Chapter 41. Multiplayer Online Games
Information in this chapter:
• The culture of Massively Multiplayer Online Role Playing Games (MMORPGs)
• MMORPG data as evidence
Online gaming today is now the most popular form of gaming in the world. With the advent of high-speed Internet, it became possible for online gaming to really take off as a genre, and today tens of millions of people play games such as World of Warcraft, Everquest 2, The Sims Online, and Second Life. Console gaming units like the Xbox and PlayStation platforms now have online capability so that people can play together online. Where games like this exist, evidence also exists that can be used in investigations and legal actions.
Keywords
Multiplayer Games, MMORPG, Game Evidence, World of Warcraft, Everquest 2
Introduction
Online multiplayer gaming started way back in the mid-1970s when people played games called Multi User Dungeons (MUDs) on the Advanced Research Projects Agency Network (ARPANET). The ARPANET was the first packet-switched network, which would eventually become what we know today as the Internet.
Online gaming today is now the most popular form of gaming in the world. With the advent of high-speed Internet, it became possible for online gaming to take off as a genre, and today tens of millions of people play games such as World of Warcraft, Everquest 2, The Sims Online, and Second Life. Console gaming units like the Xbox and PlayStation platforms now have online capability so that people can play together online. Where games like this exist, evidence also exists. These programs, especially Massively Multiplayer Online Role Playing Games (MMORPGs) such as World of Warcraft, store a significant amount of data that can be useful as evidence.
The first half of this chapter will introduce you to the world of online games, including the culture and the people who play. The second half will focus on the type of evidence these games create.
41.1. The culture of Massively Multiplayer Online Role Playing Games (MMORPGs)
To understand MMORPG evidence, it is important to have a grasp of who plays these types of games and something about the strategies that game companies use to keep people playing over the long term.
The common stereotype of a MMORPG player is the jobless Mountain Dew–gulping nerd, living in his parent’s basement with no aspirations for the future other than leveling up his Dark Elf Shadow Knight. While people do exist who meet this stereotype, they are the exception and not the rule. People from all walks of life play these games, from your most successful business people and professionals to housewives and retirees. In 2010, the average age of a game player was 34 years old, and the gender demographics report that the players were 60 percent male, and 40 percent female. 1
In these virtual worlds, real friendships are developed. It is not uncommon for people to meet online in these games, get to know one another, move across the country to live together in romantic relationships, or to even get married. In a survey of 30,000 participants, it was reported that:
5.1% of men and 15.7% of women had physically dated someone who they first met in an MMORPG. Across these three sets of findings, a substantial portion of users across a broad age range have had meaningful social relationships in these virtual environments. What these three sets of findings make clear is that many users across all age ranges form meaningful relationships in MMORPGs.2
This may seem odd to someone unfamiliar with MMORPGs, but when you see the structure of the communities developed in these games, and the amount of time people put into developing their characters and the relationships they have within these virtual worlds, it is not surprising.
Respondents were also asked to compare the quality of their MMORPG friendships with their real-life friendships. 39.4% of men and 53.3% of women felt that their MMORPG friends were comparable or better than their real-life friends.
Almost all MMORPGs charge a monthly subscription to play. Because of this, it is in their best interest to keep people playing. The leveling up of your character, the quests, and the slaying of boss monsters is all developed to be as much of a time-sink as possible. In 2006, people spent on average 22.72 hours a week playing their MMORPG. 3 A significant number of MMORPG players spent even more time than this in the virtual world, regardless of age, career, family, or social commitments.
The distribution showed that about 8% of users spend 40 hours per week or more in these environments – the equivalent of a normal work week. The significant amount of time that users are willing to invest in these environments is further highlighted by the finding that 60.9% of respondents had spent at least 10 hours continuously in an MMORPG.4
The prevalence of possible evidence coming from MMORPGs and gaming devices is likely to increase with time. In 2010, it was reported that 67 percent of American households were playing computer or video games. 5
The most well-known MMORPG is World of Warcraft, and with good reason. As of October 2010, World of Warcraft reported having over 12 million subscribers. 6 With a user base reaching in the millions for only one of the many MMORPGs available today, it is no surprise that the data they create has become a potential source of evidence, and is appearing in cases with more and more frequency. The best way to illustrate this is to let the news stories speak for themselves:
A Houston mom is accused of luring a then 15-year-old Canadian boy into a sexual relationship after “meeting” him through the online game World of Warcraft, according to a report from Fox. Lauri Price, 42, apparently thought this through. She decided she’d fly to Canada to have relations with the boy when he turned 16 — as a way to sidestep U.S. statutory rape laws. (In Canada, the age of consent is 16.)7
A South Korean couple whose three-month-old daughter died of malnutrition while they were raising a virtual child in an online game pleaded guilty to negligent homicide on Friday.8
A Portland woman who met a 14-year-old Tennessee boy while playing the online game “World of Warcraft” is accused of engaging him in sexual chats and trading explicit photos.9
PORTLAND, Ore. – The Multnomah County Sheriff’s Office has launched an investigation into allegations that a local corrections deputy bragged about using a Taser gun on people in an Internet chat room.
Lt. Jason Gates of the Multnomah County Sheriff’s Office said he is appalled at the alleged online comments of the county corrections officer.
According to Gates, Thompson used a county work computer to play the online video game “City of Heroes” while on the job and then boasted about the joy he gets hurting people in jail in the chat room.
Budnick said that according to Trafalgar’s [Thompson’s] online chat, the deputy has posted more than 1,700 messages on the “City of Heroes” Web site since January. At one point, he allegedly posted 64 messages in 24 hours.10
On January 16, 2009, 29-year-old Andrew Warner’s son, Brendin, died at his Kingsland home… He admitted that he had seen a pillow sitting on top of his son’s head and didn’t take the time to remove it. He also admitted that he’d heard the boy crying, but didn’t turn away from World of Warcraft until he had to go to the bathroom. On top of that, it turned out that records showed the man had been playing the game for much longer than he had told investigators.11
Prosecutors in Canada hope to have two teens sentenced as adults after they admitted to planning the brutal rape and murder of 18-year-old Kimberly Proctor, and bragged about it on World of Warcraft, a sometimes violent online role-playing game. Some experts believe the killers’ involvement with World of Warcraft, which has 12 million subscribers worldwide, may have been a contributing factor in the crime, and say the game provided key information to police, according to CTV. CTV reports that the teens planned the killing online, using code words to “initiate the attack, maps of where to dispose her body and what kind of fuel to buy to burn her body.”12
Authorities said a 54-year-old Boston-area man traveled to Michigan to have sex with a 13-year-old girl who was his bride in an online role-playing game… Napoleon said the two had sex in Phillips’ van, at a motel, and at the girl’s home. Napoleon said Phillips met the girl online last year while playing RuneScape. Napoleon said the characters the pair assumed were married as part of the game, and Phillips gave the girl presents, including a cell phone, so that she could text him.13
41.2. MMORPG data as evidence
Multiplayer games can potentially provide four types of evidence that could be used in a case:
1. Timeline
2. Content
3. General location
4. Game subscriber information
We will look at where to get each of these types of evidence and how to validate them as needed.
41.2.1. Timeline evidence
Multiplayer games can provide timeline evidence from two primary sources, client-side evidence and server-side evidence. Timeline evidence is both in the form of when someone was playing one of these games, but in some cases, equally important is how much a person was playing. In the following sections we will show how it can be determined when someone was playing and how much total time they spent online.
41.2.1.1. Client-side timeline evidence
Client-side timeline evidence is data that is collected and stored by the game on the local computer hard drive in various log files that the game stores without the player’s knowledge. Client-side evidence can be located and analyzed by a computer forensic examiner.
Timeline evidence from these games can be used to establish when and how much someone has been connected to the game. However, to make sure that connection time is relevant and useful, analysis would need to be performed to make sure that you are looking at connection time and not just overall connection time. The reason for this is that these types of games do not typically have an auto-disconnection feature. In other words, you can log in to one of these games, leave for ten hours, and the log would reflect that you were connected to the game for that ten-hour period.
For this reason, reviewing the logs to ensure that some type of user activity is present throughout the course of those ten hours would be required to validate that a person was playing the game, rather than the game sitting there unattended.
In Fig. 41.1 you can see the overall timeline for play sessions. However, this will not give you any information as to whether or not the player was active at the keyboard.
 |
| Figure 41.1 |
In order to establish active connection time from historical logs stored on the user’s computer, the examiner would need to locate the game logs that store not just the connection time, but also in-game activities such as chatting, fighting, crafting, and so forth, and view them in detail. These log files can become extremely large depending on the game and how the logging is done by either the game software or a third-party logging software.
Figure 41.2 is a screenshot of a player log from Everquest 2. The key words in the screenshot that indicate player activity are the words “you” and “your.” These indicate that the player is causing something to happen, in this case by fighting a monster called a Sablevein crumbler. When these kinds of entries are seen in the log, the player is at the keyboard and this can help to verify that the game was not logged in and left idle.
41.2.1.2. Server-side timeline evidence
Server-side evidence would have to be provided to you from the company that hosts the game. Server-side timeline evidence should be able to provide even more detail if the logs have been preserved by the game company. The reason the server-side log may contain more information about the player’s activity is that the server-side logs are used to respond to customer service requests from players. In order for the game company’s customer service department to handle such issues as lost-in-game items, connection issues, player disputes, harassment issues, and so on, they must be able to see more information than what is displayed on the screen to the player. However, how long this information may be preserved on the server side is going to be game company–dependent and could be only a few days to several months.
41.2.2. Content evidence
The second type of evidence that can be gathered from multiplayer games is content evidence. Content evidence is going to consist of chat logs. Multiplayer games are designed specifically to have people interact with each other via their avatars or in-game characters. A multiplayer game without the ability to chat with other players online would be an abysmal failure. Most multiplayer games have the ability for the user to turn the chat logging on or off.
Figure 41.3 shows a chat log from the game Everquest 2 showing a player-to-player conversation between the user at the keyboard and a player character named Cogito.
In Fig. 41.3 you can see a conversation between two players. Note that the player character name is only shown for the player the user is talking to and not for the user at the keyboard. The conversation in Fig. 41.3 has been parsed using a database program to exclude everything else in the log. In Fig. 41.3 you can also see the date and time stamp of the conversation, so you are getting both timeline and content evidence.
41.2.3. General location evidence
General location evidence can be obtained from the gaming company, provided they record the Internet Protocol (IP) address of the computer’s Internet connection for each session. If you can get this information, an examiner can perform a whois lookup to determine who owns the IP address and where the IP address is located. With the IP address and the owner information gained from the whois lookup, you can then subpoena the Internet service provider for the subscriber information to get the actual physical address of the IP connection along with the name of the person who is financially responsible for the Internet access account.
41.2.4. Game subscriber information
The last piece of evidence these games can provide is the game subscriber information from the gaming company. The game subscriber account information can yield the real name, billing address for the payment method, the e-mail address for the account, and telephone contact numbers.
If you are performing an investigation into the activities of the person outside of the game, the e-mail address, phone numbers, and credit card information can potentially provide additional leads of value.
41.2.5. Getting server-side evidence
Server-side evidence is discussed in Chapter 23.
Summary
In this chapter we discussed in some detail the world of multiplayer online games. We covered the culture of MMORPGs and who plays them, and also looked at a number of cases that have been in the news that have involved people who play these games. We also looked at the types of evidence these types of games can yield for the purpose of legal actions including timeline evidence, content evidence, subscriber information, and general location evidence.
References
[1]
[2]
[3] Yee, N., The Psychology of MMORPGs: Emotional Investment, Motivations, Relationship Formation, and Problematic Usage, In: (Editors: Schroeder, R.; Axelsson, A.) Avatars at Work and Play: Collaboration and Interaction in Shared Virtual Environments (2006) Springer-Verlag, London, pp. 187–207.
[4] Yee, N., The Psychology of MMORPGs: Emotional Investment, Motivations, Relationship Formation, and Problematic Usage, In: (Editors: Schroeder, R.; Axelsson, A.) Avatars at Work and Play: Collaboration and Interaction in Shared Virtual Environments (2006) Springer-Verlag, London, pp. 187–207.
[5]
[6]
[7]
[8]
[9]
[10]
[11]
[12]
[13]
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.