Don’t pass it on

Belated a.k.a. Is cheating now a crime?

US Federal law may have taken one step closer to the regulation of Virtual Worlds.
How so?
By making it possible to consider the use of someone else’s password to access a protected system a Federal crime – that’s how.

In the piece Is password-lending a cybercrime? Security Focus reports that on 20th February a court in Manhattan ruled that the unauthorised use of someone else’s password to access a secured computer system was a violation of Computer Fraud and Abuse Act ‘CFAA’ (18 U.S.C. § 1030 et seq) if both ‘damage’ and ‘loss’ could be demonstrated.

In the specific case I.M.S. Inquiry Management Systems Ltd. vs Berkshire Information Systems Limited (2004 U.S. Dist. LEXIS 2673) (two competing advertising tracking services), it was alleged that Berkshire obtained a unique (and valid) user identification and password and with this gathered and copied material from the I.M.S. site. In this case the court held that the CFAA had been breached.

This case looks remote from virtual worlds, but not if one examines the ruling. The CFAA does not ban the use of someone else’s password per say, the Act adds both damage

(5)(A)(ii) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage

and loss

((5)(B)(i) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value

as necessary conditions (the court did not rule on whether either damage or loss on theiry own were sufficient).

What is important to us is the interpretation of damage and loss. Again the CFAA sates:

(8) the term ''damage'' means any impairment to the integrity or availability of data, a program, a system, or information

Now the court ruled that access to and the copying of information by a competitor is sufficient to sustain a claim of damage.

Moreover, the CFAA states:

(11) the term ''loss'' means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service; and

Here the court accepted that remedial measures that summed to at least $5k were sufficient to satisfy a claim of loss.

OK, so, say I pass my SWG password to someone who works for a competitor of Sony, they use it and take some screen shots, but Sony gets wind of this and closes down the account. In this situation Sony could easily burn up $5k in admin fees just changing and checking system stuff, plus a competitor has access protected (and probably copyrighted) material – loss and damage, slam and dunk, my friend is a felon and I’m probably an accessory.

But what if I just give the password to some other player or I pass it along when I sell and avatar. Well, if Sony did find out about this and did something about it there is most probably a claim on the basis of loss (and remember its is still moot whether this in and of itself is sufficient). But what about damages?

To me the ruling is unclear. While the commercially competitive nature of the two parties is noted, given the wide interpretation of the definition of ‘damage’ it does not seem impossible that another court my rule that the fact unauthorized access to material is in and of itself an impairment to the integrity of that material.

In a virtual world one could easily argue that someone purchasing and using a character (if outside the terms of the EULA) challenges the integrity of the game and thereby the information that constitutes it.

But there is good news – at least this case was not ruled to be a breach of the DMCA.

Phew.

Comments

[Edward Castronova]

1.

Loss here seems to be any cost to any victim. So if a scammer gets a few SWG passwords and sells (or deletes) the Jedi character on the account - which are selling these days for upwards of $2000 on eBay - they could become exposed to prosecution under this statute, right?

Issues similar to this were involved in the Hacker Court moot held in Las Vegas last summer. It was about a hack that wrecked some in-game equipment. No one (judge, jury, audience) seemed to question either damage or loss. There were questions about culpability of specific actors, and about whether the in-game nature of the goods - within the magic circle - might justify a different reading of the law. Basically, there are all kinds of things that cause damage and loss (e.g. the end of romantic relationships), where the law does nothing. By that argument, existing law would be understood not to apply to anything so intangible as broken hearts.

Are virtual goods that intangible, or intangible in the same way? Are they special? If the magic circle is preserved - through role-playing, no eBaying, etc. - I would say, 'yes.' If the magic circle is not preserved, I would say 'no.'

[Ren]

2.

>Loss here seems to be any cost to any victim.
Yes, pretty much.

My point being (in the case of loss) that we dont even have to get into debates about property, we can simply look at the cost of time that a compnay would inccur in dealing with an issue that is a result of an unauthorised access i.e. this seems a much wider interpretation than the ones that have been debated in the past.

[DivineShadow]

3.

Edward,

What are the boundaries of this 'Magic Circle'?

Seems like it could be defined: "It has the same boundaries as the EULA" or "It has the same boundaries as your contract".

[Ren]

4.

DivineShadow> What are the boundaries of this 'Magic Circle'?

The answer to that is a probably a full phd, if not several.

It refers to Huizinga’s concept of what is and is not the game or ludic space.

One might ask: what is the boundary of our suspension of disbelief when we enter a theatre, certainly I would say that it is not defined by the contract that we have with the theatre – but it does include getting up in the middle of the performance and shouting ‘Look is this Godot character gonna turn up or what?’

[DivineShadow]

5.

"It refers to Huizinga’s concept of what is and is not the game or ludic space."

No PhD here... So bear with me...
Going to Edward's point of having to make a distinction of whether the Magic Circle was preserved or not would imply we know when the line was crossed. If there is a legal proceeding dependant upon this Magic Circle, we better know real well where that line rests. It doesn't seem like there's a whole lot of clear-cut facts here for a court to go on beyond a contract. Suddenly it seems like the Magic Circle is a whole lot smaller and matches in size and shape your contract. ... Have courts recognized and assigned greater force of law to the existence of a Magic Circle than to a written contract in the past?

Hmm... I suppose many of today's EULAs essentially read "You will respect the Magic Circle" when they have a clause that says "You will behave according to the Rules of Conduct" and then those rules of conduct are as fluffy as "You will be nice to other people".

[Ren]

6.

Yes, I take any clause that talk about things like ‘the spirit of the game’ (often a EULA will reference a code of conduct or similar, which will itself have form of fair play assertion) this to be the ‘magic circle’ clause. I guess I discount these as part of the EULA as such as the are referencing external attitudes, established cultural practices etc.

My legal point is that, it seems conceivable that a court might be minded to take this vague set of stuff and assert that the acts of someone using someone else’s password breach the ‘integrity’ of the game.

To put this in (tabloid) headline terms: in this very specific set of circumstances and given my interpretation of the possible use of ‘integrity’ – Cheating becomes a crime !

Oh, if any one is totally interested, someone posted the ruling here: http://www.corante.com/importance/archives/002149.html

[Sourtone]

7.

Show me a player that actually reads the EULA and I'll show you...

Well you get the idea. I think the law in question was intended to deal more with personal data than any sort of protection for characters in virtual worlds. Remember that to the bulk of the nation "gamers" are a fringe sub-culture and those of us involved in MMOG's are the geeky subset to that culture (with MMORPG players being the geekiest of the geeky)... that said I'd be surprised if any of the creators fo the abvoe law even know there are such things as virtual worlds (and such things as virtual property) and would likely not care if they find out all we do is use them for playing games.

[Ren]

8.

Sourtone >Show me a player that actually reads the EULA and I'll show you...
A mirror ?

>I think the law in question was intended to deal more with personal data than any sort of protection for characters in virtual worlds.
Indeed, in many cases its not the intention of the original draft of a law that worries me, its the interpretations over time, and in particular those that may indeed be done by people with no knowledge of the culture in question.

>find out all we do is use them for playing games.
As you may feel I’m trying to avoid a property discussion as this law does not need us to get into that (not all legal discussion are propety based one - OK dispite the fact that most of my papers bang on about it), however I should not that while some people use VWs to play games there are many other uses, including commercial ones.

[DivineShadow]

9.

"My legal point is that, it seems conceivable that a court might be minded to take this vague set of stuff and assert that the acts of someone using someone else’s password breach the ‘integrity’ of the game."

Agreed. It would certainly seem that way. And as you said, cheating might be deemed a breach of integrity, too, with very real and easy to calculate costs too. Problem being differentiating what is a bug, what is an exploit, an unintended side-effect, what is cheating, what are the rules, where are they written for each subsystem, etc. Suddenly, being an MMORPG gamer became a lot more complex.