The cyber risks presented by the Digital Wallet Beta application

The new application Beta Digital Wallet, The service, which aims to prevent minors from accessing online pornography, also presents some risks, since it uses users’ personal data, which is why the possibility of this service registering failures that lead to theft or misuse of informationproblems of ‘‘sextortion’ o to selling data on the black market.

The Spanish Government announced earlier this week that it intended to implement a Age verification system to restrict children’s access to websites with erotic and age-inappropriate content, which will operate through a mobile application.

This is Beta Digital Wallet, announced by the Minister for Digital Transformation and the Civil Service of Spain, José Luis Escrivá, which is expected to arrive at the end of this summer to offer a “very comfortable and very easy” system, which “will not cause any problems”, although it will require “a small effort” on the part of adults.

With this new service, Spaniards will be able to register your age using an official document, such as an electronic ID cardqualified certificates or agreed keys from the Cl@ve system (Cl@ve PIN, Cl@ve mobile or Cl@ve permanent).

Once this documentation has been submitted, the Application verifies the age of the person and generates an anonymous credential which allows access to websites and portals with pornographic content, as explained in the presentation of the app.

When the person in question tries to access a site of this type, his or her age will be consulted using the reading a QR code. After that, Digital Wallet Beta will share an access credential if it determines that the person who wishes to consume the content is an adult, blocking minors from accessing the selected website.

As explained by the General Director of Public Governance, Carmen Cabanillas, the access credentials allow it to be a “totally anonymous” system“, so they will be used to prevent navigation from being traced through consumer habits. In total, it will be possible to generate up to 30 credentials -each of them can be used up to 3 times on the same website- every 30 dayswhich will expire after this time.

APPLICATION EFFICIENCY

This initiative comes from the The European Union (EU) Digital Services Regulation (DSA). Specifically, the update of the Regulation on electronic identification and trust services (eIDAS2)which establishes that, from the By 2027, all EU digital content platforms will have to verify the age of majority of its users.

In this regard, the Spanish platform Xnetfocused on the digital rights of users, has given its opinion on this application, questioning its effectiveness. For example, it has indicated that it would be more convenient if a person could prove that you are of legal age without associating it with your date of birth or personal data.

On the other hand, Xnet has recalled that the Most porn websites are not hosted in Spainbut its servers are spread throughout the world, which contrasts with the procedure of the app mentioned, which is designed to block websites that operate from Spain.

This makes it easier for users use a VPN system -with which the location of the device can be set to another country-, to evade the age verification system and avoid “doing this bureaucratic procedure every month for just three visits”has apostilled Xnet.

CYBERRISKS OF THE BETA DIGITAL WALLET

The Digital Wallet Beta app also features other cybersecurity issues because the existence of a tool that allows filtering who accesses one content or another requires having personal information, which can put citizens’ privacy at risk.

This is what cybersecurity firm Panda has stated, which has also warned that the efficiency of this application “is quite dubious”, coinciding with the indications of the Xnet platform, formed by activists who support a free internet and real democracy.

In this regard, the company has clarified that this application has been developed an inter-ministerial working group in about 9 months; a period that “It is not a reasonable time to issue a definitive solution“, taking into account that it is an ‘app’ that “works with the data of people who consume pornography in a country,” as noted by the Global Consumer Operations Manager of Panda Security, Hervé Lambert.

In addition to this note, Panda has pointed out that it is ““essential” to ensure that this information is stored and processed securely to prevent data leaks or theft by cybercriminals. Like any other application, the Beta Digital Wallet can present vulnerabilities that can be exploited “in a thousand different ways.” He therefore stressed that the systems must be periodically subjected to penetration testing and security audits.

They should also correct potential vulnerabilities which, according to the company, “will continue to emerge.” However, it has stressed that the fact that authorized personnel can manipulate this sensitive data -referring to the Government- “is already a risk in itself.”

If this information is leaked due to an accident or cyber attack, names, addresses or ID numbers will be available to outsiders, who could use them for unauthorized purposes. As Panda has indicated, these uses can range from digital marketing to the sale of data to third parties, which violates users’ privacy and exposes them to potential threats.

In addition, the cybersecurity firm has stated that, if a large number of people were to use this ‘app’, it could generate a centralized database with sensitive information which would amplify the consequences of a potential security breach.

On the other hand, the company also warned that, if the identity of users is intercepted, cybercriminals could use this information to carry out ‘sextortion’ or other scams based on emotional blackmail. In these cases, They demand money in exchange for not revealing information that could compromise them.

Following this line, the data could also reach the ‘dark web’ to put them up for sale, so that other cybercriminals can acquire the names or identity documents to carry out impersonations and fraudulent activities.

Panda has even stated that it could be create a black market for certificates, in which the minors can buy access credentials and continue accessing pornographic contentThis way, they could steal the credentials of adult relatives and then sell them to acquaintances or through the black market.

In addition to all this, Panda has raised other issues related to user privacy, such as the fact that monitoring user activity “could open the door to “citizens’ rankings based on their Internet activity.”

With all this, Lambert has ruled that, although it is necessary to take measures of this type, ““This app is not going to eradicate the problem of pornography consumption among minors” and yet it does raise cybersecurity and privacy issues for the people who are going to use it.

“If this type of action is not accompanied by long-term education plans, we will simply be putting patches on a wound that requires very deep analysis and treatment“, concluded Hervé Lambert.