Saturday, May 5, 2007

Data Mining in Second Life

http://blog.secondlife.com/2007/05/04/age-and-indentity-verification-in-second-life/#more-946

There are a number of things that trouble me about this. The main thing is that a third party is going to be used. I made an agreement with Linden Labs that they could utilise my credit card details to pay for a service they were providing me, but this goes well beyond that. While I agree that some form of age verification should be done within Second Life - I don't think this is the way to do it. I think they are opening a dangerous Pandoras Box here.

It doesn't much bother me from a governmental point of view. Governments can already collect my data. But where is it going to end from a private point of view? To site one example very relevant to Second Life, let's look at our old friends the music industry.

Already the music industry is making a concerted effort to price many internet based music radio stations out of existence. For each track broadcast they want a fee, and they've set fees very high considering the fee has to be paid not for each broadcast of the track, but for each person listening to the track. And here's where it overlaps the boundary into Second Life.

There are a large number of clubs in Second Life, and an even larger number of non-club plots that stream music in. My question of the day is this: If a company is allowed to collect my name, address, date of birth and other such personal information, and the RIAA (I site them as an example because of their very active campaign to chase people for money) then comes to this data mining site and says "We believe that this person is playing music into their lot on SL, hand over their details" - will they do so? And will I be told about it? Or will the first thing I hear about it be when a bill drops through my letterbox saying "You've played 500 tracks this last month, and we believe that they've been heard by 10 people, so here's the bill."

Data Mining using a third party is the top of a very slippery slope. While I would be prepared to supply, for example, my driving license number to Linden Labs direct so that they could run a check to see if a license in that name existed and was valid, that's the extent of it. I would balk at providing even THOSE details to a third party, since that third party is going to have other interests that Linden Labs doesn't (not to mention the fact that they might not even tell Linden Labs that they were giving away residents details to avoid being sued). I am certainly not prepared to provide detailed information such as my name and address, DOB and passport number just to play a game, ESPECIALLY if those details are going to be shared with a third party. When they demand that for entry to mature areas, I shall simply not enter mature areas. When they demand it for entry to the grid, I shall leave Second Life completely.

I suspect I won't be the only one.

4 comments:

Will Dwinnell said...

Please, let's keep the terminology straight: "Data mining" is a process of sophisticated statistical analysis, not mere information-gathering. If there is a threat to privacy, it is the uncontrolled and unmonitored access to, and sharing of personal data, not data mining.

Wildcat said...

This is sort of right and sort of wrong. Data mining means to search many databases for key pieces of information. It may be more accurate to describe what Linden Labs are doing here is providing one of those mines.

And this is an important issue. For what purpose can this mine of names, addresses and personal information be used, and by whom? And why are we being asked to provide a mine of potentially useful personal information about ourselves just to play a game? Once that information is out there, how can we tell what happens to it?

Wikipedia sums it up nicely:

"There are many legitimate uses of data mining. For example, a database of prescription drugs taken by a group of people could be used to find combinations of drugs exhibiting harmful interactions. Since any particular combination may occur in only 1 out of 1000 people, a great deal of data would need to be examined to discover such an interaction. A project involving pharmacies could reduce the number of drug reactions and potentially save lives. Unfortunately, there is also a huge potential for abuse of such a database.

Essentially, data mining gives information that would not be available otherwise. It must be properly interpreted to be useful. When the data collected involves individual people, there are many questions concerning privacy, legality, and ethics."

Anonymous said...

In some jurisdictions (not all) the athenticator can determine that an over-18 person with that identity exists. That is all.

A parental driving license can be "borrowed" once just as easily as a credit card.

Nothing proposed can determine the identity of the person logging onto SL.

The only credible justification for this is to try to protect SL from litigation - they can claim they "did their best" and point to a third party.

In other words, this is an illogical act which only makes sense in the context of so many other equally illogical "security" precautions.

Appearance is all, content irrelevant.

Meanwhile, the US government gets a welcome addition to the databases it can demand access to. More crosslinks. Less privacy. Yummy !

Wildcat said...

I agree. I'm not prepared to go along with this. Not now, not ever.