Fun conversations attempting to game out the question "to what extent is [an OS mandating data collection] / [mandating OS data collection] related to age legal in Canada?"

[sarahjamielewis@mastodon.social]

My takeaway on the current state in Canada is:

- An OS can mandate age collection (as long as it stays on device)

- Mandating such collection will face issues.

- Deployment of an OS that mandates age collection could be an issue

- Any attempt to use that collected data will face issues (especially if developers are required to be deemed to have collected it)

[nemeciii@mastodon.social]

@sarahjamielewis As an European, what is going on?

I thought this was some California tech-bro oligarchy Trump boot licker shit but you too?

[sarahjamielewis@mastodon.social]

@nemeciii

There are a number bills in a few US states (CA, CO, NY) which all together likely capture a significant % of OS and OS developers

There are some private member and draft bills in Canada floating around, but nothing with traction right now.

My main concern as someone who deploys software to many different platforms is if OS's start mandating that applications collect age data (as in the CA bill) then my obligations under Canadian law mean I have to stop supporting those platforms.

[nemeciii@mastodon.social]

@sarahjamielewis this is really horrible.

What do they check the age verification against?

Also, I'd register my computer under some random hobo on the street ( if we had random hobos on streets which we don't, since we actually have somewhat working social security ).

[sarahjamielewis@mastodon.social]

@nemeciii

I think the important thing to note here is that the "age verification" parts of these laws are the least interesting bit (by which I mean, its not practical to enforce compliance in any meaningful way)

These laws are fundamentally about developer liability - the success of these laws would fundamentally mean the death of free software.

See:https://mastodon.social/@sarahjamielewis/116178334950236964

[nemeciii@mastodon.social]

@sarahjamielewis yikes.

Hmm... Pihole blocking the shit out of unauthorized network access or redirecting it to success 200.

Anyhow. They're trying to kill freedom, and track who you are. Luckily GDPR + EU will likely ban all that ( ).

[dazo@infosec.exchange]

@sarahjamielewis What I struggle to wrap my head around on this OS age verification stuff ... How will they verify that this age verification hasn't been disabled or tampered with?

How can they be sure it is working as intended on an OS which is fully open source?

Or will they do home visits to check that it is working as it should? Will you need a licence to own a computer, so governments know who has access to computers and how many? I heard families in California could get a $2500 fine if the age verification was not active - how would they know? You need to login on a website regularly to get access to Internet?

On the other side, I see a huge win in all of this.

The government may very well help fostering up a large force of young hackers who will want to take full control over their computers. Where the clever hacks fooling various audits and controls will flourish on the darkweb which will also most likely grow popularity. And if this goes much further than California alone, maybe this will even contribute to "the year of the Linux desktop"? I'm sure Microsoft will be thrilled!

I think I'll just grab some popcorn and watch how this all plays out. And I'll happily help and support kids wanting to learn a few things about computers

[dazo@infosec.exchange]

@sarahjamielewis @nemeciii

I hope sanity will win in the end. When these politicians realises that it will be easier control then direction the wind blows per week day, than to control what happens on computers in the homes of their population.

It's essentially just a dark comedy farce, almost like it's pulled out of an unpublished Douglas Adams manuscript.

[sarahjamielewis@mastodon.social]

Something I really really want to emphasize here:

The "age verification" bit doesn't really matter. Even as far as mandating the existence of parental controls is debatable in many contexts.

The "developer liability to know personal information" bit is an existential threat to free software. And the bit that deserves defending from every possible angle (freedom of speech, expression, and privacy law to name a few)

Sarah Jamie Lewis (@sarahjamielewis@mastodon.social)

Something I want to make clear: The "age verification" bit of the CA/CO laws are not the bit I care about i.e. a law that requires an operating systems to implement some kind of parental control feature is...whatever. The bits I care about are the obligations on developers to call APIs and then that invocation being taken as evidence of knowledge. Specifically, I think a -legal- requirement to: - make any kind of call is an attack on speech - know a users age (bracket) is a privacy violation

Mastodon (mastodon.social)

[em0nm4stodon@infosec.exchange]

@sarahjamielewis @nemeciii We need to start pushing against this with our local representatives in Canada. This is coming for us too: https://www.ctvnews.ca/politics/article/social-media-ban-for-kids-under-consideration-in-online-harms-bill-carney/

[sarahjamielewis@mastodon.social]

@Em0nM4stodon @nemeciii

The federal government would likely struggle to come up with anything that sticks in this area because these kinds of questions are typically not within their primary jurisdiction - age of majority questions are clearly matters for the provinces.

More likely we will see duty of care considerations applied to federally recognized entities, and perhaps obligation to provide an option for parental controls (something like what was proposed in 216) in commercial settings.