Drakontas real crimes in virtual worlds


Published on

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Drakontas real crimes in virtual worlds

  1. 1. March 2012 Real Crimes in Virtual Worlds About 2 Threats 3 Solutions 7 What are virtual worlds and What specific crimes have What can law enforcement online gaming communities? been identified? What do to counter this new How do they work? social and economic and emerging threat? Why would criminals be harms arise from those interested? activities?Our Digital Playgrounds:Virtual Worlds and Online GamesCriminal threats are emerging in onlinecommunities where adults and children playVirtual worlds and online gaming communities are activities in virtual and online gaming communitiesfast becoming the predominant entertainment in their efforts to police cyberspace and to protectmedium in the world. Collectively, they are the jurisdictions they serve.projected to generate $112 billion in salesrevenues annually by 2015 from hundreds of Over the past two years, the Bureau of Justicemillions of individuals worldwide who subscribe Assistance (BJA), in partnership with Drakontasto them.1 Millions of users enjoy these “digital and Drexel University, has been investigating theplaygrounds” every day, and very rarely is their rise of crime in virtual worlds and online gamingexperience interrupted by inappropriate or communities, and its impact on the people thatcriminal behavior. subscribe to and play them. This document is designed to help raise awareness about the kindsUnfortunately, as more people subscribe to virtual of crimes being committed in virtual and onlineworlds, and as the number of online games increase, gaming worlds, and to provide an overview onthe opportunities for socially and economically the methods of social interaction that occurharmful crime will correspondingly rise. The law within these worlds and what law enforcementenforcement community must, consequently, and the broader criminal justice community canbegin to develop a capacity to address criminal do to respond to and mitigate future incidents. 1
  2. 2. March 2012 WHAT IS AN ONLINE WOrLD? In his book, Virtual Justice: The New Laws of Online Worlds, Dr. Greg Lastowka of Rutgers University defines virtual worlds and online gaming communities as “Internet-­ ased simulated b environments that feature software-animated objects and events.”According to a recent report2 from Interpol,the International Criminal Police Organizationheadquartered in Lyon, France, virtual worldscan often be classified according to their specificfeatures. The most commonly seen types of virtualworlds fall into two general categories: gameplaying and community-based. Both of thesetypes of virtual worlds are created to provideentertainment, first and foremost, while some alsoprovide social engagement and interaction, aswell as monetary benefits to their users. In thegame-playing category, social interaction is notonly encouraged, but is required, as players willonly be able to advance so far and accomplishset-goals within a game before they will need tocall upon others to assist them. No matter what type of virtual world or online gaming world one plays, there are inherent risksCommunity-based virtual worlds, on the other associated with each of them, as the peoplehand, have no specific purpose from the players’ one encounters along the way may have ulterior,perspective, aside from fostering social interaction criminal motives. The criminal opportunities thatand providing entertainment. Any person can exist within virtual worlds, and the subsequent callexplore community-based virtual worlds without to action, that is required by law enforcement andthe assistance of other players that is required in crime prevention communities, will be addressedgame-based virtual worlds. in the following pages. 2
  3. 3. March 2012THREATS & VULNERABILITIEsToday’s digital playgrounds and online market today each have embeddedcommunities have been created, as highlighted communications features and provide access toabove, for children and adults as vehicles for social networking platforms. Additionally, manysocial engagement, entertainment, diversion, have internet browsing capabilities, allowingand, on occasion, as places to make money by users to access any number of social media sitesselling and buying digital goods and services. where they can meet friends or seek to establish new relationships.However, just like playgrounds in the real world,digital playgrounds offer myriad new locations One of the major challenges in these virtualand opportunities for criminals to prey on environments, however, is being able to identifyunsuspecting individuals and to commit the person on the other end of the internet withtraditional “real-world” crimes, like theft, money whom one is communicating. Due to the fact thatlaundering, bullying, and stalking. The companies many of these virtual and online gaming worldsbehind these new gaming environments certainly are often free or very inexpensive to use, a persondid not intend to create virtual worlds that can easily register for a particular game andfacilitate criminal behaviors, and most companies provide false information. For example, a personactively protect the safety and security of their can indicate on a virtual world registration pageusers. Nonetheless, these measures have not that she is a 14-year old girl, when “she” is, in reality,prevented criminals from exploiting vulnerabilities a 35-year old man. Here, the communicationsin gaming platforms and systems. capabilities – chat, voice, text messaging – all become potential means by which criminals canFor instance, the major gaming systems on the exploit and target an unsuspecting victim. 3
  4. 4. March 2012Threats and Vulnerabilities (Continued)This is especially troubling if a location to hide illicit images,young person is unaware of and the file sharing permitted bythe dangers inherent in virtual these systems and embeddedworlds and online gaming into the virtual worlds and onlineworlds and is not monitored gaming communities accessedwhile playing in a digital via the gaming consoles offer newplayground. Complicating the potential distribution mechanismsissue even further is that many of for these illegal materials. Below are severalthese virtual worlds are built on kinds of socially harmful illegal activities occurringthe need for social interaction Many of these virtual worlds and in and/or inadvertentlyin order to advance to new online gaming communities are facilitated by virtuallevels within a particular game. accessible via handheld gaming worlds and onlineCommunication with other devices or even via smartphones. gaming communities:players is often paramount to The gaming companies areone’s success within a game seeking to ensure the gaming • Online Solicitationand this fact further increases experience is accessible wherever of a Minor: Using communication toolsthe opportunity and likelihood cellular networks can connect (e.g., email, video chat,for social or economic harms. users to the games. audio chat, text chat, and instant messaging) in a gaming environment orThese same social capabilities Sometimes, the games are even virtual world to engage inhave been used by criminals to designed to combine real world sexually explicit conversationsoversee and monitor prostitution and virtual world interactions, with a minor or for therings and by drug dealers to where users know the physical purposes of arranging a sexual encounter in thecoordinate the exchange of location of other participants so physical world.illicit goods. They use the gaming that they can meet or receivesystem as a communications offers for special deals from • Child Pornography: Storage and distribution ofplatform in order to evade retailers that are near their images or videos via a gamingwiretaps, as this is a channel that location. This same information console that contains peoplelaw enforcement is not as likely can be intercepted and used as under the age of 18 in a sexual situation.to monitor. a beacon for a cyberstalker, or offer targets for child exploitation. • Harassment, Bullying,Each gaming platform also has and Stalking: Using communication toolssome form of storage capacity There are also vulnerabilities (e.g., email, video chat, audioand, much like a traditional arising from the economic chat, text chat, and instantpersonal computer, these can systems built to support virtual messaging) in a gamingbe locations for storing pictures worlds and online gaming environment or virtual world to threaten, annoy, or alarmand videos. This provides a child communities. Many virtual other players.pornographer with another worlds have their own currency, 4
  5. 5. March 2012Threats and Vulnerabilities (Continued) so that people playing the between the real world and the game can buy and sell objects. virtual world in order to maximize For the gaming company, this is its profits for a particular brand. another way of making money Imagine a virtual world created from the game; estimates are for children, wherein a parent that revenues from virtual goods can spend a few pennies to will exceed $14 billion by 2014.3 purchase a piece of digital jewelry for his or her child’s Most of these revenues come virtual doll. This “virtual” jewelry from “micro-transactions” – small just so happens to look exactly Below are some purchases of less than $1 that like the jewelry the parent economically harmful make up the bulk of consumer also purchases in the physical illegal activities occurring in and/or inadvertently purchases of virtual goods. The world for the child’s “real” facilitated by virtual process is very simple: a person doll, allowing the company to worlds and online gaming plays a game for which he or maximize the amount of time a communities: she pays a nominal monthly child interacts with its brand in subscription fee. In addition, both the real and virtual worlds, • Identity Theft: the user has the option of thereby increasing its bottom line. Use of login credentials to gain access to credit customizing an avatar – the card information and user’s digital character within a Generating profits in the real other personal information virtual world or online gaming and virtual worlds isn¹t a crime. connected to a gaming or virtual world account. world – or purchasing additional However, with the increasing items to increase the avatar’s complexities involving real and • Fraud: strength or weaponry. Each of virtual currency transactions, The intentional misrepresentation connected these items, sometimes referred there is a correspondingly rising to the sale of digital goods, to as add-ons, can be purchased likelihood that fraud andother digital currencies, or gaming/ for a small fee. These purchases crimes will be perpetrated in virtual world services. can add up to a sizable sum of these environments. Law • Money Laundering: money over time. Considering enforcement needs to be aware Using virtual economies to there are many virtual worlds of and familiar with these channel funds into and out of with hundreds of thousands payment systems so that they are the physical-world economy. of subscribers, the companies prepared to respond accordingly. • Phishing: behind these games stand to Using email or other reap significant revenues from There are millions upon millions communications under a pretense to gather personal these micro-transactions. of small transactions like information from gamers or this, happening every day, virtual world inhabitants. In some cases, a virtual world crossing credit card platforms, company will blur the lines banking systems, and payment 5
  6. 6. March 2012Threats and Vulnerabilities (Continued)services throughout the world. It is the kind of real world currencies. There are even currencyplayground where criminals can make money if exchange platforms that allow users to trade inthey know how to intercept those transactions. and out of virtual currencies in the same way they could trade foreign currencies in the real world.The sheer volume of transactions and sums of money Individuals provide virtual goods and servicesinvolved make virtual worlds and online games – everything from new dresses for an avatar toinviting targets for fraud, identity theft, and other virtual prostitution – and money paid for theseeconomically harmful crimes. Gaming companies goods and services can be transferred into U.S.have become the new targets for cybercriminals dollars through the currency exchange. However,looking to steal credit card information or intellectual unlike traditional “real” world banks, these virtualproperty associated with the games themselves. exchanges and operations are not subject to the same regulatory oversight. This trend is likely to expand further in the coming years, as gaming companies seek to maximize the consumer’s engagement with the gaming platform on a daily basis. There was even one gaming company several years ago that had registered for and received a banking license, which allowed gamers to transfer currency inPhishing schemes, where computer users are and out of the game readily through ATMs or atricked into entering user names, passwords, and “real-world” bank branch. This creates a parallelcredit card information into websites that appear banking system, where the potential exists forto be legitimate, are just as likely to target gaming money laundering and the illicit transfer of goods.brands as they are to exploit large banking There are also criminal organizations that use theseinstitutions. This is, in great part, due to the fact that virtual currencies to earn real money, selling illegallymany gaming companies store both personally obtained virtual goods to game players interestedidentifiable information and financial data of their in obtaining a powerful sword or special potion somembers on servers across the globe. Criminals they can advance to the next level of the game.gaining access to this information, using phishingschemes or other nefarious methods, can easily For people who have never played one of thesereap millions of dollars. games, this may seem a bit farfetched. Yet, these social and economic harms are very real andAdditionally, many gaming companies have have been documented in the articles and newscreated digital currencies that are meant to stories included as an appendix to this document.facilitate transactions within the virtual world. The list we provide represents the tip of the icebergSome companies even contemplated that their – an increasing threat that law enforcement mustvirtual currencies would be transferrable into address now. 6
  7. 7. March 2012 Drexel University recently held a BJA-sponsored Symposium on Real Crimes in Virtual Worlds in Philadelphia, PA. Led by Dr. Robert D’Ovidio, Associate Professor of Criminal Justice, a community of industry, academic, law enforcement, and cybercrime experts discussed the challenges they face in this emerging area.SOLUTIONS: RESPONSELaw enforcement is constantly required to adapt CRIMINAL JUSTICE regarding the threats posed by crimes in virtualits strategies and tactics to combat the rise of worlds and online gaming communities. Thenew criminal behavior. The increase of socially Symposium held in Philadelphia, pictured aboveand economically harmful activity in virtual - along with the training sessions conducted byworlds and online gaming communities requires Drakontas LLC and Drexel University, as part ofa unified response from law enforcement and BJA’s program - represent a first step in helping lawother key stakeholders, some of which will come enforcement better understand the challenges.from refocusing existing policies, procedures, andcapabilities to match this new threat. UPDATED POLICIES AND ProceduresNevertheless, new capabilities are required to Second, existing policies and procedures need toensure law enforcement has sufficient capacity be refined given the nature of the investigatoryand tools at their disposal to respond effectively. process. For instance, as gaming technologiesSome of these are outlined below. and digital storage devices evolve and are increasingly adopted around the world, theINCREASED AWARENESS potential locations for digital evidence alsoFirst and foremost, it is imperative that awareness increases. Information is now being stored onbe raised among the criminal justice community machines and devices located in other countries 7
  8. 8. March 2012Solutions (Continued)on other continents far away from a particular Video game consoles have different proprietaryuser’s gaming system. operating systems and other restrictions that present numerous technical hurdles forThis greatly complicates an investigator’s work. forensics tool manufacturers; as a result, it is veryAn investigator needs to search for evidence on difficult, if not impossible, to automate a soundlocal devices (i.e., a computer or gaming system), forensic examination of these platforms andbut they also must reach out to Internet Service extract evidence for an investigation. ForensicProviders (ISPs) and the gaming companies, experts, therefore, are often required to employas well as the third party payment services that manual techniques, such as a scroll analysisoften serve as the marketplace for the exchange through various menus and data storageof digital goods and services. Each has vital locations, which can be time consuming andinformation that law enforcement will want to potentially subject to courtroom challenges, if notuse during an investigation, but it can be very properly documented.difficult and time consuming to collect all ofthe relevant information for a particular case Fortunately, there are resources available to lawinvolving gaming systems. Law enforcement must enforcement to help combat this rising challenge.piece together the various technologies involvedthat facilitate the connection between an These include:offender and a victim. They must also familiarize • Training Programs:themselves with the data storage and retention BJA has made available funding for trainingpractices of virtual world companies, as they as part of a broader effort to raise awarenessbegin investigating game-related cases for the for law enforcement, probation and parole,first time. and other facets of the criminal justice community about crimes in virtual worldsNEW FORENSICS TOOLS and online gaming communities. BJA hasFinally, there are few tools available to automate partnered with a company, Drakontas LLC,the process of examining the gaming devices and to provide this training, details for whichplatforms used as gateways to these virtual worlds can be requested via email at training@and online gaming communities. Law enforcement drakontas.com, or from BJA at www.bja.gov.has had success over the years in conductingdigital forensics investigations on traditional • Specialized Technical Assistance:computing devices, such as personal computers BJA funds partner organizations to assist stateand laptops; however, the pace at which video and local law enforcement with technicalgame consoles and handheld electronic devices challenges associated with cybercrime, inhave emerged and been adopted by consumers general, as well as with the specific issueshas presented a number of pressing issues for law described in this document. For moreenforcement and private industry. information, contact BJA at www.bja.gov. 8
  9. 9. March 2012Solutions (Continued)• Publications: theft existed long before these new digital Over the coming months, Drakontas will publish playgrounds were built. What is new are the more documents that address key policy issues techniques and methods used by criminals in in virtual worlds and online gaming communities. virtual worlds. They are able to take advantage of The goal is to build further awareness of the both technological and social vulnerabilities, and challenges that exist in these digital playgrounds unintended consequences inherent in game play. and help to define the best tactics for responding to criminal activities. This document represents a resource for addressing crime in virtual worlds, the subsequent challengesThe crimes discussed in this document are not new facing the criminal justice community, and the– unfortunately, crimes like child pornography, broad-based response required to stem the tidecyberbullying, online enticement, and identity of this rising criminal threat. CONTRIBUTORS: CONTACT INFORMATION: Dr. Brian Regli, Drakontas LLC Drakontas LLC Michael Mitkus, Drakontas LLC 200 Federal Street, Suite 300 Camden, New Jersey 08103 Dr. Robert D’Ovidio, Drexel University (215) 887-5570 training@drakontas.com Disclaimer This project was supported by Grant No. 2009-D2-BX-K005 Drakontas (www.drakontas.com) develops mobile awarded by the Bureau of Justice Assistance. The Bureau collaboration software and provides training and technical of Justice Assistance is a component of the Office of Justice assistance that increase the safety and operational capacity Programs, which also includes the Bureau of Justice Statistics, of law enforcement, emergency response, and security the National Institute of Justice, the Office of Juvenile Justice personnel. The company was founded in partnership and Delinquency Prevention, the Office for Victims of Crime, with Drexel University in 2004 to transition technologies and the Office of Sex Offender Sentencing, Monitoring, developed at the Applied Communications and Information Apprehending, Registering, and Tracking. Points of view or Networking (ACIN) Center for the Department of Defense to opinions in this document are those of the authors and do commercial, civilian and homeland security uses. not necessarily represent the official position or policies of the U.S. Department of Justice. ADDITIONAL RESOURCES: ENDNOTES: Bureau of Justice Assistance 1 Gartner. (2011). Gartner Says Spending on http://www.bja.gov/ Gaming to Exceed $74 Billion in 2011. Retrieved on July 26, 2011 from the Gartner website: International Association of Chiefs of Police (IACP) http://www.gartner.com/it/page.jsp?id=1737414 Center for Social Media http://www.iacpsocialmedia.org 2 Goodman. Marc. (2010). Crime and Policing in Virtual Worlds (Interpol Working Party on IT Crime – Europe). Internet Crime Complaint Center (IC3) http://www.ic3.gov/ 3 Reisinger, Don. (2010, November 15). Virtual Goods Revenue to Hit $7.3 Billion this National White Collar Crime Center (NW3C) Year. Retrieved on July 26, 2011 from the http://www.nw3c.org/ CNET News website: http://news.cnet.com/8301-13506_3-20022780-17.html Regional Computer Forensics Laboratory (RCFL) http://www.rcfl.gov/ 9
  10. 10. March 2012Related Articles:Associated Press, The. (2010, January 6). Houston Mom Accused of Soliciting Teen Online.Retrieved on July 26, 2011, from the MSNBC websitehttp://www.msnbc.msn.com/id/34734169/42538547Cavalli, Earnest. (2009, January 12). Italian Woman Explores Prostitution Via Second Life.Retrieved on July 26, 2011, from the Wired websitehttp://www.wired.com/gamelife/2009/01/italian-woman-e/Cluley, Graham. (2011, February 3). Hacker Admits Stealing Zynga Poker Chips Worth $12 Million.Retrieved on July 26, 2011, from the Naked Security websitehttp://nakedsecurity.sophos.com/2011/02/03/hackerzynga-virtual-poker-chips-worth-12-million/Davis, Carolyn. (2010, December 8). Virtual Justice: Online Game World Meets Real-World Cops and Courts.Retrieved on July 26, 2011, from the Philadelphia Inquirer websitehttp://articles.philly.com/2010-12-08/news/25293555_1_virtual-worlds-warcraft-online-worldsDetroit News, The. (2011, February 28). Child Predators Turn to Gaming.Retrieved on July 26, 2011, from The Detroit News websitehttp://detnews.com/article/20110228/METRO/102280328/Child-predators-turn-to-gaming--Michigan-police-sayPeterson, Debra. (2010, August 30). Disney World Employee Arrested on Xbox Child Porn Charges.Retrieved on July 26, 2011, from The Examiner websitehttp://www.examiner.com/disney-travel-in-national/former-walt-disney-world-employee-arrested-on-xbox-child-porn-chargesPotter, Ned. (2009, March 13). PlayStation Sex Crime Criminal Used Video Game to Get Girl’s Naked Pictures.Retrieved on July 26, 2011, from the ABC News websitehttp://abcnews.go.com/Technology/story?id=7009977&page=1Roman, David. (2011, February 11). Entropia Universe: Where Online Money Meets Real-World Cash.Retrieved on July 26, 2011, from the Wall Street Journal websitehttp://online.wsj.com/article/SB10001424052748704132204576135953837768200.htmlSemuels, Alana. (2008, January 22). Virtual Bank’s Second Life Scheme Raises Real Concerns.Retrieved on July 26, 2011, from the Los Angeles Times websitehttp://articles.latimes.com/2008/jan/22/business/fi-secondlife22 10