The first virtual currency crime: hacker jailed after $12m Zynga theft

Last week a hacker faced a substantial prison sentence after pleading guilty to stealing approxmately $12 million worth of Zynga chips, a virtual currency used in its poker game.  This is big stuff (more on that below).

I spoke with Develop about this fascinating development – here’s their article:

“An IT businessman is facing a substantial prison sentence after pleading guilty to stealing around $12 million in online game currency.

Ashley Mitchell, 29, based in the Devonshire costal town of Paignton, admitted to hacking into the accounts of social gaming giant Zynga.

He transferred around 400 billion virtual poker chips into his account and began selling the currency on the black market. He had made £53,000 before his arrest.

Mitchell stood to make around £184,000 from the chips, the court heard, though Zynga’s sale value of the currency is $12 million.

Judge Philip Wassall said Mitchell faced a substantial jail term for the offences, according to regional paper Herald Express.

Mitchell was remanded in custody after the case was adjourned for reports.

Digital economy

The actual value of Zynga’s intangible and instantly replicable online currency sparked a debate in court.

Prosecutor Gareth Evans said Zynga had not been, in essence, deprived of any goods. He claimed there may be a knock-on effect as more customers bought the poker chips on the black-market instead of paying Zynga.

Judge Wassell asked if the case was any different from stealing notes from the Royal Mint – the UK’s body that manufactures British currency.

Prosecutor Evans replied that, in theory, there was no difference because the mint can produce more currency if its goods were stolen.

He said there is, however, a difficulty in valuing the chips because they are digital. But if Zynga had sold them legitimately the value would have been around $12 million.

Jas Purewal, lawyer and author of Gamer/Law, explained to Develop that the case has set a new precedent.

“This shows that the legal regulation and protection of virtual goods and currency, which historically has been fairly uncertain, is evolving fast – driven partly by the boom in virtual goods sales in games.

“This case is particularly interesting because it involved a UK court recognising virtual currency – in this case, Zynga chips – as legal property which can be protected by existing UK criminal laws.

“The court effectively found that, even though virtual currency isn’t real and is infinite in supply, it still can deserve legal protection in the same way as real world currency”.

Purewal said the case is a “vindication” for Zynga and other virtual goods providers.

Hacker record


Judge Wassell heard that Mitchell’s offences were in breach of a previous suspended sentence he was handed in 2008.

Mitchell had previously been convicted of hacking into the Torbay Council website and changing his personal details.

Defence solicitor Ben Derby said as a plea in mitigation that Mitchell had been “wrestling with a gambling addition” at the time of the Zynga theft.”

THOUGHTS:

As I said to the Develop guys, this case really does seem to break new legal ground.  For the first time (so far as I’m aware anyway) in the West, a court has looked at virtual currency and seemingly accepted on relatively little argument that it can be classified as ‘property’ within the meaning of (UK) criminal laws (though NB I can’t state definitively the the court found virtual goods = property, because we don’t have the court transcript).

So what?  Well, as longtime readers will know, I’ve been exploring for some time the legal status of virtual goods, which I think is going to come under significant pressure from different directions in the next few years.  The key issue is whether virtual goods are ‘goods’ (i.e. property) or whether they are services or something else.  If they are property, then in principle they could be bought/sold/assigned etc – which goes way beyond the way in which virtual goods are currently dealt with.

Until now, there has been relatively little by way of official analysis of this issue – which is why this case, where a judge seemed willing to convict a man based effectively upon theft of a virtual currency – is significant.

We may not hear much more about this particular development (except possibly when the man is actually sentenced) but this is definitely not the last we’ve heard about the interaction between games, virtual goods and the criminal law (in fact, I might even write a piece on that next month!)  As always, watch this space…

Follow us at http://www.twitter.com/gamerlaw or subscribe to our email updates here

Digital Chocolate sues Zynga over Mafia Wars

Digital Chocolate is suing fellow social games developer Zynga in the US over Zynga’s game Mafia Wars.  Digital Chocolate, which released its own Mafia Wars cell-phone game in 2004 (5 years before Zynga’s Mafia Wars), argues that it owns the rights in Mafia Wars and that Zynga has knowingly infringed those rights.  Digital Chocolate claims that Zynga has “falsely claimed to the public, the United States Patent Office and the courts that it ‘coined’ the Mafia Wars mark and owns superior rights to the mark.”
According to Courthouse News, Digital Chocolate claims that it “notified Zynga last year that it owned rights to Mafia Wars. Zynga attorneys responded with a letter promising to stop using the name, then the company launched a multimillion-dollar marketing campaign with 7-Eleven to promote the game, and filed two trademark applications to register the Mafia Wars mark for a range of products, from beer mugs and napkins to sweatshirts and hats”.  Pretty explosive stuff.
Digital Chocolate is seeking an injunction prohibiting Zynga from further trademark infringement (i.e. stop selling Mafia Wars).
Comment
This is another in an increasingly long series of lawsuits in the social games industry.  Nicholas Lovell at GamesBrief wrote a good summary on social games lawsuits back in 2009.  On that front, it’s worth bearing in mind in particular that this isn’t the first time Zynga has been involved in litigation over Mafia Wars – in 2009, Zynga sued Playdom over allegations that Playdom had released misleading advertising that created confusion between its Mob Wars and Zynga’s Mafia Wars.

There is certainly is a lot at stake here.  According to AppData.com, Zynga’s Mafia Wars currently has the 5th highest amount of Monthly Average Users (at approx 25 million) on Facebook games (does anyone have details on Mafia Wars’ revenue etc?).  That makes it a pretty high-profile target, so it will be very interesting to see where this goes next…

Digital Chocolate’s Complaint is available here.

Image credit: Zynga/Techbucket

Follow us at http://www.twitter.com/gamerlaw or subscribe to our email updates here

FarmViller player runs up £900 debt, could be sued by mother?

The Guardian reports “a mother has warned of the risk of children spending hundreds of pounds on ‘free’ online games available through Facebook after her 12-year-old son ran up bills of more than £900 without her knowledge“.  This raises interesting issues about the extent to which she could recover her losses: in a nutshell, only if she sues her son.  (Which she won’t, obviously, but it let me write a slightly more interesting headline than usual.)

But seriously – the issue of recovering loss suffered through inadvertant spending on a social game is an interesting one and I think this case is just a taste of things to come.  The facts according to the Guardian are that “last month [the mother’s] son…spent more than £900 on FarmVille. He had emptied his own savings account of £288 and had used her credit card to the tune of £625 to pay the bills“.  She apparently tried to obtain redress from Zynga, who refused.  Facebook has disabled her son’s account.  She tried to call HSBC to ask for a refund, but she was “told she would only qualify for a refund if she reported her son to the police and obtained a crime number“.

Sounds rather sensationalist, I know, but HSBC were right: under consumer credit legislation, a credit card company is only obliged to offer a refund to a consumer if the card has been used fraudulently/for criminal purposes, so the mother would have to report her son to the police in order to be able to claim that refund.  Which, obviously, she didn’t want to do as it would involve her son being given a criminal caution!

There might be a bit more of an argument over Zynga’s receipt of the money, but I imagine they may argue that they’re right to have refused a refund on the basis that, while in fact they may have received the money without the authorisation of the owner of the money, they accepted that money in good faith without knowledge that the son did not have his mother’s authorisation to use her credit card.  Is that sufficient?  Hmm. One to think about…

Anyway.  The Guardian article goes on to say:

She does not blame Facebook, Zynga or HSBC, saying that her son was the one using the card and is entirely at fault. But she added: “I do think they need to shoulder some responsibility in this business and put systems in place to stop this happening again. The fact that he was using a card in a different name should bring up some sort of security and the online secure payment filter seems to be bypassed for Facebook payments.”

A spokeswoman for HSBC said that had the credit card been used on a gambling site it would have started alarm bells ringing for “unusual usage”. But because the card had been used to buy Facebook credits HSBC did not consider the transactions to be suspicious, even though £625 was spent in just two weeks

The idea that Facebook’s social games platform did not put adequate safeguards in place to ensure that a child cannot use a card in another person’s name is an entirely valid parental consideration, but is that really Facebook’s responsibility?  Perhaps the mother is right that there should have been some additional security involved which the son could not breach but ultimately, no matter how many levels of security you impose, if a child obtains all the relevant details from his/her parent then it it’s difficult to see why the games company/web site should be at fault.

This incident also may have implications for banks and other consumer finance providers – is it right that spending substantial and unusual amounts of money on social games in a short period of time should not qualify as “unusual usage“?  Looking at it another way, if your card is used to spend a lot of money on social games currncy in a short period with no prior record of such purchases, should your bank give you a friendly call to make sure you authorised the payments?  Answers on a postcard please…


Bottom line: money is pouring into social games companies, but it’s just a matter of time before they have to deal with real issues of consumer credit liability and fraud.  Best for everyone to get the proper safeguards in place now.


[Image credit: Zynga]

Follow us at http://www.twitter.com/gamerlaw or subscribe to our weekly email newsletter here