Crime in the metaverse

Thanks to Lorenzo Saba for collaborating on the English version of this article

The first cases involving virtual crimes are starting to surface, and states will have to adapt their laws to deal with them. Investigating such crimes and gathering evidence about them will be a challenge.

Virtual reality is often associated with the idea of escaping the real world. Hiro, the protagonist of Neal Stephenson’s novel Snow Crash, knows something about this. He tries to get away from oppressive reality by using his computer to access another world—a world Stephenson coined the word “metaverse” to describe. Just over thirty years have passed since the 1992 publication of that book, and the metaverse has evolved from an imaginary place in post-cyberpunk literature into a true parallel world where anyone can interact with others and work, play, sell, or buy. But where there are transactions there are also crimes.

A few weeks after a British 16-year-old reported being sexually assaulted in an immersive metaverse game, Interpol (the international police force) presented a white paper on metaverse threats and opportunities at Davos.

Interpol’s experts have identified crimes that are likely to be committed, including cybercrime, NFT fraud, virtual identity and asset theft, stalking, sexual harassment, cyberbullying, and terrorism. Many of these are already common on the web, but they are likely to expand to the metaverse, given that Gartner and Citigroup predict that by 2026 roughly 25% of the population will spend at least one hour per day in the metaverse, and by 2030 the metaverse market will be worth around 13 trillion dollars.

The good news is that when this does happen, we likely won’t be caught off guard from a legal perspective. Many laws are evolving to cover online versions of existing crimes, and that is likely to occur in the metaverse as well.

Consider terrorism and more specifically radicalization via the web. In 2023, a teenager playing an ISIS warrior on Roblox—a well-known platform for playing games in 3D scenarios created by the players—was arrested in Singapore. He was watching propaganda videos on the internet and listening to Islamic State songs on streaming platforms. Even more common are cases of online fraud perpetrated through fake shops. These are e-commerce websites that faithfully reproduce legitimate shops and then steal credit card data from users. If such cases occur in the metaverse, we have real-world tools to fight them.

However, in some scenarios, preexisting laws aren’t up to the task of dealing with facets specific to metaverse interactions. For example, Italian case law recognizes remote sexual harassment as potentially criminal and has acted on cases of sexual harassment in the form of forcing victims to perform sexual acts while taking pictures and videos via webchat. However, Italian courts haven’t yet ruled on a case of rape in the metaverse. Given that avatars are acting in the metaverse, and the victim is a mere spectator to what is occurring virtually, it may be complicated to define such scenarios as sexual assault punishable by law—at this time physical involvement of the victim is required to meet that definition. However, the psychological consequences of such an act would still be significant enough to establish the less serious crime of harassment.

The current legal framework—despite obvious interpretation challenges and possible adjustments—does not appear wholly inadequate to deal with the earliest cases of crime in the metaverse. The biggest challenge will be for investigators to gather evidence in a murky, dematerialized world in constant evolution, where avatars can serve as masks that make identification of the people behind them difficult, if not impossible. This vaguely resembles the internet evolution scenario in web 2.0, only this time, illusion makes the experience a whole lot more real. But that’s another story.