Planned UK age verification checks risky for internet users

The UK government is to introduce the world’s first regulations for age verification when accessing online pornography in July, but experts at Finnish cyber security firm F-Secure say the measures could be risky for users.

Under the new rules, porn sites will need to implement age-verification technology or face sanctions, such as having payment services withdrawn or being blocked for UK users.

There will be an implementation period to allow providers of online porn content to comply with the new standards, according to the Department for Digital, Culture, Media and Sport (DCMS). 

Enforcement will begin on 15 July, with the British Board of Film Classification (BBFC) being responsible for ensuring compliance with the new laws.

“Preventing kids from accessing certain types of online content, such as pornography, is in everyone’s interest. But people who share personal details with third-party age verification platforms need to know that attackers actively target this type of data, and will likely find these databases very enticing,” said Tom Gaffney, principal consultant at F-Secure.

“Criminals will almost certainly try to trick users into disclosing personal information by creating fake websites that look like legitimate verification pages, which is another risk users need to be made aware of.”

Under the new laws, UK internet users will be required to verify their age to access adult content websites. This could mean sharing personal information such as passport, driving license, phone number or credit card details with third-party age verification platforms, or purchasing a porn pass form approved suppliers.

The new requirements coincide with increased cyber crime in the UK, which has reportedly become more common than traditional robbery or theft. Despite the increase in frequency, however, the general public still often takes a complacent approach to digital security.

F-Secure’s Fennel Aurora, a security advisor with the company, said that while he supports the intent to protect children online, the proposed checks could backfire by enticing minors into taking other risks.

“The checks may drive those who wish to avoid the age verification system into engaging in more risky online behaviours. This could include accessing smaller, unregistered sites, or using free, untrustworthy tools that can harm unsuspecting users attempting to work around the checks,” he said.

“If these behaviours increase, we could end up exposing internet users of all ages to illegal content, as well as malware and other cyber crimes.”

According to Aurora, educating families about online security, privacy and how to behave online is as important as regulating websites.

“While we understand the desire to limit children’s exposure to potentially harmful content, it’s not a long-term plan for keeping kids safe. Regulation is an aid and not a replacement for the parent’s role,” he said, adding that parents can use technology to safeguard their children online by setting boundaries.

In response to the news in April that the age verification schemes would be required by law from July 2019, director of the Open Rights Group, Jim Killock, raised concerns about the danger that a data trail could be created, which could hypothetically be misused.

“It has a potential to track people across everything they watch and could end up being an enormous database of people’s personal sexual preferences,” he told Computer Weekly, adding that if that data leaked, “it could have devastating consequences for people”.