Anonymity and the Internet

[Jacob]

I came across this article online recently: Security software CEO warns: We could be facing the 'death of anonymity online'

The specific article itself doesn't matter that much, but the general trend towards age verification for adult stuff is real. Similarly, there's the ongoing back and forth in the EU about Chat Control.

I'm curious if any of you have any thoughts or insight on possible less-or-no-anonymity-on-the-net scenarios and potential impacts.

It seems to me that the primary framing of the public discourse is around the following:

• It will allow us to keep children from accessing porn (and other stuff deemed harmful).
• It'll make loads of adults feel weird about accessing porn becuase it'll be linked to their actual identities somehow.
• It'll allow governments way too much insight into political speech and that's going to lead to bad places.
• Something about free speech.

But what are the other possible ramifications?

What's the possible impact on social media if anonymity is curtailed? Will it render large parts of the social media economy reliant on bot farms and the like inoperative? How much of an impact will it have on foreign (or domestic) online influence operations?

How big of a threat is it to the bottom lines of social media companies like Meta, Twitter, etc (and therefore, how much should we expect to see them oppose it)? Or is it not a threat?

To what degree will malicious (or simply profit seeking) actors be able to get personal data on individual people if there's no anonymity? And is it actually that different from what is available to Google, Meta, Microsoft et. al. now?

I'm curious if any of you have any insight or have read any compelling analysis on the topic?

[frunk]

I don't like the idea of destroying anonymity on the whole internet, but I do like the idea of having walled gardens of authenticated users corresponding to real people.  Unfortunately every social media platform that has pushed for authenticating users benefits from blurring real and fake users either for advertising or boosting volume/engagement.

I think these pushes are resulting from the deteriorating quality of these supposed walled gardens that purposefully exploit the authenticated users for their own benefit, making the internet as a whole feel worse and more dangerous.

[Zanza]

• It'll allow governments way too much insight into political speech and that's going to lead to bad places.

I think it is naive to believe that (malicious?) governments are not already able to do this. Edward Snowdon was thirteen years ago and we know that data engineering and recently AI made gigantic progress since then in the private sector.

[Crazy_Ivan80]

The path to the managed democracy of Super Earth, all in name of protecting 'the children'.

[crazy canuck]

The path to the managed democracy of Super Earth, all in name of protecting 'the children'.

Very good argument for removing anonymous posts from social media.

[Crazy_Ivan80]

The path to the managed democracy of Super Earth, all in name of protecting 'the children'.

Very good argument for removing anonymous posts from social media.

didn't take you for an authoritarian. Seems I was mistaken.
Seems you're also unaware that a 'managed democracy' isn't a democracy at all. And that the argument 'think of the children' is often used to ram through measures that would otherwise never make it to the books.

Without anonymity the government will, inevitably, regulate what opinions are allowed. And it will be able to do so effectively. Your speech will get managed.

[Valmy]

I will probably just stop talking on the internet should this happen.

Look I know the government probably has some record that "valmy" on Languish.org is me but they don't know they know it. And nobody is going to just screenshot stuff I say here to bust me.

But if I have to be my real name on places that would change how I act. Because some shit isn't anybody's business.

[Sophie Scholl]

It's terrifying for a number of reasons, but one specific to trans people (and other minorities/at-risk groups) is that it would be *very* easy to make lists of us and track us if things keep going the way they are. 

[Sheilbh]

It's terrifying for a number of reasons, but one specific to trans people (and other minorities/at-risk groups) is that it would be *very* easy to make lists of us and track us if things keep going the way they are. 

Yeah - I am very torn I think there are groups who have been able to find communities online and that has been enabled by anonymity. I don't think anonymity is the heart of the issue. I think part of the reason it keeps coming up as a solution is that it reflects the issues of being prominent on the internet - so whether that is Musk or any politician they will get hundreds and thousands of often unhinged anonymous comments from people. At the really bad end (and there's been several prosecutions over this in the UK) threats of violence. The obvious solution to that is to end anonymity because people with their real names known would not make those types of comments - but I'm not sure the issue that idea solves is part of the big problem wth the internet, I think it is, however, the problem people in power and influence are most exposed to.

I also think there are very real security risks around how it's done. It's an area where there are actually some very good private sector solutions that have developed really secure age verification tools that do not store a huge amount of personal information - but it's the wild west out there in terms of standards. I was struck by the UK Online Safety Act coming into force in the same week as a very major data breach in the US of a big online provider. The European Commission launched an age verification app to comply with various EU laws (in different stages of taking effect) a couple of weeks ago and urged rapid adoption. It took security experts less than two hours to hack it - and it was (even to a non-technical person like me) wildly insecure, for example lots of stuff just being held in plain text.

The flipside is there is a lot of content that should be age gated and would not be accessible to children in the real world. That includes porn, but is broader. I've said before that the Online Safety Act in the UK (and there is similar in Europe) is a bit of a grab-bag from very well meaning campaigns that I can only sympathise with - parents of children who killed themselves or died from an eating disorder and had been engaging in content that promoted self-harm, suicide and eating disorders. There are safeguarding issues in basically any area of the internet where children are (this is also a big part of the European drive to stop end to end encyrption which is causing a big fight with Meta and Apple especially).

But I think this has led to some incredibly ill-defined concepts in our laws like, in the UK, "lawful but harmful", in Europe quite broad powers to "authorities" which do not require a court order and I think some quite dangerous over-reach, particularly around encrypted messaging. I also think that the whole regulatory approach actually reinforces the big platforms - who I think are a major part of the problem - because whether it's age-gating or assessing potentially harmful content, that tends to reinforce their market and institutional power as gatekeepers. I don't think that's helpful as I think they are part of the problem. So to Jake's question around whether it harms them - I think it does the opposite. I think it embeds them as part of the core infrastructure of the internet.

Now having said all of that anonymity on the internet is largely a fiction at this point unless you put a lot of effort into it just by virtue of the way online advertising works. Your profile is being broadcast to thousands of counterparties in the ecosystem every time you're browsing online. It's not just cookies any more with cross-device, cross-browser tracking and general ID graphing of who is who and who is in a household. And there is an argument that a more age-gated internet might help reduce the issues around that - but again it entrenches the platforms.

My own view all told is probably very controversial I fully accept Sophie's point and I don't know that anonymity is the heart of the problem. But I think from a European perspective, China probably had the right model of developing and ensuring that the internet that is built in that country complies with its laws. Those laws in China are obviously authoritarian and not what I would want to replicate. But I think that approach has "worked" in allowing the development of an internet that is in line with local laws and to that extent arguably more "pro-social". I think in Europe we have the worst of all worlds. We have been open to the global internet which means we live on the American internet with all its pathologies and it does not always comply with our laws on speech or other issues. We have also imposed quite a high regulatory burden which is expensive to comply with and a really high bar to entry for European competitors. Which means we are relying on TikTok, Google, Meta etc to comply meaningfully with our regulations (which I'd argue is questionable at best) but also those same regulations present a barrier to creating and scaling European TikToks etc. I think a Great Atlantic Firewall, say, would have been the right approach and maybe it's not too late - removing anonymity may be part of it, it goes against the great cosmopolitan dream of the internet but I kind of think building localised internets that comply with our local legal requirements would be worth doing (because once you've blocked Meta or Google - they're not impossible to replace - see China, Russia etc)

[crazy canuck]

The path to the managed democracy of Super Earth, all in name of protecting 'the children'.

Very good argument for removing anonymous posts from social media.

didn't take you for an authoritarian. Seems I was mistaken.
Seems you're also unaware that a 'managed democracy' isn't a democracy at all. And that the argument 'think of the children' is often used to ram through measures that would otherwise never make it to the books.

Without anonymity the government will, inevitably, regulate what opinions are allowed. And it will be able to do so effectively. Your speech will get managed.

You are missing the point.  Social media has already done considerable damage to democracy.

[Sophie Scholl]

You are missing the point.  Social media has already done considerable damage to democracy.

I think it is more the nigh total marketization and focus on wringing every possible short-term cent out of social media that has led to the damage to both it and democracy. The internet, too. They were both once possible bastions of freedom and democracy and a way to move the world into a more open and progressive future. Alas, that is no longer the case. 

[crazy canuck]

You are missing the point.  Social media has already done considerable damage to democracy.

I think it is more the nigh total marketization and focus on wringing every possible short-term cent out of social media that has led to the damage to both it and democracy. The internet, too. They were both once possible bastions of freedom and democracy and a way to move the world into a more open and progressive future. Alas, that is no longer the case. 

Agreed, once someone figured out how to monetize the internet, it was game over.  Governments completely abdicated their responsibility and this is what we got. 

The cries of freedom of speech in protest to attempts to regulate miss the point.

[Syt]

On the subject of anonymity/age restriction:

https://www.pcgamer.com/gaming-industry/us-may-force-operating-systems-to-have-mandatory-age-verification-share-info-with-third-parties/

US may force operating systems to have mandatory age verification, share info with third parties

As reported by Gaming on Linux, a new bill brought before the US House would require operating systems like Windows, Linux, and MacOS to verify users' age for installation and, seemingly, regular use. The "Parents Decide Act" has been referred to the House Committee on Energy and Commerce, and is cosponsored by New Jersey Democrat Josh Gottheimer and New York Republican Elise Stefanik.

The bill would "require any user of the operating system" to enter their date of birth to both "set up an account on the operating system and use the operating system."

OS providers would also have to "develop a system to allow an app developer to access any information as is necessary, collected by the operating system to carry out this section and any regulation promulgated under this section, to verify the date of birth of a user of an app of the app developer." In other words, any program on your PC would have access to the date you entered, which I don't like at all.

The method of age verification is probably the most critical information here in terms of privacy and data security, but that's being left to the Energy and Commerce Committee to decide after the bill has been passed⁠

It's not exactly clear if the law would simply require us to enter a date—just like how we all say we were born on 1/1/1900 when we want to look at an M-rated game—or if an actual verification step will be required. Some of the language in the bill heavily implies the latter, and, worryingly, that detail is seemingly one of a few that would only be figured out after the bill is passed—if it is passed.

"Not later than 180 days" after enacting the Parents Decide Act, the committee would determine the following:

• "How an operating system provider can verify the date of birth of a parent or legal guardian"—or, unmentioned in this entry but implied later, an adult user acting on their own behalf.
• "Data protection standards related to how an operating system provider shall ensure a date of birth collected by the operating system provider from a user, or the parent or legal guardian of the user ... is collected in a secure manner to maintain the privacy of the user or the parent or legal guardian of the user; and is not stolen or breached."
• "Ensure an app developer can access information collected by the operating system provider to carry out this section ..., to verify the date of birth of a user of an app of the app developer."

Now I'm just a simple country games journalist, but this certainly sounds like a vaguely-worded privacy nightmare that would require OSes to not only store sensitive personal information, but share it with whoever⁠—and you'll forgive me for not trusting some hastily drawn-up data protection scheme when these things always seem to fail, whether it's Discord immediately compromising IDs used in its own age verification, or some bush league people finder in Florida losing everyone's Social Security number.

That's not to mention that this bill seems to just assume that all operating systems are of corporate origin⁠—how is an open-source fork of Linux supposed to securely process personal information at installation, startup, and, seemingly, every time it interacts with a third-party application?

The simple answer would seem to be that it's not, and this bill would blithely wipe out an entire mode of personal computing in order to project the appearance that Congress cares about children's wellbeing. A further wrinkle pointed out by PCG US editor-in-chief Tyler Wilde: Would this also require internet access just to use a computer?

OS-level age verification is the latest development in the generalized first world drive to wipe out what little remains of digital privacy in a panicked response to parents letting their children fry their brains on the internet. The government of California has already passed a similar law, and it's driving open source software developers to the brink.

Article about the law in California: https://www.pcgamer.com/software/operating-systems/a-new-california-law-says-all-operating-systems-including-linux-need-to-have-some-form-of-age-verification-at-account-setup/

A new California law says all operating systems, including Linux, need to have some form of age verification at account setup

The government of California is implementing a law that requires operating system providers to implement some form of age verification into their account setup procedures.

Assembly Bill No. 1043 was approved by California governor Gavin Newsom in October of last year, and becomes active on January 1, 2027 (via The Lunduke Journal). The bill states, among other factors, that "An operating system provider shall do all of the following:"

"(1) Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user's age bracket to applications available in a covered application store.

"(2) Provide a developer who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface that identifies, at a minimum, which of the following categories pertains to the user."

The categories are broken into four sections: users under 13 years of age, over 13 years of age under 16, at least 16 years of age and under 18, and "at least 18 years of age."

In essence, while the bill doesn't seem to require the most egregious forms of age verification (face scans or similar), it does require OS providers to collect age verification of some form at the account/user creation stage—and to be able to pass a segmented version of that information to outside developers upon request.

That's likely no big deal for Windows, which already requires you to enter your date of birth during the Microsoft Account setup procedure. However, the idea that all operating system providers need to comply (in California) has drawn a fair degree of ire from certain Linux communities.

"This is basically impossible for California to enforce" says CatoDomine on the Linuxmint subreddit. "Even if Linux Mint decides to add some kind of age verification, to comply with CA law, there's no reason anyone would choose that version."

"It's more likely they will put a disclaimer on their website: "not for use in California."

Looking at the wider picture, however, mandatory age verification appears to be a growing trend. The UK government's current implementation under the Online Safety Act has come under heavy fire for privacy concerns, while platforms like Discord have received similar critique for their face-scanning age verification efforts, not least because of associations with companies that may not be using the collected data for mere age-confirmation purposes.

And while this implementation is California-specific, it does speak to a wider desire from governments to enforce age verification on a legal level—even if in this case, it seems virtually impossible to effectively enact.

[HisMajestyBOB]

And it's bipartisan.
This is one reason why I don't think Democrats will ever stand up to the anti-democracy oligarchs. They're also all to willing to go along with authoritarianism if they get their paycheck.

[Valmy]

And it's bipartisan.
This is one reason why I don't think Democrats will ever stand up to the anti-democracy oligarchs. They're also all to willing to go along with authoritarianism if they get their paycheck.

Nope. Not unless we make them.