Rape in virtual reality: How to police the metaverse

LONDON - A police probe into a sex assault carried out in the metaverse has raised questions about the impact of virtual crimes on real people and how to safeguard cyberspace.

Donna Jones, chair of the Association of Police and Crime Commissioners, confirmed to Context that a complaint of an online assault was received last year, triggering the landmark inquiry into sexual crime in the metaverse.

Media reports allege that a child was 'attacked' in a virtual-reality (VR) video game, the first such case British police have investigated.

Police officials would not reveal more details.

The metaverse was popularised in 2021 when Mark Zuckerberg renamed the company that owns Facebook, WhatsApp and Instagram 'Meta'. It is generally defined as a network of virtual spaces where users can communicate.

Allegations of online sexual assault date to 1993, first documented in a text-based platform, LambdaMOO, in which one character used a virtual voodoo doll to force sex acts onto other players.

The paper became the key foundation on which academics and professionals crafted an alarming, new concept - 'virtual rape'.

As the internet has grown - and with it, ever more realistic and immersive platforms - experts say cases of virtual rape have grown, spawning questions about how either companies or law enforcement can possibly police this new Wild West.

Is sexual assault a new problem in the metaverse?

In 2022, psychologist Nina Jane Patel described her experience of sexual harassment in Meta's Horizon Venues (now Horizon Worlds) platform, where she was verbally and "physically" harassed by multiple male avatars.

"The intensity of experiences in the Metaverse can mirror the emotions felt in the physical world due to the immersive nature of these environments. This can lead to real trauma and psychological distress, akin to those experienced in physical assaults," Patel told Context.

Organisations have flagged instances of sexual assault on virtual platforms, but its true extent over multiple apps is unclear.

Meta has shipped more than 20 million units of its Quest headsets between launch in 2019 and early 2023, according to market research company Counterpoint.

The headsets are used to access a range of virtual reality apps owned by Meta and other companies.

One popular VR social app - VRChat - has about  50,000 users who go online using software called Steam, but that does not account for the tens of thousands thought to be using headsets.

Horizon Worlds, Meta's platform and arguably the most recognisable among many in use, has about 200,000 monthly users.

"Reporting mechanisms ... are often inadequate, either because the burden of responsibility lies with the victim, or because these mechanisms are not seen as trustworthy or effective," said Emma Gibson, global coordinator for the Alliance for Universal Digital Rights (AUDRi), an anti-discriminaton group focusing on online spaces.

"These challenges replicate offline barriers to protection, and obscure the true picture of the scale of the problem," she said in emailed comments.

A researcher for Eko, a campaign group that holds corporations to account, said she had "quickly ... encountered sexual assault on (Meta's platforms) after another user encouraged her to disable the personal boundaries setting".

"She noted that when another user touches you, the hand controllers vibrate, creating a very disorienting and even disturbing physical experience during a virtual assault."

Charlotte Proudman, a barrister and founder of a gender parity group, Right to Equality, said the "alleged gang rape of a girl through her avatar in virtual reality highlights the alarming extension of misogyny and men's sense of entitlement to women and girls in online spaces.

"It’s threatening and dangerous," she told Context.

What do the platforms say about alleged assaults?

A spokesperson for Meta distanced the company from the sexualised conduct that some of its users had detailed.

"The kind of behaviour described has no place on our platform, which is why for all users we have an automatic protection called personal boundary, which keeps people you don't know a few feet away from you," he said.

Game platform Roblox has also been hit with sexual exploitation accusations, and has faced at least two lawsuits accusing it of enabling child sexual exploitation in its virtual reality game.

A Roblox spokesperson said the company "combine(s) preventative measures with strict moderation and enforcement action against anyone caught attempting to circumvent our standards, in order to keep our community safe".

What other crime goes on in the metaverse?

Theft and financial fraud are a greater risk in the metaverse, which relies on online payments. Some platforms also have their own dedicated currency.    

"Following these transactions will require knowledge of decentralised finance, the different blockchain implementations as well as familiarity with a range of different forms of digital currency," Europol, the law enforcement agency of the European Union, said in a 2022 report.

The existence of multiple currencies can befuddle users and and facilitate fraud, Europol says. If money moves across borders, it is also more difficult for law enforcement to track.

Players of cryptocurrency game Axie Infinity suffered hefty losses when hackers stole about $615 million in cryptocurrency from a blockchain network in 2022.

And sellers of non-fungible tokens (NFTs) - a type of digital asset authenticated by blockchain - can offer a token to potential buyers without owning what it represents first.

In 2022, Brazilian prosecutors ordered a company to stop selling NFTs that promised buyers a protected tract of the Amazon rainforest due to conflicts over who owned the land.

Who has juristiction over the metaverse?

Experts say that policing the metaverse raises challenges in terms of defining the crime, jurisdiction and investigation.

"If an assault occurs in a virtual environment, the legal system must grapple with the nature of the offence. Is it akin to physical assault, harassment, or something entirely new?" said psychologist Patel.

A user whose crime has impact in another country would need to be extradited - a lengthy and rare process, said David Hoppe, a metaverse lawyer at Gamma Law, a San Francisco law firm specialising in media and technology.

Investigating an alleged offender would require real-world information such as a name and address obtained through an internet service provider. This can easily be masked by virtual private networks (VPNs) that can hide users' information by rerouting their activity through other countries, he added.

Ian Critchley, lead child protection specialist at the National Police Chiefs' Council, said the UK "policing approach must continually evolve to enable us to relentlessly pursue predators and safeguard victims across all online spaces."

What does that mean for cyber laws?

It is unclear what legal definitions should be used to define crimes seem in the metaverse.

Virtual experiences, while immersive, may not currently meet the legal benchmark for sexual abuse due to their lack of physical interaction, the 2022 Europol report says.

It is more likely, Hoppe said, that existing online harassment laws will be updated to better protect the metaverse.

But that might change as the technology becomes more intense, or the platforms become as ubiquitous as smartphones.

(Reporting by Adam Smith; Editing by Lyndsay Griffiths)