Orcs, witches, goblins, elves... and yes, NSA trolls.
New internal NSA documents made available by whistleblower Edward Snowden and reported on by the Guardian, New York Times, and Pro Publica on Monday reveal that in addition to previous revelations, the U.S. spy agency has been systematically monitoring the digital landscapes of World of Warcraft, Second Life, and other console and computer games by "conducting surveillance and scooping up data in the online games played by millions of people across the globe."
As the Guardian reports:
Online gaming is big business, attracting tens of millions of users world wide who inhabit their digital worlds as make-believe characters, living and competing with the avatars of other players. What the intelligence agencies feared, however, was that among these clans of innocent elves and goblins, terrorists were lurking.
The NSA document, written in 2008 and titled Exploiting Terrorist Use of Games & Virtual Environments, stressed the risk of leaving games communities under-monitored, describing them as a "target-rich communications network" where intelligence targets could "hide in plain sight".
Games, the analyst wrote "are an opportunity!". According to the briefing notes, so many different US intelligence agents were conducting operations inside games that a "deconfliction" group was required to ensure they weren't spying on, or interfering with, each other.
If properly exploited, games could produce vast amounts of intelligence, according to the the NSA document. They could be used as a window for hacking attacks, to build pictures of people's social networks through "buddylists and interaction", to make approaches by undercover agents, and to obtain target identifiers (such as profile photos), geolocation, and collection of communications.
And the jointly-written Times and Pro Publica story adds:
The documents do not cite any counterterrorism successes from the effort, and former American intelligence officials, current and former gaming company employees and outside experts said in interviews that they knew of little evidence that terrorist groups viewed the games as havens to communicate and plot operations.
Games “are built and operated by companies looking to make money, so the players’ identity and activity is tracked,” said Peter W. Singer of the Brookings Institution, an author of “Cybersecurity and Cyberwar: What Everyone Needs to Know.” “For terror groups looking to keep their communications secret, there are far more effective and easier ways to do so than putting on a troll avatar.”
The surveillance, which also included Microsoft’s Xbox Live, could raise privacy concerns. It is not clear exactly how the agencies got access to gamers’ data or communications, how many players may have been monitored or whether Americans’ communications or activities were captured.
One American company, the maker of World of Warcraft, said that neither the N.S.A. nor its British counterpart, the Government Communications Headquarters, had gotten permission to gather intelligence in its game. Many players are Americans, who can be targeted for surveillance only with approval from the nation’s secret intelligence court. The spy agencies, though, face far fewer restrictions on collecting certain data or communications overseas.
"We are unaware of any surveillance taking place," said a spokesman for Blizzard Entertainment, based in Irvine, Calif., which makes World of Warcraft. "If it was, it would have been done without our knowledge or permission."