I was once told that there are two things in life that you should never watch being made: laws and sausages. Either one tends to make people sick to their stomach. I've made sausages before, but everytime I get political, I usually get mad at myself afterwards. But I need to say something about this.
This story has started to make the rounds. I remember when it was first brought up on the
PLUG and
SLLUG mailing lists. It hit the local news in Utah, and finally found its way to
ArsTechnica. It seems that every time I hear something new about HB 139, I wonder if people are actually paying attention. In particular, I wonder if
Ralph Yarro, one of the bill's biggest proponents, has actually read the bill.
First of all, the basics.
House Bill 139 was proposed by Representative
Brad Daw, from Orem, UT. Its intent was to keep children safe from Internet Pornography. This is an intention that I think is good, and as an intention, I fully support it. But as the saying goes, the road to hell is paved with good intentions.
Here is the basic breakdown (from the bill itself):
12 Highlighted Provisions:
13 This bill:
14 < makes it a violation of Title 13, Chapter 11, Utah Consumer Sales Practices Act, to
15 sell a device capable of wirelessly accessing the Internet without labeling the device
16 to reflect that fact;
17 < defines terms;
18 < requires a person maintaining a public wireless network to attempt to restrict access
19 to a minor;
20 < provides for a civil penalty against a person who does not restrict access to a public
21 wireless network if a minor accesses material harmful to minors through that
22 network; and
23 < provides for enforcement by the Division of Consumer Protection.
I'm going to start with lines 14 through 16. Daw wants to make it illegal to sell a Wi-Fi device in Utah that doesn't not specify that it is a Wi-Fi device. I ask you: when was the last time you bought a wireless-capable device that did not already specify this? It's called marketing, or even better, advertising. I can't say I really disagree with this part because every wireless manufacturer that I know of already complies with this. It's how they sell their products. It's a worthless provision, but I don't currently see it causing any harm.
Line 17 is obvious. Lines 18 and 19 require people to apply security to their wireless networks. Lines 20 through 23, it would seem, say that if you don't secure your wireless network and a minor uses it to access pornography, then you can get fined or spend some time in jail... even if you didn't know that you needed to do so, or know how to do so.
Forgetting for the moment the obvious questions of how enforceable this actually is, the gist of this is that if you know enough to plug in a wireless access point of some sort, you should know everything there is to know about securing it, and if you screw up and some kid breaks into your network (intentionally or accidentally), then you are legally liable. Ralph Yarro thinks that this is a fine alternative, telling the Salt Lake Tribune that people "should be responsible for their barking dogs and their Internet access."
This is when I would like to point out another section of the bill:
63 13-46-201. Restricting access to wireless network.
64 (1) A person may not provide wireless Internet access to the public unless the person
65 restricts access to prevent a minor from accessing material harmful to minors.
66 (2) A person who fails to utilize measures designed to restrict access to prevent a minor
67 from accessing material harmful to minors violates this chapter if a minor accesses material
68 harmful to minors.
69 (3) This section does not apply to a person who maintains a wireless network within
70 the person's private residence to provide personal wireless Internet access.
In particular, I would like to point out lines 69 and 70, which state that whether or not people at home are responsible for barking dogs, they are not legally responsible for their Internet access. Ralph, are you listening? No, I didn't think so. You're off in your own little world, as usual.
This bill does still apply to businesses who decide to run a public network. Obviously, it is in the best interest of several businesses to offer services like these to attract customers. In particular, coffee shops and other restaurants will offer free Wi-Fi access to customers, in the hopes that those customers will buy enough consumables to offset the cost of the access. Hotels are another entity that offer Wi-Fi so that potential guests will be pursueded to spend X number of nights sleeping there at a cost of Y number of dollars a night. Business travellers in particular often have a need to stay connected inside their hotel room. Let's not also forget business such as training centers that offer free Wi-Fi to students who may be taking a week-long training seminar while their employer is requiring them to still perform their regular job duties from inside that training center.
I stay at a lot of hotels. I spend a lot of time teaching classes with students who are required to divide their time between me and their day job. These are factors that I face on a regular basis. This week I'm teaching a class in Mountain View, California. The training center that I am at doesn't bother to provide their own Wi-Fi because this is also the hometown of Google, who has apparently blanketed much of the town with their own free Wi-Fi. Enforcing such a law in this area would add costs that would likely make these productivity assets financially unfeasible. I question whether Daw or Yarro have ever considered these variables. Then again, I often wonder whether Yarro has considered pursuing anything other than fear, uncertainty and doubt.
What kinds of restrictions would businesses be required to add to their public networks? Let's take another look at the bill:
54 (4) "Restrict access" means to use a reasonable method for ascertaining the age of a
55 person using wireless Internet access or preventing the display of material harmful to minors
56 over the wireless local area network, including:
57 (a) visually inspecting a government-issued identification document; or
58 (b) requiring the provision of a valid credit card number.
Are both (a) and (b) required? I'm not sure. Let me tackle them one at a time. With (a), a business could create temporary (or permanent) access codes for a customer if that customer can show them a drivers license, passport, etc. I'm sure there are other methods available. All of them would require special software, possibly even separate hardware to run that software, and competant installation and configuration of both. All employees that dealt with access codes would need be to trained, which would constitute additional costs. And if something fell through the cracks, and some kid still got through, it might mean the end of the business.
Kids aren't stupid. If you think they can't get into things that they're not supposed to, then you're an idiot. Some will even get in without knowing that they're not supposed to. Many will intentionally get into things just because they know they're not supposed to, not even caring why they're not supposed to.
Kids are also not technologically stupid. Schools are teaching more about computers and technology than ever before. Even if they weren't, kids are being exposed to more technological advances than ever before. I have often joked that my own kids may very well be able to compromise any computer security I set before them by the time they hit third grade. Few things would make me more proud than if they were to accomplish such things at such a young age, and fewer things still frighten me more.
As for (b): credit card verification? How hard is it for little Johnny to sneak into dad's room and write down a credit card number? Like it or not, it happens all the time. In fact, kids stealing their parents credit card numbers is the least of my concerns. Other people stealing credit card numbers is what worries me the most. Every time I hand my credit card number to sombody, I risk them stealing it. It's one thing to buy a piece of hardware from my favorite online store. I've bought from them before, and I think they can be trusted. It's another thing to give somebody my credit card just to prove my age. How are they verifying that I've given them a real number? What's to stop them from storing my credit card number away someplace? Even if they only have the best of intentions in mind, how do I know that their database of credit card numbers won't be hacked? I still remember getting a letter from Visa years ago telling me that my credit card number, along with thousands of others, had been stolen from a popular online store, and that they had immediately cancelled my current card and were sending me a new one. Fortunately, nothing was charged to my card, but the danger was still there, and I had no idea. "Identify theft" has become a household phrase for a reason.
There is another issue that I would like to go back to:
69 (3) This section does not apply to a person who maintains a wireless network within
70 the person's private residence to provide personal wireless Internet access.
How many kids do you think are walking through downtown Salt Lake with their wireless devices, hacking into wireless coffee shop networks and downloading pornography? I think the bigger concern is a kid accidentally or intentionally getting access to a neighbor's network and downloading porn. It's easy to do, and it's hard to catch people who do it. Those who have configured wireless routers and access points also know that configuration is neither simple nor easy. They may also realize that the default security level is almost always the least secure. Fortunately for them, the manufacturer's inability to provide user-friendly security interfaces will not land them in jail for the night. Unfortunately, it also doesn't solve anything.
I'm going to guess that the people involved in this law process hasn't spent much time in the realm of troubleshooting. There is a fundamental principle that I teach my students week after week: address causes, not symptoms. If you address the cause, then the symptoms will be much easier to deal with, if they don't just go away by themselves. Taking care of the cause also tends to keep the symptoms from coming back. If you only address the symptoms, they may go away or they may come back, but they certainly won't stop other symptoms from popping up.
This law only addresses symptoms. It seems to do so haphazardly, as if the writer were playing buzzword bingo, pulling random pieces of seemingly related knowledge together into a patchy mess that was then proposed as law. Fortunately, Representative Daw has received a barrage of emails from various concerned local technology experts warning him of his errors, and he seems to be open to correcting his mistakes. Time will tell whether he can properly rewrite the law, or scrap it in favor of a proper solution.
What would be a proper solution? The same thing it's always been: education. Parents need to know how the technology works so that they can be more prepared to guide and protect their child from the dangers inherent in it. Children need to be made aware of the dangers that they can be getting themselves into. However the parents themselves become educated, it's up to them to provide the education needed by their children. This is commonly known as "The Talk".
The Talk is a bit of a misnomer though. It implies that when the child is ready, Mom and/or Dad will sit down with them and explain to them the facts of life in one little conversation which will prepare the child for certain matters of the world. I don't personally believe that there should only be one Talk, and I don't believe most parents do either. Most parents also dread these talks, and understandably so. Few things have a larger impact on a person's life than how they handle matters of sexual responsibility. It is for this reason alone that these talks are both terrifying and crucial.
There are tools that parents can use to protect their children. The famed V-Chip is one of these tools. Movie ratings are another. Neither should supplant parental responsibility. The things that a ratings panel have decided are safe or unsafe for certain audiences rarely reflect personal beliefs exactly, or even closely enough to be taken seriously. To think that restricting technological advances based solely on misunderstandings of how those things can be used or misused is not only erroneous, but also as potentially fatal to the progress of a society as those things that those restrictions are meant to protect against.
There may be little, if anything, that we can do to stop the biggest cause of our problems: the smut peddlers, the predators, the perverted. Even if we could stop them, it wouldn't be the only thing we would have to solve. The possibility of our children stumbling upon something dangerous would still exist. Education is still key, no matter what. Taking responsibility for educating ourselves and our children is our duty. Ultimately, we cannot control what our children do, we can only guide them. But if our failure to address this duty causes them harm, even through their own actions, then we as parents share that part of the blame.
The implementation of a law which does not address causes, and in fact barely addresses symptoms, does not relieve us our our duties. In fact, even a properly-written law that was built out of good intentions and well-researched information does not relieve us of our duties. Laws don't solve all of our problems, and in cases such as these, they do nothing but cause more problems.
Before lawmakers start trying to put together rules and regulations to supposedly keep our children safe, they need to do all of their homework. They need to research the applicable technology, and talk to experts who have a far greater understanding of it than they do. Rather than taking advice from the old chairman of a failing technology company that has managed to lose most if not all respect from its industry thanks in large part to poor leadership, lawmakers need to locate actual experts and question them as open-mindedly as possible. It may be decided that no version of this bill will ever address the real causes, which is what I personally suspect. If that is the case, I certainly hope that the lawmakers will have the good sense to swallow their pride and focus their attention on more appropriate venues. More rests on this than I think any of us know.