This article first appeared in Digital Edge, The Edge Malaysia Weekly on January 9, 2023 - January 15, 2023

During a visit to Horizon Venues, a Meta (formerly Facebook) version of the metaverse, 43-year-old Nina Jane Patel’s avatar was attacked by three male avatars. Her virtual self was sexually assaulted and gang-raped.

Just because the assault occurred virtually, it is by no means less threatening, says Trang Le, a PhD candidate and teaching associate from Monash University’s Communication and Media Studies department. Lee, in her paper “Sexual assault in the metaverse is part of a bigger problem that technology alone won’t solve”, states that sexual assaults in the metaverse are intense and traumatising due to the immersive nature of haptic technologies, which make it feel like a physical experience.

Patel’s horrifying experience is one of the many crimes happening in the metaverse, which include identity theft and doxing. In light of this, law enforcement has started to train on ways to protect the virtual realm from assailants.

Last October, the International Criminal Police Organisation (Interpol) launched the global police metaverse as part of its effort to train members to police the digital realm. But the call for surveillance has drawn brickbats, with opponents arguing that this act undermines the metaverse’s sovereignty and that it should be ungoverned and decentralised.

What is the alternative if surveillance is not an option? Digital Edge speaks to Puteri Sofia Amirnuddin, senior law lecturer and programme director for Master of Laws programmes and the co-director of Taylor’s University’s VORTEX XR Lab (Advocacy & Research) on the ways to enforce the law in the metaverse and protect users from falling victim to cybercrimes.

The metaverse virtual experience differs from internet search engine activities in that users will appear as digital avatars rather than browsing from a flat screen. It opens a whole new world of infinite possibilities in an unregulated territory.

Digital avatars provide a level of anonymity to individuals that can lead to undesirable cybercrimes in the metaverse. These include information theft, spreading computer viruses, sending pornographic materials, hacking, harassment, cyberbullying, cyberstalking and many others.

Cybercrimes in the metaverse can be divided into three categories: against individuals, property and the government.

Cybercrimes against individuals include cyber harassment, the distribution of child pornography, criminal intimidation, criminal conspiracy and identity theft.

Meanwhile, cybercrimes against property cover copyright infringements, virus transmission, hacking and any crime against a computer or server.

Cybercrimes against the government in the metaverse occurs through cyberwarfare and cyberterrorism.

There is no single, omnibus legislation that governs activities in cyberspace in Malaysia, but we are fortunate to have a 

wide range of laws that confer protection on users who are involved in cyberspace and electronic-related activities.

These legislations include the Penal Code, Copyright (Amendment) Act 1997, Computer Crimes Act 1997, Digital Signature Act 1997, Telemedicine Act 1997, Communications and Multimedia Act 1998, Electronic Commerce Act 2006, Electronic Government Activities Act 2007 and Personal Data Protection Act 2010.

Since the metaverse is a concept that is continuously evolving, it is difficult to measure the level of protection accorded to metaverse users. It depends on the nature of the cybercrime and the investigators’ ability to obtain access to data or records of cybercrimes. Cybercrime investigators will also need to acquire skills and technical capabilities to interpret data if it involves programming languages.

There may also be operational difficulties with cybercrime investigation in the metaverse if international cooperation is required in the event the crime occurs outside of our borders.

a. In your opinion, is it necessary for Malaysia to have specific laws to govern the metaverse?

There are suggestions for specific meta-laws or meta-courts to be established but more research and discussion between various stakeholders need to be held to determine the comprehensiveness of specific laws or courts to resolve issues arising in the metaverse.

It is worth noting that such initiatives, though welcomed, can be extremely complex and exceptionally lengthy, given the revolutionary nature of the metaverse.

Firstly, it depends on how the metaverse is being defined. Currently, there is no single authoritative definition of the metaverse. Metaverse is a complex term and its elements are not limited to virtual reality platforms.

If the metaverse is to be considered as the internet (given the fact that you need to have access to the internet to join the metaverse), then there are many legal precedents that have been applied.

As an example, in Singapore, the General Division of the High Court of Singapore recently delivered a landmark decision in the case of CLM v CLN & Ors [2022] SGHC 46 in relation to stolen cryptocurrency assets. The stolen cryptocurrency assets did not transpire on metaverse platforms such as Horizon Worlds, Second Life or Decentraland but through online websites. In these instances, the offence of stealing cryptocurrency assets has also been considered to be applying the law in the metaverse.

The existing laws were enacted with the aim of protecting real, living people and are not meant for avatars, software codes or artificial intelligence beings.

There are multiple issues that need to be addressed prior to determining the punishment for a particular offence that has been committed in the metaverse, which include the weightage of avatar rights and its characteristics.

In circumstances where it is found that an avatar has committed a tortious offence by assaulting another avatar, there may be virtual punishments such as banning or restricting the avatar user’s account and IP address.

As the metaverse is distinct from the real world, it can be challenging to embody all 30 principles of basic human rights.

Some possible basic rights that a metaverse user can exercise include the right to privacy; the right to treat others with conscience, dignity and common decency; and the right to security. The list of basic rights should be featured on the account registration page and also in the Terms of Use, Terms and Conditions or Terms of Service section.

a. If an unfortunate metaverse user were to fall victim to any crime in the metaverse, what action could be taken?

In circumstances where a metaverse user falls victim to a cybercrime, it is advisable for the user to lodge a report with the creator of the metaverse platform.

Meta, for instance, has a clause in its Supplemental Meta Platforms Technologies Terms of Service that encourages its users to promptly lodge a report for any conduct or content that they believe has violated their rights or Meta’s terms or policies.

Meta will then investigate the alleged offence and take appropriate action, such as limiting, suspending or terminating access, prohibiting the offender from creating another account, or even referring the offender to law enforcement.

Police reports play a pivotal and crucial role in the area of criminal law and the commission of cybercrimes. This is a right afforded under Section 107 of the Criminal Procedure Code (CPC). The general powers to conduct an investigation are provided in the CPC but there are no specific provisions to investigate cases of cybercrime in the CPC.

Hence, a cross-reference will need to be made to other legislation such as the Computer Crime Act 1997 or the Communication and Multimedia Act 1998 regarding the investigation procedure. If the victim suffers financial loss due to a financial scam, he can also lodge a report with relevant enforcement agencies such as the Malaysian Communications and Multimedia Commission (MCMC) or Bank Negara Malaysia.

Since cybercrime is a transnational crime, the perpetrators and the victims can be located anywhere in the world with an internet connection. Given that there are no geographic boundaries and no clear demarcation of territories in the metaverse, the location cannot be used to determine jurisdiction. Hence, it depends on various factors such as the types of cybercrimes and the legislation that applies.

For cybercrimes that fall under the ambit of the Computer Crimes Act 1997 (CCA), Section 9 provides that the provisions of the CCA shall have an effect within and outside Malaysia, as if the offence was committed at any place within Malaysia regardless of the nationality or citizenship of the individuals.

The next issue to determine is how to evaluate the jurisdiction of the metaverse since it is a virtual realm. Section 4(3) of the Communications and Multimedia Act 1998 highlights the term “place” to include the atmosphere. How do we determine what can be considered the atmosphere? Do we determine the atmosphere through the location of the server that hosts the metaverse? What happens if there are multiple servers located in multiple jurisdictions?

The metaverse is bursting with exciting potential but users need to be reminded that life and crime in the metaverse will be exactly the same as in the physical world. As a result, my advice to metaverse users is to be vigilant and cautious of any interactions in the metaverse, as there are no current laws to protect everyone.

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.