Sunday's new blog entry on Age Verification

http://blog.secondlife.com/2007/12/09/more-on-age-verification/

LL has been at pains to point out that no data will be stored by Integrity or LL during the age verification process, and that Integrity will not share any info with its parent company Aristotle (Aristotle's primary business being the collection and sale of identity databases).

In both of these issues, LL seems to be treating us like children. I'm not sure that isn't what irritates me the most about this policy.

My blog response:

Blog above: “Thus, there is no collecting, using, storing, or transferring of your personal information beyond the one-time match. Period. Certainly, you are not being asked to place your information in a database.”

May 2007: “[10:12] Daniel Linden: it’s vaulted to provided a government-required audit trail for two years, but neither Linden or Integrity can access that data unless an audit is initiated.”

Vaulting is impossible without storing the data somewhere, most likely in a third-party site in addition to Integrity. It won’t be accessed UNLESS some government agency requires it. So am I right in assuming that a person getting a divorce could subpoena or legally request avatar identity information (or better yet Homeland Security could) from Integrity now as well as SL, and expect to get it if it was still vaulted?

Oh goodie.

And another question: what verification mechanism does LL have in place to ensure that Integrity will not share the information gathered with its’ parent company, Aristotle? You say this confidentiality is contractually enforced. How will LL know if Integrity violates the contract? Or is LL simply blindly trusting them? How … sweet.

Integrity is a product of Aristotle not a separate company/division. The PR video that can be found on www.aristotle.com clearly shows this as does the website.

This whole thing is amature. It protects no one. Not even LindenLab. Many countries do not follow US legal procedures so would not care that Aristotle is providing insurance. They would go after LindenLab officers. I find it interesting that Aristotle can provide insurance against litigation where access by a minor is involved if verified. Sounds very very risky to me.

Soon some enterprising parent is going to test the system. Have their kid verify and access some naughty place and then sue for damages. It is almost a sure money maker. LindenLab and Aristotle have in a way created the challenge.

Well as I 've just posted in the blog, LL needs to assert its responsibility and liability to ensure that no data used in the verification step is stored by itself or third parties in the T&S, not in a blog post which has dubious legal weighting.

Matthew

If the information is being data vaulted, then it is likely that it would fall under the jurisdiction of the US Patriot Act, which I understand would allow the US Government access to that information on demand.

Matthew

All things considering, isn't it true that everything on your computer is saved to memory; even to the extent that completely erasing all the memory you can find and reformatting wouldn't get rid of all attainable memory on ones' hard drive (hypothetically speaking) by say, the FBI? I heard it's possible, the point is...If our private information is being sent to LL or to Aristotle or Integrity (the irony hurts sooo much), wouldn't they be able to access it through the means I hypothesized about? Even if its "destroyed on contact"? O_o thats my worry

And lets say I am verified (I'm not, but I am 19), providing that whomever I offer is over 18 as my information, and they can't back up knowing that I am what I provided...What did I just accomplish? If they prove that I falsified information, they set themselves up for a -huge- class-action lawsuit, and if they don't, I get away scott-free being verified with someone else information, thus proving that the system is pointless. O_o

http://www.frasi.co.uk/blog/2007/12/10/ll-on-age-verification-again/

I just verified with an entirely fictitious identity culled from a language study textbook.

At least, I assume it's entirely fictitious. The address and dob I entered was, at least.

I am so sick of hearing about age verification. It is such a bad idea! Robin Linden finally came out and said that Aristotle will not be storing our information, and it only took like what... 5 blog posts until they answered the people? Our international users are having great difficulty verifying, which in the long run will cost LL money. I've heard of horror stories on the blog of people using known terrorist's information and it working. (supposedly the US government has posted everything about these people on websites, including driver's license) Also, some have said they have used their children's social security numbers, and the verification works.

I personally do not trust Aristotle/Integrity. I don't really like the idea of Linden Lab having my personal information, but I would prefer they have it than Aristotle.

Also, numerous testers of this beta verification have stated that they can easily cam inside of the flagged parcels, but I haven't heard if they can still buy things.

It never fails; on every blog post by Robin Linden there is something that she says that I find offensive. It is no wonder people are murmuring words like fired or resign. Why would they say they may force only certain countries to verify when this entire mess is still in beta? It sounded so discriminatory.

They need to come up with something better; I've never heard of a place like this that is asking for so much personal info. Is Second Life going to be that harmful to children? If it is, should we play on it as adults?

This is nothing to do with protection of kids - let's get that myth put to rest at least. Any youngster can obviously access all sorts of porn and other unsuitable material with no more than a few search terms into Google, and it's well known that predators could stalk chatrooms and social networking sites such as Facebook, Bebo etc - do we see Google or any other site demanding SS numbers, driving licence or passport details to access them? Of course not. Even porn sites don't have anything other than an age disclaimer and credit card requirement for access, so why LL feels the need to be the only company on the 'net to institute this ridiculously intrusive system is mystifying.

No, this is LL trying to wash their hands of responsibility for overseeing access to the Grid, plus a data-mining exercise.

I'm a UK resident, so the only way this dubious Aristotle/Integrity company (oh the irony of that name!) can get access to my passport or driving licence numbers is if I'm daft enough to hand it all over to them to add to their databases, as these are not publically available.

The blogs show that people have managed to verify entirely fictitious characters, known criminal and terrorist details, dead people's details, and their own underage kids' information. This system is idiotic and proven worthless and should be scrapped. What a huge waste of time and resources!

The thing that pushes my buttons on this is not Age Verification per se.

What I find thoroughly repulsive is the vile hypocrisy of it all.

It was dressed up as "trust" and "safeguarding kids".
It was transparently obvious to anyone of moderate intelligence that it could not possibly deliver on that. The reports of people 'verifying' with fictitious information simply confirm that. The reports of people failing with genuine data confirm that.

The truth is that it's all about insurance and PR for LL. LL have yet to come out and admit that.

IDV will do nothing to stop kids accessing restricted content.
IDV will do nothing to stem the flow of griefer signups.
All anyone needs is some arbitrary data that gets past Aristotle's "automated check is done at the point of contact, and all data is then purged".
Yes kiddies and griefers, you can use that false ID over and over - or if needs be use the next false ID - over and over.



In this latest blog, we've gone from information being vaulted to "no data is being taken, retained or stored. Rather, an automated check is done at the point of contact, and all data is then purged. Thus, there is no collecting, using, storing, or transferring of your personal information beyond the one-time match. Period."

I find that very difficult to believe.
No audit trail?
No trace of what information was used to verify?

The whole thing is about an attempt to limit liability for LL. It is done purely in the expectation that someone will take a civil case against against LL, and for no other reason.
Apparently the "I am over 18" on signup is not felt to be a strong enough defence. LL's legal advice appears to indicate that a second layer would be required.

How much stronger would the defence be?
Aritotle: “This entity submitted ID data that matched our database as being over 18 years old”
Lawyer: “What ID data did they submit?”
Aristotle: ”We don’t know. We purge all the data after the match."



We are being fed half-truths and spin.
We are being treated like morons.


I would be totally supportive of something that *genuinely* made it difficult for kids and vulnerable adults to get involved in the very immersive darker aspects of SL.
I would be totally supportive of something that *genuinely* made it difficult for griefers to sign up disposable avatars.



What LL have dreamt up is something that
- provides none of the child protection or trust that the PR/marketing muppets puked up
- labels those who verify as people who require access to porn

There is one and only one reason to verify. That is access to 'adult_content aka porn' and 'extreme violence'. Oh..and nipples.
Children will cheerfully and very easily "verify" for that.
Griefers, perverts, and perfectly normal adults will "verify" for that.

Nothing gets really verified. All that is required is some text that gets past Aristotle's brain-dead system.
I don't think that Aristotle really care. It's just a percentages game for them. What are the chances of a civil suit? What might be the costs? What kind of a plausible story can we spin at a court if/when it happens. It's all for appearances sake. They will just make a show and then pay up. The payments are already built into their financial model. It's just insurance.



The hypocrisy, double-talk, spin and other lies are absolutely sickening. Period.
LL want to cod us into buying in to all of that.


LL already have my true RL details. They also have my credit card details. They also have my assertion that I am over 18.
None of that is Linked to the IDV system in any way.
Apparently I can get through IDV as a known (and known to be dead) terrorist, or as somebody else, and LL/Aristotle will be satisfied.

Argggggh Im so fed up with this age verficaiton stuff. If you dont want to do, dont do it!!!! If you think that the governments of the world dont know your personal details anyway, you must be living on another planet.

All this rubbish about "Im not giving my details out" like they dont know most of it already. And if you think other SL type sims wont do the same well think again.

Pretty clearly a "shot over the bow" at Aristotle. Or, more likely, a PR-speak hint at the contents of some heated conference calls.

So now, the verification information already supplied by residents is in the hands of a company that is very likely to have this contract canceled without payment. One wonders how they'll try to recoup their losses.

I verified and had no problems with it, but was lucky in that respect, I guess. Now, I'll wait and see if the voices of gloom and doom are right. If they are, well then, my bad for verifying, huh? I think, though, that some people are panicking when there is not yet a reason to. If you don't want to verify yet, then don't verify. Wait and see what those of us who did have to say in a month or two. If we're posting about identity theft, e-mail inboxes full of spam, release of RL information unintentionally and carelessly, our houses being blown up, the world ending, etc., then you will know that you're justified in your caution. If not, then you will know that it's not as unsafe to verify as you think it is. Rather than jump the gun, and predict the downfall of SL and planet earth, wait and see what happens. I've read on the blogs and these forums time and time again how "this is the end of SL", with just about every new thing them implement. Funny that. Gambling is banned and SL is still here. At least, I'm pretty sure it is since I was logged on for a lot of yesterday. In fact, I see higher numbers logged in then I did several months ago. Maybe they're bots, but they're still controlled by some real life person, I think it still translates into more active residents overall. I also think that in the future, more websites and virtual worlds will be requiring this same sort of thing. I think it's a new age, people, an age where businesses MUST protect themselves against lawsuits, frivolous or otherwise, because a minor was accessing their content. My Space was required to turn over names of users who may be registered sex offenders (at least, that's the way I understood the article I read). That's waaaaay more big brother than LL asking for you to prove your age. The AV system as they have it set up does need some work, but overall, I don't think it's the terrible thing that everyone is predicting. I could be wrong........only time will tell. And if I am....I promise not to whine, but will humbly admit that I was mistaken, don't follow in my footsteps. But if I'm right, then will all of you who are against AV please stop complaining, too? (I was going to say whining, but that was too strong a word, because most are expressing actual fears they have, even if they are, perhaps.....PERHAPS I said, misguided)

So Flowerdew,

Any children on the grid have already lied to be here.
Do you believe that it is not easy for them to produce ID information that will get past IDV? They can trivially use a parents info. They can easily use some other info. Have you read any of the postings in which the weaknesses have been pointed out?
Have you read any of the postings in which people report verifying with bogus data?

What do you think will actually be achieved by IDV?
Do you see any need to implement IDV other than LL wanting to do it for whatever reasons?

Can you answer:
- Will IDV prevent under 18s from accessing restricted content?
- Will IDV make it significantly difficult for under 18s to access restricted content?
- Will IDV somehow enhance "trust" in SL?

If you answer to any of the questions is "Yes", could you please explain how?
I genuinely have to answer "No" to all questions.



I'd love to see LL giving clear explanations of affirmative answers to those questions.

I wish people would stop blaming Robin for all this. This wasn't an idea she woke up with one morning and thought it would be fun to implement.

It is a Linden Lab decision - blame the company, not the individual.

Broccoli

Did you let them know that the company failed them? That might be the icing they need to kick Integrity to the curb

I verified and well.. *shrugs* I think if I get any calls from the company (in which I didn't enter a phone number), then I shall be hitting them with a Do Not Call violation. I also hang up on polls, charity, and some family members. Junk mail.. that's a whole other can of worms. I don't mind that.. because my dad can always use the stuff for lighting fires in his wood burning stove

I'll second that.
The thing is a crock, but it's a corporate crock driven by lawyers and marketing muppets.
The personal remarks posted in reference to Robin are unfair.

I don't disagree with this. But Robin is the one who makes the controversial blog posts at 8pm, 9pm, then doesn't hang around to answer questions. Unless the lawyers and/or members of the board told her to do it that way, then she has earned at least some of the ire that's been directed at her.

It always sucks to be the bearer of bad news, but it seems pretty consistent behavior in her case, to toss the info out there at an odd hour, then run and hide.

Contrast to the blog post that preceeded hers, in which Sidewinder has replied several times.

-Atashi

It's Robin's job to break these things to us. That's why it always seems to be her 'bearing the bad news'.

Honestly... wouldn't you "post and run" at the end of the day, if you had to break crap like this to people knowing full well it would go down like a plate of ham sandwiches at a barmitzvah?

I think your comparison to Sidewinder's post is a bit erroneous. It's not a controversial policy announcement/clarification - it's merely a new download, and an optional one at that.

Broccoli

Probably not entirely comparable, though. Presumably, anything Robin could say would have to be vetted by counsel first, and good luck finding the corporate attorney over the weekend. [Edit: this is assuming that the matter is legally sensitive. Which ID verification is, almost by definition, but it gets extra sticky if I'm right that Aristotle is now "on notice" that they're about to lose the contract.]

But yeah, criticizing Robin for communication effectiveness would be fair, whereas blaming her for LL policy would be rather like holding Dana Perino responsible for Bush administration misadventures.

If she cannot be held accountable for blog posts with her name on them, why don't they just have a blog bot to post things? If they know that all of the comments are going to be negative maybe they should just close them. Why is it always Robin Linden saying these things that make me mad? Why did it take so long for a simple answer about Aristotle keeping our information? Hit and run blog posts are not my idea of a good Vice President of Marketing and Community Development. Seeing as that is supposedly her job, I don't see how she didn't have a say in how age verification would come about. Some of you in this thread have been known to complain about LL; why all the pity for Robin Linden all of the sudden? As if LL is one mass collective like the borg without influential individuals who make a difference within it. It should be her job to calm the masses down; she did a good job at first stating that Aristotle doesn't retain our information, but then she goes and states things like...well 'maybe' we will force some countries to verify and others to not. That sounds horrible. Lots of people outside of the US are having trouble verifying.

The is something that I have not seen mentioned in all of the blog posts and in the forum.

People say that it's ok to verify because they are only matching against data that they already have in their database. That may be true, but by verifying you are in essense verifying that you are indeed the person that they have in their database. No need to store any additional data. LL gets a Y oor N, set a verified flag in the record that they already have and they are good to go with whatever they want to do with that data.

Similiar to spam e-mails that say if you want to not receive anymore e-mails from them send an e-mail to or go to a particular web site to opt out. If you do that, in reality what you have done is said to the spammer that he has a valid e-mail address.

Giving out private info and having it retained is not really the issue, although it is CLOSE. The fact is Aristotle already has personal information (out-of-date info notwithstanding) on most people. Here, I think, are the real points:

- Aristotle maintains a vast database of personal info from which subsets and lists are sold to political and marketing entities.

- Neither LL nor Aristotle will retain any of the personal info ENTERED AT THE TIME OF THE VERIFICATION PROCESS, but LL WILL retain a "Y" flag in your avatar record and Aristotle WILL create an index that links your avatar to the rest of the database that contains your personal information, and/or an index in your personal information area that links you to one or more avatars in SL.

- So, once you have verified, your RL person and SL person(s) will be forever linked and another bit of categorizing and listing info will be available for Aristotle to sell to whomever they wish. For example, they might market to a political campaign a list of all potential voters who are residents of Second Life, or they might sell a list of potential customers in Second Life who have expressed an interest in adult-oriented activities and materials as indicated by a willingness to have their adult ages verified. Second Life residents are spending almost a million-and-a-half US dollars a day. Don't you think marketers would like to get their hands on a list of those buyers?

Because the story about the reasons for age or ID verification have been muddy and the details have changed with the wind, it's easy to see that this is not about "protecting the children," especially since this system is so convoluted and ineffective that no one with that goal in mind could have come up with this solution if he gave it half a minute's thought. It's about marketing, and perhaps, later, taxation (as has been suggested elsewhere with very good reasoning).

Now, couple this age/ID verification scheme with the new Search feature, which is being rolled out quickly at the same time and for which LL has been adamant that SL resident names MUST be included with no ability to opt in or out, making at least your SL name available to outside, worldwide, search engines. Suddenly, those lists Aristotle has for sale catapult in value. Not only will your SL name be tied to your RL information, but now a clever marketer, after purchasing one of Aristotle's lists, can contact you IN SL about things you are interested in in RL. Any separation of SL and RL lives will become so blurred as to disappear.

This link to one of Aristotle's marketing videos has been posted before, but if you missed it, I encourage you to take a look (see also the other videos thumbnailed on that page):
http://video.google.com/videoplay?docid=-4122546444822457411&hl=en

As I've already said, whilst Robin's job description means she is the one who has to write it on the blog, it certainly was not her decision or anything that can be blamed solely on her and her alone - and most likely several other senior Lindens have 'input' into the post before the "send" button gets hit.

It's quite clear that there have been a lot of mistakes in this verification process - but how much of it could be Aristotle lying, or at the very least being 'economical' with information to get the contract in the first place? I'm sure many of us could list examples of 'business deals' where one party has failed to live up to the promises it made.

I have tried verifying with every piece of information that the system lists, and it failed every time. That does not mean I am not who I say I am, it simply means that Aristotle does not have access to the information it requires to cross-check that I am who I say I am. That is Aristotle's problem, not Linden Lab's.

Go to any porn site that you can find, and you won't get much more than a "I am over 18, click to enter" button or at most 'enter your credit card details to gain access', containing much harder and certainly illegal stuff that you won't get in Second Life. Why is that not enough to CYA for Linden Lab?

Broccoli

The issue is not whether governments know this information. Of COURSE they know this information, they are the entities that gave out the passports/driving licenses/national ID cards in the first place.

This is typical "dismiss these people as tin-hat conspiracy theorist" mentality, where the real issue is never addressed.

The real issue is that Integrity/Aristotle have a business model that sells huge databases of such information TO ANYONE WHO CAN PAY FOR IT. If you've got the cash, you can have the information, simple as that. Second Life residents, especially those not in the US, are not comfortable with this information being in the hands of Integrity, nor are we convinced by promises that don't form part of a legally binding contract, that our data won't be kept and offered up for sale.

Get with the debate, or get out of the debate. Your point was irrelevant to the key issues.

Some have said that since any child can Google porn, LL's concerns about lawsuits are misplaced. I disagree, because parental control software exists that blocks all such websites, detecting them via screen scraping. In some cases, sites actually cooperate with the makers of such software. Windows Vista has parental control software built in, and reputedly it is not bad. But since LL's data is streaming video, it cannot be filtered by such programs. So parents do not have tools to protect their children from SL content, as they do from generic porn websites.

I think a much more effective scheme to actually protect children would be for LL to:

-- Keep the teen grid (on the main grid, unverifieds can cam into restricted areas anyway, and it is impossible to stop this without severely crippling SL's usability; children need to be kept off the grid)

-- Work with the makers of parental control software to be sure that they contain blocks to main grid access, blocks that do not rely on URL requests but that actually are informed by the main grid servers when access is attempted.

--------------

Of course, LL's verification scheme, so easily circumvented, is not about protecting children; it's about limiting liability. Does anyone know if Integrity's indemnification claims have actually been tested in court?

Note that legislation is now making its way through the U.S. Congress that expands the reporting requirements of service providers when reporting child porn online, see the "SAFE Act of 2007: Securing Adolescents From Exploitation-Online Act of 2007"; Chris Norse posted its abstract here:

/327/36/227899/6.html#post1789294

LL has already demonstrated themselves to be willing to comply with reporting the identity of avatars accused of child porn, so they would be in compliance. In a way, the act actually provides shelter for service providers, in providing guidelines for them to cooperate with authorities.

Is there any need for Age Verification of this kind? Would not compliance with reporting requirements and stronger enforcement of parental controls be not only more effective, but legally sufficient?