Cybersecurity for Children and Young Adults: Discussion (Resumed)

I welcome Professor Barry O'Sullivan, director of the Insight Centre for Data Analytics in the department of computer science in University College Cork, UCC, and Dr. Mary Aiken, adjunct associate professor at the University College Dublin, UCD, Geary Institute for Public Policy and academic adviser to the European Cybercrime Centre at Europol. I thank the witnesses for appearing before the committee this afternoon at relatively short notice.

Before we commence and in accordance with procedure I am required to draw your attention to the fact that by virtue of section 17(2)(l) of the Defamation Act 2009, witnesses are protected by absolute privilege in respect of their evidence to this committee. However, if you are directed by the committee to cease giving evidence on a particular matter and you continue to so do, you are entitled thereafter only to a qualified privilege in respect of your evidence. You are directed that only evidence connected with the subject matter of these proceedings is to be given and you are asked to respect the parliamentary practice to the effect that, where possible, you should not criticise or make charges against any person, persons or entity by name or in such a way as to make him, her or it identifiable.

Members are reminded of the long-standing parliamentary practice to the effect that they should not comment on, criticise or make charges against a person outside the House or an official either by name or in such a way as to make him or her identifiable.

I remind members and witnesses to switch off their mobile telephones or put them into flight mode. Mobile telephones interfere with the sound system even when muted and will make it difficult for the parliamentary reporters or anybody watching the television or online coverage to decipher what we are saying due to interference. I wish to advise the witnesses that any submissions or opening statements submitted to the committee will be published on the committee website after the meeting has concluded. The witnesses will make a short presentation, followed by questions from members of the committee. I thank the members for almost full attendance this afternoon.

I ask the witnesses to limit their opening statements to ten minutes between them.

Professor Barry O'Sullivan

We are grateful for the committee's invitation to speak on the implications of cybersecurity for children and young adults. The protection of children online is an extremely important matter. One might argue, as we do, that the challenges, threats and dangers presented by the Internet, social media and wider cyberspace to our children and young teenagers necessitate that they are given our utmost careful attention. It is important that this problem space is not considered in separate Government silos, for example, the Departments of Education and Skills, Health, Justice and Equality and Communications, Climate Action and Environment, since in terms of the child's or young person's experience of technology each has a very important contribution to make.

A key concept underpinning the security of our children and young teenagers online is age appropriate interaction with technology and, more specifically, age appropriate interaction with the Internet. The Digital Childhood report of 2017 highlights that the Internet was conceived as an environment for adult users and no design concessions were made for children.

The utopian vision of the Internet was that all users would be equal. If all users are equal, then a child user is treated the same as an adult user and this is why, arguably, the Internet, by default, is not fit for children. The Children's Online Privacy Protection Act, COPPA, passed in the United States has been one of the sole mechanisms to define restrictions on the collection and processing of personal data from children under the age of 13 years, unless verifiable consent has been granted by a parent or guardian. It is because of COPPA that many social media platforms require that their users are at least 13 years old. However, it has not been vigorously enforced in a regulatory context and studies consistently provide evidence of underage usage of mainstream social media platforms. We believe that robust age verification online is one of the most critical requirements to deliver on child and youth security in cyber contexts .

The forthcoming European general data protection regulation, GDPR, which comes into effect on 25 May 2018, will formalise age protective measures online. The EU has set the digital age of consent at 16 years but permits each state to decide a national age of consent that can be as low as 13 years. For clarification, the digital age of consent is not about when a child can access the Internet, it is merely the age at which a child can consent to a profiling of their personal data and that is it. It is not about access, it is just the age at which a child can say he or she is happy to be profiled by a social media company or by a game. Notably, Ireland has opted for 13, the lowest age of digital consent allowed under the GDPR. The Data Protection Bill 2018, which enshrines an Irish digital age of consent of 13, was submitted to the Seanad on 8 February 2018 and is currently under consideration.

On launching the Bill, the Minister for Justice and Equality stated:

The Government considers that a digital age of consent of 13 years represents an appropriate balancing of children's rights, namely, a child's right to participation in the online environment and a child's right to safety and protection, rights that are enshrined in the UN Convention on the Rights of the Child. Provision is made for that in section 29.

It is important to point out that section 29, or rather Article 29, does not actually say this. We are not criticising the Minister at all - this is actually a widely held belief - but the convention does not say that. This claim has been made by a number of respondents to the Department of Justice and Equality's consultation on the digital age of consent, which was held in 2016.

The UN Convention on the Rights of the Child was ratified in 1989 and came into effect in 1990, thereby pre-dating the Internet, online services and social media. The assertion that “a child’s right to participation in the online environment ... rights that are enshrined in the UN Convention on the Rights of the Child” is not quite an accurate statement. If one wishes to bring this Convention into play, attention should be given to Article 17, which states:

States Parties recognize the important function performed by the mass media and shall ensure that the child has access to information and material from a diversity of national and international sources, especially those aimed at the promotion of his or her social, spiritual and moral well-being and physical and mental health.

That is an access issue that is not what the age of consent is all about. Article 19 states:

States Parties shall take all appropriate legislative, administrative, social and educational measures to protect the child from all forms of physical or mental violence, injury or abuse, neglect or negligent treatment, maltreatment or exploitation, including sexual abuse, while in the care of parent(s), legal guardian(s) or any other person who has the care of the child.

Probably most importantly, Article 27 states "States Parties recognize the right of every child to a standard of living adequate for the child's physical, mental, spiritual, moral and social development.” It also states “The parent(s) or others responsible for the child have the primary responsibility to secure, within their abilities and financial capacities, the conditions of living necessary for the child's development.” The important point here is that parents should have authority over when and a young child can and cannot give consent. Notably, Article 1 takes a very age-protective stance regarding the definition of a child, stating that for the purposes of the convention, a child is defined as someone below the age of eighteen years. We will outline in the remainder of our submission, which Dr. Mary Aiken will present to the committee, some of the many reasons Ireland, by setting the digital age of consent at 13 years, is not honouring the spirit of the UN Convention on the Rights of the Child in terms of the risks to a child's security, well-being, physical and mental health. The digital age of consent is intended to provide robust protection for children from those who might seek to target and commercially exploit them. In our opinion, the digital age of consent will also have protective merit in terms of the psychological and social well-being of the child, which in turn will help to deliver on child safety and security.

It is therefore very important, before we move on to Dr. Aiken's contribution, to understand that the digital age of consent is simply about the age at which a child can enter into a contract with a social media company; it is not about access to the Internet.

Dr. Mary Aiken

The Children and Parents: Media Use and Attitudes Report for 2017 produced by the Office of Communications, Ofcom, in the UK highlights that more younger children are going online. I am not going to read out all of the statistics, people can look at them afterwards, but I will just highlight one or two. At present, 53% of three to four year olds are now online, 1% of three to four year olds have their own smartphone and if one looks at an older age group, 83% of 12 to 15 year olds have their own smartphone, 99% go online for more than 21 hours a week and 74% have a social media profile. It is significant that such a large percentage of young people have a social media profile despite COPPA. This represents a major cybersecurity challenge that must be addressed whereby children under the age of 13 have social media profiles. Evidence is mounting about the harmful effects of social networking sites on the well-being of children including sleeplessness, obesity, compulsive use and vulnerability to advertising. Sleep deprivation increases the likelihood that teens will suffer a myriad of negative consequences, including an inability to concentrate, poor grades, anxiety, depression and suicidal ideation.

The statistics are worrying as rates of anxiety and depression in young people have increased by 70% over the past 25 years. Young people say four of the five most used social media platforms make their feelings of anxiety worse. A report by the Royal Society for Public Health report states "the platforms that are supposed to help young people connect with each other may actually be fuelling a mental health crisis”. Insomnia is on the rise and one in five young people say they wake up during the night to check messages on social media. They are three times more likely to feel constantly tired at school. Nine in ten teenage girls say they are unhappy with their body and there has been a surge in teenage girls being hospitalised for eating disorders. According to the HSE, the number has almost doubled over ten years. Arguably these increases are linked to the use of social media, along with the availability of such sites as “pro-ana” or“pro-mia” websites, which encourage and glamorise anorexia and bulimia. These sites also influence vulnerable, self-conscious teens. Notably, the negative impact of these sites, along with the availability of harmful and age-inappropriate online content such as violent, aggressive or gory content involving cruelty, abuse of animals and killings, adult pornography, extremism and radicalisation was highlighted in the Irish Internet content governance advisory group report, to which I was a party. Ireland has one of the highest rates of sexting among young people in Europe. The exchange of explicit images presents a significant security risk rendering young people vulnerable to cyberbullying and to sextortion. In 2017 my group at Europol reported that sextortion and webcam blackmailing has skyrocketed in the past few years. It was noted that victims as young as seven years old are being targeted online. This is a whole new cohort of people who have an economic interest in the child, rather than a sexually deviant interest in the child.

Instant messaging apps are problematic in terms of cyberbullying since they can act as rapid vehicles for circulating bullying messages and spreading images. The National Anti-Bullying Research and Resource Centre at Dublin City University found that new apps and social media platforms are targeting children as young as nine years of age. Children can be reluctant to tell their parents about the bullying because they are worried that their Internet access will be taken away. Victims of bullying are more likely to experience low academic performance, depression, anxiety, self-harm, feelings of loneliness and changes in sleeping and eating patterns, which is extremely worrying in the context of the overall health and well-being of our children. Teachers are front-line witnesses to these problems. Teachers in the UK have reported a significant increase in children as young as four years suffering panic attacks, eating disorders, anxiety and depression. Schools are struggling to access support to deal with the surge in the number of children and young people suffering from mental health issues. The general secretary of the National Association of Schoolmasters Union of Women Teachers, NASUWT, Chris Keates, has warned of growing concern among teachers about a gap in the availability of experts and counselling to help children with mental health needs. A recent survey by the Irish Primary Principals Network reported that a quarter of its members reported a spike in anxiety levels in their schools. The Growing Up in Ireland study of 2016 found that 10% of 17 to 18 year olds reported that they had been diagnosed with depression, anxiety or both by a medical professional; 17% of 17 to 18 year olds - these are Irish children - admitted to engaging in self-harm behaviour.

Setting an appropriate digital age of consent is a complex issue. The decision must be informed by the impact that technology has on the cyber-cognitive and sociological development of children so that we avoid placing them in positions where they neither have the digital skills, nor the understanding of the consequences of sharing their data or aspects of their personal lives. Children need guidance from their parents in this regard.

When it comes to technology and children, the digital age of consent is both a security issue, which is of particular interest to the committee, and a child protection issue. An arbitrary statement that every child at 13 is capable of consenting to the terms and conditions of online service providers is problematic given the potential risks that they face. For example, companies can collect, record and share a children's home and school address, their location, date of birth, photos, phone number, likes and dislikes, who they know, and the content of their conversations, including direct messages sent privately. Not only does that present a security risk to the individual child but, by association, it also presents a risk to the family.

Notwithstanding a young person's right to freedom of speech and to access information, the requirement for verifiable parental or guardian consent for those under the digital age of consent seems entirely appropriate and responsible. The point is that parents and guardians know their child best, and they are the primary custodians of their security and welfare. They are best placed to evaluate properly when it is appropriate to grant consent on behalf of their child. It is only they who can judge appropriately and assess an individual child's level of maturity, understanding and judgment in an online context.

An optimum digital age of consent for Ireland can be informed by best practice in other countries. Notably, liberal EU leaders in child safety and protection online, countries such as Germany, France and the Netherlands, have chosen 16 years as their digital age of consent. The UK will be enacting an amendment to its data protection law to impose a stricter code of practice for protecting children's privacy online focusing on provisions for 13 to 17 year olds who are above the digital age of consent but still children. The proposed UK amendment has several features designed to deliver on cybersecurity, for example, ensuring high privacy settings are switched on by default, not revealing GPS locations, and preventing data from being widely shared. Additionally, the proposed amendment allows for the well-being of the young person, for example, by giving children time off from endless notifications during school and sleep hours and by requiring commercially driven content presented to children to be clearly identified.

The Irish digital age of consent must be informed by the Law Reform Commission's 2011 report, Report on Children and the Law: Medical Treatment. I sat on the Law Reform Commission's group. The report recommended that when it came to persons under 16, there should not be a presumption of capacity to consent. The 2011 report involved the application of a "mature minor" test , which has been applied in a number of states, sometimes in case law and sometimes in legislation, to a wide variety of legal areas involving decision-making capacity of children and young persons.

It is also worth noting that Article 42A of the Constitution , inserted by the children's rights referendum, also recognises the concept of a "mature minor" test. While Article 42A might not directly apply to the age of consent for the purposes of the general data protection regulation, GDPR, the fact that the Constitution now includes a "mature minor" test is worth noting.

The Garda has stated that it has no substantial difficulty with the digital age of consent being set at 16. Let us remember that the Garda will deal on the front line with the consequences and fallout of problems in this area involving minors. It was recently reported that Assistant Commissioner Pat Leahy has criticised the Government for "not serving our children well" with unregulated access to social media websites where they could become victims of online paedophiles. The number of suspected incidents of online child abuse referred to the Metropolitan Police in the UK has increased by 700% since 2014. Reports to the current UK independent inquiry into child sexual abuse estimate that 10% of adults take part in "online sexualised conversations" with children and teenagers aged under 18, as many as 4% of adults have engaged with images of child sexual abuse on the Internet, and 11 to 14 year olds are most at risk from online abuse.

Given the substantial risks to the safety, security and well-being of children and young people online, Ireland needs to put in place a policy framework and an associated educational programme that ensures children are sufficiently aware and responsible to understand and exercise their digital rights by the time they reach the digital age of consent. In the absence of a rigorous basis for any specific age at this point, a prudent approach would be to set the digital age of consent in Ireland at 16. We would both like to say, for the record, that we unequivocally oppose the Government's current position to set the digital age of consent in Ireland at 13 years.

Professor Barry O'Sullivan

I will wrap up. We have a number of recommendations. We are happy to speak to each of those in detail if the committee wishes. Experts, policymakers and stakeholders should come together to agree on a national framework to address Irish children's well-being, safety and security online. There are a variety of aspects to that which are important and we are happy to discuss them.

The Government must hold social media companies accountable for underage usage of their platforms. Despite what one hears in the media that this is not practical, it is eminently practical. One also often hears that children drink alcohol underage but that is a problem we have, by and large, solved. There are very specific things we could be doing.

There is a need to stop conflating a child's right to access information online with the digital age of consent which specifically relates to the age at which a child can sign legal agreements with online service providers who gather, profile, sell, and commercialise personal data. We both agree that this conflation has mis-stepped the entire debate on the digital age of consent in Ireland because people think it is about access when it is not. Six lines in the general data protection regulation talk about entering legal agreements.

The Government must formalise the role, office, and statutory powers of the digital safety commissioner, which we strongly welcome. One specific task that could be assigned to this office is the development of a robust system for age verification online. Self-verification does not work. A child simply saying he or she is 13 or 16 is not adequate. One does not enter bars on the basis that one says one is 22 if one is not. Ireland could lead in the area of online age verification. We believe that robust age verification online is one of the most critical requirements to deliver on child and youth security in cyber contexts.

We must develop robust policies and safeguards to ensure that children are delivered content that is age-appropriate and that careful consideration is given to limiting or eliminating advertising to them online. In tandem to setting an appropriate digital age of consent, consideration must be given to making the Internet and social media safer for children specifically, as well as educating children and parents on Internet safely. That is clearly something that can be picked up by the office of the digital safety commissioner.

The report of the Internet content governance advisory group should be revisited. Specifically, consideration should be given to recommendation 12 on page 9, and its possible implementation through the office of the digital safety commissioner, to provide:

[A] common online platform and brand, and offer a helpline, educational resource and awareness-raising function for children and young people, for teachers and educators, and for parents. It should act as a one-stop portal designed to address the likely volume of enquiries, aggregating available support content and serve as a directory/information resource for the general public.

The Office of the Data Protection Commissioner, who is ultimately responsible for implementing the GDPR in Ireland, must work in tandem with the new office of the digital safety commissioner to provide a seamless reporting mechanism for violations of the GDPR, digital age of consent, online age verification, and the provision of safe and age-appropriate Internet content.

I thank the witnesses very much for their opening statements. I invite Deputy Chambers to commence the discussion.

I thank Professor O'Sullivan and Dr. Aiken for taking the time to come here. It is fantastic to have them here. They are both exceptionally qualified in their field and have worked for many years in this area. It is of huge benefit to us as parliamentarians who do not have the same expertise to hear from people such as them.

I am interested to hear what they think is the impact on the formation of relationships. This is something I have been thinking about for quite a while. I have younger siblings and whereas we had to form relationships at a younger age by talking to somebody and meeting them face to face, a lot of relationships are formed now through online social media platforms.

This is having an impact on social skills and the ability to speak to a person face to face or even to contact a restaurant or hairdressing salon by phone to make a booking. Younger people are finding these interactions more difficult because they do not have this experience growing up but they are happy to send text or Snapchat messages. I refer to the impact of this on the formation of relationships. What are our guests' views in that regard? How will this affect these children when they reach their 20s, 30s and so on?

I have other questions. I do not know if-----

If the Deputy does not mind, we will group the questions and then get a response.

Dr. Mary Aiken

Do I need to press the microphone?

No. We will look after that. We will just let Deputy Lisa Chambers finish asking her questions.

Yes, I will finish asking my questions. Another question I have concerns age verification. What are we suggesting? Are we suggesting the child would scan a copy of his or her birth certificate? Obviously, children at that age do not have ID. They may have birth certificates or perhaps school ID cards, but that is the extent of it. How do we go about this verification process in a practical way?

My final question concerns the sexualisation of children at a very young age. We see young girls under the age of ten in particular sending images of themselves that look quite provocative, for want of a better word. Then there are young boys and young men viewing images that are not age-appropriate, which has an impact on how they view women. I would be interested to hear how we might tackle this. I do not think we have seen its long-term impacts yet.

Dr. Mary Aiken

I think the Deputy is quite right: we have not seen its long-term impacts. We, as academics, are only raising these issues now. We do not have the longitudinal studies that show this definitively to be what we call causation according to scientific testing. However, it does not take a rocket scientist to figure out that if an eight year old boy is looking at hardcore pornography, by the time he is 18 he will be damaged as a result of exposure to that content. Coming back to relationships, the Internet is effectively a lean medium. While texting and the connectivity involved in it seem spectacular in that there are so many connections, as humans we are hardwired to read facial expressions. That is how we evolve and socialise with one another. I have been inundated with calls from school principals since this whole debate started informing me of reports coming back from employers of transition year students placed in workplaces to the effect that these kids have impoverished social skills and very poor eye contact and, as the Deputy said, cannot make phone calls, book anything or gather information. This is one of the reasons France has banned phones in primary and secondary schools, not only because of the addictive nature of the device but also because the kids were not socialising at breaks. They were sitting with their devices in linear huddles rather than actually talking to one another and they were not reading emotions well. This was also leading to cyberbullying problems because they were not able to tell by reading someone's facial expressions that he or she was getting upset. The second point raised relates to exercise. We have an increasing problem with obesity in young people. The kids were sitting with the devices and not moving around at lunchtime or break-time. This is something to consider. We are certainly considering it at school level.

The Deputy's point about the hyper-sexualisation of children is very valid. As a cyber-behavioural scientist, I am very concerned about the impact of this on young people. Again, we are seeing reports of young people presenting in clinical environments with chronic sexual dysfunction as a result of being exposed to hardcore content. I put it to the committee that no one will take responsibility for a child being exposed to extreme content - for example, adult hardcore pornography - but whether one is the device manufacturer, the Internet service provider or the entity that generated or hosted the content, basically, when a child is exposed to this extreme content, one is collectively involved in the abuse of the child. I think it is only a matter of time before State agencies such as Tusla will have to become involved with children who have been exposed to extreme hardcore content online. For the record, paedophiles expose children to such material to desensitise them in order to groom them.

Professor Barry O'Sullivan

The question of verification is really important. How does one know that the person online is a ten year old, a 12 year old or a 17 year old? We must develop technologies that make age verification practical. Self-verification does not work. We could consider a variety of options. For example, one possibility is that at the purchase time of a device - in other words, when one buys a smartphone in one's local store - the age of the person using that phone is declared. This needs to be done on the basis of a form of ID. An important point I wish to make here is that many parents are buying devices for their children and one could infer that in some sense they are responsible for the content on those devices. I ask the committee to imagine a situation in a school in which boys are sending very personal photographs of themselves of an adult nature - let us put it that way - to their female classmates. The owner of the phone is actually in possession of images that are illegal. If one discovers-----

Dr. Mary Aiken

They constitute de facto child pornography.

Professor Barry O'Sullivan

Yes. It is in parents' interests that there are technologies that address this. As for other age verification technology we could build, one could imagine solutions based on artificial intelligence, AI, which, based on the manner in which the user interacts with the device, estimate his or her age and ask for confirmation. Another technology could use some notion of a digital certificate that a parent can grant to a child to protect his or her anonymity if that is important to them. That certificate could be uploaded to a platform to prove that the user has permission. The certificate could come from, say, the office of the Digital Safety Commissioner. There are many solutions. One will hear people on the web who hold the view that anonymity is key, but this attitude tends to come from the first amendment to the US constitution and the idea that people have the right to free speech and so on. However, I think if one asks most parents and most kids, anonymity is not important to them and they are prepared to engage with technologies if there is a benefit. If there is a benefit in making the Internet safer, more easy to use and so on, I think people would welcome these technologies.

Dr. Mary Aiken

The American military has an entity called the non-classified Internet protocol router network, NIPRNet. It is an intranet within the Internet. The American military's devices can only connect to this network, which also stops contamination of devices from malware. Why can we not have a NIPRNet for young kids? Why can we not have a technology whereby the device can only connect to a safe area?

Is Deputy Lisa Chambers happy with the witnesses' responses?

This evidence is mind-blowing. There is so much that is in what the witnesses have said that I am finding it hard to internalise it in live stream, so to speak. It is devastatingly pertinent and, thankfully, there is a language relating to it that is coherent. I thank the witnesses for that because this is what we, as legislators, really need to hear. We are getting down to the nub of the matter.

I wish to speak specifically to the Data Protection Bill. Professor O'Sullivan referred to section 29, which acts coterminously to Article 8 of the regulation. We have had before the committee entities that represent the rights of children state with goodwill and solid bona fides that the digital age of consent should be retained or legislated for at 13. Professor O'Sullivan makes the point that there is a distinction to be made between the article and the legislation. In other words - and this is what I want clarification on - is he saying that the article is not about a child's general capacity to enter into a contract?

Professor Barry O'Sullivan

No. The Deputy is referring to Article 8 of the GDPR. I have it right in front of me. It is four lines long and there is also a little rider.

Article 8 of the general data protection regulation, GDPR, states, where consent is required:

In relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

The next line simply states member states can lower the age to 13 years. The only thing that is in Article 8 is a reference to the contract with the individual for the provision of services and it is only about the processing of personal data.

I agree that people have engaged in the debate in good faith, but there has been a conflation between a child's right to access the Internet and information. Nobody disputes its importance provided the content is age appropriate, but that is not what the digital age of consent is all about. For example, it does not apply if no personal data are being shared. Therefore, when someone goes online to do one's homework, his or her personal data are not being shared and one is not being profiled. If advertising is not presented to a person while he or she is online, one is not being profiled. When someone browses Wikipedia or visits the many websites that allow a person to play games, he or she is not being profiled. It is only where one signs up to a service that someone's personal data are gathered and processed.

Dr. Mary Aiken

At that point one is treating the child as a data object-----

Professor Barry O'Sullivan

Yes.

Dr. Mary Aiken

-----rather as than a child.

Indeed. That is where I need clarity.

Professor Barry O'Sullivan

Yes.

I have researched this matter and discovered that under the law of contract in Irish common law which has not been updated or consolidated recently, a minor does not have full capacity to contract. I shall quote the antiquated language used in the law of contract in Irish common law. It states:

Where necessaries are sold and delivered to a minor he must pay a reasonable price for them. Necessaries in this section are defined as meaning “goods suitable to the condition in life of [a minor] ... and to his actual requirements at the time of the sale and delivery".

If this aspect of the law is left in place and not amended, it seems possible that a minor will have the capacity, at 13 years, to consent to the processing of his or her personal data but will not have the capacity to enter into the substantive contract in question on the grounds that it is not one for necessaries.

Professor Barry O'Sullivan

Yes.

In other words, a digital age of consent of 13 years would put us offside in our own common law system.

Professor Barry O'Sullivan

It would put us offside in lots of situations. If the Data Protection Bill is supported as it is written, the only situation where someone under the age of 16 years in Ireland will be able to consent to anything is in signing a legal agreement with a company that gathers and processes his or her personal data.

Dr. Mary Aiken

Under the digital age of consent.

Professor Barry O'Sullivan

In fact, in Ireland someone cannot buy a dog licence at 13 years of age. Next May children could be in a situation where they will be able to sign up to a system that will gather almost everything about them on their device and use it for commercial purposes, which will be highly problematic.

Dr. Mary Aiken

It will include family photographs. The activity does not just compromise the security of the child but also that of the family. We expect parents to parent young children to ensure their safety and security and every educational messaging platform is about parents engaging with their children. However, the one thing that would give them absolute visibility as regards what their 13-year-old, 14-year-old and 15-year-old was doing online is if their children had to approach them to say, "Hey, Mom, I want to be on Facebook, download Kik or be on Instagram," or "Hey, Dad, what do you think?" The one thing that would deliver visibility is having a digital age of consent of 16 years which is already the norm in EU legislation. The proposed amendment would take it away from them.

Professor Barry O'Sullivan

Deputy Sean Sherlock asked why would it be in the best interests of a child to enter into such a contract. I put it to him that there are no benefits, just massive risks. We do not need to advertise to 13-year-olds as they do not have money of their own.

Dr. Mary Aiken

They have a little.

Professor Barry O'Sullivan

Yes but usually not enough to buy fancy shoes, a nice dress, nice trousers and so on. To get around the digital age of consent, if someone is under the age of 13 years, he or she can turn off data profiling. If the company does not gather their data and profile them, the children are in good shape.

I thank the delegation for their excellent information. Did I hear them correctly when they said - I shall paraphrase - that when a parent signs a contract to buy a phone and gives it to his or her 13-year-old, 14-year-old, 15-year-old or 16-year old and images of an adult nature are shared between boys and girls, girls and boys, etc. it constitutes-----

Dr. Mary Aiken

No; it is not where the images are of an adult nature but where they are sextexting images which, by definition, are explicit of an underage child.

What does that constitute?

Dr. Mary Aiken

De facto it is child pornography.

Professor Barry O'Sullivan

Let us say Mom or Dad buys a phone and gives it to her or his daughter. Please remember that young girls do not tend to participate in this activity as much as young boys who will send images of themselves. As Dr. Aiken said, if they are explicit-----

Dr. Mary Aiken

Explicit.

Professor Barry O'Sullivan

-----they are pornographic images of a child. As the device is the property of the parent, he or she should be extremely concerned about what might be on the devices of his or her children.

Dr. Mary Aiken

Ireland has one of the highest rates of sextexting in Europe. It is a social problem but, arguably, normative. Back in the day people went behind the cowshed and played strip poker or spin the bottle, but the difference was they did not take digital images and disseminate them widely. Children and young people or teenagers are sexually curious. The problem with sextexting, as a social problem, is that it is viewed through the lens of the legislation that deals with child pornography. If the child is underage and the image is explicit, it amounts to child pornography. If a 13-year-old generates an image of himself or herself and sends it his girlfriend or boyfriend, de facto he or she is generating and distributing child pornography, albeit of himself or herself. As many as 1,004 children in Denmark are being prosecuted for distributing child pornography because they shared explicit images.

Professor Barry O'Sullivan

I wish to make one important point in response to Deputy Sean Sherlock. One of his questions was about the digital age of consent and another was not about the digital age of consent but online safety. Where they meet is in age verification. If we can age verify online, we can, potentially, eliminate the practice of sharing images. The Deputy's two questions are related but really they are separate.

There is a third strand to this topic on which I suspect Deputy Anne Rabbitte is about to touch.

I thank the delegates for coming. As my two colleagues said, we are blessed to have the opportunity to avail of their knowledge and expertise. Two very different conversations are taking place, as Professor O'Sullivan noted. I shall continue where Deputy Sean Sherlock left off and where Deputy Lisa Chambers started by referring to sextexting on digital devices. I suffered a pang of anxiety while listening to the debate because, no different from anybody else, I have bought mobile phones for my children, one of whom is now 16 years of age. The mobile phone was an upgrade and, therefore, on my account. Any parent listening to this debate and wondering who was responsible for such devices would have got a shock.

Dr. Mary Aiken

The Deputy is responsible for the device.

I know. Perhaps my children who are listening to me also know. All of a sudden there is added responsibility. As the contract is in my name, I own the mobile phone. Even though I give the device as an upgrade, it is still owned by me. If there is one image that is incorrect on it, I will be deemed to have enabled and abetted. Please correct me if I am wrong.

Dr. Mary Aiken

The Deputy is not enabling or abetting but in possession of the mobile phone.

I suspect there is a lot of deleting ongoing.

It is a very serious realisation. Parents give a mobile phone as a present at Christmas time and at the time of a child's First Holy Communion or confirmation. One often hears about peaks in the sale of mobile phones at such times. Another factor is parents do not physically buy a new mobile phone for their child but avail of their mobile phone upgrade package as a way to give him or her a gift.

Dr. Mary Aiken

The problem does not really lie with parents or even the statutory authorities or the Government but with the behavioural sciences which have been blindsided by the rapid evolution of technology.

I first studied psychology before the Internet and computers. Everything changed and I had to go back to requalify for an MSc in cyberpsychology and a PhD in forensic cyberpsychology. I had to do so because the world had changed suddenly.

If one thinks about classical child development, we have Piaget's stages of cognitive development. Parents are told that, by the age of one year, their child should be standing up, by four, saying a sentence and so on. We do not have the equivalent for stages of cybercognitive development. For argument's sake, what is the best age to give a child a smartphone? There are no protocols or recommendations at a statutory level or from the Department of Education and Skills which state that expert consensus agrees on what age a child should interact with technology. The American Academy of Pediatrics recommends that one should not give a device or any screen time to a child under the age of 18 months, yet nobody knows that. One positive outcome would be to bring an expert group together to go through all the information and data we have to date to see if we could formulate stages of cybercognitive development that could inform and advise teachers and parents.

I know there are many lobbies, people talking about banning smartphones and much drama in the media about this. A ban is something else. As scientists, we would be much more in favour of protocols. If, for example, the recommendation is that a child under the age of 14, which is a protective band, is not mature enough to deal with what he or she is exposed to on a smartphone, then, effectively when little Johnny is given a smartphone at seven for his First Communion present, other parents can say that is not fair because it is creating peer pressure. It is actually not working to best practice in terms of the protocols.

Professor Barry O'Sullivan

One often hears of the amount of peer pressure being put on parents as a consequence of their children's classmates having phones. It is a serious issue. If one has a child who does not have access to a smartphone, he or she can be excluded from his or her community and bullied as a consequence. This is why we, as a society, need to sit back and figure out what we want our schools to be doing and how we want parents to behave with each other. If there is a cohort of parents who give smartphones to their kids at certain ages, we should be frowning upon that because it is putting pressure on other families to buy these devices and start putting their kids online. We need to each to a level of maturity to deal with this cultural issue. As Dr. Aiken said, the world has changed enormously. Eleven years ago, when the first iPhone came on the market, we had no idea that we would end up here.

Dr. Mary Aiken

It is not about contact. Kids could have old-school devices. If one takes what is called a dumbphone, which has no Wi-Fi, Internet or camera, that is many problems removed straight away, yet someone can still connect with the child by text or by calling him or her. There are practical solutions.

The witnesses referred to problematic apps. Will they expand on that? When I think of a problematic app, I think of Snapchat and having to have streaks. Children must have 156 streaks or, if they break it, their friends do not think they are friendly with them any more. When going on holiday, they become concerned about Wi-Fi access which is necessary to allow them to keep up with streaks. Children feel compelled and they cannot take a break from anything.

Dr. Mary Aiken

We describe that as variable ratio and intermittent reinforcement aspects of technology, which is a fancy way of saying it is like a giant slot machine. It is far more addictive, however, than intermittent messaging. If every message was good or every message was bad, then it would not be as addictive as occasional messaging. Imagine it as playing a slot machine and every so often one wins. The problem with kids is that it becomes a feedback loop. The phones are designed to be addictive. The average adult looks at his or her phone 200 times a day and touches it 2,000 times a day. High-end users will touch it 5,000 times a day. We are focusing on kids but we have to think about adults' use of devices. Children look to adults in the context of how they use their devices. We must focus on how that influences children's behaviour. If a caregiver to a young child is constantly engaging with his or her device, that means he or she has not looked at the child 200 times and not touched them 2,500 times. That is problematic.

The phones are designed in terms of signal theory. The phone's lights are designed to attract one's attention, as are the vibration and the visual aspects. These devices are designed to tap into our psychological Achilles heel. They diminish us rather than making us better as humans.

Professor Barry O'Sullivan

These apps are problematic because the product is the child and the user. The product is not the app. What they want to do is maximise the extent to which one engages with those apps. If they know that the Deputy and I are in constant contact with each other and she buys something, then maybe I could buy it too. Commerce is the objective. That is why the digital age of consent is important because profiling is the objective.

Dr. Mary Aiken

Without naming the specific app, there is one - available to 13 year olds - in which there is a setting for wanting to engage with strangers. That flies in the face of every educational protocol. Can one imagine a product designed to encourage children to set themselves up to engage with strangers?

Does the messaging of this nature have an endorphin effect? Does it set off a chemical reaction in the brain that keeps people going back all the time?

Dr. Mary Aiken

That is neuroscience. We are not neuroscientists and we will pass on that question. There is a whole debate about this.

Professor Barry O'Sullivan

They are certainly designed to be addictive. They are designed to have people engage with them. There is an enormous amount of addiction theory on this.

Dr. Mary Aiken

There are theories about seeking, stimulating the lateral hypothalamus and producing dopamine, which is a feel-good entity. The science field is still open in actually proving causation.

What about the case of the 13 year olds on Snapchat and somebody has approved it and so forth?

Dr. Mary Aiken

Coming away from neuroscience and back into behavioural science, we certainly see young people effectively crowdsourcing self-esteem by likes.

Professor Barry O'Sullivan

When was the last time anyone walked down the main street with a photograph asking people do they like it?

In a room full of politicians that is not so hard to answer.

(Interruptions).

Professor Barry O'Sullivan

I forgot that. However, politicians do not tend to carry them. Instead they put them up on posters.

Dr. Mary Aiken

With the crowdsourcing of self-esteem, we have to be protective of children as they are going through critical development phases such as identity formation, which happens between nine and 14 years of age. In the case of a child on a social media platform, before he or she has discovered who he or she is and is reconciled with himself or herself, her or she is creating versions of self. For example, are committee members the same person they are on LinkedIn, on Facebook or on Instagram? The child is creating this artefact of self, this curated, heavily manipulated entity. The Royal Society for Public Health report made a recommendation that images manipulated online by means of filters, such as showing brighter skin, shinier hair, or stretched to be five pounds lighter, should be flagged to ensure children are not looking at these images feeling their friends look better than them and they are not pretty enough.

Professor Barry O'Sullivan

The important point about the crowdsourcing of self-esteem is that social media companies have control over how somebody gets one's sense of self-esteem. For example, a person shares the fact that his or her cat has died on a social media platform. No one interacts with that and, therefore, he or she thinks that nobody cares.

It is not that nobody cares, it is just that the algorithm behind the social media platform decides that it is content with which not many people will engage very strongly; therefore, it serves up something else instead and the person is left thinking nobody cares about him or her when it has been decided purely by the algorithm. The mere fact that kids can crowdsource their self-esteem is unpleasant, but that there are organisations that, as a consequence of profiling and trying to maximising the value of their platform, decide how to manage it is really pernicious.

Senator Catherine Noone wishes to come. I have to proceed in order.

If Deputy Lisa Chambers wants to interject on this point, that is fine.

It is a point of clarification for parents who may be watching the proceedings and wondering if they are now criminally liable or potentially open to criminal charges. One knowingly has to be in possession of child pornography. If one does not know that it is on the phone, one cannot be prosecuted. That is an important point for parents who are watching the proceedings. It is something that has to be addressed.

Professor Barry O'Sullivan

That is true, but if parents know that a child is sending their child content, the extent of that knowledge will be in question.

Professor Barry O'Sullivan

The Deputy is absolutely right.

The 1998 Act specifically states a person must knowingly be in possession of child pornography.

Professor Barry O'Sullivan

That is true.

I am clarifying the position in order that parents will not panic.

Dr. Mary Aiken

The point at which they look at the phone and see an image, they have to act.

One has to act.

Dr. Mary Aiken

That is a point we are making.

I welcome the delegates. We are very grateful to have them here. There are many things I could ask, but I have to try to hone in on a number of them that I want to put to them.

I am conscious that this is the Joint Committee on Children and Youth Affairs and that the digital age of consent was actually dealt with by the justice committee. That puts us in a difficult position. I chaired a committee which dealt with an issue on which some people disagreed. I fear that this issue has been decided, but I hope certain individuals can look at the legislative implications on Committee Stage. It is a children's issue. The justice committee was the right place for it to be dealt with because of the Bill, but it is certainly something into which we should have some input.

Education is key. We cannot say it enough. A little like the issue of childhood obesity, we have to come at it from the top, the side and the bottom. It is one area in which children are far ahead of us. It is a little like drug enhanced performance in sport. Those involved are ahead of us all the time. It is comparable to those who seek to partake in illegal activity in sport. It is constantly developing. The advertisers, marketers and all those involved are constantly trying to see how they can benefit financially in all areas and children are a huge target group.

The delegates touched on the banning issue. We have to try to get children off their mobile phones. It is easy to say we cannot ban them and cannot have a digital age of consent over 13 years. How free will we have to be on this issue? My feeling is, having put some stuff on social media in recent weeks, that parents believe they need a helping hand. We need to come at it from a lot of angles, but banning mobile phones would be an extreme measure and, as Dr. Aiken said, might make it more attractive. What is her view on potentially not allowing mobile phones in schools until the age of 14 years?

Dr. Mary Aiken

A ban in schools is a separate issue. It would be too extreme to use legislation to ban smartphones. We could set up rules in schools in order that there might be a ban in a primary school or even a secondary school.

In terms of what happens in the home, we have to involve parents. If we were to have guidelines which state smartphones were not suitable for kids under the age of 14 years, parents would pay attention. It is like underage drinking. We ban kids under the age of 18 years from buying alcohol or being in pubs, but that does not stop parents from sitting down - perhaps a father and a son - with their 17-year-old and having a beer. That is fine in the home and the safety and security of that environment. Something similar could happen with mobile phones. An individual parent might decide that his or her 13-year-old is particularly mature and be happy to allow it. We have to involve parents in the process. I am not in favour of having a prescriptive ban. Banning technology sounds like we are Luddites. We are both pro-technology. We just want to introduce it in an age-appropriate way and to involve parents in the process.

Professor Barry O'Sullivan

Having a ban would be a mistake. What we want to get at are the issues with which we are trying to deal. If we were to ban the technology, we would not be dealing with the issues. The issue is the digital age of consent which I accept was dealt with by the justice committee. As we said in our statement, it is one of the issues that cuts across many Departments.

Dr. Mary Aiken

Health, communications and education.

Professor Barry O'Sullivan

Therefore, we have to deal with it. A ban would not be helpful. We have to deal with the issues of age verification, age-appropriate content and simple things that could be done. If one thinks of reading a book, when getting kids off their smartphones, there are natural stopping points such as the end of a chapter. When one watches TV, one gets to the end of the programme and might go and make a cup of tea or go for a walk. When someone goes on the web or an app, he or she can keep going forever because there is no cue to stop. A smartphone manufacturer could build a very simple cue to help people to stop, for example, the screen could go blank for a minute or two after ten minutes. It could show a little timer on the top of the screen to show how much time has been spent on it. Lots of kids to whom I speak get angry with themselves when they realise how much time they have spent on their device. They think they could have gone out to play or read a book for half an hour. There are simple things that could be done. A ban is not what we want.

What about Internet filtering whereby the default position would be, when a server is placed in a house, it would be precluded from accessing all sites that could potentially be harmful to children? One could opt in if one wished. Would that be helpful for parents who are not very au fait with the Internet or do not have the time to spend looking up how to actually stop their children from doing certain things?

Professor Barry O'Sullivan

These things would certainly be helpful and there are lots of technical solutions. There are products one could buy that could be plugged into the Wi-Fi system at home. There is also a little phone app available. A parent could say, for example, "Tom's device is that phone and Anne's device is that computer" and he or she could decide what the child could and could not access. There are lots of such tools for parents.

In Germany there is IP filtering through a product Cisco has provided free to schools. It is also provided for homes. It is something that would be very easy to do in Ireland because telecoms companies could do it. It would not solve the problem entirely because children would get around it. They would not always be at home using the Internet which is pervasive and everywhere. They are on it 24/7.

Professor Barry O'Sullivan

Every router people have in their homes can do that. It is just that parents do not know how to do it.

That is my point. We need to turn it on its head and take away the fact that parents do not know how to do it. They will have to find out how to opt in. The default position could be that they have opted out. It would not solve all of the problems, but it would be very helpful.

Professor Barry O'Sullivan

It would certainly help.

Dr. Mary Aiken

I know of parents who sleep with the router in their bedroom to stop their children from getting at it at night to change the settings. One thing I say to parents and that I will say to parents who are watching the proceedings is on the issue of parental controls which are always talked about. I ask them to turn on their computers and search for "bypassing parental controls". They will not sleep after doing so, but they will know what their kids know. There will be about 1 million results. There is no one size-fits-all solution to actually solve these problems. There are a lot of small problems.

If we can look at them simultaneously we can create context for problem solving.

Professor Barry O'Sullivan

If I can steal one of Dr. Aiken's great lines, there is no shallow end in the swimming pool. It is all very fine to block certain things and have Internet protocol, IP, filtering but once somebody is given access to an application, such as Snapchat, that person has it. There is no sort of Snapchat light. There are fundamental principles that we must get right.

The bottom line is that for legislators it is hard to know what way to go on this. We want to help parents and we have a duty to protect children. We do not want to have too much of a nanny state approach. There is a fine line for us to navigate. We are relying on experts like the witnesses and those who appeared before the justice committee to tell us where to go with this.

As this is my final chance, I will probably have to squash a few points into it. As legislators, we must make laws for the worst case scenarios, and we have heard many of them in the media recently. There was an awful case highlighted in the past number of weeks where paedophiles were grooming children. I have a friend who is a doctor and she told me about a very difficult case where a parent presented to her. The couple were having problems, which happens all the time, and perhaps they were not focused. They discovered through looking at a device that their child had been sending pictures to a paedophile. The child was only looking for love and affection in reaching out. I know it is not happening all the time and there are so many positive aspects to the Internet - I cannot emphasise that enough - but we must do something about this as legislators.

Dr. Mary Aiken

We must understand from a cybercriminology perspective that the behaviour is mutating all the time. We are considering it at this point in time and saying there are X, Y and Z dangers but at Europol we see a constant mutation of behaviour. Today we have only really been talking about "surface" net, which is approximately 1% of the Internet.

There is the deep or dark net as well.

Dr. Mary Aiken

The rest is deep web and dark nets within the deep web. Increasingly at Europol, we see children entering that domain, which brings a raft of other problems to address.

It is not like years ago when people said children who watch too much television will have problems. There were debates about that years ago. This is a minefield and it is not comparable in that sense. We are not being overly cautious or ultra-conservative to be concerned about this.

Dr. Mary Aiken

Not at all. Societies are not judged by how they deal with the strongest members of society. They are judged on how they protect the most vulnerable. Great societies protect the vulnerable.

Professor Barry O'Sullivan

It might come as a shock but the average teenager in Ireland spends approximately four and a half to five hours per day on their smartphone devices. That is a lot of little amounts of time.

They are not reaching developmental goals.

Professor Barry O'Sullivan

Yes, as they are being distracted. The Senator knows that if somebody knocks on the door, it is a distraction and one might not be able to get one's head back into a process for quite some time. There are all sorts of issues in this regard. We need prudent, almost conservative, legislation on when we take parents from the equation. That is where we find the digital age of consent as a problem, as legislation has gone completely the other way. The thinking might be that we are giving kids access to the web but we are not; we are taking parents out of the equation.

Yes. I cannot get my head around that at all.

Professor Barry O'Sullivan

We must get online age verification right and we must take it very seriously. There must also be age-appropriate content. Those are the three key elements of the legislation.

To clarify, does that come within the remit of social media companies?

Professor Barry O'Sullivan

Yes.

I thank the witnesses, who have been extremely insightful. I sit here pondering what has been said in the past 90 minutes. I worked in the sector before but with the amount of information that has come at us today, I am still trying to process what was said earlier. If I am still trying to process it, we can imagine what a parent might be going through in watching this. It all leads back to education. If a person knows and understands the issue, he or she can combat it. If somebody does not know the warning signs, he or she will be hurt. That is down to a lack of education. If there are to be recommendations from this committee, they will be about how we educate people on this. It may have to go before the education committee as well. The matter is evolving and we need underlying education to be able to have the wherewithal and be able to think outside the box in watching for the warning signs. It is an imperative.

The witnesses mentioned protocols and I assume for particular age groups there would be protocols or a methodology or best practice to follow for the ages of 12, 13, 14 and 15. I am homing in on those age groups. Our biggest challenge is trying to lay down that first blueprint, taking from other jurisdictions, so that in five years it will only have to be tweaked as things move on. That might be a recommendation.

We might be using the wrong vocabulary in saying the age of "digital consent". Given the comments from the witnesses, it should be the age of "data consent". It might make more sense. It is confusing and straight away people might ask if they can access the Internet. I would say data consent rather than digital consent. There is also the question of social media companies controlling self-esteem; that means an algorithm controls self-esteem, based on commercially driven ideas. Again, this goes back to education. We must tell our kids at 13, 14 and 15 that certain things happen on social media that people, including children and parents, do not know about it. It is a pitfall.

The witnesses mentioned the number of children starting to interact with the dark web is increasing. Why is that?

For the information of witnesses, next week there will be two groups before us. They will be the Internet Content Governance Advisory Group and four Ministers, including those responsible for education, children, communications and justice. It is important in putting together a final opportunity to extrapolate from everything we have heard over the past four months. The most important aspect gleaned last week from our interactions with Comhairle na nÓg and secondary school students was their first-hand experience. Even those teenagers expressed the requirement for education to take over pretty much every strain of this debate because knowledge is key. In all of this information presented to us, which is very helpful, the important point highlighted by Comhairle was that just 20% of parents were cognisant of what their teenagers or children were doing online.

Dr. Mary Aiken

There is a point on education. When we consider matters in society, we do not solely rely on education. We have tried education for a decade or 15 years but it is clearly not working, as evidence indicates that problems are getting worse for young people. We must say that education has a role but we do not solely speak of education when it comes to the likes of a smoking ban. We do not just speak of education when it comes to underage drinking. We have multi-strand approaches to the problem space. One could say to kids all day long not to climb a tree as they might fall and be hurt.

It is definitively not going to stop them. Knowing that they can fall from a tree will not stop them trying to climb it.

I thoroughly agree.

Dr. Mary Aiken

That is what kids do.

We are deficient in education as part of one strand. I agree with Dr. Aiken that it should be across the board but we are extremely deficient. I have learned stuff today that I did not know and parents have learned stuff that they and their kids need to know. Mention has been made of algorithms and social media and the effect on self-esteem. People need to know this so that when turn on a telephone, they are copping on to what is going on as opposed to being affected by it.

Professor Barry O'Sullivan

Education is important and it needs to go hand-in-hand with a structure that holds. There needs to be responsibility on all sides in some sense. Some parents might hear "education" as them being criticised that they do not know enough but this is a multi-way street. The social media companies have an obligation, and we, as a society, have an obligation to put in place the rules of the games, digital age of consent and so on but education needs support. I agree with the Deputy that the digital age of consent might be misunderstood as a term. It has not been referenced or named in the GDPR and, therefore, it is not called the digital age of consent. It has become the term that people identify it as.

The warning signs are often not all that obvious until it is too late. There is a nice statistic, which says that the average teenager has seven online personalities, of which a parent is only aware of three. There are other ways in which a teenager or young person presents himself or herself online, perhaps through multiple accounts or multiple platforms, and the problem is that once the parents are taken out of the equation, they are no longer required for consent. We have to sort out the age verification issue carefully, as Deputy Chambers said. We cannot even throw a loop around the issue and figure out how to address it because it is multifaceted. Protocols rather than bans should be implemented because people do not respond positively to bans. That drives issues underground and we do not deal with them and so on.

Is the future dystopian or is it hopeful?

Professor Barry O'Sullivan

Absolutely hopeful.

Dr. Mary Aiken

It depends. It is hopeful if we pay attention and make changes. From where I sit in the world I operate in Europol, the awful cases we have seen so far are the tip of the iceberg in terms of what is coming. I can say that categorically and definitively. We are facing a tsunami of these types of cases down the line.

Dr. Aiken said the children's interactions with the dark web are increasing.

Dr. Mary Aiken

The deep web. There are darknets within the deep web. I will not give a guide on television as to how that can be accessed.

What is behind the behaviour? Why is that happening?

Dr. Mary Aiken

If one points to the haunted, spooky house on the hill and says, "Do not go there", it becomes attractive to kids. The answer to how they get into the deep web lies online. It is straightforward and parents would be horrified to know where their kids are. Cyberspace has to be conceptualised as a place, which is a paradigm shift. There is the real world where we are and there is cyberspace. NATO recently recognised cyberspace as a domain of operations and a domain of war, thus recognising that wars of the future will take place on land, sea, air and on computer networks. Now that we are at the point at which NATO is saying this is a place, we need to pay attention to that. We have to conceptualise cyberspace as a place, we have to think about our kids going there and then we have to think about the symbiotic relationship between what happens in a cyber context and the real world. One impacts on the other and there are consequences. The EU conceptualises the Internet as an infrastructure similar to a railway or a motorway but it is anything but; it is an entity that has the ability to have a profound and pervasive impact on humankind - on the individual in a psychological context and on the group in a sociological context.

We are passionate about this and we do this work pro bono. We volunteer our time to do this because I do not want to look back in ten or 20 years and say: "That happened on my watch. I could have informed policy." As policymakers, do members want to look back and say that this happened to all these kids on their watch? That is what motivates us.

Professor O'Sullivan said that social media companies could have a default setting whereby they switch off data profiling for those aged under 13. Is that his proposal?

Professor Barry O'Sullivan

I said that the issue of age of consent is related to profiling and if one is using a service that does not profile, then one is just using the service but, of course, the product is the profile. We want that to some extent. We want Netflix to tell us about a movie we might like to watch.

Dr. Mary Aiken

Maybe not.

Professor Barry O'Sullivan

When the services we use profile, they can make better recommendations to us. If there was a setting to turn off profiling, that would help but it would not solve all the problems.

Dr. Mary Aiken

If the Deputy likes gardening, he may get caught in a filter bubble that pushes gardening content or if he likes working out, the filter bubble might push gym wear and sports wear, but what happens when a child gets caught in a distorted filter bubble, say, for radicalisation or an eating disorder? Who is protecting the child then? The algorithm does not know it is dealing with a child. Why would parents hand over their 13 year olds to technology companies to raise them? I do not understand. If parents could understand what this is about, there would be uproar at these sites saying, "Give me your 13 year old". That is not acceptable because 13 year olds are children. Lobby groups have mentioned the UN Convention on the Rights of the Child, but the convention states that a child is anybody aged under 18, not 13.

Dr. Aiken mentioned that liberal EU member states such as Holland, France, the UK and Germany have enacted legislation making 16 the age of consent. Have studies been conducted on the benefit of that in comparison to the previous age of consent or is it still too new?

Dr. Mary Aiken

That is a good question. We hope that in the consultation process the departmental officials will speak to colleagues in France and Germany and examine the rationale behind that. That is a question for the Department of Justice and Equality because we are not privy to all its consultations. Germany has adopted a protective stance for a long time regarding what is deemed to be a child. The age of a child is 14. The Internet content governance report points out that Germany has active take-down notices for self-harm content, forcing internet service providers, ISPs, to take down content and cutting sites. A cutting site is a site whereby if a child posts a fresh GIF or short video of bleeding when he or she has just cut himself or herself, he or she will get "likes" for that. It is despicable that young children are exposed to this content online.

With regard to an eating disorder, if an 11 year old suddenly says, "I am too fat" or "I hate my body and I am going to starve myself", that child will not get any support at home or in school, but if he or she goes to these sites, he or she will discover an entire community who will say, "Not only is 6 stone too heavy, you should be 4 stone". I do not use the word lightly but this is evil online in terms of targeting children and we have to do everything we can to protect the child.

Professor Barry O'Sullivan

With regard to the question of why the age of 16 was chosen, in some sense, no evidence is necessary because this is a prudent measure to take. The child loses nothing. Once he or she has a parent who says he or she can sign up to a site, he or she is on and that is it.

Once the parent feels comfortable that they can go online then they can go online. There is no downside.

Dr. Mary Aiken

Not going online, going on social media.

Professor Barry O'Sullivan

Yes, on social media or sign up to some service that profiles them. There is no downside and there is every upside to having the age older. It is a no-brainer.

Have there been any studies done with 16 year olds compared to 13 year olds who may be online? It is a broader issue with social media and interaction and all that.

Dr. Mary Aiken

I understand the point Deputy Neville is making and the answer is "No". There is no developmental reason an age should be 13 or 16. There is, however, a legal reason. The law has to focus on a point, on the 16th birthday or the 13th birthday. In psychology we never say that by the age of 13 all children are mature enough to do X, Y or Z. We always talk about age bands. When we make a recommendation we make the age band slightly older to allow for the fact that children develop at different stages. If we say that the digital age of consent should be 16, then we are talking about protecting 13, 14 and 15 year olds while fully acknowledging that some 13 year olds might be more mature and their parents might say "Great, go on Facebook and do what you want". Some parents, however, might be a little worried about a child having Instagram and various images where the child may be fussing about his or her looks and have self-esteem issues. Parents may feel they should withhold that particular platform or may feel that the child is okay on one platform and not on another. Why would we take that power from parents? From the perspective of liability, why does the State want the responsibility of now being responsible for everything that 13, 14 and 15 year olds do online because the State has chosen to make the legislation this way?

Professor Barry O'Sullivan

The State is proposing to enact legislation that is going to make one single exception to consent law in Ireland; the only thing a person can consent to at 13 years of age is to have his or her data profiled on a social media platform. This 13 year old person will not be able to buy a licence for a pet dog but he or she can sign up to a social media company, which can present to the 13 year old person a view of the world based on his or her personal data, with no evidence that this will be helpful to that person.

Dr. Mary Aiken

It would also be able to manipulate a person in terms of how his or her personality develops and how the self develops.

On the representatives' opening statement and the conversation they have just had with Deputy Neville around education, Dr. Aiken has said that education in this regard has failed. Deputy Neville has highlighted the fact that it is deficient. I do not believe that deficiency is a failure but, as a parent and as a legislator, I believe that the basic principle behind all of this is that we are woefully ill-equipped to deal with the ongoing issues of online security, bullying and everything else associated with the matter. This applies to adults and to the current generation coming through.

Last week a young lady, I believe she is 16 or 17 years old, was sitting in the same seat as Dr. Aiken is sitting in now. I asked her about the possible ban. I was not aware that she had studied in France but she chimed in and told the committee that she had spent three months there and she had a very interesting insight into the ban on phones for young students there. Senator Noone touched on the issue earlier and Dr. Aiken has referred to it also; bans are crude instruments that invariably do not work. The bans will not capture everybody and usually the individuals who find a way around it are often the ones who require the most assistance.

I do not want to be pernickety about these things but as he is a member of the Garda I wish to make a correction; it is appropriate to say that Assistant Commissioner Pat Leahy did not criticise Government policy. He lamented the fact that there was a deficiency in legislation with regard to a particular case. He did not, as stated in the Irish Mirror, slam the Government. I would never rely upon it for a quote. That is a personal observation. I am of the view there is a massive deficiency in criminal law and criminal justice around the grooming of children. This has also been referenced a number of times by Dr. Geoffrey Shannon and by the Law Reform Commission. Some of these deficiencies have been highlighted to the committee already and the witnesses' contribution to the debate today has been excellent in that regard. I thank the witnesses for that. From my perspective, however, and to go back to the educational aspect, a figure of some 80% of parents did not have a clue what their teenagers or their younger children were up to online. This is a societal failing and a failing of our education system. It was suggested that there be mandatory requirements for programmes to be introduced to third level training for teachers at primary, second and probably even third level where first and second year students are still in their teens and exposed to the sort of environment the witnesses have described over the past 90 minutes. Dr. Aiken and Professor O'Sullivan will most likely agree that this is a very important part of the solution. I will not call it the antidote because it is a sticking plaster in terms of what we have to face in the future around criminal acts and the deficiencies as mentioned.

Reference was made to distorted images and how image distortion can have a major effect on self-esteem. The geolocation aspect, however, is quite insidious. There are a number of apps that do this, Snapchat being one which is probably the most high profile. I am sure there have been examples the witnesses have studied and come across in their own fields where individuals will have used their geolocation. How significant a threat is this from a predatorial perspective and from a psychoanalytical aspect with regard to determining where an individual is located and preying on the person based on the geography? I acknowledge it is not just an issue in this State because I am aware that both of the witnesses' studies have extended well beyond the Republic of Ireland.

Dr. Mary Aiken

That is a great question. When a digital image is taken there is metadata embedded in the image. Crack tools are available online where a person can crack the image to release the metadata. This will include the GPS co-ordinates of the image. A child could take a photo and embedded in that image is the location. The metadata will also contain the date. This date is important because it tells the predator that the child who looks like a seven or eight year old in the image is still that age and, therefore, it is not an old image and the child falls within the predator's preference range. Predators are also profilers; they look at location, the date and the time of day. If a child is taking explicit images of himself or herself it may be at the time the child is unsupervised and this might give a window of opportunity for somebody to call to the house and actually to the door, to try to engage with the child. We are haemorrhaging data through these platforms. Whatever about adults being aware of our digital exhaustion, a child who is seven, eight, nine or ten years old is not aware of the consequences of their activities. This is why we have to adopt a protective stance. If we could get children to the age of 15, which is what we are trying to do with the digital age of consent, in an environment where they had maximum levels of parental involvement and protection then I believe we would be doing a great job. It is our hope that Ireland could lead in this area. As scientists we are more than happy to work on age verification methodologies and protocols to create an entire use case for how this might actually happen. Ireland could lead the world in this area. We are a small market and we have the tech companies here. I do not know any tech company that wants to be involved in something where a child suffers harm. Recently the Apple shareholders wrote to the company to say they were worried about this issue. There will be liabilities down the line because of how children have been harmed by their use of certain social media.

Professor Barry O'Sullivan

There are other examples about geotagging I have come across recently. A parent told me about an incident that occurred when someone was talking to the child online and said "I know where you live. I know you live in the house with the green door. I know what the car looks like outside." They did this by getting the child to send an innocuous image of the ceiling in their bedroom but the image was geotagged by default. With three keystrokes a person can pop it up on a map, onto Google street view and he or she is now looking at the house.

Someone could be in Azerbaijan playing this really nasty game-----

Dr. Mary Aiken

Psy ops.

Professor Barry O'Sullivan

-----stating he or she is at the corner or two doors down and watching. There are people out there who do this stuff for the hell of it. Why does a child need to share geolocation on a photograph? People might want to have their holiday albums popping up on a map to remember where they were. How many times have people picked up their phones to see an app asking to access photographs. People innocuously agree because they want to post a photograph, but what they have actually done is given the social media company access to all of the geotagged information on the smartphone so they know where they have been and when they were there because it is all timed. People allow access to their phones and photographs because they want to post photographs of their new dog, but they actually release an enormous amount of information and parents do not appreciate this.

Dr. Mary Aiken

Now 13 year olds will be trying to make these judgment calls for the family. It is crazy. We will look back and regret it if the digital age of consent of 13 goes through.

Dr. Aiken mentioned the distortion of images and the effect this will have on young teenage girls in particular. This has come up again and again in terms of image and self-esteem. With regard to augmenting policy on social media providers, in terms of getting an icon put on the corner of the screen or something to this effect, has any other jurisdiction had any success on this?

Dr. Mary Aiken

It was a recommendation of the report that came out last year. The UK is getting very active and it has proposed an amendment to its legislation which set the digital age of consent at 13. The amendment covers a raft of measures that are very child protective not only on how to protect the child from a cybersecurity point of view, but also protecting the mental health of the child. I have heard discussions on this. The UK is taking it very seriously.

My observation on this is that it is all well and good the UK is doing this, and perhaps other jurisdictions will follow suit and that is good, but the biggest proponent of this is probably the US, from whence many of those who are celebrities for being celebrities are noted and online. I do not look at Instagram that often, but if we look at it any of these apps we see everybody using filters. I have not seen a genuine image of a celebrity in quite some time.

Dr. Mary Aiken

It is fake reality, and we are seeing the emergence of eating disorders in young boys because at 13 they are expected to have a six pack and they are not physiologically capable of generating that muscle mass at that age. The boys and girls are objects online, and they are being expected to leapfrog from being a child at nine to becoming an adult at 11 or 12. Childhood as we know it is being compromised. In time, when we have enough evidence to show the damage, then legislation will change and governments will begin to pay attention. Then we will try to undo a damaged generation. There is a great quotation, which is that we are living through the largest unregulated social experiment of all time with this generation that has been exposed to technology in this way.

I thank the witnesses for coming before the committee. My head is going to explode because this is mind-boggling. I have three children, for whom I have bought smartphones and they have iPads. I am absolutely terrified. There are parents watching this who are confiscating phones as we speak. I totally agree we need to have some sort of practical guidelines on phones, without a doubt. We were speaking about whether education works. I used to be smoker. The children learned about smoking in school during an awareness campaign. As legislators, we need to have an awareness campaign which educates parents. Technology has moved on so much regarding what my children could probably do on the phone and Internet that I cannot do. This is the way we need to go. We need to have collective joined-up thinking with stakeholders, the witnesses and legislators to get this right. The witnesses have made very valid points. We cannot come back in years to come after generations of children have been affected. As legislators, we have to put serious pressure on social media outlets. We have seen it ourselves. We have had witnesses before the committee. We have been dismissed by some of them and off they went, but the responsibility has to be put on their shoulders also.

Professor Barry O'Sullivan

There is nothing Dr. Aiken and I have suggested today that would make Ireland any more difficult an environment for those companies to work in as France, Germany or the Netherlands-----

Dr. Mary Aiken

Which are much bigger markets.

Professor Barry O'Sullivan

-----which are much bigger markets. We should not be afraid of this. These people are being held to a much greater standard in other jurisdictions and there is no issue.

Dr. Mary Aiken

Why are German, Dutch or French children treated better than our children? This is the part that upsets me. Why are we allowing this to happen to Irish children? Why do Irish parents not pick up the phone and contact their local representative and state they want to parent their 13, 14 and 15 year olds?

Professor Barry O'Sullivan

With regard to education, it is very challenging. When it comes to technology, I am not stupid. My profession is technology and I am a professor of computer science. My children frequently show me things that I ask them to show me again. This is not something that people who are just not paying attention are being surprised by. In two or three conversations we have had over the past two weeks, I have said there was something I did not really think about.

Can we could empower parents to be able to ask the questions? They know so little that they cannot ask the questions.

Professor Barry O'Sullivan

More importantly, bring in the children and speak to them about what is going on.

I understand they will always be ahead, but parents should be able to ask questions about what something is. Professor O'Sullivan was able to spot something because he is a computer scientist.

Not to pick on one company, but I am reminded of the McAfee security settings way back 20 years ago, which were minimum, just below average, average, above average and maximum. What occurs to me is that something that could be of use for a lot of parents out there is a usage app that limits usage for everything else, and depending on how good the child is that particular day it could be adjusted. There is no doubt, as has been referenced, that many people do not have enough information and they are afraid of asking the simple question because it is not simple to them. An iPhone 6, iPhone 8 or the iPhone 10 that is out now might as well be something from "Star Trek" because people are simply not able to assess it.

If someone used an iPhone 3 or an iPhone 4, the base knowledge is there to ask the questions. That is my point.

The difficulty is there are people out there who did not.

Professor Barry O'Sullivan

Adults view the world entirely differently from children. Earlier, Deputy Anne Rabbitte spoke about a Snapchat streak. If someone explained that concept two or three years ago, one would have looked at them quizzically and asked why an earth someone would ever want such a thing.

They see the world very differently from us and they need to be part of the education process. They have a lot to teach us about the technology.

As parents, we have to have the conversation and our children must be able to come and speak to us when something goes wrong. I remember when I was a kid and did something wrong, I was told that was it and I was grounded. We need to have conversations and they must know that if they come and let us know, we will not punish them. It is so important that children are able to do that.

Dr. Mary Aiken

That is a very important point. The literature shows us that where parents adopt too much surveillance of their children online, by hacking their phones or trying to read their messages, their children are less likely to go to their parents if they are in genuine trouble. Another point for parents is to avoid the impulse to vent their frustration with technology on the child when the child does something wrong. We see parents confiscate smart phones, iPads and computers where, say, a child broke a curfew. Where that 13 year old child goes to their bedroom hating the parent, the world and himself or herself, one has actually deprived the child of his or her entire support network. We do not want to do that. Go old school and make them mow the lawn or wash the dishes, but do not vent one's frustration with technology on the child. We are talking about smartphones, which are a transactional entity. They are here and the child is here. What is coming next is head-mounted display units, HMDU; full helmets and virtual reality environments. The problems we are talking about now will be exacerbated when the child is not only psychologically immersed in the space, but physically encased in it.

Dr. Mary Aiken

If you are telling kids who come to the table with phones in their hands to pay attention, wait until they turn up in their HMDU helmets.

We will have to vacate the room, so I will take the next three speakers together and then the final responses.

I have a comment on Tusla. I did my research before I came to the committee. Tusla has not made a statement endorsing the age of consent, but the agency is cited by the Taoiseach as having played a part in the advice and consultation leading to the Government's decision to establish 13 as the official digital age of consent. Tusla is responsible for welfare and protection and I would like to hear comments on that. Because the conversation has been good all afternoon, we did not get to the digital safety commissioner role. The witnesses have recommended it and I assume they would like the committee to continue to lobby hard on it.

On UK legislation and the point in the witnesses' submission, the UK amendment refers to high privacy settings being switched on by default. I need an explanation as to how that would work in practical terms. Ireland is one of the most innovative countries in the world and nine out of the top ten "born on the Internet" companies are here. Their European, Middle East and Asian, EMEA, headquarters are operating out of Dublin. We have the Insight Centre, a Science Foundation Ireland-funded body. We are investing significantly in big data analytics. The innovation the witnesses are talking about to crack that code could be done on the island of Ireland. We have the scientific personnel and the excellence in science to be able to do it. I want to get the witnesses' perspective on the fear I have. The top companies I referred to have commercial sensitivities and are looking for market share. My fear is that if one tries to legislate for or create the innovations to block and filter access, Mr. Facebook, CEO, or Ms Facebook, CEO, and others may ring the Taoiseach to say they do not like what we are doing in Ireland where they have made a solid commitment to their investments. The threat of pulling out could be used to push back.

Dr. Mary Aiken

We should not be looking at economic investments on the back of 13 year old children.

That is a fair point but it is a consideration I put to the witnesses.

We are talking about the digital age of consent, but there is a wider conversation the committee needs to have on the impact of screen time and the impact of Internet devices on the socialisation and sexualisation of children. When we look at our work programme again, we might look at addressing those issues. I can see the impact on adults. In our jobs, we are required to carry a phone day and night. I find that if I leave my phone behind when I go out for an evening, I feel like I am missing something. There is an anxiety there, albeit a slight one. I am aware of the impact of technology on me and its negative aspects but I am an adult.

Dr. Mary Aiken

No control is a clinical sign of addiction.

Sometimes I struggle and keep checking the phone 200 times a day. We all need to check ourselves. Someone said "Monkey see, monkey do". We have work to do ourselves. How do we formulate the guidelines? Senator Noone and others have said it would be very helpful for parents if they could point to national guidelines and abide by them. Have the witnesses done any work on what the guidelines might be? It might sound it, but it is not extreme to ban smartphones from national schools. No national school child should have a smartphone. Should we even take that the junior certificate level? Do they need smartphones? We do not have longitudinal studies on the impact on the mental health of young people and their social skills, but if we do not do it now-----

Dr. Mary Aiken

We do not have causation models either.

We do not have any of that. I would be interested to hear what the witnesses suggest as professionals as to the guidelines we should be exploring for parents. Should we be banning smartphones for some age groups?

Donal O'Shea said the one thing he would do about childhood obesity was impose a sugar tax. We have done that and are hopeful it will have an impact. Obviously, it is something that has to be tackled from a lot of different angles. As Donal O'Shea's equivalents in this area, what do the witnesses say are the three things we have to do in the short and medium terms?

Dr. Mary Aiken

A tax is an interesting idea. Taxing social media or some aspect of the Internet could raise badly needed funding to address some of these problems. In Ireland, we tax plastic bags to protect the environment and tax chewing gum to protect pavements, but we will not levy the Internet to protect our children. We care more about rubbish than about our children. We need to raise money to fund the educational programmes we are talking about and the investment in research to deliver results. Professor O'Sullivan is a world leader in artificial intelligence and I am a leader worldwide in the discipline of cyberpsychology. We are prepared to volunteer our services and we should be able to lead in this area.

Professor Barry O'Sullivan

I will respond to all of the members very quickly. I was asked about the top three things. Parents always need to be involved and the digital age of consent needs to be high. We need very robust age verification online and we need a way to enforce age-appropriate content.

There are other things we can do such as, for example, putting markers on the amount of time people spend on devices, so that children are aware of these sorts of things. Basically, if we can help them a little, our children want to help themselves. As for Tusla, I have absolutely no idea what it is thinking. I can only presume it thinks there is an advantage to eliminating the possibility of parents withholding consent for children to go online.

Dr. Mary Aiken

Critically, if a child was in a vulnerable environment.

Professor Barry O'Sullivan

There is an exemption for that in any case in the GDPR, so I cannot get that straight. It would be very interesting to hear what that is. On privacy by default, basically if one buys a new smartphone - I can see two nice new smartphones in front of me that have been bought recently - one will find that lots of things are turned on, by default such as frequent locations, geo-tagging of photographs and location services. Rather than turning them on, they should simply be turned off. One should actively turn them on if one wants them, rather than having something that follows one around all of the time, which is what the device does.

Dr. Mary Aiken

One also could have age-appropriate devices, where they never turn on. For children under the age of 14, for example, rather than being turned on and off, because children will otherwise change the settings. One could have phones that were for specific ages. A phone, for example, could be suitable for eight to 14 year olds, whereby it would do certain things and nothing more.

Professor Barry O'Sullivan

In terms of the innovations, we cannot control who phones who, obviously, but these companies will not be working in an environment that is any different here than in France, Germany or the Netherlands and I do not believe that we should fear that too much. I believe the public will be pushing back so strongly against social media that this simply will become something the social media companies will want to do anyway. They are probably ahead of us already in terms of these issues. They know these are issues that need to be solved. In terms of bans-----

Dr. Mary Aiken

Probably for profit.

Professor Barry O'Sullivan

If, when they were established, one were to have asked the founders of some of these companies whether this is how the world would be affected, I do not think they would have predicted that.

Dr. Mary Aiken

What is very interesting about the technology companies and the people who head up these companies, is they are very protective about giving technology to their children. Bill Gates said he would not give a smartphone to a child under the age of 14. They sent their children to schools that do not allow smartphones and do not allow the devices in their own homes. The question is, what do they know that we do not?

They created the content, the hardware and the facilities-----

Dr. Mary Aiken

They see the result of overexposure to technology.

Professor Barry O'Sullivan

Steve Jobs famously said that he would not give his children an iPad because he knew that he was developing a fantastic device with which people would want to engage and would find compelling and frankly, he did not want that for his children.

I will have to draw proceedings to a close by thanking sincerely our two witnesses this afternoon and for your incredibly full engagement with the committee. I also thank members for their time and consideration of this matter. On behalf of the Oireachtas Joint Committee on Children and Youth Affairs, I thank them for their attendance and for dealing with members' questions so comprehensively. The meeting is adjourned until 9 a.m. on Wednesday, 21 February, which is a slightly earlier start.

The joint committee adjourned at 3.43 p.m. until 9 a.m. on Wednesday, 21 February 2018.