philosecurity

I’m down in New York for the Last HOPE Conference, which has been awesome so far. Tonight at dinner, I learned about United States Code, Title 18, Section 2257 for the first time.

For others such as myself who were not aware of it, 2257 is part of the Child Protection and Obscenity Enforcement Act of 1988, which “places stringent record-keeping requirements on the producers of actual, sexually explicit materials” and requires “producers of sexually explicit material to obtain proof of age for every model they shoot, and retain those records. Federal inspectors may at any time launch inspections of these records and prosecute any infraction.” (Wikipedia) Failure to do this is punishable with up to 5 years of jail time and fines.

Now, there is a lot of fallout from this seemingly straightforward requirement. For starters, this means that producers of pornographic material are collecting and permanently storing sensitive information about their actors and actresses, including name, social security number, maiden name, all other names they’ve ever performed under, address, etc. Many people star in pornographic films under pseudonyms for a reason– ie. they value their privacy, and pornography is a sensitive topic in our society. There are many legitimate reasons that an actor might not want their art to be associated with their real name.

Furthermore, consider the current state of information security in industry. It’s a mess. Large companies at least have full-time staff to devote to the problem of securing data, but not small businesses. The creators of pornography, especially small enterprises, are not likely to have the specialized security skills necessary to properly store this information. The best defense is probably to keep it off the network entirely, but actors have little control over how producers manage their data, and no good way to verify that it’s being carefully managed. Even if companies do store their actors’ information carefully today, how can the actors be sure that that will continue to be the case for the next ten, twenty or thirty years? In the current environment, giving sensitive personal information to a company and asking them to store it forever, with no verification of their security procedures, is pretty much equivalent to making it public. Section 2257 forces actors to choose between their work and their safety of their personal information.

In 2007, the courts “ruled that the record keeping requirements were facially invalid because they imposed an overbroad burden on legitimate, constitutionally protected speech.” (Wikipedia) However, the Department of Justice requested an en banc review of that decision, which is still unscheduled. Due to this legal limbo, the law still stands.

I’m guessing that one supposed purpose of this law is to thwart child exploitation, by ensuring that all producers verify the age of their actors and maintain records that they have done so. However, requiring them to actually store detailed identification information places their actors– free American citizens and consenting adults– at undue risk of privacy breach.

The same purpose could be accomplished with far less risk by having producers record other information, such as the actor’s age and manner in which it was verified, rather than store the actual identification data itself. I think it’s unlikely that the law actually protects children at all– if a minor wants to be in a sexually explicit film, they can always get a fake ID. If they’re being forced into it, then Section 2257 is not going to stop the producers (although I suppose it could extend their jail sentences).

Actors in sexually explicit films are free citizens and consenting adults. They should have the right to perform without being forced to give detailed identification information to companies that may or may not secure it properly. At the very least, companies which store this data should be required to provide verification that the data is being properly secured. In my opinion, as consenting adults actors should have the right to perform anonymously if they so choose. Section 2257 may have been created to “protect” minors from exploitation, but in reality it is ineffective, and places many Americans at real, immediate risk of personal data loss.