ENTERTAINMENT & SPORTS - March 2024

Online Safety and Cybersecurity Risks in Video Gaming – Part 1

By Lau Kok Keng and Teoh Jun Li (Rajah & Tann Singapore LLP)

I. Introduction

Video gaming has become an exceedingly popular hobby for many around the world. There are currently just over 3 billion active video game players in the US$282 billion-dollar global video gaming market.[1] Individuals of all ages game, with those under 18 years old comprising about 20% of the gaming population.[2]

Of the three billion active video gamers, 1.1 billion engage in online video gaming while the rest enjoy games that can be played purely offline.[3] Online games are played over the internet, and many allow gamers to interact and connect with each other online via in-game chat boxes, chatrooms and over microphones. In addition to online games, popular gaming communications platforms such as Discord also allow gamers to engage in voice and video calls, text messaging and exchange of content. Despite the benefits of online gaming, its ubiquity also means that many are susceptible to various risks such as bad actors and technology that is misused for harmful purposes. This is especially concerning considering that those at risk include the young and vulnerable.

In the first part of this two-part article, we explore the online safety risks that gamers may encounter, including online grooming, cyber bullying, and gaming addiction, and how existing laws are able to deal with offences relating thereto. We will also discuss the new Online Criminal Harms Act (“OCHA”) and its equivalents in other major jurisdictions, and how the OCHA may potentially be applied to combat such offences.

II. Risks of Online Gaming

A. Online Grooming

One risk of online gaming is the possibility that a young and vulnerable gamer may experience online grooming. This is when a predator cultivates and nurtures a relationship with a young person to eventually exploit him or her sexually or financially.[4] Groomers do this by utilising communication features in games to strike up conversations,[5] and may gift their prey with in-game currency to win their favor and trust.[6] The groomer then proceeds to exploit the relationship by requesting sexual favors, such as sexually explicit images. The images may be used to extort money from them or to get them to commit crimes. Financial grooming may take the form of investment or romance scams. Some groomers even end up killing their prey, like in the case of Breck Bednar.[7]

Online grooming is a pressing issue as studies have shown that young persons are exposed to high-risk online grooming situations in as little as 19 seconds, and the average grooming time is only 45 minutes.[8] In Singapore, 14% of respondents of a youth online gaming survey interacted with strangers beyond the online game, such as meeting them personally and sharing personal information.[9]

Section 376E of the Penal Code, which was introduced in 2007 due to the increase in online sexual crime, expressly prohibits the sexual grooming of minors.[10] Further, section 376EB, which prohibits sexual communications with a minor, was introduced in 2019 to cover situations where a groomer sexually communicates with a victim but with no intention or attempts to meet the victim.[11] In addition, section 8 of the Children and Young Persons Act prohibits the “sexual exploitation of a child or young person”.[12]

In relation to financial grooming, section 415 of the Penal Code makes it an offence to engage in financial scams by dishonestly inducing a person to deliver or cause the delivery of any property to the scammer, while section 405 of the Penal Code makes it an offence for anyone to dishonestly misappropriate or convert to his own use any property entrusted to him by another person.

Generally, however, current anti-grooming laws are considered insufficient as they only allow for reactive rather than preventive enforcement.[13] Further, they do not clearly provide measures to address the anonymity that groomers may enjoy on the Internet. The OCHA, which will be covered below, now empowers the authorities with additional tools to facilitate more effective enforcement action.

B. In-game Cyber Bullying

Another risk that online video gamers are exposed to is cyber bullying. This generally encompasses toxic behavior like shouting, cursing, making derogatory remarks and abusing game mechanics to disrupt the gameplay of other players.[14] In Singapore, a youth online gaming survey found that about 17% of gamers between 13 and 18 years old were bullied, and half of them did not tell their parents about it.[15]

The ramifications of cyber bullying are serious. Victims are robbed of their enjoyment of the game as they experience harassment, irritation and emotional distress. They may even develop anxiety, depression and suicidal tendencies.[16] In one unfortunate case, a Texan teenager was cyber bullied to the point that he committed suicide. He was harassed and convinced to commit suicide in an online video game by a 16-year-old male from Michigan. The deceased was still online and wearing his headphones at the time of his death.[17]

C. Gaming Addiction

Online gamers are exposed to the risk of gaming addiction. The World Health Organization’s International Classification of Diseases now includes gaming disorder as a global health and health-related condition, and defines gaming disorder as a pattern of gaming (digital or video) behaviour characterised by impaired control over gaming, increasing priority given to gaming over other activities to the extent that gaming takes precedence over other interests and daily activities, and continuation or escalation of gaming despite the occurrence of negative consequences[18]. Such a disorder has numerous adverse effects on the gamer’s health, like obesity, higher heart rates and blood pressure, and eating disorders.[19] Some addicts have even died during marathon gaming sessions,[20] such as 17-year-old Thai gamer Piyawat Harikun.[21]

Gaming addiction has also contributed to hefty expenditure on in-game and in-app purchases[22] of cosmetic items, pay-to-win items and loot boxes.[23] The extent of expenditure on online gaming can be seen from games like Genshin Impact, which earned US$874 million in its first five months after its launch,[24] and Counter-Strike: Global Offensive, which earned US$100 Million on loot boxes alone in March 2023.[25] Locally, one young Singaporean addict spent S$20,000 of his parent’s money on online games, and even stole to buy loot boxes.[26]

D. Loot Boxes

“Loot boxes” are purchases offered by online games that reward players with randomised in-game items. Examples of loot boxes include the purchase of “keys” to unlock “chests” in Counter Strike: Global Offensive to yield random “skins”, which can go for as much as US$50,000.[27]

Loot boxes present risks to online gamers as they are likely to amount to gambling due to the presence of the element of chance.[28] Like gambling, loot boxes stimulate dopamine release, rendering the opening of loot boxes highly addictive.[29] This addiction has led some young gamers to spend exorbitant amounts of money,[30] incur unrepayable debt, misappropriate their parents’ money, and even cause their families to re-mortgage their homes.[31]

In Singapore, certain types of loot boxes are permitted to be offered under a class licensing regime. These are either loot boxes within a game that is entirely free to play, or loot boxes containing prizes that cannot be exchanged for real-world currency.[32] However, jurisdictions like Belgium and Netherlands have already banned loot boxes while China and Japan have enacted regulations.[33] In China, loot boxes cannot be purchased, be it with real-world or virtual currency, and the drop table and drop rates of the loot box must be publicised.[34] In Japan, loot boxes with multi-level mechanisms (known as “Complete Gacha”) are prohibited. These mechanisms require collection of sets of items via opening loot boxes in order to obtain a rarer final item.[35]

III. The Online Criminal Harms Act and its Application to Online Gaming

The OCHA, which came into force on 1 February 2024,[36] was created against the backdrop of increasing occurrences and abetment of criminal activity occurring online, including scams and illegal moneylending.[37] It allows for quick and effective action to be taken against online crime by issuance of one or more of the following directions by the police:[38]

Disabling Directions to online service providers requiring it to disable access to materials that it hosts;
Stop Communication Directions to persons to require them to remove material, stop storing, posting, providing or transmitting material, and to disable access to the material;
Access Blocking Directions to internet access service providers requiring them to disable access by persons in Singapore to any material or location;
Account Restriction Directions to online service providers to disallow or restrict interactions by its online accounts; and
App Removal Directions to app distribution service providers requiring them to stop the distribution and download of apps.

The aforesaid directions can be issued against individuals and entities regardless of their links to Singapore.[39] Further, the OCHA allows for the authorities to seek information that is relevant to the investigation of online crime from online service providers, such as information about online gaming accounts.[40]

Although the OCHA was intended to deal with scams and online crime, the powers granted to the authorities are wide enough to tackle the risks of online gaming. For example, to combat cyber bullying and online grooming, Account Restriction Directions may possibly be issued to game developers and communication platforms to restrict access by the offending user to his online accounts. Information can also be requested about the offender’s online account, which could reveal the offender’s identity. Access Blocking Directions can then be issued to relevant internet service provider to require it to disable the offender’s access to certain games and communication platforms. Stop Communication Directions may also be issued to stop the offender from verbally abusing others, or for interacting for the sake of grooming.

The concerns arising from loot boxes may also be addressed by applying the OCHA via issuance of App Removal Directions to prevent gamers from being able to access such games in the first place. Alternatively, issuance of Disabling Directions to game developers to prevent access to the game’s loot box features may be possible. Finally, gaming addiction may also possibly be dealt with by issuing time-based Disabling Directions or Account Restriction Directions to limit the play time of its gamers, which is the approach taken by China.[41]

Finally, Codes of Practice that are binding on online service providers can be issued under the OCHA to prescribe good practices and implementation of appropriate systems and processes to reduce the risk of online crime.[42] Enforcement of the Codes of Practice can be achieved via the power to issue Rectification Notices to remedy non-compliance,[43] and Implementation Directives to compel implementation of systems, processes, or measures.[44]

IV. Comparison of OCHA with its Equivalent Laws in Other Jurisdictions

A. Online Safety Act of the UK

The UK Online Safety Act (“UKOSA”) applies to online services, but only to those that have a significant number of users in the UK or if the UK is a target market.[45] In contrast, the powers under the OCHA can be used against all online services regardless of their links to Singapore.[46] Further, unlike the OCHA, the UKOSA does not apply to internet service providers.

In addition, although the OCHA allows for the issuance of Directions against various individuals/entities, the UKOSA does not prescribe such powers to the regulator Ofcom; enforcement against online services for breaches of UKOSA duties is limited to imposition of fines and the exercise of the power to request for information.[47] Finally, the UKOSA criminalizes certain acts that are linked to the risks of online gaming, such as the threat of sharing intimate photographs.[48] The OCHA does not criminalise such activities, and only provides powers to contain them.

B. Online Safety and Media Regulation Act of Ireland

The equivalent of the OCHA in Ireland is the Online Safety and Media Regulation Act (“OSMRA”). Like the OCHA, it was also introduced to regulate the effects of harmful online material, and applies to certain online services like information sharing services.

The OSMRA allows for the promulgation of binding Online Safety Codes which the relevant online service providers must adhere to.[49] Orders may also be made to enforce against non-compliance of these Online Safety Codes.

Information may also be requested under the OSMRA, but only from designated online service providers, and relating to the service provider’s compliance with the Online Safety Codes.[50] In comparison, information can be requested from any online service provider under the OCHA for information relating to online crimes.

The OSMRA allows for the issuance of Access Blocking Orders, which is substantially similar to the Access Blocking Direction.[51] However, an application must be made to the High Court for the order. No such application is needed for issuance of an Access Blocking Direction under the OCHA. The OSMRA’s Content Limitation Notice operates similarly to the OCHA’s Disabling Direction. It forces the online service provider to remove, disable or limit the availability of specified content.[52]

Finally, the OSMRA does not have the equivalent of the Stop Communication, Account Restriction and App Removal Directions.

C. Online Safety Act of Australia

The Australian Online Safety Act (“AUOSA”) applies to online service providers like online gaming services and internet service providers.[53] The AUOSA allows for the promulgation of the Basic Online Safety Expectations, which requires online service providers to have systems in place to reduce the risks of online harm.[54]

Like the OCHA, the AUOSA also allows for the request of information from online service providers, but only relating to information about its users.[55] The AUOSA also allows notices to be issued to online service providers and internet service providers requiring them to remove cyber-bullying material targeted at Australian children, and the intimate images of others. Notices can also be issued to users requiring them to remove, refrain from posting, and to apologise for publishing the material.[56] This is substantially like the Stop Communication, Disabling and Access Blocking Directions under the OCHA, although the scope of the powers under the AUOSA is more limited.

There are also App Removal Notices available under the AUOSA, but these are only available in certain situations like where the app facilitates the posting on social media of films which have been refused classification on the grounds that they contain material that is denigrating to racial or religious communities in Australia, and the social media platform operator service provider fails to comply with a notice to remove such films.[57]

V. Conclusion

Online gaming brings about a whole host of health and mental risks and safety issues that users may face. In the second part of this article, we will examine the cybersecurity risks that arise from and which are prevalent in online gaming, and the legal and regulatory framework in Singapore that is in place to deal with such risks.

AUTHOR INFORMATION:

Lau Kok Keng is a Partner and Head of the Intellectual Property, Sports and Gaming Practice at Rajah & Tann Singapore LLP.
Email: kok.keng.lau@rajahtann.com

Teoh Jun Li is a Trainee in the Intellectual Property, Sports and Gaming Practice at Rajah & Tann Singapore LLP.
Email: junli.teoh@rajahtann.com

REFERENCES

[1] https://explodingtopics.com/blog/number-of-gamers

[2] https://explodingtopics.com/blog/number-of-gamers

[3] https://www.statista.com/topics/1551/online-gaming/#topicOverview

[4] https://www.childrenssociety.org.uk/what-we-do/blogs/gaming-and-grooming

[5] https://www.unicef.org/eap/blog/child-sexual-exploitation-online-gaming#:~:text=The%20threat%20of%20grooming&text=Players%20often%20communicate%20via%20voice,increase%20the%20risk%20of%20grooming

[6] https://www.unicef.org/eap/blog/child-sexual-exploitation-online-gaming#:~:text=The%20threat%20of%20grooming&text=Players%20often%20communicate%20via%20voice,increase%20the%20risk%20of%20grooming

[7] https://www.theguardian.com/lifeandstyle/2016/jan/23/breck-bednar-murder-online-grooming-gaming-lorin-lafave

[8] https://www.nst.com.my/news/nation/2023/10/968030/study-it-takes-19-seconds-children-be-exposed-high-risk-grooming-social

[9] https://www.straitstimes.com/tech/singapore-s-first-youth-gaming-survey-17-feel-bullied-online-14-met-strangers-beyond-games

[10] S. Chandra Mohan and Lee Yingqi, ‘Sexual grooming as an offence in Singapore’ (2020) 32 Singapore Academy of Law Journal 96 at [5].

[11] Ibid at [58].

[12] Singapore Parliamentary Debates, Official Report (18 January 1931) Vol 60 at col 448 (Yeo Cheow Tong, Minister for Community Development).

[13] Supra note 10 at [37].

[14] https://getkidas.com/toxic-gaming-behavior-what-is-trolling/

[15] https://www.straitstimes.com/tech/singapore-s-first-youth-gaming-survey-17-feel-bullied-online-14-met-strangers-beyond-games

[16] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC8125715/

[17] https://www.nbcnews.com/news/us-news/texas-child-died-suicide-online-game-cyberbullying-authorities-said-rcna129247

[18] https://icd.who.int/browse/2024-01/mms/en#1448597234

[19]https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3905489/#:~:text=Various%20studies%20show%20that%20playing,too%20much%20excitement%20and%20stress

[20]https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9789564/#:~:text=24%20cases%20were%20found%3A%20one,played%20action%2Drich%20multiplayer%20games

[21] https://nypost.com/2019/11/05/teen-video-game-addict-dies-after-marathon-session-report/

[22] https://www.addictions.com/video-games/video-game-addiction-symptoms/#:~:text=Overspending%20on%20Video%20Games&text=Many%20adults%20who%20are%20addicted,there%20is%20a%20deeper%20problem

[23] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9737990/

[24] https://sensortower.com/blog/genshin-impact-revenue-first-five-months

[25] https://www.alliedgamingpc.com.au/news/AlliedGaming-CSGO-CounterStrike/

[26] https://www.channelnewsasia.com/cnainsider/spent-parents-money-mystery-loot-boxes-gaming-problem-gambling-2050696

[27] https://www.dexerto.com/counter-strike-2/most-expensive-cs2-csgo-skins-1340162/

[28] https://lordslibrary.parliament.uk/loot-boxes-in-computer-games-are-they-a-form-of-gambling/

[29] https://www.straitstimes.com/singapore/what-loot-boxes-in-video-games-are-and-why-they-can-be-as-addictive-as-gambling

[30] https://www.channelnewsasia.com/cnainsider/spent-parents-money-mystery-loot-boxes-gaming-problem-gambling-2050696

[31] https://www.rsph.org.uk/about-us/news/over-1-in-10-young-gamers-get-into-debt-because-of-loot-boxes.html

[32] Gambling Control (Remote Games of Chance – Class License) Order 22. Insofar as arcade and amusement centre gaming is concerned, with effect from 1 March 2024, the value of prizes given for such games must be less than S$100. No cash, cash equivalents, credit or merchant vouchers can be offered as prizes. The sale of prizes back to operators will also be prohibited: https://www.mha.gov.sg/mediaroom/press-releases/restrictions-on-prizes-for-games-offered-at-amusement-centres-and-fun-fairs/.

[33] https://www.channelnewsasia.com/cnainsider/spent-parents-money-mystery-loot-boxes-gaming-problem-gambling-2050696

[34] https://www.dlapiper.com/en/insights/topics/loot-boxes

[35] https://monolith.law/en/general-corporate/game-random-complete-illegal

[36] https://www.straitstimes.com/singapore/online-criminal-harms-act-to-kick-in-from-feb-1-with-special-provisions-for-scams#:~:text=SINGAPORE%20%2D%20The%20Online%20Criminal%20Harms,scams%20and%20malicious%20cyber%20activities

[37] https://www.mha.gov.sg/mediaroom/parliamentary/second-reading-of-the-online-criminal-harms-bill/

[38] Section 6 OCHA.

[39] Section 6(2) OCHA.

[40] Section S48 OCHA.

[41] https://apnews.com/article/gaming-business-children-00db669defcc8e0ca1fc2dc54120a0b8

[42] Section S21 OCHA.

[43] Section S23 OCHA.

[44] Section 24 OCHA.