Criminal-Legal Issues of Countering Crime in the Metaverse: Current State and Prospects of Development

Introduction

With the expansion of Web 3.0, virtual reality began to develop in a new direction. Since 2021, leading IT companies have been developing the metaverse, a new digital space combining physical reality with the augmented reality (AR) and virtual reality (VR) technologies.

It is believed that metaverse technologies can be widely used in such areas as education, culture, trade, etc. (Lewandowsky, 2024). The Singapore government has already announced that most public services will soon be available through virtual representations of relevant structures in the metaverse¹.

In Russia, attention to the metaverse regulation and legal risks was largely due to the speech of the President of the Russian Federation, Vladimir Putin, in which he stated the need to use the opportunities of the metaverse so that people could communicate, work together, study, and implement joint creative and business projects. Also, the head of state noted that this is a real challenge for technology companies, creative industries, as well as for lawyers who are to develop rules for regulating economic and public relations in the fundamentally new world².

According to expert estimates, the metaverse market should reach US$74.4 billion in 2025 and 2,633 million users by 2030³. Many of the world’s leading brands have already established their presence in the metaverse and begun trading and holding virtual presentations, concerts, and exhibitions. For example, in the Decentraland metaverse, Dolce & Gabbana hosted the first Metaverse Fashion Week, featuring a 20-piece collection⁴. Omoda unveiled a new line of vehicles on the metaverse platform. Visitors submitted applications for a test drive of cars, and sales increased after the virtual dealership was opened⁵.

We should agree with A.M. Konstantinov that the digital metaverse is currently being formed as an integrated and multilateral public space, some aspects of which are a challenge for many humanities, including legal theory⁶.

It is important to realize that the metaverse is not just another multiplayer computer game. The idea of the metaverse is to create a virtual analogue of the real world, although it will not be limited to this, of course (Narasimhan & Kala, 2024). In the criminal law aspect, the metaverse attracts attention as a new space for social interaction, which can (and in fact already does) serve as a space for criminal activity (Saharan et al., 2023). Indeed, for many socially dangerous attacks provided for by criminal law, virtualization makes little difference in achieving the desired result. Moreover, such a virtual world, which does not have a clear law enforcement system, has obvious advantages for intruders (anonymity, wide reach, etc.) (Marshall & Tompsett, 2023).

One could object that the problem of malicious behavior in the metaverse is far-fetched, does not require legal intervention, and should remain completely within the system of relations between a resource owner and a user. We believe that this is a misconception. Such an elimination from public regulation and protection (the “vicious circle” theory) is relatively suitable for computer games, but not for a virtual analogue of the real world in which government agencies, commercial and non-profit organizations, and real people operate, albeit through their digital counterparts (avatars) (Singh, 2024).

1. Concept of the metaverse

The term “metaverse” is believed to first appear in Neal Stephenson’s novel “Snow Crash” in 1992, showing a virtual world as a continuation of people’s physical lives, in which they spent most of their time.

The metaverse is a result of convergence of technologies, the blockchain and the Web.3 named as the key ones. Immersion technology is also one of the main components of the metaverse, used to connect users to the virtual world and interact with its objects (Alawadh, 2023). Immersive technologies ensure a realistic representation of virtual content in the metaverse. The Internet of Things (IoT) is necessary to connect the metaverse with the real world. A network is required for communication and data transmission. It allows users around the world to connect to the metaverse (AlMutawa et al., 2024). Cloud and peripheral computing are required for the distributed storage and processing of the vast amount of data generated by the metaverse. It is important to emphasize that the metaverse allows people to interact as if they are not in the virtual, but in the real world.

Although there is no universal definition of the metaverse, in a broad sense it can be defined as a collective virtual space created by a convergence of augmented virtual reality and the physical world.

2. Crime and the metaverse

The metaverse poses the same systemic problem to criminal law as it does to any branch of law (AL-Tkhayneh, 2023). Conventionally, it can be described as follows: if the metaverse is a digital analogue of the physical world where individuals enter into relationships and engage in harmful behavior using their digital images (avatars), is it possible to extend the existing legal frameworks to both these relationships and this harmful behavior?

Modern literature suggests that any crime, including murder, can be committed in the metaverse. This is a bold idea. To agree with it, one must review many fundamental provisions of criminal law, to form completely different understanding of such key categories as victim, life, death, the subject of crime, etc. Is the Russian legal doctrine ready for this? Probably not.

Currently, crimes related to the dissemination of criminogenic and traumatic information are committed on the metaverse platforms (Gómez-Quintero et al, 2023). To a certain extent, this was expected, since digital technologies have always been attractive for criminal activities related to the distribution of prohibited content (Teodorov, 2023).

As for many criminal acts of this group (Articles 110, 110¹, 110², 128¹, 137, 205¹, 205², 205³, 242, 242¹, 280, 280¹, 280³, 280⁴, 282 of the Russian Criminal Code), their implementation in the metaverse does not exclude the possibility of bringing a person to criminal responsibility. The metaverse is just one of many digital platforms (messengers, social networks, multi-user virtual games, etc.) used to disseminate prohibited information (Blake, 2023).

Special attention should be paid to the question whether information about a person’s activity in the metaverse is a personal secret within the meaning of Art. 137 of the Russian Criminal Code. Today, the virtual world provides a user with almost limitless opportunities for self-identification and self-expression: one can choose an avatar of any gender, determine their race, age and appearance at one’s own discretion. The user can enter into a variety of relationships with other avatars and be active in the metaverse, while assessing the information about it as a personal secret. For example, in the metaverse, users can not only be in a relationship (engage in sexual activity without physical contact), but also get married with an NFT certificate, which serves as an alternative to official registration in the real world. We believe that the collection and dissemination of such information about a real person (provided they correspond to the signs of secrecy) fully fall within the Art. 137 of the Russian Criminal Code.

The possibility of bringing a person to criminal liability for violating the right to freedom of conscience and religion committed in the metaverse (Article 148 of the Russian Criminal Code) is debatable. By its nature, this crime can consist both in the public dissemination of certain information offensive to believers and in the commission of specific actions related to interference in worshipping, ritual, etc. In the first case, the application of Art. 148 of the Russian Criminal Code cannot raise objections. However, in case of other actions one has to agree with several assumptions at once, first of all, with the fact that worship or other religious rite can take place in the metaverse. In addition, it should be recognized that the avatar’s behavior in the metaverse has signs of interference in the ritual. Indeed, under certain circumstances, a person who is not aware of the intricacies of a particular religious rite can quite conscientiously assess one’s actions as permissible and not creating obstacles to its implementation. But, of course, the key issue is recognizing the very possibility of exercising the right to freedom of conscience and religion in the virtual space.

A broadly discussed problem of crime in the metaverse is the possibility of attacks against sexual freedom and sexual integrity of an individual (Wiederhold, 2022). The key point is that it is not the user who is being “sexually abused”, but their avatar, of course⁷. Those who had encountered with this phenomenon noted that they had experienced a strong emotional shock as a result of such actions. A famous example is the case of Nina Jane Patel, whose avatar was sexually assaulted by four male avatars at once on the Horizon Venues platform. According to her, she experienced a psychological shock. It is indeed noted in the literature that, due to immersive technologies, such actions against an avatar can cause emotional experience comparable to the shock of sexual violence in real life (Chawki et al., 2024).

Another example: in the UK, an investigation was initiated into an incident in the metaverse where an avatar (owned by a child) was attacked, involving manipulation similar to sexual violence. This fact caused a mixed reaction from the public. Many criticized, pointing out that law enforcement agencies should be engaged in criminal prosecution of real attacks on sexual freedom⁸.

For the same reasons as with murder, the application of criminal law norms on liability for sexual crimes in relation to avatars of the metaverse seems impossible. An avatar is just a digital image of a person in the virtual world and cannot have sexual freedom, as well as sexual inviolability. At least, that is the case at the moment. Of course, one may assume that over time such digital alter-egos will become inseparable from the real person. Then, we will have to review the object of sexual assault and recognize, as part of a person’s sexual freedom, also one’s right to choose partners and engage in sexual relations, at one’s own discretion and without coercion, using one’s avatar in the metaverse (Cheong, 2022). However, this is a question of the future and, probably, not the closest future.

It is important to make a reservation that, under the Russian criminal law, it is already possible to initiate criminal proceedings on indecent acts in the metaverse and in some cases on sexual violence against a person under the age of twelve – provided that the perpetrators were aware of the age of the avatar’s owner, of course.

The metaverse ecosystem provides opportunities for the acquisition of “digital property”, including virtual land plots, buildings and structures. The three most popular platforms include The Sandbox, Decentraland, and SuperWorld. It is known that the cost of land plots can range from hundreds to millions of US dollars. For example, one of the most expensive “digital real estate” transactions was the purchase of 100 private islands on The Sandbox platform for US$4.3 million⁹. The metaverse users place bets on virtual land plots via trading platforms, and purchasing is much like buying real estate in the real world. As soon as the buyer purchases virtual land, the transaction is recorded in the blockchain, which in a sense serves as an analogue of making an entry in the real estate registry when making transactions in the real world. Since many of these virtual worlds have a limited number of land plots, as the popularity of the platform grows, so does their value. Cases of illegal acquisition of digital property in the metaverse are also known. For example, a malware program was used to “steal” a land plot worth £10,000¹⁰ from one of The Sandbox platform users.

According to Russian criminal law, it is impossible to steal virtual property. We can only talk about illegal access to legally protected computer information for mercenary reasons (Part 2 of Article 272 of the Russian Criminal Code). However, one should admit how far such a qualification is from the content and focus of seizing the victim’s digital assets. After all, this is not so much about the software and technical means of information protection, but rather about taking possession of items that are marketable and often of significant value.

The debate on this issue in modern jurisprudence (Lin et al., 2023), as a rule, points out the dependence of criminal law protection on the regulation of the relevant objects’ turnover in civil law. However, given the current situation, there are more and more arguments that such a relationship does not constitute an absolute dependence of one on the other (Bhardwaj, 2024). Perhaps, the recognized secondary nature of criminal law protection can be overcome by developing special rules for the qualification of encroachments on “digital property”, with them forming the subject of specific crimes against property. Similar approach is known to be implemented in the explanations of the Russian Supreme Court’s Plenum about legalization. If transactions with cryptocurrencies and other digital assets are possible per se, including for the purposes of criminal legalization, then there are no serious obstacles to considering them as an object with a specific value at the time of the criminal encroachment.

As was noted above, the internal economy of the metaverse serves as an effective tool for money laundering (Wu et al., 2023). Metaverses allow, just as in the physical world but with lower risks, to create the appearance of “profitable” economic activity (provision of virtual services, trading in virtual assets, etc.). This has already been highlighted in the legal literature (Mooji, 2024). In general, the provisions of the Russian criminal law (Articles 174, 174¹ of the Russian Criminal Code) can be applied here on common grounds.

The existence of own economy within the metaverse (Wasswa, 2023) raises the question of the applicability of the traditional criminal law liability provisions to crimes in the field of business and taxation. Suppose a person organizes a platform-based cryptocurrency exchange point. Clients visit it using avatars and make payments with the organizer in one form or another. Clearly, in real life such activities are grounds for bringing the person to criminal liability for illegal banking (if a large amount of income is proven). As is rightly noted in the literature, actions to cash out funds may constitute a crime under Article 172 of the Russian Criminal Code, if large-scale income is extracted, since cashing operations can be considered cash services for individuals and legal entities (Gribunov et al., 2023). However, banking operations cannot be carried out in the metaverse, at least from a formal viewpoint.

It is equally difficult to qualify the actions of a person who, having the status of an economic entity, carries out activities (consulting services, design, etc.) not only in the physical world, but also in the metaverse, receiving significant income from the latter. I.A.Khavanova rightly summarizes that national regulators and tax authorities are still trying to comprehend the problems that arise in the metaverse, including those related to determining the moment of income, evaluating transactions of exchanging virtual goods for virtual or fiat currencies. At the same time, she is right saying that the technical impossibility of accurately calculating the tax base and determining the source of income in a space whose integral component is anonymity should not serve as a basis for non-taxation (Khavanova, 2024). Consequently, it is impossible even to raise the question of applying the rules on tax crimes if a person misleads the tax authorities about the income received from activities in the metaverse.

The above list of criminal-legal risks in the metaverse is, of course, not exhaustive. For example, one could also consider the urgent problem of committing corruption crimes using digital objects of the metaverse. However, further presentation of specific examples will add little to the overall picture. It is more important to pay attention to a number of systemic problems of crime prevention in the metaverse.

As is known, the metaverse has no geographical boundaries. Experts are actively discussing the problem of establishing so-called “cyber boundaries”, or the limits of the powers of states in virtual interaction and compliance with “cyber sovereignty”. It is expected that special procedures will be developed for the metaverse to hold individuals accountable for offenses and crimes based on the legislation of those countries with which the relevant metaverse platforms are affiliated¹¹. So far, these problems are under development, which creates additional prerequisites for various forms of criminal activity.

There is much debate about whether the real identity of a user of the metaverse should be disclosed in case of an illegal act. This, anyway, is related to the question of whether the user’s real identity should be combined with only one avatar. Obviously, if a user can have only one avatar, additional identification information will be required. Since the legal guarantees of the right to privacy vary from country to country, it is necessary to reach a consensus on what information about their identity should the users provide.

Until now, when creating avatars, users may imitate other people: celebrities or their friends, colleagues, as well as deceased persons. Over time, this can lead not only to ethical, but also to legal problems (Begishev et al., 2023). For example, law enforcement practice may face numerous disputes about protection of honor and dignity, business reputation and good name against actions committed in the metaverse using the victim’s biometric data (for example, a peeved student using the biometric data of a professor in the metaverse to create an image of a prostitute or a drug dealer). A fundamental solution is possible by introducing a registration mechanism in the public registry of avatars, where each person may register only one avatar in the metaverse under a unique identifier (Qin et al., 2025). At the same time, if we are talking about the metaverse as an alternative social space in a virtual environment, the creation of such a registered avatar, supposedly, should be linked to the user’s biometric data (technically it is already possible now). In other words, at a certain stage in the metaverse development, today’s complete freedom to choose a digital image will probably have to be abandoned.

Finally, all the above said, related to the (greater or lesser) applicability of the substantive criminal law provisions to the users’ actions in the metaverse, is only valid if we agree that there are procedural and criminological tools to prove a criminal case. This has already been noticed in Russian science. For example, O. A. Zaitsev rightly stated that we have to improve access to technological integrated platforms that facilitate obtaining the necessary data in the infrastructure of a single information space, as well as to change the very concepts of the criminal procedure, as it contradicts modern methods of obtaining evidentiary information. He also rightly noted that we urgently need an improved legal regulation of electronic evidence in proving the guilt (innocence) of a person in committing a criminal act, as well as a greater range of investigative actions to more productively obtain evidentiary information in electronic format (Zaitsev, 2024).

Conclusions

The most predictable answer to all the problematic issues of legal regulation and protection of relations in the metaverse would be to state that the digital analogue of human physical space requires a digital analogue of real-world law. This involves either applying the provisions of legislation by analogy (where this is permissible), or expanding the limits of existing legal structures through interpretation, or, if necessary, constructing special “digital twins” of legal norms designed specifically for these relations.

However, the simplicity of the solution is not a guarantee of its correctness. Not everything in the metaverse should be regulated or protected by means of criminal repression. As in the physical world, there are areas in the metaverse that should remain outside the legal regulation. Perhaps, we may argue that there should be significantly more such spheres in the metaverse than in real life.

However, it is also clear that one cannot remain in the paradigm of the real law non-interference in virtual relationships (Duranske, 2008; Fairfield, 2012). According to A. A. Smirnov, in the longer event horizon, as the ontological status of virtual worlds is established as a new environment for human existence, there will be a need to create a full-fledged system of legal regulation of life in virtual worlds (metaverses). Based on these considerations, he justifies the need to develop and adopt a Federal Law “On virtual and augmented reality systems”¹².

At the same time, T. Ya. Khabrieva quite rightly points out the general ineffectiveness of exclusively legislative regulation of relations in cyberspace, compared to other mechanisms (Khabrieva, 2018). In this regard, the model of regulation and protection of relations in the metaverse seems promising mainly through the development of framework rules of user behavior (the so-called “soft law” system) and the selective regulation of legal norms of those relations that cannot be regulated in any other way (beyond the boundaries of the well-known “vicious circle”). In order to prevent and effectively counteract crimes, states and metaverse platforms’ owners have yet to find a balance between anonymity and the protection of confidential user data. The metaverse platforms cannot remain just a virtual field for user interaction; they must be involved in their interaction to ensure a balance of interests. Therefore, the model of protecting relations in the metaverse from the most dangerous attacks should be multidimensional and based on close cooperation between the state, the IT sector, business, and users.