State of Play 2009 - Surveillance in Virtual Worlds
Jun 20, 12:27 PM
This is my transcript of the panel on surveillance in virtual worlds for State of Play 2009. The panel was pretty spotty. Two of the guys I just didn’t think were helpful or informative at all. The police officer, Charles Cohen, had some absolutely fascinating things to say, as did Bart Simon, an academic based out of Montreal. As always, any mistakes or misinterpretations here are entirely my own. My comments are in [brackets] and there are plenty this time!
——
Roderick Jones [with UK national security]:
I think of VWs as a tool that are becoming increasinly important to people in national security. They can do certain things for bad guys: VOIP, recruitment, moving money through these spaces. What really interests me right now is what VWs can do for good guys. The Iranian Twitter stuff reminds me of almost a text based game. [Shows a diagram, a highly connected graph.] This is a link analysis produced by MI5 of telephone conversations from 2004, a plot by Al Qaeda to use local UK operatives to plant a bomb outside a nightclub in London. Within that plot, the ringleader of the 2005 bombings in London was noted, but his surveillance was dropped. But the diagram illustrates the big problem [really? could you explain that?]. Try and make sense of this cloud, it’s huge and there’s only two nodes connected to MSK [the ringleader]. [What about centrality algorithms?] If my version of the future happens, we ask “What does information war look like in a virtual space?” If you have info zones in a virtual world, then the conflict becomes over the virtual spaces. In SL there were attempts to upstage one another by pro Israel and pro Gaza folks. Is a WoW battle the future of war in VWs? [Uhhh, no. Wow. This is pretty not helpful stuff.]
Bart Simon:
I thought I’d set the scene for the discussion. This requires some speculative imagination, so to get into this I had to do a little fiction writing. [Tells a story about operations HQ at Blizzard, it’s like a NASA operating center. Wall-sized monitors with maps of Azeroth and data overlays. Operators assume player’s point of view to shadow the avatars. Search algorithm shows that the avatar has too much gear for his level. Err, actually his spectulative fiction is just like stuff that is done on some live MMOs already, it’s just that in his fiction it’s all a smoothly integrated application.] We’re surrounded by popular representations of what we now call the surveillance society. There’s a counter-discourse: our privacy is always under threat so we must defend and resist against this. A lot of the language that we derive for this comes from the notion of Bentham’s panopticon, which then takes another form in Orwell’s 1984. But the concern of Bentham not what someone does with the information, but rather to create a light surveillance system where the surveilled have access to their own data. There is no moral valence to surveillance: parents surveil their kids. Catholic and other religious conversations about watching out for each other entail surveillance.
There’s two components: one is exerting influence (pos or neg) on someone’s life, and systematic attention, which is where the apparatus comes in. We’ve moved away from people watching people: there are now information technology intermediaries. Camera lens to software to bureaucracy, finally to someone who makes a decision. This is dataveillance. Crucial assumption: the data is about the person to which that data belongs. The surveillance is not of the person but of the data about the person. The trick is to make the connection between data and person.
Traditionally this was done through an apparatus called confession. That data you’ve collected about me connects with me and I say, “Yes, you got me, I did it.” The problem is, what happens when the person won’t do that? What happens when you occupy a society in which it becomes difficult to extract confession to connect data to a person? VWs are interesting because they are problematic for this reason. There’s a tradition for RP and VWs that comes from masquerade and carnival: being someone who you are not. So there’s a disengagement of who you are from the representation of who you are. Creates problems if you’re using the places as sites of surveillance.
Not from the point of view of finding farmers or griefers, but if you’re producing a situation where players are monitoring themselves, you have a break because true surveillance is impossible due to the lack of link between data and person.
So there are two sides: one is that hte VW is a place to go to get away from who you are and get away from society. On the other hand, VWs are an ominvous place for the manufacture of surveillance society. If you talk about the trends of individualization of avatars and online identity, and unifying their identity online, it increases the connection between data and person. People will willingly claim their database information about them, making surveillance easier.
Chuck Cohen:
I’m with the [couldn’t hear] State Police. My job is to get bad guys. Surveillance, whether in real world or VW, is it lawful? And is it technically possible? From my experience, what I’ve found is that over 90% of criminal investigations are done by state and local agencies, not federal agencies. Over 90% of state agencies have less than 10 officers on hand. I was doing some training recently, of 30 officers there only 5 had heard of Second Life. VWs are communities. From the standpoint of NYC with 8.7 million people and 54,000 police officers; you look at WoW with 11 million people and 0 public sector law enforcement monitoring the activity. Anecdotally, I got a phone call from a large law enf agency on the east coast, investigating the murder of an 11 year old girl. The suspect lived in the house with her and spent most of his day in an MMO. But the cops couldn’t ask his known associates because his known associates did not exist in the real world. What they were left with is they needed to find evidentiary value in the VW. They made a phone call to a self-proclaimed expert who said “The servers are offshore, they company won’t help you.” That was not true, the game company did give them data.
There’s a well-known case of a woman who put an ad on CL to prostitute herself for 5000 gold in WoW, which is about $125 about equal to about 30 minutes with a CL prostitute. But she wanted a flying mount, not money, so it was easier to take payment in WoW gold. If you look at most states, it’s the exchange of sex for an item of value that is prostitution. Blizzard claims that WoW gold has no value. So the question is, is this prostitution??? From a legal standpoint, could I arrest her for prostitution knowing that Blizzard will always say that WoW gold has no value? There’s reasonable doubt there.
Going on to other examples, I spend my time investigating the distribution production of child pornography. The photorealism of many MMOs leads to a problem: I have to prove whether an image is an image of a real child. There’s a plausible defense: “This movie was taken with an adult actor and in post production made it look like a child.” Within the next 18 months, that is likely to become a very solid defense. “I didn’t know that this image was of a real child, I was told that it was a photoshopped image.”
Surveillance has been going on in law enforcement for years. In the wild west, when officers would ride up and down the street and jiggle the door handles of business, that’s surveillance. Door knobs, questioning, or building up mutual trust in a community, is hard to do when skilled investigators don’t know anything about Second Life or WoW. [What about recruiting inside a virtual world for law enforcement?]
VWs are more of a challenge than an opportunity for us at this point. Often, even when there’s clearly evidence in a VW, it’s not recovered. Sometimes the servers are in areas that are not compliant with U.S. laws.
Michael Schrage:
Human beings are hardwired to find patterns in noise. We bring biases, even into VWs. There are dichomoties between physical and virtual, trust and verification, whether something is real or simulated.
If you’re in law enforcement, you’re trying to flush out the difference between the signal and the noise. You have things called honeypots, you set something up, some people think it’s entrapment though it’s really the opposite. How do you design a honeypot in a virtual world?
I believe that we always screw ourselves when we draw false lines. The interesitng thing is not what goes on in VWs, it’s how the VWs interact with real world. I think it’s clear, no matter what happens with VWs, you’re going to see the rise of malevolent mashups. Your iPhone is going to become a window into a virtual world, call it the devicification of VWs, means there are all kinds of ways that our [err. Okay. This guy is talking off the top of his head, jumping all over the place conceptually. I can’t understand what he’s saying enough to even transcribe it in a way that makes sense. Sorry.]
Michael Theis:
I used to be with the National Reconnaissance Office, but I do not speak for them nor do I speak on behalf of the government. The first thing I had to realize is that the world has changed fundamentally in the way espionage can be done. All important secrets that people own are in a computer some place, but we don’t really understand how people use those computers. 3 things to protect from cyberthreat: a judge of trustworthiness of the person on the other end, I have to get my permissions straight, and I have to have an effective monitoring capability. I’m looking at monitoring as an entire enterprise thought process. Surveillance is about an individual or small group, but monitoring is enterprise-wide discipline.
Less than 1 in 10 teenagers see no moral problem with illegallly swapping music. Is there a correlation between swapping music and stealing secrets? I don’t know. As an investigator, I want to develop sources and investigation methods where I don’t have to physically be in the real world. We want to be in the same room normally to look at body language. I should be able to do that in cyberspace, but I don’t know how to do that. If we could, I could be much more efficient. But it’s pretty easy to hide in the cloud right now.
However, that’s not the same as anonymity. I can find you in WoW, talk about weather, and now i know the weather where you live. Couple of weeks go by, I might complain about I-95, and get them to name a road. You can build this over a period of time, and very quickly get to where they live and what they do and whether they have something of value to you. I need to take that model and break it down so it’s faster and can be done in an interview. In telephone conversations we’ll ask certain questions and build background to listen to a person’s meter and tone, their word selection, etc. A calibration. Then when I ask the hard questions I can compare and infer. I’d like to be able to do this in a VW.
How can I figure out when a person is the same person but in a bunch of different worlds trying to pretend to be different people. Is there a digital footprint regardless of their presense on a VW? You can see it in message boards where untrained people can figure out that a person has a sock puppet on the board.
I need the monitoring to prove that a trustworthiness judgment is correct and that my permissions are the right levels. So all three of those things have to work well.
Q: For Officer Cohen, are MMOs a medium for money laundering?
A: Yes. Make an avatar in SL, make an item. Create an alt, put in $10k in money, buy the item for the equivalent in linden dollars, cash out with the other avatar.
Q: Considering cyberwarfare, cyberterrorism. What about torture? Is there cybertorture?
A: Michael Schrage: with the rise of haptic interfaces, yes. [Really? Can’t you just unplug a haptic device?]
Simon: the notion of a self or identity is fragmented right now, but they’re coming together slowly. As that connection closes, it’s like voodoo: you can start doing things to that double that will have real impacts on the real person. [I mean, sure, cyberbullying. Deface a kid’s myspace, his social life is affected.]
Theis: as a skilled and experienced interrogator, I do not believe that torture is effective at all. But I do believe in interrogation. There are a lot of things you can do in cyberspace, but you have to understand what’s important to people.
Cohen: I’m more concerned with cyberbullying, which is often torturous [yes!]. As people become more tied to their avatar, that kind of thing can be torturous, setting up duplicates of people’s avatars or blogs, etc.
Q: When law enforcement wants to investigate a player or user in a virtual world, does the user have an expectation of privacy within the dwelling of the virtual world? Do you need a warrant to go into somebody’s virtual home?
Cohen: We don’t know. Law doesn’t keep up. Is it analogous with an intercept or a search warrant?
Schrage: The document that law enforcement looks at is the user agreement with the vendor. There may be a waiver of rights. EULAs are now drawn up with the expectation of law enforcement showing up. Also, the Chinese or the Iranians have different notions of what’s acceptable in a VW. If the Iranian gov’t says that people are acting against Iranian law, does the US compel Twitter to turn over data to Iran? VWs are global, and with all due respect to the Constitution, it doesn’t apply globally.
Q: Teen and tween worlds are a big draw for pedophiles. I was talking to someone from Habbo Hotel who said that 1 in 5 chlidren are solicited for sex [really?]. Are you able to investigate within tween worlds with the tacit understanding that investigations are to remain confidential to protect the reputation of the company?
Cohen: I think the 20% number is low. Create a child avatar and you will likely be solicited in some way. We do not honeypot for the part, but we do not do undercover operations. Some VWs ban law enforcement from their games.
Q: Do you think we are more or less vulnerable in a VW?
Theis: I think it’s easier to recruit people online than in the real world. A real person offering you a Nigerian scam you would not believe, but in VWs it works sometimes. But then there are systems administrators and cyber security folks who are stronger in the VW, but are maybe more naive in the real world. [Ehh, most security nuts are pretty paranoid all over!]
Simon: I think that until populations inside virtual worlds voluntarily submit themselves to certain forms of surveillance, surveillance is going to be impossible in a VW.
