Rajesh Mirjankar of Kiya.ai on metaverse policing, KYC, regulations, and privacy

The year 2022 is turning out to be a year when brands, consumers, gaming companies, artistes, the M&E industry, and practically every sector has started building a significant presence in the Metaverse. The advent of 5G is setting the path to the Metaverse, according to a study by Ericsson. The study reveals that 5G users on average are already spending one hour more per-week in Metaverse-related services than 4G users. They also expect two hours of more video content will be consumed weekly on mobile devices, 1.5 hours of which will be on AR/ VR glasses by 2025.

However, with this growing presence in Metaverse, there are a whole lot of concerns and questions that are begging to be answered. These include the lack of regulatory clarity, the policing of Metaverse, privacy laws, cyber security, etc.

In this interview with Adgully, Rajesh Mirjankar, MD and CEO, Kiya.ai, dwells at length on these aspects. According to him, policing of the Metaverse is necessary. He feels that when it comes to business use of Metaverse, there will be KYC checks; otherwise, the standard cyber laws will be applicable to Metaverse in any country.

“Cyber security risks is the same as what is perceived in the current web, but the Metaverse will be geared strongly to deal with it because there would be blockchain technology so tokenization is native to the platform,” he says. Excerpts:

One of the challenges is that most countries lack regulatory clarity with regard to Metaverse as a technology. Is this aspect impeding its growth? Are there any global examples worth emulating in a regulatory framework?

There are a few countries that have adopted metaverse earlier than others. Some of them are Korea and China, and recently Dubai put out a very clear outreach in terms of promoting thousands of jobs. From a regulatory standpoint, the China-based regulatory framework came out was on the antitrust.

So, if we were to look at metaverse as a platform, to achieve social networking and two, to have goods being sold, which is in the case of NFT, and the third being, conducting a financial activity, like banking, etc.

When we look at these top things, what comes to my mind are one that there will be regulations to know who is at the end of the avatar; so there will be a KYC to be conducted, the second part regarding data privacy; if we look at European regulations around GDPR, it is pretty straightforward where whoever owns the metaverse they can or should not retain customer data.

There is the decentralised metaverse, and then there's the centralised metaverse, and there are pros and cons to each of them. When you look at the maturity of metaverse today, I would split it into two concepts. One is what I would call the GAMING VS, which is typically around games and a lot of people are attracted to it because they do want to play games and that is the virtual worlds that they transit into. But when you look at through a sense of how adoption can happen across the board, minus the hype of being the third generation of the web, then you need businesses and citizens to come on board for reasons other than gaming and into business. So our focus as a company was to look at building a business metaverse and not one that is based on gaming.

What we foresee is that the regulations will be around what is currently governed for the normal being, such as using KYC norms, data privacy, cyber security, etc. So these things would be clearly adaptable. Other than that, antitrust does make a point because the whole concept of metaverse on a Web 3.0 architecture is to say that metaverse is the biggest thing and governs everybody centrally. It will be multiple metaverses that operate together.

For experiencing the immersive nature of metaverse, one has to wear VR headsets such as Meta’s Quest, which are costly. How can we overcome issues like the low VR penetration and other challenges that are impeding the growth of metaverse?

We have seen that a lot of firms are now coming out with their own VR headsets. When we look at this fact, we can see that the cost of VR headsets is coming down. But the important part is to understand that metaverse does not necessarily mean having a VR headset. For example, with gaming you have the ability to operate them on mobile phones, desktops or laptops, and also headsets like VR, augmented reality headsets, WMR and mixed reality headsets. There are companies like Jio Tesseract, who will come up with their own version of headsets.

I think within the headset world there is a lot happening which will turn around in the next six months to two years when we will find different kinds of headsets. It's about saying how immersive and cheap they are. I don't think the cost is necessarily the issue, because, in terms of acceptance, India has about 350 million smartphones in play and there is UPI or any other payment mechanism or even WhatsApp as a mode. Now sooner you will find the other sort of messaging mechanisms that have come on over the 3.2 architecture. The cost of a smartphone is comparable to what a VR headset is from an average cost perspective. So, in terms of business use cases increase I'm sure people will find a good reason to buy a VR headset. At the moment, because it's perceived to be limited to games, that is where somebody with a business would not have a need to buy a VR headset.

What we are doing at Kiya.ai is that we recently launched the BharatMeta, where we for the first time had India’s tricolour hoisted on the metaverse. These would be all business reasons where you would have aspects such as banking, financial services, and public services, all of these coming into play, and then you will have wider acceptance.

Does metaverse need policing? If so, who will police it? Or will metaverse be an open and collaborative platform, just like the internet?

Even if the internet is an open platform today, there are cyber laws to police content on it. Whether it is the content policing done by the firms that own that particular portal or the cyber laws that justify what you can and cannot do on the internet. In my belief, metaverse will have the same standards because at the end of the day, what is metaverse it is the new version of the web where you have three 3D visualisations of avatars, and are able to interact with each other. So it is an advanced, social interaction, whether it is more business or gaming. But policing is necessary, individualization of identities where you have background checks done.

When it comes to business use of metaverse, there will be KYC checks; otherwise, the standard cyber laws will be applicable to metaverse in any country.

How regulations will apply in the metaverse is another pertinent question. Will we see metaverse-focussed privacy laws being passed by governments to deal with transactions/interactions happening in the metaverse?

There are two aspects to consider here. When we look at the metaverse what is typically spoken of is the concept of NFT, and when we look at what is happening in the NFT world today with regard to it being similar to what was seen in crypto is that you have some good valid players who've got a strong business as well as good technology whereas those who make a fuss.

That same thing applies to the metaverse where if someone was to go blindfolded back into the metaverse and rely on the content spoken by an Avatar and make prey to financial fraud. It is same as it is applied to the current Web 2.0 architecture. But what’s slightly more important is that here these identities from a decentralised mode could be somebody owning their own data and running that. So, I guess if the control is placed better on the fact of who's behind the Avatar, and those then being encouraged to come on for social interaction platforms, we will see the lesser issues for different privacy laws being placed. 

Otherwise, the standard laws of what applies to the current web can be applicable to the metaverse. One change that will be there is that when we look at the standard metaverse, the standard web as of today, the dealing was with conventional currencies and payment modes where tracking and regulations are there on that front. It comes back to the point that there will be a need for stringent measures on cryptocurrencies or NFTs on how they are transferred and are traceable in case of a criminal incident. That will be the whole point to be addressed.

In the case of our metaverse platform, our base is the fact that we are encouraging social interactions and being able to conduct business using that particular virtue, rather than saying that we need crypto to be able to enable this. We are not looking for the need for game coins as there are other metaverse where they believe that you need to have their own game coins to conduct transactions. Whereas here we've said that there is central control or that is not pure web 3.0. But the fact is that that's necessary to be running a business which is safe and regulated. So that's been our approach to go in a phase-wise manner. Whenever CBDC come in, that's when we chose to say that we will go with the appropriate adoption of the so-called blockchain-based cryptocurrencies, which is a CBD rather than private currencies.

With an amalgamation of tech needed in the metaverse, cybersecurity risks might increase with hackers devising new methods. What else will be the other potential challenges?

Cybersecurity is a potential challenge for the metaverse pretty much like how it applies in the current context, even more so because when you see others who you can't recognise, but who can still influence you more than what is there on the standard web; that's a key concern. There has to be a model of education that has to be given to users that if you're interacting with somebody on the metaverse, appreciate that their influence on you is far more than what is in the standard web. Hence, there is a need for establishing the identity of the person with whom you're talking or socially interacting.

Cyber security risks is the same as what is perceived in the current web, but the metaverse will be geared strongly to deal with it because there would be blockchain technology so tokenization is native to the platform. Card transactions today are becoming more secure because of tokenization. This is something that is guaranteed in case of say metaverse. At the same time, the key concern is that the cyber security around crypto-based NFTs today is what are the smart contracts behind those NFT's in terms of taking up ownership. And hacking of those smart contracts is what probably has resulted in the large losses of over a billion dollars from July to at present. There is a need for audit standards to come on smart contracts and say they are okay to go as managing financial transactions. That is an important aspect that probably needs to be covered to prevent cybersecurity risks.

The other challenges are in terms of data privacy as you're doing social interactions with people, how the data is used, how it is managed, and whether the metaverse platform has its own compliance to privacy policies like GDPR and other local regulations on data privacy is an important aspect to consider.

When people accept conditions to join a metaverse platform, it is important to know that not all your activity is being tracked for commercial use by the platform owners. That would be something that's necessary.