For those of us who are not hardcore gamers (yours truly included),but have fond memories of playing Pitfall on the Atari 2600 or Pirateson an old Apple, the world of online gaming has been experiencing aperiod of explosive growth in recent years. The rapid increases inplayers and dollars flowing into the gaming industry go well beyond theconsole-based games such as Sony’s PS3 and Nintendo’s Wii and extend toPC-based games such as the hugely popular World of Warcraft (WoW) whichenjoys a thriving online population that recently reached over 6 million users worldwide.WoW is a massively multiplayer online game (MMOG) that allows playersfrom across the globe to interact socially in a persistent world wherethe player is represented by their in-game avatar who increases inskills, gains possessions and presumably builds relationships overtime. The MMOG market tipped 1 billionin market value in 2006 for North America for the first time in 2006,while in China and other parts of Asia it’s been a runaway success fora long time now, with over 37 million gamers (90% online) in China alone.
So what does this have to do with security and privacy?
(I won’t bother asking about work productivity, we all know the answer to that already)
While it’s easy to point out that theft of in-game items is aburgeoning business, a more subtle thing is happening in the rapidlyexpanding world of MMOGs: the advertisers have come and are honingtheir techniques. The steadily increasing number of real-worldadvertisers in Second Life and Google’s recent acquisition of Adscape Media,among other developments, have raised the collective eyebrow of gamerswho openly wonder if advertising inside of games ruins the “in-world”experience even if it lowers the cost of playing.
Beyond tarnishing the fantasy of a virtual world, advertising viaproduct placement (think “Pepsi Magic Potion” or “Samsung HyperSpacepod”) inside virtual games offers some compelling benefits for theadvertisers and potentially large privacy concerns for privacywatchdogs. The concern that springs to mind is similar to the adwarebehavior tracking issue: as advertisers place their virtual productsinside the game environment for players to interact with, can theyresist the temptation to track how players are using their virtual“ad-products” and which versions they are choosing? Think less of amagic potion or sword and more like an environment such as Second Lifewhere conventional goods such as cars and shirts are commonplace.Wouldn’t the auto manufacturer want to know which colors are sellingthe best and what aspects of the virtual vehicle are being used andhow? This type of feedback could potentially be useful with a newproduct prototype in order to gain early feedback on a concept, andplan production according to early indications of consumer tastes,albeit virtual ones.
In my estimation the question primarily lies in the expectation andconsent of the game players themselves: do they expect that they willbe tracked in this fashion when enjoying a virtual good? Will theirexplicit consent be obtained in a clear fashion before their behavioris monitored and leveraged by marketers? Is there enough value in thevirtual ad-products to where they would consider it a fair-exchange toendure avatar behavior monitoring in order to enjoy using it? Andlastly, will the organizations running the virtual worlds permitadvertisers this capability?
While the gaming community sorts out these thorny questions, I’mreminded of the early days of the adware boom in the first half of thisdecade, where consent was largely ignored and tracking was concealed inthe pursuit of profits. Let’s hope the gaming community leans over theshoulder of the security industry and reads our notes of lessonslearned from the adware fiasco, so that by the time virtual worldsreplace our intranets and extranets we don’t have to look aroundnervously for virtual spies and rogue advertisers lurking in theshadows.