Europol Warns Police to Prepare for Metaverse Threats

The European Union Agency for Law Enforcement Cooperation (Europol) has released a new report urging police chiefs and law enforcement agencies to prepare to face the challenges of law enforcement within the metaverse.

Europol researchers cite claims that the metaverse stands poised to become “next iteration of the internet.” As companies like Meta, the parent company of Facebook, Google, Microsoft and others invest in metaverse technology, and some estimates put 25% of people in some version of a metaverse service for at least an hour a day, Europol’s Innovation Lab’s report advises law enforcement agencies to build familiarity with metaverse technology and internet crime to prepare for a new frontier.

“[The metaverse] could potentially transform our lives just as the internet did,” Håkan Wall, National Operations Department Commissioner of the Swedish Police Authority said in a video announcing the report.

“Criminals will also use these new opportunities, so it’s vital for the police to anticipate these changes, understand the technology underpinning it and get ready to provide safety and security to citizens in these virtual environments.

In June 2022, the Europol Innovation Lab hosted academics, experts and over 120 representatives from law enforcement agencies from across Europe to discuss the metaverse, including representatives from Meta itself. Attendees participated in a series of “foresight exercises,” raising concerns about potential safety and enforcement issues within the metaverse space and playing out potential scenarios.

“I believe it is important for police to anticipate changes to the reality in which they have to provide safety and security,” Catherine De Bolle, executive director of Europol, wrote in a dedication for the report.

“The metaverse will bring about new ways of interacting and whole new virtual worlds to live in, potentially transforming our lives, just as the internet has done in the last three decades.”

“Keeping in mind that historically law enforcement was generally slower in developing capabilities for digitally committed crimes, we should as soon as possible begin preparing for the emergence of the metaverse from a law enforcement perspective,” report authors warn.

New technology offers new avenues of attack and exploitation for potential criminals, “making it all the more important,” Europol’s report reads, “to call for safety by design” as metaverse worlds and services are developed and launched.

Researchers and law enforcement can’t be certain exactly how crimes native to the metaverse might play out, but they can look to our current digital spaces. The report flags phishing—like the massive phishing operations imitating Robolox, a kind of metaverse gaming platform aimed predominantly at children—and ransomware style attacks that lock devices or services until a victim pays a ransom or surrenders something.

That kind of attack may be even more effective in the metaverse space, and confounding to current law enforcement efforts, since metaverse platforms mix digital and real life assets and currencies. This potential for this kind of crime within the scope of the planned metaverse mean that anti-money laundering (AML) and know your customer (KYC) protections may play an important role.

Challenges for Law Enforcement 

The report flagged a number of challenges for investigations into and enforcement against crimes online in the metaverse, raised by participants in Europol’s police chief meeting.

• • With an uncountable number of future metaverse services, platforms and worlds, it will be impossible to police them all equally, especially with limited resources.
  • Monitoring and moderating online content and behavior will be harder in the metaverse and more broad.
  • Interactions may be fleeting and may not be recorded in the same way they often are in other internet spaces (like post histories on social media), leaving no trace of an incident for police to review.
  • Different people may experience the same incident through separate ‘realities,’ with their own settings in a metaverse space making their version of a story completely different than another person who experienced the same thing.
  • As interactions move into the metaverse, law enforcement may further lose the location of users and of criminals, making it harder to pin down offenders and the criminal and law enforcement infrastructure at play wherever those people are in the world.

The report goes on to explain a handful of potential attacks that might be used in XR situations, or when the metaverse meets real world technology and interfaces, creating a potentially new category of cybercrime where participants and victims may be in the metaverse or on the street or in the office in the real world.

Law enforcement can read short descriptions of attacks like the human joystick attack, overlay attack, and chaperone attack that exploit both the physical and virtual environment, in Europol’s report.

Europol’s Innovation Lab urges law enforcement and legislators to get ahead of the wave of metaverse technology before it becomes ubiquitous.

“Legislating for new technology is often compared to driving a car only using the rear view mirror,” report authors argue. “It is often done in retrospect, and by that time new dangers are ahead of you, it is too late.”

Law enforcement agencies in particular can try and get ahead by gaining experience and training with current and emerging technology, learning the risks associated with developing technology and how law enforcement can help before its userbase grows large enough to create a serious criminal risk.

Agencies should work to establish online presences in virtual worlds and use current services to build online policing skills that will better set them up for potential changes to how the public and the criminal element interact with emerging technology.

Police can also gain valuable experience through current investigations into blockchain and NFT-related crimes, technology that plays a big role in the foundations of current metaverse development.

“[The Policing the Metaverse report] helps national law enforcement agencies such as Swedish police to make sense of these developments and be prepared for the future,” Commissioner Wall said. “It will help police chiefs to begin to grasp this new world in order to adapt and prepare for policing in the metaverse.”

Read the full report here.

 Audrey Nielsen is a TCR contributor