Game Culture, Policy, Law, and Politics

Where identity goes, trouble follows. Blizzard's Battle.Net has a new identity system, RealID, which is raising a number of security, privacy, and utility concerns as the company prepares to launch two of the most anticipated PC games in years - Starcraft II and Diablo III.

Blizzard's Battle.Net is one of the older(est?) gaming social networks built around some of the most popular PC games of the last decade: Warcraft III, Starcraft, and Diablo II. While I've not been made privy to the service's history, it seems to have grown up in a rather ad hoc fashion. With the impending launch of Starcraft II, Blizzard has redesigned the service and one of its key components is its new identity service - RealID.

Online identity is a tricky problem (I've written over 100 blog entries on the topic) and Jaime Skelton of MMORPG.com has written a great article discussing the issues with Blizzard's service.

The RealID service as currently implemented lacks many of the privacy controls that users have come to expect from a social network - it seems that friends cannot be grouped into different categories for privacy and that it is not possible to play somewhat anonymously (a tricky issue for an online service).

Email addresses are login IDs - a bad idea I've discussed before - and you are identified by your real name to your friends, even if you haven't given that information to them otherwise. While Blizzard has stated that "friends" should only be your "real" friends, the expectation of "friending" online acquaintances has become so accepted that Blizzard's implementation is bound to cause a fair amount of trouble.

There are also some COPPA and child protection issues raised by the service, even if it is not explicitly targeted at children (complying with COPPA is such a good, do-able business strategy, and a legal requirement, there is rarely a sensible reason for not implementing its features even if you don't target kids as customers).

There are a number of other privacy issues as well as security concerns that have been raised by RealID.

Identity services are a key customer service and a major customer service cost - their design and implementation requires careful engineering and thought.

J. Skelton (2010), "Player Perspectives: A Pain in the RealID", http://www.mmorpg.com/showFeature.cfm/loadFeature/4342/page/1

How are we going to solve online identity? Just stop by 7-11.

A number of years ago, I was involved in some discussions about age verification for online gambling. At that time, as with it is today, there are plenty of technology pushers around - trying to sell ID tokens, biometric systems, etc. etc. etc.

My answer was simpler - use convenience stores.

After all, these pervasive, local merchants are the gateway to adulthood.

They sell us alcohol, cigarettes, porn, and lottery tickets.

They are entrusted by the state to verify our identities and our ages.

It would seem New Hampshire has figured this out. The state is beginning to support online lottery games, but the sales are tied to the existing retail infrastructure as players need to go to a lottery retailer, buy a ticket with a unique number, and register online to play (and presumably reverse the process to cash out).

Simple and as secure as anything else anyone has proposed.

And only the beginning for online skill and gambling games.

Know anyone at 7-11?

"New lottery games: A small change", http://www.unionleader.com/article.aspx?headline=New+lottery+games%3A+A+small+change&articleId=0e853e6a-1924-40db-bb54-d78c944c7d79>

"State To Launch Online Gaming Website Next Week", http://www.wmur.com/news/24016014/detail.html

There's a Sumo scandal brewing in Japan. 65 wrestlers have admitted to gambling illegally on baseball. This is in the wake of recent assault and drug use accusations.

It kind of sounds like a US sport.

What is different is that sponsors are taking the accusation seriously. Nagatanien, a major sport sponsor, is canceling its sponsorship of the next major tournament and reviewing its entire involvement with Sumo, as are several other sponsoring firms.

There has been a growing wave of gambling problems tied to different sports. Ranging from the mostly benign (wagering on other sports - with the main concern being debt and involvement with "interesting" folk) to very serious accusations of match fixing and odds manipulation.

The global nature of sport and wagering is making this a problem both for legitimate wagering firms and for sports organizations.

N. Fujimura (2010), "Sumo Loses Biggest Sponsor Amid Gambling Scandal (Update1)", http://www.businessweek.com/news/2010-06-22/sumo-loses-biggest-sponsor-amid-gambling-scandal-update1-.html

Gambling is Easy, Skill is Hard. Proving that a game is a gambling game is pretty straightforward, but how do you prove that a game is NOT a gambling game, that it is a game of skill? This is an increasingly important question as traditional computer game companies, such as Virgin Gaming, try to take familiar computer games into the play for cash and prizes world and slot machine manufacturers look to skill games as a way to reach new audiences.

Such is the case with Pace-O-Matic's "Moxie Mania Empire Edition" game licensed by Moxie Metro in New York. The basic game is (perhaps) a skill game using a variant of Tic-Tac-Toe where a player finds the best cell to score of the 9 available. After a long and winding series of legal battles, the game was declared a gambling game because the court determined that the prize which could be won was determined by chance.

Thus, though the game would be considered to have a "positive expected value" for any skillful player, the prize amount was chance driven, thus the game was gambling.

To review, there are three elements to determine whether a game is a gambling game:

1. A payment or consideration to be able to play.
2. A prize or reward of actual value based on the game's outcome.
3. An element of chance in determining the game's outcome.

In this case, the chance solely drives the size of the prize, even with perfect play, thus, the game has an element of chance and is gambling.

It was an interesting move by Moxie Metro and Pace-O-Matic as perfect skill play will always have a positive outcome (so, no risk of losing funds), but the court ruled that this was not sufficient.

Solo skill games for money are, I think, at high legal risk for being determined a game of chance, or having no players, or losing money. In order to be popular, players need to think they can win (my "illusion of skill" argument), operators need to know that players aren't going to win (more than they spend), and all of this needs to be done with no element of chance to get into legal trouble.

VERY HARD, if not impossible from a game design perspective.

Conversely, I think the real potential is with multi-player games. Core mechanics such as Rock-Paper-Scissors, Battleship, checkers, etc. lend themselves to rapid play with no element of chance (RPS raises some problems for another day).

M. Webb (2010), "Court Ruling Says Moxie Mania Empire Edition Is Illegal", http://www.vendingtimes.com/ME2/dirmod.asp?sid=EB79A487112B48A296B38C81345C8C7F&nm=Vending+Features&type=Publishing&mod=Publications%3A%3AArticle&mid=8F3A7027421841978F18BE895F87F791&tier=4&id=90CB95AF28D8497A8B64067285D7171D

Moxie Metro web site, http://moxiemetro.com/index.php

Pace-O-Matic web site, http://www.paceomatic.com/index.html

Richard Branson has re-entered the game industry with a tournament game site, Virgin Gaming. The site is supposed to award $1 Million in prizes over the next 12 months and will use existing console games.

(If you've been to PlayNoEvil before, you'll know what's coming next)

First of all, I am a huge fan and fascinated by the potential of skill games as an online business. I think skill games and more advanced gambling games could be the drivers of a new industry.

However, you've got to design for the medium.

Without basic changes, I suspect Virgin Gaming will rapidly join the ranks of failed tournament services.

Pool of Players

Customers are key to a business and a tournament service relies on having many, many players so that the entry fees far outweigh the cost to operate and the prize pool. Most console games are HEAVILY SKILL driven. There are great players and then there are the rest of us. They know it. We know it. In pretty much any sports or FPS or other twitchy game, I know I've lost in the first couple of minutes. Ranking systems somewhat compensate for this, but as seen with Team Fortress 2 and most other online shooters, the best players dominate the game and everyone else quits.

The Illusion of Skill

A 'great' skill game is one where everyone thinks that they are above average. Poker has achieved this. The game is designed so that for virtually every hand there is a way to see to have won when you've lost. Poker is a study in brilliant player choice and information disclosure. The game is strategic, but simple and, because of chance,a player is likely to not go too long without a victory.

Game Duration / Game Sessions

A good tournament service needs to have lots of short game sessions so that players who've lost have a chance to re-enter the tournament or enter another event. If a game takes a long time to lose, players will abandon it rather than try again. Learning opportunities and feedback needs to be fast.

The Dark Side

While Virgin Gaming is using the Xbox Live and Playstation service, there is no strong identity in the system (both services now support pre-paid debit card players), so there is only a weak linkage between an account number and a person. Once a game is played for money, even if there was strong "account identity", there is very weak "player identity" - after all, I could bring in my "ringer" buddy to play on my behalf when real money is on the line.

... and then there is cheating (a problem even on console games).

... and then there is tournament abuse (manipulation of ranking and reputation systems).

... and, of course, the complicated legal issues for these games (skill games are not legal in all US states).

I discuss tournament and ranking abuse, cheating, and identity problems at some length in my book Protecting Games.



I'm looking forward to the day someone gets this right. It will be a true revolution in gaming.

"Virgin Gaming FairPlay Guarantee", http://virgingaming.com/fairplay.html?f=FTR_1F_001

O. Chiang (2010), "Richard Branson Launches Virgin Gaming, An Online Game Tournament Service", http://blogs.forbes.com/velocity/2010/06/15/richard-branson-launches-virgin-gaming-an-online-game-tournament-service/

A bill has been introduced to legalize intrastate Internet gambling in New Jersey. The proposed bill would allow currently licensed traditional casinos to set up web sites that could be used by New Jersey residents to bet online. Other discussions of this issue have suggested that interstate compacts between states that legalize gambling (similar to combined lottery pools) may be the way online gambling is legalized within most of the US (bills have been introduced in Florida and California as well).

The claim is that there are around 500,000 NJ residents who wager $150 million a year at offshore voting sites. (that's $300 each - not a huge amount considering this is likely counting each wager made).

A representative of Interactive Media Entertainment and Gaming Association claims that 1500 jobs and $200 million in revenue could be raised.

"Some N.J. lawmakers betting on the Internet for new casino game revenue", http://www.nj.com/business/index.ssf/2010/06/some_nj_lawmakers_betting_on_t.html

Square Enix is dealing with a security breach for its MMO Final Fantasy XI. Ir seems that players user names, passwords, and other registration information was disclosed. Based on the description, it looks like a login and registration server was compromised.

Important Notice Regarding your PlayOnline ID(s)

Thank you for your continued support of PlayOnline and FINAL FANTASY XI.

As a result of an attack on our computer network, there is a possibility that information pertaining to some users has been compromised including the PlayOnline ID, PlayOnline password and certain other details obtained during registration. We have taken measures as soon as the attack was detected, and have limited the potential breach of information.

If you have linked your PlayOnline ID to a Square Enix Account, your account will be safe due to the nature of the information possibly breached. Please be assured that sensitive information such as your credit card number has not been compromised.

To prevent any misuse from accounts potentially compromised during this incident, we have changed the PlayOnline password for all those affected. We will be sending the new PlayOnline password to you by regular mail to the address registered in our records. We apologize for the inconvenience, but you will be able to login to PlayOnline using this new password. We have also sent out details on how to reset your password through our Information Center to those with a valid e-mail address, during the early hours of June 4th.

Those who can still login to PlayOnline using their current password are unaffected by the contents of this e-mail.

Please note: Square Enix employees will not ask you for your PlayOnline password regarding this incident. Please remain vigilant of any phishing attempts disguised as correspondence from Square Enix.

Thank you for your understanding, and we again apologize for any inconvenience caused.

"Important Notice Regarding your PlayOnline ID(s)", http://www.playonline.com/ff11us/polnews/news19199.shtml

B. Ashcraft (2010), "Final Fantasy XI Accounts Compromised", http://kotaku.com/5555304/final-fantasy-xi-accounts-compromised

The Swiss Supreme Court has ruled that poker is a game of luck in Switzerland and can only be played in casinos.

Meanwhile, the Ohio House has introduced a bill to regulate "skill games" (mostly games similar to slot machines, but with some element of skill).

There are some interesting public policy questions implied by a game played for money that may need to be considered:

1. How do you prevent money laundering?
2. How do you handle addiction / problem gaming? Do you?
3. What age limits or verification are appropriate?
4. How do you ensure the integrity of the game, skill or luck?
5. How do you ensure the integrity of the game operator?
6. If there is a game machine or software, who validates its integrity?
7. What the __ is a game of skill and how do you "prove" that a game as implemented is actually a game of skill?

E. Engeler (2010), "Swiss crack down on Texas hold 'em matches", http://www.google.com/hostednews/ap/article/ALeqM5g49nVKzWWNq_7AJOjVIjuC34WBYQD9G348UG1

J. Nash (2010), "Ohio House tackles 'skill' games", http://www.dispatchpolitics.com/live/content/local_news/stories/2010/06/02/copy/house-tackles-skill-games.html?adsec=politics&sid=101

There are substantial rumors that Virgin / Virgin Gaming is getting into the the skill / tournament games business for money & prizes.

If so, this will be the most serious move by a larger company into the skill games business.

It looks like the early games being considered are conventional console games. While this may be good for yielding a larger number of games, these games were not designed for this environment. Cheating is a much bigger issue, of course, and the bigger the prizes and cash, the larger the incentives for abuse... and the very fact that the games are being played over a network also increases the risks.

J. Fletcher (2010), "Virgin Gaming to offer online game tournaments", http://www.joystiq.com/2010/06/01/virgin-gaming-to-offer-online-game-tournaments/

"Virgin Gaming - ModNation Racers - Tournament Details", http://virgingaming.com/modnation/details

Just change your passwords.

Symantec found a server which appears to be a key part of a botnet which has harvested 44 million user names and passwords for online games:

World of Warcraft - 210.000
Aion - 60,000
PlayNC - 2 million (NCSoft's site-wide account)
Wayi Entertainment - 16 million

Symantec focused on an interesting feature of the botnet - it was used as an illicit cloud computing service to validate the quality of the stolen account information using a trojan program called Trojan.Loginck.

Ah, the Internet and its glorious features.

It was unclear how all of these identities were collected, probably via phishing or purchase.

Needless to say, this did represent a substantial dollar value in stolen accounts... millions and millions of dollars.

"44 Million Stolen Game Accounts Uncovered?", http://www.markeedragon.com/content.php/720-44-Million-Stolen-Game-Accounts-

E. Ward (2010), "44 Million Stolen Gaming Credentials Uncovered", http://www.symantec.com/connect/blogs/44-million-stolen-gaming-credentials-uncovered