Privacy and security fears: Australians face having to reveal more personal information just to get online

Australians are set to be forced to offer up even more personal information online just to access the internet, sparking concern about security and privacy as companies struggle to keep data secure. From December — where “technically feasible and reasonably practicable” — companies like Google and Microsoft must introduce “age assurance” measures for account holders on their search engines. The reforms, part of an industry code, were adopted by the eSafety Commissioner Julie Inman Grant last month and follow plans to ban under 16s from social media. Curtin University Professor of Internet Studies, Tama Leaver said there were too many unanswered questions about how the changes will work. “We haven’t had successful age verification tools, really, anywhere in the world where age verification has been mandated unless it’s been based on a government ID, and I don’t get the sense that is what is intended by these codes,” Professor Leaver told The Sunday Times. “Google will already be able to accurately identify the age of many, many people using those platforms. A lot will have a credit card, for example, attached to a Google account for various purposes. That’s very straightforward, then to identify the age of that particular user. “If you’ve never used Google services, then it becomes harder, of course, and that’s where the question of what level of information to verify an identity needs to be mandated.” Revelations people will need to fork out more personal information come in the wake of another corporate data breach — a widespread hacking of Qantas customer data coming in the wake of scares at Optus and Medibank, as well as myriad smaller companies in recent years. The action by the eSafety Commissioner — known as the Internet Search Engine Services Online Safety Code — is aimed at reducing the risk of children accessing or becoming exposed to harmful content like pornography, high-impact violence, or self-harm material. But Kate Sim, director of UWA’s Children’s Online Safety and Privacy Research program, said there would be serious repercussions for all users. “Just think about all the times that you have been annoyed or, even locked out of your account, by two-factor authentication,” Dr Sim said. “Many Internet users do not have a good grasp of when and where they use the Internet as account holders and as non-account holders. “This is because search engines are not optional; they are infrastructural. It is deeply embedded in how people experience the Internet.” The European Union is in the process of undergoing similar changes, recently launching a pilot of age verification apps across several countries which are hoped to balance people’s privacy concerns and the need to protect kids online. Back home, the Federal Government launched a trial of its own verification technology in November — the findings of which are still to be released. “It does feel like we’re asking for something to happen, but nobody can actually give a concrete answer as to how,” Professor Leaver said. “Other than something like government-issued ID or linking Google to your My Gov, or your digital ID platform. I think most people are not comfortable with that level of data and platform level data being so deeply tied together.” Google already offers a verification service for age-related content which relies on users uploading a valid ID document, mobile phone number, selfie, or a credit card. The company says the data may also be used to “improve our verification services for Google products and protect against fraud and abuse”. It maintains that the information is stored securely and not made available to the public. “I think we have far too many examples in recent memory of very large, very wealthy corporations that should have extremely good security, somehow releasing or not protecting sufficiently, very significant amounts of data,” Professor Leaver said. “I think we can just look in the last month at Qantas. Trust is a difficult thing — we’re living at a time when the pendulum has swung very much away from implicit trust in big technology platforms. “I don’t think forcing those companies to extract more personal data is the best way to do it.” The eSafety Commissioner was asked how the proposed “age assurance” measure will work when they’re introduced by the end of the year, and what safeguards would be put in place to protect any sensitive information if users have to provide it. In a statement, a spokesperson for the Commissioner said the code and the measures contained in it were formulated in consultation with industry. “Each sector of the online industry has their own role to play under the Codes. Search engines are one of the main gateways available to children for much of the harmful material they may encounter,” the spokesperson said. “The code for this sector is an opportunity to provide very important safeguards. Each industry code is drafted by bodies or associations representing specific sectors of industry, with the work overseen by a steering committee. “Search engines will have to implement age assurance for logged-in account holders, and provide mandatory crisis support messages for users who enter searches on topics such as suicide or self-harm methods.” Further industry codes which cover platforms like app stores, online data storage, instant messaging, and gaming sites are still under consideration by the eSafety Commissioner. Google and Microsoft were contacted for comment. Top five tips to stay safe online from cyber safety educator and former WA Police officer Paul Litherland Trust two-factor authentication “It would be my number one go to is using the two factor authentication where it’s available. Set up your profiles so you receive a code either to your email, or by text message. It adds another layer on top of a password to get into your account.” Protection begins with passwords “You’d be surprised at how many people still have their date of birth, or surname as their password. If you have social media accounts, anyone can really jump on online and see what your date of birth is, what your name is, what your favourite dog is. “Get outside of those habits — have a hard to guess password, whether they’re random generated passwords using a software or creating your own with a mix of numbers, letters of characters.” Check it and change it regularly “Change your password every six or 12 months. It will help really significantly lower the opportunity for a scammer or a software bot to actually guess it.” Leave links alone “Something as simple as receiving a notification or an advertisement through an email address, a lot of people will just click on that link, and it’ll take them to what they would presume would be that particular company’s website. “Don’t click on a link within an email, go to the actual website yourself and then log in if you’re a member, or visit that site directly through a browser.” Be suspicious “Whether you’re 12 or 72, it is always good to be very cautious of trusting our online environments these days. There’s a lot of amazing websites out there now that have been created by scamming syndicates and look legit. They may even look almost identical to real website that you think you’re visiting. It’s all about really checking and investigating. “Always, always have your guard up as often as you can. Often we rush in because of the ease of the internet and how technical things are these days, we sort of tend to rely on our assumptions sadly, and that does get a lot of people caught out.”