Dick Thornburgh and Herbert S. Lin, Editors

Committee to Study Tools and Strategies for Protecting Kids from Pornography and Their Applicability to Other Inappropriate Internet Content

Computer Science and Telecommunications Board

National Research Council



13.

 

Technology-Based Tools Available to Non-End Users



Complementing the discussion of Chapter 12 on tools for the end user, this chapter focuses on tools for other Internet stakeholders, such as Internet service providers, content providers, or operators of adult-oriented Web sites. As a general rule, these tools are most relevant to entities that have some commercial reason for existing--they have less relevance to non-commercial sources of sexually explicit material (e.g., individuals with exhibitionist preferences, friends sharing sexually explicit images, and so on).

provides a preview of this chapter.


13.1.

 

A .XXX TOP-LEVEL DOMAIN



".xxx" is pronounced as "dot-XXX."


13.1.1.

 

What Is a .XXX Top-level Domain?

A .xxx top-level domain (TLD) would be reserved for those entities providing adult-oriented, sexually explicit material. For example, www.foo.xxx would name a site on which such content would be found, and any pages within it (e.g., www.foo.xxx/example1) or any subdomains (e.g., www.fetish.foo.xxx) would be assumed to have similar content as well. A key element of proposals for .xxx is whether the use of .xxx would be voluntary or mandatory. If use were mandatory, all providers of adult-oriented content would be required to place such content on a Web page with the .xxx TLD, and penalties would be established for not doing so.

Today, assignment of domain names in some TLDs is done on a purely voluntary basis, whereas for other TLDs, an adjudicating body determines eligibility. For .com, .net, and .org, registrars of domain names perform a strictly administrative function; for the .edu, .mil, .gov top-level domains, some institutional entity decides that an organization is or is not eligible. However, regardless of the TLD involved, the content that a domain name owner wishes to place on its Web site is not necessarily related to the assignment of the domain name to that owner, and there is no requirement today for such a relationship.

Proponents of a .xxx domain argue that it would provide an easy way of recognizing material presumed to be inappropriate for children, obviating the need for a laborious inspection of Web pages for such content and simplifying the filtering task by simply blocking access to sites in the .xxx domain.

The institution authorized to establish new top-level domains is the Internet Corporation for Assigned Names and Numbers (ICANN), a non-profit corporation that was formed in October 1998 to assume responsibility for the IP address space allocation, protocol parameter assignment, domain name system management, and root server system management functions previously performed under U.S. government contract by the Internet Assigned Name Authority (IANA) and other entities.

If and when a .xxx TLD is established, it would remain for product vendors to build software that would provide users with the option of rejecting all domain names ending in .xxx. Parents, schools, teachers, and other concerned adults would then have to be willing to exercise the options enabled in the software.


13.1.2.

 

How Well Would a .XXX Top-Level Domain Work?

In essence, the use of a .xxx TLD amounts to a label to identify content as inappropriate or appropriate for children that is based on the source of that content. Thus, from the standpoint of the end user, all of the pros and cons of label-based filtering described in Chapter 12 apply to the use of a .xxx domain.

A .xxx domain would be intended to facilitate the blocking of access to sexually explicit material. Thus, in principle, it--along with filters--would help to protect against both deliberate and inadvertent access. From a filtering perspective, the effectiveness of such schemes depends on the reliability of the assumption that adult-oriented, sexually explicit material will be confined to a .xxx domain.

By definition, an .xxx domain name is reserved for sexually explicit material--and is thus irrelevant for any other material that is non-sexual in nature. It is likely that certain parties will have some incentives to place their content in such a domain.1 After all, they wish their content to be found, and segregating it into an adult-oriented TLD helps to make it found. (Indeed, a concentration of adult-oriented Web sites may in fact provide children and adults with a "target-rich" environment in which they could much more easily seek out sexually explicit material.) On the other hand, a .xxx domain does not deal at all with the issue of peer-to-peer transfers, e-mail attachments, and so on. For example, college students may post collected sexually explicit material on various servers run by universities or public Web hosting services--and there is no guarantee that all sexually explicit material will be contained on Web sites in the .xxx domain, even if all commercial adult-oriented providers choose to cooperate.

Two issues related to a .xxx TLD are whether the use of the TLD is mandatory or voluntary, and whether there is an adjudicating body that monitors the content contained in one or another of these TLDs.2 Today, no Web site owner is forced to use a given TLD, and there is no adjudicating body that determines if the content on a Web site matches its TLD.

For a .xxx domain, these two issues are related. Mandatory use of a .xxx domain for sexually explicit material would imply creating a body whose role was to decide what content must be placed into a .xxx domain, and thus would affect all domain name owners, not just those associated with adult-oriented content. However, because "harmful to minors" laws are community-specific, a single body might be tempted to use a "lowest common denominator" approach to such decisions. Thus, some organizations and firms would be forced to use a .xxx domain even if they did not believe their content was adult-oriented and sexually explicit. (Stigmatization might also result from forced placement into a .xxx domain, with the .xxx TLD becoming a de facto ghetto into which all controversial material is placed.) Coupled with filters that block Web sites with a .xxx suffix, this approach would lead to a bias in favor of overblocking. On the other hand, in the absence of an adjudicating body, or if the use of a .xxx domain is voluntary, adult-oriented, sexually explicit material could easily be found on non-.xxx domains. Filters designed to block sites based solely on the .xxx TLD designation would be ineffective against such content, and so commercial sites uninterested in differentiating between children and adult traffic could take advantage of the lack of the .xxx TLD. A voluntary .xxx domain might also reduce filter overblocking, since operators of sites with sexually explicit material that was not oriented towards adult entertainment (e.g., museums, medical schools) would not choose a .xxx domain name and hence would be less likely to be blocked.

A final--and critical--question for the mandatory use of a .xxx TLD is how it would apply internationally. That is, how would U.S. law be able to compel foreign Web site owners to use a .xxx domain?3 (Such a question is particularly relevant given the commonness of full frontal nudity in many mainstream foreign publications and Web sites.)


13.1.3.

 

Who Decides What Material Should Be Confined to .XXX Web Sites?

For voluntary use (in the absence of adjudicating bodies), only the organization in question makes decisions about what material is adult-oriented and sexually explicit. For non-voluntary use requiring an adjudicating body, the adjudicating body makes decisions about what should and should not be placed in each domain, thus raising the question of what community's standards would be used by the adjudicating body and how they would be determined.


13.1.4.

 

How Flexible and Usable Are Schemes Based on a .XXX Top-Level Domain?

The usability of schemes based on .xxx would depend in large part on whether or not domain names with these suffixes contain the content implied by the TLD (as described above).

Another issue is whether the .xxx TLD would receive ICANN endorsement. A number of schemes have been proposed to circumvent ICANN in the establishment of other TLD names. Such proposals have been controversial, because they violate principles that have been regarded by many as integral to the smooth operation of the Internet. In particular, a non-endorsed TLD name might not be uniformly accessible from every Internet access point (and today only a very small percentage of Web users could access sites based on non-endorsed TLDs), and under some circumstances, a user seeking to access a site based on a non-endorsed domain name might wind up at different Web sites depending on the location from which it was accessed.4


13.1.5.

 

What Are the Costs and Infrastructure Required for a .XXX Top-Level Domain?

For .xxx domain names, the adjudicating body must make decisions about every Web page that is posted on the Internet, because it must decide if such material belongs in a .xxx domain name. Such a task is daunting, and it is virtually impossible that an adjudicating body could do so. More likely, it would undertake what sampling it could do at reasonable expense and would examine non-.xxx sites that were reported as having sexually explicit content.

In addition, a .xxx domain would pose a number of technical difficulties.5 An adult Web site may reside on a .xxx domain, and indeed may wish to reside on such a domain. However, consider the example of a university--which hosts a wide variety of content, some of which is deemed to be adult-oriented and sexually explicit by the adjudicating body. Web pages for such content will--by assumption--reside underneath the .edu domain of the university. Under a .xxx domain name, another separate category in the domain name service tree must be maintained by the university. Alternatively, a university could require that projects containing such content set up their own Web servers in the .xxx domain, which does not involve a high cost. Project Web sites under the .edu domain could contain links to the Web sites in the .xxx domain.

A second technical difficulty is the fact that the domain name service of the Internet supports page redirection. That is, the owner of the site <www.safe_for_kids.com> has the technical capability to force individuals intending to visit the <www.safe_for_kids.com> site to visit a .xxx Web page instead, whether or not the owner of the .xxx Web page wishes this redirection to happen.6 Such a scenario raises a question of responsibility if a minor is channeled to the .xxx site. The owner of <www.safe_for_kids.com> has no sexually explicit content on its site, but is responsible for directing the minor to the .xxx site. The owner of a .xxx domain name may have taken no actions to attract children to the .xxx site. Who bears responsibility for this exposure?


13.1.6.

 

What Does the Future Hold for a .XXX Top-Level Domain?

At least one legislative proposal has been offered to support the establishment of .xxx domains.7 As this report goes to press in April 2002, the prospects of these proposals are unclear.


13.1.7.

 

What Are the Implications of Using a .XXX Top-Level Domain?

The establishment of a .xxx domain, even if use is voluntary, would establish a "big fat target" for subsequent regulatory efforts. In other words, even if its use is voluntary, it may not remain that way for long as policy makers take note of its existence.


13.1.8.

 

Findings on a .xxx Top-Level Domain

1. A .xxx domain that is selected voluntarily may have some appeal for enterprises that are involved primarily in providing access to sexually explicit material intended to arouse desire (i.e., what is often known as "pornography") and that use a distribution channel requiring the use of domain names. Such enterprises are likely to use a .xxx domain as a part of their advertising strategies.

2. A.xxx domain would have little effect on (a) sexually explicit material that is not intended to arouse desire but which some parties may regard as inappropriate anyway, (b) a mixed-use domain (e.g., a university with a .edu Web site with a faculty member who does research on human sexuality or studies the evolution of sexuality in art and media and wishes to post research materials on a university Web site), or (c) sources of inappropriate sexually explicit material that are located outside the United States (if these sources do not wish to be identified with a .xxx domain).

3. The use of a TLD to identify inappropriate content would require software (e.g., Web browsers) that can be configured to block content coming from .xxx sites. Conceptually, this arrangement is identical to that of filtering based on content, except that the task of developing black lists and white lists is made much easier.

4. The benefits associated with a .xxx domain would depend on the association of a TLD with specific content. This fact raises the question of an institutional entity that might be established to promote such association. If the benefits associated with a purely voluntary use of either domain are sufficient, then no such entity need exist. But if the affected public requires higher confidence in the association between TLD and content, such an entity may be required, and that entity would be venturing into difficult uncharted waters as it sought to determine whether certain content should or should not be contained within a given TLD. In the case of a .xxx domain, the scope of its responsibility would be to ensure that all sexually explicit material was hosted on a .xxx domain and nowhere else--an entirely daunting task.


13.2.

 

A .KIDS TOP-LEVEL DOMAIN



".kids" is pronounced "dot-kids."


13.2.1.

 

What is a .KIDS Top-level Domain?

A .kids top-level domain would be reserved for those entities providing material intended and appropriate for children. That is, it would be explicitly designed for the use of children, providing safe, lawful, and appropriate content (e.g., information and entertainment), services, and facilities of especially high interest for them. Further, it would safeguard the privacy and safety of all children accessing .kids domain names.

For example, www.foo.kids would name a site on which such content would be found, and any pages within it (e.g., www.foo.kids/example1) or any subdomains (e.g., www.nature.foo.kids) would be assumed to have similar content as well. In general, use of a .kids domain has been discussed in entirely voluntary terms, and it would make no sense to make it mandatory.

Proponents of a .kids domain argue that it would provide an easy way of recognizing material presumed to be appropriate for children, simplifying the filtering task by simply allowing access only to sites in the .kids domain. As in the case of a .xxx domain, product vendors would have to build software that would provide users with the option of accepting only domain names ending in .kids. Parents, schools, teachers, and other concerned adults would then have to be willing to exercise the options enabled in the software.


13.2.2.

 

How Well Would a .KIDS Top-Level Domain Work?

Because the use of a .kids TLD amounts to a label to identify content as appropriate for children that is based on the source of that content, all of the conceptual pros and cons of label-based filtering described in Chapter 12 apply to the use of .kids. However, in addition to the baseline question of the extent to which it would help to keep children away from inappropriate materials, a second question particularly relevant to a .kids domain is the extent to which it would succeed in providing appropriate, educational, and informative content and experiences for children.

A .kids domain would be intended to promote access to child-friendly material. To the extent that this occurs, children have less time available to seek out inappropriate material. Thus, a .kids domain alone may help to reduce deliberate access to inappropriate material but cannot address the problem of inadvertent access. A browser or Internet service provider restricting access only to .kids Web pages effectively provides the same kind of protection as a content-limited ISP service.

From a filtering perspective, the effectiveness of such schemes depends on the reliability of the assumption that material intended for children will be found on a .kids domain. It can be anticipated that many firms seeking to provide content for children will have incentives to obtain .kids domain names, because such a domain name would guarantee their audience. Today, no Web site owner is forced to use a given TLD, and a Web site operator can post anything on his or her Web site. If this were true in the .kids domain, it could defeat the intent of keeping children away from inappropriate content.

It is unlikely that those in the commercial enterprise of providing adult-oriented, sexually explicit content would choose to place their materials in a .kids domain. Furthermore, other enterprises, especially those operating in the commercial mainstream, would select quite carefully the content they would place in a .kids domain. However, it is easy to imagine that if .kids domain names were as freely available as today's .com domain names, certain parties would place inappropriate content of some kind on a Web site with a .kids domain name.

Thus, the safety of a .kids domain name likely depends on the existence of some mechanism to ensure that the content available from any given .kids site matches the intent of the .kids domain. One such mechanism is an adjudicating body that decides what organizations would be eligible for a .kids domain name (so that .kids domain names would not be as freely available as today's .com or .net names). Further, the body would make decisions about specific content that would be eligible for placement. The effectiveness of a .kids domain would depend, then, on the wisdom of the judgments of the adjudicating body and the extent to which it had the power to enforce its judgments. The body's enforcement power might depend on its ability to take away a .kids domain name from an owner found to be misusing it, or an acceptance of civil liability for false and deceptive advertising or business practices in that event (suggesting a possible FTC role).

The second question involves the extent to which a .kids domain would succeed in providing appropriate, educational, and informative content and experiences for children. It is clear that commercial entities that market their products and services to children would make significant use of a .kids domain. But as discussed in Section 10.9, non-commercial entities could also have an important role to play in populating the .kids domain.


13.2.3.

 

Who Decides What Material Should Be Allowed in .KIDS Web Sites?

In the absence of an adjudicating body for allocating domain names, only the organization seeking a domain name makes decisions about what material is appropriate for children. In the presence of an adjudicating body, the body makes decisions about what should and should not be placed in each domain, thus raising the question of what standards should be used by the adjudicating body and how they would be determined.

An undetermined aspect of a .kids domain would be the developmental or age level that should govern placement. As noted in Chapter 5, what is perfectly appropriate for a 16 year-old may be inappropriate for a 7 year-old. Coupled with the fact that the information needs of small children are generally less than those of older children, it would seem that content for .kids would tend to be oriented towards younger children.

One possibility for definition of Web sites eligible for a .kids domain name is a site that is subject to the requirements of the Child Online Privacy Protection Act (COPPA), that is, a site "directed" to children under 13. To determine whether a site is "directed" toward children, the Federal Trade Commission considers several factors, including "the subject matter; visual or audio content; the age of models on the site; language; whether advertising on the Web site is directed to children; information regarding the age of the actual or intended audience; and whether a site uses animated characters or other child-oriented features."8 If a .kids domain is indeed intended for use by children under 13, the FTC definition of a site directed to children is one reasonable point of departure for a working definition.


13.2.4.

 

How Flexible and Usable Are Schemes Based on a .KIDS Top-Level Domain?

The usability of schemes based on .kids depends in large part on whether or not domain names with this suffix contain the content implied by the TLD (as described above). As with a .xxx domain, another issue is whether these TLDs receive ICANN endorsement. A number of schemes have been proposed to circumvent ICANN in the establishment of other TLD names, and the discussion above about a .xxx domain in this area applies identically here.


13.2.5.

 

What Are the Costs and Infrastructure Required for a .KIDS Top-Level Domain?

For mandatory adjudicating bodies to make decisions about content, an effort would be required that is proportional to the volume of information posted by entities with a .kids domain names.

In addition, owners of Web sites in a .kids domain face liability issues. The proposition that a .kids site is appropriate for children is the draw for many users. Content deemed inappropriate by someone that is found in a .kids domain is likely to lead to lawsuits about false and deceptive advertising; if an adjudicating body is involved, it is likely to be named as well. Also, while the intent of a .kids TLD is to make certain material easy to find for children, the existence of a .kids TLD makes it easy to restrict children's access only to Web sites in a .kids domain, even though much other material might be both useful and appropriate for them.


13.2.6.

 

What Does The Future Hold for a .KIDS Top-Level Domain?

At least one legislative proposal has been offered to support the establishment of a .kids domain.9 As this report is going to press in April 2002, the prospects of this proposal are unclear.


13.2.7.

 

What are the Implications of Using .KIDS Top-Level Domain?

A Web site can offer users more than passive viewing of content. If a Web site in the .kids domain offers opportunities for a child to interact with other users on the site (e.g., through chat rooms, e-mail, bulletin boards, and so on), adults seeking to interact with children, such as pedophiles, are likely to be drawn to the site as well because of the high likelihood that a user will be a child. This fact is not likely to be reassuring to parents.

A second implication is the following: if a .kids domain consists only of Web sites explicitly designed for children, especially younger ones, it would be highly restricted. In particular, it would not carry sites that provided information for a range of ages (e.g., information found in encyclopedias, which are not designed only for children). Thus, a child restricted only to accessing a .kids domain may not have access to information necessary to do certain homework assignments. (Indeed, part of the appeal of Internet access is the access that people have to a broader range of information--and so restricting a user to a .kids domain reduces the Internet's appeal.) Such restrictions may be most appropriate for the youngest Internet users.


13.2.8.

 

Findings on a .KIDS Top-Level Domain

1. A .kids domain may have some appeal for enterprises whose businesses are involved primarily in providing access to child-friendly and appropriate material. Such enterprises are likely to use a .kids domain as a part of their advertising strategies.

2. The use of a TLD to identify child-appropriate content could require software (e.g., Web browsers) that can be configured to accept only content coming from .kids sites. Conceptually, this arrangement is identical to that of filtering based on content, except that the task of developing white lists is made much easier.

3. The use of a .kids TLD would also be useful as an indicator of appropriateness for children even in a non-filtering context, because it would enable parents and other responsible adults to determine a site's appropriateness at a glance.

4. The benefits associated with a .kids domain would depend on the association of a TLD with specific content. This fact raises the question of an institutional entity that might be established to promote such association. If the benefits associated with a purely voluntary use of either domain are sufficient, then no such entity need exist. But if the affected public requires higher confidence in the association of TLD and content, such an entity may be required, and that entity would be venturing into difficult uncharted waters as it sought to determine whether certain content should or should not be contained within a given TLD. In the case of a .kids domain, the scope of its responsibility would be to ensure that the material on Web sites in a .kids domain was in fact child-appropriate.


13.3.

 

AGE VERIFICATION TECHNOLOGIES



Because much of the political debate centers on the access of children to inappropriate sexually explicit material on the Internet, it is natural to examine online methods that can be used to differentiate between adults and children. Age verification technologies seek to distinguish adults from children and to grant access privileges only to adults. Age verification technologies seek to accomplish in cyberspace what a clerk checking an ID card or driver's license accomplishes in an adult bookstore.


13.3.1.

 

What Are Age Verification Technologies?

Age verification technologies (AVTs) seek to establish that a given individual is or is not an adult, and based on that determination, an information provider (generally a commercial Web site host) allows/denies access to certain material or allows/prevents a transaction to be completed. The structure of a typical commercial adult Web site is a home page (<http://www.adult_site.com>) on which are presented a number of sexually explicit "teaser" images that are immediately available to anyone arriving on that page. Other content is accessible only after the user pays for access or enters a special password to gain access.

As a rule, the home page of an adult-oriented, sexually explicit Web site has a number of other options that the user might subsequently choose:

  • A "free tour" in which additional teaser images are presented, perhaps on a number of additional pages;
  • A "sign-up now" button, which will take the user to a subscription page where he is invited to provide a credit card number; and
  • A "provide access code" field, in which the user can enter an access code that has been provided previously or through some other source.

In other cases, the home page may not have any images at all, or have only obscured but suggestive images, with a warning that says, "If you are under 18, please exit by clicking here." In addition, the site may display boilerplate language that seeks to immunize the site owner against charges that he has made sexually explicit adult content available to children ( contains an example); in these cases, the user may enter the site only by passing through this boilerplate language. Clicking the "enter" button is taken to be the user's assurance that he or she agrees with the conditions of use, which include stipulations about age.

As the structure of the canonical adult Web site indicates, the simplest age verification technology is a Web script that asks the user's age, and in many cases, such a request suffices. A similar situation obtains with online forms and profiles that users are often asked to fill out; such profiles often include entries for age. But because young people are sometimes willing to lie about their age, stronger age verification is generally necessary. In general, systems for age verification are based on the technologies described in Chapter 2.

Age verification technologies are implemented by parties who wish to restrict the access of their online products or services to adults. (In addition to limiting access to adult-oriented, sexually explicit materials, AVT infrastructure may also be useful to individuals who sell alcohol, tobacco, or other adult-only products over the Internet.) However, the deployment of an age verification technology may not indicate a desire to verify age--in particular, consider credit cards that serve the dual function of age verification and payment medium. Because credit cards are today the simplest medium for online exchange of funds, the use of credit cards is just as likely (indeed, far more likely) to indicate a desire to be paid as a desire to restrict adults-only products and services to adults alone.


13.3.2.

 

How Well Do Age Verification Technologies Work?

In general, AVTs protect against deliberate access to sexually explicit material that is being sold. However, they provide no protection against non-commercial sexually explicit material (e.g., an exchange of sexually explicit images between two friends), or against deliberate or inadvertent access to "teasers" on adult Web sites. AVTs also provide benefits both for the owner of an adult Web site (who can operate with less fear of running afoul of the law) and for society (which can reduce the frequency of children coming into contact with adult material or making transactions reserved for adults only).

AVTs protect primarily against deliberate access to sexually explicit material for which adult Web site operators require payment. To be effective, age verification technologies must be deployed in front of any content that is inappropriate for children--in other words, a user must have to pass through an adult verification screening (thus verifying that he or she is an adult) before he or she has access to adults-only content. Material behind an AVT screen is inaccessible to most search engines--and thus cannot be found inadvertently. However, this simple-to-achieve safeguard--placing a "plain brown wrapper" around an Internet adult Web site--is often not implemented even by those sites that require a credit card to get past the teaser pages.

The effectiveness of AVTs is mixed, though they clearly do eliminate some significant percentage of children who would otherwise gain access to sexually explicit material. Factors that reduce the effectiveness of credit cards as AVTs include the placement of highly explicit material before credit card numbers must be submitted, possession of credit cards by children (but see ), and the availability of parental credit cards through the rifling of a parent's wallet or purse. On the other hand, the use of credit cards is convenient for both user and vendor, and access can be granted in a matter of a few minutes.

AVTs that rely on public records indicating age provide higher levels of assurance regarding age. But they are incompatible with rapid initial access, because they rely on the postal service to deliver age credentials. Furthermore, because not everyone has a driver's license or is registered to vote, vendors that rely on AVTs based on public records have a smaller audience than they would otherwise have. (In other words, these AVTs exclude individuals who would be entitled to gain access.)

AVTs also presume that an adult has not left the access device without logging out. If he or she does not log out, the next user--who may be a child--will automatically have access to all of the content that was accessible to the adult.

Finally, the age of adulthood differs from state to state. Because it is technically difficult to make geographical distinctions among points to which content is delivered, in practice most Web site owners choose 18 as the threshold age above which they will allow access, even if in some states 16 or 17 would be perfectly acceptable and legal. In these cases, those individuals are denied access for no legal reason.


13.3.3.

 

Who Decides What Is Inappropriate?

The Web site owner is the primary decision maker about whether or not the site contains material that is inappropriate for children. If so, the Web site owner deploys AVTs to prevent access by children. However, there have been legislative attempts to promote the use of AVTs, as described in Chapter 4.

Because it is the Web site owner that makes the decision to use AVTs, many sites containing what some people consider inappropriate material would not see any need for age verification (e.g., Victoria's Secret). As a practical matter, AVTs will be used to differentiate adults and children only when the site contains material that the site operator believes is obscene with respect to minors.


13.3.4.

 

How Flexible and Usable Are Products for Verifying Age?

As a general principle, more rigorous age verification procedures will increase the "hassle factor" that users face. For example, a higher degree of reliability is available when public records can be checked and an access code sent to the postal address associated with those records. However, such a requirement also prevents adults from gaining the immediate access that is possible with certain other methods.


13.3.5.

 

What Are the Costs and Infrastructure Required for Age Verification?

Financial Costs

The costs of using AVTs fall primarily on Web site owners and on adult users.

Psychological and Emotional Costs

AVTs may entail a loss of privacy for the adult user, both perceived and real. In a face-to-face transaction with a clerk checking a driver's license, there may be some embarrassment, but as a general rule, the clerk does not make a record of the license and does not record the titles of the material being purchased or rented. As importantly, the user can see that the clerk is not doing so. When an online AVT is used, the reasonable assumption would be that records are being kept (whether or not they are in practice), and so the user has a plausible reason to be concerned that his name is associated with certain types of material.

The privacy problem is exacerbated by how some AVTs work. For example, an age verification system (AVS) often provides a code number certifying age, which the user enters into the age verification field on an adult Web site. Usually, the Web site then contacts the AVS to check the validity of this number (which will expire if the user does not maintain his AVS membership). Thus, the AVS has a complete record of all of the adult sites visited using its age credential.

Furthermore, AVTs that rely on public records generally have access to the age information recorded therein. Thus, the age of a user is made available--even though that provides more information than is needed to satisfy statutory requirements.

Note also that commercial trends are pointing increasingly toward the customization of computer and device behavior and function to specific users (who may be one of many using a particular device). To the extent that this is true, age information may be associated with such functionality. At the same time, for many hosts, there are few incentives and not much of a business case to go to the expense of deploying AVTs.

It should be noted that legislation such as the Child Online Protection Act (discussed in Chapter 4) does not require personal identification--the AVTs specified in the legislation are intended as a way to screen out most minor children, not to obtain the identity of users. However, the transaction between site operator and credit card company inevitably entails some expense for the credit card company, and so the credit card company is not likely to be willing to process such requests if no revenue results from it--therefore, the site operator will submit only transactions that are associated with an actual purchase, rather than a simple age verification request, and purchases are necessarily connected with personal identity.

Infrastructure

The primary infrastructure issue is the deployment of AVTs among host sites. AVTs can play a meaningful role in reducing the access of children to adult-oriented material only to the extent that they are indeed widely deployed. (If they are not, they render only a small amount of content unavailable, and the generic equivalent of that material is almost certainly available elsewhere.)

Depending on the kind of AVTs involved, other cooperating institutions or individuals are necessary.

  • AVTs that rely on public records indicating age obviously depend on the availability of those records from public agencies. Given that there is some controversy about the widespread commercial availability of such records, their continued availability from public agencies cannot be taken for granted.
  • AVTs are often built into parental controls, and parental controls must be deployed by the adults responsible for youth. In practice, today's infrastructure for Internet access means that all access points (computers) that a given youth might use must have the appropriate parental controls.


13.3.6.

 

What Does the Future Hold For Age Verification Systems?

Improvements in AVSs depend primarily on the development and deployment of an infrastructure to support age verification, rather than the technologies themselves. For most commercial online transactions, the age of the consumer is not particularly relevant, assuming that the consumer has the ability to pay for the products or services being offered. Thus, there appears to be no general-purpose need for a pervasive infrastructure for age verification.

This suggests that if improved AVSs are to be available for vendors of adult-only services and products, the infrastructure required for verifying age must either be (a) a subset of an infrastructure that can be used for broader purposes, or (b) deployed by those vendors.

In case (a), a number of scenarios are possible. For example, smart-card technology enables a higher degree of security in authentication than do passwords, which are easily compromised. A "smart card" is a small physical hardware device (typically the size of a credit card) containing read-only non-volatile memory and a microprocessor that can be inserted into a card reader attached to a computer. In most scenarios, the individual user carries the card and inserts it into an Internet access point that requires such a device. The memory provided on the device can store information about the user, including his or her age, preferences for material to be blocked, and so on. Software installed on the computer, and on Web sites visited, would check the smart card for dates of birth when necessary, and if the user were underage for certain types of material, would refuse to grant access to that material. However, computing and Internet access technology has not developed in this direction, and the costs of converting to such an infrastructure specifically for this purpose are entirely prohibitive.

If, for other reasons, such technologies become common on personal computers and other devices that can be used to access the Internet, those offering adult-only products or services would be able to require a smart card-enabled age verification as a condition of access. Even today, one firm seeks to offer "smart" library cards on which parents can indicate their preference for their children to have filtered or unfiltered Internet access in the library.10 Nevertheless, the effectiveness of such an approach depends on the vendor's decision to deny access to those who are unable to present a smart card, for whatever reason (including the lack of a card reader on an Internet access point or a legitimate adult customer who lacks the smart card). Such a decision runs quite counter to business incentives to achieve the maximum exposure of a product or service being sold.

Another scenario is that a vendor's knowledge of a user's age may well provide business benefits and more lucrative marketing opportunities. Routine collection of age information may well occur in the future with tools that provide automated policy preference negotiation (e.g., Passport and similar products11). However, age information collected in this manner may well not be verified (as it is surely not when a child is asked online to reveal his or her age).

In case (b), the current "adult check" services available are an example of a vendor-supported infrastructure. However, for the most part, the adult-check services used by those providing sexually explicit material are based on credit cards. (One might argue that credit cards are themselves an infrastructure on which adult check services build.) More effective verification services that are dedicated to serving these vendors are likely to entail considerable expense.

Today's credit cards do not distinguish between minor and adult owners. But it is technically feasible for credit cards issued to youth to be tagged with an entry in the credit card company's database saying "do not authorize payment for sexually explicit material." The downside of such an approach is the processing burden that it imposes on the credit card company's systems.

Given widespread concerns for privacy, it may also be possible to develop AVTs that provide a greater degree of privacy for individual users. In particular, the legal requirement that age verification technologies are seeking to meet is not the age of the user but rather whether on a given day he or she is over 18 (or whatever the age of majority is).

Finally, despite the limitations of AVTs based on credit cards, they could be much more effective if they were systematically coupled with "plain brown wrappers" around the content that is inappropriate for children. Chapter 9 described elements of a regulatory approach that can be used to encourage the deployment of AVTs in front of all content that is regarded as inappropriate for children.


13.3.7.

 

What Are the Implications of Using Age Verification Systems?

Widespread AVTs may compromise the privacy of adult viewing. Also, some AVTs enable--indeed require--systematic tracking of all sites that use a given age certification, thus allowing a dossier of visited adult sites to be compiled. Thus, they may inhibit free flow of information and create a chilling effect on the freedom of adults who wish to access lawful though perhaps controversial material.

Widespread requirements to present documents certifying one's age raise many of the same concerns that national ID cards raise. In particular, while acknowledging that verification of one's adult status is necessary from time to time, the concern is that a diversity of methods and documents for certifying one's adult status will--in the name of simplicity--lead easily to a single document indicating age, and perhaps other personal information. Once such a document exists, it becomes very easy to insist on the use of this document as the necessary documentation for a wide range of societal benefits, such as employment, health care, gun ownership, and so on. Much as the Social Security number has evolved into a de facto universal identifier, such a document could well become the basis for national databases that track all of the significant activities of all those with this document--and all of the concerns about loss of privacy and government/private sector abuse emerge in full force.


13.3.8.

 

Findings on Age Verification Technologies

One approach to protecting children from inappropriate sexually explicit material on the Internet is based on being able to differentiate between children and adults in an online environment, and AVTs are a tool available for doing that.

1. Those wishing to verify age with a high level of confidence require that a document with proof of age can be associated clearly and unambiguously with the specific individual in question. Over the Internet, there is no mechanism known to the committee that accomplishes this task on a short time scale (seconds or minutes).12

2. As a practical matter, AVTs will be used to differentiate adults and children only when the site contains material that the site operator believes is obscene with respect to minors.

3. Mechanisms that prevent age verification on short time scales are likely to have a significant negative impact on sales and would be an impediment for adults seeking commercial adult-oriented products and services.

4. AVTs based on credit cards do provide some significant obstacles to children seeking deliberate access to inappropriate sexually explicit material. However, as credit cards (and prepaid cards usable as credit cards) are increasingly marketed to adolescents as young as 13, such AVTs will become less useful. Furthermore, parents that have explicitly allowed their children to have credit cards or prepaid cards may be more likely to trust the viewing behavior of their children as well.

5. The underlying technology to support widespread, high-confidence age verification does exist, but its implementation could be very expensive, and its use would raise a myriad of important privacy concerns.


13.4.

 

TOOLS FOR PROTECTING INTELLECTUAL PROPERTY



The widespread use of tools for protecting intellectual property may help to reduce the exposure of children to inappropriate sexually explicit materials that may have been taken from subscription adult-oriented Web sites.


13.4.1.

 

What Are Tools for Protecting Intellectual Property?

A variety of technologies have been developed to protect intellectual property. For example, some rights management technologies enable an image to be transmitted to a given user but increase quite substantially the difficulty of printing, forwarding, or saving it.13 ( describes some rights management technologies.) Other tools compare an image or text found on a Web site to a known and properly owned image or text (presumably the property of its creator or subsequent rights holder), and allow the flagging of near-matches that may indicate improperly derived works.

The primary users of rights management tools would be content providers with proprietary content.


13.4.2.

 

How Well Do Tools for Protecting Intellectual Property Work?

As noted in Chapter 3, the online adult industry is highly stratified--and includes a relatively small number of well-established firms and a much larger number of "fly-by-night" operators, many of whom illegally use copyrighted content from established firms. Wide use of rights management technologies could significantly reduce the flow of new content to these firms. There is some reason to believe that these smaller firms and operating entities are also the parties that are least responsible about keeping children away from their adult-oriented content.14 To the extent that this is true, drying up the supply of new content for these firms will increase the likelihood of a shakeout in the industry that will increase the prominence of the more established firms at the expense of these smaller ones.

A more mature adult industry (consisting of established firms rather than the "fly-by-nighters") is likely to have more concerns about the protection of intellectual property as well as being more likely to take actions to restrict the access of children to their products. With a reduction in the content available to fly-by-night firms that are less likely to take actions restricting the access of children, certain types of adult content will be less accessible to children. The reduction is likely to mean a lower degree of inadvertent access, but the ease of deliberate access to generic adult content is likely to be unaffected to a significant extent.

Approaches based on tools to protect intellectual property of the adult entertainment industry are relevant only to content originating there, and have no applicability to content for which no intellectual property rights can be legally asserted.

A second benefit of tools that detect possible thefts of intellectual property is in the prosecution of child pornography. As noted in Chapter 4, obscenity and child pornography differ in a number of key respects, and one of the most important differences is that while a legal determination that an image is obscene depends on factors extraneous to the image itself (i.e., on community standards), a legal determination that an image constitutes child pornography does not. Thus, once an image has been determined to be child pornography, images that are substantially identical to it (e.g., cropped images, images with shading superimposed on top) can also be determined to be child pornography. Thus, images suspected of being child pornography can be automatically compared (e.g., by a Web-crawling "spider") to databases of known child pornography.15 Such a technique will not identify new images of child pornography, but since a substantial amount of child pornography is "recycled," application of this technique is still relevant.

The impact of rights management tools (RMTs) on reducing access of children to adult-oriented material depends on their widespread use, but in any case is an indirect one. The primary purpose of an RMT is to protect intellectual property--and the secondary effect may well be to reduce the volume of adult-oriented materials available to children.


13.4.3.

 

Who Decides What Is Inappropriate?

This question is not applicable in this context.


13.4.4.

 

How Flexible and Usable Are Products for Protecting Intellectual Property?

From the standpoint of the end user, the primary usability issue is the extent to which different content providers use the same RMTs. If every Web site uses a different "home-grown" RMT, the user interfaces for viewing content are likely to be different--and thus the user will have to use different methods for viewing different Web sites. This limiting case represents the greatest degree of inconvenience for the user.


13.4.5.

 

What Are the Costs and Infrastructure Required for Protecting Intellectual Property?

An approach based on the protection of intellectual property requires client-side software and hardware to perform rights management. While in principle any individual content provider could simply download rights management software to a user to protect its intellectual property, the effort required to do so is large. A widely deployed rights management system would be something on which many content providers could rely to protect intellectual property--and some infrastructure software, such as Windows Media Player, is beginning to incorporate such features. Alternatively, the content providers in the adult industry could develop their own rights management system and require that their content be displayed through it.

An essential element of infrastructure for the use of tools to protect intellectual property is an enforcement mechanism. The enforcement mechanism is technical if the technology prevents content from being improperly copied. However, such systems sometimes affect the user's experience, making systems slower and less convenient to use and to customize for his or her needs. Content providers who insist on using such systems then must deal with customer dissatisfaction that arises as a result. When the technology facilitates or enables the detection of pirated materials, a procedural or organizational or legal mechanism is needed to prevent further pirating and/or to deter others from doing the same. For example, if pirated materials are found on the bulletin board of an Internet service provider, the ISP has to be willing to take down pirated material if intellectual property rights are to be respected.


13.4.6.

 

What Does the Future Hold for Tools for Protecting Intellectual Property?

As of this writing, a variety of technology vendors are in the early stages of developing rights management metadata systems, by themselves (for example, XMCL from RealNetworks and others (<http://www.xmlcl.org>)) and as part of broader content standards (e.g. MPEG-21). At the same time, peer-to-peer technologies such as Gnutella demonstrate that if a single copy of content can be placed on the network with no rights management wrapping or marked as "unlimited and untracked use by anyone," it can become widely distributed rapidly.

A more detailed discussion of the future of tools for protecting intellectual property is beyond the scope of this report. A report by the National Research Council--The Digital Dilemma--addresses this point in greater detail.16


13.4.7.

 

What Are the Implications of Tools for Protecting Intellectual Property?

Discussing the implications of tools for protecting intellectual property is beyond the scope of this report. A CSTB study--The Digital Dilemma--addresses these implications in substantial detail.17


13.4.8.

 

Findings on Tools for Protecting Intellectual Property

1. Purloined content accounts for a significant fraction of sexually explicit material on the Internet, though reliable data on this point is hard to obtain. Tools for protecting such content as the intellectual property of its creators thus have some potential to limit the number of Web sites and channels through which such content might be obtained.

2. To the extent that the rightful owners of this content are firms sufficiently established to be willing to take steps to deny children access to their material, it is in the interest of children that the intellectual property rights of these parties are respected. Owners and operators of adult Web sites will have to take the initiative to enforce intellectual property protection if this approach is to prove viable.


Boxes

Box 13.1 Boilerplate Disclaimer
Box 13.2 Visa Buxx pre-paid Visa cards
Box 13.3 Rights Management Technologies


Table

Table 13.1 Technology Tools for Use by Non-End Users


Notes

1 For example, Seth Warshavsky, president of the Internet Entertainment Group, an adult entertainment company, told the U.S. Senate Commerce Committee in 1998 that he would like to see a .adult domain: "We're suggesting the creation of a new top-level domain called '.adult' where all sexually explicit material on the Net would reside." See "Congress Weighs Net Porn Bills," CNET article, February 10, 1998, available online at <http://news.cnet.com/news/0-1005-200-326435.html>.

2 An adjudicating body refers only to an entity that could make such a determination. A wide range of entities fit such a characterization--from an organization or agency established with a charge to make such determinations to a court or jury instructed to make such determinations in accordance with applicable law.

3 A particularly thorny issue in this regard concerns the implications of such efforts for attempts by foreign governments to enforce their laws on Web sites based in the United States. For more discussion, see Global Networks and Local Values.

4 For more discussion of this point, see Computer Science and Telecommunications Board, National Research Council, Domain Name Systems, National Academy Press, Washington, D.C., in preparation.

5 See ".xxx Considered Dangerous" online at <http://search.ietf.org/internet-drafts/draft-eastlake-xxx-01.txt> for more discussion of these and other technical issues.

6 In redirection, the request from the user's software (e.g., browser) arrives at the site whose address was entered, but that site does not return content. Instead, the site returns a standard Internet message saying, "The content you seek is located at this address," and the user's software immediately fetches data from that address. Since the first system may send an address without a symbolic host name, but rather with a numeric IP address, such as that in the message "the content you seek is located at http://111.222.333.444/aWebPage.html," client-side filtering has no clues that this is actually a host in the .xxx domain. Redirection exists in the Internet protocols because organizations do change what systems host their content but still want the old well-publicized URLs to work, and because it can be used as part of load balancing: a nearly overloaded server can redirect some percentage of requests elsewhere, potentially based on the geographic location of the requester as inferred from the IP address.

7 See, for example, <http://www.adlawbyrequest.com/legislation/tldsex.shtml>, which describes a proposal supporting .xxx.

8 See Federal Trade Commission, 1999, "How to Comply With The Children's Online Privacy Protection Rule," November. Available online at <http://www.ftc.gov/bcp/conline/pubs/buspubs/coppa.htm>.

9 See, for example, David McGuire, 2001, "Bill Would Require ICANN To Create '.Kids' Domain," Newsbytes, June 29. Available online at <http://www.newsbytes.com/news/01/167478.html>.

10 See <http://www.libraryguardian.com>.

11 Passport (specifically, Kids Passport) is a service offered by Microsoft that is intended to enable parents to decide whether their children can use services provided by participating Web sites that collect and/or disclose personally identifiable information. These services can include newsletters, discussion groups, pen-pal programs, wish lists, and contests. Parents can provide consent for three levels of access--no consent (child can use the Web site but not services that collect or disclose personal information), limited (third party can collect personal information but is not allowed to share or display it), and full (third party can collect and/or disclose personal information according to its privacy policy). For more information, see <http://kids.passport.com> and <http://www.microsoft.com/presspass/features/2000/02-08passport.asp>.

12 This finding refers only to the first time the individual needs age verification. In subsequent interactions, the individual can generally use the certification that was previously provided.

13 It is of course true that one can always take a photograph of a screen, and then deal with it as one would prefer. But disabling system-provided capabilities for printing, forwarding, and saving goes a long way to protecting content.

14 For example, the smaller ones are likely to derive some considerable fraction of income from raw traffic, thus giving them little incentive to screen out children. See Chapter 3 for more details.

15 See, for example, testimony of Mark Ishikawa, CEO of Bay TSP to the COPA Commission, on August 4, 2000. Available online at <http://www.copacommission.org/meetings/hearing3/ishikawa.test.pdf>.

16 Computer Science and Telecommunications Board, National Research Council. 2000. The Digital Dilemma: Intellectual Property in the Digital Age. National Academy Press, Washington, D.C.

17 Computer Science and Telecommunications Board, National Research Council, 2000, The Digital Dilemma: Intellectual Property in the Digital Age.











Buy this book

Buy this book

Copyright 2002 by the National Academy of Sciences
Previous Table of Contents Next