Blackburn & Blumenthal Introduce Terrible, Dangerous Bill To Make Sure Children Are Constantly Surveilled Online

from the this-is-a-bad,-bad-idea dept

Senator Richard Blumenthal is apparently a bottomless well of terrible internet regulation ideas. His latest is yet another "for the children" bill that will put children in serious jeopardy. This time he's teamed up with the even worse Senator Marsha Blackburn to introduce the Kids Online Safety Act, which as the name suggests is full of a bunch of overbearing, dangerous nonsense that will not protect children at all, but will make them significantly less safe while giving clueless, authoritarian parents much more power to spy on their kids.

About the only "good" part of the bill is that it doesn't attack Section 230. But the rest of it is nonsense, and based on a terrible misunderstanding of how, well, anything works. The bill doesn't just take its name from the UK's Online Safety Bill, but it also takes a similar "duty of care" concept, which is a nonsense way of saying "if you make a mistake, and let undefined 'bad stuff' through, you'll be in trouble." Here's the duty of care is self-contradictory nonsense:

BEST INTERESTS.—A covered platform has a duty to act in the best interests of a minor that uses the platform’s products or services

How the hell is a website going to know "the best interests of a minor" using its platform? That's going to vary -- sometimes drastically -- from kid to kid. Some kids may actually benefit from learning about controversial topics, while others may get dragged down into nonsense. There is no one way to have "best interests" for kids, and it's a very context-sensitive question.

PREVENTION OF HARM TO MINORS.—In acting in the best interests of minors, a covered platform has a duty to prevent and mitigate the heightened risks of physical, emotional, developmental, or material harms to minors posed by materials on, or engagement with, the platform, including—

(1) promotion of self-harm, suicide, eating disorders, substance abuse, and other matters that pose a risk to physical and mental health of a minor;
(2) patterns of use that indicate or encourage addiction-like behaviors;
(3) physical harm, online bullying, and harass17 ment of a minor;
(4) sexual exploitation, including enticement, grooming, sex trafficking, and sexual abuse of minors and trafficking of online child sexual abuse material;
(5) promotion and marketing of products or services that are unlawful for minors, such as illegal drugs, tobacco, gambling, or alcohol; and
(6) predatory, unfair, or deceptive marketing practices.

So, so much of this is nonsense, disconnected from the reality of how anything works, but let's just focus in on the whole thing about how a covered platform has a duty to "prevent and mitigate" risks associated with "eating disorders." Last year we had a content moderation case study all about the very, very difficult and nuanced questions that websites face in dealing with content around eating disorders. Many of them found that trying to ban all such conversations actually backfired and made the problem worse. But often by allowing conversations about eating disorders it actually helped steer people away from eating disorders. In fact, much of the evidence showed that (1) people didn't start getting eating disorders from reading about others with eating disorders, and (2) people writing about their eating disorders made it easier for others to come and help them find the resources they needed to get healthy again.

In other words, it's not a matter of telling websites to block information about eating disorders -- as this Blumenthal and Blackburn bill would do. That will often just sweep the issue under the rug, and kids will still have eating disorders, but not get the help that they might have otherwise.

Once again, a Blumenthal bill is likely to make the problem it ostensibly tries to solve "worse." There is similar evidence that suicide prevention is an equally fraught area, and it's not nearly as simple as saying "no discussions about suicide," because often forums for discussing suicide are where people get help. But under this bill that will be prevented.

This bill takes extremely complex, nuanced issues, which often need thoughtful, context-based interventions, and reduces to block it all. Which is just dangerous. Because kids who are interested in suicide or eating disorders... are still going to be interested in those things. And if the major websites, with big trust and safety teams and more thoughtful approaches to all of this are forced to take down all that content, the kids are still going to go looking for it and they're going to end up on sketchier and sketchier websites, with fewer controls, fewer thoughtful staff, and it is much more prone to a worse outcome.

Honestly, this approach to regulating the internet seems much more likely to cause serious, serious problems for children.

Then, there's the terrible, terrible parental surveillance section. The bill would mandate websites provide "parental tools" that would be "readily-accessible and easy-to use" so parents can spy on their kids' activities online. Now, to avoid the problems of surreptitious surveillance, which would be even worse, the bill does note that "A covered platform shall provide clear and conspicuous notice to a minor when parental tools are in effect." That's certainly better than the opposite, but all this is doing is teaching kids that constant surveillance is the norm.

This is not what we should be teaching our kids.

I know how tempting it is for parents to want to know everything their kids are doing online. I know how tempting it is to be afraid about what kids are getting up to online, because we've all heard various horror stories. But surveilling kids of all ages, all the time is a stupid, dangerous idea. First of all, the kinds of things that a parent of a six-year-old might need are drastically different than the parents of a 16-year-old. But the bill treats everyone 16 and younger the same.

And there are already lots of tools parents can use -- voluntarily -- to restrict the behavior of their kids online. We don't need to make it the expected norm that every website gives parents tools to snoop on their kids. Because that alone can do serious damage to kids. Just a few months ago there was an amazing article in Wired about how dangerous parental surveillance of kids can be.

Constant vigilance, research suggests, does the opposite of increasing teen safety. A University of Central Florida study of 200 teen/parent pairs found that parents who used monitoring apps were more likely to be authoritarian, and that teens who were monitored were not just equally but more likely to be exposed to unwanted explicit content and to bullying. Another study, from the Netherlands, found that monitored teens were more secretive and less likely to ask for help. It’s no surprise that most teens, when you bother to ask them, feel that monitoring poisons a relationship. And there are very real situations, especially for queer and trans teens, where their safety may depend on being able to explore without exposing all the details to their family.

And yet, this bill requires the kind of situation that makes teenagers less safe, and pushes them into more risky and dangerous activity.

Why is it every Blumenthal bill "for the children" will make children less safe?

And just think about how this plays out for an LGBTQ child, brought up in a strictly religious family, who wants to use the internet to find like-minded individuals. Under this bill, that information gets reported back to the parents -- and seems way more likely to lead to distress, harm and even possibly suicidal ideation -- because of this bill.

In other words, this bill tries to prevent suicide by forcing websites to take down information that might help prevent suicides, and then forces vulnerable kids in dangerous home environments to share data with their parents, which seems more likely to drive them towards suicide.

It's like the worst possible way of dealing with vulnerable children.

There are, of course, other problems with the bill, but the whole thing is based on a fundamental misunderstanding of how to raise resilient kids. You don't do it by spying on their every move. You do it by giving kids the freedom to explore and learn, but equipped with the knowledge that not everything is safe, and not every idea is a good one. You teach them to recognize that the world can be dangerous, but they need to learn how to be equipped to deal with that. Obviously, the best strategies for that will differ at different ages and based on the individual child. But assuming that all children up to age 16 must be surveilled by their parents and that websites should be forced to block information about which many kids will want to explore, seems like it would create a horrifically bad result for many, many children -- including the most vulnerable.

It's truly incredible how many horrible, horrible laws about the internet one man can sponsor, but Senator Blumenthal really has become a one-man "terrible bill idea" shop. People of Connecticut: do better. As for Blackburn, well, she's always been terrible, but I find it amusing to remind people she put out this video a decade ago, screaming about how the internet should never be regulated. And now look at her.

Filed Under: children, duty of care, eating disorders, for the children, harm prevention, marsha blackburn, online safety, parental tools, richard blumenthal, suicide, surveillance

UK Government Apparently Hoping It Can Regulate End-To-End Encryption Out Of Existence

from the sure-hope-'the-children'-are-grateful-for-the-shitty-future-being-handed dept

Politicians -- those motivated by the notion of "doing something" -- want to end encryption. They don't want this to affect their communications and data security. But they don't see the harm in stripping these protections from the general public. Often, the argument is nothing better than "only criminals want end-to-end encryption," something they trot out as a truism despite plenty of evidence to the contrary.

But these politicians (and government officials) are cowards. They refuse to call a backdoor a backdoor. They come up with all sorts of euphemisms while pretending compliance with proposed laws won't result in the creation of backdoors that can be exploited by everyone, not just the "good guys." They also deploy other euphemisms to attack encryption that protects millions of members of the public, referring to good encryption as "warrant-proof" or "military-grade." Those terms never survive examination, but the narrative persists because most members of the public have no interest in closely examining falsehoods uttered by governments.

The UK government has expressed an unhealthy determination to undermine encryption for years now. It has the fanciest of plans to undo protections enjoyed by UK residents for reason ranging from "the children" to "the terrorists." The underlying intent never changes even if the name on the office doors do. Regulators come and go but the desire remains. Even the bills get renamed, as though a different shade of lipstick would make the UK's anti-encryption pig any more desirable.

Rebranding from "Online Harms" to "Online Safety" only changed the tablecloths in the Titanic's dining room. The UK government wants encryption dead. But presumably "safety" sounds better than "harms," especially when the government affirmatively wants to harm the safety of millions of UK residents.

The Internet Society has taken a look at the revamped and rebranded bill and has delivered a report [PDF] that explains exactly where on the Internet doll the UK government plans to engage in inappropriate touching. There's no mention of backdoors or broken encryption, but complying with the law means possibly doing both.

The draft Online Safety Bill places a duty of care on service providers within the scope of the draft bill to moderate illegal and harmful content on their platforms, with fines and penalties for those that fail to uphold this duty. The only way for service providers that offer end-to-end encryption to comply with this duty of care would be to remove or weaken the encryption that they offer.

That's the end result of these demands. But the politicians and regulators pushing this are unwilling to directly refer to the harms the bill will cause. There's no ban on end-to-end encryption. There's no mandate for backdoors. Instead, the bill hopes to achieve these ends by applying regulatory pressure that makes both of these outcomes unavoidable.

Service providers deploying end-to-end encryption obviously cannot see the content of communications between users. The UK government says that's no longer acceptable. Providers need to be proactive in preventing the spread of certain content. That leaves them with only one option.

Ofcom can require that service providers use “accredited technology” to identify harmful content and “swiftly take down that content”. To comply with this requirement and fulfil their “duty of care”, service providers will likely need to resort to upload filters and other mechanisms that may interfere with the use of end-to-end encryption.

Basically, the same thing that saw Apple catch a considerable amount of heat will be expected to be standard operating procedure for any tech company doing business in the UK. Client-side filtering is the most efficient way to prevent the uploading and sharing of "harmful content." Shutting it off at the source means either invading devices or removing at least one end of the end-to-end encryption. And once those options are available, it will only be a matter of time before the UK government starts demanding access to unencrypted devices and/or messages.

And the UK government has specifically cited Apple's now-defunct plans to strip protections it previously extended to users and device owners as evidence the proposed law is a net gain for society.

[I]n the Daily Telegraph article announcing the Safety Challenge Fund, Home Secretary Priti Patel points to Apple’s client-side scanning proposal as a positive example, raising concerns about the criteria for evaluating Challenge Fund proposals.

In its quest for easy wins, the UK government is ignoring the long-term fallout of these demands. While it may have no problem stripping UK residents of strong data and communication protections, it may find it more difficult to talk powerful businesses into accepting less-than-solid protections for their financial interactions and transmission of sensitive proprietary info. And government employees still rely heavily on third-party contractors for communication services and data transmission/storage. These same employees also rely on devices and cell phones manufactured by companies that will now be forced to make their products less secure for everyone who uses them.

Everyone loses. But the people who will lose more and lose it faster simply don't matter. Before the cold reality of broken encryption hits home for politicians, they'll have already collected the PR wins needed to secure more terms in office. And with more time comes more power. Eventually, the UK government may find a way to exempt it from the impositions placed on the private sector, elevating them above the people they serve. In the end, very little will have actually been done to address the problems (child exploitation, terrorism) cited to justify these impositions. The only guarantee is that devices, communication services, and the internet at large will be expected to make huge sacrifices in service to the UK government's talking points.

Filed Under: backdoors, encryption, end-to-end encryption, going dark, online harms, online safety, online safety bill, uk

China's New Internet Regulations, Building On Western Internet Regulations, Requires Algorithms To 'Vigorously Disseminate Positive Energy'

from the justifying-actual-suppression-of-ideas dept

When the UK announced its rebranded "Online Safety" bill (originally, the "Online Harms" bill) we noted that the mechanism included was effectively identical to the original Great Firewall of China. That is, when China first began censoring its internet, rather than telling websites explicitly what needed to be taken down, it just gave vague policy guidance about what "harmful" information would be a problem if it was found online, and backed that up with a serious threat: if any service provider was found not to have taken down information the government deemed problematic, it would face serious consequences. There was, of course, no such threat for taking down information that should not have been taken down. The end result was clear: when in doubt, take it down.

It remains preposterous to me that all across Western democracies, we've seen them taking the same basic approach -- insisting that platforms need to be much more aggressive in pulling down "bad" information (loosely defined), with significant liability attached to leaving it up (even if the content is legal), and little in the way of punishment for overblocking. And, over and over and over again studies have shown that when you set up a liability regime this way, you get massive overblocking. It seems that some countries see that as a feature, not a bug.

And, of course, with that approach now being picked up in other countries, China has apparently decided to ramp up its own approach. Under the guise of stopping "harmful" information online, China has released a draft of new regulations to punish internet companies that don't remove harmful information:

China kicked off a two-month campaign to crack down on commercial platforms and social media accounts that post finance-related information that’s deemed harmful to its economy.

The initiative will focus on rectifying violations including those that “maliciously” bad-mouth China’s financial markets and falsely interpret domestic policies and economic data, the Cyberspace Administration of China said in a statement late Friday. Those who republish foreign media reports or commentaries that falsely interpret domestic financial topics “without taking a stance or making a judgment” will also be targeted, it added.

Part of this new effort is a set of draft regulations for "algorithmic recommendation" systems. Kendra Schaefer wrote out a detailed Twitter thread analyzing the proposal, and just how far reaching it is.

Among the new rules (as translated by by Stanford's DigiChina center) are some... um... interesting ones.

Algorithmic recommendation service providers shall uphold mainstream value orientations, optimize algorithmic recommendation service mechanisms, vigorously disseminate positive energy, and advance the use of algorithms upwards and in the direction of good.

Algorithmic recommendation service providers may not use algorithmic recommendation services to engage in activities harming national security, upsetting the economic order and social order, infringing the lawful rights and interests of other persons, and other such acts prohibited by laws and administrative regulations. They may not use algorithmic recommendation services to disseminate information prohibited by laws and administrative regulations.

It limits what kinds of keywords can be used. "Harmful" information cannot be used, nor "biased user tags" (whatever that means):

Algorithmic recommendation service providers shall strengthen user model and user tagging management and perfect norms for logging interests in user models. They may not enter unlawful or harmful information as keywords into user interests or make them into user tags to use them as a basis for recommending information content, and may not set up discriminatory or biased user tags.

There are also rules against using algorithms to manipulate systems -- but also to "shield information," which seems to contradict the requirements to block lots of information.

Algorithmic recommendation service providers may not use algorithms to falsely register users, illegally trade accounts, or manipulate user accounts; or for false likes, comments, reshares, web page navigation, etc.; or to carry out flow falsification or flow hijack. They may not use algorithms to shield information, over-recommend, manipulate topic lists or search result rankings, or control hot search terms or selections and other such interventions in information presentation; or to carry out self-preferencing, improper competition, influence on online public opinion, or evasion of supervision and management.

That one about "influencing public opinion" sure is interesting. How do you avoid influencing public opinion?

Like many recent regulatory proposals in the US, Canada, the EU and elsewhere, China leans heavily on "transparency" when it comes to algorithms:

Algorithmic recommendation service providers shall notify users in a clear manner about the situation of the algorithmic recommendation services they provide, and publicize the basic principles, purposes and motives, operational mechanisms, etc., of the algorithmic recommendation services in a suitable manner.

But, of course, viewing this in the Chinese context shows why such mandatory transparency has risks. In this case, China wants this transparency so it can further regulate what information people will see via algorithmic recommendations, and to intimidate/threaten companies not to spread information the government wants suppressed.

Again, similar to various internet regulations in the West, China has a nod towards end-user control and empowerment:

Algorithmic recommendation service providers shall provide users with a choice to not target their individual characteristics, or provide users with a convenient option to switch off algorithmic recommendation services. Where users choose to switch off algorithmic recommendation services, the algorithmic recommendation service provider shall immediately cease providing related services.

Algorithmic recommendation service providers shall provide users with functions to choose, revise, or delete user tags used for algorithmic recommendation services.

Where users believe algorithmic recommendation service providers use algorithms in a manner creating a major influence on their rights and interests, they have the right to require the algorithmic recommendation service provider to give an explanation and adopt related measures to improve or remedy the situation.

But, again, when viewed in the Chinese context, you can easily see how this kind of mandate can be abused heavily.

There is also, a "think of the children" provision, because no internet regulations these days are complete without such a moral panic heart string pull:

Where algorithmic recommendation service providers provide services to minors, they shall fulfill duties for the online protection of minors according to the law, and make it convenient for minors to obtain information content beneficial to their physical and mental health, through developing models suited for use with minors, providing services suited to the specific characteristics of minors, etc.

Algorithmic recommendation service providers may not push information content toward minor users that may incite the minor to imitate unsafe conduct, or acts violating social morals, or lead the minor towards harmful tendencies or may influence minors’ physical and mental health in other ways; and they may not use algorithmic recommendation services to lead minors to online addiction

Also, there's a built in complaint mechanism.

Algorithmic recommendation service providers shall accept social supervision, set up convenient complaints and reporting interfaces, and promptly accept and handle complaints and reports from the public.

Algorithmic recommendation service providers shall establish user appeals channels and mechanisms, to standardize the handling of user appeals and the timely provision of feedback, and realistically ensure the lawful rights and interests of users.

Failing to abide by these rules will get the companies fined (relatively small amounts -- about $1k to $5k -- at first). However, it also opens them up to significant criminal liability as well.

As Schaefer notes, this is China "going beyond" the internet regulations in the EU. But, what's left unsaid is that some of this is enabled by just how far the EU and others have gone in trying to get the internet to paper over the societal problems created by government failures in other realms.

It should be leading us to wonder why it is that China is so eager to embrace and extend this approach to internet regulations, rather than as an endorsement of such an approach.

Filed Under: algorithms, china, intermediary liability, internet regulations, online harms, online safety

What's Wrong With Parents Teaching Their Kids That Not All Internet Content Is Good?

from the instead-of-spying-on-them? dept

It's no secret that not all content online is good for kids to see -- though, the "threats" have been greatly exaggerated. However, it doesn't stop self-declared online child safety "experts" from giving terrible advice. For example, here's an entire article based on the claims of one such expert claiming that, rather than teaching kids how to deal with stuff they might see online, the real answer is for parents to hover over their kids when they use the internet. This would be from the same expert who once suggested that the answer to cyberbullying was to have someone dress up as Spiderman and tell kids that cyberbullying was "bad" (very bad!). She also goes on (like others) to blame YouTube for making kids want to do bad stuff. The simple fact of the matter, however, is that it is not reasonable nor practical to monitor your kids' every action online. Obviously, for very young children, it could make sense, but once they reach a certain age, it's not going to happen. Yet, instead of hovering over them at all times, why not teach them some online street smarts -- just as you would teach them to be safe when they walk outside alone? Teach kids that not everything online is good, and teach them how to be careful when they surf. In other words, don't act like bad stuff will automatically kill them -- but teach them how to deal with it so that when it inevitably does come up, they know can handle it.

Filed Under: kids, online safety

Press, Parents And 'Experts' Blew Online Safety Threat To Children Way Out Of Proportion

from the kids-are-pretty-safe dept

If you pay attention to most of the mainstream press these days, you could be forgiven for thinking that the internet is a den of sin, where children are constantly preyed upon by predators from every angle... especially on social networks. After all, we've been told about all the sex offenders on MySpace and Facebook. There are even a few so-called "experts" who you see quoted repeatedly on just how dangerous it is for kids online -- even though study after study has actually shown that fewer kids are being solicited -- and most kids seem smart enough to be able to deal with unwanted contacts just fine. However, you don't see those stories very often, because it's not as headline grabbing to say: Hey, Everyone's Overreacting! But sometimes it does happen... and USA Today has a nice article explaining that many parents and politicians are significantly overreacting to the "threats" online facing children. As the article notes, it's extremely rare for someone to "stalk" a person via their profile and abduct them. In fact, sexual abuse cases against children are way down (by 50%) from 1990 to 2005, as the internet became so much more popular. So, the idea that the internet and social networks have somehow put more children into harms way seems totally incorrect, and it's nice to see a news source like USA Today making that clear. This isn't to say children shouldn't be taught how to deal with strangers online -- but it's like learning how to deal with strangers you run into on the street. You don't keep your children from meeting strangers completely, you teach them how to be safe.

Filed Under: children, for the children, online safety, predators