On this month's Let’s Talk, Victoria and Andrew dive into the Twitch security breach and the privacy implications of Facebook attempting to build out the metaverse (a 3D virtual space where people interact with each other as avatars in a real-world space) when it seems they, and other Big Tech companies, have little concern with people’s private information. The two take some time to discuss the importance of these events for arts organizations.
Victoria Sprowls 0:01
Welcome to the Let's Talk series of Tech in the Arts, the podcast for the Arts Management and Technology Lab. My name is Victoria Sprowls, the podcast producer,
Andrew Wolverton 0:10
and I'm Andrew Wolverton the technology and interactive content manager.
Victoria Sprowls 0:14
Each month we review trending stories and topics such as streaming, artificial intelligence, sustainability, social media, inclusion, and much more. Our goal is to exchange ideas, bring awareness and stay on top of the trends. In this episode, we will be discussing the Twitch security breach, Facebook attempting to build out the metaverse and how those could affect arts groups and administrators in the future. Andrew, why don't you get started by sharing about the Twitch security breach.
Andrew Wolverton 0:41
Thanks, Victoria. Yeah, so on October 6th, Twitch revealed that due to an error in their server configuration changes that there was an alleged hacker that leaked sensitive information. And from that information, we were able to see 125 gigabytes worth of data, including three years worth of details regarding creator payouts on Twitch, the entirety of Twitch.tv's commit history going back to its early beginnings, source code for the mobile desktop and video game console for the Twitch clients, code related to proprietary software development kits and internal Amazon Web Services used by Twitch, an unreleased Steam competitor from Amazon game studios data on other twitch proprietaries Like IGDB, and CurseForge and Twitch's internal security tools. So while this was a major hack, fortunately, Twitch has confirmed that while the breach was expansive, and they're working urgently to understand the extent of this - Twitch did update us last week that no passwords, login credentials, or credit card numbers and bank details were exposed in this breach. So it seems that this breach was focused more on how Twitch functions and what their internal source coding looks like. And so we're really not sure and Twitch has not released their findings as to why this breach happened.
Victoria Sprowls 2:10
Right. So it seems like, you know, it's, I'm not even that worried about my passwords anymore, because it seems like they just do get stolen all the time. But at least you know, this time they weren't.
Andrew Wolverton 2:22
Yeah, and Twitch, Twitch did recommend for everybody to change their stream keys, and for just all users to change their passwords just out of an abundance of caution. But again, Twitch did confirm that none of this personal and sensitive information was leaked. And so The Verge - they spoke to multiple sources at Twitch talking about this breach, and they revealed that this isn't the first time Twitch has been hacked, and their information has been breached. So Verge has reported that back in August, Twitch was hit with these bots spamming hate speech across Twitch chat. And the source is claiming, from Twitch, that these raids were internally discussed as being this vector for harassment, just by virtue of their name alone, and that the team had a rush to secure the feature before it went live. And so the source is characterizing Twitch as this place of foremost concern with their bottom line, and that if it wasn't generating revenue, whatever decisions that they're making, then it wasn't really valued as highly. And so, in fact, we've seen hate speech across Twitch for quite some time, but it really hit back in August. So the source that, at Twitch that Verge has been talking to, they reveal that this isn't the first time that Twitch has actually been hacked and issues that they've had with bots and scammers. So in 2017, there were these alleged scammers that were able to contact streamers requesting their revenue sharing from Twitch Prime subscription, and the source is claiming that it led to Twitch accounts being connected to compromised Amazon accounts. And while Twitch had to respond to this, there wasn't much done on the end for the streamers and the consumers. And so there was this notion of lip service versus action. These hacks continued even further back in 2014. In 2014, there were two unreported hacks and breaches at Twitch which they were forced to rebuild their source code. In fact, Twitch didn't even know about this hack until eight months after it had started.
Victoria Sprowls 4:37
Wow.
Andrew Wolverton 4:38
And this kind of goes into looking at you know, the dysfunction that is happening in the back offices of Twitch - and Twitch, they have more than 30 million average daily visitors currently. And so this, this is a widespread industry in which there's some major security breaches happening. This is an ongoing report here, and so I urge our listeners who are wanting to keep up with this to go to Twitch's blog where they're constantly updating what the status is for this latest breach, and we'll be sure to link that for our listeners down below. So, Victoria, I guess what comes to mind with this, in sort of looking at some of these other breaches that are happening and the integrity of technology that we use every day, I'm I guess I'm wondering, you know, what, what is being done to help prevent this, but also what is being done to protect us as users and consumers of this technology?
Victoria Sprowls 5:47
Right. So According to TechCrunch, you know, tech giants like Apple, Google and Microsoft have pledged billions to bolster U.S. cybersecurity following a meeting with President Joe Biden at the White House. Apple's vowed to establish a new program to drive continuous security improvements, Google said it will invest more than 10 billion over the next five years to expand zero trust programs. Microsoft said it's committing 20 billion to integrate cybersecurity by design, and to deliver advanced security solutions. However, there are currently almost 500,000 cybersecurity jobs across the U.S. that remain unfilled. And many note that the vacant cybersecurity jobs the U.S. is looking to fell fall behind on competitive salaries, and few if any benefits.
Andrew Wolverton 6:35
This seems like this isn't an issue that only Twitch is having, that our own government cannot secure enough positions to be filled for cybersecurity. And it is quite alarming that, one, our own government is seeking 500 positions. That is a-
Victoria Sprowls 6:58
500,000 positions.
Andrew Wolverton 6:59
Oh, I'm sorry. 500,000.
Victoria Sprowls 7:01
Yes.
Andrew Wolverton 7:03
500,000 positions, that that tells you the magnitude of the issue of cybersecurity. And, honestly, how vulnerable we very well may be.
Victoria Sprowls 7:18
Right, and I think it goes into what you were saying about how, you know, this source inside of Twitch was saying that if you know, it wasn't good for the company's bottom line, or if it didn't increase profits, it was - the company wasn't going to focus on it. And I think that we are finding that across several different big tech entities at the moment, including Facebook,
Andrew Wolverton 7:40
This sort of hush hush under the rug just right. Well, we'll take care of it. Don't you worry about it.
Victoria Sprowls 7:46
Yeah, it's it's kind of like a we've got you covered. But you know, when you peek under the, under the rug to see how they've got you covered, what you see is a gaping hole.
Andrew Wolverton 7:58
Yeah. And I think you're about to, you're talking about Facebook there and what's happening, and we're not necessarily seeing data breaches with Facebook. But we are seeing a lack of security and protection for its users. And, as I'm sure many of our listeners have seen some of the accusations and data that has been put out from its whistleblower.
Victoria Sprowls 8:22
Right. And I think that it's only going to become a more prevalent issue in the coming years with the build-out of the metaverse.
Andrew Wolverton 8:34
Oooh, the metaverse.
Victoria Sprowls 8:36
Yes, a phrase that, you know, I feel like no one spoke about for 20 years, and then all of a sudden in the past month, everyone's like, Oh, the metaverse the metaverse,
Andrew Wolverton 8:45
I've seen a lot about this recently and the way it was described to me is if you were to combine, you know, the avatars that we have, in let's say, an online gaming system like Fortnite for example.
Victoria Sprowls 9:03
Right.
Andrew Wolverton 9:03
For those of you who may have kids that play Fortnite, you know, having an avatar but one that can actually be transferred and can move about to different platforms is how is how I've been understanding this metaverse.
Victoria Sprowls 9:17
It's a little like The Matrix meets Ready Player One if you've seen either of those films.
Andrew Wolverton 9:21
Yes.
Victoria Sprowls 9:22
Humans, as avatars, interact with each other in a three-dimensional virtual space that uses the real world as a template - and that's from the Neal Stephenson 1992 sci-fi novel, "Snow Crash."
Andrew Wolverton 9:35
Yeah
Victoria Sprowls 9:36
Decades before his, you know, he was a genius.
Andrew Wolverton 9:40
You're absolutely right. It does. It does almost seem like it is a movie. But this is emerging technology that we are willing to put ourselves in, when which you can only imagine the amount of personal information that we would be giving to put ourselves into this so called metaverse.
Victoria Sprowls 10:00
Yes, exactly.
Andrew Wolverton 10:01
How vulnerable would we be making ourselves? I think that is a question that we need to be very careful and cautious about, especially if Facebook is trying to be a leader into this Metaverse, and we're already seeing issues from them not being able to protect their own consumers,
Victoria Sprowls 10:23
Right. I'm going to talk a little bit about the pros first because I don't want to I don't want to just, you know, drag the metaverse.
Andrew Wolverton 10:31
No, of course not.
Victoria Sprowls 10:33
On the one hand, you know, Facebook is obviously striving to make the metaverse the future of its platform. And its first step in that direction seems to be what I have termed "pulling a Google," by creating a parent company akin to what Alphabet is to Google. The new parent company name is definitely an attempt to disassociate Facebook's myriad of different products that have bad press associated with the Facebook name at the moment. And that new parent company name will be released on or before the company's annual Connect conference on October 28. I can't wait to see what they come up with.
Andrew Wolverton 11:13
So that that will be that that is a week from today when we're recording this. So yes, if there is an update to that, we will be sure to link that and put a little update in the description down below
Victoria Sprowls 11:25
Put it in the notes. Some of the pros - for one thing after a year and a half we've experienced I think people would jump at the chance to lessen the spread of viral illnesses. You know, kind of like doing things over zoom, but in a more immersive kind of experience. If you could imagine meeting with someone virtually, in person, like virtually in person instead of just virtually on a computer screen.
Andrew Wolverton 11:49
Right.
Victoria Sprowls 11:49
Another potential along with practical reasons for online interactions, like you know, maybe trying on clothes in a virtual store, so you don't have to waste all that shipping and the environmental impact of that.
Andrew Wolverton 12:03
So is the metaverse saying that we would have an image of our entire selves that would be able to be seen in the metaverse? This is not just like an avatar where I'm creating this completely different looking being, but this is an image and projection of myself?
Victoria Sprowls 12:22
I mean, I think it's I think there are merits to either I imagine if you are creating your avatar, you could create it to look like whatever you wanted. But if you did want to try on clothes in a virtual store, it would be nice to have your actual measurements. Some other areas, the metaverse would open up space for NFT artists to... Yeah, NFT's. Not only sell their work, but capitalize on the intellectual property through virtual experiences in the metaverse, CAA and UTA, some of the largest talent agencies in America recently signed multiple NFT artists. And by signing these artists, they're hoping to move toward IP licensing that will create new sources of revenue for both NFT collectors and artists. There are also many potential ways for arts organizations to profit off of a space in the metaverse imagine paying to see that exhibit in Beijing or Reykjavik, without actually having to travel there. So you know, you save on potentially all of that international travel, and you get to see the exhibit virtually.
Andrew Wolverton 13:29
interesting. I guess I never thought of visiting a country virtually instead of in person. I would imagine that there are definitely people out there who would take up that experience. And if you think about folks who do not have the opportunity and or resources to travel abroad, as expensive as it can be. I do think that there as you said, there are some merits to this, and how opening up access to different experiences.
Victoria Sprowls 14:02
Right. And, you know, along with some of the equity that would come with the metaverse for the first time in history, you could pay to be on stage with the orchestra as they perform looking at the intricacies of their movements.
Andrew Wolverton 14:17
Interesting.
Victoria Sprowls 14:18
It gets a little it gets a little out there. Yeah, you have to really conceptualize it.
Andrew Wolverton 14:21
Right.
Victoria Sprowls 14:22
It's difficult from a, you know, non-metaverse point of view - you have to really put yourself in the in the metaverse.
Andrew Wolverton 14:27
Right. So this is this is more than having those 3-D experiences that that we can currently do online but it is we are this is using like a VR headset?
Victoria Sprowls 14:41
Right. So obviously I'm sure Facebook would love for it to be the Oculus headset since Facebook owns Oculus, keeping that all in the family. You would get haptic gear as well. I mean it is really it sounds really movie-like but I, I think it is the future. So with some of that equity, you know, we've seen ways that working from home. Working inside the metaverse opens up jobs to people who traditionally wouldn't be able to move to a certain location to land that job. But there are cons associated with working from home that we addressed in a podcast episode earlier this year. A lot of us are experiencing the neverending grind that comes with work from home setups, and serious concerns about work-life balance that I'm sure the metaverse would only intensify.
Andrew Wolverton 15:32
Right? And not even, I mean, even more so the ethical concerns...
Victoria Sprowls 15:37
Right.
Andrew Wolverton 15:37
...that are involved, and the privacy concerns when it comes to using something this immersive with our lives, you know, with with everyday life in person, we we have a little bit more control over who who gets what of our information. Where, with this metaverse, it sounds as if we are - we're really putting a lot of our personal information and our our our bodies, in a sense, online here and so how do we ensure that Facebook can be ethical with this, given the recent concerns?
Victoria Sprowls 16:17
Yeah, let's get into that after a brief break.
Andrew Wolverton 16:19
Stay tuned for the second half of the podcast after this brief intermission. So Victoria, before the break, I was asking, how can we ensure that Facebook is going to take our privacy seriously?
Victoria Sprowls 16:46
So that's where we come up against, you know, with great power comes great responsibility. You know, a concern is what the makeup of the metaverse would look like. Dr. David Leslie, ethics theme lead at the Alan Turing Institute in London, has voiced concerns over the risk that “…in terms of socioeconomic, gender, and ethnic makeup, the populace of the metaverse could be imbalanced. We don't live in a time where there's equitable access to the sorts of infrastructure that one would need to engage in these technologies.” And he argues the metaverse should be held off until tech companies find a way of addressing those kinds of inequities. Especially considering the large monetary hurdle people will surely have to jump, especially in the early years, in order to be a part of the metaverse. Considering, as we said, all the expensive wearable tech that will inevitably be involved. So while Zuckerberg has pledged that Facebook will invest $50 million over the course of two years, to collaborate with industry partners, civil rights groups, government, nonprofits and academic institutions, to determine how to build the technologies for the metaverse responsibly, that is really a drop in the bucket for a company that made almost $30 billion from ad revenue in 2019. So this is where it does come back to that lip service of you know, we say that we want to do things ethically, we're going to be responsible, we're going to ensure your privacy. And you know, we'll throw out a figure that seems really large - $50 million. I mean, wow, it is really large. I would love to have $50 million.
Andrew Wolverton 18:22
Yes.
Victoria Sprowls 18:23
But compare that to the $30 billion that they made from ad revenue alone. I mean, it it, it's just not looking up to par.
Andrew Wolverton 18:32
Right. And so I guess why should we trust a company? That, that is repeatedly showing the same actions of distressed
Victoria Sprowls 18:40
Right, so what I think Zuckerberg might have, you know, incorrectly assumed was that his push for Facebook to become a metaverse would draw attention away from the current crises Facebook's undergoing, you know, "Ohh look a shiny, ashiny new toy!
Andrew Wolverton 18:58
Sure.
Victoria Sprowls 18:58
But if anything, it's only shone a bright light on the issues of personal privacy, marketplace competition, and the misinformation running rampant through Facebook today. You're right that the creation of a metaverse will only allow for the collection of even greater amounts of personal user data that Facebook can use to monetize at the expense of its users. Which, if the metaverse comes to fruition, could be the majority of internet users in the world. I mean, I think that adaptation to the metaverse will eventually be huge, just like adaptation to the internet adoption of the internet.
Andrew Wolverton 19:33
Yeah, and I mean, it is difficult for me to say personally that I would not want to try that and get involved in that. And I, I think from something that we've learned over this last 20 years of social media booming is that they have become really good at understanding the human psyche - of how we work, how we think and what we want, and making sure that we come back to it. I think, a question that has been posed to me many times is that, "Would I ever consider deleting my Facebook? Would I ever delete, consider deleting social media?
Victoria Sprowls 20:09
Right. And would you?
Andrew Wolverton 20:13
You know, I don't think that I have that willpower, at the moment, because I enjoy the connectivity.
Victoria Sprowls 20:20
Right. And and it's worth noting that Facebook is not the only company trying to build out the metaverse or to create their own world inside a universal metaverse. But they're the loudest at the moment. And they are, as you said, the best at at tapping into your psyche and getting you to to want to try it. And once you try to want to come back.
Andrew Wolverton 20:40
Right, you know, I, I always think well, how did people survive before social media, and I'm sure there's a way we can get by but as you mentioned, it is a shiny new toy. And I think it really, as we talked about, it puts puts responsibility on these big tech giants to start being accountable for what they're doing. There's an article in Newsweek talking about big tech giants like Google and Facebook, and sort of they view themselves as key assets for the American economy. And that, you know, there has been a this attempt to shift the focus of lawmakers and regulators on America's biggest economic and political rival China. And so big tech monopolists, they are arguing that this is, this is a zero sum game: breaking up big tech will only strengthen Chinese companies. So therefore, you know, America needs these big tech corporations in order to be competitive internationally.
Victoria Sprowls 21:44
Right, so it's almost like, well, if Facebook doesn't - if an American company like Facebook doesn't do it first, maybe you know, a company from another country will, and then they will get all of the money associated...
Andrew Wolverton 21:55
Right. Right. Yeah. So it they're they're really framing this as economic competition in order to sway lawmakers to side with them and to not engage in antitrust lawsuits.
Victoria Sprowls 22:09
Right to say, "Well, don't you want the economic advantages that would come with this kind of a new product?"
Andrew Wolverton 22:17
Right, right. So where does this leave us with cybersecurity?
Victoria Sprowls 22:21
So the issue seems to be that people, the consumer, values cybersecurity, and it will become increasingly important as the metaverse is built out, but companies including Facebook, Twitch, just not willing to pay competitive rates to make it happen. They say they value it, but when it comes down to it, what they really value is the bottom line. And I think that what the Twitch data leak and Facebook's planned dominance of the metaverse point out is the importance of developing cybersecurity to protect from outside sources, yes, but also a need for more regulation to protect consumers from companies that value the bottom line more than any ethical or moral obligations. And you know, I can't presume to give a specific answer about what it will take to get tech giants to take cybersecurity seriously. But maybe diversifying where you go to connect with friends and family and view content. Maybe that is part of the answer. And I think that in the same way, we make ethical decisions about the food we eat, and the clothes we wear. And we signal those decisions through our buying power as consumers. We need to make ethical decisions about the social media and tech companies who choose to support and signal those decisions through the power of our time. And realizing that our time and our loyalty is money to these companies.
Andrew Wolverton 23:48
I think it's important for folks to make those matters known not only to you know, Facebook, and to Instagram or to Twitter, but also to, as you mentioned before, to lawmakers who are going to be making the decisions of what is going to happen and how this how these how these things are going to be regulated in the future and how the metaverse is in itself, you know, is it is it going to be considered that is a digital art. You know, and I think this brings up a lot of questions and discussions for us in the future.
Victoria Sprowls 24:22
Right or is it a digital economy of sorts and yeah, so I think getting in contact with your lawmakers especially when they face such pressure from these large tech companies can never hurt.
Andrew Wolverton 24:33
Can never hurt.
Victoria Sprowls 24:36
Thanks for listening to the AMT Lab podcast and don't forget to subscribe wherever podcasts are found. Let us know what you thought by visiting our website AMT-lab.org That's AMT-lab.org or you can email us at amtlabcmu@gmail.com. You can also follow us on Twitter @techinthearts or on Instagram, Facebook and LinkedIn at Arts Management and Technology Lab. We'll see you for the next episode where I'll be interviewing Dr. Heng Wu and Nick Pozek about the future of museums and technology.
Thanks again for listening. If you found this episode, informative, educational or inspirational, then send this to another arts afficionado in your life. We'll see you next time.