Cybersecurity experts say there are a “lot of problems” with the way popular messaging app Snapchat is approaching age verification for the impending under-16 social media ban.
Ten platforms, including Snapchat, will be included in the social media ban for children under 16, which comes into effect on December 10.
Snapchat will offer Australians the chance to prove they are 16 or above in three different ways: users can click on software tool ConnectID, owned by Australian Payments Plus, which links to their bank accounts; use software owned by Singapore-based k-ID, which estimates a person’s age based on a selfie; or upload government-issued identification.
Snapchat claims about 440,000 Australian users aged 13-15, making it the most affected platform by the restriction.
US-based company Snap, operator of Snapchat, has been critical of its inclusion in the restrictions, arguing that it is a “visual messaging app” but has agreed to comply.
“However, disconnecting teens from their friends and family doesn’t make them safer — it may push them to less safe, less private messaging apps,” Snap said in a post on its website.
“We continue to advocate for more privacy-conscious solutions, such as mandating age verification at the device, operating system, or app store level.”
Sherif Haggag, a cybersecurity and ethical hacking expert from Adelaide University, said there were “a lot of problems” with the way Snapchat is approaching age verification.
Dr Haggag said the first issue was that data provided by young Australians will leave Australia because k-ID is based in Singapore.
“Even if they say that they’re not going to be saving the data, the data will be actually going out: the child’s passport, selfie, ID, whatever it is, will have to be sent to verify,”
he said.
“Once it goes outside Australia, the Australian government’s regulations are out of the window because you don’t have any control of it.”
A spokesperson for the Office of the Australian Information Commissioner (OAIC), the national privacy regulator, said the Privacy Act had extra-territorial application and applied to “organisations no matter where they’re owned or headquartered, provided that they have an Australian link or carry on business in Australia”.
Paul Haskell-Dowland, a cybersecurity expert with a research interest in child safety, said immediately alarm bells started to ring when he heard that two of the options Snapchat was offering involved sending a selfie or government-issued ID.
“We have so many cases that come to public awareness because of data being breached, data being lost, data being misplaced,” Professor Haskell-Dowland said.
“Now we don’t know the details at this stage of how they will handle the data.
“What we do know is that companies, not necessarily this one, but companies in general are not very good at keeping our data safe.”
Bank account option
The bank account option represents the first involvement of a person’s financial footprint in the rollout of the landmark social media ban.
ConnectID said it was operating with Snapchat through k-ID, business-to-business, so that the user would just see ConnectID if they chose the bank account option.
The company said it would send the tech platform a yes/no signal about whether the person was over 16 based on their account details, without making them upload sensitive information.
“The goal here is to protect young people online without creating new privacy risks,” ConnectID managing director Andrew Black said in a statement.
Dr Haggag said the bank account option was probably less risky, as long as there was no identifying information, like account numbers, included.
Cybersecurity lecturer Rumpa Dasgupta at La Trobe university said taking a selfie raises real privacy and security concerns.
“A selfie used for age estimation counts as biometric data, which is extremely sensitive, and storing these images anywhere makes them a tempting target for hackers,” she said.
“A successful data breach could expose biometric images and identity documents of Snapchat users and opening the door to identity theft and fraud.
“While Snap states it only receives a yes/no result, the third-party service provider may still store images or retain logs, metadata, or backups.”
Historically, many large-scale cyber-attacks worldwide have originated through third-party providers, Dr Dasgupta said.
“Users therefore need transparent details on what information is collected, how it is processed, how long it is retained, who can access it, and whether the images are stored or used ephemerally,” she said.
“Without this transparency, trust declines and the likelihood of data breaches increases.”
Dr Haggag says the biggest concern he has is the potential for hacking.
“At least every month we have a major data breach, whether it’s a bank or telecommunications company; we have so many hacks happening,” he said.
“And if you are verifying data, even if you are not storing it, you still have data on file to verify.”
A government spokesperson told the ABC that the “social media minimum age law incorporates strong protections for personal information collected by platforms for age assurance purposes”.
“These privacy safeguards impose robust obligations on platforms to ring-fence and destroy any information collected, with serious penalties applicable for breach of these requirements,” he said.
But Professor Haskell-Dowland said there were risks associated with young people sending passports, driver’s licences or learner’s permit.
“It raises concerns over how the data will be processed, how it will be stored, what duration it will be stored for, who will have access to it, and what the process will be for that data subsequently being deleted when it is no longer required,” he said.
One of the other concerns Dr Haggag raised was the potential for age-verification apps that use selfies to use the photos to better train their tools.
“The more data I provide to the system, the more it’s going to be accurate,” he said.
The OAIC said platforms must not use information collected through age assurance methods for any other purpose and that once those purposes have been met, the personal information must be destroyed.
But Dr Haggag says, in practice, the most likely way a company is found not to be compliant with Australian privacy laws is when there is a data breach, and then it is too late.
“When you take a selfie or a photo of your child’s face it’s very sensitive information,” he said.
“If it leaks, you can’t change your face, the damage is done and it’s going be done forever.”
K-ID has been contacted for comment.
Loading…
