User-Generated Gaming

Old-time favourite game City of Heroes has made a giant innovative leap by being the first massively multiplayer online game to implement user-generated gaming. While other games and virtual worlds offer user-generated content, what makes City of Heroes unique is that it has created a system that allows players to design their own missions and story-arcs within the game, and to offer those to other users (see the video here). The best-rated and most downloaded missions give "influence" to the player (the in-game currencies). An interesting feature of the new content-creation system is that it has been implemented as a "game-within-a-game" concept. A new in-game company in the Paragon Isles called Architect Entertainment sells heroes and villains virtual world subscriptions so that they can create their own missions. Simulations making simulations, Baudrillard would be proud.

The second thing that crossed my mind when I read about this innovation was to consider the many legal angles that this development unleashes (the first thought was that perhaps it was time to dust-off the spandex suit and don the cape once more, but I digress). City of Heroes, like most other MMOGs, claims ownership over all content created by users, and this is no exception. The CoH end user agreement states:

"(c) Customer content. Customers can upload to and create content on the Publisher’s servers in various forms, such as in selections he makes and avatars and items he creates for the Game, and in bulletin boards and similar user-to-user areas ("Customer content"). By submitting Customer content to or creating Customer content on any area of the Service, the Customer acknowledges and agrees that such Customer content is the sole property of the Publisher. To the extent that the Publisher cannot claim exclusive rights in Customer content by operation of law, the Customer hereby grants (or warrants that the owner of such Customer content has expressly granted) to the Publisher and its related Game Content Providers a non-exclusive, universal, perpetual, irrevocable, royalty-free, sublicenseable right to exercise all rights of any kind or nature associated with such Customer content, and all ancillary and subsidiary rights thereto, in any languages and media now known or not currently known. The Customer shall indemnify and hold the Publisher harmless from and against any claims by third parties that the Customer content infringes upon, violates or misappropriates any of their intellectual property or proprietary rights. "

As I said, this is typical of most MMOGs. All rights to content remain with publisher NCSoft, if the user has any rights by law (such as moral rights I guess), the publisher is given a licence to those rights, and the user is liable for any breach or harm arising from the created content. Typically one-sided affair that accumulates all the benefits and washes its hands off any pitfalls. However, something else has struck me when reading through the legal documents. The patch notes for the new release have updated the Code of Conduct to forbid users from making parodies! These now state that "Parodies and derivative works are not allowed." How interesting, given the fact that parodies are allowed in most copyright legislation. However, because this is a user agreement, they seem to be relying on contractual pre-emption of copyright law.

Having said that, NCSoft have been brave in allowing such a change to the game mechanics, and it seems that they were well aware of how difficult it would be to draft policies that would be both fair and would discourage trolling, griefing and abuse. In an interesting article, developer Joe Morrissey admitted as much. How can you avoid people creating obscene and/or objectionable content? If you give power to users to remove content themselves, how do you avoid "grief removals", where players intentionally flag content as inappropriate when it is not. And most importantly, how can you filter out the word "penis"? The most interesting aspect of the game self-regulation process is that NCSoft has implemented a data mining policy that tries to find out patterns. This is interesting, as it seems logical that people prone to create objectionable content will do it repeatedly, while griefers will also be re-offenders. Morrissey says:

"In MMOs you datamine. That's the only real way to know what's going on with your game once it has gone live. So for Architect, we wanted to track as much as we could. We need to see what content is getting flagged. Who is flagging it? Who is being flagged? Has the person ever been banned? If so, how often and for how long? What's a person's overall rating? Has he ever flagged content as inappropriate and been wrong? How often and what content? That last bit helps track down the grief voters."

This is both ingenious and practical; it also serves as a possible regulatory lesson to be learnt outside virtual worlds. Data mining for regulatory purposes is not a new idea, but it is a powerful tool for keeping a lid on user-generated content abuses. Although I still do not like the City of Heroes' copyright policy, I think that they are headed in the right direction when it comes to governance and self-regulation.

Before anyone interjects and mentions Second Life, no, Second Life it is not a game! Besides, it is impossible to write SL content because of the lag (/scratch).

Blurring the real and virtual boundaries

Mathias Klang has posted about an interesting development in the increasing complex interaction between the real and the virtual worlds. Swedish game developer MindArk has been granted a banking licence by Swedish Financial Supervisory Authority. MindArk are known for developing and managing the remarkable Entropia Universe, which is the "first virtual universe with a real cash economy". Entropia is almost always mentioned when talking about virtual economies because its virtual currency has a high exchange rate with real currencies, and they also offer credit cards and other innovative financial mechanisms. The fact that they are now a recognised credit institution is a huge development for virtual worlds, as it makes it even more likely that there will be a viable commercial interface between the real and the virtual.

This comes at the same time as other developments are coming along in virtual worlds which I believe open some interesting interacting options between avatars and real life. For example, World of Warcraft is now advertising a service that allows users to "print" their avatar with a 3D printer, hence having a real world representation of their characters.

My mage gets ready to teleport into the real world.

The possibility of having more direct interaction with avatars outside of virtual worlds opens up interesting questions. What is to be done about intellectual property rights? Could anyone set an avatar 3D printing service without Blizzard's consent? What are the rights of the resulting statuettes? This does not even mention what could happen with an over-imposed world of augmented reality. I know some people are already starting to talk about the IP implications of 3D printing, so at least there is a discussion about these questions out there (LawClanger has been writing an article on this).

Do these developments mean that there will be orcs storming virtual banks, as predicted by Charles Stross?

Book Review: Rainbows End

Before being attacked by the Lynne Trusses of the world, the title of Vernor Vinge's Rainbows End is not missing an apostrophe. The book is named after a retirement community which was chosen by either "an everyday illiterate or someone who really understood the place.” Vinge is part of a wave of technologically sophisticated authors depicting the post-internet world, this cadre includes Charles Stross, William Gibson and Cory Doctorow, yet I am reluctant to call this movement cyberpunk. Post-cyberpunk maybe?

The book is very technical in nature, and includes dialogue on instant messaging (thankfully not on chatspeak); it also introduces several new acronyms for neuroscience technologies that we may have in the future: JITT (Just In Time Training), and YGBM (You Gotta Believe Me). It is possible that all of this SMing and techno-speak may put-off some people, but they do work in the context of the hyper-connected world described by Vinge. While the text conversations get clunky at times, the story makes up for it, and the characters jump out of the page, particularly the main character, erstwhile poet and recovered Alzhaimer sufferer Robert Gu.

The world of Rainbows End is what makes the novel memorable, and I beleive that it showcases three new technologies that make it an excellent read for cyberlaw classes. In this world, medicine has not only managed to expand lifespans considerably, it has begun reversing the process of ageing, particularly neurological debilitating diseases such as Alzheimers. Vinge's real triumph is to describe what would a world inhabited by rejuvenated elderly would look like, particularly because medicine cannot cure everything. So there are people like Robert Gu who have made astounding recoveries, while there are other lucid yet infirm elderly on wheelchairs. This world is also one where wireless broadband is ubiquitous, but the internet looks nothing like ours. Computers are wearable and include contact lenses that over-impose an information layer to reality, so the future web is a vast world of augmented reality where people can wear avatars in everyday life, but also where everything and everyone is tagged with information. The third technological feature of this world is that it is a strictly controlled hardware environment, where every piece of gear has embedded protection that connects with both Homeland Security and with certificate authorities. This allows a level of control that we cannot dream of, but it is also a rather vulnerable world.

There are some really interesting considerations of this post-geriatric world. Leaving aside the bioethics of the technologies described, I found the social implications staggering. We already live in an era sharply divided along generational lines. The wired generations live in a different world than that of the analog ones. While the number of older people adopting some of the technologies is growing (my mother has joined Facebook and frequents internet forums), there is still a large disconnect with the possibilities presented by the user-generated world, so there are entire generations left behind. This is not really explored in social research in cyberspace, but Vinge presents us with an important question. What if lifespans keep getting longer, and older generations have the mental learning capabilities that they had when they were younger? The answer is both shocking and elegant. Send them to school! In Rainbows End, schools are filled with the very young and the very old, both learning how to use and navigate the datastreams. This makes a lot of sense, but it also presents some challenges for a society where the old and the new clash in such manner. There is an endearing connection between teenagers and the old geezers that I found both believable and desirable. Technology could bring back respect for one's elders. What a liberating idea!

Rainbows End is also the ultimate user-generated world. Users can modify themselves, but also their environment. There is one fan-generated layer covering the entire world which has mapped Pratchett's Discworld into our own, so if you were in China you would be in the Agatean Empire, if you were in London you would see Ankh-Morpork, and presumably if you were in Australia you would see XXX. In fact, the world is filled with these "belief circles" where fans choose which reality to inhabit, and sometimes they clash and fight for recognition and space.

Finally, Rainbows End depicts a tightly controlled network environment, where every piece of hardware must have a valid certificate issued by an authorised certificate authority. This is simply the endgame of Trusted Computing, and the embedding of technological protection measures not only into media, but into every single piece of equipment that has a chip inside. While in theory, this allows a level of surveillance unmatched even by our CCTV crazy environment, it can also be circumvented. Vinge's genius is that he recognises that even if those pushing for secure hardware environments get their wishes fulfilled, hackers would still be able to circumvent the technologies by using illegal gear. But also, Vinge describes the dangers of such a world, which would be vulnerable to cascading failures if someone was able to attack a single ceritficate authority and void a whole lot of permissions.

To conclude, Rainbows End is a wonderful look at the near future, but one that leaves some questions for us to decide. I like his view of the post-geriatric world, and I think that augmented reality will soon be here. The book is filled little gems and witticisms that make it highly enjoyable and readable if you get past the texting.

And yes, rainbows do end.

Dissecting a virtual world phishing attack

An interesting development in the latest cybercrime trends has been a marked increase in attacks against online games and virtual worlds, as I have posted previously. One element that I have missed in the discussion about game hacking has been the methods with which cyber-criminals obtain login details and passwords in order to empty the virtual coffers of gamers around the world. I had generally assumed that hackers obtained passwords through a combination of means, including keylogger software, social hacking, guesswork and bad security on the part of the user. I was not aware of large-scale phishing attacks, so when I received my first WoW phishing message, I was both taken aback by its realism, and also in awe of how many people must be falling for this.

First some background. Last year I opened a US World of Warcraft account for occasionally playing when I am back in Costa Rica. I generally do not use this account, so it would be ripe for hijacking. Yesterday I received this message from what looked like a legitimate Blizzard account. I will reproduce it in its entirety only removing the actual link for obvious reasons:

------------------

Subject: Blizzard Account Administration
From: Blizzard [donotreply@blizzard.com]
Reply-To: Blizzard [donotreply@blizzard.com]

Greetings,

An investigation of your World of Warcraft account has found strong evidence that the account in question is being sold or traded. As you may not be aware of, this conflicts with Blizzards EULA under section 4 Paragraph B which can be found here:
WoW -> Legal -> End User License Agreement

And Section 8 of the Terms of Use found here:
WoW -> Legal -> Terms of Use

The investigation will be continued by Blizzard administration to determine the action to be taken against your account. If your account is found violating the EULA and Terms of Use, your account can, and will be suspended/closed/or terminated. In order to keep this from occurring, you should immediately verify that you are the original owner of the account.

To verify your identity please visit the following webpage:
[HTTPS link removed]

Only Account Administration will be able to assist with account retrieval issues. Thank you for your time and attention to this matter, and your continued interest in World of Warcraft.

Sincerely,
Account Administration
Blizzard Entertainment

------------

This was a short and concise message that actually seems plausible, as it arrived to the email account with which my US WoW account is registered. It reads well, with no suspiciously dodgy English or ludicrous made-up names; it also points to the relevant legal documents and articles. Thankfully, I immediately checked the links, and rightly enough, the most important one did not direct to Blizzard, it led to ripside.com, which is a small website hosting service. I visited using Google Chrome (which is new enough not to have developed exploits), and this is what I found:

Which looks exactly like the Blizzard's own account management screen found here. Once I entered some meaningless login and password, I got a large page asking for all sorts of details, including name, address, email, and interestingly, the following:

In short, this is all that is needed for anyone to hijack an account, take all the money and items with them, and run. Every guild has stories of members who have been compromised, and from time to time one can hear the desperate cry of a poor sod in Trade chat who shouts "I'VE BEEN HACKED!"

It is important to stress that Blizzard seems to be taking this very seriously, so they have initiated a campaign to make sure users are aware of the security risks involving their account. There is also a procedure in place in order to reinstate money and items to the victims. However, what is not mentioned anywhere is that these actions constitute a crime, and I am concerned that this is precisely the reason why there is such an increase in hacking activities against gamers. As I have mentioned before, there seems to be some reluctance from crime enforcement agencies to respond to cybercrime in general, and game account hacking would seem to be even at the lowest end of priorities. So, a geek had his magic sword stolen? Who cares?

If hackers have moved towards sophisticated phishing attacks, then we are talking about an entirely new level of engagement. Banking phishing sites are usually taken down within hours of the attack through action from anti-phishing organisations. However, the offending site in this specific attack is still up and running 24 hours after the message was received. This seems to indicate that cyber-criminals are catching up to efforts to curb their scams, and are moving to easier pickings in the shape of virtual worlds. The fact is that virtual goods are worth real money, so the temptation for criminals to make some quick earnings through hacking must be the drive behind the growing number of hijacks. While a criminal will certainly get more money from hacking a bank account, it seems that they realise that hacking a virtual world account is less likely to result in prosecution.

The last element in the line of attacks is that according to the email headers, this message came from New Zealand and what appears to be a compromised Hotmail account. Hotmail seems to be a favourite of phishers and spammers, with Youtube videos explaining how to create fake Hotmail accounts.

Much as with bank phishing, there seems to be a toxic triangle that allows some of this to happen. Firstly, email services like Hotmail seem to make it easy for hackers to exploit the system to send fake emails. Secondly, law enforcement and anti-phishing authorities seem unaware and/or uninterested about the phenomenon. Thirdly, users are still falling for many of these attacks due to lack of care and lack of education.

I'm now off to install some anti-keylogger software. I don't want to lose my enchanted knives.

Has the Ice Stone melted?

(via Matthew Bozarth) A WoW insider joke I had to share.

Has the Ice Stone melted?

Attack of a gold spammer

It seems like as soon as this blog's Technorati ratings go up, we start getting flooded by virtual gold sellers. I don't know if it's because of my earlier confession to having purchased WoW gold, or just random attacks. Last night's gold spammer was particularly prolific, leaving messages in 20 random posts. These bear reproduction merely for the almost poetic manner in which they include the link to the gold selling service. I dn't know abou you, but I find the phrase "the freedom of wrath of the lich king power leveling a bird in the open" has a certain elegance.

"Joy in warcraft leveling living comes wow lvl from having wow lvl fine emotions,wow power level trusting them,power leveling giving them power leveling the freedom of wrath of the lich king power leveling a bird in the open. wlk power leveling Joy in living can age of conan gold never be assumed as a pose,or put on from guildwars gold the outside as a mask. People who have this joy don not need maple story mesos to talk about it; they radiate it. wow gold They just live out their joy and let wow power leveling it splash its sunlight and glow into other lives as naturally as bird sings."

The hyperlinks have been removed to protect the innocent.

Geophysical survey of World of Warcraft

How big is Azeroth? How long would it take you to walk from one end of Kalimdor to the other? How tall are the buildings in Thunder Bluff? What is the height of the Alterac Mountains? A level 29 Warlock set out to find out the answers to these and other questions, and the resulting presentation from James Wallis is a must-see.



Did you know that Azeroth has the diameter is one tenth the size of the Death Star? Yet with gravity similar to Earth, it must be incredibly dense. This warps time due to Relativity, which explains network lag.

Why a warlock? At that level he got attacked by lots of monsters. The warlock can summon a protective demon to take the aggro.

NCSoft sued for avatar patent infringement

(Via Colin Miller) NCSoft, the producers of virtual worlds such as Lineage, City of Heroes and Guild Wars has been sued by virtual platform developer Worlds.com, which holds several patents on 3D environments. Back in December, Terra Nova had reported that Worlds.com had announced that it would be enforcing its patents, and as everyone in the comments section agreed, this was a completely spurious claim. As far as I can tell, Worlds.com is not involved in the MMO market, as it makes bespoke virtual enviroments for corporations and the enterainment industry, yet it has warned that it will enforce its MMO-related patents.

The patent in question is U.S. 7,181,690, which protects a system and method for enabling users to interact in a virtual space. The abstract reads:

"The present invention provides a highly scalable architecture for a three-dimensional graphical, multi-user, interactive virtual world system. In a preferred embodiment a plurality of users interact in the three-dimensional, computer-generated graphical space where each user executes a client process to view a virtual world from the perspective of that user. The virtual world shows avatars representing the other users who are neighbors of the user viewing the virtual word. In order that the view can be updated to reflect the motion of the remote user's avatars, motion, information is transmitted to a central server process which provides positions updates to client processes for neighbors of the user at that client process. The client process also uses an environment database to determine which background objects to render as well as to limit the movement of the user's avatar."

In this line of work I have become used to ludicrous patents, but this one should be awarded a price. Given that the filing date is August 2000, I am sure that any examiner should have come up with examples of graphical avatar interaction in a 3D environment. Meridian 59 and The Realm Online were released in 1996, Ultima Online in 1997, Lineage in 1998, and Everquest in 1999. All of them embody exactly the patent claim, so how could it have been awarded with such extensive prior art?

This is why so many people are opposed to software patents. All you need in order to make money out of litigation is to make a vague claim for which there is a mature market, get it issued because the examiners do not know anything about the subject, and then start suing market leaders in order to extort licence fees from those who are actually innovating and making popular products.

By the way, the drawing with the penguins is part of the patent claim. I kid you not.

Cybercriminals making a killing on magic swords

(via Pangloss) The European Network and Information Security Agency (ENISA) has published a report about the prevalence of cybercrime against virtual world inhabitants. The report states that:

"2007 was the year of online gaming fraud – with malicious programs that specifically target online games and virtual worlds increasing by 145% and the emergence of over 30,000 new programs aimed at stealing online game passwords. Such malware is invariably aimed at the theft of virtual property accumulated in a user’s account and its sale for real money."

Pretty interesting, considering that the real-world value of virtual goods is growing in value, with some experts placing the total GDP of virtual worlds in the trillion of dollars. As these virtual goods become more likely to be exchanged for real money, they will continue to be the target for hackers and cyber-criminals with the intention of removing online gold and other valuables in order to sell them on the virtual markets in exchange for real currency.

The likeliest scenario of a virtual robber is that of a gamer who has his/her password stolen, and then the criminal enters into their account, removing all gold and tradeable valuables, which are then sent to a third party, and probably removed once more to remove traces of the goods. The gold then is sold to third-party gold sellers in China, where it is exchanged to real money when some gamer buys it.

The report also has a likely scenario for attacking guild banks.

"In games such as World of Warcraft, in-game guilds have banks where they store their most valuable items. Full access to such guild banks is limited to players high in the guild hierarchy. However guilds often have web sites open to guests where information such as email addresses, instant messaging usernames and social networking details, are available. Members of the guilds are also active in forums. This leads to the following attack scenario:
• Attacker visits guild sites or forums and checks in the MMO/VW to gather a list of high-ranking officers in the guild and their contact information.
• This is used to gain account information that can be used for social engineering, phishing, hacking, etc.
• Attacker logs in as a player, accesses guild bank, and sells all items.
• Attacker changes account details so a player cannot login. "

I have heard from WoW players and guilds who have been victims of such attacks, but I had no idea of the scale of the problem. As the report rightly points out, this type of cybercrime usually goes unreported, and it is not hard to imagine that law enforcement bodies around the world will be highly sceptical about crime that amounts to someone stealing a magic sword, or currency that is not seen as any different from Monopoly money. However, these crimes have real value, and they are a worrying trend.

Hmmm... I wonder if my online characters still have their gold intact.

The evils of virtual worlds

Yesterday was the official "bash virtual worlds" day in the UK press. With the launch of the latest World of Warcraft expansion (Wrath of the Lich King), news sources went overboard in the coverage of thousands of costumed geeks queuing outside Oxford Street's HMV; at some point the game's launch was the top story in both the BBC and the Guardian, with legions of Tauren and Night Elves adorning the streets of London attracting similarly large numbers of journos and papparazzi. The tone of the coverage has been mixed, but the overarching theme has been set by the Today program, the BBC 4 flagship radio news and current events show which usually sets the agenda for the days news throughout the British media. The technophobes in chief at Radio 4 decided to run not with celebratory coverage, but with a report about the dangers of online game addiction kicking the day's news. Then we were treated to similar coverage, with one doctor being interviewed about the many teenagers falling prey to the evils of game addiction. Further reports stressed on the addiction element. Other news outlets continued the trend, the Telegraph reported on one gamer who collapsed after queuing for 40 hours without food or water, the Times lamented about WoW Widows, while the Daily Mail was uncommonly subdued. At the other end of the spectrum, the tech-friendly Guardian adopted a more balanced reporting. The main story did contain some talk about the addiction controversy, but there were several comments against the seemingly unstoppable tide of negative articles: Alex Sassoon Coby wondered why the game is so popular, Rowenna Davis wrote an astute comment about the virtual versus physical reality, Naomi Alderman made a rather preposterous post about how gaming helped her go through post-9/11 trauma, while the always enjoyable Jack Schofield wondered if WoW can save people from TV addiction. Jack says:

"Millions of British people are addicted to something they call "the boob tube". Every night they slump for hours in front of a flickering box, having their brains rotted by a continuous diet of mindless pap. They could be doing something interesting with their lives, but they need a continuous stream of stuff, and it's available right round the clock. They can't go out, they don't have time for proper meals, they can't even take a bathroom break when they need one. If they miss a dose due to holidays or illness, they start trying to "borrow tapes" or even going online to hunt down that missing episode of EastEnders, Coronation Street, Strictly Come Dancing or whatever."

Granted, while the addiction angle was down-played by some outlets, the day was capped by another virtual world story. By the afternoon, Warcraft geeks had been pushed from the headlines by the sad story of Amy Taylor and David Pollard, a married couple (both on and offline) who had an extensive presence in Second Life. Ms Taylor filed for divorce from Mr Pollard because she allegedly caught him chatting intimately with another SL character. Ms Taylor told the Daily Mail that "It may have started online but it existed entirely in the real world and it hurts just as much now it is over." The news coverage that ensued had a tinge of sensationalism mixed with the very clear implication that there is something clearly wrong with these people. Perhaps I am being slightly unfair to journalists and commentators. The SL divorce story is indeed farcical, but the world is filled with all sorts of sad people who end their relationships for less of an excuse. Where are the stories covering the thousands of divorces due to email, SMS, chat rooms, and Facebook?

While I have low expectations of the British media, it seems to me that there is a deep Luddite vein that is exploited repeatedly whenever games and virtual worlds are concerned. For most people, gaming simply replaces other entertainment activities, such as reading, watching TV, or listening to the radio. When you boil it down to basics, gaming is a way of removing oneself from reality and experiencing other points of view. But is that not the same of reading? When reading I have spent countless hours lost in Middle Earth, visited Macondo, explored the Galaxy in Culture ships, and metamorphosed into a giant insect. On TV I have followed the perilous journey of the Battlestar Galactica in its brave escape from the Cylons. In cinema I have witnessed the triumph of the Rebel Alliance, followed the romantic adventures of a French waitress, and seen seven brave samurai rescue a village from bandits. Those are hours of my life "wasted" in other realities instead of "being outside" doing "real things" and interacting with "real people". Are there people who abuse gaming? Sure! But so do lots of people who abuse alcohol, knitting and sport. To me this is the most fallacious of dichotomies, people who are inclined to spend 12 hours in front of a computer screen playing a game are not likely to suddenly go out and become involved in "real life" if you switch the computer off.

What really worries me is that the talk of "addiction" is usually followed by concerned calls of people asking the government to "do something about it". I am just waiting for the first call by someone to think about the children. I will then run out of the room screaming. Thankfully, the gamer stereotype will be shifted by demographic changes, as more and more people will have grown up with computer games (hey, even celebrities are doing it!)

For the record, I'm not buying Wrath of the Lich King, I'm bored of Warcraft.

Woman jailed for killing avatar

Internet news sites are abuzz with the report that a Japanese woman has been jailed after reportedly "killing" her virtual husband's avatar after a virtual divorce. A 43-year-old Japanese piano teacher was virtually married to a 33-year-old office worker in the online game Maplestory - a cutesy Korean manga-style world.

Reportedly, the husband divorced his virtual wife without warning, and hell hath no fury like an avatar scorned. The piano teacher knew the login details of her online lover, so she entered the game using his password and deleted the character. An avatar had ceased to exist, for all practical purposes, it had been killed. The owner did not take the "killing" lightly, phoned the police, and the Sapporo woman was arrested and taken into custody charged with "illegally accessing a computer and manipulating data". None of the many reports say if she has been released, but the charges carry a maximum sentence of one year and maximum ¥500,000 JPY fine (contrary to the five years claimed by many news sites).

It is perhaps too easy to laugh at the mirth-inducing reports of middle-aged piano teachers and mild-mannered office workers taking their manga characters way too seriously. Nevertheless, it seems evident that there are some interesting legal issues at stake. Firstly, I find it intriguing that anti-hacking laws are being used to protect the integrity of an avatar. The statute in question is the 1999 Unauthorized Computer Access Law, which as the name suggests, penalises unauthorised access to a computer. Art. 3 reads:

Article 3. No person shall conduct an act of unauthorized computer access.
The act of unauthorized computer access mentioned in the preceding paragraph means an act that falls under one of the following items:
(1) An act of making available a specific use which is restricted by an access control function by making in operation a specific computer having that access control function through inputting into that specific computer, via telecommunication line, another person’s identification code for that access control function (to exclude such acts conducted by the access administrator who has added the access control function concerned, or conducted with the approval of the access administrator concerned or of the authorized user for that identification code);

There is no reason why this criminal type would not apply to the present case (that's too many negatives). Moreover, avatars are the embodiment of hours of hard work on the part of the player, and it would be interesting to see if besides the criminal conduct incurred, the perpetrator could also be the recipient of civil action. Nowadays it is possible to allocate real-money value to virtual goods, so a high-level character could be worth a lot of money. If a person deletes the character, shouldn't there be some sort of civil damage recourse as well?

Finally, I think that if this case had taken place in the UK, one could have used the Computer Misuse Act. s1 and s3 of the act penalise unauthorised access and unauthorised modification of computer material respectively.

I'm now off to make sure that my many avatars are still alive.

Virtual currencies stifled by regulation?

(via panGloss, The Register and Out-Law) Roll back the time to 1999. The internet was relatively new, electronic commerce was still a buzz-word, and everybody was talking about electronic cash, virtual currency and Mondex. In the future we would have relinquished our reliance on paper money, and we would be conducting our everyday commercial transactions with a combination of smart cards, RFID chips and mobile phones. The European Commission, in a characteristic surge of regulatory vigour, drafted several directives dealing with e-commerce, including the Electronic Money Institutions Directive, the legal skeleton supporting the frame of the brave new incorporeal marketplace.

Fast forward to 2008. My trousers are still jingling with coins. I look into my wallet and those pesky pieces of paper are still there. True, I have several smart cards, but those chips are inserted into "traditional" payment methods, such as credit and debit cards. Whatever happened to our dream of electronic money?

The European Commission conducted a consultation process that looked at the topic of e-money, and the findings are troubling. There are only 20 electronic money institutions in the entire EU, and the issued value amounts only to 1 billion EUR. The consultation unearthed some problems with the existing legislation that stifles the provision of electronic money. The impact document states that:

"During the review process, stakeholders expressed concerns that the current directive lacks legal certainty. First of all the definition of electronic money is considered unclear. Second it is unclear for stakeholders whether or not it is applicable to certain business models such as certain prepaid payment from mobile network operators and electronic vouchers."

So, we should blame the legislation for the lack of electronic money... or should we? True, I am on record criticising the EMI directive, and how the definitions were pretty useless when looked at closely. PayPal pretty much exploded the system when it was declared an EMI, an later became a bank. Similarly, I have always been averse at proactive regulatory efforts because it is my strong belief that they usually fail miserably in reading technological advances. The regulatory landscape of electronic commerce and information technologies is filled with the carcasses of failed and/or ineffective pieces of legislation drafted with specific technologies in mind.

Nevertheless, I do not think that the EMI directive is to blame. I blame the efficiency of traditional payment systems. Why have an extra cash card, when debit cards will suffice for most transactions? Why try to jump-start the electronic money market, when PayPal dominates electronic payment systems? Moreover, electronic money has not taken off in jurisdictions that never enacted the EMI directive, which tends to confirm in my mind that the problem is one of consumer confidence and lack of a "killer app" in the field of electronic money.

Last year I asked a simple question to my students for their essays: “Virtual in-game currency, such as Linden Dollars, is electronic money as defined by the Electronic Money Directive”. I got some excellent answers as a result (I'm hoping LawClanger will publish his essay), which served to confirm that the directive was bursting at the seams when confronted with real-life examples. I still think that virtual currencies could be classed as electronic money, and the admission of regulatory defeat by the Commission has served to confirm my suspicions; I believe that the growing economic importance of virtual currencies will eventually prompt the recognition of virtual currency as valid electronic money. Hopefully, the more generic definitions contained in the new directive proposal will serve to that effect.

Farming gold for development

(via Wiebke Abel) The BBC has a fascinating story on the astounding growth of virtual economies. Richard Heeks of the University of Manchester's Institute for Development Policy and Management has produced a report entitled Current Analysis and Future Research Agenda on "Gold Farming". The report makes for a fascinating read, and should validate the importance that many researchers like yours truly give to the regulation of virtual economies. According to the report:

"In basic terms, gold-farming is a sizeable phenomenon. The rather wobbly-legged best guesses for 2008 are that 400,000 gold farmers earning an average US$145 per month produced a global market worth US$500m; but we could easily more than double the latter to over US$1bn. There are probably 5-10m consumers of gold farming services. The main uncertainty of estimation relates to the gold-farming market in East Asia, which appears much larger than that in the US/EU. That uncertainty in part arises because gold farming operates at four levels – local, national, regional and global. We should encompass all four but, to date, the focus has been almost entirely on the global trade."

Even with the conservative estimates presented by the report, these are astounding figures. The numbers involved seem to suggest that gold farming is a valid and profitable industry, and that "playbourers" earn a decent living from it. Moreover, gold farming validates the importance of in-game economic activity by giving it a tangible value in the outside world.

This economic impact should perhaps strengthen the calls for regulatory oversight and policy examination of the role of virtual worlds in modern society. While they are still considered a form of fringe interest by the geeky classes, it is undeniable that an activity that employs 400,000 people in developing countries is worthy of examination. Isn't this a valid trade law subject? Where are the papers examining the electronic commerce implications of this phenomenon?

Richard Heeks concludes his report with an interesting plea:

"One final point. Credible analysis of gold farming can only be undertaken by researchers who play the games, and have engaged in real-money trading. With that, back to Azeroth for some more "research time". "

I concur. Unfortunately I have uninstalled WoW from my Mac laptop. Perhaps this would be a good opportunity to migrate to an American server. Does anyone have a good guild I can join?

Update: Interesting blog post on this study here.

Virtual Policy '08 Conference

I've just attended Virtual Policy '08 in London, organised by BERR and the Virtual Policy Network. This has been a different event because it has brought together regulators, industry, educators, developers, economists, and academics to explore current and future policy issues involving virtual worlds. The wide number of sectors represented has produced an interesting combination of papers (and wide range of dress styles). You can catch some discussion of the policy issues at this week's Guardian's Technology Podcast with Aleks Krotoski and Ren Reynolds.

One of the highlights of the event for me was to hear Professor Richard Bartle, who I had heard before at last year's State of Play. Richard Bartle is an entertaining speaker, and he made some interesting points about regulation, demographics and entertainment. One of the things I really enjoyed was how he explained the popularity of games like WoW or Age of Conan by explaining it as part of Joseph Campbell's heroic archetypes. There is also a very clear split between the gamers and the Second Lifers in this area of study, and Richard Bartle broke the truce and mentioned that SL is only a small part of virtual worlds (5 W0W servers worth), while the largest number of players are in game-oriented worlds. I almost stood up and cheered.

Other highlights for me were the IP panel in which yours truly participated. David Naylor gave an excellent introduction to some of the most pressing infringement issues, while Andreas Loeber gave a very good introduction to some of the potential issues in avatars and personality rights.

We also had a very good panel on Financial issues, where former student Simon Bradshaw gave a cracking presentation on the question of whether virtual currency is electronic money.

This was a very good event, so I will not be posting any doodles from it.

World of Lawcraft: Breach of EULA is infringement

(via B2fxxx and Terra Nova) Back in March we reported on an important suit involving World of Warcraft and software developers MDY (I don't know why I'm using "we", it's only me writing this). The suit involved cheating autopilot exploit which allows a player to gather gold automatically by using intelligent agents and bots to control an avatar. MDY distributes software advertised specifically to serve as an exploit, which represents a serious problem for WoW developers Blizzard Entertainment because it affects legitimate players who put time and effort into levelling and gathering gold.

Blizzard's Terms of Use (ToU) clearly prohibits such practices, by stating that:

"You agree that you will not (i) modify or cause to be modified any files that are a part of the Program or the Service; (ii) create or use cheats, bots, "mods", and/or hacks, or any other third-party software designed to modify the World of Warcraft experience; or (iii) use any third-party software that intercepts, "mines", or otherwise collects information from or through the Program or the Service. Notwithstanding the foregoing, you may update the Program with authorized patches and updates distributed by Blizzard, and Blizzard may, at its sole and absolute discretion, allow the use of certain third party user interfaces."

MDY's actions seem to be unequivocally a breach of these terms and conditions. However, it must be stressed that the above is not the licence itself. WoW's End-User Licence Agreement (EULA) is a separate document which grant the user the right to perform actions which otherwise would be infringing, in this case, install the program into a computer. Under normal circumstances, a breach of licence usually translates into the termination of the agreement, and therefore, the termination of the licence to use the work, but it does not immediately translate into copyright infringement. Breach of licence will normally herald the termination of the permission to use the work, and further uses would be infringing. Does a breach of the Terms of Use mean that the licence has also been breached? Blizzard's EULA clearly states that the user must comply with theToU, but nowhere does it say that breach of those terms will translate into a breach of the licence! Similarly, it seems clear to me that the licence was drafted to accomodate the theory of termination described above, as it sets out the effects of termination:

"Blizzard may terminate this Agreement at any time for any reason or no reason. In such event, you must immediately and permanently destroy all copies of the Game in your possession and control and remove the Game Client from your hard drive. Upon termination of this Agreement for any reason, all licenses granted herein shall immediately terminate."

Blizzard sued MDY for selling the exploit, but not for breach of Terms of Use, but for copyright infringement. This is why I believe that this case is so important. Blizzard's lawyers are claiming something that rests at the heart of the interaction between contract and copyright law. Does breach of licence mean copyright infringement?

The United Stated District Court of Arizona has just decided on the case of Blizzard Entertainment v MDY, and it's a doozy. As explained above, the heart of the question is whether a breach of terms of use constitutes copyright infringement. Blizzard argued to the court that it does, and presented two cases that supported this assertion. MDY on the other hand argued that even if it is in breach of the TOU, this would not constitute copyright infringement because MDY's actions are not an exclusive right protected by copyright; there is no right not to cheat in a game. MDY presented Storage Technology v Custom Hardware Engineering as a relevant authority that explicitly recognises that there cannot be copyright infringement on rights that do not exist, but the court dismisses this claim. Similarly, the court agreed that existing licensing law in the United States admits that granting a licence usually innoculates users against copyright infringement claims. The Court cites Sun Microsystems v Microsoft:

“Generally, a copyright owner who grants a nonexclusive license to use his copyrighted material waives his right to sue the licensee for copyright infringement and can sue only for breach of contract. If, however, a license is limited in scope and the licensee acts outside the scope, the licensor can bring an action for copyright infringement.”

Similarly, this case is not only about MDY, it is about all MDY users. Blizzard's argument is that each user who is installing MDY's cheating software are in breach of their ToU, therefore in breach of the licence, and therefore are infringing copyright. MDY therefore is guilty of contributory and vicarous copyright infringement, akin to Grokster and other P2P providers. The District Court of Arizona therefore ruled in Blizzard's favour, and therefore MDY will be held liable accordingly.

I must say that I do not like MDY, and my initial reaction was to wish Blizzard the best. However, this is a diabolical ruling. The actual effect of the court's argument is that if any user is in breach of the Terms of Use, they will also be liable for copyright infringement. To put this in other terms, if I let you into my house, I am giving you a permission to enter. I cannot just decide to revoke my permission unilaterally (which is what Blizzard's EULA says), and while you're inside call the police alleging that you broke in. No wonder EFF have flipped over the story (although I do not agree with their provoking title). William Partry is also befuddled by the strange decision.

So, next time I see someone misbehaving in Ironforge's bridge, I can say in the chat box: "Pardon me chap, but are you aware that your actions may constitute copyright infringement?"

Where have all the spambots gone?

As an update to the WoW gold spamming story I wrote earlier, I have noticed that in the last month the spambots have gone. There is still some spam, but I could swear that SpamMeNot has been reporting less and less spam recently. I have also noticed that the corpses have gone from Stormwind's Auction House.

I have been searching official forums for an explanation, but so far I have found none. It is interesting that forum moderators are ordered to delete spam-related threads immediately, so I have not found any mention of this. I can only see one of these options as the reason for the reduction of in-game spam:

• Spammers have given up after the many thousands of deaths, and moved somewhere else (unlikely).
• Gold websites have disappeared (even unlikelier).
  
• Blizzard has recognised this as a serious problem, and have implemented a technical solution that gets rid of most of the problem.
  

I vote for option 3, but I do not know how this has been achieved.

Democratic engagment or PR ruse?

There has been considerable excitement in those interested in virtual world research about the results of the election of EVE Online’s Council of Stellar Management, which is as far as I know the first ever democratic experiment involving users of a virtual world. EVE Online is one of the most hard-core MMOGs in the world, an innovative and vicious global network of players engaged in galactic domination. The game has many interesting features that make it an excellent case study for regulation of the new virtual lands. It is a unique server, which means that unlike more popular games like WoW, all players can engage regardless of location. The game is also based on a unique premise, that of corporate and imperial greed in search of resources with which to bash your opponents. This has been translated into a loyal fan-base of tens of thousands, but little room for expansion, as the barriers to entry for new players are too big to overcome.

Now CCP, the Islandic company behind the game, have decided to empower its player-base by holding elections on the Council of Stellar Management, a body consisting of players which will be flown into Iceland to have direct talks with CCP and game designers. The press release reads:

"Since the earliest days of EVE’s development, we have relied heavily on collaboration with our playerbase regarding world issues. CCP has followed and nurtured what governing and organizational structures emerge within EVE and also brought best practices from the real world into the virtual world,” said CCP CEO Hilmar Veigar Petursson. “The formation of the Council of Stellar Management signifies to us that that EVE has extended beyond the parameters of being ‘just a game’ into something more meaningful. As this first group of Councilors works with us over the course of the next six months, we look forward to seeing how our combined efforts can further expand the potential for virtual worlds to entertain, educate and inspire.”
The men and women of the assembly will travel from their homes in the United Kingdom, United States, Netherlands and Denmark to Iceland in June for their first face-to-face summit with CCP representatives at the company’s corporate headquarters in Reykjavik. Speaking on behalf of the players that elected them, the Councilors will discuss EVE-related issues, offer suggestions and exchange ideas to continue the evolution of EVE, which recently celebrated its five-year anniversary."

This is quite a unique solution to the issue of governance of virtual worlds, but one has to wonder if it will be a genuine attempt to engage the fan-base, or it will end-up being just a clever PR exercise.

I found the demographics of voting more interesting than the actual vote itself. Veteran players constituted the largest voting block, and it is interesting to see that while roughly one third of EVE players are American, the actual voting was well-spread geographically.

Regardless of my typical cynical reservations, I believe that this vote is unique. Is this the birth of virtual democracy?

Machinima for good causes

This is an excellent use of Machinima to illustrate the need for Fair Trade.

Death of a gold spammer

(The next victim stands on top of a pile of dead spammers)

A curious scene has been taking place in the streets of Stormwind. The square between the Auction House and the Bank is by far the busiest place in the game, with dozens of players moving to and from the commercial hub. This is why the square is also the favourite location for gold spammers. The spammers are randomly generated Level 1 characters, operated as bots and programmed to repeat an endless stream of ads. The typical message gives the name of the site, and the current price of gold. The constant stream of chat spam is so annoying that it has become a serious problem for players. Most people ignore it, but there are some who have taken the law into their own hands.

It is not possible to hurt a character from your own faction without inviting them to duel. Even if a player from another faction got there, he would not be able to kill the spammer, as he needs to be flagged for PvP. However, someone found that a shaman can cast a totem that will give just enough damage for a few seconds to all around it, even players from the same faction. This will not hurt anyone else, but it will kill a level 1 character. Because these are bots, the corpse will sit there, and will not resurrect. One can't spam when one is dead.

There are several legal issues here. Firstly is the legality of killing another player in this fashion. Interestingly, this is an action that is considered to be a game exploit, and therefore it is a bannable offence that would fall under s B.7-8 of WoW's Terms of Use. According to that, users may not:

"7. Harass, threaten, stalk, embarrass or cause distress, unwanted attention or discomfort to any user of the Program;
8. Cheat or utilize "exploits" while playing the Program in any way, including without limitation modification of the Program’s files;"

Because the exploit is a bannable offence, the thread where it was explained was deleted, but by the wonders of Google cache, you can find it here.

The second legal question is one of regulation. It seems like WoW is somewhat reluctant to completely stamp out gold selling and spam; see Judge Ung-Gi Yoon's excellent article on the subject (thanks to Nic Suzor for the link). However, there are several regulatory responses to the problem posed by chat spam. The first one is to use the top-down, legislative and contract approach, which is to make this a bannable offence under the terms of use. Sections B.2-3 of the Terms of Use deal with that:

"2. Carry out any action with a disruptive effect, such as intentionally causing the Chat screen to scroll faster than other users are able to read, or setting up macros with large amounts of text that, when used, can have a disruptive effect on the normal flow of Chat;
3. Disrupt the normal flow of dialogue in Chat or otherwise act in a manner that negatively affects other users including without limitation posting commercial solicitations and/or advertisements for goods and services available outside of the World of Warcraft universe;"

While this is enforced, the solution by spammers is to create characters as soon as the old ones are deleted, which explains why gold farmers are all Level 1. As with email spam, the second solution is code. SpamMeNot is a WoW plugin which filters out most of the chat spam, and a very effective one at that.

The third solution is the vigilantism described. It is intriguing how virtual communities will revert to community enforcement when they perceive that the legal solutions are not working. Suddenly, it is the Wild West all over again.

I'm sure that Blizzard will soon plug this exploit, but on the meantime, all bots in the vicinity of Stormwind better beware. Avatars are up in arms, and they want revenge.

Regulating gold farming

I'm in Malaysia for a WIPO seminar on the software industry (note to self: in the future, stay away from water and ice). Yesterday there was an interesting session on the gaming industry in the Asian region. The representative from the Japanese software industry gave statistics on the subscription-based online gaming market. By 2006, there were 660,000 people playing subscription-based games (of which 90,000 were female). Laura Ho from the Malaysian Multimedia Development Corporation had an interesting take on virtual property. While it is clear that some games make claims over ownership of virtual goods, what happens in exchanges between two players? While the actual ownership over the intellectual property may be clearly delimitated through licences, what is the relationship between users?

This made me think about the growing economic importance of virtual economies, but also brought me back to my own experiences with gold selling. On the plane in I read an article in Edge magazine on the behind-the-scenes work of support staff at NCSoft Austin. A prominent part of the interview talked about the problem of gold farmers, and about the amount of resources that go into curbing farming. Support staff are very much aware of the activities of gold farming, so they claimed to conduct account banning, as well as being familiar with Chinese IP addresses. One of the claims is that farmers are given away by sudden large earnings, or by unusually large transactions.

Farming is clearly aganst most EULAs, but I was wondering about the extent of policing excercised. For example, I think that whatever the evils of farming, the underground economy could actually be good for a game. Farmers must be subscribers after all, and many other virtal inhabitants appreciate access to gold without countless grinding hours.