Part 1: The Price of Convenience: AI, Surveillance and the Fight for Privacy with Paul Walsh

In Part 1 of this two-part conversation, Francis Gorman sits down with technologist and entrepreneur Paul Walsh to explore a question that has followed the internet for nearly three decades: how do we know what and who to trust online?

Paul traces the problem back to the early web and his work on content classification and verification standards, explaining why today’s challenges aren’t necessarily new they’ve simply been amplified by AI, deepfakes, phishing and increasingly sophisticated social engineering.

The conversation then turns to the growing push for online age verification and social media restrictions. Paul draws a sharp distinction between content moderation and access control, arguing that modern devices already give parents powerful tools to manage what children can access.

But his bigger concern is what comes next: when “robust age verification” evolves into mandatory identity verification for entire populations.

Key Takeaways

• The trust problem hasn’t changed it has scaled. Social engineering and impersonation remain at the heart of much cybercrime; AI simply makes them faster, cheaper and harder to detect.
• Verification is as much about psychology as technology. A badge or trust signal only works if people understand what it actually represents.
• Deepfakes raise the stakes. In a world where people can no longer automatically trust what they see or hear, reliable provenance and account verification become increasingly important.
• Content moderation and access control are different problems. Paul argues that platforms should improve moderation, while parents already have increasingly sophisticated device-level controls available to manage children’s access.
• Age verification can become identity verification. Paul warns that demands for “robust” age checking could ultimately require users to prove their real-world identity simply to participate online.
• Privacy can be lost incrementally. Measures introduced for legitimate goals such as child safety can expand in scope and create infrastructure capable of much broader surveillance.

Soundbites

“Society doesn’t know where to look to find trust.”

“Technology is just an enabler.”

“I don’t think any tech company is doing enough to reduce the risk of their technology being used for harm.”

“Content moderation is different to access control.”

“The governments are saying they’re giving back control, but actually they’re taking away their ability to just be a parent.”

Part 1 ends with a fundamental tension: how do we make the internet safer without building systems that require everyone to surrender their identity and privacy in order to participate?

Transcript

Copy Transcript Copied

Francis (00:02.444)
Hi everyone, welcome to the Entropy Podcast. I'm your host, Francis Gorman. Before we dive in, if today's conversation challenges you, sparks a new idea, or sharpens how you think about the world, don't keep it to yourself. Subscribe, leave a review, and share this episode with someone who enjoys staying curious. Today I'm joined by Paul Walsh, a technologist, entrepreneur, and long term advocate for a safer, more trustworthy internet. Paul has spent close to three decades working across web standards, cybersecurity, digital identity, and privacy.

Francis (00:29.43)
including early work on the W Tree C on content labeling and verification. More recently, his focus has turned to the growing tension between online safety, surveillance and individual freedom, particularly around age verification, mobile safety, AI, encrypted communications, and the future of digital trust. Paul, it's lovely to have you here with me today.

paul (00:49.532)
Pleasure Francis. Francis, actually you put you said that quite well. I love the way you stitched that together and bridged everything. Nice.

Francis (00:57.454)
Thanks, Paul. It's it's become a a a a practiced exercise at this point. So I'm glad I'd glad it flowed. Paul, I wanna talk to you a little bit about trust and content c classification on the web, because you were looking at this before. I think most people had broadband, if if I if my maths are are are are correct. So nearly thirty years on, do you think we've actually made the internet more trustworthy or have we made it harder to establish trust on the internet?

paul (01:28.272)
I don't think it's harder. I think it's the same problems, just amplified. Whether it's like if you look at cyber risk, the vast majority of cyber risk, whether it's espionage, data breaches, SMS scams, corporate espionage, account takeovers, ninety percent of it starts with social engineering. So that's a criminal or a teenage hacker.

Impersonating a trusted brand, an organization, or an individual to encourage somebody to do something they'd rather not do through and it's usually phishing with a dangerous link. I was one of the first people that hackers impersonated on the internet in 1996. And that's roughly when phishing was first discovered online. And not much has changed. AI makes it easier, faster, and cheaper for criminals to create.

social engineering tactics and phishing threats, but from a cybersecurity perspective, it remains the same. And what we're seeing today is kind of rather strange intersection where we've got this convergence of cybersecurity challenges. Also society doesn't know where to look to find trust.

What sources to turn to. And we don't know what to believe. Is that video made of AI? Is it is it a deep fake? Is it a joke? Is it legitimate? So I don't think it's not a lot has changed in the last 30 years in terms of trust and online reputation. The same kind of challenges have persisted.

They've just amplified and the security industry hasn't done a particularly good job at protecting people online from harm caused by criminals who try to impersonate people. So it's pretty much the same thing, really.

Francis (03:39.019)
I think they are fair points points, Paul. And and I I I think as I look at a y you you touched on something there that we've touched quite a bit on the podcast. It's you can't really believe what your eyes see and your ears hear anymore, which is a real I suppose that that's a fundamental shift from from where we were back when you you were impersonated all all those years ago. And it's become more rampant and as you said, AI has enabled a lot of it. Can can you take me back to the early days of your W three C work and just

Talk to me a little bit about that because I'm I'm fascinated with the whole idea of content labeling and you know where where that where that came from at a time when I suppose we didn't have AI generating every second facet. We didn't have robots writing content on the internet, we didn't have synthetic twins going around pretending to be Francis and Paul everywhere. You know, wha can you can can you take back to that time and just kind of l let me relive it a bit in in in in where where you were and where your top processes were at the time?

paul (04:32.456)
Yeah, sure. For anybody who's not familiar with the W three C, it's the World Wide Web Standards Consortium and it was founded and still shared by Tim Berners Lee. And the mission is to try and make sure that the web, the World Wide Web, is is as accessible as possible to everybody, irrespective of their ability, disability, location, or device. And it creates it has created standards like HTML, for example.

In two thousand and four, myself and a guy called Phil Archer decided to put forward to the W three C a new way to label content. At the time, he was the CTO of an organization called ICRA, the Internet Content Rating Association, now known as FOSI. I think it stands for the Family Institute of Online Safety, which is now more about lobbying than technology.

And the reason we wanted to come up with a new way is because the old standard called PICS, which is what almost all parental controls use to protect children from adult content, because that was pretty much the only type of content that anybody would want to avoid, perhaps, either children or adults, depending on context or location. And the problem with the old way, prior to 2004, or up to that point, was that you could only classify

An entire website or a specific web page. And we predicted that there would be a need in the future to be able to classify different sections or different parts of a website. And it wasn't just about child safety. Around just after that, I was starting to look at online privacy. How do you know when a website is accessible to a person with a disability and they need to use a screen reader? How do you know which websites are safe for kids?

How do you know which ones are mobile friendly? How do you know what websites comply with some kind of best practice or standard before you visit the website? So come up with a machine readable way to label content so you can find out what's at the other end of the link before you click on it. And then make it easy for search engines and browsers to make use of that. Because if you look at search engines today, let's take Google, for example.

paul (06:58.439)
It provides you with the title and description of a web page. The hyperlink is the title, the text is the description, and that doesn't necessarily appear on the website. What you also have now today is the ability for AI chatbots to give you a response and it goes and finds that information on the web. So that's likely to be classified in a certain way with machine readable capabilities to make sure that it can be discovered by AI, by crawlers.

And so we put it through the W3C. And long story, slightly shorter, what we came up with was the concept of being able to classify a specific part of a website. So if you look at Twitter verified, LinkedIn verified, Instagram verified, meta verified, or basically anything that has an account with a verification symbol, that would be one example of that concept that I co invented.

Because we foresaw a situation where you might need to be able to provide more information. A verification or a digital certificate or a privacy seal, they're all different examples. And the blog post that I used to write back in the mid twenty, I would talk about a content label on the back of a tin of beans where it tells you more information about the content and then you can make a decision as to whether you purchase that product or not. And different people have different requirements.

So I'm a very strong advocate for online account verification and have been for a very long time. And that means encourage website owners, whether it's a social media company or somebody else, make it easy for people or organizations to verify who they are, whatever that means, to reduce the risk of somebody impersonating them. And then allow everybody else to decide.

Will I trust an account more because it has a verification seal or not? The old way of was website identity verification with certificates that then displayed a green padlock in the address bar inside your browser, but that was all removed in 2019. Unfortunately, today we have two things. One, companies aren't doing a very good job with implementing.

paul (09:24.873)
that verification process because it's not just about the machine readable metadata. It's not just about the process. Everything goes into the mix that I've been studying for a very long time. And that is the technology, the psychology, the human behavior around what a visual indicator looks like, what color should it be? Where is it placed? How do you educate somebody in an intuitive way so they just know instinctively whether to trust something or not? So technology is just an enabler.

So Twitter verified is probably a good example of how it doesn't work very well. Because as soon as you pay for a premium account, you get that verification symbol. And the reason Twitter X made that explicit is because the EU sued Twitter for deceptive design because people would look towards the verification symbol, assume it really was the person who they claimed to be, and then potentially fall for a scam. So the first thing is.

Companies not doing a great job at that. So can you really trust when somebody or an organization has been verified? Because one of the benefits today, which obviously I wouldn't have been able to comprehend in 2004, but I did talk about it quite a lot about nine years ago. One of my biggest nightmares is deep fake videos, because that's the intersection of social engineering, phishing, AI, a society.

That doesn't know what to trust or where to go to find trusted information. Some people will believe just about anything, some people won't believe anything. And so when you see a video, it's very hard to know. And that would be a good example because if Instagram, for example, had a very good verification process, then you could decide whether or not to trust videos. A video that belongs to an account that has been verified could be assumed to be at least not a fake video.

And any account that hasn't been verified, let's say it's a famous person or a celebrity and it looks like an investment opportunity, if they haven't been verified, then you might consider taking precautions. However, what we're seeing today kind of ruins everything because governments around the world are using child safety, child and child exploitation, national security, fraud.

paul (11:51.434)
As excuses to roll out surveillance systems by getting people to verify who they are just to create a social media account. And that's something I'm sure we can dive into because that yeah, that that concerns me more than most things today, is that.

Francis (12:06.702)
Absolutely.

And I as you were talking, Paul, one one thing that was jumping into my mind was I recently went to verify myself on LinkedIn and to look for my passport and then I looked into the detail. It was a third party and I went, nah nah, nah, this ain't this ain't happening because I it felt like a way to pillage more even deeper personal information off me to a social media entity that could, you know, then gather that up and have my passport, my database, my phone number, my address, you know, where does the data set

paul (12:27.933)
Yeah.

Francis (12:42.446)
stop to a point when that gets lost inevitably like they did a couple of years ago through a breach, then then then you have the whole packet. You've everything. So what you're touching on is, I presume, the eighteen billion settlement with meta that we've seen the last couple of weeks and and how that's now being portrayed as we're now leaders in child safety where there's a far darker edge to that story. We could c let's let's jump into that and get your perception on on what what is going on there.

paul (13:05.683)
Yeah, I'd like to take us up to thirty five thousand feet first and then dive into the meta because the meta is just one thing. What I'm seeing is a pattern and it involves very specific governments around the world, especially the five eyes. And for anybody who's not familiar with that, the five eyes are the five intelligence agencies that share information, intelligence across the countries the US, Canada, New Zealand, Australia and the UK.

And then there's other companies or other countries, states that also share intelligence with them in a wider kind of way. And there's a few things that I see happening. First of all, they've always wanted to end end-to-end encryption because they say that only criminals use encrypted communication services for an infuriating intent. And we can unbundle that in a while. And then they've also got this.

What can only be described, I think, is a coordinated effort. Because when the tech leaders and country leaders meet at, say, a G7 summit and they're positioned around a table as if they're couples at a dinner party, right? It's like broken up. You've got country leader, company leader, country leader, company leader. They're not talking about child safety, obviously. I mean, we should all agree and conclude that when they come together.

Child safety is probably not a priority. In public, we see governments and regulators constantly complaining about the lack of care with social media companies. But then they're taking selfies and posting them on LinkedIn and talking about removing red tape and how to scale. They're not talking about child safety. So for me, I think it's PR campaigns.

And I don't mind saying that publicly because I'm a technical expert in the entire technology stack for child exploitation, child safety, privacy and security, especially on mobile phones. So everything they're trying to do is not fit for purpose. Now we might have people listening to this jumping up and down thinking, my god, what about the children? Let's just set aside one thing where we have common ground. I don't think any tech company

paul (15:31.369)
Is doing enough to reduce the risk of their technology being used for harm. That's not to say they should be held accountable or held responsible every time somebody uses it for harm, right? But context and timing is everything. A bread knife is a bread knife. When you buy a bread knife, it's still a bread knife. It's only a weapon if you're walking down the street with the bread knife in your hand and it's not inside a bag with a receipt.

So it depends on the context and timing. With social media, we've now seen, I mean, I've seen this over the years, some certain social networks have been caught causing harms to children intentionally because it generated more revenue. Then they lied about it and tried to cover it up, and it has been disclosed through ex executives.

And Meta is one of those companies. That's the main one. Meta is one of the reasons we can't have nice things. So Meta has gone out of its way to cause harm according to all of the whistleblowers and lawsuits. And as a result of that, it has given the governments an excuse, a way to roll out identity verification across entire populations.

And the reason I'm very confident that it has nothing to do with child safety is the following. First of all, every smartphone has built-in settings that today are fantastic. About 14 years ago, I was interviewed on BBC News Night to demonstrate how terrible these parental controls were when I was advising the UK government on the first original.

Parliamentary inquiry into online child safety, which was the first democratic society to implement filters to block pornography by default. My advice was: yes, encourage ISPs and mobile providers to provide tools to people who want them, but don't turn it on by default because it forces everyone to give up their identity just to say, I want to consume this kind of content or access the websites that you blocked that you shouldn't have. And

paul (17:55.081)
So back then parental controls were terrible. When I was at AOL in the mid nineties, online family safety was a unique and very important selling point and a very important thing for us to focus on content moderation, account moderation, because it was before the web became mainstream. So we had to make sure people felt they were going to be safe on this weird place called the web.

So it was taken very seriously and it was done extremely well. It was never perfect, of course, but it was a million times better than anything we're seeing today. So today, the parental controls on site and iPhone, for example, allow you to restrict very specific apps or very specific websites, or you can decide the age category of your child. So if you don't want your child

To access any social network, then you just choose the age in the settings. And when you choose I can't remember if it's like nine or twelve, but there isn't a single social network that is not aged or classified less than 13, right? Because every application on the App Store has to be classified itself by a certain with a certain age. So it's either 13, 16, or 18, depending on the social network. And it's protected by a pin by the parent.

So even a security professional like me cannot bypass that. There is no technical way. Some people say, but they can be circumvented. Kids, pardon me, smart kids can get around it. It's not true. Maybe whatever they were thinking was true a long time ago, but it hasn't been true for quite some time. So if I set that up for a child, it's set up once and I don't have to do it again. And when they go to the app store and they search for Facebook, Instagram, Snapchat, Reddit, TikTok.

Or X, they'll be grayed out so they can't download them and they can't use them, and they can block the websites. In addition to that, you can set curfews so you can decide how long your child should be allowed to use the phone or specific applications or specific websites. Is it X number of hours a day or a week, or is it certain times of the day or certain times of the week? So you've got full control. Unfortunately,

paul (20:20.02)
A lot of parents use them and use them well in conjunction with educating their children along their kind of journey with digital devices like they do with Stranger Danger. Some parents don't know they even exist, some parents don't care, and then you have everybody in between. It's it's nuanced. Every kind parenting is nuanced. Me being a parent of three does not qualify me to have an expert opinion and recommend what should

or shouldn't work or doesn't work for an entire country as a result of one lobby group thinking it should be done a certain way. Being a parent doesn't qualify me to decide how every other parent should parent their children when it comes to digital safety. So mobile devices have that capability. And I believe parents should be educated how to use them and to know that they're there to begin with. I was l I've listened to a number of

interviews recently on various radio stations in different countries and I just happened to listen to one on RTE I think it was yesterday or today and they were talking about the social network ban and it's a child safety organization. They talked about everything except for parental guidance and what parents can do. It's all about the tech companies. The tech companies should do this and the tech companies should do that.

So let's separate two things content moderation and access to that content and application. Content moderation is absolutely abysmal on these websites. They are absolutely terrible at it. Meta has pretty much gutted its entire trust and safety teams across the board, which will tell you how much they care and invest in any kind of content moderation.

Whether it's adult content, self-harm, suicide, or any or violence or anything else? Reuters also discovered that Meta generates 10% revenue. Ten percent of its revenue comes from scams and illegal products. So it is constantly generating revenue as a result of things that shouldn't happen on its platform and then being caught telling lies about it. Will Meta do anything in the future to implement better parental controls according to this new

paul (22:45.043)
US legislation. Well, let's look at the last 20 years and see what they've done. All they've done is lied, lied, lied under oath, and then Mark Zuckerberg decided to settle before he was put on the stand to testify in front of a jury. There's no way he would have escaped without serious harms to the team, potentially. because if you're found guilty of intentionally causing harm that resulted in the death

of people. That goes far beyond defining in my book. So if a website has content that parents believe are un is unsuitable or dangerous, then you block access to that application and then everybody else can stop talking about the suitability of that content. Unless of course they want to talk about how you moderate it for adults and everybody else so that it just simply is moderated according to their own terms of service.

Which says you're not allowed to do certain things. But content moderation is different to access control. And so called bans for teenagers on social media is absolutely ridiculous. And on RTE radio, when I heard this CEO talk about we still have to wait for Australia to see if it's been successful.

These people are not looking at what's happening. We already know that it has failed in Australia for quite some time. This is well publicised. So well publicised that the e commissioner in Australia has said that TikTok and other social networks are not doing a good enough job to verify everyone's age. So they doubled the fine and they introduced a word called robust. So they've now said.

Social media companies have to implement robust age checking, and I emphasize that for a reason. Robust is also the word that the new US legislation is proposing. Because when they say age estimation is not good enough, you need robust age verification. What they actually mean

paul (25:07.467)
And it's almost like it's white text on a white background that will only become discoverable if you hold it over a a candle and squeeze lemon juice on it. Is we are forcing you to verify everyone's identity because that is the only way you can potentially prove effectively and reliably everyone's age to make sure they're over a certain age. The reason the governments, the Irish government, the British government, the US government, the Australian, the New Zealand, the Canadian.

The French, the reason they will not come out and say publicly, we want social networks to verify everyone's identity is a number of reasons. One, everyone will pause and say, Wait, hang on. Does that mean that my child has to have their identity verified when they reach a certain threshold, like 16? You're forcing my daughter who's just turned 16

To verify who she is with a government-issued document, which she might not even have, with Google or Apple or Facebook or TikTok, all of these tech companies that you want to protect our children from when it comes to surveillance, but you're telling me that everyone in the country, before they can read, write, or share any kind of post online, we have to verify who we are. If I had have known that that was going to happen in 1996,

I would have changed profession. If I'd have known that that was going to happen in 2004 when I invented the concept of the act of account verification, I probably would have filed more patents to prevent this kind of censorship, not to prevent innovation. So what Meta Meta has been fined for causing harms. And the legislation is forcing Meta within a year

To roll out a number of different things, including identity verification, as well as content moderation and other things that supposedly that if a child is on Facebook, they will only see content that's suitable for that particular age. Well, they haven't been able to just exclude content that's got people dying or shooting somebody. So

paul (27:35.481)
Do we really trust that they're going to get so good at it that they're going to be granular and decide what's suitable for a nine-year-old versus a 12-year-old? They might as well just drop the age classification of the app on the app store to four plus, because then they can say, Well, we'll only show content that's suitable for that specific age. So when you put it all together, and also Meta has been signed has been fined, but some of it is contingent.

on TikTok and YouTube also complying. And Meta just paid for an Instagram campaign. So Meta has paid for a campaign on its own social network to get in front of YouTube and TikTok to say join the club. Like they don't have meetings in Starbucks or in their own cafes or at a G7 Summit. They have to take out an ad on Instagram.

It's got nothing to do with speaking directly to those tech companies. That's a pure campaign to try and say they're trying their best to do good. So when you put it all together and we know that the social network ban doesn't work because teenagers just use a VPN to pretend they're in a different country. We know it doesn't work in the UK. We know it doesn't work in Australia. So why do does anybody think it's going to work anywhere else, whether it's Ireland or the UK? Here's what's going to happen.

It's a playbook that I've been looking at. First of all, they use the excuse of child safety. It's almost like every politician seems to be overnight obsessed, obsessed with the safety of everybody else's child, as if nobody knows how to take care of their own children. There are people who don't know how to use digital devices, but they can ask for help now. It's 2026. It's not 14 years ago when I was on BBC News Night saying that this was all terrible and difficult.

Pe kids who are now, let's say twelve or fourteen, they were about five or six when it would have been obvious to the entire world that they shouldn't have had access to these websites. And if you can't stop a child at the age of five or six or seven or eight or nine from accessing a website like or an application like Facebook, then you have much bigger problems, right? That's a much bigger problem than the tech companies not doing what they're supposed to do to enforce their own terms of service.

paul (29:59.789)
So the politicians are doing this. They're saying that in order to protect children, they need to ban them from social media, including all the teenagers who are perfectly safe and who have parents who have taught them all about digital safety and they're responsible and and they're happy, right? That's no longer that doesn't matter. That has been taken from them. The governments are saying they're giving back control, but actually they're taking away their ability to just be a parent.

So they're basically saying in order to protect these children, we're going to ban them on social networks and we will decide how many hours a day they should be able to access the web or these specific websites. And to do that, you need to implement robust age checking. And then when the social networks don't do that well enough, they'll be forced to implement identity verification. And when teenagers continue to use VPN,

To get around these social network bans, as they have been in Australia since it came out, they will try to age gate or ban VPN services. And that's what they tried to do in the UK until there was backlash. Any politician who says that a VPN should be banned or age gate fits into a number of different categories for me as a technical expert and somebody who can specialise

in social engineering and reading people's intent. One, they're naive and they don't know any better. And they should be open-minded to when they're told by a technical expert that their their ideas and opinions need to change and give them the information so they can change their mind. That's the first one. The second one is if they're not naive and they know exactly what they're doing, then for me and I will tell them to their face,

They have nefarious intent because a VPN is has most people would know VPNs as something you use if you want to stream Netflix and pretend you're in the US. So you can access US content. But that's the secondary purpose. Remember, every technology has dual purpose. A VPN being used for a streaming service is a secondary purpose. Its primary purpose is to keep you safe and private.

paul (32:21.964)
So if you're in a public Wi-Fi, if you're in a cafe or a conference or an airport and you're connecting to a public Wi-Fi, you must use, pardon me, you must use a VPN, especially if you're a high-profile target. Use a VPN for security purposes. I won't go into the details as to why. If you are working remotely, a lot of organizations, whether it's a corporate network, a university network, a government network, you have to have a

specific IP range or I you have to be in a certain location to be able to access that network. So you have to use a VPN to access that network. You might be working remotely or working for an organization in a different country. There are many other reasons as to why you would use a VPN but there for security and privacy and personal safety. A journalist, a whistleblower, a source, an executive, a lawyer, a you know, ambassador, military, police,

Government officials, executives, crypto traders, they use VPNs to keep themselves safe. They're not trying to do something untoward or dangerous or illegal.