The rapidly changing nature of information and communications technologies suggests that as soon as new hardware, software or other applications are introduced, they will be exploited in some form or fashion by international criminal organisations. The speed at which criminals can exploit these technologies is truly remarkable. Unfortunately, law enforcement and the criminal justice system, bound by limited budgets, finite training, and traditional legal regimes are much slower in their abilities to respond.
Cybercrime has, and will continue, to evolve overtime. From the early days of phone phreaking and the hacking of Bulletin Board Systems (BBS’s), information technology crime has transformed itself to include a much broader spectrum of criminal activities comprising previously unimagined technical forms of malfeasance, such as computer viruses, worms and Trojans; hacktivism, phishing, botnets, critical information infrastructure attacks and even cyber-terrorism.
Given the significant advances in computer processing power and the growing number of Internet users around the world, it should come as no surprise that newer forms of criminal conduct in cyberspace are surfacing, to include crime and disorder in “virtual worlds”(1) as well.
What are virtual worlds?
The concept of “virtual reality” is new to law enforcement agencies around the world. Yet every day, millions of people connect in these 3-D worlds to socialise, shop and learn. Unfortunately, lawbreakers have also joined these virtual worlds and the full range of criminal activities is now also present. Common “real world” crimes are occurring every day in virtual worlds, including money-laundering, theft of intellectual property, exchange of child abuse images and even suspected terrorist activities. For these reasons, new virtual worlds and communities pose a unique set of challenges for the criminal justice system. Moreover, the near total lack of requisite jurisprudence means that criminals are often free to act with impunity.
Features of Virtual Worlds
Virtual Worlds can often be classified according to their specific features. The most commonly seen types of virtual worlds break down into two general categories: game-playing and community-based, although they often share some characteristics of the other. One of the interesting developments with certain Virtual Worlds is the possibility of transforming gains generated within these online spaces into real world money.
As a result, a whole new breed of entrepreneurs has developed and several “virtual industrialists” have turned virtual world activities into real world profits. Perhaps the most famous of these virtual world entrepreneurs is an individual whose Second Life character is known as Ailin Graef, but in reality is controlled by Chinese national Anshe Chung. Chung created a real estate company within Second Life and as a result became the first “real world” millionaire based solely upon her activities in virtual worlds.(2)
In short, “virtual worlds” create an alternative reality where users can represent themselves as they wish, in just about any format they desire through their “avatars.” Men can become women, women men, adults may become children and human beings may transform themselves into animals, superheroes or monsters.
Virtual worlds often contain elements common to other types of online activities, such as MMORPGs (Massive Multiplayer Online Role-Playing Games). MMORPG’s are videogames that allow thousands of players to simultaneously enter a virtual world and interact with one another. Players can run their own “cities and countries,” stand up armies to win battles and go on any variety of “quests” with their own avatars. These avatars are completely customizable. Within MMOG’s participants may communicate with each other through a variety of means, including text chat or real time voice communication, using technologies such as VOIP to carry their messages.
Common Virtual Worlds
There are dozens, if not hundreds, of virtual worlds and MMORPG’s in existence today, with new ones emerging increasingly frequently. Perhaps one of the most popular virtual worlds is Second Life (SL), which was established by Linden Labs in 2003. SL has grown significantly over the past years and has an international reputation as one of the preeminent non-game based virtual reality worlds. Among MMORPG’s, the World of Warcraft (WoW) is perhaps the most popular worldwide. Players control a character/avatar within the game world, exploring the landscape, fighting monsters, completing quests and interacting with Non-Player Characters (NPCs ) or with other players. Other common virtual worlds and MMORPG’s include Club Penguin, Lineage II, Habbo, HiPiHi, Runescape, Entropia Universe, Gaia Online and IMVU. The number of users in virtual worlds is impressive, with tens of millions of individuals visiting these spaces every month. Blizzard Entertainment’s World of Warcraft alone has over 11 million active subscribers:(3) if WoW were it’s own country, it would be the 75th largest in the world, surpassing Belgium, Portugal, Sweden, Austria and Switzerland in terms of population size.
Psychology of Virtual Worlds
To many that live in the “First World,” the concept of a Second or Virtual World may not make much sense at all. Many criminal justice officials may be asking themselves why individuals would spend so much time in these simulated environments. The answers are complex and are not yet fully understood by psychologists. To many, virtual worlds offer not just a form of entertainment, but also a means of escapism, a way of creating an alternative environment that is much more attuned to the user’s liking. The fantasy lives permitted via these virtual worlds create almost unlimited opportunities for escapism, starting from the fact that an avatar does not need to have any verisimilitude to how one appears or behaves in real life.
In order for any investigator to understand virtual worlds, the crimes that take place therein, and the suffering of victims of “virtual crimes,” it is critical that the investigator gain insight into the mindset of virtual spaces’ “inhabitants.” Many of them sincerely see their “second lives” as “first lives,” to the extent that, for the more extreme participants (about 20% of MMORPG gamers), the real world (a.k.a. “meatspace”) is nothing more than a secondary home in which to eat and sleep, while the virtual world clearly represents in their minds their first place of residence and interaction.(4)
Until one fully grasps the how real the “reality” in virtual worlds is to its participants, it will be impossible to successfully understand the mindset of both the criminals and the victims who participate in these new virtual communities. Only by understanding this mindset can one begin to comprehend why somebody might show up at their police station to report a virtual rape, a virtual assault, a virtual burglary or a virtual suicide.
Millions and millions of euros are spent each year in various online virtual worlds. While the idea of a “virtual economy” versus a real world economy might sound strange at first, most virtual worlds allow for some exchange of goods and services, either through bartering systems, or by overcoming various game challenges or through the use of “virtual currency.”
While previously many of these economies were strictly virtual, recently there has been a cross over between virtual worlds’ economies and real world economies. Some virtual worlds actually have currency exchange rates with real world currencies such as dollars, pounds, RMB and euros. That means it is possible to buy Linden Dollars or Entropian dollars with Swedish krona or Brazilian reals. Often virtual currencies trade with or without authorization in a booming secondary market, which operates without any regulations, opening the door to further criminal opportunities.
Real Crimes in Virtual Worlds
Many police officials, including seasoned and experienced cybercrime investigators, may not have yet investigated a case involving a virtual world or MMORPG. Faced with already overwhelming caseloads from traditional forms of cybercrime, such as hacking, Internet fraud and online child abuse images, few investigators want additional work from virtual cases. That said, we believe that virtual world crimes merit further examination given their inevitable emergency into the daily workload of cybercrime investigators around the world.
While it might be tempting to ignore MMORPG crimes as being purely virtual in nature, and thus not “real,” the vast majority of virtual crimes have real world victims. While one can certainly argue whether “virtual rape” indeed constitutes “real rape,” let there be no doubt about the economic or psychological effect of these crimes on their victims, since these virtual spaces are every bit as real to their inhabitants as is the physical world to most investigators.
Given the size of virtual world economies, it should not be surprising that many of the crimes committed in virtual spaces involve financial fraud or other nefarious activities for criminal economic gain. Virtual World economist Edward Castronova has estimated the value of all the goods and services produced in virtual worlds to be between 7-12 billion US dollars per annum. He further noted the economic transfer of at least 1 billion dollars in virtual currencies per annum as of May 2009.(5) As such, the virtual economy dwarfs the “real world” economy of dozens of countries around the world.
The proliferation of virtual currencies, such as Linden Dollars, WoW gold, QQ coins and so many others, has created an attractive economic target for international organised crime groups. Long gone are the days where hackers engaged in criminal activities merely for the “fun” or “challenge” of the matter. Modern organised crime seeks first and foremost financial gain and the amount of money in MMORPG’s poses an incredibly enticing target for them and the millions of MMORPG users can become to organised crime a readily accessible victim-base. The emergence of some dominant companies in the MMORPG field, such as Second Life and World of Warcraft, has meant that criminals can now create computer malware and social engineering scams to specifically locate and target large numbers of potential victims.
There are several tried and tested ways of committing financial fraud in virtual worlds, including social engineering, exploiting or hacking MMORPG servers and the introduction of malicious computer code into an individual’s virtual world environment.(6) Social engineering attacks occur when cyber criminals enter an MMORPG or an associated, but independent, gaming forum where they search out users and offer them help or various bonuses to help “improve” their user experience or increase their gaming level. In exchange they solicit user names and passwords so that they can carry out the purported helpful work.
The Role of Malware
These malicious programs or computer Trojans enable a wide variety of criminal activities in MMORPG’s, including the theft of virtual goods and money. The number of malware programs specifically directed at virtual worlds and online gaming has increased dramatically over the past few years. In fact, according to computer security company Kaspersky Laboratories, over 30,000 new malicious programs specifically targeting online games were introduced in 2008.(7)
Over the past decade, a number of new alternative forms of payment have been introduced throughout the world to keep up the growing volume of electronic commerce. The most famous of these companies is PayPal, which became a wholly owned subsidiary of eBay in 2003. PayPal made it easier for payments to be made through the Internet and serves as an electronic alternative to traditional paper money, checks or bank money orders. It can be very useful for the vast majority of the planet’s inhabitants that do have access to a credit card. Of course alternative payment systems also open up the doors to alternative forms of money laundering.
While PayPal was certainly revolutionary in its approach, it always settled transactions in well-established forms of national currency, such as dollars, yen or euros. Over the past few years however, a number of virtual worlds have begun to issue their own forms of currency. With names like the Linden Dollar (used by Linden Lab’s Second Life), World of Warcraft Gold (from Blizzard Entertainment) or QQ Coins (by Tencent Limited), these virtual currencies are being used by literally tens of millions of people worldwide. There have been various estimates of the size of the virtual world economy, but some estimates have placed it in the billions of (US) dollars.
Given the vast sums of money being transferred among parties around the world, it should not be surprising of course that criminals would want to take advantage of this money flow. With little if any regulation, virtual world economies are ripe for exploitation by organized crime, terrorists and others who wish to launder large sums of money.
While virtual world money laundering has theoretically been a possibility for some time, the following case clearly shows that theory has now been put into practice, to the tune of $38 million US dollars. As the Seoul Metropolitan Police Agency (SMPA) demonstrated, a group of Chinese and Korean criminals were able to successfully defraud Korean game players and then launder the funds through a number of business front companies back in mainland China.
In further evidence demonstrating the growing value of virtual world goods, a court in China handed down a 3-year prison sentence in mid-2009 to a known gang member for extorting virtual goods. According to Chinese officials, three suspects cornered the victim in a cyber café and noticed he had a particularly large balance of virtual goods in his QQ-Tencent account. An assault ensued and the victim was forced to turn over the equivalent of nearly 100,000 RMB of the virtual currency QQ coins.(8) This case is interesting in that it shows that virtual goods must be of value in order for the arrest and prosecution to have occurred. As virtual goods proliferate, more and more individuals could become victims of virtual thefts and extortions.
Possession of Child Abuse Images
By the very nature of their entertainment value, virtual worlds and MMORPGs are attractive to people of all ages, and in particular to young people. The enticing cartoon-like graphics, the gaming potential and the entertainment value all make virtual worlds of interest to a younger audience. Of course this is not to say that children are the only ones using virtual worlds. In fact, across the board, most users in MMORPG’s are in the 20’s and 30’s, but average ages vary greatly from game to game. Second Life tends to draw an older crowd than Disney’s Club Penguin for example, which targets children from 6 to 14 years of age.
Many virtual worlds allow for outside connections and communications: text chats, real-time voice over internet protocol (VOIP) conversations, exchanges of photographic and video images with one another. While friends might want to do this for legitimate purposes, there certainly could be criminal implications as well.
For example, a number of paedophiles could create avatars in Second Life providing false identification details. They could meet each other in various chat rooms/islands dedicated to “child love” or “Lolita” or any other such keyword and begin socializing with each other. One of the paedophiles (represented by his avatar) could readily build a movie theatre on the island of his choice and show whatever streaming video file he chooses. So in effect, it would be entirely possible to have a virtual room full of paedophiles watching real child abuse images (photos, videos, etc) of real children.
While few would argue that the exchange of real child abuse images, whether done in person, on IRC (Internet-relay chat) or in a virtual world should be a criminal matter, the depiction of virtual children engaging in sexual activity proves much more difficult. For example, in Second Life, you can choose and dress you avatar as you wish, thus a 56 year old man could inhabit the avatar of a 12 year old girl and could then script that avatar to engage in various sexual activities. To those observing in Second Life, it would look as if the “12 year old girl” was engaging in sexual activities, while in reality it is the older man using the avatar for his own sexual purposes.
Should such activities be a crime? Across the world, government legislatures are answering this question differently. In Germany, Ireland and many other European countries the possession of “virtual child pornography” is considered the legal equivalent of possessing “real” child pornography and is equally punishable by law. In the United States the courts have ruled that “virtual” child sex depictions are a form of fantasy and, as such, they do not constitute criminal behaviour because no actual child was ever abused or photographed in the production of those virtual child abuse images. Others have argued that only somebody predisposed to abusing a real world child would want to act out sexually as a virtual child. Those in opposition responded that democratic societies should not have “thought police” and that a fantasy life that does not cross the threshold into harming others should not be criminalized.
One of the largest and most infamous cases of age play occurred in Second Life in an area known as “Wonderland.” There, young “children” avatars were offering sex in a playground environment. The young children were in this context not real children, but graphical representations, the so-called avatars, and the playground was a virtual playground created with computer software. The case created a strong rebuke from law enforcement authorities and prosecutors in Germany opened a criminal case in the matter. Another such case was investigated by the British police.
Perhaps no other form of virtual world crime endangers quite as much passion amongst participants as the discussion of “virtual rape.” To some, it is very much a crime as “real” world rape. Doubters dismiss the possibility outright, noting that rape is impossible without a human victim who has been physically attacked or violated. Despite the differences, more and more police agencies around the world are having victims of these types of crimes present themselves and demanding police redress.
A “virtual rape” occurs when one person’s avatar is forced into a sexual situation against his/her desire. To be clear, this type of crime is different from consenting adults acting out a fantasy version of rape for whatever reasons. Virtual world rape is alleged when one of the participants is an unwilling participant in the act. Graphics in MMORPG’s and virtual worlds have progressed enormously, to the point that they can accurately represent real world scenarios fairly well. As such, an involuntary sexual assault could be perceived as having verisimilitude to the actual real world act. While many virtual worlds such as Second Life have built-in technical protections to prevent such activities from occurring, they can occur elsewhere through the introduction of malicious code that forces an avatar to do something against its will.
Again a review of the psychology of virtual worlds is critical here. To an individual who spends 12 hours a day inside a MMORPG living through their avatar, any activity that occurs to that avatar against its owner’s will can be troubling. For some seeing one’s avatar undergo a graphic representation of a violent sexual attack clearly would have a negative impact to the psyche of the avatar’s owner. Whether this harm is as serious as a “real world rape” is very much debated openly and is beyond the scope of this report. That said, many such cases are occurring and are being reported to law enforcement around the world.
In Belgium recently, federal prosecutors asked the Belgian Federal Computer Crime Unit to travel to the scene of a crime in Second Life for the purpose of investigating a “virtual rape” involving a Belgian victim.(9) This type of activity has been around for a very long period of time. The first most widely reported case of virtual rape was documented in 1993, long before today’s MMORPG’s existed.
Despite how police may or may not feel about such cases, one thing is certain, they will be increasingly reported to police. As such, law enforcement should have a plan in place to deal with them and to secure any potential crime scene in search of evidence of criminal activity.
One of the most common complaints and potential criminal activities in virtual worlds/MMORPG’s is that of harassment, intimidation or stalking. This often occurs when an individual becomes the subject of unwanted attention or focus by another person (avatar) or group of them. In virtual worlds, this type of activity is commonly referred to as “griefing.”
Perhaps it is not surprising that all the petty grievances, insults, arguments and disorders that occur in the “real world” also occur in “virtual world” spaces. A griefer is not playing an online game or inhabiting an MMORPG for any useful purpose, except to harass or intimidate others. They may have uncovered undocumented technical aspects of the virtual world software and exploit these glitches or features to purely harass other players or inhabitants. For those victimized by such behaviour, it can be extremely annoying and it could feel like the real world equivalent of stalking or harassment.
Prostitution is certainly common in virtual worlds and MMORPGs, but one must be careful about how one defines the term. Some individuals are willing to pay for their avatar to engage in simulated sexual conduct with another avatar for money (virtual currency or real). While this may or may not violate the terms of service of the virtual world itself, it would not be a criminal offense in many jurisdictions, assuming all parties were consenting adults. In other jurisdictions, even simulated sexual contact in exchange for money would be criminal.
While most police forces might not pursue strictly virtual prostitution between adults (especially when all activities were purely online within the MMORPG), there are many overlapping technologies that can make this type of activity a hybrid cross between the virtual and the real. For example, many virtual worlds allow users to incorporate VOIP communication into the MMORPG environment. Thus the addition of voice communication as part of the prostitution scenario might further push the boundaries of what is legal in some jurisdiction.
In other cases, pure acts of prostitution in the real world have taken on a virtual world component. In one of the most famous cases known as the “Epic Mount” case, a woman offered sexual encounters in the real world in exchange for money: 5,000 pieces of World of Warcraft gold. The woman claimed she needed the money to purchase her “epic flying mount.” Since WoW gold can be exchange for real world currency (euros, dollars or yen) it has a real world value based on market conditions, and given the exchange of said currency for a real-world sexual act, that woman could be punishable in many jurisdictions.
Though it might seem odd to talk about riots or public disorder issues in virtual worlds, they are in fact, not that uncommon. For example, during the most recent round of elections in Spain, most politicians had established a virtual presence in Second Life. Some politicians had even established their own avatars, which in turn campaigned, held rallies and put up election posters in virtual spaces. While things worked well for a while, politicians from one party were quickly overwhelmed with griefing by opposition supporters.
This is of course not the first time such a thing has happened. During a recent political rally by a far-right French politician, his posters were defaced, he had “exploding virtual pigs” hurled at him and Nazi swastikas were painted on campaign headquarters.(10)
Surely when incidents as these occur, especially when they involve high-level politicians, law enforcement will be contacted. Whether or not police are able to respond to such matters under national law is another question. The fact is, however, that the public will increasingly expect their police service to handle incidents such as these.
The evolving nature of modern science portends that as new information and communications technology tools are introduced, so too will criminal exploits for these technologies. The aforementioned focus on virtual world crime was provided to highlight how a simple new technology can be utilized by criminals to commit a wide variety of offenses. As has been noted, almost any crime that can occur in the real world can also be committed in virtual spaces. From child abuse to terrorist attacks, police will increasingly encounter a plethora of offences in virtual spaces. In order to keep these virtual spaces safe and crime free, criminal justice professions should continue to work with industry and academia to ensure the greatest possible cooperation in trying to minimise any social harm resulting from these technological developments. The size of the financial gain to be made by modern criminals will ensure that virtual worlds continue to be targeted for illicit purposes. Moreover, as human social interactions increasingly migrate from “real space” to virtual space, so too will the panoply of social ills and harms. Given the complexity of the issues involved, now is the time to begin thinking about and responding to these concerns before the virtual crime wave spills over into the real world.
* Marc Goodman is a visiting researcher at the University College Dublin’s Centre for Cybercrime Investigation. He also serves as a Senior Advisor to Interpol’s Steering Committee on Information Technology Crime, where he chairs the organisation’s working group on Next Generation Cyber Threats.
1 A virtual world is a type of online community that often takes the form of a computer-based simulated environment, through which users can interact with one another and use and create objects, often in 3D virtual environments. In virtual worlds, users often take the form of avatars visible to others as graphical representation of the users.
2 According to: www.el-universal.com.mx/articulos/36445.html. See also Business Week Magazine’s feature article on Chung: http://www.businessweek.com/magazine/content/06_18/b3982001.htm
6 For a good overview of fraud in online gaming environments, see the white paper by Kaspersky Labs entitled “Online games and fraud: a source of easy money,” available at: http://www.kaspersky.com/au/reading_room?chapter=207716493
9 Source: http://virtuallyblind.com/2007/04/24/open-roundtable-allegations-of-virtual-rape-bring-belgian-police-to-second-life/