Children Are Not the Enemy: Child-Fit Security as an Alternative to Bans and Surveillance

Technical Summary: Children Are Not the Enemy: Child-Fit Security as an Alternative to Bans and Surveillance

Problem Statement
The paper identifies a critical misalignment in current approaches to child online safety. Dominant paradigms rely on "containment" mechanisms—such as age-based bans, surveillance, parental controls, and access restrictions—which frame children as vulnerabilities, attackers, or risks to be managed rather than legitimate users. This approach treats child protection primarily as a problem of restricting access to systems designed for adults. The authors argue that this framing is inadequate because it ignores the reality that children are integral to digital society and that digital systems often fail to account for children's developmental needs, rights, and evolving capacities. Consequently, current measures often shift responsibility onto children and parents, weaken overall system security (e.g., by undermining end-to-end encryption), create inequality, and fail to address the root causes of harm: system design, governance, and commercial incentives.

Methodology
This work is a conceptual and theoretical contribution rather than an empirical study with experimental results. The methodology involves:

1. Critical Analysis: A critique of existing regulatory and technical interventions (e.g., client-side scanning, age-gating, school bans) and their unintended consequences, such as security weakening, privacy erosion, and the displacement of accountability.
2. Paradigm Construction: The proposal of a new security design paradigm termed "Child-fit security." This involves redefining core security concepts (assets, adversaries, attack surfaces, and harms) specifically for the context of children.
3. Conceptual Framework Development: Defining the core principles of the new paradigm and outlining a research agenda to operationalize it.
4. Illustrative Scenarios: Using hypothetical scenarios (comparing a child in a "containment" regime vs. a "child-fit" regime) and a table to demonstrate how the proposed principles apply across different developmental stages (ages 6, 10, and 16).

Key Contributions
The paper makes three primary contributions:

1. Proposal of Child-fit Security: A new design paradigm where technologies likely to be used by children treat children's wellbeing, development, privacy, safety, agency, and rights as core security requirements (first-order design considerations) rather than afterthoughts. This shifts the focus from securing the app/account to securing the child-system relationship.
2. Critique of Containment: A detailed analysis of how well-intentioned containment approaches (bans, surveillance, age verification) often produce unintended harms, including the weakening of encryption, the creation of digital divides, and the failure to prepare children for digital participation.
3. Operational Framework and Research Agenda:
   • Core Principles: The paper defines four principles: (1) Treating children as legitimate users; (2) Supporting children's agency; (3) Recognizing and designing for child diversity; and (4) Protecting children's rights.
   • Operationalization: It outlines seven strategies for implementation, including treating childhood as a core design context, protecting participation (not just restricting risk), designing without surveillance, ensuring developmental appropriateness by default, protecting against extractive models, participatory design, and extending threat modeling.
   • Threat Modeling Extension: The authors propose extending existing threat modeling techniques (e.g., STRIDE, LINDDUN) to include child-specific assets (attention, autonomy, relationships), adversaries (including structural incentives and design patterns), and attack surfaces (e.g., parental dashboards, age assurance systems).
   • Research Agenda: A roadmap for future work is presented, focusing on inclusive design with children, age-specific security requirements, child-fit threat modeling, embedding protection in system architecture, and providing developer support tools (APIs, checklists, SDK analysis).

Results
As a conceptual paper, it does not present experimental data or quantitative results. Instead, its "results" are the theoretical constructs and frameworks proposed:

• A redefinition of child online protection as a security problem involving specific assets (attention, emotional safety) and threats (design-induced harms, algorithmic manipulation).
• A conceptual model (Figure 1) illustrating that wellbeing, development, privacy, safety, agency, and rights are the core requirements of child-fit security.
• A comparative illustration (Table 2) showing how security mechanisms should evolve from "scaffolded protection" for young children to "supported protection" for adolescents, contrasting this with the "containment" model.
• A visual representation (Figure 2) of how threat modeling must be adapted when children are involved, shifting from technical entry points to socio-technical surfaces.

Significance
The paper claims significance by challenging the security community to expand its scope beyond traditional adult-centric models. It argues that the current paradigm of exclusion and surveillance is not only insufficient but potentially harmful to children's development and digital rights. By proposing "Child-fit security," the authors aim to:

• Shift the site of intervention from the child (the user) to the system (the design).
• Reframe child protection not as the prevention of direct harm through restriction, but as the transformation of digital spaces to allow for safe, meaningful, and dignified participation.
• Establish a foundation for future research and engineering practices that treat children as legitimate users with evolving capacities, thereby moving beyond "one-size-fits-all" bans and surveillance toward systems that are inherently safe and supportive by design.

The authors conclude that this reframing is necessary to move beyond a narrow security view that treats children as outsiders or risks, acknowledging that children are already part of digital society and that systems must be designed to fit their needs rather than forcing children to fit the system.