Inspite of misgivings around the metaverse fuelled majorly by bad press, the world needs to prevent the metaverse from becoming the Planet of the Bored Apes, argues KATHERINE CROSS.
THERE’S BEEN NO better exploration of the uplifting side of the metaverse than a recent People Make Games documentary titled Making Sense of VRChat, the “Metaverse” People Actually Like. The host, Quinton Smith of Shut Up & Sit Down fame, amiably describes a platform where users have created a bewildering variety of private spaces, including museums and libraries, a record shop where you can listen to everything in stock, fantasy kingdoms, and even an eerily accurate recreation of a late 1990s Kmart, complete with a photo booth. Notably, VRChat has provided a familiar efflorescence of socialization and expression for transgender people exploring their identities for the first time, disabled people who find freedom in VR, and furries and otherkin who’ve built dens for themselves and their kith. Smith’s interviews with people from all of these groups are quite touching, and a reminder of the power of online anonymity.
It reminded me of the internet I grew up with: IRC chatrooms, Neverwinter Nights private servers, a bewildering variety of BBCode forums, and LiveJournal. Each was a wholly different world, loosely yoked together by the Windows GUI and nothing more.
The metaverse in its current form resembles that early internet in a number of crucial ways: relative freedom, cellular communities devoted to niche interests, the ability to remain anonymous, platforms being multilayered rather than flat and conformity-inducing. The internet of GeoCities rather than the internet of Facebook.
Of course, there’s an ugly reality to that time period as well. As early as 1995, media scholar Lisa Nakamura was warning that utopian dreams of the internet erasing all inequalities and prejudice were vastly overhyped, noting that early online games like LambdaMOO evinced ugly racism, orientalism, and harassment. Yet it’s clear that the rationalizing, homogenizing, and imposition of corporate-hegemony over that old internet has not only failed to solve that problem, but allowed it to metastasize into a threat to democracy itself. Questions of online harassment are vital in today’s metaverse, and made all the more urgent by ugly episodes of abuse, like a SumOfUs researcher who experienced what can only be described as a virtual gang rape in Meta’s Horizon World.
Despite the barrage of bad press, it’s worth remembering that the metaverse is not wholly owned by Meta (née Facebook). The marketing sleight of hand in Facebook’s rebrand was an attempt, likely, to link the two entities in the public consciousness. But the reality is that the word “metaverse” describes all networked VR and AR experiences, regardless of who owns them. While much attention is understandably focused on Horizon World, what with Meta’s aspirations to make it an omnibus social media platform for all occasions, there are other planes. Though contemporary VR in the form of the metaverse is not a true new beginning—it is, after all, still deeply tied to the internet we already have—its dramatic shift in medium offers us the opportunity to do certain things over again.
We can transition to a more regulated space without losing the beauty, freedom, and creative spirit of this incarnation of virtual reality. It’s an opportunity to get it right this time. We can effect a shift to a more ethical regulatory framework that will curb the awful episodes we’ve witnessed already without snuffing out the beauty that Smith found in VRChat. In short, we need to prevent the metaverse from becoming the Planet of the Bored Apes.
WE CANNOT AFFORD to leave regulation up to any one corporation. People Make Games opened my eyes to the risks of a heavy-handed approach, or one that turned things over to multinational hegemons who are equally PR-conscious and avaricious. Neither quality is especially helpful in preserving the best of individual expression while curbing predatory behavior. At the risk of stating the obvious, Meta cannot be trusted to act in good faith here: their raison d’être for investing so deeply into the metaverse in the first place is their desire to, at last, create a walled garden of their own. After all, owning Oculus means that Meta would control the platform, the hardware, and the distribution after years of being at the mercy of other companies’ app stores, browsers, and equipment.
Now that we can see the train coming from a mile off, what can we do to stop it? To that end, I propose a framework that seeks to address the metaverse’s problems in the most minimally intrusive fashion, while preventing the full-blown strip-mining of the space.
Begin With a Rights-Based Mindset
At present, most online spaces lack a sense of their inhabitants as individual carriers of rights. They are first, foremost, and often only consumers. It’s a grim exigency of capitalism, but it has been intervened in before: antidiscrimination law prohibits private businesses using their discretion to deny service to people of color, for example. A combination of existing national or supranational laws, as well as platform-specific policies, can ensure that a right to privacy, for instance, follows you wherever you go in the metaverse.
We should assume that all users of VR and AR spaces have inalienable rights that should guide policy. Individuals have a right to privacy, anonymity, control over their data, and control over their experience. Existing laws in the European Union governing privacy and control over data, such as the GDPR, provide a model that should cover many existing metaverse properties; the proposed Washington Privacy Act should be passed, planting a flag in Microsoft and Amazon’s backyard. But national legislation could also be modeled after it, as well as existing laws in Virginia and California: crucially, these laws hold corporations to a common standard, provide users with more control, and in the case of California, permit remedies for citizens whose data has been misused.
On most VR platforms, companies would have to be responsible for developing a prosocial architecture from the ground up: for instance, by implementing tools that protect users and give them control over their space. Giving players agency over how they interact or can be interacted with is vital for curbing online abuse. As a matter of design, building spaces to protect individual expression and discourage unwanted expression will be vital. Robust content moderation will be key to guaranteeing this, and cannot be an afterthought in virtual spaces. Content moderation professionals should be well remunerated by the builders of VR platforms and included in major design decisions. Larger corporate structures should include a C-suite officer whose sole job is overseeing and representing moderation strategies: that is, a CMO or chief moderation officer.
Ethicist and researcher Lucy Sparrow further argues for the need for a “community manager” approach to moderation, whereby some moderators are tasked not just with quietly managing content behind the scenes, but with actively cultivating the wider community of players. I’ll echo that call. Moderation is vital, and it is more than being punitive.
It is important to note that these strategies must be employed together. Tools at the level of the individual only work in conjunction with effective oversight. A techno-libertarian approach that suggests all the user needs is a “block” tool is merely going to re-create the layers of hell that already exist on social media.
Virtual Reality Is Reality, Act Accordingly
Existing laws may already apply to metaverse spaces. What’s vital is recognizing that online interactions are real and meaningful. Stalking in VR should be treated like stalking in the physical world; so should sexual harassment. While law enforcement rarely has any interest in genuinely helping people, this doesn’t mean that the companies in charge of various metaverse spaces have no responsibility to their users. Thus, even if a potentially illegal act is not referred to the police, it should still be grounds for severe sanction—perhaps through a watchlist shared across all virtual spaces by a trusted third party, like an ethical collaborative.
Similarly, though the legal landscape remains globally divided on this question, we need to nip any implementation of gambling mechanics in the bud.
The use of microtransactions in many games can be easily converted into gambling via systems like lootboxes, and platforms like VRChat already have a lucrative secondary market for avatars, costumes, and other digital assets. For the moment, it’s proving to be a mostly friendly and lucrative space for digital artists. In the hands of a corporation, it could turn into a casino. Existing laws around gambling, such as restrictions against selling to children or confinement of gambling mechanics to narrowly circumscribed digital spaces, could theoretically be used to stop this before it starts. There is even scope for updating or rewriting the Interstate Wire Act for the 21st century.
Many gaming studios insist that the virtual nature of the transactions, combined with the fact that the “payouts” are always digital items rather than real currency, distinguishes them from “real” gambling. There’s a reason for this: most existing restrictions on gambling in the US turn on questions of whether the stakes have “real value.” But we must broaden our understanding of reality to include these mechanisms, because virtual goods are undeniably valuable. And if VR ever does become a bigger part of our lives—as big as the internet already is—then asseverations about digital goods not having value will look even more dangerously antiquated than they already do.
Just Say No to Crypto
The most obvious source of corruption in metaverse spaces right now is the risk posed by NFTs and cryptocurrency. In recent months, a number of Ponzi schemes and other scams built around NFT properties involved the creation of video games and virtual worlds, and many people remain eager to shoehorn NFTs into online gaming with word salad promises of value for ordinary gamers.
While the ongoing crypto crash may solve this problem, securing a viable future for virtual reality means ensuring that its early adopters are not scammed into losing their life savings. For some, the advent of the metaverse is nothing more than yet another opportunity to hawk various crypto offerings. But that would be poisonous to this young garden of creativity. It would not only be stultifying to that innovative spirit, but it would also—like the gambling mechanics I’ve already inveighed against—create and nurture a predatory environment for users.
If we are to prevent the mistakes we made nearly two decades ago, we will need to close off as many avenues of capitalist predation as possible. This includes stopping attempts at re-creating our real world housing crisis, with its out of control speculation, in virtual spaces. Matters are already at a crisis point in some videogames: adding cryptocurrency to this combustible situation would be catastrophic.
POLICY IS A rich and intricate endeavor that requires attention to deep specifics and innumerable edge cases. But I hope that this framework offers a way to conceptualize a regulatory solution to the metaverse’s many problems. Not coincidentally, such a framework would begin to help save us from the existing problems of surveillance capitalism that already bedevil us. VR simply affords a chance, however small, to build it right the first time.
The VR future we deserve should be more than Meta’s quest for vertical integration. If we begin from an individual rights based framework based on principles of freedom to do, freedom to be, and freedom from—combined with a recognition of the fundamental reality of the space and a closing off of early opportunities for capitalist predation—we might just make the most of this second chance.
REGULATORY
SEC Charges Ex-Mazor Exec With Insider Trading Over US$1.6B Medtronic Buyout
By Andrea Park
Medtronic’s 2018 acquisition of Mazor Robotics was a win-win for the duo: Medtronic added a new slate of robot-assisted technologies for spinal surgeries to its portfolio, while the Israeli startup pocketed a total of about US$1.64 billion, including the costs of Medtronic’s previous investment in the company.
But not every winner in the deal kept things above board, according to the US Securities and Exchange Commission. On Wednesday, the agency filed charges against a former Mazor executive and two associates, alleging that they made more than US$500,000 in profits through an insider trading scheme related to the buyout.
The SEC claims that Mazor’s former vice president of business development—and currently the vice president of business development and growth at Change Healthcare Doron Tavlin —told a friend, Afshin Farahan, about the Medtronic buyout in August 2018, a month before the companies announced their plans. According to the agency, “Tavlin encouraged Farahan to buy Mazor securities quickly and to invest money on Tavlin’s behalf.”
Arcadia offers an approach that highlights the importance of bias mitigation and consideration of health equity issues in AI tool development, as well as several tips for reducing implicit bias and improving the equity and diversity of predictive outputs while still optimizing the organizational and financial objectives of their design.
Farahan allegedly did indeed use the information to buy Mazor stock, with total profits of about US$247,500. The SEC said he also passed the tip on to another friend, David Gantman, who proceeded to make around US$255,600 in his own subsequent trading.
The SEC also alleged that in October 2019, several months after the acquisition closed, Tavlin asked Tarahan to pay him for the insider tip and received US$25,000.
According to the complaint, all three men “took steps to conceal their illegal conduct” after the fact, when they allegedly covered up their relationships with one another during an inquiry by the Financial Industry Regulatory Authority into potential insider trading and a later SEC investigation ahead of the lawsuit’s filing.
The accusations fall under the SEC’s antifraud laws. In its complaint against the trio, the agency said it’s seeking permanent injunctions against them and a disgorgement of all funds they earned from their alleged scheme, plus a civil penalty fee from each. It’s also hoping to prohibit Tavlin from ever again holding an officer or director position at a company that reports to the SEC.
Surprisingly, this isn’t the only insider trading charge linked to a deal between Mazor and Medtronic. In May 2017, the pair inked an agreement that gave Medtronic exclusive distribution rights in the US for Mazor’s robotic surgical guidance systems, and in September of that year, they expanded the deal to give Medtronic global distribution rights for the Mazor X Surgical Assurance Platform.
Mazor later disclosed, however, that CEO Ori Hadomi had been investigated as a suspect by the Israel Securities Authority that May for allegedly telling associates about the distribution deal before it went public, prompting them to buy up Mazor shares. In its annual report for the year, the company said it wasn’t aware of any further questioning of Hadomi after the initial office raid and interrogation, and that it would continue to support the CEO and cooperate with the investigation as needed.
CYBERSECURITY
More Than 600 Providers Impacted By Ransomware Attack On Payment Vendor
By Heather Landi
A payment vendor was hit with a ransomware attack back in February that may have exposed patient data from more than 600 healthcare providers and organizations.
Professional Finance Company, an accounts receivable management company based in Greeley, Colorado, detected and stopped a sophisticated ransomware attack in which an unauthorized third party accessed and disabled some of PFC’s computer systems, the company said in a notice on its website about the cybersecurity incident.
The company said it immediately engaged third-party forensic specialists to secure the network environment and contacted law enforcement. During an ongoing investigation, it was determined that hackers accessed files containing certain individuals’ personal information.
The incident may have affected 657 of the company’s healthcare provider clients.
According to the PFC website, the company is one of the nation’s leading debt recovery agencies, and its client list includes many healthcare providers, retailers, financial organizations and government agencies.
PFC said it sent notification letters to all affected healthcare provider clients May 5.
The ransomware attack hit company computer systems that held data from clients such as Banner Health, Lifestance Health, Renown Health, DispatchHealth and hundreds of other provider customers (PDF).
The investigation uncovered no evidence of misuse of patient data, but data theft and misuse could not be ruled out. The types of information potentially accessed in the attack included names, addresses, accounts receivable balances, information regarding payments made to accounts and, for some individuals, birth dates, Social Security numbers, health insurance information and medical treatment information.
The company said it is providing complimentary credit monitoring and identity theft protection services to affected individuals.
The data breach has yet to appear on the the Department of Health and Human Services’ Office for Civil Rights website, so it is unclear how many patients have been affected by the breach.
“Data security is one of PFC’s highest priorities. Since the incident, PFC wiped and rebuilt affected systems and has taken steps to bolster its network security,” the company’s notice stated.
“PFC also reviewed and altered its policies, procedures, and network security software relating to the security of systems and servers, as well as how data is stored and managed.”
Companies operating in the healthcare space have a “perpetual target on their backs” for cybercrime, given the high volume of sensitive patient information that they are entrusted with, said Keith Neilson, technical evangelist at CloudSphere, a company that provides a cloud governance platform.
“Data breaches of this scale can be detrimental to a company’s reputation, and any company entrusted with confidential data like names, addresses, Social Security numbers, and financial information must be especially hypervigilant in their security and governance practices,” Neilson said.
The attack serves as a reminder that an effective cybersecurity strategy begins with cyber asset management, according to Neilson.
“The most critical proactive step IT leaders can take to mitigate the risk for ransomware attacks is to take full inventory of all cyber assets hosted within their company’s IT environment. Once comprehensive, real-time visibility of all data is secured, companies can establish security and governance practices across the entire cloud landscape, significantly minimizing the potential attack surface,” he said.
North Korean hackers targeting healthcare
It’s been an alarming week for cybersecurity in healthcare, as the federal officials issued a warning that hackers sponsored by North Korea’s government have been using the Maui ransomware to target healthcare and public health services providers since last May.
The FBI, the Cybersecurity and Infrastructure Security Agency and the Treasury Department released a joint cybersecurity advisory about the ransomware threat.
Federal officials “highly discourage” paying ransoms as doing so does not guarantee files and records will be recovered and may pose sanctions risks, according to the advisory.
In the past year, the FBI has observed and responded to multiple Maui ransomware incidents at healthcare and public health sector organizations. North Korean state-sponsored cyber actors used Maui ransomware in these incidents to encrypt servers responsible for healthcare services—including electronic health records services, diagnostics services, imaging services and intranet services, according to the agency.
The advisory says that Maui ransomware, known as maui.exe, is an encryption binary designed for manual execution by a remote actor using command-line interface to identify files to encrypt.
The FBI says North Korean state-sponsored cyber actors are using ransomware against healthcare organizations because the hackers believe providers are more willing to pay the ransom to retrieve their files.
The federal agencies recommend healthcare organizations maintain offline (i.e., physically disconnected) backups of data, and regularly test backup and restoration. Organizations also should ensure all backup data are encrypted, immutable (i.e., cannot be altered or deleted) and cover the entire organization’s data infrastructure.
Hospitals and health systems also need to create, maintain and exercise a basic cyber incident response plan and associated communications plan that includes response procedures for a ransomware incident.
According to the agencies, installing updates for operating systems, software and firmware as soon as they are released also is critical to mitigate risks. Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats.
The agencies also recommend healthcare organizations turn off network device management interfaces such as for wide area networks and secure with strong passwords and encryption when enabled, secure personal identifiable information/patient health information at collection points, encrypt the data at rest and in transit and implement and enforce multilayer network segmentation.
