Are Virtual-World Bank Robbery, Pickpocketing, and Runs on Banks Covered by Real-World Laws?

Second Life is an online virtual world. Recently, its virtual banks experienced a series of virtual bank heists, which netted the thieves/hackers a reported $3.2 million in Linden dollars -- the virtual currency used within Second Life, which is operated by Linden Labs. Noting that proper security had not been used by the host of the bank's server, the CEO of L&L Bank and Trust reported that "a brute force attack cracked the [bank's] database within a few hours."

The Linden dollars' real-world value was, at the time, approximately US $11,500, for Linden dollars can be converted into US currency on a Linden currency exchange. Thus, when the news broke, Second Life members, who spend about US $1.5 million every day within Second Life, were understandably upset.

The heist leads to an interesting legal question, which I will discuss in this column: Can a crime committed within a virtual reality game also be a crime in the real world? In particular, can a theft of virtual currency count as a real-world robbery?

Since virtual property still has monetary value, I believe the answer should, in theory, be yes, but an examination of real-world laws is necessary. I will also discuss whether virtual banks have any duty towards their depositors, in terms of providing security or other protections for their cyber-currency.

Is a Virtual Bank Robbery a Real-World Crime?

In answering the question whether virtual bank robbery is a real-world crime, the first important point is that it should be. Linden dollars can be converted into real dollars; people buy and sell Linden dollars both inside and outside Second Life. Like frequent flier miles or rewards points, Linden dollars can be used to acquire other property and can even be converted into U.S. dollars. Moreover, even if unconverted, Linden dollars can be used to acquire additional property within Second Life - and to obtain more recreation, which also has value. Finally, though the amount at issue here was modest, there are stock exchanges in Second Life as well - what if future thefts deprive citizens of millions, rather than thousands, of dollars?

At present, however, a virtual bank robbery would not qualify as a real bank robbery under the relevant federal law. Under this statute, a bank is defined as any member bank of the Federal Reserve System, or any other banking association, trust company, or savings bank operating under the laws of the United States. Second Life's bank would not qualify. Unlike online banks (or online operations or branches of real-world banks), virtual banks within a game are not banks for the purposes of US law. They are not licensed, supervised, or regulated by any banking regulator.

However, due to the hacking and theft that was involved, the Computer Fraud and Abuse Act may apply, for it includes a prohibition against knowingly, and with intent to defraud, accessing a protected computer, without authorization and by means of such conduct, furthering the intended fraud and obtaining anything of value. Hacking is accessing a protected computer, and as noted above, Linden dollars have value.

In sum, then, under federal law as it currently stands, what happened on Second Life may be categorized and punished as computer crime, but not also bank robbery.

What About Pickpocketing on Second Life? Can It Be Prosecuted?

Pickpocketing on Second Life may also fall within the Computer Fraud and Abuse Act.

Reportedly, due to a technical flaw in Apple's QuickTime program, it's possible to steal Linden Dollars from within Second Life. When a virtual resident sees an image planted by hackers, Second Life software activates QuickTime so it can play the video or picture. Hackers can then direct the Second Life resident to a malicious website that then allows them to take over a player's avatar and force it to turn over its Linden dollars by making an unauthorized withdrawal.

Virtual theft in this case may also be considered theft or larceny, as criminal law prohibits the unlawful taking and carrying away the property of another, with the intent to deprive the owner of its use. Surely, the transfer from the avatar to the hacker should count as a "taking and carrying away," and plainly, the hacker/thief has the requisite intent.

Should Virtual Banks Provide Real-World-Style Banking Guarantees, Especially In Light of a Recent Run on a Bank Within Second Life?

These issues not only raised questions about the applicability of real-world laws, but also should lead operators of virtual worlds to consider whether to guarantee (or explicitly declare they will not guarantee) the security of virtual world money and property. Currently, when a Second Life user places Linden dollars in a virtual bank, he or she is only protected by contract terms and computer security.

These questions will become more urgent when and if the holdings of Second Life financial institutions grow. Even now, the stakes are very real: In August, Second Life's biggest bank closed its doors after a run on its deposits, putting at risk the equivalent of hundred of thousands of U.S. dollars. The bank's founders claimed that a Second Life ban on Internet gambling caused a bank run as depositors moved to withdraw their funds which they could no longer use in Second Life's virtual casinos .

The bank, Ginko Financial, stopped accepting new deposits, and temporarily halted all withdrawals. Rather then going into bankruptcy, the bank converted account holders' balances into "tradeable debt securities" referred to as Ginko Perpetual Bonds. These bonds can be bought and sold on the World Stock Exchange (WSE), the largest of three virtual stock markets in Second Life.

Ginko Financial had promised a high interest rate, amounting to an annual return of close to 44 percent. At one point, it claimed to have 18,000 accounts and deposits amounting to $US 750,000. When the run occurred, rather than liquidating its assets for pennies on the Linden Dollar, Ginko opted to convert the deposits into bonds, an option not available to real-world banks. Ginkgo depositors can withdraw their deposits early, but at a highly-discounted value, or accept the bonds. (Of course, in the real world, unlike on Second Life, bank deposits are often guaranteed by deposit insurance, up to a certain amount; in the US, the regulator is the FDIC.) While most depositors had small sums on deposit, other customers may have lost as much as $10,000 US dollars.

At present, Second Life residents are setting up their own virtual regulatory bodies within the game - but these regulators have no ability to provide real remedies outside of cyberspace. The bottom line is that, as virtual banking increasingly has real-world consequences, regulators should take note. Otherwise, participants in Second Life and other virtual worlds may lose major sums of money, yet have no remedy or recourse.