Jusletter IT

One of the more surreal revelations of the Snowden disclosures was the attention that security services of several countries had given to online gaming communities. NSA and GCHQ, the American and British military intelligence services, had discussed these issues in « ‹Get in the Game› with Target Development for World of Warcraft Online Gaming».¹ The document is a compilation of four independent studies into the danger that online gaming environments could be used as hidden communication tools for terrorist networks and also a discussion of the opportunities of these environments for security services in terms of recruitment. The introduction to the document states:

 

«Although online gaming may seem like an innocuous form of entertainment, when the basic features and capabilities are examined, it could potentially become a target-rich communication network. Online gaming represents a technology that is rapidly growing in popularity worldwide. World of Warcraft is one with an impressive following of gaming enthusiasts. With over 10 million users worldwide, it may be providing SIGINT targets a way to hide in plain sight.»

However, surveillance of online games was not to be left to SIGINT, signals intelligence, the electronic surveillance of communication traffic, alone. Rather, HUMINT, Human Intelligence, was to play a crucial part of both online surveillance and recruitment. This also involved «undercover» operation, members of the security services setting up player accounts and participating in the gaming action. The thought of «undercover orcs» infiltrating networks of terrorist elves was too good for the press to resist, with the Guardian setting the tone early on:

 

«To the National Security Agency analyst writing a briefing to his superiors, the situation was clear: their current surveillance efforts were lacking something. The agency’s impressive arsenal of cable taps and sophisticated hacking attacks was not enough. What it really needed was a horde of undercover Orcs.»

While this reaction by media and public to this revelation ensured that it remained merely an amusing footnote to the much more serious allegations of unauthorised surveillance activity, one of the authors has argued previously that we should not easily dismiss the potential for harm that resides in the surveillance of playful behaviour.² While game playing, and role playing in particular, seems by definition to be «not real», and the characteristics that we acquire in these environments therefore not in any substantive sense «about us», we argued that there are strong anthropological and sociological arguments to be made that under the social and economic conditions of modern industrial societies, «play» might be the only place left that can counterbalance the prevalent instrumental rationality and are the last safe havens left for holistic personal development and the autonomous shaping of one’s identity.³ We concluded our analysis with Huizinga’s conception of Homo Ludens, the «Man as Player».⁴ Huizinga showed that many cultural systems such as politics, science, religion and law emerged through self-organisation during play. From this we concluded that game environments are particularly fertile spaces where societal values can be learned, acquired and brought to flourish. Crucially, this also includes learning about the value of and the possibility for political resistance.⁵

This paper begins where our previous analysis ended. Where the previous study tried to draw a map of the type of data protection issues that surveillance of online games raises, here we look at two specific attributes that are of particular significance for data protection law. EU Data protection law is built around 2 binary distinctions. First, the distinction between personal and other data. Second the distinction between sensitive and non-sensitive personal data. Membership in two of the systems that Huizinga linked to game playing is sensitive personal data for the purpose of Data Protection law: political and religious opinions, and membership in political and religious groups.⁶

This paper then asks what it means, for Data Protection purposes, to be «member of» a political or religious group, or to have a political or religious belief in an online world, where these attributes can be much more ephemeral than traditionally the case. Looking at this question through the perspective of games will allow us to draw more general conclusions regarding online privacy protection also outside formal gaming contexts. «Slacktivism» for instance, the ease with which we can participate – or look as if we were participating – in political processes, by signing e.g. online petitions, raises similar conceptual issues regarding the appropriateness of our Data Protection regime in an environment where technological intermediation affects the intensity and persistence of commitments to secular or religious belief systems.⁷

In this section, we discuss how new forms of spirituality online could affect the meaning of «religious affiliation» in Data Protection law. «Religion on the Internet is […] a massive phenomenon».⁸ The trans-border nature of the net, its emphasis on networks and connectivity, made it an ideal space for numerous religious groups to augment their physical presence. The internet is likewise revolutionising the way that religion is lived out with the creation of cyber-religion⁹ and the resulting cyber-theology. People are increasingly going online to deepen and enrich their own faith and spiritual life,¹⁰ as well as to find spiritual relationships and more intimate communities.¹¹

We can distinguish here the mere use of the new environment by religions «born analogue» from religious movements that are «born digital» and only ever emerged because of the Internet. From a Data Protection perspective, it is obviously irrelevant if information about a person’s religious beliefs is gathered by filming attendance in a physical cathedral or a digital cathedral as online meeting place, or by monitoring the online discussion forum on questions of theology run by this church. Online services and activities by established offline religious groups will routinely fall within the remit of Art. 8 of the DPD.

More problematic, potentially, is the status of religions that were born digital and whose presence remains limited to cyberspace.¹² Examples of these are techno-pagan groups and esoteric movements that have found their own web space.¹³ Some of these new religions take the Internet and its culture itself to the heart of its belief system – The Missionary Church of Kopimism for instance is a congregation of file sharers that center around the idea of copying information as a sacred virtue.¹⁴ The Internet also allowed groups to flourish (or to be formed) that either parodied religion, such as the Church of the SubGenius (CoSG), or be religion-critical such as the Church of the Flying Spaghetti Monster (FSM). The Internet often transformed these marginal movements into entities with high group cohesion, engaged in activities that were previously typical for «proper» religious congregations. The FSM for instance has an active group on Kiva.org, where members engage in charitable work. Academic analysis by sociologists, cultural studies, anthropologists and theologians of these «joke religions» is controversial, with Danielle Kirby¹⁵ arguing e.g. that the marriage of ICT with groups such as the CoSG created a «church masquerading as a joke, rather than the reverse». From a legal perspective, both Kopimism and FSM have been granted legal recognition on several occasions in several countries, and it seems likely that engagement in their activities would qualify as indicative of a «religious or philosophical belief» under Art. 8, even if the belief ultimately is one of profound scepticism towards established religion, as atheism or agnosticism are equally protected.¹⁶

Finally, and most implausibly at least on first sight, are religions that are formed as part of the fictional environment of virtual games. The language of online games is itself full of religious allusions – we speak about «being in Godmode» when playing without any risks of being killed, there are shamans and paragons, and of course the «avatars» that we use. Inevitably, many Massively Multiplayer Online Role-Playing Games (MMORPG) also often allow players to take on the role of priests, druids or healers, and populate the environment with deities with variable numbers of tentacles and horns. Intuitively, it seems implausible that playing a Serpent God in Age of Conan should qualify as «sensitive personal information» for the purpose of DP law – «playing» indicates that the belief is not serious, it has similar semantic properties to the adjective «fake» or indeed «make-belief».

However, in the previous paper one of the authors argued that anthropological research into the psychology of game playing teaches us that the identification of «play» with «fake» is problematic, and that the way we play and react to the play of others can reveal a lot about us. It can indeed be, as Shakespeare wrote, the place wherein we «catch the conscience of a king». David Chidester coined the term of «authentic fake» in his description of the interaction of religion with popular culture in the consumer society,¹⁷ a concept that has been widely adopted by researchers into online and in-game religion.¹⁸ Crucially, «Even a fake […] can be doing something authentic», and for our purpose this means that it allows to gleam on authentic attributes of the game player.

Many of the strategies that the players adapt, as a question of moral choice, in a MMPORG can be of the type that traditionally was associated with a religious belief – e.g. the willingness to sacrifice oneself for the group, or to get martyred for one’s belief. For religions and games, this more intimate connection has recently been recognised in a number of in-depth studies of virtual gaming environments, with often surprising results. Campbell and Grieve, for instance in Playing with Religion in Digital Games, argue that¹⁹

 

«[...], digital games are an important site of exploration into the intersection of religion and contemporary culture that helps us understand what religion is, does and means in a changing contemporary society.»

For them,

 

«[…] games and religion share a fundamental similarity: both are order-making activities that offer a mode of escape from contemporary life, and both demand, at least temporarily, that practitioners give themselves over to a predetermined set of rules that offer a system of order that is comforting for its very predictability.»

In a similar vein and based on extensive ethnographic fieldwork, Robert M. Geraci argues in his Virtually Sacred: Myth and Meaning in World of Warcraft and Second Life that the space for community and ethical reflection that online games build are also mediating religious experience. They create meaning – which brings us into the scope of «philosophical beliefs» and also ideas of transcendence. For some users at least, this becomes a stated desire to copy their minds into the game, to become «immortal software angels».²⁰ This makes these worlds «virtually sacred» in multiple, sometimes collaborative, sometimes antagonistic ways, they «participate in our sacred landscape as outsiders, competitors, and collaborators.»

 

«They wander across amazing landscapes in amazing bodies and gain powers beyond mortal ken. […] Now, however, virtual worlds approach the powers of religion by offering transcendent places and experiences, and have, in fact, been explicitly compared to religious places and practices.»²¹

To make the link to the question of political beliefs online, we can see these developments in the light of what Weber called the «disenchantment of modernity»: the forces that pushed religion from public life now face their only place of resistance in game environments. These virtual environments that have taken the ability of technology-mediated «re-enchantment» to a new level, as an example of what Baudrillard called hyperreality: the inability in technologically advanced postmodern societies to distinguish reality from simulation. If legal doctrine remains beholden to that distinction, it will inevitably fail to grasp its subject matter.

In the novel «The Player of Games», the Scottish novelist Iain M Banks introduces the Empire of Azad, a brutal society with a unique political system: Every few years, all of the Empire participates in the game of Azad, a board game that can be played in single and multi-player mode. The game’s rules are so complex, and the skills needed to excel in it so closely matched to the skills that guarantee success in real life, that all political posts are allocated based on success in the game, the winner ultimately becoming the new emperor.

More than any other author, Banks takes Huizinga’s notion of the origin of politics in game playing to the heart of his story. In Azad, it is clear that the properties that a player displays during the game are also indicative of his political orientation and affiliation – Azad does not just select individuals for political posts, rather, the most successful gaming style also determines at least in broad outlines the political direction that the empire will take. If the dominating style in a tournament is aggressive, so will be the foreign policy for the next cycle, if it is vengeful, so will be its penal policy, etc. Knowing how a player plays, by definition, also tells how he thinks politically. Information about a player’s gaming style then is information about this political beliefs, and thus, in the vocabulary of data protection law, sensitive personal information.

How does political reality at the beginning of the 21st century compare? Above we saw how new religious movements were born in online gaming environments. Political activism too has on occasions entered virtual worlds and online gaming. In 2007, more than 200 avatars protested in Second Life under the auspices of the global union federation UNI against the employment practices of IBM. However, this activity was a «spill over» of industrial dispute in the physical world, and there can be no question that tracing back participation of an avatar at this event to the account holder would constitute professing sensitive personal information. A different problem may however arise in the future when avatars are increasingly capable of acting autonomously and unsupervised.

Closer to the examples of in-game religions that we discussed above was the «Million Gnome March» of 2005, just months after World of Warcraft had been launched.²² Several changes that administrators had made to the functionality of the game, and in particular to the «status» of a specific in-game class, the «warriors» which they refused to revert when complains were submitted in the out-of-game discussion fora that accompany the platform, players formed a «guild» (the in-game equivalent to a trade union, or political party) and staged a protest march. They used as avatars the form of scantily clad gnomes – a symbolically significant choice, as gnomes are the weakest, most oppressed group – and descended en masse on a specific place in the online world. Just as with demonstrations in the physical world, an inevitable consequence/design feature of such a protest is to inconvenience other users of the public space, the congregation of so many players at the same virtual space deteriorated software performance to everybody. And just as with demonstrations in the physical space, the authorities reacted with a mixture of countermeasures aimed at dispelling the protest and punitive measures to deter a recurrence:

 

«Attention: Gathering on a realm with intent to hinder gameplay is considered griefing and will not be tolerated. If you are here for the Warrior protest, please log off and return to playing on your usual realm.

 

We appreciate your opinion, but protesting in game is not a valid way to give us feedback. Please post your feedback on the forums instead. If you do not comply, we will begin taking action against accounts.

Please leave this area if you are here to disrupt game play (sic) as we are suspending all accounts.»²³

We note the attempt to re-affirm the in-game/outside-game dichotomy: In game, the story requires antagonism between groups, but it is a «make belief antagonism». «Real» antagonism, or grievances, should be taken off-game. The appeal was largely unsuccessful. Players who refused to leave the space got their accounts deleted. To do this, they obviously had to connect «participation at the march» and «protesting about the game changes» to the identity of the owner of the avatar – but did this constitute processing of sensitive data about «political opinions», or in other words, was WoW a «polis», a political community, or a mere commercial platform governed by contract law, the conflict «about» contract law rather than the social contract? The framing issues by the players, or citizens, and the administrators/owners, or government, differed on this. Blogger Ecastronova brought the issue to the point, in a post titled Synthetic Statehood and the Right to Assemble:²⁴

 

«Running a virtual world is a service, as we are often reminded, but it is more than running a BBS or a shopping mall or an amusement. There’s a nascent politics. There’s policy. There’s speech and assembly. There’s terror and reaction. If destroying the world and banishing people are not terror and reaction, respectively, I don’t know what would be. All this means that there are real issues of governance in play in the metagame.»

Developments like this led some academic commentators toy with the notion that public rather than private law, and with this also political and human rights, should govern the relation between participants and owners of virtual gaming environments.²⁵ While these radical proposals failed to gain traction, the issue under discussion here sidesteps the question whether the relation between owners of a gaming platform and gamers should be constructed analogously to that between government and citizens. The issue here is the applicability of Data Protection principles that also bind commercial service providers. Nonetheless, even though the march of the gnomes used the game environment to utilize the symbolism of political protest, it remained at heart a dispute between parties to a commercial contact, about the performance of this contract. It is unlikely therefore that participation at the march would be classified as the expression of a political opinion.²⁶

While online games therefore have the potential to generate political movements and political opinions, it is more difficult to find examples that match the creation of new in-game religions with out-game significance of the type we discussed above. Rather, what we find is the intrusion of political movements form the physical world into game environments – unproblematic for DP purposes – and game-related contractual disputes that use the symbolism, but little more, of political protest.²⁷ We should distinguish this line of argument from one that claims that games, themselves, are political, and their internal structure influenced by and depending upon powerful political and economic ideologies in the physical world.²⁸ This view is expressed e.g. by Scott Rettberg in «Corporate Ideology in World of Warcraft»:

 

«World of Warcraft is both a game and a simulation that reifies the values of Western market-driven economies. The game offers its players a capitalist fairy tale, in which anyone who works hard and strives enough can rise through the ranks of society and acquire great wealth.»²⁹

Not only these parallel readings are highly contested – it has been equally argued that some quests in WoW are subtly coding real life political events such as the Vietnam war³⁰ – but for our purposes largely irrelevant. In this case, the very fact that someone plays WoW would be data about his political opinions (in this case, endorsing capitalism, or criticising neo-colonialism e.g.). Since players have no control of the gaming features that give rise to these analogies, it seems a long stretch to attribute the choice to play the game at all to a political opinion of theirs. While this can depend on the political system they are in, and the nature of the specific game, we ignore this possibility for the purpose of our discussion that focuses on attributes and behaviour within the game, rather than the choice of gaming environment.

While games themselves are therefore not a breeding ground for new political beliefs, there is another way in which in online worlds, games and politics merge. «Gamification» is the process by which elements that originate in game design are increasingly utilised in environments outside formal game contexts. It uses e.g. reward strategies that allow «players» to earn points or badges for accomplishing certain tasks, and in this way utilises our natural tendency to enjoy «competitive socialising».³¹ The potential for (re)kindling political activism and engagement has also been identified, both for democratic participation³² and by democratic governments³³, and also extremist organisations.³⁴ From a DP perspective, the confluence of ICT enabled «slacktivism» with the gamification of political engagement raises issues about the nature of «political belief» in VRs that are the mirror image to those we discussed for in-game religious beliefs above. If citizens sign e.g. online petitions that are sent to them in their daily digest from websites such as Change.org, not because they necessarily identify with the issue in question, but because for them it is a move in a game environment that earns them gold coins, is this still the expression of a «political belief» for DP purposes, or is the nexus between identity and political belief so weakened as to make it unrecognisable?

What can we take from these discussions? As we said, Data Protection law in Europe is based on a hierarchy of dichotomies. One of them is the distinction between sensitive and non-sensitive personal data. Depending on which of these two categories a piece of data belongs to, different duties for the data controller are triggered. This data-centric approach aims to classify data independent from the context within which it occurs. A person’s gender, ethnicity, trade union membership or religious and political beliefs are always personal sensitive data. Yet the law does not give any definition of what a political or religious belief is. Rather, we «know one if we see one», with intuitions shaped largely in the offline environments of old. Our argument is that under the dual pressure of virtualisation and gamification, these old certainties become problematic. Activities that look like the online analogue of traditional political or religious activity may not have the close connection to persona identity that necessitated their special protection, while conversely, behaviour that looks like mere make-belief and fantasy may take the place of traditional religious experience. Rigid demarcation between sensitive and non-sensitive data, independently from the way information is created, negotiated and understood in its specific context, can result both in over- and underprotection of data under Data Protection law. For some, but not all, game players their in-game religious affiliation is constitutive for their personality. For some, but not all participants in e-democracy, signing a petition is hardly more than part of a game, the content of the petition accidental to the activity. Still, it is more likely that a person will face negative consequences for a petition they sign online, however frivolous and commitment-free this act has become, than face religious discrimination (or persecution for apostasy) for playing the role of a serpent priest in an online game.

But in privacy law, we are not only concerned about misuse of personal data. Rather, the very act of trying to build a complete picture of us as human beings, however benign in intent, is a transgression against our dignity, and the mere knowledge of being under constant observation chilling our attempts to find a genuine expression of our identity. Danger of misuse alone is therefore insufficient to rescue the distinction in virtual online environments. At the same time, widening the scope of «sensitive» is also not going to be possible. Online Gaming platform providers need simple mechanisms to «remember» that a gamer plays, say, a priest, without needing or wanting to know if for any particular gamer, this choice is of (quasi) religious significance.

Online, the virtual and the real, game and earnest, blend into each other, with boundaries that are essentially fuzzy and contested. Rather than forcing such an environment into binary categories, fuzzy legal concepts with blending boundaries such as «fair processing» may ultimately be more appropriate, and capable of giving gaming environments their due recognition.