The law requires the identity records to be kept with copies of each work containing explicit depictions sufficient to match the performer to the identification. If you do online real-time live streaming of depictions, how do you do that if they aren't on the same system?

Just a thought, but you don’t store them in an unprotected S3 bucket.

If you’re required to handle this kind of sensitive information — for any purpose, but I would say this is even more true for anything tied to anything of a sexual nature or anything tied to health — you should take every precaution that that information is secure, encrypted when possible, and that your systems are regularly audited for vulnerabilities.

If the onus of properly protecting sensitive data — whether you’re legally required to hold it or not — is too much or too expensive, you shouldn’t be in that type of business. Period.

Until companies are made to feel the pain of data leaks, they won't bother.

It's a porn company, not a bank or other "respectable" business, so it's possible that they could actually face consequences.

And to counter that, the victims are porn actors/actresses, so the perpetrators probably won't face consequences for it.

I'd like to /s this comment, but I'm not sure I can.

I can chime in one as I was a systems administrator for one of those shady “Get sex tonight” dating websites.

The law of having to hold the identification of the models is pretty much the only law you need to uphold. These sites are created from shills of shells.

You have one company, from there you then have two or three other companies which create white label brands utilising one of the shell companies.

So the brand “bangshelia” would be registered with a shell company “adult dating world”. This brand would then be bought by a shill and branded as “purple dating” but registered by a company called “dating purple”.

You would then affiliate with “adult dating tonight” where they would provide the data for your brand.

To get anywhere near close to chasing the company, you need to launch a lawsuit against the active site, (the company registered to) and then the company behind that and from that the company providing the database. Which all costs money.

As my CEO did, you pack up shop on one of those brands and rebrand yourself. Claim your not associated to the previous company by registering another director.

There are no resources available to attempt to make anything secure. The website of the company I used to work for kept all passwords in plain text in a database that was accessible online publicly for other affiliates to borrow to create their own “brand”.

It took me a couple reads, but do you mean "shell" (as in a shell company that does nothing but exist to protect or obscure the operations of another company) instead of "shill" (a person who markets for someone while hiding that they are associated with them)?

Sorry about that, I’ve rehashed what I wrote and should now make more sense.

It’s shill of shells. The CEO makes one company, another “investor” buys a brand of the original company and registers it in their name and then sells that on.

The Experian settlement pretty well solidified security as a waste of money.

I watched "Laundromat" (*movie about the Panama Papers), towards the end of the movie, Antonio Banderas says: "In... In retrospect, uh... I think we... we could have spent more on cyber-security."

> Just a thought, but you don’t store them in an unprotected S3 bucket.

> If you’re required to handle this kind of sensitive information ... you should take every precaution that that information is secure, encrypted when possible, and that your systems are regularly audited for vulnerabilities.

None of that solves the problem, though.

You can protect an S3 bucket, but anyone who wants it simply checks it periodically.

Then one day someone is working with the data and changes the permissions to get access, and before they know it, it's downloaded in minutes. It just takes one attacker to get lucky and catch it before your audits do.

And S3 is not unusual, it's just an Internet service like any other, they all have this problem. Even if you have your own data center on a private network, it's only private until someone needs to transmit something and opens a route.

It's ultimately a human problem, there's no magic that can prevent it.

> If the onus ... you shouldn’t be in that type of business. Period.

Ending an unjustified opinion with "period" highlights the fact that you didn't justify the opinion. And it sounds fatuous.

If you're changing the permissions to public just to work with the data, there's your problem. Proper access policies solves all of this - the bucket should never have had public access enabled in the first place as there is literally zero need for it, just sloppy work.

> Just a thought, but you don’t store them in an unprotected S3 bucket.

That's pretty much a good rule of thumb for, well, everything.

(Sure, there are exceptions. But, there's a reason AWS not only doesn't enable public access to buckets by default, but actually by default has superceding policies in place which block setting normal policies to allow public access; it's almost always the wrong choice.)

I had never anything to do with this topic and have no expertise in legal topics but it sounds like you are referring to the Child Protection and Obscenity Enforcement Act [1]. I didn't read the entire thing but just searched for parts talking about keeping records, mostly § 75.2 [2]. Maybe I am interpreting the letters of the law a bit naively but I can not find anything that would require keeping this information anywhere close to the servers used for streaming. Quite to the contrary, it seems to me that you could keep the required records on paper if you wanted to - more or less a copy of the ID, name and aliases used by the performer, and a list of works the performer appears in, for example the URL a stream is available at. But maybe I missed something important.

[1] https://en.wikipedia.org/wiki/Child_Protection_and_Obscenity...

[2] https://www.law.cornell.edu/cfr/text/28/75.2

A file-cabinet next to the server?

There are rules on how the information has to be indexed and cross referenced; while you might be able to design a system of electronic-beside-hardcopy records that you could make a plausible argument for meeting all of the requirements, it's straightforward to do it if your data and media are in the same electronic system.

Considering that getting it wrong is a federal felony, the incentive set by the law is clear even if, arguably, unintended.

> Considering that getting it wrong is a federal felony, the incentive set by the law is clear even if, arguably, unintended.

I don’t think you’re wrong, but I would argue that if getting it wrong is a felony, not properly protecting the data should be a felony as well. I realize it isn’t, but incidents like this showcase just how poorly the laws around this type of thing are written. If you can’t properly protect the data, you shouldn’t be in this type of business.

Of course, in this case, this is a site registered in Andorra. So who even know what those laws required in the first place.

> I don’t think you’re wrong, but I would argue that if getting it wrong is a felony, not properly protecting the data should be a felony as well.

It probably should be; I suspect that it's not because making involvement in porn risky for adult participants (and thereby discouraging it), while not the central focus of the law, isn't actually undesirable to lawmakers.

> Of course, in this case, this is a site registered in Andorra. So who even know what those laws required in the first place.

My understanding is that the US applies it's rules to anything of an adult nature sold into or among the US states, regardless of origin, though in practice applying it to foreign entities with little US exposure is difficult; but certainly it wouldn't be the only law that applies, to the extent it might apply.

Eh, maybe it's irresponsible but I don't think that it needs to be a felony or that those people shouldn't be in business. People just shouldn't expect every shady website to have perfect data practices.

You shouldn’t need to ask if your employer is shady — and even then because it isn’t shady, not because someone tells you afterwards that it should’ve been obvious to you that it was bad before you started.

Sure, but that doesn't mean that because some data got leaked that it should be a felony.

Not being a legal scholar, I won’t make a distinction between felony and misdemeanor.

What I will say is that just as computers are a force-multipler for getting important stuff done, they are also a force-multiplier for causing harm. As the old saying goes: “to er is human, to really foul up requires a computer”.

This leak did not endanger just one or two people, which would be bad enough, but 4000. Even if the remedy is limited to a fine sufficient for each affected person to change their names and address, it is still a more serious harm than almost anything normal intuition will help with because of how many were involved.

I wish that being in the sex industry was socially neutral for men and women and that nobody would be assaulted or insulted for it. I don’t know why that isn’t the case already, but I do recognise that it isn’t — and given that it isn’t, this leak is still extremely likely to result in someone getting hurt.

Also not being a legal scholar, the distinction being that a felony is a much more serious crime and lands people in jail for long periods of time. Which is why I think this could be an over reaction when a data leak may possibly be a mistake or ignorance. I understand that the nature of the data may be sensitive, but I don't think it makes sense to ham handedly punish people for something they aren't directly responsible for. Like someone being hypothetically hurt by someone else because of a data leak they may not even have known about.

I strongly disagree. I’d expect the shadiest of shady websites to have the best security, but as demonstrated, the people that scooped up tonnes of my financial history without my permission, then charge me for access, and sell that data to other financial institutions that use that data to determine my access to credit, not only have terrible security, but aren’t really punished for it either.

I would love to implement an extreme version of this, where each night a cron job runs that prints directly into a slot of a locked box

Any time human labor is involved, that makes the startup less valuable to VC.

Anytime human labour that is required is ignored that makes the startup more deceptively attractive to VC - and may end up bordering on fraud if done with intent.

Fraud and the rule of law don't seem to factor into VC calculations lately.

Well, they do, just sometimes fraud positively and the rule of law negatively, instead of vice-versa.

In principle this problem should be solvable with a zero-knowledge proof system.

The law should allow for schemes that prove a performer is legal, identified, etc., but that don't keep individual private details. Even if the site was completely compromised, all the attackers would gain is a single bit of data on each performer. The data would be worthless for personal identification

Yeah the law (for very good reason) is made in a way that you can never hide behind "i don't have it now / it's not here / it wasn't me at the time", but in the day and age of live streaming and data leaks that's basically a matter of time until such leaks happen.

Store enough image data (e.g. the entire video archive) to do the mapping plus the user ID on the server.

Store all the identifying data they need to hold onto for compliance purposes plus the user ID in offline storage.

You store them wherever you like, encrypted with a public key. The important thing is the decryption key, which never has to leave the airgapped laptop or the printout in a vault. The law doesn't say the files have to be in a particular format or instantly viewable, any more than it says they need to be stored in an unprotected S3 bucket.

2257 record compliance can be done with a custodian.

A custodian can hold the records, but they still have to have all of the required records at the moment you sell any depiction if you don't want to commit a federal felony, and if your depictions are created live in real-time, that's going to be quite challenging to do offline.

Amazing law.

I don't have it here / I don't have it now / It's not me who keep them / It wasn't me at the time / I don't know

Just like banking regulations that seems stupid, they come from real abuses and a solution to it at the time. I doubt laws signed in 1988 had internet scale and access in mind, nor could they predict it.

When the law can't keep up with reality even after this long, that's not an excuse, it's an indication of a broken system.

Indeed. Especially when in cases like this, when you’re talking about fingerprints, passport information, gender, parents names, marital information — not to mention standard PII fare — all coupled with the fact that nude photos/videos can be tied to this data too.

This makes me physically sick.

2257 was passed well over a decade ago, with minimal public dispute. The only concerning thing is if the models don’t fully understand what the law entails. All affiliate publishers have to have that information under the law.

Also, because of face recognition there really is zero anonymity at this point. It would be very misleading to represent to someone otherwise.

The lawyers don’t even understand how the law says data is supposed to be segregated [1], how are the performers supposed to know.

Also, there is a very big difference between citing facial recognition tech (which while rapidly becoming more common, is still something that requires a degree of skill to use and has a real cost to using) as a reason for “zero anonymity” and having public records with direct ties to nude photos and videos leaked. It’s even more misleading to represent that these have the same risk profile.

[1]: https://lawofsex.wordpress.com/2014/03/25/keeping-your-recor...

> I don't have it here / I don't have it now / It's not me who keep them / It wasn't me at the time / I don't know

More like the state should not need it at all. Why support even more surveillance?

That's not a bug - that's a feature.

It's one data leak compared to all the abuse the law has prevented.

It's one data leak that will have life-changing consequences for a lot of people.

Age verification and privacy aren't mutually exclusive. The law can be amended in a way to remain effective without exposing people to such risks.

Back when the law was designed data breaches and being able to find everything online wasn't a thing so it wasn't a problem anyone thought of. Now it's time to fix the law to address the new risks.

AFAIK (IANAL) this contradicts laws such as California's adult entertainment laws. I believe the studio is required to maintain records of the cast. (Thanks to the Traci Lords incident).

And given that this is a site paying their webcammers, the other information is presumably back-up identification in case of account recovery or some such.

It doesn’t have to be stored on a server that is publicly reachable, however.

> AFAIK (IANAL)

I see what you did there.

That makes me think that in order to obey the law in California, you'd be breaking European law (ie. GDPR)

I don't think GDPR covers people who have an actual written and signed financial contract with the service in question. How could any business function without the information needed on who to pay?

Keeping data which you are legally required to keep is certainly allowed by the GDPR.

Although it wouldn't be surprising to have two (or more) laws contradict each other.

Especially if that was a way to "accidentally" kill an objectionable industry.

GDPR has explicit provisions for "keep what you're legally required to keep".

It's funny that there are a tons of requirements before you are allowed to store credit cards (PCI DSS), which are easily changed and expire anyway, yet none for storing ID photo or other highly sensitive personal data, much of which is unchangeable (like date of birth).

As always, the powerful (banks) can rig the system in their favor.

Sort of. It's all about whose information it is.

A credit card number is managed/owned/valid within the payment networks. Since they manage it, they get to dictate what means of protection are required in order for you to engage in business on those networks.

Government IDs are usually property of the body which issues them. That means each state can (and IIRC, does) have rules about what you can and cannot use that information for. Therefore you'd have to know the rules for each state or issuing body.

That's not to say that common sense _ought_ to dictate that these things should happen anyway, but who thinks to look up various state government rules on handling a Driver's License?

Yes, but then again it's much simpler. Leak credit card data because you didn't stored it as they want, you'll never touch one again. But if you leak personal user data, nothing (really) bad will happen to you.

It's a matter of incentives.

This is very serious actually, short of addresses also being added I can't think of a worse situation to be in if you were a model.

many photo IDs include an address, so it's basically included

This is the way they should do it: https://www.verygoodsecurity.com/

Keep the data encrypted and only allow KYC providers access to the decryption keys.

That solution does not work for frontend encrypted data. It also does not work for short strings, such as days, months, years, street numbers.

Firstly disclaimer that I work at Very Good Security.

ec109685 is right and this is precisely what VGS does. Most companies collect sensitive data (PII/PCI) to achieve a business objective, like verifying identity, age, creditworthiness or to authorize payment. Storing and securing this data is not their primary objective and possession of data comes with the burden of compliance and regulations. VGS acts as a proxy aliasing sensitive datasets as the data flows between systems. When it is time to use this data, VGS acts as a proxy replacing the aliases with real values as data has to be exchanged with third parties.

When dealing with short attributes, combining several other parts of the form to create a composite alias partitioned over the different parts of the payload gets the job done. This would expand the size of the short integer. Adjacent encodings in Chinese, Korean and Japanese characters further expand possibilities.

Could you not also just throw in 1-2kb of random data with your short data? Your app can then just disregard all text after a null bye or something similar.

I'm not a cryptographer but that sounds like a good strategy when encrypting very short strings to resist cryptanalysis.

And apparently pictures of credit cards for some reason.

I had several legitimate businesses ask me for that. Thankfully they were fine with obscuring all but the last 4 digits of the card.

I don't get why they do it though. Faking a card photo is trivial so anyone trying to defraud them will just do so. These guys can manufacture physical replicas of cards to cash them out at ATMs, do the companies really think they won't be capable of altering a picture?

I'm assuming someone somewhere told them to do it and nobody took a minute to actually look into it deeper and realise how easy it is to exploit (and thus useless at preventing fraud).

> someone somewhere told them to do it

And/or it ticks a checkbox in some compliance checklist.

now THAT is ridiculous.

To pay for enrollment in their iOS dev program (to publish iOS apps) Apple asked me to FAX my credit card data to a USA phone number so that they can charge it manually. Told me that that was the only way of enrollment from my country of residence at that time. Things changed now and they allow online payment but that was also ridiculous. They literally had a form on their website that I printed and filled in my CC data to appropriate boxes. Then had to find a fax machine to send it.

To be fair I had to use this very process to book a hotel in the Caribbean just last year - a hotel owned and operated by a British company!

So Caribbean hotel, adult streaming site and Apple can be compared as on the same tech competency level for online payment without blinking. Okay, didn't expect that one today.

I don't think a hotel in the Caribbean, regardless of the owner, quite compares to one of the richest computing companies in the world.

You'd be surprised but established brands like Arcteryx ask their customers to email pictures of their passport and credit card. Email. Pictures. Yes, you've read that right. Given how stupid such request is (from data security and privacy points of view), I'm sure they treat that data properly. /s

Many "legit" crypto exchanges ask for these kind of infos as well.

Parent’s full names? That seems weird

Leak contains photos of identity documents from many different countries and some include information about parents.

FYI: all cam model websites do this and hold onto it. i.e manyivds, mfc, onlyfans, etc.

I'd imagine "hold onto it" can mean "printed copies in a vault" instead of "readily accessible online", though.

yes but unless you go into a major porn studio in person and they scan it all, etc there. Its likely to just stay in the digital system. You could say the same thing about printed copies. Do you really want them printing out everyone's photos and trusting them to delete the online versions (what if you just sent it via email). Do you trust them to properly secure a filing cabinet? You know its easy to pick a lock on one of those too.

generally I agree, but I can understand why they did it. If they're accused of allowing underage models they'll be in a spot they definitely don't want to be in.

There was a case years ago of a man who was on trial for child porn. It took the actress physically coming into the courtroom and showing her ID before the case was dropped.

It's just a really scary place to be in terms of society and the law, so I can understand making the decision to do the 'wrong' thing in this instance.

If you're sufficiently paranoid to want to hold onto this data, it should at least be kept in cold storage. And it's not expensive; I can walk over to Best Buy right now and pick up a hard drive big enough to store this data with cash I happen to have in my wallet.

> right now and pick up a hard drive big enough to store this data with cash I happen to have in my wallet.

You do know that the legal recordkeeping requirements mandate specific indexing and cross-referencing requirements, and that the age records must legally include copies of portions of every covered piece of media sufficient to identify the performer against the photos in the age recors, and also must include cross-reference to every individual full work.

If your media is live streamed, it doesn't seem to me likely that you could meet the requirements with an offline system.

> If your media is live streamed, it doesn't seem to me likely that you could meet the requirements with an offline system.

You store all the PII offline and assign each performer a unique identifier. Then tag each stream with the unique identifier.

Why would that not work?

> Why would that not work?

It would work if the law is applied on such a way that the list of media retrieved by querying using the performer ID on the media server is acceptable as the listing of depictions that is required to be part of the age verification records. It's pretty clear in the combination of statute and regulation that either hardcopy or digital records can be used, but it's not at all obvious that a hybrid of that particular form satisfied the requirements. From an information management perspective, I can see it making sense; from what I've seen of administration of legal rules I can see where it might not be. Especially in an industry that politicians (and lead US federal prosecutors are all a brand of politicians) like to score points against, I would expect people to be extremely conservative about uncertain legal exposure; you don't want a setup where you have a decent but uncertain argument of it goes to court, you want one that would never give anyone a reason to think it was a viable pretext for legal action against you in the first place.

Would printing out screenshots of the video constitute copies of portions?

If so, there's a simple solution, albeit one that involves hiring a decent-sized staff of file clerks: whenever a model uploads a video, have a printer start spewing screenshots and have an file clerk grab a selection of photos that both identify the video and clearly show the model's face and put them in that model's file in the cabinet.

I did not know this!

I guess today was my day to put my foot in my mouth for assuming that I can solve complicated systems with a "why don't you just" :/

It is not that difficult to achieve with documents, actually.

that's a fair point. I'm not saying they didn't make mistakes, just that I understand why they held onto the ID's in this case.

There could be a regulatory requirement that law enforcement must have automated access to the resource at any time. Wouldn't be the first time the Government build a road to hell with good intentions.

It's very rare law enforcement requires (by law) a realtime, self-service access to information.

Companies just choose to give them realtime access because they charge an admin fee for data access, and if it's realtime, they'll earn more.

Also data retention policy: automatically purge old data when it is no longer actively being accessed

Well, no - this data could be relevant ten years from now, if they’re accused of allowing an underage model after the fact. They need this data to protect themselves, and they need to have it accessible for the rest of their lives.

This is quite incorrect. Most jurisdictions have record retention policies that explicitly state that you're allowed to dispose records after a certain period of time (usually based on record type). After that, even if the record would be relevant to a case, you cannot be held liable for having disposed of it.

source: i work in this field

Isn't there a better solution involving offline storage? Keeping the data online is likely exposing it to insider threats as well.

Isn't there a statuate of limitations?

There are many, but capital offenses have no limitation, and there are many potential capital offenses. However, that shouldn't really be an issue here, because any business can commit a capital offense, but we don't require every business to record every bit of information about everything they do in perpetuity just because they might commit a capital offense one day. Innocent until proven guilty.

I think that there is a limit on the required period of record retention but I keep failing to find it.

But I don't think it is short, and it at least extends as long as you are selling the material to which it relates, since it is expressly illegal to sell depictions without the records.

If the data is to protect yourself against criminal accusations, there's not really a time limit after which data can be safely purged.

They could be accused many years after the fact.

Often the law that stipulates you need the record, also stipulates how long you need it. Good data hygiene is to retain in it for as long as necessary, and no longer.

It does not. They use old footage of models indefinitely and can be accused at any time of distributing such materials even after they’ve stopped distributing it when clients are found in possession.

Welll, i wouldnt keep it on a system on the web. This belongs in cold storage in their legal dept.

The actress had to fly from Spain to the United States to testify all because an “expert” said she appeared to be a minor in the material in question, iirc.

That data needs to be in a filing cabinet in case law enforcement are investigating accusations of a crime, likely with a warrant. There's absolutely no reason to be keeping such incredibly sensitive information, which presents a severe risk to the person's livelihood and life, on a public facing server because no one - absolutely no one - has any reason to be querying it from the public internet.

And people went to jail for the Traci Lords fiasco in which she was the one who faked all her ID documents.

Note that compliance with the age verification laws is required, but does not (even now: they didn't exist at the time of the Traci Lords incident) give you “safe harbor” from laws criminalizing sex with minors, child pornography, etc. Not all of the applicable laws require knowing that the minor is a minor for a violation to occur.

Not all the laws require the person actually be a minor either. Or the person to actually exist.

That sounds like a case of guilty-until-proven-innocent, unless he was required to keep records like porn producers are.

In which case they should encrypt the data and store it at an offline server.

Some implementations and interpretations (iirc, Great Britain for one) don't even require that the person is a minor, only the appearance and illusion of, including animation/illustration.

Encrypt each data set with a public key. Have the private key in a bank safe.

That way, if they need it as proof, they can just decrypt the data set. But if the data is stolen, it is of no use for the attacker.