of the street to drive on
- You're protected from a bank who tells you the money you depisited is "all belong to us"
- even a "market" can't exist without "protection"
Once every person has their own army of ML engineers and psychos at their disposal, then there is an oportunity for personal choice in anti-social media.
Or much simpler, the anti-social corps can be required to allow each user to configure their own feed algorithm. This would be a useful "protection".
The negative consequences of not having _any_ "protection" in anti-social networks are clear across society.
These are analagous to the damage done in the US by lack of gun protection. Guns are now the leading cause of childhood death in the US. Combine guns and 4chan/Discord and you get the rash of idiots shooting up the populace and then themseelves.
Yes, stop letting kids stare at screens all day. Yes, you are a bad/lazy parent letting the firehose of the Internet pipe into their heads.
The other argument is that this makes kids socially isolated from their peers, because they all have and use these devices. If that truly is the case there definitely still is a way to monitor your kids device and internet consumption without giving them free-reign. There are internet safety settings for parents on every device out there. Kids are perfectly capable of communicating with each other through a variety of mediums, they don't need tiktok (or whatever app is the trendy one of the decade).
The last argument, when you present the former argument, is that kids are clever and will find a way to get around controls. Yea, no shit, that's what kids do. Your role as a parent is to monitor that and teach/correct them.
I used to blame the shitty influencers and internet at large for the selfish greedy brats, but it's their parents. I've met too many exceptions where the difference was just "We limit their screen time." Maybe they end up shitty in some other way, I dunno, but at least they're going to be more functional than my nephews who my SIL is constantly trying to figure our how they get sucked into racism and greed and what to do about it. Stop letting them get all their views from greedy racists online would be a start - can't do that, she'd "never have a moments peace." Idiot human.
Side note, if you let your kids play roblox unsupervised, you're fucking up hard.
Yes, I know their are plenty of tools to allow parents to restrict what sites their children visit, etc... but not all parents are tech savvy enough to be able to set this stuff up, plus you could still allow a child to access Youtube, for example, but then find they are getting unsavoury recommendations from the algorithm.
This made me think about the fact that the major platforms (Alphabet, Amazon, Apple, Meta, and Microsoft) gather enough data on their users that they almost certainly know roughly how old someone is, even if no age has been provided to them. They can use all the signals they have available to provide a score for how certain they are that an individual is, or is not, legally an adult.
(As an example, if you have a credit or debit card in your Google or Apple wallet then you are almost certainly an adult because it would be very difficult for a child to obtain a card and get it into a digital wallet due to the security procedures that are in place.)
Given that, if these companies get forced to discern whether users are adults or not in order to serve appropriate content then it seems a no brainer for them to provide free age verification as well.
My vision would be for the UK government to provide an anonymised age verification router service. When a website requires you to verify your age in order to access some particular content it could ask you which age verification service you wish to use. It then sends a request to the government "middleman" that includes only the URL of the verification service. The router forwards the request anonymously to the specified server (no ip address logs are stored). If you are logged in to the account already then it will immediately return true or false to verify that you are or are not an adult. If you are not logged in then you will be prompted to login to your account with the service and then it will return the answer. The government server will then return the answer to the original website.
That way, we can get free, anonymous verification.
I'm sure people will have issues with this idea, such as "do you trust the government server to not log details fo your request instead of being anonymous?" - to which I do not have a definitive answer, but I feel like it is potentially a little better than having Google or Facebook knowing what sites I am visiting that need verification.
Anyone out there have any thoughts on this? I have only just had the idea pop into my head, so no serious thought has gone into it. There are probably issues that I have not thought about.