Inside Club Penguin and its Child Safety Program

Again a very good article from PlayNoEvil

While Kelowna, British Columbia about four hours east of Vancouver and has a population of just over 100,000 Canadians, it has 4 and 5 million visitors every month (according to some analysts) thanks to Club Penguin. I recently had the opportunity to speak with Karen Mason, Club Penguin’s Communications Director about the company, its technology, and, in particular, how they provide a safe online environment for kids.

A Bit of History

In early 2005, Lance Preibe (now CTO and lead designer), who had been working with Flash to design a safe online community for children teamed with Dave Krysko (President) and Lane Merrifield (CEO) to create Club Penguin, which launched on October 24, 2005. Club Penguin was designed for 8 to 14 year olds, but the audience actually skews a bit younger with a typical player being 6 to 10 years old. Parents and grandparents have also joined in. Sometimes they join to see what their children are doing and stay because they can have fun with their family. Grandparents and relatives have also found Club Penguin a great way to keep in touch with faraway family members or when someone is in the hospital. Most members are from the US followed by the UK, Canada, and Australia with additional members from New Zealand, Mexico, Brazil, and even Poland and Russia.

Technorati Tags: cafe.com, Micro transactions, MTX, Romain Nouzareth

Club Penguin remains privately held by its founders through New Horizon Interactive, even though there were acquisition rumors earlier in May with Sony offering $500 Million for the service (http://www.techcrunch.com/2007/05/16/club-penguin-may-be-acquired-by-sony-for-500-million/). The service has done no formal advertising, accepts no ads (the company feels that children need a safe place, free of marketing and advertising), and makes its money from subscription sales (the game can be played for free, but subscriptions are $5.95 per month, about the same as Runescape. The model is the same, the subscription unlocks additional game play features such as clothing for penguins, decorating a player’s igloo, and exclusive game areas) and merchandise from their store. There is no restricted content based on player level and player stats are private. This ensures the maximum opportunity for players to experience Club Penguin without creating a competitive environment (which also reduces the rewards for cheating).

The company has grown from 3 to approximately 100 employees. 80% of the staff are involved in customer service, called Community Support Representatives, and the remaining staff handle development, accounting, and other business functions.
The Club Penguin client is Flash-based, while their servers are, unsurprisingly, Linux-based with server development in PHP and using the MySQL database for their backend.

Protecting Kids

Club Penguin follows the privacy guides of the Canadian government and the US Department of Commerce (they have a Better Business Bureau Online Kid’s Privacy certification – see http://www.bbbonline.org/privacy/threshold.asp for a lot of useful information). Club Penguin is very up front about its privacy policy (http://www.clubpenguin.com/parents/privacy-protection.htm). The Kid’s Privacy seal through the Better Business Bureau also addresses COPPA compliance. There is currently no formal statement about the Europe Union’s new PEGI program.
Registration is done by parents, not just the child that wants to play. The registration process includes an email to the parent to confirm the child’s ID. Since a kid that wants to play and develop a penguin will also want to get a subscription, they are unlikely to “cheat” the registration process.

The Club Penguin team will be launching an “Egg Timer” shortly to add parental controls on the time that their children can play Club Penguin.

Club Penguin started with a fairly typical strategy for protecting communications between young players. They have a menu-driven chat system, called Ultimate Safe Chat, which restricts the players to a list of words and phrases that can be easily assembled to express virtually anything that needs to be said in the game.

They also have a second mode, Standard Safe Chat. This more flexible chat application is very interesting and differs a bit from some other children’s online communication services. First, unlike Disney’s Toontown, it does not require a Friend code, so it is as a default more permissive. Like most other such systems, it uses both filters and human monitoring. Club Penguin implements filtering in an interesting way. If anything in the message is forbidden, the entire message is blocked. The philosophy is to give kid’s positive reinforcement for good behavior. The message looks like it is being sent by the kid who created the forbidden message. However, the receiving players see nothing and therefore won’t respond. Also, since there is no “partial data” sent, there is no information available to players who want to circumvent the system.

Club Penguin’s system filters for “inappropriate” language, but also for information that may be of use to a predator. For example, the word “Mom” will cause a message to be filtered as it could include information about whether the player is home unattended. It is probably increasingly easy to manage this filter system. I suspect the system has both a “white list” of OK words and phrases as well as a “black list”. Then, when anything that comes up that is not on either, it is time for human review. This way misspelling obscenities and other devious behavior can be efficiently tracked and trapped. The longer the system runs, the better these filters will get.

Club Penguin Monitor Button

Club Penguin has two additional tools to help protect its players. First, there is a big “M” button available on all of the play screens to notify a moderator if anything is awry (or ask questions). Second, there is the Secret Agent program. In order to become a Secret Agent, players must pass a test to enroll. The test focuses on being a good Club Penguin citizen. These players help the other players with the game and act as a sort of “Neighborhood Watch” - acting as yet another layer of defense.

The result of this array of technical systems, procedures, and support by the player is that there have been no reports of predatory behavior since the game’s launch.

Cheaters and Consequences

Club Penguin has had some security problems, however. Players have used tools to cheat at the game to gain unearned points and items. The vulnerability comes from Club Penguin using the very common design approach with Flash games – having all of the game logic and scoring computed on the player’s computer. Malicious players then use memory editors and network sniffers to modify the items they earn and the scores they achieve. It would not be surprising if malicious players also attempt to attack the game’s database through malicious SQL queries.

The development team has taken this seriously. They monitor points earned for impossible and impossibly good results. An interesting innovation is the use of “honey pot” items. These items show up in the item catalogs, but they are inaccessible through proper game play. Therefore, if any player’s inventory includes one of these items, they are busted.

Club Penguin faces two problems that they share with all other online games: bullying and “false cheat” scams. Bullying or griefing is found in games for audiences young and old. There are no magic solutions. The aggressive program to protect against predators also does a good job of rapidly catching bullies.

“False Cheat” scams are a growing problem. Malicious individuals or criminals create and publicize a “cheat” against the game. Typically, these cheats don’t work, but they do require the unsuspecting player to register with their user names and passwords. The thieves then steal and sell the accounts or loot them of all of their items and sell them. Children are particularly vulnerable to these attacks. They are tempted by cheats, but don’t know to protect their account information. The Club Penguin team does regular surveillance to find web sites and other locations where these cheats are posted to take them down. In this regard, Google, Youtube, and other search engines cause problems for online game operators.

Club Penguin uses bans and suspensions to manage unruly users. Suspensions are used to warn players who make minor infractions. Impressively, the proportion of bannings has dropped as the service has grown. Unlike a lot of online games, Club Penguin benefits from having fairly a strong identity relationship with its user and real “Mom” can be a powerful deterrent.

Club Penguin has worked hard to meet the unique needs to protect children in an online environment. It seems that security has been carefully considered in every step of the businesses design, development, and operation. The founders of Club Penguin didn’t just see security as a requirement, but instead as a way to build a relationship with both its players and their parents. In doing so, they brought millions of happy penguin immigrants to a small Canadian city.
PlayNoEvil Game Security, Game Cheating, Gold Farming and RMT New

Comments

[Lutz]

Hi Romain,

I have been trying to reach Gabe Zichermann. He contact us in regards to buying our domain name about a year and a half ago. We have had several offers to sell it from various devlopers, game portals and game publishers. I am going to sell it. I just wanted to see if you had an interest in it and if so call me ASAP as we have several strong offers and will make a descion soon. We added a flash game site on our site and in less than a month have had over 100K games played and thats whta got peoples attention. If you are interested call or email me at 336-956-0223 or sales@arcadegames.com

Thanks,

Lutz

[Lutz]

it would be a great way for boonty to really break into the gaming market in the USA as everyplayer here nows them as "arcade games" our traffic is direct traffic with over 100K unique URL's / month.

Lutz

[I Hate People Who Hate CP]

I love club penguin its awesome game im a member

[Play games online]

Hey, you didn't wrote the URL. Where to go? All began with playhousedisneychannel and then AllFun, a FREE fun games for Anyone to join, & play their favorite games online. I hope ClubPenguin could be the next family action with my daughter. Thank's

[Trinca]

good posting

[Rojario]

I think creator of it has taken on tight word filters on chat programs. What I like more is that the filter blocks any sentence that contains offensive words. No one gets abusive there. Actually I have learnt many things in online safety looking at how the site operates.

[disney merchandise]

this is so good.
disney merchandise store movies dvd