News Round-Up: After COVID Pass, EU Age App; UK Youth Silenced on Politics; Kazakhstan Goes Palm Biometrics
Twice a week, the editorial team of Freedom Research compiles a round-up of news that caught our eye – or what felt like under-reported aspects of news deserving more attention.
Over the past few days, the following topics attracted our attention:
Following COVID Pass: EU Rolls out Age Verification App
Cancel Culture Silences British Youth on Politics
Kazakhstan To Introduce Palm Biometrics in Banking
Following COVID Pass: EU Rolls Out Age Verification App
The European Commission has long promoted age verification as the main solution for ensuring the safety of minors online and protecting them from the mental health risks posed by social media. On April 15, European Commission President Ursula von der Leyen announced that the EU’s digital age verification app is ready and will soon be rolled out, reports Politico. “We are holding accountable those online platforms that do not protect our kids enough. The new age verification solution and the enforcement of our rules go hand in hand,” said von der Leyen. But critics argue that such an app will lead not to the protection of children, but rather to censorship and the silencing of “inappropriate” people.
Age verification technology is promoted as a way for people to verify their age online using a government-approved and certified system. EU officials claim that citizens’ privacy and personal data are safeguarded in the system. The Commission began testing the age verification app last August, and the app is designed to work with the digital wallet solution.
Notably, in the press release, President von der Leyen drew a parallel between the COVID-19 pandemic and the so-called vaccine passport introduced then. Thus, von der Leyen emphasizes that the age verification app is not the first time the Commission has proposed an innovative solution to a new problem. “We all remember the COVID-19 pandemic. Our world came to a complete standstill. But as we emerged from lockdowns and as vaccines became available, the Commission developed the COVID app in record time—three months—to help bring us back to normal life in a safe way. By scanning our COVID certificates, we could attend a concert or board a plane to travel again, and so on. Seventy-eight countries across four continents used this app, so it was a huge success. And now we have taken this success and applied it to the age verification app. It follows the same principles, the same model,” von der Leyen explained.
Von der Leyen also emphasized that, like the vaccine passport, the age verification app is user-friendly. Citizens must download the app and set it up using their passport or ID card. Then they can verify their age on web platforms without disclosing any other personal data. “Put simply, it is completely anonymous: users cannot be tracked. Third, the app works on any device – phone, tablet, computer, you name it. And, finally, it is fully open source – everyone can check the code. This means that our partner countries can also use it. It is very important that this can be used by our global partners,” von der Leyen said. Thus, web platforms will no longer have excuses for failing to verify age for technological or other reasons. Instead, she suggested, Europe is offering a free solution to everyone, meaning the Commission no longer has to tolerate any company that “does not respect our children’s rights.”
However, hundreds of security and privacy researchers recently signed a document with opposite conclusions. They warned against a social media ban and the accompanying age verification, arguing that it may lead to censorship and the silencing of “inappropriate” people without solving any problems. The signatories say it is unclear how widespread age verification will affect security, privacy, and people’s freedom and autonomy – in other words, the researchers’ views are in direct contradiction to the European Commission President’s claims.
The first few days of the age verification app have already revealed serious security flaws. Security researcher Paul Moore demonstrated that the app can be hacked in under two minutes. During setup, users create a PIN, which the app encrypts and stores in a shared preferences file. However, an attacker with an access to the device’s filesystem can simply delete the encrypted PIN values, restart the app, choose a new PIN, and then present the original user’s credentials as valid. Moore warns that this design makes a major breach “just a matter of time.” (See also here, here.)
Cancel Culture Silences British Youth on Politics
A survey by the Economist Educational Foundation has found that 22% of 15–17-year-olds and 19% of 10–14-year-olds in the United Kingdom are reluctant to express their political opinions because they fear criticism and cancellation. In addition, 23% of more than 4,000 students aged 10–17 who took part in the survey said they had been asked not to express political views at school, according to Sky News.
Tiffany Smyly, chief growth officer at the Economist Educational Foundation, said: “If teenagers are worried about being cancelled, then they are not going to be sharing their viewpoints at school or with friends.” She warned that fear of cancellation and criticism is pushing teenagers towards “extreme” communities, chat rooms, and forums where they can then express themselves more freely. However, views in these spaces may become even more polarised. Smyly believes efforts should instead focus on channelling young people’s political interest in a more positive and constructive direction. The study also showed that young people’s main concerns are the cost of living and healthcare.
In addition, 44% of 15–17-year-olds said they do not feel prepared to vote in the next election. The UK government announced last year that it plans to lower the voting age to 16, enfranchising 9.5 million more people. While many are curious about politics, two-thirds of 15–17-year-olds admitted they would feel more confident about voting if they knew more about different political views and policies.
Kazakhstan To Introduce Palm Biometrics in Banking
The National Bank of Kazakhstan and the Agency for the Regulation and Development of the Financial Market (ARDFM) have approved new rules governing how financial institutions must identify customers using biometric data. In addition to facial recognition, citizens can now be identified using palm biometrics, Biometric Update reports.
Kazakhstan has approved new rules requiring the use of biometric identification, including palm prints, for logging into banking apps, opening accounts, initial registration for digital banking, high-risk financial transactions, loans, and issuing electronic digital signatures.
The new biometric solution introduces palm-print authentication. In addition to the biometric data already known to the state – such as fingerprints, facial features, and iris scans – citizens must also provide a palm print that includes both the surface pattern and the vein pattern of the palm. Financial institutions must use special hardware or security terminals for palm verification, and citizens are limited to only three attempts when verifying their identity. A 95% match is required for successful authentication. If palm-based identity verification fails, the next step is to use facial biometrics. All authentication attempts are recorded and stored for at least five years in both the national system and the financial institution – even if the customer relationship with the respective bank ends.
Under the new system, banks connect to the national central system and do not store citizens’ biometric data themselves. In other words, the bank establishes a connection to the national systems for each authentication. Citizens’ biometric data is collected via video or a scanner and then transmitted to the national system.
In line with the new regulations, palm-based payment systems are already becoming increasingly popular in Kazakhstan’s retail and service sectors. Such a payment solution links the user’s biometric signature directly to their bank account, enabling payments without cards, phones, or cash.