AGE VERIFICATION PROGRAM SPURS CONTROVERSY

- by Connie McMahon

An issue that enjoys near universal support among Second Life residents has become a source of contention and controversy following Linden Lab’s announcement that a new age verification program was in beta test and would be implemented “in mid-May”. The announcement, posted to the Second Life blog on May 4th, generated an immediate and mostly negative response. A follow-up and clarification posted by Linden Lab on May 7th did little to allay the concerns of residents and quickly generated more than 130 responses and comments. Negative comments outnumbered positive ones by about 8::1.

According to the postings (which can still be read on the blog at http://blog.secondlife.com/2007/05/07/more-on-identity-verification/), the program is intended to restrict access to “adult” parcels by minors. Linden defines “adult” as anything “overtly, graphically, or explicitly sexual in nature or intensely violent” and took pains to point out that the restriction did not apply en masse to whole regions rated “mature”. According to Linden, “Linden Lab is committed to enabling the safest and most enjoyable experience possible in Second Life. The introduction of age and identity provides Residents with new tools to determine how they interact with the world, how the content they create is accessed, and allow for a new level of trust within in-world relationships. Credit cards do not provide an adequate means of age and identity verification, making real and robust age and identity verification vital.” Linden Lab did not respond to requests for comment on why this issue had suddenly become such a high priority.

Details of the plan include payment of a one time fee and submission of the required personal information to a third party verification service by any that resident who wishes to enjoy continued access to all areas of Second Life, including those designated “adult”. According to Daniel and Jeska Linden, “Though there may be variation from country to country, in the United States verification will require a name, address, date of birth, and the last four digits of a Social Security Number. Internationally, most Residents will be asked for a name, address, date of birth, and a passport or national ID number. Our verification provider, Integrity Services, will only use information to provide a match code. The information provided will ONLY be used to verify identity; it will not be sold or shared.”

Most of the concerns and objections expressed were related to the submission of detailed personal information such as Social Security and Passport numbers to Integrity Services via the internet. Since 2005 there have been numerous high profile instances of supposedly highly secure US companies and government agencies losing data on customer accounts and personal information. The US Veteran’s Administration alone lost control of over 26 million account profiles, including Social Security and identity information. Other companies reporting the theft or loss of customer information (including names, addresses, Social Security and credit card numbers) include such familiar names as CitiGroup, Wachovia, JP Morgan Chase, Fidelity Investments and Deutsche Bank. Bank of America lost similar data impacting over 2 million customers in three separate incidents, including one where data management had been outsourced to a supposedly secure third party. Many residents questioned Linden Lab’s ability to guarantee the security of such highly personal data in view of the sort of conspicuous failures cited above. The Social Security Administration specifically cautions against providing your SSN, stating on its web site that “You should treat your SSN as confidential information and avoid giving it out unnecessarily. Giving your number is voluntary, even if asked for it directly.” Linden Lab notes that only the last four digits of SSN will be required and that verification is voluntary. But that is the same information used by many banks to allow customer account access, and failing to volunteer will result in account access being restricted. Similar concerns exist in other countries regarding the disclosure of passport or national ID numbers to a private US firm.

Other resident concerns included the amount of the fee to be charged, the potential negative impact on many SL business owners, conflicting national and local laws and regulations, the exact interpretation of “adult” and the choice of Integrity Services as the verification agent.
Integrity’s parent company, Aristotle International, compiles and sells voter lists and demographic information to political parties, PACs, fund raising operations, etc.

The requirement of SSN and Date of Birth, while not unusual, is no longer industry best practice. Verification companies such as IDology and ChoicePoint have dispensed with the SSN requirement entirely in favor of logic routines that will assume, for example, that if you hold a mortgage, own a business or work in certain professions (Doctor, Attorney, etc) that you are over 18 years old. The focus of these organizations is simply to reliably establish whether an individual is an adult or a minor. Linden Lab refers to the program alternatively as “age” verification and “identity” verification. The blog states that only “a match code” will be returned but they declined to respond to questions regarding exactly what the code would signify.

Residents wishing to learn more about the age verification program should consult the post and comments on the blog. Further expressions of concern will have to be sent to Linden Lab via email as the blog is now closed to further comment.