Tagged: enforcement

Identity Verification is as Bad as It Can Be

  • Posted in cyber

This is an addendum to OS-Level Age Attestation is the Good One, where I talk about the potential of legal standards for age attestation as an alternative to age verification. Not already convinced of the dangers of age verification? The extent of the evil waiting behind identification systems and deanonymization is unspeakably vast, and fortunately it’s getting extensive coverage. Here’s a quick look to get you up to speed.

Direct digital censorship

A lot of the energy behind age verification comes from authoritarians eager to censor political dissent, promote propaganda and retaliate against critics. This is a power grab, with bills designed to seize power over specific content the government objects to:

Governments are, of course, trying to claim control over “public discourse”. Like all seizing of arbitrary power, the risks associated with this are volatile and unbounded, because they depend on who holds power at any given moment in a political system where power is expected to rotate.

Discord

As a case study, let’s take a look at one of the latest major services to attempt age verification: Discord. At time of writing, Discord is in the process of trying to switch to a “Teen Default” system, where every user is assumed to be a minor unless they can prove their age to Discord. Discord is a communications platform used widely by adults, and during COVID Discord very intentionally expanded their market domain beyond gaming to focus on being a global platform, so the assumption that all spaces are for kids is clearly incorrect.1 But Discord is sometimes used by children, and since it’s a communications platform people can use it to communicate horrible things. Boomers have learned they can be insane about this, so Discord is under significant pressure to balance its goal of being a universal communications platform with child safety.

OS-Level Age Attestation is the Good One

  • Posted in cyber

There’s a coordinated effort to use the “child safety” euphemism to cripple the internet with identity verification mandates. That’s bad. But buried in the mix there’s a genuinely good idea with enough political capital that it might stick around and do some good.

Every time I’ve tried to write an article on the topic of child internet safety my energy has fizzled into depression, because as one researches the topic it becomes obvious that everyone with any relevant power is refusing to solve the problem on purpose. It’s demoralizing and it’s been mostly useless for me to do any thought work in this area.

But California’s age attestation bill might be an exception to this. Because it’s age attestation, not age verification, it looks like a significant political step in the right direction, and with the right focus it could do a lot of good. A lot of people have (fairly!) assumed attestation was age verification or at least lays the groundwork, but I think this isn’t the case. There is always the danger of future bad legislation, but OS attestation doesn’t pave the way for it, it provides a strong defense against it. We need a good idea to win the child safety war, not because we’re in dire need of more online child safety, but because addressing the real concerns correctly blocks a whole slew of impossibly dangerous policies.

My ideal age filtering tool is a system of client attestation with trust rooted in the adult administrator, provided by an OS-level API provided as preemptive verification, enforced by compliant browsers and application stores. And we’re shockingly close to that.

There is room for improvement

People on the privacy side of the age verification war — my side — will argue that parents already have everything they need for comprehensive web filtering if they want to use it. I think this isn’t quite true; there’s one notable architectural gap that a technical solution could meaningfully fill.

There are many existing content filtering tools geared toward child safety but their weakness is that they’re reactive. Traffic filters can identify and block traffic from known websites and on-device content filters can try to detect and block specific content. But this requires the user reacting and defending against every possible source and behavior. It’s the same cat-and-mouse game as adblockers. And like adblockers, the more closed down the system is — like iOS or gaming consoles — the harder it is for developers to make exactly the right product.

The internet sometimes assumes minors are supervised — since they have parental consent to have the device in the first place — but this often isn’t the case. It’s very common for minors to have their own phones or tablets with unsupervised access. When they’re online or downloading apps, they’re not sitting with a parent, they’re unsupervised, roaming children. Parents are dropping their kids off in the city.

This isn’t inherently bad; it seems like parents and children both want children to be able to exist independently without granular supervision, and so there’s a desire to make that situation safer. That shouldn’t come at the cost of any adult liberty or even the liberty of children with parental consent; it just means we want an ecosystem that allows for unsupervised children to exist within it.

Right now the burden is on parents to be active defenders protecting their children from a vast ecosystem of companies investing research and capital into optimizing how efficiently they can exploit money and data out of everyone in the world. It would be a meaningful improvement if there were a safe way to prevent some of this exploitation by putting reasonable requirements on providers, so long as this can be done in a way that doesn’t cause more problems.

Political pressure for “child safety” is exploitable

But the lack of a perfect parental control system isn’t the main problem here. The real danger is the push for online identity verification using child safety as a justification.

Smart and privacy conscious people demand “No age verification” (quite reasonably!), but that doesn’t offer the quick fix people are looking for. More importantly, it doesn’t relieve the political pressure and so doesn’t take away the excuses of tyrants.

Normally “do nothing” would be the safest option here, but the danger of uninformed and reactionary voters means there is a great deal to gain by satisfying the concerns safely instead of letting the solution be evil. A technical standard for parents to somehow identify their children as children is the relief valve for dangerous political pressure. This doesn’t appease the fascists and censors. This doesn’t cede them any ground and it’d be wrong to try to; there’s no satisfying that hunger and it’s a dangerous mistake to feed it. What it does is actually improve the material conditions for the people they’re trying to trick.

A proactive system that puts some of the burden for protecting children on those companies is a real relief to this, and it would be a meaningful improvement if something could address this without causing bigger problems.

Taxonomy

There are three basic categories of age filtering: nothing, client attestation, and client verification. These provide services varying levels of confidence in their knowledge of users. (It’s tempting to simplify confidence to labels like “strong” or “weak” but it’s important to think about what’s actually being secured, and from who.) Different people call these different things, but here’s my taxonomy with the labels I’ll use.

a wholesome plane has hit the second cozy tower

  • Posted in rp

Here’s an advertisement I got from a game company named Rogue Duck Interactive.

The game they’re advertising here — which they neglect to name outside the screenshot — is “Nothing to Declare.”1 And it caught my eye, because there’s problems.

papers please

If you’ve been living under a rock for the last ten years you might not recognize this as the gameplay from Papers, Please.

Papers, Please (2013), of course, is the multi-million-selling dystopian bureaucracy simulator game where you work as an immigration enforcement officer for a despotic regime.

Papers is known as one of the games of all time. It uses the mechanics of rote bureaucracy — checking correctness of paperwork, matching dates, enforcing documentation requirements — to connect the player to a cruel and miserable world. The message and mechanics perfectly intertwine: the dystopia is entwined with the nature of the policing, which is both the setting and the game mechanic.

It’s an intense, profound piece that prompts the player to think about the way political structures affect real human lives. It prompts introspection about the role and agency of the individual within a system and how morality responds when someone is faced with a hard reality: a political and economic moment where harming others for profit may be the only way to feed your own family. Papers is “video games as true art”, “brilliantly written”, “grim yet affecting”.

Rogue Duck hasn’t been living under a rock. They know their game “takes inspo” from Papers, Please, but it has its own “original take and ideas.”

but cozy

Now, I don’t care that Rogue Duck is iterating on Papers. What’s hooked me here is this original take they’re so excited about. Because Declare is more than a shameless clone: it has its own identity and it does have something to say. Nothing to Declare comes on stage following Papers, turns to the audience, and what it has to say is: “man, that guy was a downer, am I right?”

That fun new original idea Rogue Duck adds to the equation is that now the bureaucracy of immigration is fluffy and wholesome. A fun little action parallel to making postcards and pouring coffee.

This isn’t even an interpretation, they shoehorn it right in their store description.

A Hack is Not Enough

  • Posted in cyber

Recently we’ve seen sweeping attempts to censor the internet. The UK’s “Online Safety Act” imposes sweeping restrictions on speech and expression. It’s disguised a child safety measure, but its true purpose is (avowedly!) intentional control over “services that have a significant influence over public discourse”. And similar trends threaten the US, especially as lawmakers race to more aggressively categorize more speech as broadly harmful.

A common response to these restrictions has been to dismiss them as unenforceable: that’s not how the internet works, governments are foolish for thinking they can do this, and you can just use a VPN to get around crude attempts at content blocking.

But this “just use a workaround” dismissal is a dangerous, reductive mistake. Even if you can easily defeat an attempt to impose a restriction right now, you can’t take that for granted.

Dismissing technical restrictions as unenforceable

There is a tendency, especially among technically competent people, to use the ability to work around a requirement as an excuse to avoid dealing with it. When there is a political push to enforce a particular pattern of behavior — discourage or ban something, or make something socially unacceptable — there is an instinct for clever people with workarounds to respond with “you can just use my workaround”.

I see this a lot, in a lot of different forms:

  • “Geographic restrictions don’t matter, just use a VPN.”
  • “Media preservation by the industry doesn’t matter, just use pirated copies.”
  • “The application removing this feature doesn’t matter, just use this tool to do it for you.”
  • “Don’t pay for this feature, you can just do it yourself for free.1”
  • “It’s “inevitable” that people will use their technology as they please regardless of the EULA.”
  • “Issues with digital ownership? Doesn’t affect me, I just pirate.”

Why training AI can't be IP theft

  • Posted in cyber

AI is a huge subject, so it’s hard to boil my thoughts down into any single digestible take. That’s probably a good thing. As a rule, if you can fit your understanding of something complex into a tweet, you’re usually wrong. So I’m continuing to divide and conquer here, eat the elephant one bite at a time, etc.

Right now I want to address one specific question: whether people have the right to train AI in the first place. The argument that they do not1 goes like this:

When a corporation trains generative AI they have unfairly used other people’s work without consent or compensation to create a new product they own. Worse, the new product directly competes with the original workers. Since the corporations didn’t own the original material and weren’t granted any specific rights to use it for training, they did not have the right to train with it. When the work was published, there was no expectation it would be used like this, as the technology didn’t exist and people did not even consider “training” as a possibility. Ultimately, the material is copyrighted, and this action violates the authors’ copyright.

I have spent a lot of time thinking about this argument and its implications. Unfortunately, even though I think that while this identifies a legitimate complaint, the argument is dangerously wrong, and the consequences of acting on it (especially enforcing a new IP right) would be disastrous. Let me work through why:

The complaint is real

Artists wanting to use copyright to limit the “right to train” isn’t the right approach, but not because their complaint isn’t valid. Sometimes a course of action is bad because the goal is bad, but in this case I think people making this complaint are trying to address a real problem.

I agree that the dynamic of corporations making for-profit tools using previously published material to directly compete with the original authors, especially when that work was published freely, is “bad.” This is also a real thing companies want to do. Replacing labor that has to be paid wages with capital that can be owned outright increases profits, which is every company’s purpose. And there’s certainly a push right now to do this. For owners and executives production without workers has always been the dream. But even though it’s economically incentivized for corporations, the wholesale replacement of human work in creative industries would be disastrous for art, artists, and society as a whole.

So there’s a fine line to walk here, because I don’t want to dismiss the fear. The problem is real and the emotions are valid, but that doesn’t mean none of the reactions are reactionary and dangerous. And the idea that corporations training on material is copyright infringement is just that.

The learning rights approach

So let me focus in on the idea that one needs to license a “right to train”, especially for training that uses copyrighted work. Although I’m ultimately going to argue against it, I think this is a reasonable first thought. It’s also a very serious proposal that’s actively being argued for in significant forums.

Copyright isn’t a stupid first thought. Copyright (or creative rights in general) intuitively seems like the relevant mechanism for protecting work from unauthorized uses and plagiarism, since the AI models are trained using copyrighted work that is licensed for public viewing but not for commercial use. Fundamentally, the thing copyright is “for” is making sure artists are paid for their work.

This was one of my first thoughts too. Looking at the inputs and outputs, as well as the overall dynamic of unfair exploitation of creative work, “copyright violation” is a good place to start. I even have a draft article where I was going to argue for this same point myself. But as I’ve thought through the problem further, that logic breaks down. And the more I work through it, every IP-based argument I’ve seen to try to support artists has massively harmful implications that make the cure worse than the disease.

Definition, proposals, assertions

The idea of a learning right is this: in addition to the traditional reproduction right copyright reserves to the author, authors should be able to prevent people from training AI on their work by withholding the right.

This learning right would be parallel to other reservable rights, like reproduction: it could be denied outright, or licensed separately from both viewing and reproduction rights at the discretion of the rightsholder. Material could be published such that people were freely able to view it but not able to use it as part of a process that would eventually create new work, including training AI. The mechanical ability to train data is not severable from the ability to view it, but the legal right would be.

This is already being widely discussed in various forms, usually as a theory of legal interpretation or a proposal for new policy.

Asserting this right already exists

Typically, when the learning rights theory is seen in the wild it’s being pushed by copyright rightsholders who are asserting that the right to restrict others from training on their works already exists.

A prime example of this is the book publishing company Penguin Random House, which asserts that the right to train an AI from a work is already a right that they can reserve:

Penguin Random House Copyright Statement (Oct 2024) No part of this book may be used or reproduced in any manner for the purpose of training artificial intelligence technologies or systems. In accordance with Article 4(3) of the Digital Single Market Directive 2019/790, Penguin Random House expressly reserves this work from the text and data mining exception.

In the same story, the Society of Authors explicitly affirms the idea that AI training cannot be done without a license, especially if that right is explicitly claimed:

The ambiguous "use"

I keep seeing people make this error, especially in social media discourse. Somebody wants to “use” something. Except obviously, it’s not theirs, and so it’s absurd for them to make that demand, right?

Quick examples

I’m not trying to pick on this person at all: they’re not a twitter main character, they’re not expressing an unusual opinion here, they seem completely nice and cool. But I think this cartoon they drew does a good job of capturing this sort of argument-interaction, which I’ve seen a lot:

I’ve also seen the exact inverse of this: people getting upset at artists because once the work is “out there” anyone should be able to “use” it. (But I don’t have a cartoon of this.)

There is an extremely specific error being made in both cases here, and if you can learn to spot it, you can save yourself some grief. What misuse is being objected to? What are the rights to “certain things” being claimed?

The problem is that “use” is an extremely ambiguous word that can mean anything from “study” to “pirate” to “copy and resell”. It can also cover particularly sensitive cases, like creating pornography or editing it to make a political argument.

webcomicname: beliefs you do not agree with

But everything people do is “using” something. By itself, “use” is not a meaningful category or designation. Say you buy a song — listening to it, sampling it, sharing it, performing it, discussing it, and using it in a video are all “uses”, but the conversations about whether each is appropriate or not are extremely distinct. If you have an objection, it matters a lot what specific use you’re talking about.

But if you’re not specific, there are unlimited combinations of “uses” you could be talking about, and you could mean any of them. And when people respond, they could be responding to any of those interpretations. There’s no coherent argument in any sweeping statement about “use”; the only things being communicated are frustration and a team-sports-style siding with either “artists” or “consumers” (which is a terrible distinction to make!).

Formal logic

This is not a new problem. This is the Fallacy of Equivocation, which is a subcategory of Fallacies of Ambiguity. This is when a word (in this case, “use”) has more than one meaning, and an argument uses the word in such a way that the entire position and its validity hinge on which definition the reader assumes.

The example of this that always comes to my mind first is “respect”, because this one tumblr post from 2015 said it so well:

flyingpurplepizzaeater Sometimes people use “respect” to mean “treating someone like a person” and sometimes they use “respect” to mean “treating someone like an authority”

and sometimes people who are used to being treated like an authority say “if you won’t respect me I won’t respect you” and they mean “if you won’t treat me like an authority I won’t treat you like a person”

and they think they’re being fair but they aren’t, and it’s not okay.

See, here the “argument” relies on implying a false symmetry between two clauses that use the same word but with totally different meanings. And, in disambiguating the word, the problem becomes obvious.

Short-form social media really exacerbates the equivocation problem by encouraging people to be concise, which leads to accidental ambiguity. But social media also encourages people to take offense at someone else being wrong as the beginning of a “conversation”, which encourages people to use whatever definition of other people’s words makes them the wrongest.

Since I’m already aware that copyright is a special interest of mine, I try to avoid falling into the trap of modeling everything in terms of copyright by default, Boss Baby style. But this is literally the case of a debate over who has the “right” to various “uses” of things that are usually intangible ideas, so I think it’s unavoidably copyright time again.

Game patent grab bag

This was originally something I was going to talk about in Corporations have Rejected Copyright, back when that series was going to just be one long post (really!). But since I saw Nintendo apparently sued Palworld today, I wanted to put this up as background information.

You should definitely read You’ve Never Seen Copyright first, particularly the explanation of what patents are, because this conversation directly follows from that. The most important thing to pick up on is how the Doctrine of Equivalents lets companies use patents that are supposedly very specific to threaten other implementations that are similar, even if they aren’t using the patented design.

Game patents are revelatory, because game rules as a category explicitly do not fall within the realm of patent rights, but companies have managed to file and defend fraudulent patents anyway.

Copyright abusers lost their claim

or, the many people who said movies like Coyote v. Acme that were killed for a tax write-off should be forced into the public domain were right, and here’s why

A healthy system of creative rights, including a balanced form of copyright, is a reciprocal arrangement between creators, consumers, and the commons. Creators are granted some temporary exclusive rights by the government over qualifying intellectual work in order to incentivize creativity. These privileges are granted in exchange for creating valuable new information — the existence of which is a contribution to the public good — and for providing it in such a way that others will be able to build on it in the future. It’s an incentive for providing a specific social good, one which the market alone might not reward otherwise. Fortunately, this is actually how US copyright was designed; see You’ve Never Seen Copyright.

The takeaway from that, though, is not just that there’s a fair version of copyright, but that copyright must look like that fair model. The fact that such a thing as “good copyright” exists as a sound philosophy is not a broad defense of the word “copyright” itself, it’s an imperative requirement for the legitimacy of any system of power that claims to enforce copyright. The soundness of the philosophy doesn’t legitimate the system of power that shares its name, it damns it for failing its requirements.

When they invoke the philosophy of copyright to justify thuggery, it matters that they’re wrong.

The requirements for reciprocity intrinsic in copyright are how the system must work, but it’s not what actually happens today. In practice, corporations regularly violate the fundamental principles of creative rights — both in letter and in spirit — and use copyright protections to profit without showing the required reciprocity.

I can’t possibly list all the stories of what these violations look like. Seriously, just the thought of me having to give a representative sample of companies abusing IP law made me dread writing this series, it’s such a prolific problem. But I have shown a sample: Nintendo using copyright to kill new creative work, Apple using trademarks to keep competitors from conducting trade at all, book publishers trying to destroy the idea of buying and selling books… they’re all examples of how companies do everything they possibly can to get out of fulfilling their side of the bargain.

Case studies are fun, but just listing out a bunch of horrors isn’t what I set out to do; that’s just groundwork for thinking about the problem. What’s important is that they’re a representative sample of a kind of behavior. With all that established, you can read this with the knowledge that yes, they violate the purpose of the law as written and yes, violations are so regular they seem to define the practice.

So what does it all add up to?

Here’s what I say: If you want out of the deal, so be it. When someone won’t participate constructively — if they don’t work in good faith, or at least begrudgingly accept the limits the system of copyright puts on them — we stop respecting their claim to special privileges within it as legitimate, and understand it as the double-dealing overreach it is.

As self-evident as it sounds when I say it out loud, this argument is my nuclear option. This is what I would have to say if it ever got this bad; if, between the two of them, the courts and the corps ever broke the system beyond my last bit of tolerance. And I’ll be damned if they haven’t done just that.

Legitimacy

In You’ve Never Seen Copyright, I talked about how the word “copyright” can refer to two very different things: either a philosophical basis that justifies copyright as a legal doctrine, or the system of power that describes how copyright is actually enforced, what enforcement looks like, and who it benefits.

But the fact that the power structure has diverged from the original philosophical intent doesn’t just create a communication issue. Yes, it becomes increasingly unclear what people who say “copyright” are talking about, but the legitimacy of the power structure depends entirely on being an implementation of a sound legal doctrine.

CDL: The AAP is Wrong About Everything

In going through these arguments, I’ll also be drawing from a few other sources, in order to give a more comprehensive description of the arguments being made.

The Authors Guild Amici Curiae Brief is a document submitted to the court by The Authors Guild in support of the plaintiff’s argument.

Reflections from the Association of American Publishers on Hachette Book Group v. Internet Archive: An Affirmation of Publishing is a victory-lap publication from the AAP, published after the summary judgement in favor of the plaintiffs.

And there’s also EFF, Redacted Memorandum of Law In Support of Defendant Internet Archive’s Motion for Summary Judgment, written by the EFF in support of the Internet Archive, and whose arguments overlap a lot with mine.

Alright, there’s never anything more damning than their own words, so let’s just look at what it is they said here.

CDL: Publishers Against Books

Combining lending with digital technology is tricky to do within the constraints of copyright. But it’s important to still be able to lend, especially for libraries. With a system called Controlled Digital Lending, libraries like the Internet Archive (IA) made digital booklending work within the constraints of copyright, but publishers still want to shut it down. It’s a particularly ghoulish example of companies rejecting copyright and instead pursuing their endless appetite for profit at the expense of everything worthwhile about the industry.