BBFC News

The AV industry is not yet ready

The Digital Policy Alliance (DPA) is a private lobby group connecting digital industries with Parliament. Its industry members include both Age Verification (AV) providers, eg OCL, and adult entertainment, eg Portland TV.

Just before the Government announcement that the commencement of adult verification requirements for porn websites would be delayed, the DPA wrote a letter explaining that the industry was not yet ready to implement AV, and had asked for a 3 month delay.

The letter is unpublished but fragments of it have been reported in news reports about AV.

The Telegraph reported:

The Digital Policy Alliance called for the scheme to be delayed or risk nefarious companies using this opportunity to harvest and manipulate user data.

The strongly-worded document complains that the timing is very tight, a fact that has put some AVPs [age verification providers] and adult entertainment providers in a very difficult situation.

It warns that unless the scheme is delayed there will be less protection for public data, as it appears that there is an intention for uncertified providers to use this opportunity to harvest and manipulate user data.
 

The AV industry is  unimpressed by a 6 month delay

See article from news.sky.com

Rowland Manthorpe from Sky News contributed a few interesting snippets too. He noted that the AVPs were unsurprisingly not pleased by the government delay:

Serge Acker, chief executive of OCL, which provides privacy-protecting porn passes for purchase at newsagents, told Sky News: As a business, we have been gearing up to get our solution ready for July 15th and we, alongside many other businesses, could potentially now be being endangered if the government continues with its attitude towards these delays.

Not only does it make the government look foolish, but it's starting to make companies like ours look it too, as we all wait expectantly for plans that are only being kicked further down the road.
 

There are still issues with how the AV providers can make money

And interestingly Manthorpe revealed in the accompanying video news report that the AV providers were also distinctly unimpressed by the BBFC stipulating that certified AV providers must not use Identity Data provided by porn users for any other purpose than verifying age. The sensible idea being that the data should not be made available for the the likes of targeted advertising. And one particular example of prohibited data re-use has caused particular problems, namely that ID data should not be used to sign people up for digital wallets.

Now AV providers have got to be able to generate their revenue somehow. Some have proposed selling AV cards in newsagents for about £10, but others had been planning on using AV to generate a customer base for their digital wallet schemes.

So it seems that there are still quite a few fundamental issues that have not yet been resolved in how the AV providers get their cut.
 

Some AV providers would rather not sign up to BBFC accreditation

See article from adultwebmasters.org

Maybe these issues with BBFC AV accreditation requirements are behind a move to use an alternative standard. An AV provider called VeriMe has announced that it has the first AV company to receive a PAS1296 certification.

The PAS1296 was developed between the British Standards Institution and the Age Check Certification Scheme (ACCS). It stands for Public Accessible Specification and is designed to define good practice standards for a product, service or process. The standard was also championed by the Digital Policy Alliance.

Rudd Apsey, the director of VeriMe said:

The PAS1296 certification augments the voluntary standards outlined by the BBFC, which don't address how third-party websites handle consumer data, Apsey added. We believe it fills those gaps and is confirmation that VeriMe is indeed leading the world in the development and implementation of age verification technology and setting best practice standards for the industry.

We are incredibly proud to be the first company to receive the standard and want consumers and service providers to know that come the July 15 roll out date, they can trust VeriMe's systems to provide the most robust solution for age verification.

This is not a very convincing argument as PAS1296 is not available for customers to read, (unless they pay about 120 quid for the privilege). At least the BBFC standard can be read by anyone for free, and they can then make up their own minds as to whether their porn browsing history and ID data is safe.

However it does seem that some companies at least are planning to give the BBFC accreditation scheme a miss.
 

The BBFC standard fails to provide safety for porn users data anyway.

See article from medium.com

The AV company 18+ takes issue with the BBFC accreditation standard, noting that it allows AV providers to dangerously log people's porn browsing history:

Here's the problem with the design of most age verification systems: when a UK user visits an adult website, most solutions will present the user with an inline frame displaying the age verifier's website or the user will be redirected to the age verifier's website. Once on the age verifier's website, the user will enter his or her credentials. In most cases, the user must create an account with the age verifier, and on subsequent visits to the adult website, the user will enter his account details on the age verifier's website (i.e., username and password). At this point in the process, the age verifier will validate the user and, if the age verifier has a record the user being at least age 18, will redirect the user back to the adult website. The age verification system will transmit to the adult website whether the user is at least age 18 but will not transmit the identity of the user.

The flaw with this design from a user privacy perspective is obvious: the age verification website will know the websites the user visits. In fact, the age verification provider obtains quite a nice log of the digital habits of each user. To be fair, most age verifiers claim they will delete this data. However, a truly privacy first design would ensure the data never gets generated in the first place because logs can inadvertently be kept, hacked, leaked, or policies might change in the future. We viewed this risk to be unacceptable, so we set about building a better system.

Almost all age verification solutions set to roll out in July 2019 do not provide two-way anonymity for both the age verifier and the adult website, meaning, there remains some log of?204?or potential to log -- which adult websites a UK based user visits.

In fact one AV provider revealed that up until recently the government demanded that AV providers keep a log of people's porn browsing history and it was a bit of a late concession to practicality that companies were able to opt out if they wanted.

Note that the logging capability is kindly hidden by the BBFC by passing it off as being used for only as long as is necessary for fraud prevention. Of course that is just smoke and mirrors, fraud, presumably meaning that passcodes could be given or sold to others, could happen anytime that an age verification scheme is in use, and the time restriction specified by the BBFC may as well be forever.

Executive Summary

The BBFC's Age-verification Certificate Standard ("the Standard") for providers of age verification services, published in April 2019, fails to meet adequate standards of cyber security and data protection and is of little use for consumers reliant on these providers to access adult content online.

This document analyses the Standard and certification scheme and makes recommendations for improvement and remediation. It sub-divides generally into two types of concern: operational issues (the need for a statutory basis, problems caused by the short implementation time and the lack of value the scheme provides to consumers), and substantive issues (seven problems with the content as presently drafted).

The fact that the scheme is voluntary leaves the BBFC powerless to fine or otherwise discipline providers that fail to protect people's data, and makes it tricky for consumers to distinguish between trustworthy and untrustworthy providers. In our view, the government must legislate without delay to place a statutory requirement on the BBFC to implement a mandatory certification scheme and to grant the BBFC powers to require reports and penalise non-compliant providers.

The Standard's existence shows that the BBFC considers robust protection of age verification data to be of critical importance. However, in both substance and operation the Standard fails to deliver this protection. The scheme allows commercial age verification providers to write their own privacy and security frameworks, reducing the BBFC's role to checking whether commercial entities follow their own rules rather than requiring them to work to a mandated set of common standards. The result is uncertainty for Internet users, who are inconsistently protected and have no way to tell which companies they can trust.

Even within its voluntary approach, the BBFC gives providers little guidance to providers as to what their privacy and security frameworks should contain. Guidance on security, encryption, pseudonymisation, and data retention is vague and imprecise, and often refers to generic "industry standards" without explanation. The supplementary Programme Guide, to which the Standard refers readers, remains unpublished, critically undermining the scheme's transparency and accountability.

Recommendations

• Grant the BBFC statutory powers:

• The BBFC Standard should be substantively revised to set out comprehensive and concrete standards for handling highly sensitive age verification data.

• The government should legislate to grant the BBFC statutory power to mandate compliance.

• The government should enable the BBFC to require remedial action or apply financial penalties for non-compliance.

• The BBFC should be given statutory powers to require annual compliance reports from providers and fine those who sign up to the certification scheme but later violate its requirements.

• The Information Commissioner should oversee the BBFC's age verification certification scheme

Delay implementation and enforcement:

Delay implementation and enforcement of age verification until both (a) a statutory standard of data privacy and security is in place, and (b) that standard has been implemented by providers.

Improve the scheme content:

Even if the BBFC certification scheme remains voluntary, the Standard should at least contain a definitive set of precisely delineated objectives that age verification providers must meet in order to say that they process identity data securely.

Improve communication with the public:

Where a provider's certification is revoked, the BBFC should issue press releases and ensure consumers are individually notified at login.

The results of all penetration tests should be provided to the BBFC, which must publish details of the framework it uses to evaluate test results, and publish annual trends in results.

Strengthen data protection requirements:

Data minimisation should be an enforceable statutory requirement for all registered age verification providers.

The Standard should outline specific and very limited circumstances under which it's acceptable to retain logs for fraud prevention purposes. It should also specify a hard limit on the length of time logs may be kept.

The Standard should set out a clear, strict and enforceable set of policies to describe exactly how providers should "pseudonymise" or "deidentify" data.

Providers that no longer meet the Standard should be required to provide the BBFC with evidence that they have destroyed all the user data they collected while supposedly compliant.

The BBFC should prepare a standardised data protection risk assessment framework against which all age verification providers will test their systems. Providers should limit bespoke risk assessments to their specific technological implementation.

Strengthen security, testing, and encryption requirements:

Providers should be required to undertake regular internal and external vulnerability scanning and a penetration test at least every six months, followed by a supervised remediation programme to correct any discovered vulnerabilities.

Providers should be required to conduct penetration tests after any significant application or infrastructure change.

Providers should be required to use a comprehensive and specific testing standard. CBEST or GBEST could serve as guides for the BBFC to develop an industry-specific framework.

The BBFC should build on already-established strong security frameworks, such as the Center for Internet Security Cyber Controls and Resources, the NIST Cyber Security Framework, or Cyber Essentials Plus.

At a bare minimum, the Standard should specify a list of cryptographic protocols which are not adequate for certification.

The Iron-Fisted Monk is a 1977 Hong Kong action comedy drama by Sammo Kam-Bo Hung.
Starring Sammo Kam-Bo Hung, Sing Chen and James Tien.

Cut by the BBFC for 18 rated DVD in 2001. Uncut and 18 rated since 2019 Blu-ray. Uncut and MPAA R rated in the US.

The 2001 cuts of 1:16s were for sexual violence. The BBFC commented at the time:

• Cuts were required to remove eroticising shots of the forced exposure and groping of breasts, and of volume of nudity of victim during a rape scene under the Board's guidelines and sexual violence policy.

93:01s

UK: Passed 18 uncut for sexual violence with previous BBFC cuts waived: 2019 Eureka video

Summary Review: Good Addition

Here is yet another excellent kung fu movie done by Sammo Hung. The fighting is outstanding consisting of multiple kung fu styles facing off against each other, all done with superior speed and precision. Also sword and other weapons battles round out the action. There are still a ton of fight scenes but not quite as many as some of his other films, probably short by just a couple. The story is good and has decent acting. It is done well enough to keep your interest throughout and contains some scenes not normally seen in these type of films (nude, rape, a whore house). I was quite surprised with the amount of nudity shown (female). This movie is definitely not for children.

The Iron Fisted Monk is definitely a good addition to any kung fu collection.

A scathing new report, seen by City A.M. and authored by the Internet Association (IA), which represents online firms including Google, Facebook and Twitter, has outlined a string of major concerns with plans laid out in the government Online Harms white paper last month.

The Online Harms white paper outlines a large number of internet censorship proposals hiding under the vague terminology of 'duties of care'.

Under the proposals, social media sites could face hefty fines or even a ban if they fail to tackle online harms such as inappropriate age content, insults, harassment, terrorist content and of course 'fake news'.

But the IA has branded the measures unclear and warned they could damage the UK's booming tech sector, with smaller businesses disproportionately affected.  IA executive director Daniel Dyball said:

Internet companies share the ambition to make the UK one of the safest places in the world to be online, but in its current form the online harms white paper will not deliver that, said

The proposals present real risks and challenges to the thriving British tech sector, and will not solve the problems identified.

The IA slammed the white paper over its use of the term duty of care, which it said would create legal uncertainty and be unmanageable in practice.

The lobby group also called for a more precise definition of which online services would be covered by regulation and greater clarity over what constitutes an online harm. In addition, the IA said the proposed measures could raise serious unintended consequences for freedom of expression.

And while most internet users favour tighter rules in some areas, particularly social media, people also recognise the importance of protecting free speech 203 which is one of the internet's great strengths.

Update: Main points

2nd June 2019. See article from uk.internetassociation.org

The Internet Association paper sets out five key concerns held by internet companies:

• "Duty of Care" has a specific legal meaning that does not align with the obligations proposed in the White Paper, creating legal uncertainty, and would be unmanageable;
• The scope of the services covered by regulation needs to be defined differently, and more closely related to the harms to be addressed;
• The category of "harms with a less clear definition" raises significant questions and concerns about clarity and democratic process;
• The proposed code of practice obligations raise potentially dangerous unintended consequences for freedom of expression;
• The proposed measures will damage the UK digital sector, especially start-ups, micro-businesses and small- and medium-sized enterprises (SMEs), and slow innovation.

The BBFC's Annual Report covering 2018 revealed several interesting snippets about R18s.

R18s with a cinema certificate

In 2018, the makers of Four Play , a short explicit pornographic film, submitted the film with an R18 request for cinema classification. This is only the third R18-rated cinema film since 1993, and the film forms the centrepiece of a Channel 4 TV series in which a group of mothers, concerned by the abusive nature of much online pornography, make their own ethical porn film.

The television transmission of the documentary shows the mothers attending a private screening of Four Play, although any explicit detail is masked or obscured for TV transmission in accordance with Ofcom rules. Although the film does not technically require a BBFC age rating, given that private screenings do not need our authorisation, the makers intended to demonstrate that the film has been properly regulated and is within UK standards. Given that Four Play is a sex title featuring images of real sex but nothing abusive, harmful or illegal, we accordingly classified it R18.

The two other cinema films certified with a hardcore R18 were

( Correction , with thanks to Craig. Previously Dr Lust was credited as one of the 3 hardcore R18 cinema releases, but this was in fact the last cinema film to be given a softcore R18 certificate in 1993).

Deep Throat is a 1972 US adult film by Gerard Damiano.
With Linda Lovelace, Harry Reems and Dolly Sharp.

Deep Throat was not given a standalone cinema release. It was reissued uncut in 2005 to accompany certain screenings of the documentary Inside Deep Throat .

The Good Old Naughty Days is a 2002 France adult documentary  and compilation of vintage stag films by Michel Reilhac.
Starring Liandra Dahl, Annabelle Lee and Joost Smoss.

Passed R18 uncut for 2002 cinema release. Note that the film would be banned for its doggy sex if it were to be resubmitted today.

Continued decline in R18s

In 2018, there was another decrease in the number of pornographic films submitted to us. We classified 298 films, which is a 19% decrease in submissions compared to 2017.

The proportion of R18 titles subject to cuts in 2018 was 15%, the same as the previous year

Relaxation of the UK obscenity law

During 2018, the CPS consulted on the guidance it issues to prosecutors on the issue of obscenity. As a result, in early 2019, it issued new guidance that places a stronger emphasis on the depiction of harmful and abusive behaviour as the key reason for prosecution, rather than the depiction of niche sexual practices.

Accordingly, at the beginning of 2019, the BBFC revised its own R18 policies to permit the depiction of certain activities, including but not limited to sexualised urination [and fisting], provided those activities occur in a consensual and non-abusive context.

The BBFC reports on its complaints received in its annual report. And 2018 saw a bumper crop (relative to previous years. The BBFC wrote:

In 2018 we received 364 complaints covering 101 films and 67 complaints covering 24 trailers. The majority of these were from people who had attended the cinema or viewed films at home. However, we also received a number of complaints inspired by news reports, online blogs and organised campaigns.

The top films attracting complaints were:

Red Sparrow

Red Sparrow attracted 64 complaints. All correspondents felt that we should have classified the film at 18 instead of 15 because of elements of violence and sexual violence in the film.

Peter Rabbit

Fifty people contacted us about Peter Rabbit, a film featuring animated rabbits and based on the stories of Beatrix Potter. Four people complained about violence and upsetting scenes but the majority complained about a scene in which the rabbits pelt their adversary, an adult man, with fruit in order to defend themselves from his attack and provoke an allergic reaction. Complainants felt that this was unacceptable at PG because it might be emulated by children.

We received complaints about the allergic reaction before the film was released in the UK in response to press coverage that started in the US. We received no complaints about this scene after the film was released.

A Northern Soul

We classified the film 15 because of around 20 uses of strong language. While the language in the film is not used aggressively or sexually, our research suggests that a significant proportion of parents are concerned about the normalisation of such language in films. The language in A Northern Soul, is used casually in conversations, across a relatively short feature (75 minutes), with no particular justification.

Three people wrote to us complaining about the 15 rating for A Northern Soul feeling a 12A would be more appropriate. We received 45 postcards protesting the 15 rating; however, these had been created and handed out to cinema goers by the filmmakers at screenings and do not provide an accurate representation of broad public opinion.

Kaala

Kaala is a Tamil-language drama which we classified 12A. 43 people emailed us to complain about the film's release. The complaints were not about the rating of the film itself but seemed to object to the actions of the film makers. They were all worded identically and were clearly part of an organised online campaign.

Show Dogs

A police Rottweiler goes undercover at a dog show. As part of the operation he is required to let the judges inspect his genitals in a manner that is not uncommon in dog shows. The character is reluctant but is encouraged to go to his happy place to get through the experience.

Thirty-one people wrote in to us echoing claims made in blogs that the scene might lower children's resistance to predators who wish to inappropriately touch them.

However, the scene is comic, innocent and non-sexual in nature and occurs within the fantastical context of a film about anthropomorphised canines.

In a similar vein to Peter Rabbit the complaints regarding Show Dogs predominantly stopped once the film had been released in cinemas.

Love Simon trailer

We received 18 complaints about a PG-rated trailer for the film Love, Simon. The trailer covers teenage relationships and features some implied kissing and references to being in love. All complainants took issue with the discussion of sex and teenage relationships in the trailer but 11 took particular issue with the fact that the character is gay, believing the depiction of gay relationships to be inappropriate at the PG level.

Ready Player One

Ready Player One received ten complaints with correspondents focusing on infrequent strong language at 12A and some moments of horror.

Jurassic World: Fallen Kingdom

Jurassic World: Fallen Kingdom received six complaints, chiefly regarding very young children being brought to the 12A screenings.

Venom

Six people complained about Venom, which is rated 15. Complainants were disappointed they or their children would be unable to see the film.

The Devil Outside is a drama by Andrew Hulme.
Starring Mark Stobbart, Keeley Forsyth and Daniel Frogson.

Cut by the BBFC for 15 rated VoD in 2019

		UK: Passed 15 for strong language, sex, nudity, images of self-harm after 9s of compulsory BBFC cuts ( 101:59s ) :
2019 Content Media Corporation INTL. VoD

The BBFC commented:

• Compulsory cuts required to remove potentially indecent images involving a child (a child in the same frame as adults simulating sex) in accordance with the Protection of Children Act 1978.

BBFC releases Annual Report 2018

• Over the past year, the BBFC has received a 65% rise in content for distribution online.

• Video on demand (VoD) continues to receive more BBFC age ratings than any other format

• Ratings given to Cinema have risen 62% since 2008.

• Once again, 15 was the most common classification given for UK cinema goers

The BBFC has released its Annual Report for 2018 a year that showed another significant increase in age ratings given to online content.

Over the last year the BBFC gave 5,751 age ratings to online content. This represents a 65% over 2017's figure.

Although output from Video on Demand (VoD) providers constituted the majority of content classified by the BBFC, theatrical films still featured strongly. Since 2008 age ratings given to cinema releases have risen 62% from 639 in 2017 to 1,036 in 2018.

15 remained the most common age rating, with 392 theatrical films receiving this classification.

David Austin, BBFC Chief Executive, said:

"In a fast evolving media landscape, the BBFC's core mission continues to be to help families and young people choose films, videos and websites that are right for them. Whenever, wherever, and however they view them. In 2018 we carried out significant research - with more than 10,000 people to help us update our classification standards. This work ensures that our standards continue to stay in line with what people across the UK consider suitable, and we found that 97% of the public believe audiences benefit from having age ratings in place.

"In 2019 we will continue to make a significant contribution to the Government's objective of making the UK the safest place for children to be online. We look forward to the introduction of Age-verification in July which will improve child protection from exposure to pornography online."

In addition to providing the latest age rating information on our websites, social media accounts and free app, the BBFC in 2018 continued to provide resources for children, teachers and older learners including a regular podcast, a children's website ( cbbfc.co.uk ), case studies, classroom resources and posters.

Every film classified by the BBFC comes with detailed ratings info to help people view what's right for themselves and their family. Ratings info is available on bbfc.co.uk and the BBFC's free apps for tablet and mobile devices.

The BBFC has re-iterated that its Age Verification certification scheme does not allow for personal data to be used for another purpose beyond age verification. In particular age verification should not be coupled with electronic wallets.

Presumably this is intended to prevent personal date identifying porn users to be dangerously stored in databases use for other purposes.

In passing, this suggests that there may be commercial issues as age verification systems for porn may not be reusable for age verification for social media usage or identity verification required for online gambling. I suspect that several AV providers are only interested in porn as a way to get established for social media age verification.

This BBFC warning may be of particular interest to users of the porn site xHamster. The preferred AV option for that website is the electronic wallet 1Account.

The BBFC write in a press release:

The Age-verification Regulator under the UK's Digital Economy Act, the British Board of Film Classification (BBFC), has advised age-verification providers that they will not be certified under the Age-verification Certificate (AVC) if they use a digital wallet in their solution.

The AVC is a voluntary, non-statutory scheme that has been designed specifically to ensure age-verification providers maintain high standards of privacy and data security. The AVC will ensure data minimisation, and that there is no handover of personal information used to verify an individual is over 18 between certified age-verification providers and commercial pornography services. The only data that should be shared between a certified AV provider and an adult website is a token or flag indicating that the consumer has either passed or failed age-verification.

Murray Perkins, Policy Director for the BBFC, said:

A consumer should be able to consider that their engagement with an age-verification provider is something temporary.

In order to preserve consumer confidence in age-verification and the AVC, it was not considered appropriate to allow certified AV providers to offer other services to consumers, for example by way of marketing or by the creation of a digital wallet. The AVC is necessarily robust in order to allow consumers a high level of confidence in the age-verification solutions they choose to use.

Accredited providers will be indicated by the BBFC's green AV symbol, which is what consumers should look out for. Details of the independent assessment will also be published on the BBFC's age-verification website, ageverificationregulator.com, so consumers can make an informed choice between age-verification providers.

The Standard for the AVC imposes limits on the use of data collected for the purpose of age-verification, and sets out requirements for data minimisation.

The AVC Standard has been developed by the BBFC and NCC Group - who are experts in cyber security and data protection - in cooperation with industry, with the support of government, including the National Cyber Security Centre and Chief Scientific Advisors, and in consultation with the Information Commissioner's Office. In order to be certified, AV Providers will undergo an on-site audit as well as a penetration test.

Further announcements will be made on AV Providers' certification under the scheme ahead of entry into force on July 15.

Starting with a little background into the authorship of the document under review. AVSecure CMO Steve Winyard told XBIZ:

The accreditation plan appears to have very strict rules and was crafted with significant input from various governmental bodies, including the DCMS (Department for Culture, Media & Sport), NCC Group plc (an expert security and audit firm), GCHQ (U.K. Intelligence and Security Agency), ICO (Information Commissioner's Office) and of course the BBFC.

But computer security expert Alec Muffett writes:

This is the document which is being proffered to protect the facts & details of _YOUR_ online #Porn viewing. Let's read it together!

What could possibly go wrong?

....

This document's approach to data protection is fundamentally flawed.

The (considerably) safer approach - one easier to certificate/validate/police - would be to say everything is forbidden except for upon for ; you would then allow vendors to appeal for exceptions under review.

It makes a few passes at pretending that this is what it's doing, but with subjective holes (green) that you can drive a truck through:

...

What we have here is a rehash of quite a lot of reasonable physical/operational security, business continuity & personnel security management thinking -- with digital stuff almost entirely punted.

It's better than #PAS1296 , but it's still not fit for purpose.

Read the full thread

Batman Returns is a 1992 USA / UK action crime fantasy by Tim Burton.
Starring Michael Keaton, Danny DeVito and Michelle Pfeiffer.

Cut by the BBFC for a 12 rated cinema release in 1992 and the follow up VHS. Less cut for 12 rated DVD in 2006. Then uncut for 15 rated Blu-ray in 2008 and finally rated 12A uncut for 2019 cinema release. Always uncut and MPAA PG-13 rated in the US.

		UK: Passed 12A uncut for moderate violence, injury detail, sex references, threat, sexual threat ( 126:18s ) :
2019 cinema release

Summary Notes

In the sewers of gotham city to the rooftops of the gotham city the penguin wants to know where he came from well in his villain ways catwoman plans to kill rich man of gotham max shreak but as he battles with millionaire Bruce Wayne both ladies men have their own secrets Bruce Wayne is back as Bat man trying to stop the penguin Max is helping penguin steal gotham city while selina Kyle/catwoman tries to help penguin not knowing her man murder target also her murder is helping him but all four men have their goals taking gotham from crime winning gotham city assassination for two men and more money to be gotham citys number one rich man.

 

The BBFC has tweaked the look and feel of its website with a new bolder looking typeface set against a white background.

The BBFC has also corrected the previously slow starting search box that used to delete what you typed if you started before the form was ready.

Otherwise the  data presented seems to about the same as before, but I did spot one significant change. The short and long summaries of ratings issues in a film have been changed. They were previously referred to as BBFCInsight but are now labelled: Rating Info

Previously the BBFC has steered away form using the word 'rating' preferring to use the term 'classification'.

Brightburn is a 2019 USA Sci-Fi horror thriller by David Yarovesky.
Starring Elizabeth Banks, David Denman and Matt Jones.

		UK: Passed 15 for strong gory injury detail, violence, language after BBFC advised pre-cuts ( 90:12s ) :
2019 cinema release

The BBFC commented:

• This film was originally seen for advice at which stage the company was informed it was likely to be classified 18 uncut but that their preferred 15 classification could be achieved by making reductions to two scenes featuring both strong gory images and a dwelling on the infliction of pain and injury. When the film was submitted for formal classification these scenes had been acceptably reduced.

For comparison in the US the film was rated R uncut for horror violence/bloody images, and language.

Summary Notes

What if a child from another world crash-landed on Earth, but instead of becoming a hero to mankind, he proved to be something far more sinister?

The BBFC has published a detailed standard for age verifiers to get tested against to obtain a green AV kite mark aiming to convince users that their identity data and porn browsing history is safe.

I have read through the document and conclude that it is indeed a rigorous standard that I guess will be pretty tough for companies to obtain. I would say it would be almost impossible for a small or even medium size website to achieve the standard and more or less means that using an age verification service is mandatory.

The standard has lots of good stuff about physical security of data and vetting of staff access to the data.

Age verifier AVSecure commented:

We received the final documents and terms for the BBFC certification scheme for age verification providers last Friday. This has had significant input from various Government bodies including DCMS (Dept for Culture, Media & Sport), NCC Group plc (expert security and audit firm), GCHQ (UK Intelligence & Security Agency) ICO (Information Commissioner's Office) and of course the BBFC (the regulator).

The scheme appears to have very strict rules.

It is a multi-disciplined scheme which includes penetration testing, full and detailed audits, operational procedures over and above GDPR and the DPA 2018 (Data Protection Act). There are onerous reporting obligations with inspection rights attached. It is also a very costly scheme when compared to other quality standard schemes, again perhaps designed to deter the faint of heart or shallow of pocket.

Consumers will likely be advised against using any systems or methods where the prominent green AV accreditation kitemark symbol is not displayed.

 

But will the age verifier be logging your ID data and browsing history?

And the answer is very hard to pin down from the document. At first read it suggests that minimal data will be retained, but a more sceptical read, connecting a few paragraphs together suggests that the verifier will be required to keep extensive records about the users porn activity.

Maybe this is a reflection of a recent change of heart. Comments from AVSecure suggested that the BBFC/Government originally mandated a log of user activity but recently decided that keeping a log or not is down to the age verifier.

As an example of the rather evasive requirements:

8.5.9 Physical Location

Personal data relating to the physical location of a user shall not be collected as part of the age-verification process unless required for fraud prevention and detection. Personal data relating to the physical location of a user shall only be retained for as long as required for fraud prevention and detection.

Here it sounds like keeping tabs on location is optional, but another paragraph suggest otherwise: 

8.4.14 Fraud Prevention and Detection

Real-time intelligent monitoring and fraud prevention and detection systems shall be used for age-verification checks completed by the age-verification provider.

Now it seems that the fraud prevention is mandatory, and so a location record is mandatory after all.

Also the use off the phrase only be retained for as long as required for fraud prevention and detection. seems a little misleading too, as in reality fraud prevention will be required for as long as the customer keeps on using it. This may as well be forever.

There are other statements that sound good at first read, but don't really offer anything substantial:

8.5.6 Data Minimisation

Only the minimum amount of personal data required to verify a user's age shall be collected.

But if the minimum is to provide name and address + eg a drivers licence number or a credit card number then the minimum is actually pretty much all of it. In fact there are only the porn pass methods that offer any scope for 'truely minimal' data collection. Perhaps the minimal data also applies to the verified mobile phone method as although the phone company probably knows your identity, then maybe they won't need to pass it on to the age verifier.

 

What does the porn site get to know

The rare unequivocal and reassuring statement is

8.5.8 Sharing Results

Age-verification providers shall only share the result of an age-verification check (pass or fail) with the requesting website.

So it seems that identity details won't be passed to the websites themselves.

However the converse is not so clear:

8.5.6 Data Minimisation

Information about the requesting website that the user has visited shall not be collected against the user's activity.

Why add the phrase, against the user's activity. This is worded such that information about the requesting website could indeed be collected for another reason, fraud detection maybe.

Maybe the scope for an age verifier to maintain a complete log of porn viewing is limited more by the practical requirement for a website to record a successful age verification in a cookie such that the age verifier only gets to see one interaction with each website.

No doubt we shall soon find out whether the government wants a detailed log of porn viewed, as it  will be easy to spot if a website queries the age verifier for every film you watch.
 

Fraud Detection

And what about all this reference to fraud detection. Presumably the BBFC/Government is a little worried that passwords and accounts will be shared by enterprising kids. But on the other hand it may make life tricky for those using shared devices, or perhaps those who suddenly move from London to New York in an instant, when in fact this is totally normal for someone using a VPN on a PC.

Wrap up

The BBFC/Government have moved on a long way from the early days when the lawmakers created the law without any real protection for porn users and the BBFC first proposed that this could be rectified by asking porn companies to voluntarilyfollow 'best practice' in keeping people's data safe.

A definite improvement now, but I think I will stick to my VPN.

VPNCompare is reporting that internet users in Britain are responding to the upcoming porn censorship regime by investigating the option to get a VPN so as to workaround most age verification requirements without handing over dangerous identity details.

VPNCompare says that the number of UK visitors to its website has increased by 55% since the start date of the censorship scheme was announced. The website also sated that Google searches for VPNs had trippled. Website editor, Christopher Seward told the Independent:

We saw a 55 per cent increase in UK visitors alone compared to the same period the previous day. As the start date for the new regime draws closer, we can expect this number to rise even further and the number of VPN users in the UK is likely to go through the roof.

The UK Government has completely failed to consider the fact that VPNs can be easily used to get around blocks such as these.

Whilst the immediate assumption is that porn viewers will reach for a VPN to avoid handing over dangerous identity information, there may be another reason to take out a VPN, a lack of choice of appropriate options for age validation.

3 companies run the 6 biggest adult websites. Mindgeek owns Pornhub, RedTube and Youporn. Then there is Xhamster and finally Xvideos and xnxx are connected.

Now Mindgeek has announced that it will partner with Portes Card for age verification, which has options for identity verification, giving a age verified mobile phone number, or else buying  a voucher in a shop and showing age ID to the shop keeper (which is hopefully not copied or recorded).

Meanwhile Xhamster has announced that it is partnering with 1Account which accepts a verified mobile phone, credit card, debit card, or UK drivers licence. It does not seem to have an option for anonymous verification beyond a phone being age verified without having to show ID.

Perhaps most interestingly is that both of these age verifiers are smart phone based apps. Perhaps the only option for people without a phone is to get a VPN. I also spotted that most age verification providers that I have looked at seem to be only interested in UK cards, drivers licences or passports. I'd have thought there may be legal issues in not accepting EU equivalents. But foreigners may also be in the situation of not being able to age verify and so need a VPN.

And of course the very fact that is no age verification option common to the major porn website then it may just turn out to be an awful lot simpler just to get a VPN.

The Interrogator :

Is it safe?

The BBFC (on its Age Verification website)...err...no!...:

An assessment and accreditation under the AVC is not a guarantee that the age-verification provider and its solution (including its third party companies) comply with the relevant legislation and standards, or that all data is safe from malicious or criminal interference.

Accordingly the BBFC shall not be responsible for any losses, damages, liabilities or claims of whatever nature, direct or indirect, suffered by any age-verification provider, pornography services or consumers/ users of age-verification provider's services or pornography services or any other person as a result of their reliance on the fact that an age-verification provider has been assessed under the scheme and has obtained an Age-verification Certificate or otherwise in connection with the scheme.

The UK will become the first country in the world to bring in age-verification for online pornography when the measures come into force on 15 July 2019.

It means that commercial providers of online pornography will be required by law to carry out robust age-verification checks on users, to ensure that they are 18 or over.

Websites that fail to implement age-verification technology face having payment services withdrawn or being blocked for UK users.

The British Board of Film Classification (BBFC) will be responsible for ensuring compliance with the new laws. They have confirmed that they will begin enforcement on 15 July, following an implementation period to allow websites time to comply with the new standards.

Minister for Digital Margot James said that she wanted the UK to be the most censored place in the world to b eonline:

Adult content is currently far too easy for children to access online. The introduction of mandatory age-verification is a world-first, and we've taken the time to balance privacy concerns with the need to protect children from inappropriate content. We want the UK to be the safest place in the world to be online, and these new laws will help us achieve this.

Government has listened carefully to privacy concerns and is clear that age-verification arrangements should only be concerned with verifying age, not identity. In addition to the requirement for all age-verification providers to comply with General Data Protection Regulation (GDPR) standards, the BBFC have created a voluntary certification scheme, the Age-verification Certificate (AVC), which will assess the data security standards of AV providers. The AVC has been developed in cooperation with industry, with input from government.

Certified age-verification solutions which offer these robust data protection conditions will be certified following an independent assessment and will carry the BBFC's new green 'AV' symbol. Details will also be published on the BBFC's age-verification website, ageverificationregulator.com so consumers can make an informed choice between age-verification providers.

BBFC Chief Executive David Austin said:

The introduction of age-verification to restrict access to commercial pornographic websites to adults is a ground breaking child protection measure. Age-verification will help prevent children from accessing pornographic content online and means the UK is leading the way in internet safety.

On entry into force, consumers will be able to identify that an age-verification provider has met rigorous security and data checks if they carry the BBFC's new green 'AV' symbol.

The change in law is part of the Government's commitment to making the UK the safest place in the world to be online, especially for children. It follows last week's publication of the Online Harms White Paper which set out clear responsibilities for tech companies to keep UK citizens safe online, how these responsibilities should be met and what would happen if they are not.

Spy Cat is a 2018 Germany / Belgium family animation adventure by Christoph Lauenstein and Wolfgang Lauenstein.
Starring Alexandra Neldel and Axel Prahl.

Four crazy antiheroes on the run. Their leader is the unworldly innocent, naive Marnie, a house cat who is not allowed to leave the house and only knows about real life from television. Based loosely on Grimms "The Bremen Town Musicians" a modern, hilarious road movie is told.

Passed U for very mild comic violence, rude humour, language after 57s of BBFC category cuts for 2019 cinema release.

The film had earlier been passed PG uncut for mild bad language, violence, rude humour.

The BBFC commented:

• Company chose to make various cuts to receive a lower classification. Cuts were made to remove instances of mild bad language and word play on strong language, to remove mild sex references, to reduce scenes of mild rude humour, and to reduce sequences of mild violence and threat. An uncut PG classification was available.