8 ms·

generally I agree, but I can understand why they did it. If they're accused of allowing underage models they'll be in a spot they definitely don't want to be i

generally I agree, but I can understand why they did it. If they're accused of allowing underage models they'll be in a spot they definitely don't want to be in. There was a case years ago of a man who was on trial for child porn. It took the actress physically coming into the courtroom and showing her ID before the case was dropped. It's just a really scary place to be in terms of society and the law, so I can understand making the decision to do the 'wrong' thing in this instance.

pavel_lishin 7y ago
If you're sufficiently paranoid to want to hold onto this data, it should at least be kept in cold storage. And it's not expensive; I can walk over to Best Buy right now and pick up a hard drive big enough to store this data with cash I happen to have in my wallet.
- celticmusic 7y ago
  that's a fair point. I'm not saying they didn't make mistakes, just that I understand why they held onto the ID's in this case.
- miohtama 7y ago
  Also data retention policy: automatically purge old data when it is no longer actively being accessed
  - commandlinefan 7y ago
    Well, no - this data could be relevant ten years from now, if they’re accused of allowing an underage model after the fact. They need this data to protect themselves, and they need to have it accessible for the rest of their lives.
    - zerkten 7y ago
      Isn't there a better solution involving offline storage? Keeping the data online is likely exposing it to insider threats as well.
    - eberkund 7y ago
      Isn't there a statuate of limitations?
      - deleted 7y ago
        [deleted]
      - peterwwillis 7y ago
        There are many, but capital offenses have no limitation, and there are many potential capital offenses. However, that shouldn't really be an issue here, because any business can commit a capital offense, but we don't require every business to record every bit of information about everything they do in perpetuity just because they might commit a capital offense one day. Innocent until proven guilty.
      - dragonwriter 7y ago
        I think that there is a limit on the required period of record retention but I keep failing to find it. But I don't think it is short, and it at least extends as long as you are selling the material to which it relates, since it is expressly illegal to sell depictions without the records.
    - enraged_camel 7y ago
      This is quite incorrect. Most jurisdictions have record retention policies that explicitly state that you're allowed to dispose records after a certain period of time (usually based on record type). After that, even if the record would be relevant to a case, you cannot be held liable for having disposed of it. source: i work in this field
      - deleted 7y ago
        [deleted]
  - clinta 7y ago
    If the data is to protect yourself against criminal accusations, there's not really a time limit after which data can be safely purged. They could be accused many years after the fact.
    - JackFr 7y ago
      Often the law that stipulates you need the record, also stipulates how long you need it. Good data hygiene is to retain in it for as long as necessary, and no longer.
      - ComputerGuru 7y ago
        It does not. They use old footage of models indefinitely and can be accused at any time of distributing such materials even after they’ve stopped distributing it when clients are found in possession.
- tmpz22 7y ago
  There could be a regulatory requirement that law enforcement must have automated access to the resource at any time. Wouldn't be the first time the Government build a road to hell with good intentions.
  - londons_explore 7y ago
    It's very rare law enforcement requires (by law) a realtime, self-service access to information. Companies just choose to give them realtime access because they charge an admin fee for data access, and if it's realtime, they'll earn more.
- dragonwriter 7y ago
  > right now and pick up a hard drive big enough to store this data with cash I happen to have in my wallet. You do know that the legal recordkeeping requirements mandate specific indexing and cross-referencing requirements, and that the age records must legally include copies of portions of every covered piece of media sufficient to identify the performer against the photos in the age recors, and also must include cross-reference to every individual full work. If your media is live streamed, it doesn't seem to me likely that you could meet the requirements with an offline system.
  - sadfklsjlkjwt 7y ago
    > If your media is live streamed, it doesn't seem to me likely that you could meet the requirements with an offline system. You store all the PII offline and assign each performer a unique identifier. Then tag each stream with the unique identifier. Why would that not work?
    - dragonwriter 7y ago
      > Why would that not work? It would work if the law is applied on such a way that the list of media retrieved by querying using the performer ID on the media server is acceptable as the listing of depictions that is required to be part of the age verification records. It's pretty clear in the combination of statute and regulation that either hardcopy or digital records can be used, but it's not at all obvious that a hybrid of that particular form satisfied the requirements. From an information management perspective, I can see it making sense; from what I've seen of administration of legal rules I can see where it might not be. Especially in an industry that politicians (and lead US federal prosecutors are all a brand of politicians) like to score points against, I would expect people to be extremely conservative about uncertain legal exposure; you don't want a setup where you have a decent but uncertain argument of it goes to court, you want one that would never give anyone a reason to think it was a viable pretext for legal action against you in the first place.
  - watwut 7y ago
    It is not that difficult to achieve with documents, actually.
deleted 7y ago
[deleted]
elorant 7y ago
In which case they should encrypt the data and store it at an offline server.
TallGuyShort 7y ago
That sounds like a case of guilty-until-proven-innocent, unless he was required to keep records like porn producers are.
idclip 7y ago
Welll, i wouldnt keep it on a system on the web. This belongs in cold storage in their legal dept.
droithomme 7y ago
That data needs to be in a filing cabinet in case law enforcement are investigating accusations of a crime, likely with a warrant. There's absolutely no reason to be keeping such incredibly sensitive information, which presents a severe risk to the person's livelihood and life, on a public facing server because no one - absolutely no one - has any reason to be querying it from the public internet.
ComputerGuru 7y ago
The actress had to fly from Spain to the United States to testify all because an “expert” said she appeared to be a minor in the material in question, iirc.
C14L 7y ago
Encrypt each data set with a public key. Have the private key in a bank safe. That way, if they need it as proof, they can just decrypt the data set. But if the data is stolen, it is of no use for the attacker.
bsder 7y ago
And people went to jail for the Traci Lords fiasco in which she was the one who faked all her ID documents.
- dragonwriter 7y ago
  Note that compliance with the age verification laws is required, but does not (even now: they didn't exist at the time of the Traci Lords incident) give you “safe harbor” from laws criminalizing sex with minors, child pornography, etc. Not all of the applicable laws require knowing that the minor is a minor for a violation to occur.
  - RHSeeger 7y ago
    Not all the laws require the person actually be a minor either. Or the person to actually exist.
tracker1 7y ago
Some implementations and interpretations (iirc, Great Britain for one) don't even require that the person is a minor, only the appearance and illusion of, including animation/illustration.

pavel_lishin 7y ago

If you're sufficiently paranoid to want to hold onto this data, it should at least be kept in cold storage. And it's not expensive; I can walk over to Best Buy right now and pick up a hard drive big enough to store this data with cash I happen to have in my wallet.

celticmusic 7y ago
that's a fair point. I'm not saying they didn't make mistakes, just that I understand why they held onto the ID's in this case.
miohtama 7y ago
Also data retention policy: automatically purge old data when it is no longer actively being accessed
- commandlinefan 7y ago
  Well, no - this data could be relevant ten years from now, if they’re accused of allowing an underage model after the fact. They need this data to protect themselves, and they need to have it accessible for the rest of their lives.
  - zerkten 7y ago
    Isn't there a better solution involving offline storage? Keeping the data online is likely exposing it to insider threats as well.
  - eberkund 7y ago
    Isn't there a statuate of limitations?
    - deleted 7y ago
      [deleted]
    - peterwwillis 7y ago
      There are many, but capital offenses have no limitation, and there are many potential capital offenses. However, that shouldn't really be an issue here, because any business can commit a capital offense, but we don't require every business to record every bit of information about everything they do in perpetuity just because they might commit a capital offense one day. Innocent until proven guilty.
    - dragonwriter 7y ago
      I think that there is a limit on the required period of record retention but I keep failing to find it. But I don't think it is short, and it at least extends as long as you are selling the material to which it relates, since it is expressly illegal to sell depictions without the records.
  - enraged_camel 7y ago
    This is quite incorrect. Most jurisdictions have record retention policies that explicitly state that you're allowed to dispose records after a certain period of time (usually based on record type). After that, even if the record would be relevant to a case, you cannot be held liable for having disposed of it. source: i work in this field
    - deleted 7y ago
      [deleted]
- clinta 7y ago
  If the data is to protect yourself against criminal accusations, there's not really a time limit after which data can be safely purged. They could be accused many years after the fact.
  - JackFr 7y ago
    Often the law that stipulates you need the record, also stipulates how long you need it. Good data hygiene is to retain in it for as long as necessary, and no longer.
    - ComputerGuru 7y ago
      It does not. They use old footage of models indefinitely and can be accused at any time of distributing such materials even after they’ve stopped distributing it when clients are found in possession.
tmpz22 7y ago
There could be a regulatory requirement that law enforcement must have automated access to the resource at any time. Wouldn't be the first time the Government build a road to hell with good intentions.
- londons_explore 7y ago
  It's very rare law enforcement requires (by law) a realtime, self-service access to information. Companies just choose to give them realtime access because they charge an admin fee for data access, and if it's realtime, they'll earn more.
dragonwriter 7y ago
> right now and pick up a hard drive big enough to store this data with cash I happen to have in my wallet. You do know that the legal recordkeeping requirements mandate specific indexing and cross-referencing requirements, and that the age records must legally include copies of portions of every covered piece of media sufficient to identify the performer against the photos in the age recors, and also must include cross-reference to every individual full work. If your media is live streamed, it doesn't seem to me likely that you could meet the requirements with an offline system.
- sadfklsjlkjwt 7y ago
  > If your media is live streamed, it doesn't seem to me likely that you could meet the requirements with an offline system. You store all the PII offline and assign each performer a unique identifier. Then tag each stream with the unique identifier. Why would that not work?
  - dragonwriter 7y ago
    > Why would that not work? It would work if the law is applied on such a way that the list of media retrieved by querying using the performer ID on the media server is acceptable as the listing of depictions that is required to be part of the age verification records. It's pretty clear in the combination of statute and regulation that either hardcopy or digital records can be used, but it's not at all obvious that a hybrid of that particular form satisfied the requirements. From an information management perspective, I can see it making sense; from what I've seen of administration of legal rules I can see where it might not be. Especially in an industry that politicians (and lead US federal prosecutors are all a brand of politicians) like to score points against, I would expect people to be extremely conservative about uncertain legal exposure; you don't want a setup where you have a decent but uncertain argument of it goes to court, you want one that would never give anyone a reason to think it was a viable pretext for legal action against you in the first place.
- watwut 7y ago
  It is not that difficult to achieve with documents, actually.

deleted 7y ago

[deleted]

elorant 7y ago

In which case they should encrypt the data and store it at an offline server.

TallGuyShort 7y ago

That sounds like a case of guilty-until-proven-innocent, unless he was required to keep records like porn producers are.

idclip 7y ago

Welll, i wouldnt keep it on a system on the web. This belongs in cold storage in their legal dept.

droithomme 7y ago

That data needs to be in a filing cabinet in case law enforcement are investigating accusations of a crime, likely with a warrant. There's absolutely no reason to be keeping such incredibly sensitive information, which presents a severe risk to the person's livelihood and life, on a public facing server because no one - absolutely no one - has any reason to be querying it from the public internet.

ComputerGuru 7y ago

The actress had to fly from Spain to the United States to testify all because an “expert” said she appeared to be a minor in the material in question, iirc.

C14L 7y ago

Encrypt each data set with a public key. Have the private key in a bank safe. That way, if they need it as proof, they can just decrypt the data set. But if the data is stolen, it is of no use for the attacker.

bsder 7y ago

And people went to jail for the Traci Lords fiasco in which she was the one who faked all her ID documents.

dragonwriter 7y ago
Note that compliance with the age verification laws is required, but does not (even now: they didn't exist at the time of the Traci Lords incident) give you “safe harbor” from laws criminalizing sex with minors, child pornography, etc. Not all of the applicable laws require knowing that the minor is a minor for a violation to occur.
- RHSeeger 7y ago
  Not all the laws require the person actually be a minor either. Or the person to actually exist.

tracker1 7y ago

Some implementations and interpretations (iirc, Great Britain for one) don't even require that the person is a minor, only the appearance and illusion of, including animation/illustration.