Much of the controversy surrounding the 3D Virtual World (Metaverse) that has been popularized by the Company Meta™ – formerly Facebook™ – gravitates towards inappropriate content (pornography) and behaviors such as cyber bullying and sexual harassment (Frenkel & Browning, 2021); however, a nation state level concern exists that may be prolific enough to topple democracy as we know it. Nation states and foreign threat actors are using cognitive science approaches to influence their targets into compromising cyber security and committing seditious aggression towards Western governments and their personnel. The Metaverse is the next logical step for weaponization because it supports attack vectors in all three of the major schools of thought for the assumption ‘cognition is information processing’ as outlined by Dawson in Mind, Body, World: Foundations of Cognitive Science.
Throughout modern history, classical mass media outlets such as print, radio and television have been trusted sources of information regarding important events locally, nationally and internationally. This knowledge dissemination has fundamentally shaped modern society over the past century (Stella, 2021). However, ‘media hype’ became a common term associated with scandalous news and high news value triggering emotion and polarization amongst consumers. “Social media [has] reshaped the way we consume information… and enables the user to interact and communicate, to create and share content digitally. This main characteristic allows regular users to create media hypes comparable to news waves generated by news media” (Roese, 2018, p. 313). Understanding the cognitive science behind social media is important to recognize and control the media hype.
Classical cognitive science and connectionism are two of the major schools of thought for the assumption ‘cognition is information processing’. Classical cognitive science is the dominating school of thought in the field of cognitive science and has brought major advances in understanding of language and human problem solving. It is a rule-governed system of symbols for information processing and usually involves defined algorithms to accomplish tasks (Dawson, 2013, p. 9). Social media platforms utilize well defined algorithms to target information and advertisements for users that are more susceptible to such information and commercialization
Reciprocally, humans navigate through each day utilizing rule-governed systems that are fundamentally based on symbols. Language, the medium through which concepts and emotions are encapsulated in words, is a classical cognitive science system which allows for learning, communication, and teaching. “The cognitive landscape of knowledge flowing along social media interactions must be investigated by language models grounded in psychology and cognitive science and thus interpretable under the lenses of cognition, personality, and behavior” (Stella, 2021). Interpretation relating to personality and behavior requires a system that identifies patterns within systems to connect-the-dots.
Connectionism is the second school of thought for the assumption ‘cognition is information processing’ and is inspired by our knowledge of the human nervous system. “The basic medium of connectionism is a type of model called an artificial neural network, or a parallel distributed processing network” (Dawson, 2013, p. 128). This artificial neural network is extremely efficient at pattern recognition on an abstract level and is primarily used for speech recognition, computer vision, and language translation due to its ability to infer contextual information from patterns.
Neural networks are trained for performance using data that is predetermined to be correct or incorrect, allowing weighted connections to be adjusted using linear regression and mathematics. Humans learn in a similar way by being taught what is right and wrong using datasets provided by our parents, teachers, and other individuals within our ‘circle of trust’. Social media reinforces this principle of learning as it “[has] a strong cognitive component because [social media posts] are mainly made of knowledge, that is, emotions and ideas, flowing from user-to-user along with social ties” (Stella, 2021). As a result, media hype is widely accepted as factual without error checking which leads to misinformation and disinformation at a pace unseen throughout history - especially when information is accompanied with emotional stimulation.
Emergence Synthesis is a modern theory and model of emotion formation that incorporates aspects from the older James-Lange theory, Cannon-Bard theory, and Cognitive theory. Emergence Synthesis supports the belief that some emotions do not require interpretation and are subject to immediate stimuli; indeed, “fear can be caused when a threatening stimulus activates a part of the brain called the amygdala [which] can induce the feeling of being scared without any thought or appraisal” (Friedenberg et al., 2021, p. 298). Emotional stimulation from impactful images and statements within posts throughout social media enhances ‘the need’ to spread the information regardless if the information is true or false which feeds into media hype.
Following the inauguration of President Donald Trump in 2016, “more than 10,000 tweets – each laced with hyperlinks containing malware – were sent directly to U.S. Defense Department employees on Twitter. The messages were tailored to appeal to the employees’ individual interests and generated click rates nearing 70 percent” (Bossetta, 2018, p. 97). Customized baiting attacks that target individuals or a specific set of individuals is known as spear phishing and the process for collecting information on targets through social media is called open source data collection. Theoretical models of social media spear phishing are proposed, supported, and exemplified by Great Britain, France, Germany, and the United States Open Source Intelligence (OSINT) programs and spear phishing attacks via social media increased five hundred percent in 2016 (Bossetta, 2018, p. 98).
Spear phishing attacks utilize threat models consisting of five phases: collect, construct, contact, compromise, and contagion. During the first phase the attackers collect data regarding the target utilizing open source methods such as social media and public records. Target information is usually basic such as online connections, email addresses, phone numbers, work history, education, and interests. This information is used to build a personal profile and behavioral data is then collected over time to identify emotional stimulants, online routines, and personal beliefs.
Attackers utilize both classical cognitive science and connectionism approaches during the first phase of the attack. The classical cognitive science aspect is the logical procedure of collecting information and evaluating it for effectiveness. The connectionism aspect is the behavioral data analysis to determine emotional stimulants, online routines, and personal beliefs. Advanced machine learning tools can be used to increase the effectiveness of the attacks by assisting with behavioral data evaluation.
During the second phase of the attack model, the attackers construct fake social media profiles and identities with constructed persona which may include fabricated credentials, such as working in the same organization or having attended the same university, to interact with the target. According to Bossetta:
Ahead of the 2017 French election, Facebook™ identified approximately two dozen fake accounts spying on then-candidate Emmanuel Macron’s presidential campaign. These accounts, linked to the Russian hacking group Fancy Bear – the same organization responsible for the email hacks of the U.S. Democratic National Committee – were posing as friends of friends of Macron associates and trying to glean information from them (Bossetta, 2018, p. 100).
More interestingly, trust is utilized as an emotional brain state and not an emotional response to gain access to protected social media accounts by using platform-specific account metrics such as friends of friends and account creation date as older accounts are more likely to be considered authentic.
Embodied cognitive science interprets ‘cognition is information processing’ as the coordination between sense-act relations between ‘mind-body’ and environment. The embodied approach replaces the sense-think-act cycle associated with classical cognitive science and connectionism (Dawson, 2013, p. 13). Similar to how Emergence Synthesis allows emotion without thought, the embodied approach assumes interactions between ‘mind-body’ and the environment results in action without thought. An example of this theory can be seen in how ants determine the shortest path between two objects when traveling in formation by following the strongest scent of pheromone placed by the previous ant. The ants use environmental cues to make their next action without thought as part of the sense-act relationship.
Similarly, advertisements utilize the subconscious or unconscious mind as a pervasive and powerful influence over higher mental processes. “The term unconscious was originally based on one’s unintentional actions and not on one’s ability to process subliminal-strength information. And this equation of unconscious with unintentional is how unconscious phenomena have been conceptualized and studied within social psychology for the past quarter century” (Bargh, 2008, p. 74). However, modern theories of the unconscious define the term as a lack of awareness of the influences instead of Darwin and Freud’s tendency to define the unconscious as unintentional actions rather than unawareness of stimuli (Bargh, 2008, p. 75).
The relationship between the unconscious and sense-act behaviors remains to be studied in greater detail, but results are the same in that thought or awareness is not a fundamental aspect leading to action or behavior. Contextual priming is a mechanism that provides precise adjustments to events and people in real time unconsciously. Such priming effects influence what one does and proves the existence of a close and autonomous connection between perception and behavior. This link promotes default tendencies to act in the same way as those around us, unconsciously adopting what others around us are doing, especially in new situations and with strangers. In the research of Chartrand and colleagues:
Not only do people tend to adopt the physical behavior (posture, facial gestures, arm and hand movements) of strangers with whom they interact, without intending to or being aware they are doing so, but this unconscious imitation also tends to increase liking and bonding between the individuals, serving as a kind of natural ‘social glue’ (Bargh, 2008, p. 76).
This research supports environmental cues causing a sense-act reaction and “several theorists have postulated that the conscious mind is not the source or origin of our behavior; instead, they theorize that impulses to act are unconsciously activated and that the role of consciousness is as a gatekeeper and sense maker after the fact” (Bargh, 2008, p. 76).
New attack vectors can utilize embodied cognitive science to influence decisions on a more fundamental and basic level where the victim is unaware that original thought was envisioned, fabricated, and implanted by an attacker; indeed, new attack vectors utilizing the embodied approach may be capable of inception of thought. Attackers may set up subtle environmental cues such as images on shirts, billboards, or advertisements, and interact with the victim as a team to influence the environmental conditions and discussions, slowly compromising the victim unconsciously.
Ahn, author of Designing for Persuasion through Embodied Experiences in Virtual Reality identifies that, “VR uses digital devices to produce realistic sensory information, users temporarily forget that they are in a mediated world and feel as if they have genuinely visited a different space. This feeling of ‘being there’ in the virtual world during an embodied experience is referred to as ‘presence’” (Ahn, 2021, p. 166). VR provides an embodied experience unlike any technology in the past with the majority of users reporting a feeling of presence during use.
The Metaverse is a 3D Virtual World focused on social connection facilitated by the use of virtual and augmented reality headsets. Environments are designed and built by third parties and hosted on popular platforms such as Decentraland, Sandbox, and Meta’s Metaverse where users from all over the world can interact and converse with each other. Avatars are used which can be customized with facial features, expressions, actions, clothing, and accessories. Participants can play traditional games such as golf, corn-hole, chess and checkers or they can work together or compete in live-fire close-combat simulation games similar to the popular game Call Of Duty.
One security issue that separates Meta’s Metaverse from other 3D Virtual Worlds is the link between Meta’s ever popular social media platform. Attackers can utilize modern spear phishing methods to obtain Open Source Intelligence about their target and then locate the individual within the Metaverse during the contact phase of their attack. The interactions will most likely be subtle at first with a presence in similar locations within the Metaverse where the attacker uses unconscious and embodied cues to gain the victim’s companionship.
An attack vector utilizing the Metaverse will likely produce intense feelings of trust which will maximize the potential collateral damage inflicted by the attacker. An example of the information compromised may be close quarters combat tactics shared during gameplay, confidential information shared during conversation, theft of intellectual property, information related to ‘doxxing’, or procurement of trade or manufacturing information which may provide a tactical advantage in trade negotiations (Bossetta, 2018, p. 98). Additionally, attack vectors originating within the Metaverse will likely lead to attacks being successful external to the Metaverse.
Geopolitical influenced and state-sponsored attempts to manipulate public opinion within the Metaverse is expected to be a real threat following the controversy surrounding the Russian interference in the 2016 U.S. election. Users experiencing ‘presence’ within the Metaverse will develop more intense relationships at a faster pace than what is experienced through modern social media platforms due to the more personalized interaction with unconscious and environmental cues influencing companionship.
As the Metaverse matures and users begin to interact in new social environments where the entire atmosphere may be controlled by a third party, additional measures need to be implemented to determine if attackers are targeting individuals or determine if political influencing is occurring on a large scale. This can be accomplished with advanced software algorithms and specialized training for individuals with access to classified information. Platform moderators should be required to have stringent terms of use and privacy policies and should also be held responsible for not enforcing violations of those policies.
The Metaverse is on the horizon and the number of users accessing these 3D Virtual Worlds are increasing everyday. Legislation needs to be implemented before wide adoption of the Metaverse to ensure the U. S. maintains a proactive and safe security posture for their residents. Action is required now before it is too late.
