1984 2.0

So, in the interests of blatant self promotion, my short essay encouraging government to respect privacy interests in virtual worlds is now up at www.yalelawjournal.org.  But I wanted to take this further: I think our acquiesence to the rule of contract law in virtual worlds has come home to roost.  Bad law combined with EULAs are to blame for our loss of civil liberties in virtual worlds.  More on this admittedly controversial statement after the fold.

I admit: I have an axe to grind.  I think EULAs are being used to control behavior that has nothing to do with copyrights.  I think that a EULA that requires a consumer to vote Democrat, or only to wear purple, or to use no third-party software programs has long ago left behind the traditional reasons we enforce consumer contracts. 

But nowhere does this expansion of contracts so bother me as in the area of government surveillance.  Under our current regime, search warrants are simply unnecessary.  We have all agreed to permit game gods to surveil our every word and action, and to hand the information over to law enforcement and the intelligence community.  The Stored Communications Act makes it pretty clear that clicking "I Agree" to a virtual world EULA means "I voluntarily suspend my Fourth Amendment rights pretty much permanently."

Don't get me wrong: I understand that routine surveillance by game gods is fine and necessary for customer service.  There's no government action, so no problem.  And, otherwise how could a GM go back and check to see if that guy did indeed ninja the Foozle? And I understand that parties can waive constitutional protections by consent: I can consent to a search of my house, or the tapping of my telephone.  So why not permit blanket consent proactively to have any of the eleven million people in WoW monitored and the footage handed off to law enforcement or the CIA?

Part of the problem is informational.  Customers are signing away constitutional rights (assuming, as I do, that constitutional rights do not cease upon entrance to a virtual world -- in itself a controversial position as far as I can tell) in clickwrap agreements without the slightest knowledge of what they're getting into.  So, fair enough: I guess I'm into telling people what they're signing away when they agree to Section 6.1 of the Second Life ToS or Section 17.C and 17.D of the World of Warcraft TOU. 

That information problem is also an enforceability issue.  Contracts that overreach that far are unconscionable.  But unconscionability isn't much of a defense under the Fourth Amendment.  You consented; there was no duress.  The government can access the information. 

But there is a further problem with the argument as a whole.  Imagine if signing away your constitutional rights were a prerequisite of engaging in any commercial activity.  We could refuse to sell people food unless they signed contracts like this.  We could certainly make agreeing to wiretapping a prerequisite to getting telephone service. We could require your "consent" to the installation of cameras in your house as a precondition of getting a building permit, or as part of the sales contract of a house.

You might say: "Sure, but if anyone required me to install cameras in my bedroom, and made me waive the constitutional restrictions on the footage being handed over to law enforcement or intelligence, I'd pretty clearly not agree to the deal!  I'd pretty clearly go elsewhere!"  Well, manifestly not, given the behavior of people in virtual worlds.

What if there is no elsewhere to go?  I guess we see what happens: people do agree to shred their constitutional rights just to get the ability to get on with their lives, in virtual worlds and, by extension, in the real world.

Comments

[reality]

1.

Where the hell have you been? Almost everyone on this blog is guilty of the hypocracy that virtual worlds technolgies are NOT being developed to sign away all civic rights a person may have had to be replaced by those of their own companies vc backed corporate/countrie's platform for consumer service and communications.

There's not anyone here who dosent believe that "code is law' and that MY code(or that of my current employer) is the best law.

get real.

[Bret]

2.

IANAL, but I don't think a government agency like a permitting office is allowed to require that you waive your rights in order to access its benefits.

As for waiving your rights as part of commerce, it happens all the time. Cameras in dressing rooms. Non-disclosure agreements. The government often sets itself legally and physically astride major commercial choke-points, such as telephone networks, and this can be extremely insidious. But at the end of the day, nobody is required to sell you a telephone, or anything else. You need it and they've got it.

There are two ways this dichotomy can go: either enough people reject the EULA that a market forms for an MMO that respects your rights, or people decide that they don't care if Big Brother is watching while they dance pantsless in Goldshire.

[Andrei]

3.

What about the fact that the Government in China now demands MMORPG users to register with their names?

Link here.

2.0 indeed. And don't forget this is China we're talking about.

[Richard A. Bartle]

4.

>I think EULAs are being used to control behavior that has nothing to do with copyrights.

Well yes. Games are like that: they have rules to control behaviour. You agree to limit your behaviour in accordance with the rules in order that you gain benefits you wouldn't gain if you (and your fellow players) didn't follow those rules.

For virtual worlds, where it's not possible to use the usual sanctions against (for example) cheats (ie. "I'm not playing with you, you're a cheat"), some other mechanism for dealing with such problems needs to be in place. At the moment, this is done via EULAs. EULAs aren't great, I agree, but no modern virtual world one has yet tried a better suggestion.

From your comments above (I haven't had chance to read the paper itself yet), it seems that you accept that there can be legitimate uses of EULAs for virtual worlds, and your problem comes when developers go beyond this.

A question I have, therefore, is why would a virtual world developer want to give themselves the kind of illegitimate powers you're complaining about?

Richard

[Joshua_Fairfield]

5.

I don't find the market argument compelling, even though I ought to, given that I am generally a pretty hard core free market guy.

Externalities are one reason: your surrender of civil liberties affects me by weakening the barrier against government intrusion into all citizens' lives. Now, if you surrender your liberties in the individual case (you are stopped, the police ask if they can search your car, and you say yes) then I have at least some surety that your surrender of liberty doesn't affect me. Maybe. Although I do note that the permissibility of waiving constitutional rights does cause the police to adopt agressive and deceptive tactics in order to get the necessary waiver, which may in turn affect other citizens.

But once we require mass surrender of civil liberties in order to participate in commercial and public life -- and who here doesn't think that virtual worlds are a critical step in the development of commercial and public life? -- your surrender of a right clearly impacts my rights. Because of the network effect, the economies of demand of a virtual world mean that "civil liberties world" is unlikely to flourish, on the simple ground that the majority of the population is already invested in a different world.

"Civil liberties world" will fail for the same reason Age of Conan is having a hard time getting off the ground. Network effects mean that online populations will accede to suboptimal contractual regulatory terms even in a supposedly "free" market.

We are moving public life online. Will we bring our constitutional values with us or not? I can easily imagine a world in which the Constitution is a dead letter, replaced by EULAs. Actually, I don't have to imagine it: that's how things are.

[Joshua_Fairfield]

6.

@Richard:

Because the government wants them to, and threatens to subpoena their CEOs unless they respond to requests for information. Based on my conversations with law enforcement, that's pretty much standard: "hand over the information you've gathered in your commercial capacity, or we make your CEO testify for a week in Nowheresville."

[Cunzy1 1]

7.

1984 2.0!

Seriously? You've used that as a title and not apologised yet? I hate you.

[Joshua_Fairfield]

8.

Fair enough -- apologies for the cheese!

[Richard Bartle]

9.

>Because the government wants them to, and threatens to subpoena their CEOs unless they respond to requests for information

So you're saying that MMO developers put some clauses into EULAs solely because the government wants the information that these clauses give the developer permission to extract?

Er, OK... And there's nothing in your constitution to prevent the government acting by proxy like this? They could, if they wanted, pay contractors to perform all current activities that the government performs, and these contractors would be allowed to break the constitution because they're not the government, they're contractors?

Hmm, yes, I can see why you might want to fix that.

Richard

[Tizzers Foxchase]

10.

“[T]he arbitration clause is not designed to provide Second Life participants an effective means of resolving disputes with Linden,” he said. “Rather, it is a one-sided means which tilts unfairly, in almost all situations, in Linden’s favor.”

-U.S. District Judge Eduardo C. Robreno
(Bragg vs Linden Lab)
http://lawy-ers.com/robreno_order.pdf

Companies such as Linden Lab for too long have spun their terms of service in a way that forces the user to voluntarily surrender their rights. This results in a technocracy that puts the user at the mercy of the corporation with little to no legal recourse if they feel the service is less than satisfactory.

This can be a very unfortunate position especially considering Linden Lab's notorious lack of care for their "customers," (*cough* Lab rats.)

In contrast, you have visionaries like Raph Koster that -get it- because they know what it is like to walk in the shoes of an avatar.

Declaring the Rights of Metaplace Users

http://www.raphkoster.com/2008/09/15/declaring-the-rights-of-metaplace-users/

One can only hope this kind of document becomes a trend in the future, lest we succumb to the Orwellian metaversal micro-societies that these virtual worlds companies create.

[Cunzy1 1]

11.

Hate is a strong word. I apologise.

[Bret]

12.

@Joshua_Fairfield

> "Civil liberties world" will fail...

I'm not sure I agree. It depends on a ratio of the perceived value of online rights to the inertia of investment in a particular system. American colonials rebelled against British rule even though that meant needing to establish a new currency, redefine property rights, defend against the French to the north and west, etc.

If WoW users were to see a high-profile incident which made enough of them feel their interests were seriously threatened by their continued participation, I think you'd see movement. You're already 'radicalized' (not in a pejorative sense at all; I agree with most of what you say) by what you've seen. But a critical mass hasn't yet developed.

[thoreau]

13.

"Imagine if signing away your constitutional rights were a prerequisite of engaging in any commercial activity."

You mean like when you sign a credit card agreement you waive your right to a trial by jury and instead agree to have any disputes heard by an arbiter?

[Bruce Boyden]

14.

Joshua, interesting paper. I'm a little unclear on the threat. The EULA provisions I imagine you have in mind say something like, "We can disclose your information to law enforcement when in our sole discretion conditions warrant," or something like that. I think you are right that that could carve out an ability for the VW provider to disclose under the consent exception to the SCA, 2702(b)(3). But having that power doesn't mean that they would use it -- in my experience, ISPs tend to always require some sort of formal process (subpoena or warrant) in order to cover themselves, no matter what their terms say. And I don't see any lessening of the restrictions on the government under 2703(a), which says "A governmental entity may *require* the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in an electronic communications system for one hundred and eighty days or less, *only* pursuant to a warrant..." (emphasis added). The EULA term, it seems to me, is just an overly broad way of framing the exception that already exists for disclosures in emergency situations, 2702(b)(8). In short, I don't see that it changes that much.

Second, it seems to me there are only a few contexts where privacy is even going to be important to users, so it's no surprise that there is widespread agreement to these terms. E.g., on the more social VWs like the Sims and Second Life, there may be some who want to have private and substantive (i.e., not just game-establishing) conversations. In those cases I would agree there's no real consent to the EULA's provision allowing disclosure to the whole wide world of what is said, and this is yet another area where the legal fiction of constructive consent to EULA terms is in tension with reality. But considering the proportion of all online VW chats that have this private, substantive quality and given the likelihood of disclosure, this problem does not seem that big a crisis to me; certainly it is not like the CIA installing cameras in everyone's bedrooms.

[Joshua_Fairfield]

15.

Bruce:

I like your close reading of the statute. I'll give you my understanding of how these things work out in practice, but I am always willing to be corrected by those in the trenches.

We agree on 2702. The companies *may* disclose whatever they wish, based on consent. The question is why they would wish to disclose things the customer wouldn't want them to. The answer lies above: my understanding is that the companies get real pressure from the authorities to voluntarily disclose, under threat of government subpoena that will disrupt the business's practices. Since the business doesn't care all that much, it discloses.

So that's all that's needed to turn the contractual commercial waiver into a pretty scary constitutional waiver.

But if you want to do the "required" section, 2703, my sense is that if the government is patient, they can get the same results. Here's how it works. The company cameras are on all the time. For any conversation that is past the 180 day threshold, the government can subpoena the records, and given the incredible leeway I've seen in 2705 delay in notification, the customer will not know know they are targeted and thus cannot act to quash the subpoena.

In the case of virtual worlds, it's the fact that everything is archived (because of system backups) plus the fact that Congress relaxed the warrant requirements for "old" messages that constitutes the threat. After the statutory period, everything comes in -- unless the court decides that the Fourth Amendment constrains the government independent of the statutory language.

Also, under CALEA and 2703, communications details (who is being called, when, how long, etc.) are all obtainable without a warrant, just as the government can get a PIN registry.

[Joshua_Fairfield]

16.

I should add: a government preservation request is one way they can make sure that the cameras are on even though they have to wait the statutory period out. I've heard of this happening, but it's entirely anecdotal, and I've heard from other government sources that they consider that an unethical endrun around the rules.

[Fritz Lehmann-Grube]

17.

As i tried to express lately in my talk on surveillance in virtual worlds, "Datenschutz" (german legal analogue to privacy) is not possible. I mean that quite literally: offence to privacy begins where behaviour, look, emotional expression is recorded, and naturally virtual worlds cannot be done without that - at least on a server's memory, and usually in its logs.
So - to speak in favor of the providers - they just HAVE to demand your "I agree". - Which is the main reason for me not to play there under the current policies. (And I don't.)
But surely there is a demand to providers for alternative counter-surveillance.
So here i found an interesting approach from the real-world:
http://www.pressetext.com/pte.mc?pte=090203001 (sorry, in german. Google for "Brassil cloak")
Cameras de-identify subjects, that are registered and whose location is known. As far as i understood - without knowing the details - this is done technically so closely to the object, namely in the camera, that cutting off the registration and the "presence" information would reasonably well simulate privacy.
I agree absolutely to Ian Brown: "People shouldn't be necessitated to a registration in order to protect their privacy" - in real world. But what, when they are registered by nature. Imagine a VW feature adapted from the cloak, then relatively transparent rules could be defined to protect players. I could think of programmed solutions and "governed" standards to ease the impossibility of virtual privacy.

See the outlooking sheet of our talk at "e-forensics law workshop" in Adelaide on Jan. 19. Coming from "Privacy is impossible in virtual environments" and a discussion on the WoW armory:
http://www.math.tu-berlin.de/~lehmannf/virtual_privacy/OffWorld.html

May i also spam you with a hint to a conference next summer, where i believe, such things are going to be issues. Errr.. No, Richard? :-)
http://fave-conference.org/

[Joshua_Fairfield]

18.

Fritz:

Perhaps we have different conceptions of privacy. But a few points. First, game gods need not retain all chat indefinitely. It appears that some do, and others don't. (I have it on casual conversational authority that Sony wasn't in the habit of it, and I suspect based on Linden's ability to retrieve conversations for the Bragg litigation that they do keep everything).

So it's not a matter of recording, but a matter of keeping.

Second, the further question is not whether private entities can gather the data, but whether the government can access it without a warrant. Specifically, I think the question is whether we can contractually pre-waive the government's obligation of reasonableness in search and seizures, most commonly expressed in the probable cause and warrant requirements. Again, I think that the kind of commercial pre-consent we allow nowadays to keep e-commerce running (i.e. the legal fiction of consent in electronic contracting) is a poor substitute for the kind of informed and intentional waiver of constitutional rights that we have often desired in the search context.

I really have a hard time thinking that Toyota could require pre-consent to let the police search your car at any time. (Although does anyone know what the On-Star TOU says?) In the same way, I run into difficulties when contractual standards are used to waive constitutional rights.

warmest regards,

Joshua

[Larry Kyrala]

19.

What's especially interesting is that I don't think section 17 was in the original WoW ToU. So, now you've got a situation where you build toons over a year or so and then all of the sudden the ToU changes.

As time goes on, the player becomes more invested and the cost of quitting goes up. So the amount of rights being signed away by the ToU can gradually increase while still retaining users.

This is how the frog boils...

[Omer]

20.

EULAs and Terms of Service sheets NEVER hold up in court. So signing away your rights in them means NOTHING. Simply change the Eula text file before you sign it, and it makes it void, Tada. Even if you didn't do this, they don't hold up in court.

[Paris]

21.

Wow Omer,
I did not know that. Wow.