IEEE Technology and Society Magazine - June 2018 - 54

its own [6], we neither consider it further here, nor
require the presence of malignant insiders in order to
justify this work. Current problems with identity theft,
harassment, and more, within Massively Multiplayer
Online Role-Playing Games (MMORPG's) further justifies
our research. Related work on the causes and nature of
in-game harassment (known as "griefing" in the realm
of video games) indicates that social dominance orientation (a personality trait characterized by preference of
hierarchical groups) is a strong predictor of online sexual harassment [7] and that lower-skilled male players are
more likely to harass female players [8].
In 2014, the hashtag #gamergate mobilized a vast
gamer campaign of ultimately criminal harassment
(including threats of violence and rape) targeted at several women in the gaming industry. Within the game
Second Life - an open world social metaverse - abuse
and harassment were significant enough to warrant
harassment "primers" by Linden Labs. One such primer
offered the following advice: "If someone (or something)
is pushing you or physically assaulting you inworld, sit
down! Sitting prevents most physical forces from affecting your avatar" [9].
Another type of clear and present threat is that of
social engineering hacking, a form of trickery that relies
on human (victim) interactions that create a sense of
urgency, fear, or other emotions, that lead to the individual revealing (unwittingly or not) something of value [1].
Avatars controlled by nefarious human users can easily
engage in deceptive and unethical practices such as
impersonation, white lies, and manipulation. For example, through observation over time an individual could
impersonate a player's friend to obtain secret or private
information. Such players might be annoying and, in the
worst case, could jeopardize both player privacy and
the pleasure of interacting with the metaverse.
Finally, while the present rapid advances of machine
learning (ML) in various sectors - such as art, humanities, advertising, and chatbots - is paying dividends,
there is also a potential darker side. Software-driven avatars - armed with ever-growing training data sets - can
employ machine learning to nudge human avatars in
ways that would best serve their purposes. When combined with social engineering this becomes a threat to
privacy. For example, using in-game observations and
logging, an ML-backed agent could come to know what
your tendencies are, what kind of personality you have
(such as impulsive, introverted, etc.), and what kinds of
social interactions form the best "nudges" to create particular outcomes [10]. Furthermore, it will eventually be
nearly impossible to differentiate between exclusively
software-driven (e.g., chatbots, gamebots) and humandriven avatars. Indeed, detecting gamebots using analytic techniques is an active research field [11], [12].

Privacy Mechanisms in the Metaverse
Before describing some of our approaches to privacy we
note that in the social metaverse all avatars must "play
by the rules." What does this mean? Both the metaverse
and the avatars are software, but the latter cannot exist
without the former and the actual implementation
underpinnings of the metaverse are accessible to avatars only through controlled means. An example of an
access method into the underpinnings of the metaverse
might be an API that allows an avatar to ask the metaverse for a list of other avatars presently within 100 distance units. In response the metaverse might return a
list of avatars along with descriptive metadata such as
skillset, interests, hometown, etc. Suppose that a direct
API for listing nearby avatars was not available. It may
still be possible for avatars to build up a similar capability through more primitive capabilities. For example,
one capability might invoke a "snapshot" feature (to
capture a rasterized image of the current scene from
the avatar's point of view), and then call yet another
module that picks out and enumerates the avatars in
snapshots. Table 1 provides a summary.
We envision a new layer of controls that help tighten
privacy in a metaverse where all avatars are essentially
empowered by the same capabilities and act within the
"rules of the game." Even with this assumption, however, significantly unethical, bothersome, and threatening behaviors might nonetheless still emerge. Consider
that another avatar may: a) watch or follow you incessantly, b) monitor you from a distance, or c) harass you
with its presence or utterances. The next sections
address our approaches to mitigate these types of
undesirable interactions.

Mechanisms
In this section we describe the mechanisms we believe
will be useful in the battle for privacy. We view these as
fundamental examples of tactics that will help improve
privacy, but we recognize that other examples exist.
These mechanisms are implemented in software and
can exploit the primitives offered by the metaverse
which we assume will include primitives that help enact
movement, inventory, observation, and analysis of the
metaverse. The broad goal of these mechanisms is to
help ensure privacy while not utterly destroying the benefits of being in the metaverse. For example, while players could avert all threats to privacy by simply not
entering a particular metaverse, this solution is too
extreme to meet our requirements. The mechanisms
should generally not come at the expense of participation in the metaverse or at the expense of interactions
with other agents, objects, virtual storefronts, etc. To
these ends, we define two important notions: privacy
plans and confusion:

IEEE Technology and Society Magazine

∕

JUNE 2018

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - June 2018