Norton Gaming Articles

For those of us who are not hardcore gamers (yours truly included), but have fond memories of playing Pitfall on the Atari 2600 or Pirates on an old Apple, the world of online gaming has been experiencing a period of explosive growth in recent years. The rapid increases in players and dollars flowing into the gaming industry go well beyond the console-based games such as Sony’s PS3 and Nintendo’s Wii and extend to PC-based games such as the hugely popular World of Warcraft (WoW) which enjoys a thriving online population that recently reached over 6 million users worldwide. WoW is a massively multiplayer online game (MMOG) that allows players from across the globe to interact socially in a persistent world where the player is represented by their in-game avatar who increases in skills, gains possessions and presumably builds relationships over time. The MMOG market tipped 1 billion in market value in 2006 for North America for the first time in 2006, while in China and other parts of Asia it’s been a runaway success for a long time now, with over 37 million gamers (90% online) in China alone.

So what does this have to do with security and privacy? (I won’t bother asking about work productivity, we all know the answer to that already)

While it’s easy to point out that theft of in-game items is a burgeoning business, a more subtle thing is happening in the rapidly expanding world of MMOGs: the advertisers have come and are honing their techniques. The steadily increasing number of real-world advertisers in Second Life and Google’s recent acquisition of Adscape Media, among other developments, have raised the collective eyebrow of gamers who openly wonder if advertising inside of games ruins the “in-world” experience even if it lowers the cost of playing.

Beyond tarnishing the fantasy of a virtual world, advertising via product placement (think “Pepsi Magic Potion” or “Samsung Hyper Spacepod”) inside virtual games offers some compelling benefits for the advertisers and potentially large privacy concerns for privacy watchdogs. The concern that springs to mind is similar to the adware behavior tracking issue: as advertisers place their virtual products inside the game environment for players to interact with, can they resist the temptation to track how players are using their virtual “ad-products” and which versions they are choosing? Think less of a magic potion or sword and more like an environment such as Second Life where conventional goods such as cars and shirts are commonplace. Wouldn’t the auto manufacturer want to know which colors are selling the best and what aspects of the virtual vehicle are being used and how? This type of feedback could potentially be useful with a new product prototype in order to gain early feedback on a concept, and plan production according to early indications of consumer tastes, albeit virtual ones.

In my estimation the question primarily lies in the expectation and consent of the game players themselves: do they expect that they will be tracked in this fashion when enjoying a virtual good? Will their explicit consent be obtained in a clear fashion before their behavior is monitored and leveraged by marketers? Is there enough value in the virtual ad-products to where they would consider it a fair-exchange to endure avatar behavior monitoring in order to enjoy using it? And lastly, will the organizations running the virtual worlds permit advertisers this capability?

While the gaming community sorts out these thorny questions, I’m reminded of the early days of the adware boom in the first half of this decade, where consent was largely ignored and tracking was concealed in the pursuit of profits. Let’s hope the gaming community leans over the shoulder of the security industry and reads our notes of lessons learned from the adware fiasco, so that by the time virtual worlds replace our intranets and extranets we don’t have to look around nervously for virtual spies and rogue advertisers lurking in the shadows.