Cisco Blogs

Blizzard Real ID Privacy Concerns

July 14, 2010 - 0 Comments

As discussed in this week’s Cyber Risk Report, Blizzard Entertainment, developers of the popular Warcraft, StarCraft, and World of Warcraft video game franchises, proposed a potential plan for certain areas on their Battle.Net bulletin board forums. The plan stated that user posts in the selected areas would be accompanied by the real name of the owner of the online profile. The scheme would have been part of the newly available Real ID service offered by Blizzard, tying real names to online accounts. According to Blizzard, the reason behind the proposed change was to remove the veil of anonymity on the boards that allows some forum posters to hide their identity and post hateful, racist, or deliberately inflammatory comments. However, since the announcement, many users within the community voiced their concerns, and Blizzard has canceled the proposed changes. Even if the plan will not go into effect, it is worth examining the potential dangers in associating real names with online profiles.

World of Warcraft (WoW), like many other online groups, has a community comprised of both minor children under the age of 18 as well as adults. Players of all ages compete within the online game in various ways. The natural competition between players generates a lot of emotion, and those things sometimes spill out onto the message boards. Message boards, perhaps most notoriously boards such as 4chan, allow users to post anonymously and thus rarely fear consequence, save for the occasional ban that lasts only as long as users can change their username or IP address and then come back for more.

The Real ID plan could have changed that, but perhaps not in the way that Blizzard desired or anticipated. It’s clear that their desire is to bring civility to their community. However, in a community comprised of younger users who view the boards as a place to vent the burning angst of youth, civility may be unreachable. Blizzard’s goals are laudable but misguided. Anonymity is a protection from persecution just as it is a protection for the persecutors. Throwing real names into the equation won’t stop hate speech or sexism. It will just make it easier for hate to be targeted and expand into the real world.

The primary danger of exposing real names is the further association of personally identifiable information, and the ways in which hostile users may attempt to leverage that information for malicious activities. In response to Blizzard’s announcement, a blog was created that compiles the public information of various Blizzard employees, from Blizzard’s parent company Activision President Bobby Kotick on down to individual game developers. The information within this blog demonstrates the kind of publicly available information that can be gathered once a name is discovered. While none of the information available publicly about an individual may be particularly embarrassing or confidential, video game players may want to keep their private and professional lives separate from their recreation for good reason. Video games for many are an escape, and they do not wish to be stigmatized or judged for any reasons other than the actions they take within the game; public information about their real identity may bring on that kind of scrutiny. Taken to an extreme, the information can be used to locate a targeted user in the real world and engage in all sorts of malicious activity such as fraud, bullying or threats, stalking, or other harassment such as SWATing.

I realize, of course, the subtle irony of being critical of a website posting real names while posting these comments on a website posting my real name. However, there is a difference between posting professionally under the auspices of an employer using your real name, whether a news article or blog post, and posting comments about a video game on a forum. I accept the risks as part of my profession, and is necessary for accountability. Not only that, I want my name associated with my words in this instance! I stand behind what I write as my own opinion; but on a game forum? I don’t necessarily want the world to know who I am when I write I prefer Alliance over Horde. This comment alone might get the police or several dozen pizzas sent to my door.

The ramifications of posting under your real name on a message board go beyond what others might do to you. Perhaps just as dangerous is what you can do to yourself. Only a year removed is the Cisco Fatty incident, in which a prospective employee posted a critical message regarding a potential employment opportunity at Cisco. Similarly, another incident involving a FedEx employee exposed some negative feelings toward a client’s locale. A new exposure to embarrassing commentary could be a video game message board if real names are exposed. Content on message boards last forever. If you’re fifteen years old and post angry and hateful comments on the boards, a web search on your name might turn those things up several years later, hurting your chances at college entry, employment, or in personal relationships. Even innocuous things, comments that might make complete sense in the context of the video game, can be misconstrued by a potential employer and destroy your chance of that second interview. Replying in friendly rivalry to another player on the boards saying “Next time I find you I’m going to take you out!” is a tame challenge in a virtual player versus player video game. Taken out of context in the results of an Internet search, the same phrase could be misunderstood by an employer that this might be a dangerous individual.

Might Blizzard also be facing some potential legal issues by exposing names of minors? I’m sure the policy was reviewed before being released publicly, and Blizzard’s privacy policy does say that they don’t collect information on children younger than 13, but what about older than 13 and younger than 18? Is it responsible to allow thirteen-year-olds to post their name publicly in an online forum?

Users who do not wish to have their real name posted alongside their forum posts can simply not post to the forums. In some circumstances this might be fine. But some technical support issues require users to post publicly.

Many of these concerns were heard by Blizzard, who must have realized the potential threats of Real ID outweighed the benefits. Short of revealing real names, Blizzard might consider different systems for controlling content on their message boards. A system similar to the Facebook scheme of opt-in communications may be a good fit, such as a communication board only for users who agree to see content from other users. Social bookmarking sites like or Slashdot, or like that recently implemented on YouTube or on, allow members of the community to rate comments and posters, upvoting upstanding community members and ignoring the rest. Users behaving badly might disappear, at least to most, when the rest of the users band together to vote them down.

We have to give credit where credit is due to Blizzard. They listened to their community members and decided not to implement an unpopular plan that could threaten their users. Other online communities should take this lesson to heart. Real names and other personally identifiable information should be carefully guarded, and unpopular changes in policy should be re-examined.

In an effort to keep conversations fresh, Cisco Blogs closes comments after 60 days. Please visit the Cisco Blogs hub page for the latest content.