Then the Covid Vaccine Pass, Now the Digital Pass

Another attempt at mass surveillance in Europe. Or: how protecting the youngest may open the door to broader social control — even when wrapped in good intentions.

© Commission européenne

Ursula von der Leyen has announced the launch of a universal, anonymous application — or so we are told. This European solution aims to restrict minors’ access to sensitive online content through a tool based on zero-knowledge proof cryptography — ZK proof. The technology would theoretically allow users to verify their age without sharing any personal data with platforms.

One thing is glaringly obvious: on this particular front — protecting children and teenagers in their online activities, and combating child sexual abuse material and other harmful content — Brussels has stumbled from failure to failure. Predictable failures, it must be said.

Need a reminder? Look no further than the collapse of Chat Control in its first iteration — the proposed regulation that would have compelled platforms to scan all communications, public and private alike, without exception.

[ Analyse ] Chat Control... chat perché

Let us also recall the resounding success of forcing platforms — pornographic websites in particular — to verify the age of their users. That measure, adopted by a whole string of countries, ran headlong into the platforms themselves, who were not exactly cooperative, triggering a wave of legal battles and, as a neat side effect, a spectacular surge in VPN usage wherever the restrictions were actually enforced.

In short, the will to regulate and legislate is there — but turning that will into practice is quite another matter, one that shatters against a whole array of obstacles, technical and legal ones first and foremost.

Consider: the European Parliament adopted a resolution calling for a minimum age of 16 to access social media — without, for all that, proposing any concrete mechanism to actually compel platforms or users to comply. And countless countries have road-tested all manner of solutions, with precious little to show for it.

The application announced by the European Commission — which is nothing more than a digital pass lifted straight from the Covid health pass playbook — now enters the scene. It presents itself as a third way for the Commission and member states to sidestep the pitfalls and the accusations of mass surveillance, without having to rely on platforms that refuse to play ball. France has already announced plans to fold it into its national digital identity wallet — which tells you everything about where Macron’s France stands on civil liberties.

With this app, the burden is neatly reversed. It will now fall on the adult user to prove their good faith by feeding an identity document into the application. That document is then verified against the issuing authority — the state, via its database or electronic chip — and validated through a real-time photo or video of the user’s face. “If everything checks out, the app retains only proof of majority and does not store identity data. It generates a QR code granting access to adult content,” Le Point reports.

Never mind that no IT system is hacker proof — and this application is no exception. Security enhancements notwithstanding, it took all of two minutes to crack it open.

Set aside, too, the fact that the system can equally be circumvented by a VPN — services that France is apparently moving to ban, as suggested by the hastily retracted remarks of Anne Le Hénanff, the minister for Artificial Intelligence and Digital Affairs, on France Info on January 30th.

But the problem doesn’t stop there.

The Temptation of Social Control, European-Style

The system promises not to transmit the user’s identity to platforms. No name, no date of birth, no photograph. That is the anonymity Ursula von der Leyen is selling. What the Commission president’s communications are rather less forthcoming about is not so much what the platforms don’t receive — but what those who designed and control the architecture of such a system, namely the states and national authorities, get to keep.

Because yes — the anonymity on offer is anonymity from Big Tech alone.

Beyond the sovereign identity data it already holds, the state, under this system, is in a position to know how many age certificates have been requested. In theory, not which sites were visited. Unless, of course, it cross-references its data with that of the platforms. And we have seen, with the DSA, just how flexible Big Tech can be on that front when pushed.

The risk is not merely one of increased state surveillance or tracking in the context of judicial investigations. It is the risk of something more insidious: the normalization of surveillance. See Italy’s deployment of a digital pass to move around during the Olympic Games. The risk lives also in the chilling effect on freedom of expression and access to information. And that says nothing of the cybersecurity vulnerabilities that a system as centralized as the EU Wallet inevitably courts.

None of this is paranoia. It is a structural risk — recognized and flagged by a broad consensus of cybersecurity experts, most of whom agree that age verification is not the solution. It is, in fact, as ineffective as it is dangerous, carrying the very real prospect that this age-verification tool is progressively repurposed and extended to other uses.

There is nothing conspiratorial about saying so. The European Commission states it plainly: “the solution is designed to be scalable and extend to other age groups (e.g. 14 and above or 65 and above), subject to the availability of appropriate registration modalities.”

A digital pass to shield children from adult content? Or a foot in the door toward broader social control? Protecting the most vulnerable is a noble aim, to be sure. But this is a slippery slope — and we are already on it.

The European Court of Justice, whose rulings carry the force of law, strictly prohibits mass surveillance. That is what is really at stake since 9/11. What the United States is pushing for — ramming through, with little regard for anyone's freedom of speech — is mass surveillance in Europe built on the same premises as in the US, along with the wholesale transfer of all data. The end of privacy, say what you will.