Ethosphere

Identity, Privacy, and Anonymity in a Virtual Society

What is the smallest technological infrastructure needed to support a fully-formed virtual society? The Internet has seen a very rapid progression in which, first only documents mattered, then people, and now communities. We believe that the next logical step in the progression will be toward virtual societies -- communities with an associated decision framework, value system, economy, and perhaps even a political structure.

Premise and Assumptions

For the purposes of this thought experiment, we presume the existence of a network with certain characteristics. At this point, let's not get too caught up in how such features will be implemented or even if it is possible to implement them in a real computer network. Before these technical challenges are confronted, it is instructive to first think through the sociological challenges and implications of such a network. This network, which we will call Ethosphere, is like a MUD built to grow as large as the Internet. As in a MUD, people can log on to Ethosphere and assume one or more online personae. Unlike a MUD, there is no way for anyone to determine the true identity of the person behind a persona. It is also impossible for anyone to ascertain whether two personae actually belong to the same person in RL unless that person allows such a disclosure to occur. Let us refer to this fundamental characteristic of Ethosphere as the privacy directive.

Implications

Taken as an axiom of the system, the privacy directive leads to some interesting sociological and technical consequences which we examine below.

Privacy Through Multiplicity

Internet privacy is a big deal and will become an even bigger deal as web-based software to track clickstreams and collect personal information continues to become more effective. As an Internet user, I don't want web sites to be able to conspire to build and maintain a complete picture of my online activities. I want to be able to protect personal information about myself (e.g., credit card #, home address, business email, demographic info) from the prying eyes of web sites that I may casually visit. It would seem that Ethosphere would provide the ultimate in user privacy, since the privacy directive prevents a web site administrator (or anyone else) from discovering the true identity of a persona. However, this may not be enough. Suppose I always use the same persona, named @uncle_albert, within Ethosphere. During the day, @uncle_albert works as a trusted financial advisor, but he is also interested in hang gliding and, being a single person, occasionally hangs out in a singles-only online club. @uncle_albert also buys books from amazon.com, rents movies from netflix.com, and he owns a laptop he bought on ebay.com. It should be obvious that, by simply tracking @uncle_albert's interests and activities on the Internet, an observer could learn a great deal about the person who "owns" @uncle_albert in RL. The privacy directive would not allow disclosure of the person's real home address or age or gender, but it would still allow some pretty powerful inferences to be made regarding his or her lifestyle and buying habits. Within Ethosphere, this sort of inference-by-clickstream invasion of privacy could easily be thwarted by simply using many different personae. For example, if I create a new persona each time I log on to the network (assuming persona creation is cheap and easy), there would be no way for anyone to connect the behavior of one persona with any of the others, and each persona would therefore be completely anonymous. Unfortunately, this strategy would also make any kind of long term relationship, including business and commerce, impossible. Who would trust or choose to associate with an anonymous persona? Privacy is not the same as anonymity. It is necessary, it seems, for personae to have associated, recognizable characters or personalities that persist across logins. Nobody would trust financial advice from @uncle_albert (nor be willing to pay for it) without some kind of credentials or track record that indicates he knows what he's talking about. Moreover, if the system maintains that track record and provides it to clients or even competitors in the financial community, this doesn't really seem to raise any privacy concerns (even though it might be professionally harmful to @uncle_albert). If a client chooses to record some praise or criticism of Al's work, it seems fair to @uncle_albert and to other clients and potential clients that this bit of information be made available to them. On the other hand, if the system maintained and provided information about @uncle_albert's other interests, say hang gliding, to clients or competitors, this does seem to violate reasonable privacy expectations (even though it might not harm @uncle_albert in any way). There is a basic tension between maintaining a persona's privacy and its identity. It may be that the best compromise is to compartmentalize one's personality and create several personae, each one representing an independent aspect of the real person. If @uncle_albert is my financial advisor persona, then perhaps @buzz represents the hang glider enthusiast and @rex is the wild and crazy single guy. Each of these three personae might be individually known, recognized, and perhaps trusted in three separate socio-economic contexts, without compromising the privacy of any of them or their common owner.

Building Ethos out of Logos

Ethosphere then, in addition to preserving the privacy of the personae within it, should also be responsible for maintaining a sort of interaction history for them. Over time, this interaction history comes to represent the character or ethos of the individual persona (refer to Aristotle's theory of rhetoric). Importantly, a persona's ethos is not directly manipulable by the persona, but rather it is maintained by Ethosphere which also controls how it gets modified and by whom. We will refer to a persona and its ethos as a persona-character or PC. Lacking any connection with the real world credentials of a persona's owner, its ethos becomes an important factor in almost every interaction with other personae. Any trust relationships that evolve over the lifetime of a persona will be based on the persona's ethos. Whether or not @uncle_albert can find work as a financial advisor as well as how much he is able to charge for his advice all depend on how successful and honest he has been in past financial transactions with other persona. In many ways, a persona's ethos embodies and denotes its identity more so than say its screen name or UID. As in RL, one can imagine a persona changing its name to something completely different and yet still being recognizable solely by its ethos. So how does one initialize an ethos for a newly created persona? If I have a degree in finance, a CPA, a thriving practice as a stock analyst, and significant fiscal wealth in RL, how can I create my @uncle_albert persona and then imbue it with these qualities right off the bat? The answer is, I can't -- not within Ethosphere. The privacy directive prevents priming an ethos. Instead, a new PC is born without a history, without a pre-defined character, and without intrinsic value in the economic sense. It must be grown and developed as a consequence of many interactions with other PCs. A newborn @uncle_albert is no better suited to be a financial analyst in Ethosphere than a newborn @rex, at least not so far as other PCs can tell. My personal credentials, degrees, and wealth in the RL can't help @uncle_albert be successful within Ethosphere, although my knowledge and experience might. In this sense, Ethosphere is a pure meritocracy. In most MUDs, a new player is allowed to define her own sheet which defines the character's strengths and weaknesses. Initializing and modifying a character's sheet is usually done out-of-character and with the help/approval of a wizard or god. In Ethosphere, there are no wizards and thus the network itself must allow for modifications of an ethos as a side-effect of, or at least in conjunction with, interactions with other PCs. The ethos construct itself may consist of several components, each at a different level of detail. The most detailed component of a persona's ethos might be a complete log of all interactions involving that persona over its entire lifetime. To get a really complete picture of a PC, one could always read (or view or listen to) its entire life history, although of course this would be quite time consuming. At the next level of detail, the ethos construct might contain a collection of reference notes from other personae with whom that PC has interacted. Filing a reference for another PC would not be required for every interaction; it may be strictly voluntary or else required only for certain kinds of transactions. Finally, an ethos might contain a quick summary of a persona's characteristics in the form of numerical values associated with character traits. A common schema of traits would need to be devised to allow for quick comparison between PCs, and this schema would most likely include both areas of knowledge/expertise as well as less tangible traits like sensitivity, aggressiveness, or eroticism. MUD characters live within a world with a predefined fictional premise and they are born with a fictional personal history and background which becomes part of the character's ethos and guides the development of the his online personality. By contrast, Ethosphere has no predefined shared hallucination. Like the RL, it is simply a world whose history is the collective histories of all the PCs who have lived there. Ethosphere is a fictionless environment in which non-fictional characters have real interactions, conduct real business, form real socio-political structures, transfer real knowledge, and barter real services. In fact, Ethosphere is just as real as RL, albeit in a non-physical sense.

Economics Without Disclosure

Buying and selling goods and services within Ethosphere may seem like a tricky proposition given that the Privacy Directive prevents any connection with the currency and credit structures of RL. There is (currently) no way for a persona to have a credit card or a bank account because the banking institutions do not allow anonymous accounts to be set up. Interestingly, that's because the banks require a verifiable RL ethos including name, address, employer, and credit history in order to obtain credit. Moreover, the non-physicality of Ethosphere makes it impossible for tangible goods like books and bowling balls and flowers and food to be transferred between PCs. For example, a PC could never order a pizza without disclosing her RL name and address to the pizza delivery guy. Nevertheless, it is conceivable that a viable, even thriving, economy could exist entirely within Ethosphere. There are many products and services that have value without the necessity of physicality. Examples include information, advice, help, knowledge, entertainment, and (strangely enough) erotica. Significantly, the intrinsic value of each of these goods/services depends strongly on the strength of character of the creator/provider. For example, you would probably be willing to pay more for financial advice from @uncle_albert than from @rex the virtual bar hopper. The fundamental valuable resource, the gold standard of Ethosphere, is ethos itself. A barter economy based purely on ethos is possible. @uncle_albert might trade an analysis of telecom stocks for a month of tudoring in Algebra from a reputable teacher. However, such a barter economy would quickly become unwieldy in Ethosphere for the same reasons it doesn't scale well in RL. Eventually, a common ethos currency must be adopted that facilitates independent valuations of services (still based on the character of the service provider). The existance of ethos currency allows bartering transactions like the one above to be separated into two independent transactions. Ethos currency need not, and perhaps should not, work exactly like real money. In RL, there is a conservation law that governs currency transactions. If I pay you $1000 for an automobile, at the end of the transaction you have $1000 more and I have $1000 less. Inversely, I now own one more car and you own one fewer. In other words, currency/merchandise is neither created nor destroyed as a result of the transaction. (In the US economy, it is the job of the Fed to control the amount of currency in circulation.) The same thing is often true for the goods and services being bought/sold in RL. In Ethosphere, by contrast, goods and services are most often not conserved. For example, if I answer your technical question about how to set up a TCP/IP stack, you have more knowledge after the transaction but I don't have any less. Perhaps ethos currency should work the same way. That is to say, the law of conservation of currency need not apply to transactions within Ethosphere. One possibility in this regard is to add one additional element to a persona's ethos which represents "wealth". The value of the wealth attribute could be computed based on the values of all other attibutes, thus serving as a single, cumulative, quantitative assessment of a persona's ethos. With this mechanism, @uncle_albert's relative strength of character can easily be compared with @buzz's or @rex's ethostrength, even though all three personae have radically different areas of expertise. Of course, in order to compute a single number which represents ethostrength, one has to assign relative weights to the various types of skills and experiences one may acquire. It may be that knowledge/experience in a technical field is deemed "more valuable" that a similar level of knowledge/experience in the fine arts (or the reverse for a change!). It is reasonable to assume that these kinds of value judgements will be made at the societal level as they are in RL. In other words, the powers-that-be within Ethosphere will need to agree on a set of weights for the various skill types with which a linear combination of individual skill levels can be computed. Such a cumulative strength-of-character metric would yield a commercial currency that reflects the meritocratic nature of Ethosphere. However, transactions involving this ethos currency would not obey the law of conservation of currency. For example, if @buzz decides to purchase a training video on hang gliding the Grand Canyon, he would be able to do so only if his cumulative ethostrength (most of which is probably due to his hang gliding knowledge/experience) were sufficiently high so that he could afford the transaction. Having purchased the video, however, his personal wealth would not be diminished in any way. This may seem counter-intuitive because of our experience with RL commerce. If I buy something I will have less money as a result, right? But even in RL, a person's ability to create wealth may be more important than how much money he currently possesses. Donald Trump was able to borrow money and attract significant investment at a time when his personal wealth was at an all time low, simply because he had once been fabulously wealthy. Trump's strength of character had not diminished even though his bank account had. The act of engaging in a commercial transaction does not automatically decrease one's buying power in Ethosphere as it does in RL. In fact, such transactions may actually increase the buyer's wealth if they serve to increase her experience or knowledge in some area. As a corrolary to this, the Ethosphere economy does not require the existance of a central bank in order to control the amount of currency in circulation.

Wizardless Government

There is an inherent class structure in most MUDs. Some users have more power to control the virtual environment than other users, based in part on their knowledge and ability to write code, either in the MUD's built-in construction language or in native program code. It is inevitable that Ethosphere, being itself a software construction, will be plagued/blessed with the existence of these sorts of supervirtual entities, omnipotent beings who can change any rule, even the privacy directive, by modifying program code. As long as the privacy directive survives, however, there is no way for any persona to identify these supervirtuals or to determine which, if any, personae they might own. Another form of supervirtual that usually exists in a MUD is called a wizard. Wizards are ordinary personae who are endowed through some political process (e.g., democracy, appointment by a god) with the ability to step outside the fictional premise of the MUD and make changes to the story line, either in the future or the past. For example, if a persona decides to take some action within the story line that causes widespread change, say burn down a village or kill a primary character, others may appeal to a wizard to make a determination whether this action is constructive to the overall storyline and whether the action should be allowed to occur. In this way, wizards can preserve the rationality, continuity and internal consistency of the storyline. Although it is true that many wizards are also coders, this need not be the case. In Ethosphere, of course, there is no fictional storyline and, therefore, no reason to go out of character to decide issues of continuity, etc. Nevertheless, there will be instances where appeal to a higher authority is necessary to resolve issues of interpretation of the TOS, settle disputes among personae, modify the TOS or other established community rules, and impose sanctions and punishments upon TOS violators, including perhaps the persona death penalty. Choices for the exact nature, structure, and scope of power of such political bodies are as varied as political systems in RL. In fact, there need not be just one such system within Ethosphere. It is clear, however, that these activities could be carried out by ordinary personae. Unlike MUDs, it isn't necessary to have a distinct supervirtual race in Ethosphere in order to satisfy the requirement for a higher political and judicial authority. Given these assumptions, designers and coders of Ethosphere will face some very interesting moral and social dilemmas. For example, should every persona be empowered with the ability to kill another persona? Is it necessary/sufficient to be able to incarcerate or freeze a personae for some period of time? What rights and privileges should bots and other non-human personae have? Should bots be tagged in some way so they are easily distinguishable from "human" personae? Are all personae born with certain inalienable rights, or are rights and privileges (including perhaps the power to kill) based solely upon ethostrength, which is accumulated over time through social interaction? In short, Ethosphere will be a fascinating crucible in which personae will face many, if not most, of the moral and social questions that have challenged human beings since the beginning of time. The unique many-to-one relationship between personae and their human owners, however, will pose a number of fundamental dilemmas in Ethosphere that do not exist in the real world, at least not in exactly the same form.

Potential Vulnerabilities

Persona Slavery

One of the unspoken assumptions of social interaction in RL is that people behave in a coherent, consistent fashion. People who don't behave in this way are considered crazy or mentally diseased and they are generally ostracized socially or institutionalized. Discontinuous changes in personality are not the signs of a healthy mind. The same requirement is likely to be made of personae within Ethosphere. But what happens if a persona is transferred to another owner? We have already said that the fundamental thing of value in Ethosphere is ethos itself, and this value extends beyond the boundaries of the virtual universe. It is conceivable, even likely, that personae who have developed strong characters and valuable ethos over a long period of time will be bought and sold in RL. This persona slavery (admittedly a deliberately provocative term) might present a substantial problem within Ethosphere. Given the privacy directive, there is no way to prevent this from happening, nor even to detect if it does happen. Of course, the persona's personality will likely change, a little or a lot depending on the owners, and over time the persona's ethos will likely move in a different direction. As long as this personality shift is gradual and small, everything is fine. But if the change is rapid and noticeable, then great damage might be done to the societal structure -- especially if the transferred persona is a very powerful ethos. For example, suppose I sell my @uncle_albert persona to a brand new biz school graduate who wants to be an investment advisor. (This, incidentally, would be a RL transaction -- the new grad gives me cash, I give her a login and password or a private encryption key with which she may authenticate herself as @uncle_albert.) Within Ethosphere, clients of @uncle_albert might not notice the change of ownership, or might even start seeing their investments pay off even more than they did before the transfer. More likely, however, the clients would see an immediate, and perhaps devastating, decline in the value of their investments because @uncle_albert no longer seems to know what he's doing! Or worse, @uncle_albert might hold political office or possess the ability to kill other persona at his discretion, either of which would enable even more far-reaching damage to be done as a result of this discontinuous ethological shift. A less serious, though probably more common, version of this problem would occur when the owner of a persona simply stopped logging on to Ethosphere (maybe because he has died in RL!). If a very powerful persona suddenly becomes dormant for a long period of time, this could have a profound effect, positive or negative, on the others who depend or compete with the sleeping persona. Extended illnesses and vacations in RL might result in long sleeping spells for personae in Ethosphere. There will be a need for coroner personae to examine life signs, assess past history, and be able to declare persona death by such "natural causes," thus allowing unused resources to be returned to the Ethosphere for reuse. How serious is this anomaly? The answer is, it might not be as bad as it seems. In RL, corporations change ownership and control very often. A corporation is essentially a persona with its own ethos which participates on a par with human entities, at least in certain commercial environments. When a corporation undergoes a significant change of control, say a new board of directors is elected or an acquisition occurs, this often results in a visible change in the projected personality of the corporation, including perhaps its corporate identity or even its "screen name." Since a trust relationship exists between the corporation and its customers and partners, it is possible that the same sort of abrupt ethological shift could occur and cause significant financial damage to these dependent entities. This rarely happens however, because the new owners usually strive to preserve the value of the corporation after the transfer of ownership, and this includes the relationships and good will, in short the ethos, that have developed over the prior lifetime of the corporate entity. To be sure, there will need to be some mechanism for spotting and punishing (or at least localizing) aberrant behavior of personae within Ethosphere. The judicial and TOS-enforcement mechanisms will need to be able to take steps to arrest discontinuous behavior by transpossessed personae as quickly as possible. This disruptive behavior, and not the transfer of ownership per se, is likely to be illegal. Undoubtedly, some miscreants will occasionally do serious damage to Ethosphere's social or commercial structure by buying or otherwise appropriating a powerful persona and then using it to do evil. It is conceivable, however, that a sufficiently robust society could evolve such that this sort of damage, however serious, might not unravel the entire Ethosphere.

Persona Collusion and Sybil Attacks

Ordinary notions of voting and elections by plurality of individuals don't really work within Ethosphere. If I want a vote to go a certain way, I could just create a large number of personae and have them all act in collusion with one another to influence the election. The obvious way to avoid this problem is to require that personae "vote their ethos," so that stronger, more experienced personae have more electoral influence than younger, less experienced ones. The idea that some persona will have more influence than others within Ethosphere tends to raise some immediate concerns. Will this create a disenfranchised lower class of newborn personae? Is it elitist? The answer is yes, and no. A new persona's ethostrength is always initialized to zero, so it has no influence whatsoever. The persona can only gain ethostrength by participating in the society, presumably in a constructive way. So, with respect to voting and influence, it makes no sense to try to create a thousand newbie personae and have them all vote the same way — their cumulative influence is still zero. As we've already pointed out, the privacy directive makes it impossible to carry over reputation from RL in order to prime the ethostrength of a PC. Every persona you create will begin life in Ethospere as a newbie, irrespective of who your parents are in RL, how much money you may have in the bank, your title, position, age, or any other RL attribute. Therefore, while Ethospere may be elitist in the strict sense of the word, one's position in the society is not based on privilege or wealth, or even some artificial concept of "worthiness" based on class-biased testing. It is based solely on accomplishment within the context of the virtual society.

Accidental Disclosure

Even though the privacy directive prevents disclosure by Ethosphere itself, there are myriad ways in which a persona might give away information, accidentally or purposefully, which would identify the RL owner or reveal that two persona actually have the same owner. Is this bad? Not necessarily. It is commonplace among Mudders to reveal their true identities to certain other players. The key is, there is no global disclosure by the system itself. Obviously, if you're watching over my shoulder while I type a stock tip as @uncle_albert, I'm busted. As in Vernor Vinge's story, it is a distinct advantage for personae to strive to protect their true identities. In a way, the strength of a persona's ethos is diminished if its identity has been disclosed.

Glossary of Terms

Disclosure

Revealing information about one's true identity in RL.

Ethos

One of the three elements of the Aristotelian theory of rhetoric. Simply stated, ethos is persuasion by appeal to the rhetor's character. In this document, we also use the word to describe the character of an online persona.

God

A very special wizard in some MUDs. Usually, this is the owner of the MUD database and/or the physical machine hosting the MUD. A god has all the power of a wizard, and in addition may choose to take his toys and go home, thus terminating the MUD.

Logos

One of the three elements of the Aristotelian theory of rhetoric. Simply stated, logos is persuasion by appeal to logic.

MUD

Multi-User Dungeons or Mutli-User Domains. Here we use the term to refer to any various MUDs, Mushes, MOOs, etc. that involve multi-user, interactive role-playing.

Pathos

One of the three elements of the Aristotelian theory of rhetoric. Simply stated, pathos is persuasion by appeal to emotion.

Shorthand for Player Character in MUDs or Persona Character in Ethosphere.

Persona

An online representation of a person in Ethosphere. It is assumed that every persona has some distinguishing characteristic (e.g., unique id or public key) that never changes over the lifetime of the persona.

Persona Character

A persona and its associated ethos within Ethosphere.

Shorthand for Real Life.

Sheet

A collection of numerical values that define a player's influence and/or power in various, predefined areas within role-playing systems like MUDs and Mushes.

TOS

Wizard

A person who has special privileges within a MUD to make out-of-character changes, modify fictional history, rollback events, judge characters' activities, and generally do wizard-like stuff outside the fictional framework of the MUD.

created by: dutton on: 1999-02-01 last modified by: dutton on: 2011-06-11