There’s a small indie game from 2013 that I think about often. In Lucas Pope’s Papers, Please you play an immigration inspector at the border of the gloriously miserable communist republic of Arstotzka, and your entire job is to scrutinise documents. Passport here, entry permit there. Does the photo match the face? Does the date of birth line up across the forms? Is the seal the correct one this week? Glory to Arstotzka. It is a fun little game about bureaucracy, but perhaps more importantly, it’s all about the banal machinery of the checkpoint, about how the act of demanding papers becomes so routine that you eventually stop seeing the human being on the other side of the glass and start seeing only a set of credentials to be approved or denied. While I loved the concept of the game, I could never get into it, I just don’t have the stomach to be a guard, I have too much trouble with authority. ACAB and all that.
I’ve been fascinated with this sort of petty bureaucracy for years. I am also a fan of “The Lives of Others”, of which I’ve written here before, where surveillance mechanisms are often put in place, but then misused for other purposes, you have an invasive regime that starts with the intention of safeguarding citizens, and ends up being used to pursue personal affairs.
If you live in the UK, or have been following the tech news, you may already know where I’m going with this. On June 15 the UK government announced a ban on under-16s using social media, so I suspect that we are about to live in an Internet where showing your papers is common.
What’s going on?
Keir Starmer and Science Secretary Liz Kendall have announced that social media platforms will be banned from offering their services to under-16s, with the rules expected to come into force in Spring 2027 and the first regulations laid before Parliament by Christmas. We don’t know if Starmer’s resignation will have an effect, but for now let’s assume that it will stay in place, as it appears to be very popular. The ban will cover a number of social media apps, including Snapchat, TikTok, YouTube, Instagram, Facebook and Twitter, while sparing other apps and sites such as YouTube Kids and private messaging apps such as WhatsApp and Signal. The proposals come bundled with a suite of additional measures: a ban on livestreaming for under-16s, restrictions on strangers contacting children (including inside games), default-off settings for 16- and 17-year-olds, and the rather eye-catching world-first of forcing “romantic companion” AI chatbots to enforce a minimum age of 18. The model is borrowed from Australia, which last year became the first country to bar under-16s from holding social media accounts at all.
I really want to be careful here for various reasons. I don’t have children, so I have no first-hand experience of how bad social media is affecting kids. I am not blind and today’s world is not the same in which I grew up. My childhood was spent playing outside, scratching my knees everywhere, swimming in rivers, and exploring dangerous places. It sounds a bit idyllic, but it was also quite boring, we only had 3 TV channels which replayed the same shows over and over. I had limited access to literature and had to rely on public and school libraries. I listened to the radio all the time. So I can’t even begin to imagine what it must be like to raise kids in the social media age.
There are also real harms, and I don’t even need to cite those, they’re well documented. I can completely understand the sentiment behind the ban, where we are told that children are growing up with a screen in front of their eyes all the time. I can see the complaints that childhood is being quietly strip-mined by infinite scroll and algorithmic outrage, by endless stimulation, cyber-bullying, and always-on peer-pressure. It is also clear that platforms have been neglectful in tackling online harms, often tailoring their products to make them more addictive. The government calls it “a line in the sand,” and as a piece of political theatre it lands.
But (and you could probably see that “but” coming from a kilometre away), the practicalities of such bans are what worry me. I can empathise with the problem, but find the solution to be highly-problematic. The question is not whether we should protect children, because the answer is always a resounding yes, but whether a ban will work. I’m extremely sceptical of bans, they seldom work, and they often produce unintended effects. The problem is that you cannot stop a 15-year-old from opening an account without checking the age of every single adult who tries to open one too.
The details
This is the part that tends to get lost in the warm glow of press coverage and government talking points. A ban on under-16s is not, operationally, a thing you do to under-16s. It is a thing you do to everyone. To keep the 15-year-olds out, the platform has to satisfy itself that you are 16 or over, and it cannot do that by politely asking, because the entire problem the law is trying to solve is that children lie about their age on a tick-box. So the whole edifice rests on a single concept that Ofcom has been tasked with defining, and it is called “highly effective age assurance.” The regulator has to run a rapid study on what that actually means in practice, with findings expected by October of this year.
We have a fairly good idea of what this will all mean, because people in the UK have been living with a smaller version of it since the Online Safety Act’s age checks were implemented last year. In practice, the fabled “highly effective age assurance” means one of three things: you hand over a government ID; you let a camera scan your face so an algorithm can guess your age; or you let a third party vouch for you using your bank or mobile phone provider. Each of these is a way of attaching your legal identity to your browsing. The idea here is that pseudonymous accounts will potentially disappear, that is, the assumption that you are a login name, not a passport number. This is an unavoidable side effect of the enforcement mechanisms. The ban is the headline feature, but we need to live with endless identity checks as the small print.
So far the age-verification in the Online Safety Act has not been too cumbersome, at least in my experience. I refuse to allow any site to have my picture, so I mostly get around it using VPNs, and this is the first issue that I have with implementing this thing to a wider audience. It is possible that any age verification will also come with some form of VPN restrictions… and that will really be quite problematic. Something else that worries me is that the proposed ban, when read together with other legislation, are deliberately flexible, designed so that ministers can switch particular features on and off across services without passing a fresh law each time. That sounds good, until you start to think that this could easily be misused by a government that is not so friendly, and looking to enhance the tools. The thing that gives me nightmares is a system of surveillance that would be required by this ban being misused by a Reform government to try make immigrant’s lives miserable.
Papers, please.
Show me your papers
I keep coming back to the phrase “papers, please,” because this is precisely what is being proposed. Many people who love civil liberties recognise that authoritarian societies use the checkpoint not because it is effective, but because the semblance of control is the point, even if this is often ineffectual (security theatre anyone?). Bored guards are often the first casualties in any movie, they’re ineffectual, easily fooled. “These are not the droids you are looking for”, the Jedi mind trick works on the weak-minded, and that’s your average guard.
So the point is the normalisation, and the costs can be quite steep.
The first cost is that it creates a honeypot. Age verification concentrates the gathering and storage of sensitive data, including biometric data under some circumstances. To prove that I am over 16 to a dozen platforms, my identity documents and biometric face-scans have to sit in databases somewhere, and those databases are now among the most attractive targets on the planet. This is not a hypothetical, last year a breach of a third-party vendor used by Discord exposed roughly 70,000 government ID photographs. Biometric data is special category data under the UK GDPR for a very good reason, unlike a password, you cannot change your face after it leaks. If there is a national network of data vaults across the country in the name of child safety, we should not be surprised if every few months there are breaches.
The second cost is that it does not really work, and the people it works least well on are precisely the people it’s meant to stop. Within days of the Online Safety Act’s checks going live, VPN apps surged to the top of the UK download charts. Some apps reported a 1,400% spike, and the UK racked up more than two million VPN downloads in August alone, and Reddit threads on how to get around the checks jumped exponentially. Meanwhile the facial-estimation systems turned out to be charmingly easy to fool; one widely reported case involved sailing through a “liveness” check by using the face of a character from the video game “Death Stranding”. The teenagers this law is aimed at are often the most VPN-literate and exploit-fluent demographic out there. Asking them to be defeated by a webcam is a bit like installing a lovely new lock and handing the key to the cat burglar because he seemed nice.
Concluding
So we arrive at the genuine dilemma, and I don’t think that it’s an easy one. Children are being harmed online, the platforms have been negligent, and “do nothing” is not a morally serious answer. I am, not one to argue that technology is automatically benign or that regulation is automatically the enemy. Habitual readers will know that I spend most of my time defending the building of new things. But I am truly worried that the proposed ban asks the entire adult population to surrender its anonymity, and constantly prove their age, creating a surveillance nightmare. Moreover, we could be pushing the very children it we are trying to protect towards the less-regulated corners of the web. We could also be retiring the pseudonymous Web that has been a civil-liberties asset for decades. And all of this for a level of protection that a moderately determined 14-year-old can defeat before dinner.
I’ll be the first to admit that I don’t have an answer, and I will not be the one to tell parents how to bring up their children, but I am concerned that the current measures will not work, and may even be detrimental to society as a whole. I strongly suspect that this is not the way to go. The tragedy of the “show me your papers” approach is that it lets everyone feel that something decisive has been done, while the thing that has actually been built is a machine for inspecting the rest of us.
Glory to Arstotzka. Next, please.
0 Comments