Age Verification argument rages on

There seems to be three camps developing among residents with reference to age verification.

The first want it, have done it (or not, depending on whether Integrity actually has their information) and are annoyed at everyone else who doesn't want it.

The second is those who are generally okay with it. These are normally non-US residents whose only reservation is whether or not they are breaking the privacy laws in their own countries. More often than not, the age verification process fails for them anyway, but they're willing to try it.

The third camp is the one that I - and the vast majority of Residents - are in. That is, we don't want it, we won't use it, we won't flag our land and we'll inform relevant authorities where we see breaches of the law. In my case, since I live in Canada, I don't break the law if I voluntarily give my Social Insurance Number (SIN) to Linden Labs or Integrity, BUT, if I choose not to, Linden Labs DO break the law in Canada the moment that they deny me access to something on the grounds I haven't given my SIN number to them.

A pattern is beginning to emerge about Integrity's database. A number of people have failed to verify with their current data, but have managed to verify with data several years out of date. This indicates that Integrity are gathering public records to add to their database, but these records are often out of date. In the UK, for example, they buy data from the credit check company Equifax (which performs credit checks on consumers) however, Equifax only have data about those who have applied for credit in one form or another, or who have home facilities. Take my 42 year old brother, a sad individual who still lives with his parents. He's never applied for a credit card, hasn't bothered to tell the Driver and Vehicle Licensing Agency the last three or four times he's moved house, doesn't bother with bank accounts (he lives off welfare, cashing his cheque every two weeks at a post office who know him and never bother to ask for ID) - He wouldn't be on Equifax's database. He holds a driving license and passport, but has never had the internet at home. He is on the electoral roll, but the list that is not available to the general public (only available to government bodies).

As a test, I asked him to try age verification. Surprise surprise, it failed, despite the fact that the data he provided was correct. However, what was most interesting was he provided state information (passport number and driving license) - which would NOT normally be available to anyone but the UK government. It wasn't in Integrity's database. Which leads me to have serious doubts that their claims their data is taken from governments worldwide is genuine.

To me, Integrity has always seemed like a data mining company, that gets its profits by acquiring tiny pieces of the huge jigsaw that is a persons life, putting those pieces together and selling the completed picture for far more than the individual pieces cost. By age verifying, what a person actually does is to alert Integrity to their existence. Nobody has been able to find a privacy policy for Integrity, but my guess is that it's something like the policy for facebook; by providing them with ANY information, you expressly authorise them to collect any and all information they can about you, including but not limited to, credit card data, bank data, address data, religion, voting preference, membership of clubs etc etc. In other words, anyone trying to age verify with Linden Labs systems, whether they pass or fail, is actually authorising Integrity to start data mining on them. Again, this IS only my guess, but until someone can find a privacy policy I'm standing by this opinion, bearing in mind the discovery that it was indeed the case for Facebook.

And this is what makes it dangerous. Particularly the section in Linden Labs own terms of service, that states in the event of bankruptcy, Linden Labs can no longer be held responsible for anything done with ANY data collected by the Second Life system. Linden Labs remains completely silent on the questions being thrown at them by residents along the lines of "What guarantee do WE have that your third party company (Integrity) won't misuse or sell our information." And the answer to that is simple. None at all.

Looking at it from a legal point of view, a resident makes a contract with Linden Labs when they sign up, for the provision of a service called "Second Life" in return for complying honestly with their terms of service (it's far more complicated than this, of course, but this is what it boils down to in its simplest form) - This means that the resident, as a consumer, and Linden Labs, as a service provider, can hold one another liable in the event that one breaks the conditions. As it's part of the terms of service that users of the adult grid are over 18, anyone who isn't and uses the service is in breach from the moment they log in for the first time. Bringing a third party into it, however, muddies the waters.

Since a resident has not agreed to anything with this third party, there is no contract, and nothing to regulate the residents behaviour toward the third party or the third parties use of any collected residents data. Effectively what this means is a resident is perfectly at liberty to be totally dishonest with the third party, because there's no agreement to stick to, but it also means the third party is equally at liberty to do whatever the hell it wants with whatever data it does get provided. No agreement, no contract, no protection.

Some Residents will sign up to age verification right away (and indeed, some already have). Some will be willing to sign up when the database is more complete and they're likely to be on it. Most will refuse point blank to give this data. When push comes to shove, and it becomes mandatory, Linden Labs will risk their existence as a corporate entity on getting enough people to use the system. Ultimately, if enough rebel and leave, the costs of running Second Life will rapidly overtake the revenue - at which point, bye bye Linden Labs.

In closing, try this for a bit of fun. I created a facebook based on my best friend from school's details, except in the facebook account she lives in Canada, has a much more glamorous job, is a member of a number of respectable organisations and is most definately over 18. I created this facebook account when Age Verification was first being discussed for Second Life, so it's a over six months old now. Using a fictitious Ontario driving license number and a fictitious passport number, both authentic in the layout of their numbers and special characters, I tried to take her through Age Verification, using the same details with Integrity as I had put on her Facebook profile - and passed, proving that one of Integrity's sources is indeed facebook. The only problem with this is - she doesn't actually exist as a Canadian citizen, and her birthdate as given in her facebook account is one day wrong from her actual birthdate. Also, her address is the middle of a cemetery, but the postcode and street number do exist.

She's now verified. The thing is, she doesn't actually exist (with the details I provided to Integrity) so she should not have passed the age verification. I'm betting somewhere there's a very puzzled computer failing miserably to put together the missing pieces on her. This just shows how much of a sham Integrity's system is, and in my mind vilifies my position: I'm not using this system, ever, and if it gets made mandatory, I'll say goodbye to Second Life.

Another nail in the coffin

The storm has once again broken out on the official Linden Blog with the announcement that age verification will be introduced with viewer version 1.18. Predictably, Linden Labs have released this well before it's ready (as usual) and there are a mass of problems with it, even if you don't count the fact that the actual age verification system doesn't work.

Firstly they've bought a registered digital certificate with their entire domain in it, which isn't accepted by most modern browsers. Firefox in particular refuses to take "secondlife.com" as valid when it's visiting a site where some of the features in a page are secure and some are not. The result of this is that Firefox displays a warning that the certificate may not be genuine, because some of the content comes from http: and some comes from https: - users aren't told by the browser what the difficulty is, only that the certificate is not fully valid to cover the page that is being loaded, but this is the page that they are being asked to put their personally identifiable information on - not a good sign.

Secondly, it's illegal in some countries to provide this information, and this means that even if someone does so it can't legally be verified. Aristotle/Integrity will add it to their database, but they have no means of verifying it. Although they claim to have data from all over the world, I do seriously have doubts about the legality of verifying such data.

Thirdly, 90% of Second Life users DO NOT WANT THIS. Some - myself included - won't be able to verify anyway, due to things like only just having emigrated from one country to another. When I came to Canada, I gave my UK license to the Ontario ministry of transportation, who then issued me with a driving license number in Ontario - but if you cross reference my driving license with any other database, you won't find a match, because as of yet I still don't have a Canadian passport. So you can't check my Canadian driving license against my UK passport because they don't share that information, and you can't verify my UK license against my UK passport because my UK license has been canceled due to having an Ontario license instead. So even if I wanted to do this, I'd fail the procedure, and several people have already responded to the Linden Blog posting with tales of woe about using genuine details and being declined.

This will kill Second Life off. It's going to be the final nail in the coffin. As sim owners are threatened with banning for not marking their entire sims as "adult" just because one vendor, somewhere on their sim, sells a prim-penis or cage, so the revenue from these land owners will die. As organizations like CARP can't raise their tier because half their members no longer play owing to either being against age verification altogether, or unable to verify - so those sims will also vanish because their owners can't afford to pay tier. Newcomers to Second Life will be asked to age verify immediately or threatened that they can't see some content, and either they'll refuse to verify and not sign up, or they'll fail verification and not sign up, so the new revenue stream will dry up.

Seriously, Linden Labs, you could achieve a much better method of disclaiming responsibility for underage misuse of the grid if you made everyone type a declaration manually into a textbox. Something along the lines of "I hereby certify that I am the account holder, over the legal age of consent in my country, and absolve Linden Labs and all their employees and representatives of responsibility for any actions that I may engage in when linked to this service." Granted you couldn't sign it, but if anyone accused Linden Labs of letting underage users in, what's the difference between someone typing that sentence into a box and someone providing details when you can't see that person? How does a child with their parents driving license and a child entering this paragraph differ?

Age verification cannot work over the internet. Not with the current technology. Maybe in years to come when everybodies details are on computer, and you can verify yourself by fingerprint, retina scan or facial scan, then there would be a foolproof way of making sure that an internet user was who they say they are, but that time isn't yet, and probably won't be for at least a decade. Even then it will be America, Canada, the UK and other such countries that will get it first, with other countries lagging behind by many years if not decades.

In the meantime, Linden Labs just banged another huge nail into the coffin that Second Life is destined to be buried in.

UPDATE: Take a look at this site, published by the Government of Canada - it proves that what Linden Labs is asking for is NOT something the Canadian Government agrees with:

The Personal Information Protection and Electronic Documents Act (PIPEDA) sets out ground rules for how private sector organizations may collect, use or disclose personal information in the course of commercial activities.

Since January 1, 2001, the Act applied to personal information about customers or employees that is collected, used or disclosed by the federally-regulated sector in the course of commercial activities. It also applies to information that is sold across provincial and territorial boundaries. As of January 1, 2004, the Act covers the collection, use and disclosure of personal information in the course of any commercial activity within a province, including provincially-regulated organizations, except in provinces that have enacted legislation that is deemed to be substantially similar to the federal law.

Under the new law, organizations like banks, telecommunications companies and airlines cannot require you to consent to the collection, use or disclosure of your personal information unless it is required for a specific and legitimate purpose.

This means that unless an organization can demonstrate that your SIN is required by law, or that no alternative identifier would suffice to complete the transaction, you cannot be denied a product or service on the grounds of your refusal to provide your SIN.

In other words, if Linden Labs refuse me access to a SIM on the grounds I won't provide my Social Insurance Number to them, they are committing an offense by Canadian law. And why is it so important?

Computer technology makes it possible to use the SIN to find and match your information from one database to another; without your knowledge, a detailed profile could be drawn about you. This amounts to "data surveillance" or monitoring of your daily life, which can pose a serious threat to our privacy and autonomy.

I don't see why other countries wouldn't have similar legislature.

Fancy a new viewer?

It hasn't taken long for the open source community to rip the Second Life viewer to bits and learn how to modify or even delete the bits they don't want.

Nowhere is this more evident than the BDSM community. Marine Kelley's new viewer is a variant that works with scripts available for free from her shop, designed to compliment her existing range of, erm, toys. The viewer reacts to the scripts by removing items from the menus and pie menu that appear when you right click the avatar. It's aimed at "hardcore" BDSM players (though how you can be hardcore when it's your pixellated avatar that's getting the whipping, not you) who want that little bit more realism. Drop the script into a ballgag, and you can't speak through that ballgag on the open channel. Not 'can't speak by mistake', but viewer-enforced can't speak at all. Drop the script in a set of cuffs or other restraints, and the "detach from avatar" options all vanish. If you get locked in, you're locked in, and you can't get out from this viewer.

It's an interesting new development, certainly far from anything Phillip Rosendale ever dreamed, and I can see similar developments coming in the not too distant future. Just today the furry community was polling its membership about disabling scripting and building to anyone outside their group; the next logical development from that might be a viewer that has an identification string that an in-world item can ask for, and sends home anyone that doesn't have the FurLife Viewer. I can see it coming, and it wouldn't be too hard to do.

Of course, this makes a mockery of age verification, since viewers will be able to ignore parcel flags, which makes you wonder why Linden Labs are still talking to Integrity at all. More ominously groups might be able to use it to keep themselves underground and away from the prying eyes of law enforcement, but that's technology for you.

The pandora's box of Open Source Second Life has been opened. I wait with interest to see what it lets out!

Prokovy goes off on one again

It's been interesting from time to time to see what recognized antagonizer Prokovy Neva thinks of various things going on in Second Life, but even I was surprised by her rant about the Agelock system I talked about in my last blog entry.

His [Benjamin Sycophanske, a favourite ranting target] latest gushing excess is of a new ugly and vicious system called AGELOCK. I'm not surprised that this awful new invention on the SL landscape comes from Allana Dion and Jamie David, as we know from long, long exposure to their manipulations, power-plays, and shenanigans on the old official LL forums, Second Citizen, and on this blog, that they are hugely aggressive and persistent.

When I spoke to Jamie David initially about Agelock, he seemed pretty proud of it but definately didn't come across to me as 'aggressive'

So a list of adult consumers with their avatar names and RL birthdates will be in the hands of one of the most aggressive and persistently nasty BDSM types in Second Life. Maybe the BDSM community won't care -- they like abuse, and maybe even this kind of RL abuse of their privacy. But as it spreads, and begins to be used by any club, or any rental, or anybody who just wants to be free from the plague of kids harassing and griefing you, it could become the device of choice, as it advertises being "better" than Integrity by not taking your RL name and drivers' license or Social Security number.

Hey, give me Integrity *any day of the week*. They are a real-life registered company with a business reputation and a bottom line to fulfill and a board of trustees. If I fear they've abused my trust in taking my info, I can protest -- with lawyers, by getting Congress involved, by getting the media on it. I can't do that with these anonymous avatars in Second Life!

And this seems to be the crux of the matter. What the extremely long rant boils down to are two essential points:

1. Nobody should touch this because it doesn't have the official "Prokovy Neva seal of approval" - mainly because she doesn't seem to like the authors, rather that whether the idea of the agelock system has merit or not.

2. Because Prokovy Neva trusts Integrity/Aristotle, so should everyone else.

With the latter part of her comment, I actually laughed when I read the part about complaining to congress. Integrity/Aristotle provide detailed information to congress, why the hell would they take any notice of someone's complaints?

Let's take this extreme example of how the information that Integrity collects could be harmful in the real world, and I have SPECIFICALLY steered clear of politics in this so that Prokovy has no excuse to label me a "lefty".

Let's says that I've given my detailed information to Integrity for age verification. They put it all on their database. But let's face it, Integrity is a data mining company - that's what they do, that's how they earn their money. So without telling me, what's to stop them also collecting information from second life that would be freely available, such as the groups that I'm in.

So for arguments sake let's say they do that, and find that I'm a member of a BDSM group in SL. That information then also goes down not only against my avatar name, but against my real life name.

Now in this little fictitious scenario, a BDSM hack magazine comes to Integrity hoping to drum up business, and buys a list of people who are members of BDSM groups. Shortly afterwards, editors are found to be peddling paedophilia, the place is raided by the police and FBI and gets shut down. In the raid their computers get confiscated, and subsequently datasearched. Now the legitimate law enforcement agencies find my RL details on the computers and suddenly I'm a suspect. Not only that but when I try to get a job that requires a background check, this gets flagged up and I'm turned down, and I don't even know the reason why.

Now, in this case the law enforcement agencies have got hold of my details doing their legitimate work - but those details should never have been there. I didn't give Integrity permission to resell those details, or our fictitious magazine permission to buy and use them. ALL of that happened behind my back.

And this is my main sticking point with the Integrity/Aristotle scenario. I agree with Prokovy to a point, that the government wouldn't need to buy that information off me because they already have access to it, but it's not the government I'm worried about. This is the flaw in Prokovy's main argument, because she claims this as a reason Integrity should be trusted. It's Integrity selling my details to anyone who comes up with the right amount of cash that is the major concern, not whether the government gives a crap about the details (because chances are, they don't).

Which is why alternatives need to be found. I've already said I don't think Linden Labs will go for this, but we do need some viable alternatives if we're going to stop them using Integrity. And I'd far prefer if the proverbial genie gets out of the bottle, all a company being able to harvest is "Untameable Wildcat claims she's over 18 and claims this as her birthdate" than detailed information that also contains RL details being available to the highest bidder.

Age Verification - The Residents Strike Back

Walking around SL earlier on I was given an item by an anti age-verification group I'm a member in. The item is called Agelock, and it works by combining a security orb type script with an offsite reference script.

Visitors to land with Agelock running on it will have their names scanned against a database Agelock keep, which contains just three pieces of information about an avatar. Their name, their date of birth and the magical checkbox they've agreed to check that says "Yes, I'm over 18." If they refuse to give this information, they'll be asked to leave. If they haven't left within two minutes the security orb part of the script will cut in and eject them using the teleport home option.

This again shifts responsibility to the individual avatar, rather than the land owner, and asks for nothing more than the same kind of "good faith" agreement that has been held binding for viewing adult content sites on the web.

As such, I think it's a good idea. I also think that Linden Labs won't go for it. Or at least won't abandon their own plans to use Aristotle/Integrity for age verification.

And I do still have a real issue with Aristotle/Integrity. For a start, I can see a million ways I could cheat the system. I hold a photocard license within Canada, but because of a change of address I actually have two licenses. And when they changed my address they failed to put the correct information on the new address, but since misaddressed mail gets put on the windowsill in my apartment block to be sent back in bulk by management, I still picked up the new license even though the details on it are wrong.

According to their site, the information required in Canada is first name, last name, date of birth, postcode and telephone number. Well, let's see now. I can go out to a store, buy a prepay phone and give false details to activate it, so that's no proof. I can make up a first name and last name, so that's no proof, and as long as my DOB is convincing how do they check it? As well, since I recently moved and could quite easily use my old postcode (even assuming I didn't use the net to look up a valid postcode and use that) so those details could be false too.

Which essentially leaves them with the checkbox that I effectively ticked when I agreed that yes, I was over 18 so they could go ahead and verify me. All the other details might be false. What kid do YOU know that can't worm that information out of an adult given the opportunity?

What I AM providing with the Aristotle/Integrity method is statistics for them to sell to political entities, who could use them anyway they damn well please. All I'm effectively doing for Linden Labs is allowing someone else to say "She's telling the truth" - which itself, to me, implies that Linden Labs by default will assume I'm a liar, this despite the fact that they have my credit card information and have successfully billed it in the past.

There is effectively no difference in the information Agelock is asking and the information Aristotle is asking, except Aristotle ask for much more information and advertise that they collect this specifically to sell to political entities. I would be extremely surprised if with my recent immigration and the chaos that the lost paperwork entailed, Aristotle/Integrity could get a perfect answer on me... but I'm certainly not willing to give them an opportunity to then sell that information to the highest political bidder.

To close, let me link a video that is actually published by Integrity for the purposes of drumming up business selling the information they are planning to use Linden Labs to collect. It's quite frightening just how much they are prepared to pimp out the information they get.

Agelock is a nice system, but I can't see LL using it. Integrity is not. Judge for yourself if you think your information is safe with them.

Still alive / pet peeves

Yes, sorry about that folks, but I'm still here.

And I finally got my email working again. You can email me at my first name @ e-c-t.ca - there, spammers, try and work THAT one out! This does mean, of course, that you NEED my first name to send me email... but then those that know me, know what it is.

I was talking to someone in SL earlier on today, and they asked me my one biggest peeve about other people in SL. I had to think about it for a time, but I did find something jumped out and hit me.

As those of you who know me realise, I am a roleplayer. I consider myself a good one, too. Which made me thought of something that always makes me role my eyes. I've never understood it.

Why some roleplayers seem to NEVER use the /me command.

MSN has it. Second Life has it. Hell, even the parlour chatroom has it. Most IM'ers use it without a second thought, especially if they've used IRC at all. I use it all the time, finding that it adds more (IMHO) to a roleplaying scene to see "Untameable Wildcat looks surprised" Than "Name: I look surprised" To me, that breaks the realism of the scene. When I'm on SL I like to some extend to BE Untameable Wildcat. She's a reflection of my Geminiic personality and therefore fun to play... so why - and this seems especially true for guys who want sex - do people lack the ability to use the /me command?

In the old days of paper and pencil roleplay, admittedly one had to use the first person when they spoke to the GM about their character - but this is the internet, it's kind of more advanced... surely if you can work out how to sit on a poseball, you can work out how to use the /me command and talk in the third person. It ain't rocket science. Being able to pose realistically in text, not just with poseballs should be a fundamental part of good roleplaying. You should master it if you're going to call yourself a roleplayer. Not doing so is my pet peeve of the month.

It's live, and its... broken

Voice Chat is now live in SL.

It recognizes the existence of my Logitech USB microphone on my XP-running desktop, but doesn't seem able to use it. I click to test and nothing. Completely dead. I've checked that it's the default input device in control panel, and I know it works because Skype is quite happy with it... but SL doesn't work with it at all.

My bang up to date laptop came with Vista (ugh) - guess what... SL's voice chat doesn't work with that either. I know for a FACT that this works, because Teamspeak - which I use for World of Warcraft - is happy with both systems.

So well done again Linden Labs. You know a feature is live when it's broken.