John Villasenor on "Preventing Technology-Facilitated Exploitation of Children"

My Brookings colleague John Villasenor, who is also an engineering professor at UCLA, writes in with the following:

Last summer, the International Centre for Missing & Exploited Children and Thomson Reuters asked me to help lead their new Digital Economy Task Force. The DETF, which includes people from government, the private sector, academia, and think tanks, was formed to help address a challenge that any reasonable person would view as vitally important: How can we foster the many benefits that today’s information technologies can offer, while simultaneously preventing those same technologies from being misused to exploit children? Last week, we released the DETF’s report at the National Press Club and then presented it at an event hosted by the Senate Committee on Homeland Security and Governmental Affairs. The report doesn’t claim to offer a magic formula that can promote the beneficial uses of digital technology while simultaneously preventing the harmful uses. What it does offer, however, is a set of over a dozen specific recommendations that can be used to move the dialog forward in a balanced manner. The report recognizes, for example, that tools for conferring digital anonymity have many positive applications, including protecting journalists and dissidents in authoritarian countries. But those same tools can also be used for unlawful purposes. Today, law enforcement has the extremely challenging job of finding the perpetrators of online crimes involving children in an era when the perpetrators are armed with an increasingly sophisticated set of technologies designed specifically to make them hard to locate and identify. The report also addresses financial regulation—both broadly, as well as in the specific context of what are sometimes called “cryptographic” currencies (e.g., bitcoin). Again, it recommends a measured approach, recognizing that heavy-handed regulation can stifle innovation, but that insufficient regulation can be problematic as well. In the coming weeks and months we hope to use this report to help start conversations both in the U.S. and abroad about steps that can help combat online exploitation while also continuing to promote access to the many positive uses of digital technologies.

The introduction to the report in question, which is entitled "The Digital Economy: Potential, Perils, and Promises," opens:

While improving the quality of life for people around the world, advances in digital technology and the growth of the digital economy have also led to a rise in illicit activities including drug trafficking, money laundering, human trafficking, and sexual exploitation of children. Technologies that facilitate online anonymity, such as bulletproof hosting, anonymizing networks, and anonymous payments systems, offer a particular challenge: balancing their use for positive social impact against their potential misuse by those who perpetrate illicit activities. Confronting exploitation and other misuses of digital technology can be effective if it is precisely targeted and methodically carried out. At the same time, these behaviors should be addressed in a broader context that includes consideration of both the unlawful uses, as well as the many benefits of digital technology tools. Combating unlawful uses of online technology must also be balanced to protect the rights and privacy of law-abiding people, and to retain access to the many economic and social benefits afforded by their use. What is Anonymity? In today’s digital age, many online technologies and tools exist to conceal one’s identity, each used for different reasons ranging from protection to evasion. It is crucial to begin by distinguishing between identification, privacy, and anonymity in order to frame a discussion of such technologies and address their potential misuse by those who conduct unlawful activities. Identification occurs when identifiers are collected that provide sufficient assurance of who a person or thing is. The identifiers that are “sufficient” for any given interaction, transaction, or relationship can vary widely depending on context. Many formal and interpersonal interactions are fully “identified;” meaning that the parties know who each other are. Because these interactions are more memorable and important, many people believe that full identification is the norm, but it may not be as strong as they believe. Human interactions with others are often weakly identified, such as recognition of a store clerk only by facial characteristics or gait. These are identifiers that cannot be reliably reproduced should it be necessary to locate that same person in a different setting. Many real-world transactions involve the sharing of few, if any, useful identifiers, thus they are effectively anonymous. Withholding identifiers---that is, maintaining anonymity---is a common and important social practice. People use it to delimit social relationships, such as when a person declines to give a real name or phone number to a stranger who approaches them in public, or when a person provides a fake email address to a website to avoid receiving unwanted e-mails. Along with social and commercial freedom, anonymity is also well recognized as a tool of political freedom. In the United States, the Supreme Court recognized the relationship between anonymity and freedom of speech and association in NAACP v. Alabama. It held that the government could not acquire the membership list of a civil rights advocacy organization as it was likely to have a “…deterrent effect on the free enjoyment of the right to associate…” and it may cause members “…to withdraw from the Association and dissuade others from joining it because of fear of exposure of their beliefs shown through their associations and of the consequences of this exposure.” In 1995, in McIntyre v. Ohio Elections Commission, the Court again expressed support for the role of anonymity in freedom of speech, writing “[u]nder our Constitution, anonymous pamphleteering is not a pernicious, fraudulent practice, but an honorable tradition of advocacy and of dissent. Anonymity is a shield from the tyranny of the majority.” Anonymity Online Many of the same concepts regarding identification and anonymity apply to the online world as well, albeit magnified. It can be easier to track and monitor online activity because records are digital, and can thus be stored, recalled, and processed indefinitely. For good or bad, people can act anonymously, withholding their identifiers that could give others access to them, such as their real name, addresses, fixed email addresses, and fixed Internet Protocol (IP) addresses. There also are a variety of techniques and services designed to preserve online anonymity for people who want it. These are useful for a wide variety of legitimate purposes from general privacy protection, to securing government communications, to protecting journalists and dissidents from oppressive governments. The Onion Router (Tor), based on onion routing technology, helps Internet users retain anonymity. It “was originally developed with the U.S. Navy in mind, for the primary purpose of protecting government communications.” It helps mask the source and destination of Internet data by directing data packets through a series of “relays” in which “no individual relay ever knows the complete path that a data packet has taken.”6 While Tor technology does what it was designed to do, it also can be a tool to mask criminal activity, including crimes against children. Privacy, Anonymity, and Striking the Right Balance Any policy that addresses developing technology must confront the challenge of balancing its possible benefits with its potentially negative consequences. In the wake of recent revelations regarding broad-based monitoring of the Internet, this balance is increasingly difficult. There will likely be new restrictions on law enforcement that will push cybercriminals, including those who prey upon children, into the even-deeper web, including alternative darknets and private networks making law enforcement’s job even more challenging. Law enforcement leaders worldwide argue that policymakers must examine and discuss the difference between privacy and anonymity. In many countries, law enforcement believe that citizens have a right to privacy, but they also believe that there are exceptions based upon a lawful reason to penetrate that right. Privacy is clearly a close cousin to anonymity. Yet one can be a robust believer in the importance of privacy rights while also understanding that anonymity is a double-edged sword. Anonymity can be misused to sell drugs online, plot a terrorist attack, launder money, or to produce and trade in child exploitation images. In her “Remarks on Internet Freedom” at the Newseum in Washington, D.C. in January 2010, former U.S. Secretary of State Hillary Clinton said, “On the one hand, anonymity protects the exploitation of children. And on the other hand, anonymity protects the free expression of opposition to repressive governments.” Secretary Clinton added: "We must grapple with the issue of anonymous speech. Those who use the internet to recruit terrorists or distribute stolen intellectual property cannot divorce their online actions from their real world identities. But these challenges must not become an excuse for governments to systematically violate the rights and privacy of those who use the internet for peaceful political purposes.” She continued, “None of this will be easy…But I think these overriding principles should be our guiding light. We should err on the side of openness and do everything possible to create that, recognizing, as with any rule or any statement of principle, there are going to be exceptions.” This sentiment, to err on the side of openness while allowing limited exceptions, offers a valid guiding principle for any effort to combat child sexual exploitation online.