Senate Environment and Communications Legislation Committee [Part 2], , 1:30:51 to 1:55:18
Senators examine the use of 'sock puppet' accounts for adversarial testing of AI and social media platforms. The discussion covers the proposed Digital Duty of Care Bill, addictive design, and age verification in the gaming industry.
Topics: Online safety, Artificial intelligence
Speakers: Julie Inman Grant, Senator David Shoebridge, Senator Malcolm Roberts, Senator Nita Green, Ms. Heidi Snell, Speaker 1, Speaker 5
>> thank you. You could use the sock puppet power to create a fake account yourself and test out the capability of AI to produce that material or deep fakes for that matter and if successful prosecute them. There aren't that many AI companies. Is there any other way to achieve that same objective without sock
>> Well, the reason I mean test accounts or research accounts or what are colloally referred to as sock puppet accounts are pretty commonly used tools by regulators. And the idea is that you're right now we send notices, they give us answers. One of the only ways we can test the claims is by testing them ourselves. And so let me give you three examples of uh how we would or would like to be able to use these these tests now. So that with the social media ban um you know they're providing us not notice and we're doing research but the only way we can really test how well calibrated the triggers are for each platform is whether we're setting up an account as a 13year-old to see whether or not the rage assurance is triggered. that will tell us whether or not it's it's um working accurately or will give us an indication. Um another example is the one that you put forward. Um you can't prove in a court of law necessarily from a set of images um that that application produced them unless you do some adversarial testing. You provide them pro prompts to try and get them to create child's sexual abuse. And once you have that evidence, then you can bring it into a court of law. The third example would be um what we actually had to do with respect to roadblocks. We asked them to to take um put 10 significant safety protections into place, including preventing adult accounts from contacting child accounts without explicit parental consent. that they said that they had done that. we used avowed what we call avowed accounts. We told them that we were we were doing that and we tested to see if the parental consent was being triggered the way that it should. We were not satisfied. But what was interesting is when you uh you are in a vowed account, they can obviously through intrusion detection see that you're in their systems and it means that they can they can clean up and they can change things as you go along. There is there is um you want to be able to test in a way that they're not that they're not trying to change things as you go along so you know how their features, systems, and processes work in practice. And you you want that confidence when a child is undergoing the same actions that they're going to get a consistent safety response.
>> So in every scenario that we've heard to justify sock puppet puppet accounts, the use is limited in time. 7 days seems to be the longest it would be needed. So miss grand or the minister could you have included in the digital duty of care provision to only operate so sock puppets for limited periods and publish the name and use of the account on a public register on a monthly or quarterly basis postto so the public can have confidence you are using the powers as intended not running a propaganda exercise under the guise of public safety that would restore confidence wouldn't
>> yeah well um Senator this is a question for government but for just for the record we would never This is about testing systems and processes. This is not about individuals. It's not about surveillance. There is no precedent that we had set that
>> may not be with you. It may not be with you, but it could be in future.
>> Okay. Um well,
>> it's not just okay. That terrifies people.
>> No, of course. And I understand that and I think if you look at the current bill visav the exposure draft that some of that is is um that requires transparency reporting. Uh this again is a question for government but if there gave you greater comfort that there was a purpose limitation for these kinds of testing I'm sure we could work through that too.
Well, the the problem seems to be the intent, as many many people across Australia see, is to control and to suppress everyday Australians. There are there's a lack of tight definitions of destructive behavior and there's lack of responsibility on people who post as well as people who distribute. In other words, if I post something nasty or offensive, then it should be on me as my responsibility as well as the platform I'm using for distributing it should be on both. So the these are things that are that indicate to to people that the the intent is to control.
>> Uh can you can you just um sort of provide me with the evidence um or of that earlier supposition you made about surveillance. We're not a law enforcement agency or an intelligence agency or or a national security agency.
They're very concerned after the co response about government control of people. >> broad government control that can be used by a future government to create
>> I that's why I think a purpose limitation uh that's very specific could give a degree of comfort
>> based on behaviors. But I think the back
>> Senator Roberts, I'm going to need to share the call in a moment.
>> Okay, I'll come back.
>> Senator Roberts, if it assists you, the the bill's obviously before the committee. There'll be an inquiry into the bill. You can ask more questions >> and we'll get a chance to respond to some of those points.
>> Minister, you'd be aware that many people are deeply concerned after especially after the first draft that
was taken back. Senator, I I'm not going to get into the views right now because I think for me to respond in a full way about the what I think is happening online, which I I would characterize as misinformation about what is actually in and what isn't in the bill. >> I think for you and I to have a full discussion about that, we would probably need to do that in another forum. Um so what I will say is that um there is a Senate inquiry [clears throat] that the chair is going to handle and we'll be able to explore the bill in a fuller way through that process and I'm sure there'll be a parliamentary debate as well.
>> Okay. The the key points I [clears throat] would make is responsibility.
>> I'm not in a debate with you about this
senator. I think the chair is actually >> not after solutions now >> and also I'm saying that you're wrong
definition you are wrong and and I and it would be very helpful if if um the intent of the bill um and the actual provisions was discussed >> instead of some conspiracy theory about labeling me. No. Yes, Senator. I'm I'm very concerned that there are some ill >> that'd be great. Thanks. We can get you a briefing on the bill if you like.
>> Yes, please.
>> Fantastic.
>> Wonderful. Senator Shouage.
I'm trying to think of a term apart from sock puppet, but a um an assumed identity.
>> A testing account.
>> Yeah, a testing account. Um, it's common practice in Europe for researchers to have testing accounts and largely to hold these big otherwise unaccountable platforms to account to to to actually go onto the account and test if what they're saying is true.
>> Exactly.
>> To determine what the experience is, for example, for a 16-year-old, and they may not be 16, but to see if the asserted protections in place for a 16year-old are actually in place and and to test these platforms in real time. and they have been critically important to holding these platforms to account um particularly with researchers and agencies in Europe, haven't they?
>> Uh absolutely. I mean I I think we're past the stage of [clears throat] um you know we ask you a question give us an answer we just take you at your word. We actually if they're not going to prove it and demonstrate it through technical means then as a regulator particularly in an increasingly opaque environment and you know very well that um many [clears throat] of these platforms are becoming more opaque rather than um more transparent and in the age and complexity of AI we're absolutely going to be able um to need to um you know adversarily test the prompts. I don't know if you've saw the tech against terrorism uh report that recently came out um that talked about obliteration of safeguards from openw weight models in um as little as 3 days
>> and and and so um the bill as I understand it the digital duty of care bill puts in place a whole series of quite limited purposes for which these assumed identities can do ensures that there's reporting on it um and ensures that the um um and is one of the most critical ways that millions of Australians can have some kind of confidence um or um or actually some kind of you know transparency over whether or not the assertions that these big platforms make because they say that they put protections in for young people and often they're not there. They make assertions about the someone's journey through the platform and they're often false. And unless you can put something in to test it, you're relying upon platforms that in my experience have proven utterly um untrustworthy. And that's ultimately the intent behind this, isn't it?
>> Absolutely. If you read Professor Laura Eden's [clears throat] report on buried, missing, or gosh, what I can't remember the last broken, buried, or missing. It's it's a it tests 80 different >> feature [clears throat] safety features that you know if they were be to believe that um you know we're all working as planned or could be discoverable >> um but this is kind of the game that is played sadly. I mean, I'm just thinking of an example uh of when um Instagram came in to tell us that they were moving um in likes and there was you know big fanfare made about it and then I I don't know what the amount of time was whether it was month or a year but all of a sudden the likes were back but there was no >> communication about that or more explanation um
>> for for those politicians who trust Meta uh For those politicians who trust Elon Musk, for those politicians who trust, you know, big tech, maybe they don't want this, maybe they're quite happy having big tech self-regulate and make untested assertions. But I can tell you now, my party believes there needs to be a way to not just trust, but to verify and we can see a rationale behind this. Um C could I ask you a matter um that's been raised with me by a number of people um who pretty much love online gaming and it's what Steam has been doing about introducing a new age verification system that is limited to credit cards and um last time I checked barely half of Australian adults have credit cards. Almost no kids have credit cards. This is a a um said to be for an age verification purpose, but it what it's meant is that so many gamers can now not get access to Steam, can't get their updates, can't get their games. So, are you challenging? Are you pushing back against Steam because this seems an unreasonable requirement?
>> Yeah. Um we agree and we think it it it doesn't meet the fairness bar that has laid out in the head headco terms. Um, you may have seen that we did a much more comprehensive transparency report around a number of online gaming systems. We looked at Roblox. We looked at Minecraft. Um, we looked at Fortnite as part of EP Epic Games. And then Valve and Steam. Valve and Steam were definitely um uh had fewer uh safety interventions than the rest.
>> Um, now Steam have said though, they've they've put you in it. they've said, "Oh, this is because what e safety has demanded."
>> Um, well, they they also were not a part of any of the development of the codes >> um throughout that process and the really the only one of those um companies. So, all they had to do is, you know, read the guidance that the the gaming industry themselves built. We we have reached out to them. We've told them that um we think it's problematic and that people are effectively blocked from being able to use their platforms. Um they said they will be looking at alternative methods but they didn't give us specific dates [clears throat] as to when that will be
>> Are there any >> are there any actions you can take given it doesn't appear to be meeting the um the accessibility and reasonable codes in um provisions in the code is what actions can you take if steam don't change their position and allow other people allow people to find other more reasonable ways to prove identity
>> if if they don't and and as the commissioner has said we have been engaging with them and they have committed to um explore further methods of age assurance um and so we'll continue to engage with them at this [clears throat] stage. If uh they don't then there are a range of options which we would need to consider um as part of that as a first step um the under the codes we can issue a direction to comply. So, if we were to form a formal view, which I would say we haven't formally formed a view that they're not compliant yet because we're still engaging with them. If we were to form that view, then we could look to issue a direction to comply. And if they then didn't take further steps, then we would look to enforcement action. Um, if we, you know, obviously that is then subject to legal advice
>> because it's causing a lot of anxiety. Well, if the quantity of concerns been raised with my office is any indication, could I ask you, Commissioner, to um have some ongoing public reporting about where this is up to with steam? Okay. >> Um so there's some transparency about it because it's creating, you know, not just frustration, genuine anxiety amongst people.
>> Uh yep. Um I I I think I'm happy to do that. Um I don't think we put any time restrictions on them, but we've we've >> given them notice. we've given them are, you know, I just want to make sure that any communication is is [clears throat]
>> I'm not putting any parameters to
conduct an investigation. We would need to think about how much we would say publicly.
>> I'm not putting parameters around what you can say. If if you're if you're in the process of an investigation, there may be reasons you keep some of that confidential. If you're having productive confidential discussions with Steam, you may keep some of that confidential, but as much information as you can reasonably provide would be very helpful for people because there's a lot of concern about it.
>> Okay. And we could provide relevant updates to your office uh as things
>> that would be in that would also be helpful so as we could respond. Okay. >> Yeah. Um could I ask you then going back onto the duty of care? I mean one of the one of the key addictive elements the platforms have is things like you know auto scroll uh autoplay endless scroll that addictive design. Um do you have a view about whether the concept of addictive design or problematic overuse um is going to be effectively addressed in the digital duty of care? Those seem they're not expressly put in the bill. Do you see a a way in which they will be potentially adequately addressed in in the in the bill?
>> I think those are policy questions that will um eventually need to come out through the inquiry process. Um, I mean, again, it it it it's broad. I I would say to you if that is a concern and you would like to see something more explicit, um, do raise that with the government. Um, I I think it's a legitimate. Uh I'm just was reflecting on the um AI inquiry and Kate Chaney asked some you know very important questions about you know how do you tackle things with a you know we're talking about sick of fancy anthropomorphism in the context of AI chat bots but what about you know emotional attachment and you know h how do you how do you you use regulatory tools beyond uh prevention to prevent that happening. Again, I think it would probably require more testing in terms of looking at source code if we arrived at the opinion that it was um harmful not just for young people but for people more broadly in terms of >> you know how these these um chat bots are programmed to >> further suck people in.
>> Could I ask of just about three quick things on the digital duty of care? Yes.
But before you do, can I I think I've been a bit indulgent um at this point given the way I've enforced these rules particularly against Senator Henderson,
which is to say I was going to stand up
for you, Senator. Um and I I just had a no and appreciate the politeness in the room, but um essentially the advice I've received and the proposition I sent out at the front is we really can't go to the substance of the digital duty of care here today while it's subject to a Senate inquiry. Uh so it is about process and administration. Um so
>> I get it. I accept that. >> Pretend I didn't say digital duty of I given the time I might try and find another way of progressing some matters.
>> Well, but I don't think but I don't want you to try and find a way of rewarding them in order to achieve the same outcome.
>> I won't um um >> I won't do a ruse. So I I hear your ruling and I understand it and I think you we're bound by it, so it's not a problem. could I ask you about um um paid advertising and the extent to which paid advertising relies upon gathering data tracking people's you know um sometimes their physical location um quite often you know those same ads are tracking what people are browsing on getting some building up a data picture about potential customers and then having built up that picture about potential customers then selling that as a product to advertisers. Um do you have any concerns as an e- safety commissioner about about that practice and about how it allows potential noxious players to profile young people to profile women to identify targets for potential harassment or other mischief?
I mean I I have concern about dodgy proc practices like that. I think that falls probably more under the purview of the privacy commissioner. I I mean there there are other questions around advertising that I think are gerine to online safety that we might not be we might not have a nexus in current legislation or even uh in the future. And um one of those is the fact that mainstream uh social media companies and search engines uh that make advertising revenue were we're seeing that they're advertising um CSAM um and nutifying apps and that is con concerning to me. Uh the other thing that's concerning to me is that um we know they have the technology to uh target you with deadly precision with advertising down to you know your child's >> school shoes and you know their classroom yet they they can't seem to um identify the age of the child. That's too hard. Um, and so, you know, when I think about >> the, you know, the targeting technologies that that they have for advertising not being applied to these other challenges. Um, I find that um, quite frustrating.
>> They they can identify my age. They seem to work out where I'm about to go on holiday. They seem to know if I'm hungry, but they can't determine if someone's 16 or 17. these these things don't seem to um logically follow. >> Um um perhaps that's why we need some the ability to go beyond their assertions and put researchers in to find out the truth. >> But um does e safety have any data? Oh, sorry to to go to the social media ban, not the digital duty of care bill. Um does e safety have any data to show whether or not children have been moving to less regulated platforms and if so what is the data showing? Yeah, I
[clears throat] mean we have been following uh migratory patterns both through market intelligence tools um as as well as through our um comprehensive longitudinal evaluation. Uh you might have missed this where we sort of we've seen you know initial spikes uh particularly over the first month or two where kids would be going to Lemonate or Cap Cut or Big O Live or you know other platforms that weren't cap weren't captured. they would download it, but what the behavior we were seeing is that um they weren't actually using it or sticking with it because there wasn't a critical mass of their peers there. So, where uh we're seeing them going more to is to messaging to group messaging platforms or or on online
>> or gaming platforms as well. >> Where there's pretty much no regulation and where they can potentially be interacting with adults in in in private messages. Um are you finding that? Um
well I mean we do have codes uh you know our codes and standards do cover um gaming and you may know we have an enforcable undertaking with um Roblox at the moment over some of those very issues that um you know they were they didn't have u privacy and uh safety defaults at the strongest levels around child accounts and that they weren't when adult accounts were reaching out to children's accounts. we uh think they should be providing specific um and explicit uh parental consent.
>> Um but do you have any you said you've been looking at some of the market studies, you've been doing longitudinal studies. Do you have any um understanding of the numbers just the raw numbers of young people who having been removed from the regulated social media platforms have moved into other more um less protected parts? Do you
only released our first report which
covered the first three months post
implementation. So, in that we have not seen a vast migration to other platforms. It is definitely an indicator we are tracking. So, we're working through um analysis of our six-month data collection right now. So, the next report we we release may have some more insights about that. Um as as mentioned, we are looking at market intelligence and downloads of apps and we aren't seeing um massive trends to new to new specific apps as well. though at this stage it doesn't look like a a massive trend but it is one that we're closely watching and we're aware it could be an unintended consequence.
>> All right. Um thanks chair and
>> thank you very much
>> and commissioner. Thanks for all of your um frank engagements over the course of this committee and your work. Um I'm genuinely grateful for the work you've done on behalf of the public.