A quick note for the lovely people at @NSPCC_Press:

It's a lot more risky to throw a punch at Conor McGregor than at a typical guy down the pub. This exemplifies why "risk profiles" are generally tied to (a) behaviours & (b) capabilities, of "actors" in an model

As such "risk profiles" are heavily individualised & different from "what could possibly go wrong?" threat modelling.

The Internet, though, lacks up-front individual identity ("anonymous by default") which is a problem with your proposed approach.

"Is this a kid?" – "Dunno."

Your proposed approach presupposes that there is positive identity (the actor is Conor McGregor) or at least negative identity (the actor is not a kid).

Neither exist on the Internet. Hence your solution towards "balance" won't work.

The different products (like the different actions, going around punching people) do not yield different risk profiles.

It's a matter of *who* you end up punching, which determines the risk.

And finally: If you can't control the "who" then you can't control the risk — and attempting to control the "who" is a deeply illiberal and exclusive endeavour.

Hence: your proposed solution presumes deeply illiberal and exclusive, and currently nonexistent, behaviour.

Originally tweeted by Alec Muffett (@AlecMuffett) on 2022/01/18.