IEEE Technology and Society Magazine - June 2018 - 56

autonomously so that observers get confused and may
not be able to tell which avatar is under the control of
the actual human user. When clones are initiated the
user may specify which behaviors are preferred for
which subset of clones using command semantics such
as: a) "assign all clones a behavior that has high randomness and high interaction levels," b) "assign half of
the clones the behavior named 'walk around a house'
and the other half of the clones the behavior named
'walk in circles.'" Behaviors may have additional configurable characteristics (e.g., the circles to be traced out
might be 5 meters or 10 meters in diameter and/or
might be centered on a specific location or on a specified object) and require specification of metadata such
as: number of clones to spawn, duration of plan, spatial
configuration, and more. Typically, a clone might closely
resemble the user's avatar, but in principle, variants on
clone rendition might include those that vary visually
(and randomly) from each other (e.g., all wearing different colored virtual shirts or hairstyles). Each clone
implements its behavior by performing in the metaverse, after which the plan terminates.
Figure 1 illustrates this paradigm in simplified form.
Figure 1 (top panel) shows a stylized view of the metaverse in which our hero (avatar B) is near her virtual
home. Two other avatars are very near to B, but B would
like increased privacy from them. In Figure 1 (middle
panel) B chooses, configures and launches the "cloud of
clones" privacy plan. In Figure 1 (bottom panel) the plan
executes, during which time the real B avatar eludes
detection from A and C.
From an in-metaverse observer point of view (say
Avatar A or C in Figure 1) the sudden emergence of a

group of nearly identical avatars to the user (B in the figure) will create confusion. Importantly, the group contains the user B whose intent is to carry on with her
actions without harassment.
It is desired that the sudden appearance and subsequent dispersal of these clones will cause any observers
to lose track of the original "copy." During this time
observers may be doing their best to track and analyze
the behavior of B, but they would be forced to track all
clones of B as well. To this end, the collective behavior
of B and its clones is not as interesting when averaged
out and it cannot be clear which behavior really typifies
B's desires.
There are potential limitations to this approach which
we continue to explore. For example, we presume that
other nearby avatars cannot create a defense so as to
disallow the creation of new clones, or that other avatars cannot (easily) use a method of locking in on a
particular avatar (the original B) and tracking it programmatically. This latter possibility could undermine
the sudden attempt at partial anonymity. To succeed
over in-metaverse observers who may be identifying and
tracking Avatar B in their viewports (the view of the
metaverse seen from their avatar) the user might temporarily escape into an area in which observers cannot see
him (e.g., a building or room) and execute the "clone"
plan from there. So long as the observer does not gain
visual access again before the clones are created the
plan should be able to provide anonymity as desired. We
note here that whether or not another agent could identify a clone by detecting pseudo-random behavior is an
open issue. Finally, creating huge numbers of clones has
effects on both performance and deployment that we do
not pursue further here.

Plan B - "Private Copy"

Figure 1. A privacy plan (involving clones) playing out over

time.
56

While the previous section proposes techniques to confuse surveilling avatars or bots, an alternative provides
the user with a truly private space where surveillance
cannot occur. In the current section, we discuss a class
of privacy preserving plans which we call "Private
Copy." In these plans, the user is able to request that a
private copy of some part of the virtual world be created for the temporary exclusive use of that user. The corresponding portion of the metaverse in the main fabric
continues to exist in parallel and other users and avatars may continue to use the main fabric portion
unaffected by the actions of the user in the temporary
Private Copy. For example, consider a user who desires
a private virtual shopping experience. The user may
request a Private Copy of a virtual store or even a portion of a virtual store (e.g., a particular department). For
example, the store or department may sell personal
items for which the user does not want to be observed

IEEE Technology and Society Magazine

∕

JUNE 2018

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - June 2018