�鶹������ý

From the European Union (EU) to the United Kingdom (U.K.) to South Korea, government institutions are taking unique approaches to stimulate, integrate, and regulate their burgeoning XR markets. China, too, wants to support its XR market and incentivize using the metaverse across various sectors, but also wants to become a dominant player in controlling the XR supply chain and international standards. This could have significant national security concerns, especially as the United States and its allies turn towards metaverse applications to support critical infrastructure and military operations.

The EU has one of the more comprehensive approaches to integrating XR technologies into European society and economy by fully embracing an all-inclusive technology strategy and metaverse-specific plans. In December 2022, the EU released the “European Declaration on Digital Rights and Principles,” detailing six core principles that will guide the EU’s approach to all aspects of technology, including XR. One of these principles, “safety, security and empowerment,” includes commitments to:

• Protecting the interests of people, businesses, and public institutions against cybersecurity risks and cybercrime, including data breaches and identity theft or manipulation. This encompasses cybersecurity requirements for connected products placed on a single market;
• Ensuring that everyone has effective control of their personal and non-personal data in line with EU data protection rules and relevant EU laws;
• Protecting communications effectively from unauthorized third-party access; and
• Countering and holding accountable those that seek to undermine the security and integrity of the digital environment or promote violence and hatred through digital means.¹

The EU is also creating metaverse-specific policies and establishing new forums to help inform government policies. In 2020, the European Commission launched the Virtual and Augmented Reality Industrial Coalition to bring together EU policymakers and VR/AR companies. Through this coalition, the EU has held over 100 workshops from 2021 to 2022, developed a roadmap detailing how the EU should operate and invest in XR technologies, and published a strategic paper assessing the XR market in the EU.² This strategic paper outlines several roles for the government to strengthen the market, including:

• Increasing the number of small funding opportunities by broadening application requirements, simplifying application procedures, reducing red tape, and increasing accessibility of those by all types of stakeholders active in VR/AR development;
• Acting to make large financing opportunities available to support risk-taking and scaling-up of companies; and
• Educating investors by collecting and making available market data and trends regarding the adoption and growth of the technology.³

Despite the robust nature of the strategic paper, it shirks the importance of securing the metaverse. In a section on the “most important challenges/opportunities facing the EU VR/AR sector” the term “security” is the last item placed under “legal” with a “medium” impact if it is not addressed.⁴ In fact, the word “security” only appears 21 times in the 117-page document.⁵ Despite this, the EU acknowledges that they need to ensure the metaverse is safe and secure for Europeans, expressing that “the metaverse platforms pose significant privacy-related challenges.”⁶ Specifically, there are concerns about whether any regulatory regime can keep pace with the amount of data generated and whether existing regulations are applicable to the metaverse.⁷ For example, the General Data Protection Regulation may not cover the “invasive forms of data collection” that some XR technologies may create and store.⁸

Realizing the limitations of existing regulations, EU officials have taken several steps to begin shoring up this gap. The European Commissioner for the Internal Market, Thierry Breton, announced in 2022 that “private metaverse spaces should be based on interoperable standards,” including data interoperability standards that give consumers better control of their data.⁹ He went on to mention that the Digital Services Act (DSA) and Digital Markets Act (DMA), two key laws that regulate the internet, provide Europe with “regulatory tools for the digital space,” but did not go into detail as to how they would apply to the metaverse.¹⁰ Other types of regulations include network infrastructure taxes that will tax network providers, new digital rules to implement the DMA and DSA in the metaverse, and additional safety and interoperability measures.¹¹ As in other emerging technologies, such as artificial intelligence, the United States should pay attention to how the Europeans leverage regulation to control the metaverse and its impact on the EU market.

A stone's throw away from the EU’s domain, the U.K. has worked closely with the private sector to take advantage of what the metaverse has to offer. The greatest effort was a large-scale consultation in 2022 in which the U.K. government put out a request for information on the opportunities and challenges of a “national cyber-physical infrastructure” that includes digital twins, robotic and autonomous systems, Internet of Things devices, and AR/VR technologies.¹² The UK government stated that: “[W]e care because [cyber-physical technology] is coming and it is incumbent upon us to play an active role in how that happens; there will be risks emerging as part of this that we need to address; there are significant opportunities for the U.K.’s society and economy; and we have received a clear call from key players in the ecosystem to take an active role.”¹³

Commenters agreed that “core” sectors would stand to benefit from cyber-physical infrastructure such as “energy systems and utilities; infrastructure and built environment; manufacturing; natural environment; transport and supply chains; and wellbeing, health, and social care.”¹⁴ But they also called out key areas where the government could address “systemic challenges” by supporting “key enablers” including security and resilience; interoperability; recognized value propositions; frameworks, guidance, and standardization; and skills.¹⁵ Specifically, these commenters would like the U.K. government to:

• Launch a grant competition to fund one or more organizations working together to develop and host a cyber-physical infrastructure ecosystem accelerating capability;
• Continue funding of a breadth of cyber-physical research;
• Invest in digital twins for transport; and
• Continue the delivery of the National Digital Twin Programme.¹⁶

Unlike the VR/AR Coalitions’ Strategic Paper, the Consultative Response Paper provides concrete details for how the U.K. government should tackle cybersecurity challenges. The paper lists “high-level principles” that include (1) security as an enabler or ensuring systems or resilient; (2) secure-by-design; (3) necessity or understanding and mitigating risks and threats through necessary security controls; (4) a systems approach to security; and (5) learning from existing best practices.¹⁷

With the report just published in May 2023, it is still too soon to tell whether this report will sit on a shelf or if the government will use it as a bedrock to manage XR issues.

Other countries such as South Korea and Japan are going full steam ahead with their XR ambitions and investing millions to accelerate the adoption rate among their citizens.

South Korea unveiled a $44.6 billion “Digital New Deal” to embrace new technologies, including XR technologies. This financial package includes over $170 million to help South Korea become the fifth most “metaverse-adopted county” by 2026, up from its current 12th-place status.¹⁸ The government is investing this money in various metaverse projects to create a “metropolitan level metaverse platform” to provide government services.¹⁹ For example, the city of Seoul created a “virtual public administration platform” where roughly 3,000 residents have engaged with the beta version.²⁰ Beyond government services, South Korea is seeing how it can integrate XR technologies in all aspects of society. Kakao Entertainment is working with a gaming company to create a K-pop band that only exists in the metaverse.²¹ Through these investments, South Korea’s domestic metaverse could be worth over $300 billion by 2026.²² With the country filing one out of every five metaverse patents since 2016, second only to the United States, they are advancing towards this goal at a rapid pace.²³

Complementing this investment is the implementation of the Metaverse Industry Promotion Act. The new law creates a Metaverse Policy Deliberation Committee to discuss policies related to the metaverse and requires the Minister of Science and Information and Communication Technology to establish a basic plan for the metaverse every three years.²⁴ This law builds off the Ministry of Science and Information and Communications Technology non-binding guidelines on the metaverse, which includes the core values of “secure identity, safe experience, and sustainable prosperity.”²⁵ Stemming from these values are eight principles that metaverse system developers and users should abide by: authenticity, autonomy, reciprocity, respect for privacy, fairness, personal information protection, inclusiveness, and responsibility for the future.²⁶ While South Korea has not indicated whether they will integrate these principles into regulation, they have taken some initial steps, such as developing “metaverse specific regulation amendments” to protect minors from sexual harassment.²⁷

Japan is similarly organizing its government to take full advantage of XR technologies. In a speech in front of Japan’s Parliament at the end of 2022, Prime Minister Fumio Kishida said that the country will invest in digital transformation, which will include metaverse services.²⁸ He went on to say that Japan will “suppor[t] the social implementation of digital technology” and will “promote efforts to expand the use of Web3 services that utilize the metaverse.” The government is well positioned to act on this as the Ministry of Economy, Trade, and Industry established a Web 3.0 Policy Office.²⁹ Recognizing the scope and breadth of Web 3.0 technologies, such as XR, the Office includes departments responsible for industrial finance, taxation, corporate system (vehicles), media and content, sports, fashion, and other related industries.³⁰

China and the metaverse must be viewed through two prisms. The first is their willingness to exploit vulnerabilities in the XR ecosystem. The second is their global ambition to become a market leader in XR technologies. Both of these prisms will have significant implications for the United States.

The China Threat

With the eventual increase of XR technologies used across critical infrastructure sectors, the United States must be mindful of the threat posed by China. The reason is straightforward. The U.S. government currently views China as the greatest cybersecurity threat facing the nation. The Office of the Director’s National Intelligence’s (ODNI) 2023 Threat Assessment Report notes, “China probably currently represents the broadest, most active, and persistent cyber espionage threat to [the] U.S. Government and private-sector networks. China’s cyber pursuits and its industry’s export of related technologies increase the threats of aggressive cyber operations against the U.S. homeland, suppression of the free flow of information in cyberspace—such as U.S. web content—that Beijing views as threatening to the CCP’s hold on power, and the expansion of technology-driven authoritarianism globally. If Beijing feared that a major conflict with the United States were imminent, it would almost certainly consider undertaking aggressive cyber operations against U.S. homeland critical infrastructure and military assets worldwide.”³¹

This is not an exaggeration. China has shown a blatant willingness to attack U.S. companies and critical infrastructure beyond traditional espionage purposes. In May 2023, Microsoft found that a Chinese state-sponsored actor compromised U.S. critical infrastructure for the purpose of “develop[ing]… capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.”³² State-sponsored actors have also been known to launch ransomware attacks, steal information on COVID-19 vaccines during their development, and pilfer military intellectual proprietary information.³³ Chinese actors were spotted as early as 2011 in American gas pipeline infrastructure, a troubling situation given the devastating impact that a ransomware attack had on the Colonial Pipeline in May 2021.³⁴ Their actions can be reckless with no care of who it impacts. In 2021, Chinese state-sponsored actors infiltrated Microsoft’s Exchange servers and installed “web shells” across thousands of victims, creating a backdoor for any malicious actor to exploit. Although there were specific targets, their actions expanded to one of “mass exploitation” and were “indiscriminate” to the point that at least 60,000 Microsoft Exchange server customers were impacted.³⁵

Based on open-source reporting, cyber actors affiliated with the People’s Republic of China (PRC) have not been targeting XR applications or launching cyber attacks on XR devices. Yet, given the intelligence community’s assessment of China’s willingness to launch cyber attacks against U.S. critical infrastructure and its track record, the United States must be mindful of how China could exploit this new vulnerability in critical infrastructure systems.

There’s a Plan for That

Relative to other country case studies, China has the most robust metaverse plan backed by significant resources and government intent to be a global leader in this space. This could have perverse impacts on the United States, as ODNI has noted that China is the United States’ “top threat to U.S. technological competitiveness.”³⁶ They further detail in their recent unclassified threat assessment that “China is doubling down on efforts to boost indigenous innovation and to become self-sufficient. China uses access to its vast market and control over critical supply chains as tools to force foreign companies and to coerce foreign countries to allow the transfer of technologies and intellectual property.”³⁷ The combination of the threat posed by China in cyberspace, their willingness to actively penetrate American critical infrastructure and steal sensitive company and government information, and their desire to dominate a technological ecosystem like the metaverse warrants policymakers’ attention on how China could exploit the XR market for potentially malicious ends.

Similar to other segments of China’s economy, the CCP has a plan for the metaverse. In November 2022, the Chinese Ministry of Industry and Information Technology released a five-year action plan solely dedicated to VR. The plan’s goal, based on informal translations, is to “enhance the core technological innovation capabilities of the nation’s virtual reality industry, stimulate the innovation vitality of the industrial service system, accelerate the integrated development of virtual reality and industry applications, and build and improve the innovation and development ecology of the virtual reality industry.”³⁸

The goal is for the Chinese industry to ship more than 25 million devices projected to yield nearly $50 billion in profits by 2026.³⁹ To achieve this, the PRC is investing in 100 “core” companies and forming 10 “public service platforms” by 2026.⁴⁰ The government also wants to achieve “breakthroughs” in various XR industries such as “industrial production, cultural tourism, integrated media, education and training, sports and health, business creativity, and smart cities.”⁴¹ One envisioned breakthrough is in education, where the plan details creating VR classrooms, teaching and research offices, and “laboratories and virtual simulation training bases” from primary schools through higher education. In health care, the PRC will promote XR in medical education, diagnosis and treatments, rehabilitation, addiction withdrawal assistance, therapy, and surgeries. They also intend to integrate XR into emergency services by hosting virtual drills for hazardous chemical safety and natural disaster prevention.⁴² China plans on launching 10 “virtual AR production application demonstrations,” 10 “virtual reality+ integrated application pilot cities and parks,” at least 20 “characteristic application scenarios,” and 100 “pioneering cases of integrated applications.”⁴³

These are not just grandiose ideas. In 2021 alone, over 1,600 firms, including Alibaba and Tencent, applied for over 11,000 trademarks as shown in the graph below.⁴⁴ In that same year, more than $1.6 billion was invested in “metaverse-related ventures,” and the China Mobile and Communications Association created the “Metaverse Industry Committee.”⁴⁵ To underscore 2021 as a foundational year for the metaverse in China, the Metaverse Industry Committee released a book simply titled Metaverse, detailing the “rationale for the development of the next generation internet and the future digital economy.”⁴⁶ The Committee appears to be one of the core implementers of the five-year action plan, as they will focus on drafting industry standards, creating industry roadmaps, and establishing an investor fund.⁴⁷

In addition to breaking ground in various XR field applications, China wants to become a central leader in the supply chain. The five-year plan notes that China will “improve the supply capacity of the whole industry chain” by “comprehensively enhanc[ing] the industrialized supply capacity of key virtual reality devices, terminal peripherals, business operation platforms, content production tools, and dedicated information infrastructure.” China also understands the importance of controlling the supply chain for the materials that create VR headsets, as the plan details that they will “develop dedicated processing chips for VR, near-eye displays, and other key devices.”⁴⁸

Part of owning the supply chain is controlling the development of interoperability standards. Similar to how they were active in developing interoperability standards for global 5G devices, China has signaled they would like to lead in creating AR/VR standards.⁴⁹ China has made its desire to control the standards conversation clear, showing its confidence that the United States and other countries will be slow in reacting. The plan details that China will: “[B]uild a virtual reality comprehensive standards system covering the entire industry chain, including general use, content production, network transmission, distribution platforms, terminal equipment, quality evaluation, and innovative applications. We will clarify the roadmap for the development of virtual reality standards according to the urgent needs of the industry. We will accelerate the formulation and promotion of key standards such as health and comfort, user information security, content production process, transfer encoding, and employee capabilities. We will promote research on virtual reality application standards, and formulate model architecture and solution standards for different application scenarios. We will encourage Chinese enterprises and institutions to participate in international standardization activities and actively contribute to Chinese technical solutions.”⁵⁰

If China controls these standards it could jeopardize the safety, security, and privacy of any person or entity in the United States. For example, if China develops global manufacturing standards for user information security that is then embedded in systems widely used in the United States, those devices could have built-in vulnerabilities for the PRC to later exploit. Other possible standards could also make the transfer of data between systems insecure, less private, and more easily accessible to malicious actors. Further, if the standards are proposed in such a way that gives Chinese companies an upper-hand in the market, it could worsen the vulnerability landscape. Chinese companies are required, by law, to report to the Chinese government if they find a vulnerability in any of their products and cannot patch the vulnerability or to tell customers about it unless the government says so.⁵¹ As a result, the PRC can sit on top of critical vulnerabilities and choose to exploit at their choosing.

If China can push forward with setting these global standards, the United States and its allies will eventually push back, which will further propagate the balkanization of the internet. A world could exist where there are Western XR standards and Chinese XR standards, and the devices that flow from those two realms would not be able to interoperate with each other. The Eurasia Group concluded similarly that there will be an increase in the decoupling of data flows, applications, and deeper layers of the tech stack, which “could lead to a Western democratic-centric decentralized metaverse(s) wholly or partially interoperable with more centralized, authoritarian, censored metaverse(s) running on largely Chinese hardware and embedded with the political preferences and social controls coming from Beijing or Moscow.”⁵² The PRC also holds this sentiment, as an article in the People’s Liberation Army (PLA) Daily, suggested that “[i]n the future, China and the United States will inevitably compete in the metaverse.”⁵³

However, the competition for the metaverse may only be hypothetical due to the United States' lack of involvement internationally. The United Nations International Telecommunications Union (ITU) has in recent years created a “Focus Group on the Metaverse.” Through this working group, the UN is “analyzing the technical requirements of the metaverse to identify fundamental enabling technologies in areas from multimedia and network optimization to digital currencies, Internet of Things, digital twins, and environmental sustainability.”⁵⁴ This represents a clear way for the United States to engage the international community on critical standards issues, yet the United States does not have a representative as a Vice-Chairman. In fact, the United States has no leadership positions or editorial representation in any of the 10 subworking groups, whereas China does.⁵⁵ In fact, the second ITU forum on “Creating a metaverse for all through international standards” was held in July 2023 in Shanghai. At this forum, key topics included the role of standards to build an open and interoperable metaverse, industrial metaverse, and the role of enabling technologies to unleash a new era of immersive and interactive experiences, all topics that China has a vested interest in.⁵⁶

China’s ambitions in the metaverse are not solely for economic reasons. National security concerns appear to be the primary driver. A Chinese think tank associated with the Ministry of State Security published a paper detailing three top concerns on how the metaverse could impact China’s national security:

1. Other countries will develop XR technology faster than China, which could “cause instability in capability and access;”
2. The amount of sensitive data shared through XR will increase and the concern of how secure that data is could warrant the need to categorize XR technology as critical infrastructure; and
3. China’s politics, economy, and society could be significantly altered by the metaverse, and therefore the Chinese Communist Party must pay great heed to how this technology is used.⁵⁷

In addition to shoring up their national security, China also realizes that XR technology could be used for military purposes, similar to the United States. The government sees such close integration with XR and military applications that the PLA Daily news outlet created a term called the “battlefield metaverse” or “battleverse.”⁵⁸ The PLA Daily has published several articles on the potential benefits of the battleverse, including performing training exercises in the battleverse, simulating war scenarios, testing new weapons, enabling research, and supporting communications.⁵⁹ The battleverse could also allow soldiers stationed throughout China to have access to the same material and training opportunities regardless of location. The PLA Daily also warned how China’s adversaries could use the battleverse to hurt China, and that it is, therefore, necessary for China to “develop the metaverse” so that they may “avoid wars and economic crises.”⁶⁰

These words have taken a life of their own as the PLA have begun integrating XR technology into their military procedures. For instance, the PLA created a VR parachute training system that “uses spatial positioning, virtual simulation, and other technologies to build a realistic parachute environment, allowing new paratroopers to perceive different aerial emergencies, thereby reducing risks in an actual parachute jump.”⁶¹ These simulations could also provide soldiers with experience in “unfamiliar environments…and improve their actual combat skills.” The environment could be used to simulate joint operations and test prototype weapons.⁶² Researchers from the Institute of Military Political Work, Academy of Military Sciences, a research institute within the PLA, also wrote an article entitled “The Metaverse: The New Heights of Future Cognitive Warfare,” which details how cognitive warfare “can be advanced efficiently and enhanced at a fast pace” within the battleverse.⁶³ Based on open-source reporting, the PLA’s use of XR technology pales in comparison to the U.S. military, yet the increased focus and attention on its military benefits will likely change that balance.

Regardless of how the PLA decides to integrate XR into their military services, China has thoroughly detailed how it intends to control large swathes of the XR supply chain, own the standards debate, and be seen as a leader in the metaverse. This, however, does not need to be a zero-sum game in which the United States and its allies try to crush China’s burgeoning metaverse ambitions. A better tact would be to apply Secretary of State Antony Blinken’s approach to China in which the United States “compete[s] with confidence…cooperate[s] wherever we can…contest[s] where we must.”⁶⁴ The United States should support its own XR industries to successfully compete against state-sponsored Chinese companies to prevent China from completely dominating the supply chain or the XR ecosystem. The United States should welcome cooperation with China in the international arena, begin taking leadership positions in the ITU’s Focus Group on the Metaverse, and convince China to adopt those standards within its territory. Finally, the U.S. government must be ready to contest the PLA’s cyber activities and begin shaping international rules regarding how XR technology can and cannot be used for military purposes. This may also include examining XR apps that come from China with a critical eye for the data they may collect, similar to the national security concerns with TikTok and other Chinese apps. Other activities and policies will surely fall in these buckets, but the U.S. government must begin thinking about how to engage China in regards to XR, or else risks playing catch up and implementing haphazard policies.