Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
1 ~ Technology-Based Tools Available to Non-End Users Complementing the discussion of Chapter 12 on tools for the end user, this chapter focuses on tools for other Internet stakeholders, such as Internet service providers, content providers, or operators of adult-ori- ented Web sites. As a general rule, these tools are most relevant to entities that have some commercial reason for existing they have less relevance to non-commercial sources of sexually explicit material (e.g., individuals with exhibitionist preferences, friends sharing sexually explicit images, and so on). Table 13.1 provides a preview of this chapter. 13.1 A .XXX TOP-LEVEL DOMAIN 13.1.1 What Is a .xxx Top-level Domain? A .xxx top-level domain (TLD) would be reserved for those entities providing adult-oriented, sexually explicit material.] For example, www. foo.xxx would name a site on which such content would be found, and any pages within it (e.g., www.foo.xxx/examplel) or any subdomains (e.g., www.fetish.foo.xxx) would be assumed to have similar content as well. A key element of proposals for .xxx is whether the use of .xxx would ''.xxx'' is pronounced as "dot-xxx." 327
328 YOUTH, PORNOGRAPHY, AND THE INTERNET TABLE 13.1 Technology Tools for Use by Non-End Users Tool Function One Illustrative Advantage One Illus .xxx domain Requires that Web sites with Provides a way of identifying (mandatory) adult-oriented sexually explicit adult-oriented sexually explicit content must have a .xxx suffix material from these sites with minimal effort .xxx domain Gives any content provider the Enables sites that wish to be (voluntary) option of selecting a domain known for providing sexually name with a .xxx suffix explicit material to self- identify, thus making inad- vertent access to such sites less likely .kids domain .kids domain names reserved Provides high assurance that for site with content material from .kids Web sites is appropriate for children appropriate for children Age verification Seeks to ensure that someone Places a major obstacle in the technologies seeking to access adult-oriented path of minors seeking adult- sexually explicit content is oriented sexually explicit actually an adult content from commercial sites Tools for Provides tools for content Reduces dissemination of protecting owners to help control illegally copied sexually intellectual dissemination of images they explicit images, which property own constitute a significant amount of the adult-oriented material available online be voluntary or mandatory. If use were mandatory, all providers of adult- oriented content would be required to place such content on a Web page with the .xxx TED, and penalties would be established for not doing so. Today, assignment of domain names in some TLDs is done on a purely voluntary basis, whereas for other TLDs, an adjudicating body determines eligibility. For .com, .net, and .org, registrars of domain names perform a strictly administrative function; for the .edu, .mil, .gov top- level domains, some institutional entity decides that an organization is or is not eligible. However, regardless of the TED involved, the content that a domain name owner wishes to place on its Web site is not necessarily related to the assignment of the domain name to that owner, and there is no requirement today for such a relationship.
TECHNOLOGY-BASED TOOLS AVAILABLE TO NON-END USERS 329 :age One Illustrative Disadvantage Voluntarey versus Involuntary Exposure Requires difficult-to-obtain clearly specified and international standard for what constitutes material that must be placed in .xxx domains May lead to stronger political pressures for mandatory inclusion in .xxx domain; also likely to leave many Web pages containing objectionable materials unidentified as such, thus facilitating inadvertent access Requires difficult-to-obtain clearly specified and international standard for what material is appropriate for children; does not allow for age-based differentiation among children Little applicability to non-commercial sources of sexually explicit material Hard to use against non-commercial sources of sexually explicit material that do not depend on Web distribution (e.g., Usenet, peer-to-peer networking) Similar to filtering; prevents both kinds of exposure to .xxx domains, but is not useful against materials not found in .xxx domains Similar to filtering; prevents both kinds of exposure to .xxx domains, but is not useful against materials not found in .xxx domains See discussion in text of content-limited Internet service providers When implemented, can prevent both deliberate and inadvertent access for minors, although if user is willing to lie about age, may not be able to protect against deliberate access Not applicable Proponents of a .xxx domain argue that it would provide an easy way of recognizing material presumed to be inappropriate for children, obvi- ating the need for a laborious inspection of Web pages for such content and simplifying the filtering task by simply blocking access to sites in the .xxx domain. The institution authorized to establish new top-level domains is the Internet Corporation for Assigned Names and Numbers (ICANN), a non- profit corporation that was formed in October 1998 to assume responsibil- ity for the IP address space allocation, protocol parameter assignment, domain name system management, and root server system management functions previously performed under U.S. government contract by the Internet Assigned Name Authority (IANA) and other entities.
330 YOUTH, PORNOGRAPHY, AND THE INTERNET If and when a .xxx TLD is established, it would remain for product vendors to build software that would provide users with the option of rejecting all domain names ending in .xxx. Parents, schools, teachers, and other concerned adults would then have to be willing to exercise the options enabled in the software. 13.1.2 How Well Would a .xxx Top-Level Domain Work? In essence, the use of a .xxx TLD amounts to a label to identify content as inappropriate or appropriate for children that is based on the source of that content. Thus, from the standpoint of the end user, all of the pros and cons of label-based filtering described in Chapter 12 apply to the use of a .xxx domain. A .xxx domain would be intended to facilitate the blocking of access to sexually explicit material. Thus, in principle, it along with filters- would help to protect against both deliberate and inadvertent access. From a filtering perspective, the effectiveness of such schemes depends on the reliability of the assumption that adult-oriented, sexually explicit material will be confined to a .xxx domain. By definition, a .xxx domain name is reserved for sexually explicit material and is thus irrelevant for any other material that is non-sexual in nature. It is likely that certain parties will have some incentives to place their content in such a domain.2 After all, they wish their content to be found, and segregating it into an adult-oriented TLD helps to make it found. (Indeed, a concentration of adult-oriented Web sites may in fact provide children and adults with a "target-rich" environment in which they could much more easily seek out sexually explicit material.) On the other hand, a .xxx domain does not deal at all with the issue of peer-to- peer transfers, e-mail attachments, and so on. For example, college stu- dents may post collected sexually explicit material on various servers run by universities or public Web hosting services and there is no guarantee that all sexually explicit material will be contained on Web sites in the .xxx domain, even if all commercial adult-oriented providers choose to cooperate. 2For example, Seth Warshavsky, president of the Internet Entertainment Group, an adult entertainment company, told the U.S. Senate Commerce Committee in 1998 that he would like to see a Adult domain: "We're suggesting the creation of a new top-level domain called '.adult' where all sexually explicit material on the Net would reside." See "Congress Weighs Net Porn Bills," CNET article, February 10,1998, available online at <http://news.cnet.com/ news / 0-1 005-200-326435.html>.
TECHNOLOGY-BASED TOOLS AVAILABLE TO NON-END USERS 331 Two issues related to a .xxx TLD are whether the use of the TLD is mandatory or voluntary, and whether there is an adjudicating body that monitors the content contained in one or another of these TLDs.3 Today, no Web site owner is forced to use a given TLD, and there is no adjudicat- ing body that determines if the content on a Web site matches its TLD. For a .xxx domain, these two issues are related. Mandatory use of a .xxx domain for sexually explicit material would imply creating a body whose role was to decide what content must be placed into a .xxx domain, and thus would affect all domain name owners, not just those associated with adult-oriented content. However, because "harmful to minors" laws are community-specific, a single body might be tempted to use a "lowest common denominator" approach to such decisions. Thus, some organi- zations and firms would be forced to use a .xxx domain even if they did not believe their content was adult-oriented and sexually explicit. (Stig- matization might also result from forced placement into a .xxx domain, with the .xxx TLD becoming a de facto ghetto into which all controversial material is placed.) Coupled with filters that block Web sites with a .xxx suffix, this approach would lead to a bias in favor of overblocking. On the other hand, in the absence of an adjudicating body, or if the use of a .xxx domain is voluntary, adult-oriented, sexually explicit material could eas- ily be found on non-.xxx domains. Filters designed to block sites based solely on the .xxx TLD designation would be ineffective against such content, and so commercial sites uninterested in differentiating between children and adult traffic could take advantage of the lack of the .xxx TLD. A voluntary .xxx domain might also reduce filter overblocking, since operators of sites with sexually explicit material that was not ori- ented towards adult entertainment (e.g., museums, medical schools) would not choose a .xxx domain name and hence would be less likely to be blocked. A final and critical question for the mandatory use of a .xxx TLD is how it would apply internationally. That is, how would U.S. law be able to compel foreign Web site owners to use a .xxx domain?4 (Such a ques- tion is particularly relevant given the commonness of full frontal nudity in many mainstream foreign publications and Web sites.) 3An adjudicating body refers only to an entity that could make such a determination. A wide range of entities at such a characterization from an organization or agency estab- lished with a charge to make such determinations to a court or jury instructed to make such determinations in accordance with applicable law. 4A particularly thorny issue in this regard concerns the implications of such efforts for attempts by foreign governments to enforce their laws on Web sites based in the United states. For more discussion, see computer science and Telecommunications Board, Na- tional Research Council, 2001, Global Networks and Local Values, National Academy Press, Washington, D.C.
332 YOUTH, PORNOGRAPHY, AND THE INTERNET 13.1.3 Who Decides What Material Should Be Confined to .xxx Web Sites? For voluntary use (in the absence of adjudicating bodies), only the organization in question makes decisions about what material is adult- oriented and sexually explicit. For non-voluntary use requiring an adju- dicating body, the adjudicating body makes decisions about what should and should not be placed in each domain, thus raising the question of what community's standards would be used by the adjudicating body and how they would be determined. 13.1.4 How Flexible and Usable Are Schemes Based on a .xxx Top-Level Domain? The usability of schemes based on .xxx would depend in large part on whether or not domain names with these suffixes contain the content implied by the TLD (as described above). Another issue is whether the .xxx TLD would receive ICANN en- dorsement. A number of schemes have been proposed to circumvent ICANN in the establishment of other TLD names. Such proposals have been controversial, because they violate principles that have been re- garded by many as integral to the smooth operation of the Internet. In particular, a non-endorsed TLD name might not be uniformly accessible from every Internet access point (and today only a very small percentage of Web users could access sites based on non-endorsed TLDs), and under some circumstances, a user seeking to access a site based on a non- endorsed domain name might wind up at different Web sites depending on the location from which it was accessed.5 13.1.5 What Are the Costs and Infrastructure Required for a .xxx Top-Level Domain? For .xxx domain names, the adjudicating body must make decisions about every Web page that is posted on the Internet, because it must decide if such material belongs in a .xxx domain name. Such a task is daunting, and it is virtually impossible that an adjudicating body could do so. More likely, it would undertake what sampling it could do at reasonable expense and would examine non-.xxx sites that were reported as having sexually explicit content. 5This point is discussed in more detail in a computer science and Telecommunications Board report on domain name systems that is currently in preparation.
TECHNOLOGY-BASED TOOLS AVAILABLE TO NON-END USERS 333 In addition, a .xxx domain would pose a number of technical difficul- ties.6 An adult Web site may reside on a .xxx domain, and indeed may wish to reside on such a domain. However, consider the example of a university which hosts a wide variety of content, some of which is deemed to be adult-oriented and sexually explicit by the adjudicating body. Web pages for such content will by assumption reside under- neath the .edu domain of the university. Under a .xxx domain name, another separate category in the domain name service tree must be main- tained by the university. Alternatively, a university could require that projects containing such content set up their own Web servers in the .xxx domain, which does not involve a high cost. Project Web sites under the .edu domain could contain links to the Web sites in the .xxx domain. A second technical difficulty is the fact that the domain name service of the Internet supports page redirection. That is, the owner of the site www.safe_for_kids.com has the technical capability to force individuals intending to visit the www.safe_for_kids.com site to visit a .xxx Web page instead, whether or not the owner of the .xxx Web page wishes this redi- rection to happen.7 Such a scenario raises a question of responsibility if a minor is channeled to the .xxx site. The owner of www.safe_ for_kids.com has no sexually explicit content on its site, but is responsible for directing the minor to the .xxx site. The owner of a .xxx domain name may have taken no actions to attract children to the .xxx site. Who bears responsibil- ity for this exposure? 13.1.6 What Does the Future Hold for a .xxx Top-Level Domain? At least one legislative proposal has been offered to support the es- tablishment of .xxx domains.8 As this report goes to press in May 2002, the prospects of these proposals are unclear. 6See ".xxx Considered Dangerous" online at <http://search.ietf.org/internet-drafts/ draft-eastlake-xxx-Ol.txt> for more discussion of these and other technical issues. 7In redirection, the request from the user's software (e.g., browser) arrives at the site whose address was entered, but that site does not return content. Instead, the site returns a standard Internet message saying, "The content you seek is located at this address," and the user's soft- ware immediately fetches data from that address. Since the first system may send an address without a symbolic host name, but rather with a numeric IP address, such as that in the message "the content you seek is located at http://111.222.333.~/aWebPage.html," client-side filtering has no clues that this is actually a host in the .xxx domain. Redirection exists in the Internet protocols because organizations do change what systems host their content but still want the old welLpublicized URLs to work, and because it can be used as part of load balancing: a nearly overloaded server can redirect some percentage of requests elsewhere, potentially based on the geographic location of the requester as inferred from the IP address. 8See, for example, <http://www.adlawbyrequest.com/legislation/tldsex.shtml>, which describes a proposal supporting .xxx.
334 YOUTH, PORNOGRAPHY, AND THE INTERNET 13.1.7 What Are the Implications of Using a .xxx Top-Level Domain? The establishment of a .xxx domain, even if use is voluntary, would establish a "big fat target" for subsequent regulatory efforts. In other words, even if its use is voluntary, it may not remain that way for long as policy makers take note of its existence. 13.1.8 Findings on a .xxx Top-Level Domain 1. A .xxx domain that is selected voluntarily may have some appeal for enterprises that are involved primarily in providing access to sexually explicit material intended to arouse desire (i.e., what is often known as "pornography") and that use a distribution channel requiring the use of domain names. Such enterprises are likely to use a .xxx domain as a part of their advertising strategies. 2. A .xxx domain would have little effect on (a) sexually explicit ma- terial that is not intended to arouse desire but which some parties may regard as inappropriate anyway, (b) a mixed-use domain (e.g., a univer- sity with a .edu Web site with a faculty member who does research on human sexuality or studies the evolution of sexuality in art and media and wishes to post research materials on a university Web site), or (c) sources of inappropriate sexually explicit material that are located out- side the United States (if these sources do not wish to be identified with a .xxx domain). 3. The use of a TLD to identify inappropriate content would require software (e.g., Web browsers) that can be configured to block content coming from .xxx sites. Conceptually, this arrangement is identical to that of filtering based on content, except that the task of developing black lists and white lists is made much easier. 4. The benefits associated with a .xxx domain would depend on the association of a TLD with specific content. This fact raises the question of an institutional entity that might be established to promote such associa- tion. If the benefits associated with a purely voluntary use of either do- main are sufficient, then no such entity need exist. But if the affected public requires higher confidence in the association between TLD and content, such an entity may be required, and that entity would be ventur- ing into difficult uncharted waters as it sought to determine whether certain content should or should not be contained within a given TLD. In the case of a .xxx domain, the scope of its responsibility would be to ensure that all sexually explicit material was hosted on a .xxx domain and nowhere else an entirely daunting task.
TECHNOLOGY-BASED TOOLS AVAILABLE TO NON-END USERS 13.2 A .KIDS TOP-LEVEL DOMAIN 13.2.1 What Is a .kids Top-Level Domain? 335 A .kids top-level domain would be reserved for those entities provid- ing material intended and appropriate for children. 9 That is, it would be explicitly designed for the use of children, providing safe, lawful, and appropriate content (e.g., information and entertainment), services, and facilities of especially high interest for them. Further, it would safeguard the privacy and safety of all children accessing .kids domain names. For example, www.foo.kids would name a site on which such content would be found, and any pages within it (e.g., www.foo.kids/examplel) or any subdomains (e.g., www.nature.foo.kids) would be assumed to have similar content as well. In general, use of a .kids domain has been dis- cussed in entirely voluntary terms, and it would make no sense to make it mandatory. Proponents of a .kids domain argue that it would provide an easy way of recognizing material presumed to be appropriate for children, simplifying the filtering task by simply allowing access only to sites in the .kids domain. As in the case of a .xxx domain, product vendors would have to build software that would provide users with the option of ac- cepting only domain names ending in .kids. Parents, schools, teachers, and other concerned adults would then have to be willing to exercise the options enabled in the software. 13.2.2 How Well Would a .kids Top-Level Domain Work? Because the use of a .kids TED amounts to a label to identify content as appropriate for children that is based on the source of that content, all of the conceptual pros and cons of label-based filtering described in Chap- ter 12 apply to the use of .kids. However, in addition to the baseline question of the extent to which it would help to keep children away from inappropriate materials, a second question particularly relevant to a .kids domain is the extent to which it would succeed in providing appropriate, educational, and informative content and experiences for children. A .kids domain would be intended to promote access to child-friendly material. To the extent that this occurs, children have less time available to seek out inappropriate material. Thus, a .kids domain alone may help 9".kids" is pronounced "dot-kids."
336 YOUTH, PORNOGRAPHY, AND THE INTERNET to reduce deliberate access to inappropriate material but cannot address the problem of inadvertent access. A browser or Internet service provider restricting access only to .kids Web pages effectively provides the same kind of protection as a content-limited ISP service. From a filtering perspective, the effectiveness of such schemes de- pends on the reliability of the assumption that material intended for chil- dren will be found on a .kids domain. It can be anticipated that many firms seeking to provide content for children will have incentives to ob- tain .kids domain names, because such a domain name would guarantee their audience. Today, no Web site owner is forced to use a given TED, and a Web site operator can post anything on his or her Web site. If this were true in the .kids domain, it could defeat the intent of keeping chil- dren away from inappropriate content. It is unlikely that those in the commercial enterprise of providing adult-oriented, sexually explicit content would choose to place their ma- terials in a .kids domain. Furthermore, other enterprises, especially those operating in the commercial mainstream, would select quite carefully the content they would place in a .kids domain. However, it is easy to imag- ine that if .kids domain names were as freely available as today's .com domain names, certain parties would place inappropriate content of some kind on a Web site with a .kids domain name. Thus, the safety of a .kids domain name likely depends on the exist- ence of some mechanism to ensure that the content available from any given .kids site matches the intent of the .kids domain. One such mecha- nism is an adjudicating body that decides what organizations would be eligible for a .kids domain name (so that .kids domain names would not be as freely available as today's .com or .net names). Further, the body would make decisions about specific content that would be eligible for placement. The effectiveness of a .kids domain would depend, then, on the wisdom of the judgments of the adjudicating body and the extent to which it had the power to enforce its judgments. The body's enforcement power might depend on its ability to take away a .kids domain name from an owner found to be misusing it, or an acceptance of civil liability for false and deceptive advertising or business practices in that event (sug- gesting a possible role for the Federal Trade Commission). The second question involves the extent to which a .kids domain would succeed in providing appropriate, educational, and informative content and experiences for children. It is clear that commercial entities that market their products and services to children would make signifi- cant use of a .kids domain. But as discussed in Section 10.9, non-commer- cial entities could also have an important role to play in populating the .kids domain.
TECHNOLOGY-BASED TOOLS AVAILABLE TO NON-END USERS 13.2.3 Who Decides What Material Should Be Allowed in .kids Web Sites? 337 In the absence of an adjudicating body for allocating domain names, only the organization seeking a domain name makes decisions about what material is appropriate for children. In the presence of an adjudicating body, the body makes decisions about what should and should not be placed in each domain, thus raising the question of what standards should be used by the adjudicating body and how they would be determined. An undetermined aspect of a .kids domain would be the develop- mental or age level that should govern placement. As noted in Chapter 5, what is perfectly appropriate for a 16-year-old may be inappropriate for a 7 year-old. Coupled with the fact that the information needs of small children are generally less than those of older children, it would seem that content for .kids would tend to be oriented toward younger children. One possibility for definition of Web sites eligible for a .kids domain name is a site that is subject to the requirements of the Child Online Privacy Protection Act (COPPA), that is, a site "directed" to children under 13. To determine whether a site is "directed" toward children, the Federal Trade Commission (FTC) considers several factors, including "the subject matter; visual or audio content; the age of models on the site; language; whether advertising on the Web site is directed to children; information regarding the age of the actual or intended audience; and whether a site uses animated characters or other child-oriented fea- tures."~° If a .kids domain is indeed intended for use by children under 13, the FTC definition of a site directed to children is one reasonable point of departure for a working definition. 13.2.4 How Flexible and Usable Are Schemes Based on a .kids Top-Level Domain? The usability of schemes based on .kids depends in large part on whether or not domain names with this suffix contain the content implied by the TED (as described above). As with a .xxx domain, another issue is whether these TLDs receive ICANN endorsement. A number of schemes have been proposed to circumvent ICANN in the establishment of other TLD names, and the discussion above about a .xxx domain in this area applies identically here. Resee Federal Trade Commission, 1999, "How to Comply with the Children's Online Pri- vacy Protection Rule," November. Available online at <htip://www.ftc.gov/bcp/conline/ pubs/buspubs/coppa.htm>.
338 YOUTH, PORNOGRAPHY, AND THE INTERNET 13.2.5 What Are the Costs and Infrastructure Required for a .kids Top-Level Domain? For mandatory adjudicating bodies to make decisions about content, an effort would be required that is proportional to the volume of informa- tion posted by entities with a .kids domain name. In addition, owners of Web sites in a .kids domain face liability issues. The proposition that a .kids site is appropriate for children is the draw for many users. Content deemed inappropriate by someone that is found in a .kids domain is likely to lead to lawsuits about false and deceptive advertising; if an adjudicating body is involved, it is likely to be named as well. Also, while the intent of a .kids TED is to make certain material easy to find for children, the existence of a .kids TED makes it easy to restrict children's access only to Web sites in a .kids domain, even though much other material might be both useful and appropriate for them. 1 1 1 13.2.6 What Does the Future Hold for a .kids Top-Level Domain? At least one legislative proposal has been offered to support the es- tablishment of a .kids domain. As this report goes to press in May 2002, the prospects of this proposal are unclear. 13.2.7 What Are the Implications of Using a .kids Top-Level Domain? A Web site can offer users more than passive viewing of content. If a Web site in the .kids domain offers opportunities for a child to interact with other users on the site (e.g., through chat rooms, e-mail, bulletin boards, and so on), adults seeking to interact with children, such as pedo- philes, are likely to be drawn to the site as well because of the high likelihood that a user will be a child. This fact is not likely to be reassur- ing to parents. A second implication is the following: if a .kids domain consists only of Web sites explicitly designed for children, especially younger ones, it would be highly restricted. In particular, it would not carry sites that provided information for a range of ages (e.g., information found in ency- clopedias, which are not designed only for children). Thus, a child re- stricted only to accessing a .kids domain may not have access to informa- ))See, for example, David McGuire, 2001, "Bill Would Require ICANN to Create '.Kids' Domain," Newsbytes, June 29. Available online at <http://www.newsbytes.com/news/ 01 /167478.html>.
TECHNOLOGY-BASED TOOLS AVAILABLE TO NON-END USERS 339 lion necessary to do certain homework assignments. (Indeed, part of the appeal of Internet access is the access that people have to a broader range of information and so restricting a user to a .kids domain reduces the Internet's appeal.) Such restrictions may be most appropriate for the youngest Internet users. 13.2.8 Findings on a .kids Top-Level Domain 1. A .kids domain may have some appeal for enterprises whose busi- nesses are involved primarily in providing access to child-friendly and appropriate material. Such enterprises are likely to use a .kids domain as a part of their advertising strategies. 2. The use of a TLD to identify child-appropriate content could re- quire software (e.g., Web browsers) that can be configured to accept only content coming from .kids sites. Conceptually, this arrangement is iden- tical to that of filtering based on content, except that the task of develop- ing white lists is made much easier. 3. The use of a .kids TLD would also be useful as an indicator of appropriateness for children even in a non-filtering context, because it would enable parents and other responsible adults to determine a site's appropriateness at a glance. 4. The benefits associated with a .kids domain would depend on the association of a TLD with specific content. This fact raises the question of an institutional entity that might be established to promote such associa- tion. If the benefits associated with a purely voluntary use of either domain are sufficient, then no such entity need exist. But if the affected public requires higher confidence in the association of TLD and content, such an entity may be required, and that entity would be venturing into difficult uncharted waters as it sought to determine whether certain con- tent should or should not be contained within a given TLD. In the case of a .kids domain, the scope of its responsibility would be to ensure that the material on Web sites in a .kids domain was in fact child-appropriate. 13.3 AGE VERIFICATION TECHNOLOGIES Because much of the political debate centers on the access of children to inappropriate sexually explicit material on the Internet, it is natural to examine online methods that can be used to differentiate between adults and children. Age verification technologies seek to distinguish adults from children and to grant access privileges only to adults. Age verifica- tion technologies seek to accomplish in cyberspace what a clerk checking an ID card or driver's license accomplishes in an adult bookstore.
340 YOUTH, PORNOGRAPHY, AND THE INTERNET 13.3.1 What Are Age Verification Technologies? Age verification technologies (AVTs) seek to establish that a given individual is or is not an adult, and based on that determination, an information provider (generally a commercial Web site host) allows/de- nies access to certain material or allows/prevents a transaction to be com- pleted. The structure of a typical commercial adult Web site is a home page (http://www.adult_site.com) on which are presented a number of sexually explicit "teaser" images that are immediately available to anyone arriving on that page. Other content is accessible only after the user pays for access or enters a special password to gain access. As a rule, the home page of an adult-oriented, sexually explicit Web site has a number of other options that the user might subsequently choose: · A "free tour" in which additional teaser images are presented, perhaps on a number of additional pages; · A "sign-up now" button, which will take the user to a subscription page where he is invited to provide a credit card number; and · A "provide access code" field, in which the user can enter an access code that has been provided previously or through some other source. In other cases, the home page may not have any images at all, or have only obscured but suggestive images, with a warning that says, "If you are under 18, please exit by clicking here." In addition, the site may display boilerplate language that seeks to immunize the site owner against charges that he has made sexually explicit adult content available to chil- dren (Box 13.1 contains an example); in these cases, the user may enter the site only by passing through this boilerplate language. Clicking the "en- ter" button is taken to be the user's assurance that he or she agrees with the conditions of use, which include stipulations about age. As the structure of the canonical adult Web site indicates, the simplest age verification technology is a Web script that asks the user's age, and in many cases, such a request suffices. A similar situation obtains with online forms and profiles that users are often asked to fill out; such profiles often include entries for age. But because young people are sometimes willing to lie about their age, stronger age verification is generally necessary. In general, systems for age verification are based on the technologies de- scribed in Chapter 2. Age verification technologies are implemented by parties who wish to restrict the access of their online products or services to adults. (In addition to limiting access to adult-oriented, sexually explicit materials, AVT infrastructure may also be useful to individuals who sell alcohol,
TECHNOLOGY-BASED TOOLS AVAILABLE TO NON-END USERS 34 tobacco, or other adult-only products over the Internet.) However, the deployment of an age verification technology may not indicate a desire to verify age in particular, consider credit cards that serve the dual func- tion of age verification and payment medium. Because credit cards are today the simplest medium for online exchange of funds, the use of credit cards is just as likely (indeed, far more likely) to indicate a desire to be paid as a desire to restrict adults-only products and services to adults alone. 13.3.2 How Well Do Age Verification Technologies Work? In general, AVTs protect against deliberate access to sexually explicit material that is being sold. However, they provide no protection against non-commercial sexually explicit material (e.g., an exchange of sexually explicit images between two friends), or against deliberate or inadvertent access to "teasers" on adult Web sites. AVTs also provide benefits both for the owner of an adult Web site (who can operate with less fear of
342 YOUTH, PORNOGRAPHY, AND THE INTERNET running afoul of the law) and for society (which can reduce the frequency of children coming into contact with adult material or making transac- tions reserved for adults only). AVTs protect primarily against deliberate access to sexually explicit material for which adult Web site operators require payment. To be effective, age verification technologies must be deployed in front of any content that is inappropriate for children in other words, a user must have to pass through an adult verification screening (thus verifying that he or she is an adult) before he or she has access to adults-only content. Material behind an AVT screen is inaccessible to most search engines- and thus cannot be found inadvertently. However, this simple-to-achieve safeguard placing a "plain brown wrapper" around an Internet adult Web site is often not implemented even by those sites that require a credit card to get past the teaser pages. The effectiveness of AVTs is mixed, though they clearly do eliminate some significant percentage of children who would otherwise gain access to sexually explicit material. Factors that reduce the effectiveness of credit cards as AVTs include the placement of highly explicit material before credit card numbers must be submitted, possession of credit cards by children (but see Box 13.2), and the availability of parental credit cards through the rifling of a parent's wallet or purse. On the other hand, the use of credit cards is convenient for both user and vendor, and access can be granted in a matter of a few minutes. As noted in Chapter 2, AVTs that rely on public records indicating age provide a higher level of assurance regarding age. But the highest level of assurance is provided by coupling these public records with the use of the postal service to authenticate the user's identity, and thus this highest level of assurance is incompatible with rapid initial access. In addition, because not everyone has a driver's license or is registered to vote, vendors that rely on AVTs based on public records have a smaller audience than they would otherwise have. (In other words, these AVTs exclude individuals who would be entitled to gain access.) AVTs also presume that an adult has not left the access device with- out logging out. If he or she does not log out, the next user who may be a child will automatically have access to all of the content that was accessible to the adult. Finally, the age of adulthood differs from state to state. Because it is technically difficult to make geographical distinctions among points to which content is delivered, in practice most Web site owners choose 18 as the threshold age above which they will allow access, even if in some states 16 or 17 would be perfectly acceptable and legal. In these cases, those individuals are denied access for no legal reason.
TECHNOLOGY-BASED TOOLS AVAILABLE TO NON-END USERS 343 13.3.3 Who Decides What Is Inappropriate? The Web site owner is the primary decision maker about whether or not the site contains material that is inappropriate for children. If so, the Web site owner deploys AVTs to prevent access by children. However, there have been legislative attempts to promote the use of AVTs, as de- scribed in Chapter 4. Because it is the Web site owner that makes the decision to use AVTs, many sites containing what some people consider inappropriate material would not see any need for age verification (e.g., Victoria's Secret). As a
344 YOUTH, PORNOGRAPHY, AND THE INTERNET practical matter, AVTs will be used to differentiate adults and children only when the site contains material that the site operator believes is obscene with respect to minors. 13.3.4 How Flexible and Usable Are Products for Verifying Age? More rigorous age verification procedures often, but not always, in- crease the "hassle factor" that users face. For example, the highest degree of reliability is available when public records can be checked and an access code sent to the postal address associated with those records. How- ever, such a requirement also prevents adults from gaining the immediate access that is possible with certain other methods. 13.3.5 What Are the Costs and Infrastructure Required for Age Verification? Financial Costs The costs of using AVTs fall primarily on Web site owners and on adult users. Psychological and Emotional Costs AVTs may entail a loss of privacy for the adult user, both perceived and real. In a face-to-face transaction with a clerk checking a driver's license, there may be some embarrassment, but as a general rule, the clerk does not make a record of the license and does not record the titles of the material being purchased or rented. As importantly, the user can see that the clerk is not doing so. When an online AVT is used, the reasonable assumption would be that records are being kept (whether or not they are in practice), and so the user has a plausible reason to be concerned that his name is associated with certain types of material. The privacy problem is exacerbated by how some AVTs work. For example, an age verification system (AVS) often provides a code number certifying age, which the user enters into the age verification field on an adult Web site. Usually, the Web site then contacts the AVS to check the validity of this number (which will expire if the user does not maintain his AVS membership). Thus, the AVS has a complete record of all of the adult sites visited using its age credential. Furthermore, AVTs that rely on public records generally have access to the age information recorded therein. Thus, the age of a user is made available even though that provides more information than is needed to satisfy statutory requirements.
TECHNOLOGY-BASED TOOLS AVAILABLE TO NON-END USERS 345 Note also that commercial trends are pointing increasingly toward the customization of computer and device behavior and function to spe- cific users (who may be one of many using a particular device). To the extent that this is true, age information may be associated with such functionality. At the same time, for many hosts, there are few incen- tives and not much of a business case to go to the expense of deploying AVTs. It should be noted that legislation such as the Child Online Protection Act (discussed in Chapter 4) does not require personal identification the AVTs specified in the legislation are intended as a way to screen out most minor children, not to obtain the identity of users. However, the transac- tion between site operator and credit card company inevitably entails some expense for the credit card company, and so the credit card company is not likely to be willing to process such requests if no revenue results from it- therefore, the site operator will submit only transactions that are associated with an actual purchase, rather than a simple age verification request, and purchases are necessarily connected with personal identity. Infrastructure The primary infrastructure issue is the deployment of AVTs among host sites. AVTs can play a meaningful role in reducing the access of children to adult-oriented material only to the extent that they are indeed widely deployed. (If they are not, they render only a small amount of content unavailable, and the generic equivalent of that material is almost certainly available elsewhere.) Depending on the kind of AVTs involved, other cooperating institu- tions or individuals are necessary. · AVTs that rely on public records indicating age obviously depend on the availability of those records from public agencies. Given that there is some controversy about He widespread commercial availability of such records, their continued availability from public agencies cannot be taken for granted. · AVTs are often built into parental controls, and parental controls must be deployed by the adults responsible for youth. In practice, today's infrastructure for Internet access means that all access points (computers) that a given youth might use must have the appropriate parental controls. 13.3.6 What Does the Future Hold For Age Verification Systems? Improvements in AVSs depend primarily on the development and deployment of an infrastructure to support age verification, rather than the technologies themselves. For most commercial online transactions,
346 YOUTH, PORNOGRAPHY, AND THE INTERNET the age of the consumer is not particularly relevant, assuming that the consumer has the ability to pay for the products or services being offered. Thus, there appears to be no general-purpose need for a pervasive infra- structure for age verification. This suggests that if improved AVSs are to be available for vendors of adult-only services and products, the infrastructure required for verify- ing age must either be (a) a subset of an infrastructure that can be used for broader purposes, or (b) deployed by those vendors. In case (a), a number of scenarios are possible. For example, smart- card technology enables a higher degree of security in authentication than do passwords, which are easily compromised. A "smart card" is a small physical hardware device (typically the size of a credit card) containing read-only non-volatile memory and a microprocessor that can be inserted into a card reader attached to a computer. In most scenarios, the indi- vidual user carries the card and inserts it into an Internet access point that requires such a device. The memory provided on the device can store information about the user, including his or her age, preferences for mate- rial to be blocked, and so on. Software installed on the computer, and on Web sites visited, would check the smart card for dates of birth when necessary, and if the user were underage for certain types of material, would refuse to grant access to that material. However, computing and Internet access technology has not developed in this direction, and the costs of converting to such an infrastructure specifically for this purpose are entirely prohibitive. If, for other reasons, such technologies become common on personal computers and other devices that can be used to access the Internet, those offering adult-only products or services would be able to require a smart card-enabled age verification as a condition of access. Even today, one firm seeks to offer "smart" library cards on which parents can indicate their preference for their children to have filtered or unfiltered Internet access in the library. Nevertheless, the effectiveness of such an approach depends on the vendor's decision to deny access to those who are unable to present a smart card, for whatever reason (including the lack of a card reader on an Internet access point or a legitimate adult customer who lacks the smart card). Such a decision runs quite counter to business incentives to achieve the maximum exposure of a product or service being sold. Another scenario is that a vendor's knowledge of a user's age may well provide business benefits and more lucrative marketing opportuni- ties. Routine collection of age information may well occur in the future with tools that provide automated policy preference negotiation (e.g., ~2See <htip: / /wwwlibraryguardian.com>
348 YOUTH, PORNOGRAPHY, AND THE INTERNET that use a given age certification, thus allowing a dossier of visited adult sites to be compiled. Thus, they may inhibit free flow of information and create a chilling effect on the freedom of adults who wish to access lawful though perhaps controversial material. Widespread requirements to present documents certifying one's age raise many of the same concerns that national ID cards raise. In particu- lar, while acknowledging that verification of one's adult status is neces- sary from time to time, the concern is that a diversity of methods and documents for certifying one's adult status will in the name of simplic- ity lead easily to a single document indicating age, and perhaps other personal information. Once such a document exists, it becomes very easy to insist on the use of this document as the necessary documentation for a wide range of societal benefits, such as employment, health care, gun ownership, and so on. Much as the Social Security number has evolved into a de facto universal identifier, such a document could well become the basis for national databases that track all of the significant activities of all those with this document and all of the concerns about loss of pri- vacy and government/private sector abuse emerge in full force. 13.3.8 Findings on Age Verification Technologies One approach to protecting children from inappropriate sexually ex- plicit material on the Internet is based on being able to differentiate be- tween children and adults in an online environment, and AVTs are a tool available for doing that. 1. Those wishing to verify age with very high levels of confidence require that a document with proof of age can be associated clearly and unambiguously with the specific individual in question.l4 Over the Inter- net, there is no mechanism known to the committee that accomplishes this task on a short time scale (seconds or minutes).l5 2. As a practical matter, AVTs will be used to differentiate adults and children only when the site contains material that the site operator be- lieves is obscene with respect to minors. 3. Mechanisms that prevent age verification on short time scales are likely to have a significant negative impact on sales and would be an 14Compared to credit cards, AVTs based on public record databases do provide a some- what higher level of assurance of an alleged adult status (see Finding #4 in this section). But if these public record AVTs do not also use an offline method to verify identity, they are subject to many of the same problems associated with the teenager use of credit cards that have been pilfered from a parent's wallet. 15This finding refers only to the first time the individual needs age verification. In subse- quent interactions, the individual can generally use the certification that was previously provided.
TECHNOLOGY-BASED TOOLS AVAILABLE TO NON-END USERS 349 impediment for adults seeking commercial adult-oriented products and services. 4. AVTs based on credit cards do provide some significant obstacles to children seeking deliberate access to inappropriate sexually explicit material. However, as credit cards (and prepaid cards usable as credit cards) are increasingly marketed to adolescents as young as 13, such AVTs will become less useful. Furthermore, parents that have explicitly al- lowed their children to have credit cards or prepaid cards may be more likely to trust the viewing behavior of their children as well. 5. The underlying technology to support widespread, high-confidence age verification does exist, but its implementation could be very expensive, and its use would raise a myriad of important privacy concerns. 13.4 TOOLS FOR PROTECTING INTELLECTUAL PROPERTY The widespread use of tools for protecting intellectual property may help to reduce the exposure of children to inappropriate sexually explicit materials that may have been taken from subscription adult-oriented Web sites. 13.4.1 What Are Tools for Protecting Intellectual Property? A variety of technologies have been developed to protect intellectual property. For example, some rights management technologies enable an image to be transmitted to a given user but increase quite substantially the difficulty of printing, forwarding, or saving itch (Box 13.3 describes some rights management technologies.) Other tools compare an image or text found on a Web site to a known and properly owned image or text (presumably the property of its creator or subsequent rights holder), and allow the flanging of near-matches that mav indicate imuronerlv derived works. J 1 1 J The primary users of rights management tools would be content pro- viders with proprietary content. 13.4.2 How Well Do Tools for Protecting Intellectual Property Work? As noted in Chapter 3, the online adult industry is highly stratified and includes a relatively small number of well-established firms and a much Alit is of course true that one can always take a photograph of a screen, and then deal with it as one would prefer. But disabling system-provided capabilities for printing, for- warding, and saving goes a long way to protecting content.
350 YOUTH, PORNOGRAPHY, AND THE INTERNET larger number of "fly-by-night" operators, many of whom illegally use copy- righted content from established firms. Wide use of rights management technologies could significantly reduce the flow of new content to these firms. There is some reason to believe that these smaller firms and operating entities are also the parties that are least responsible about keeping children away from their adult-oriented contently To the extent that this is true, drying up the supply of new content for these firms will increase the likelihood of a shakeout in the industry that will increase the prominence of the more estab- lished firms at the expense of these smaller ones. 17For example, the smaller ones are likely to derive some considerable fraction of income from raw traffic, thus giving them little incentive to screen out children. See Chapter 3 for more details.
TECHNOLOGY-BASED TOOLS AVAILABLE TO NON-END USERS 351 A more mature adult industry (consisting of established firms rather than the "fly-by-righters") is likely to have more concerns about the pro- tection of intellectual property as well as being more likely to take actions to restrict the access of children to their products. With a reduction in the content available to fly-by-night firms that are less likely to take actions restricting the access of children, certain types of adult content will be less accessible to children. The reduction is likely to mean a lower degree of inadvertent access, but the ease of deliberate access to generic adult con- tent is likely to be unaffected to a significant extent. Approaches based on tools to protect intellectual property of the adult entertainment industry are relevant only to content originating there, and have no applicability to content for which no intellectual property rights can be legally asserted. A second benefit of tools that detect possible thefts of intellectual property is in the prosecution of child pornography. As noted in Chap- ter 4, obscenity and child pornography differ in a number of key respects, and one of the most important differences is that while a legal determina- tion that an image is obscene depends on factors extraneous to the image itself (i.e., on community standards), a legal determination that an image constitutes child pornography does not. Thus, once an image has been determined to be child pornography, images that are substantially identi- cal to it (e.g., cropped images, images with shading superimposed on top) can also be determined to be child pornography. Thus, images suspected of being child pornography can be automatically compared (e.g., by a Web-crawling "spider") to databases of known child pornography. Such a technique will not identify new images of child pornography, but since a substantial amount of child pornography is "recycled," application of this technique is still relevant. The impact of rights management tools (RMTs) on reducing access of children to adult-oriented material depends on their widespread use, but in any case is an indirect one. The primary purpose of an RMT is to protect intellectual property and the secondary effect may well be to reduce the volume of adult-oriented materials available to children. 13.4.3 Who Decides What Is Inappropriate? This question is not applicable in this context. Resee, for example, testimony of Mark Ishikawa, CEO of Bay TSP to the COPA Commis- sion, on August 4, 2000. Available online at <http://www.copacommission.org/meet- ings /hearing3 /ishikawa.test.pdf>.
352 YOUTH, PORNOGRAPHY, AND THE INTERNET 13.4.4 How Flexible and Usable Are Products for Protecting Intellectual Property? From the standpoint of the end user, the primary usability issue is the extent to which different content providers use the same RMTs. If every Web site uses a different "home-grown" RMT, the user interfaces for viewing content are likely to be different and thus the user will have to use different methods for viewing different Web sites. This limiting case represents the greatest degree of inconvenience for the user. 13.4.5 What Are the Costs and Infrastructure Required for Protecting Intellectual Property? An approach based on the protection of intellectual property requires client-side software and hardware to perform rights management. While in principle any individual content provider could simply download rights management software to a user to protect its intellectual property, the effort required to do so is large. A widely deployed rights manage- ment system would be something on which many content providers could rely to protect intellectual property and some infrastructure software, such as Windows Media Player, is beginning to incorporate such features. Alternatively, the content providers in the adult industry could develop their own rights management system and require that their content be displayed through it. An essential element of infrastructure for the use of tools to protect intellectual property is an enforcement mechanism. The enforcement mechanism is technical if the technology prevents content from being improperly copied. However, such systems sometimes affect the user's experience, making systems slower and less convenient to use and to customize for his or her needs. Content providers who insist on using such systems then must deal with customer dissatisfaction that arises as a result. When the technology facilitates or enables the detection of pirated materials, a procedural or organizational or legal mechanism is needed to prevent further pirating and/or to deter others from doing the same. For example, if pirated materials are found on the bulletin board of an Inter- net service provider, the ISP has to be willing to take down pirated mate- rial if intellectual property rights are to be respected. 13.4.6 What Does the Future Hold for Tools for Protecting Intellectual Property? As of this writing (May 2002), a variety of technology vendors are in the early stages of developing rights management metadata systems, by
TECHNOLOGY-BASED TOOLS AVAILABLE TO NON-END USERS 353 themselves (e.g., XMCL from RealNetworks and others (http: // www.xmlcl.org)) and as part of broader content standards (e.g. MPEG- 21~. At the same time, peer-to-peer technologies such as Gnutella demon- strate that if a single copy of content can be placed on the network with no rights management wrapping or marked as "unlimited and untracked use by anyone," it can become widely distributed rapidly. A more detailed discussion of the future of tools for protecting intel- lectual property is beyond the scope of this report. A report by the Na- tional Research Council The Digital Dilemma addresses this point in greater detail.~9 13.4.7 What Are the Implications of Tools for Protecting Intellectual Property? Discussing the implications of tools for protecting intellectual prop- erty is beyond the scope of this report. A CSTB study The Digital Di- lemma addresses these implications in substantial detail.20 13.4.8 Findings on Tools for Protecting Intellectual Property 1. Purloined content accounts for a significant fraction of sexually explicit material on the Internet, though reliable data on this point is hard to obtain. Tools for protecting such content as the intellectual property of its creators thus have some potential to limit the number of Web sites and channels through which such content might be obtained. 2. To the extent that the rightful owners of this content are firms sufficiently established to be willing to take steps to deny children access to their material, it is in the interest of children that the intellectual prop- erty rights of these parties are respected. Owners and operators of adult Web sites will have to take the initiative to enforce intellectual property protection if this approach is to prove viable. )9Computer Science and Telecommunications Board, National Research Council. 2000. The Digital Dilemma: Intellectual Property in the Digital Age. National Academy Press, Wash- ington, D.C. 20Computer Science and Telecommunications Board, National Research Council, 2000, The Digital Dilemma: Intellectual Property in the Digital Age.
Prepublication copy- subject to further editorial correction Box 14.1 An illustration of mutual reinforcement 1 4-24 Impact on suppliers of Impact on potential consumers inappropriate material of inappropriate material Social/Educational Strategies Business decisions and ethics Teach children to snake (e.g., ISPs can choose to choices to refrain from carrying stay away and to target USENET newsgroups with a searches more precisely to large amount of child reduce chances of pornography) inadvertent exposure; teach parents how to educate their children about these strategies and to monitor what their children are doing online. _ Technology-based Tools Labeling material so that Help guide children to parents and others can easily appropriate sites and help to ascertain the appropriateness prevent access to of that material for their inappropriate sites, consistent children with parental values and preferences Public Policy Shape the environment by Provide support for social and reducing educational strategies (e.g., deceptive practices (e.g., new standards of reaming for mouse/rapping, spam, K-12, outreach to parents to capturing of educate them about the misspelled web sites) Intemet) .