Comment Re: How? (Score 1) 68
The p.m. is giving companies a chance to get ahead of the legislation. If you are phone manufacturer you put together a plan and a timeline and says we can't do it in 3 months but here's our plan to do it in six.
And if you are a phone manufacturer and you tell them, "Our plan is to ignore your country until the next election, when your government will probably go away anyway," what then? Or if the answer is, "We can either keep England or California, and we choose California," what then?
Something like what they are asking for has to be done in a way that protects privacy all around, including, potentially, privacy of the minor from excessive intrusion by the parents, so you would have to allow an option for the kid to send the content to parents for approval.
For live photographs, that permission would have to be requested by the kid, and the content stored on device, but sequestered in such a way that the kid can't access it without parental approval. Otherwise, if you don't allow the photo to be taken at all, you wouldn't be able to have your kid take photos of art in museums without unlocking their devices (which would defeat the protection purposes), and if the phone automatically sends it for approval (rather than manually), you'd run the risk of kids' selfie porn getting automatically sent to their parents, making their parents potentially legally liable (not to mention probably psychologically scarred).
And all of this has to be done in such a way that none of the data can leave the device for any reason, under any circumstances, without the explicit permission of the owner of the device. That also means zero automatic reporting to anyone that content was flagged at all, because of the risk of such flagging triggering physical, emotional, or sexual abuse of the young people by others with access to those reports (e.g. pervy local law enforcement having a report of who all the bad girls are, or worse, getting access to the photos).
More importantly, this ideally should be done such in a way that it would be technically infeasible to comply with any future law mandating automatic reporting. And this is the truly hard part, because I have no idea how you'd pull that off. Mitigating the risk of future government overreach is actually the hardest aspect of this sort of detection from a privacy perspective, and given how many government officials are frothing at the mouth, breathlessly demanding such privacy violations, it's easy to see why such protection is so important.
Doing this right is potentially challenging to get right, and there are a lot of sharp edges. Worse, those sharp edges could cause regulatory problems in other countries, and because cell phones don't stay in one place, that can be a nasty problem.
Give them a ten-year implementation deadline with an eight-year design deadline. To be blunt, if England wanted this in six months, they should have asked in 2016.