Age Verification and Aadhar

On the Internet, there is pretty much no way for a site to know a person’s age. The most obvious kind of sites where this becomes a problem are pornographic sites. Of course, there are other sites which trick and manipulate children on the Internet in other ways. How does one identify and protect minors on the Net?

 

To try and address this, California passed a law in 2022 making it mandatory for sites to have checks in place to avoid exposing under-age children to certain kinds of content. You’d think it would be hard to argue against this, right? But this was America. A lawsuit was filed against the law, a court granted an injunction. On what grounds? Free speech rights! (In the US, that one is baked into the constitution and many there hold it almost sacred).

 

Rahul Matthan wrote an interesting post on the matter, contrasting things with India. While the concern of what kids can access and how they are manipulated by web sites holds in India, there are two major differences. (1) First, while our constitution also gives freedom of speech and expression, it also includes the vague term “reasonable restrictions”. Matthan says that while this phrase can be misused, it also means that an equivalent law (to what California passed) cannot be struck down in India as unconstitutional. (2) Second, unlike America which has no government issued digital ID system, India has one – Aadhar.

 

Many in India have (rightly) argued that we don’t want every random website to be able to have access to Aadhar data based on the legitimate need (or pretence) of needing to know a person’s age, explains Matthan. How do we address this valid concern?

 

In principle, we need a way to be able to answer the question (Minor or not?) in a way that does not provide any other information. In cryptography, they call this ZKP (Zero Knowledge Proof). It is a way to convince someone something is true without giving any info other than the fact that the statement is true! This sounds impossible instinctively – surely, to prove/convince someone, you need to show something more than just a declaration of it being true. A few examples of how a ZKP can work in principle will help.

 

The red card proof. Player X draws a card from a deck and announces she has a red card. Is it possible to convince player Y this is true without conveying any other information? Enter the ZKP. X takes the entire deck (other than her card) and puts face up each black card for Y to see. Since a deck has 26 red and 26 black cards, if X can show 26 black cards to Y, then it implies that X had a red card. Thus proved, without Y having any idea which particular red card X has.

 

Take the Ali Baba cave. Peggy says she knows the password to open a door at the back of the cave (the flat line in the pic). 

Victor doesn’t know whether to believe her. Peggy is not willing to tell him the password to check for himself. Is there any way for Peggy to prove she knows the password in such a scenario? Yes, ZKP to the rescue. Here’s how it works. Peggy goes in via any one path A or B (Victor won’t know which). Victor then gets to tell Peggy via which path she should come out of – A or B. If Peggy went via A (50% chance), and Victor asks her to come out via A, well, she wouldn’t have used the password. But if Victor said B, then the only way Peggy could do that was if she knew the password. Do this one time, and it only gives Victor 50% confidence Peggy really knew the password. But repeat it a dozen times and if each time Peggy is able to come via the path Victor called for, then odds that she was just lucky are 1 in 2¹² or 1 in 4096, a very tiny and almost impossible occurrence. In this example, ZKP doesn’t give 100% confidence, but with enough trials, the confidence can reach as close to 100% as one wants for practical purposes.

 

That then is the idea of how ZKP can work. ZKP proofs can be entirely mathematical and implemented via cryptographic algorithms.

 

Back to the Minor or not problem and how India is perfectly placed to answer this. Since Aadhar is a digital government issued ID system, it can incorporate a ZKP style algorithm to answer a site (Minor or not) without giving any other info about the individual. Which is why Matthan says:

“Content moderation is a global challenge… No country will be able to do this effectively unless it puts in place an effective age-verification mechanism… (India) offers an answer that not only preserves privacy, but ensures that content restrictions can be devised to apply only to those in need of protection.”

And ends with:

“Sometimes, solutions lie not in the laws we enact, but in the infrastructure we erect.”