 Okay, so this talk is by Rich Metson who will be talking about off-grid, a game about circumvention tech and hacking. So enjoy. Hi. Hi. Thanks for coming down, or coming in, or getting out the sun, whichever it was. My name's Rich. I'm making a game called off-grid, which I will just launch slides for now. Can you see that? Great. Okay. Well, as I mentioned before, I'm going to tell you about a video game that me and another guy I've been developing called off-grid. It's about hacking, data privacy, and circumvention tech. There's quite a few people from London Hack Space and who are usually dotted around EMF that have known me a little while and known that I've been working on this part-time for quite some time. So why now? Why come to EMF to talk about it now? Well, earlier this year we managed to complete enough funding to secure our alpha release and work on it full-time, so should be releasing the game sometime early next year. But without further ado, to give you a little feel for what the game is like, I'll show you a bit of the animatic intro and the demo of it. So hopefully the demo gods are with us as well. This is going to be slightly trickier because I've got to be able to see this to click on it. Tell you what. Apologies, folks. This is not very good of me. Yeah, can I try extending the displays after all because I thought I might be able to keep my eye on this screen from down there? Okay, we can try that. Sure. This might work. Can you see that? Great. I think so. I think we might be okay. Can you hear any sound is the next question? No. Well, there we go. We've got a little bit of sound. Okay, so if we can turn that off a bit. Coming. There we go. Hey, Dad. Come on. I'm hungry. Yep. Coming right up. I got you something. Happy birthday, Pop. Oh, wow. I know they're not the fancy ones, but the OS is open source so you can pretty much load anything onto them. Yeah. Oh, and look, I set up all your favorite apps. So if you turn on Bluetooth, they'll come right up. Bluetooth? Yes, I see. Yeah, just push right here. Oh, okay. I see. Geez. You mean the world to me, darling. Jen Harman, you are under arrest. Please do not resist. There's been a mistake. What are you doing? Jen, I'll sort this out. Stay back. This is a national security letter. Under the Official Secrets Act, it is here by a crime to talk or communicate about this incident. Your daughter will be in processing for 90 days. We'll call you. Okay, so Off Grid is set in a fictional world, or at least it was when we started making it in early 2013. It's a game about net neutrality, privacy, digital rights, but with a little bit of a kind of British black humor irony kind of running through it. It deals with sort of the fear of technology and that kind of thing. And we're hoping it's also a relatively nice step away from the kind of tropes and crutches that agriculture is usually rested on in mainstream media. So you the player have to dive into this world that you've got no understanding of. You play a kind of a complete technophobe whose daughter's the master of this kind of thing. He usually looks after him. And essentially some of her friends, once she's been disappeared, get in touch with you to try and help you skill up and work out how to get her back. So I'll skip this bit. So here we go. Next thing is will the frame rate be okay on this big screen? It's okay. Okay, cool. So yeah basically we wanted to make something that was kind of satirical but not too far distant in the future. And we started in 2013 and I've had to kind of put some of our crazier ideas back in over the last two years in terms of how surveillance states have kind of actually got a grip on all of us and how the Internet of Things seems to be something that everyone with a little five pound Arduino wants to stick in a teddy bear or whatever else. So we've made the game essentially where this set of hackers get in touch with you to try and get you to work out what's going on. And although the frame rate is horribly jaggy on this screen, you can sort of see that you have this data view that gives you the ability to get onto different networks and get to the different bits of data around it. So I'll take a quick step aside and go back to my presentation quickly. Can you see that? Cool. So as I said, we wanted to do something that wasn't too far in the future. In 2013 we had this kind of wacky idea that we could do a Theresa May-esque villain who was the leader of the state and absolutely hell-bent on safety for everyone. I don't know how that came about, but it did. So yeah, consistently along the way we've held off of being too out there and actually as a designer I'm now trying to reel back being out there because the world as a crazy place is actually running faster than our own fiction could. To me, a lot of it sort of seems like it's run in the direction of Terry Gilliam's Brazil. I mean, from the perspective of lots of underwhelmingly implemented technology prevalent everywhere, toasters that pour coffee on your breakfast, air conditioning vents that stop you from leaving the house type thing. We originally thought that making all the devices in the game connected to the Internet of Things was just so crass and so ridiculously futuristic that people wouldn't believe it. But lo and behold, the real world outpacing us. For instance, slow-cookers running Linux because hackers need BBQ beef to be able to SSH into. So the original notion was to make a game about data privacy and the modern world means that that means by default trying to cloak or hide yourself online or even not interacting in a way that produces data. Our thoughts from a game perspective were hiding, covering attracts, reducing visibility, then let's make a stealth game. And let's put a twist on it using kind of the traditional hacking genre, but let's place it in 3D and physicalize the data. I'm actually going to switch over again because I can't hold both. Make the data into a kind of physical breadcrumb trail. So understanding privacy and vulnerabilities and the ultimately surveillance circumvention seemed to us to be something people had a hard time grasping because it's invisible. So we hope making data physical would help with that as well as make for good game mechanics. At the time it seemed like an obscure subject, and I am talking about at the time that we first conceived of doing this in 2013, then overnight we were actually showing one of our first very rough prototypes on a little game stream with a Guardian journalist, and that same week Snowden broke his first leaks. And it became something that everyone in the main public was aware of. So essentially we wanted to make a game that doesn't preach the converted but actually explores these issues to the wider gaming public. So I'm sort of speaking to the choir here, and I know that most of you guys are probably shaking your heads at these kinds of issues for quite some time longer. Off-grid is an opportunity to take those abstract concepts of data and privacy and manipulation and social engineering and physicalize them and get the player to explore on a very basic level some of the infosec techniques you can use to navigate that world safely. In our view, and I think in most people's view, experience something is better than being told it. So to some extent we want to give players the opportunity to vicariously experience being totally surveilled, although maybe they've already got a feel for that, and invading the privacy of others to try and realize what it would mean in their real lives. And who knows, this could also be a way of engaging people to take a step towards trying out what can be a very intimidating set of tools when it comes to things like PGP or TOR. But as a TLDR, basically we wanted to make data real and something you could play with. So the basic level structure kind of goes like this. Gain access to a building, then scan the network to gain access, crack or socially engineer your way into different levels of the networks in the building. Use the personal data you find on those networks to manipulate the behavior of NPCs to move them out of the way and avoid discovery, essentially pranking and spoofing in increasingly funny ways. You kind of playing chess with the NPCs using their data. Then your main target objective in each level is to expotrate some kind of sensitive data on some of the machines in the building to help build an image of the case against your daughter and why she might have been disappeared. And then get up to the roof, set up a mesh network node and leak the information across the network, because in this fictional world the idea of an open internet is an increasingly distant memory. And finally, don't get caught. So we wanted to set up sort of a tour onion router like mechanic where you as the player had to be careful in what way and how many times you access the networks so as to avoid being traced. We started with the basics of needing to essentially clear your logs as you move through the environment. And this has evolved into simulating all of these networks in a more realistic manner. And so we're hoping to build it up so that you sort of scan the environment with a showdown style app or an API call that exposes the open ports on all of the Internet of Things objects around the levels. Anything left with its default password, anything like that and connect to those different devices by tagging them. Each device that you find and tag, you could build up a proxy chain and so extend the amount of time that you can sit in the network without being traced back, which gives you more time to do fun things like hack. So essentially finding and owning vulnerable devices extends your powers. And I put in comical laugh, but maybe not. Right, so you've got a set of tools that give you the ability to see this data as you can see in the lower left hand corner. And you basically, you can see the bread crumb of data that other characters are leaving behind. Data is actually generated by characters personalities. And we've kind of integrated an upper layer of Lua scripting. So previously it was actually XML, but each AI is driven by a kind of personality that defines his behavior and therefore how he can be pushed in different directions with different pieces of data. Each device you gain access to can also receive this data and be manipulated. So data can have an effect by modifying a device's behavior based on what it's received or modifying that data and using the permissions that device has within the network to send it onto somewhere else, aka another device that you didn't have access to before. You then use this to find other data that contains passwords, keys, private information, hide your own data, and move your adversaries out of their usual patrol routes so that you can sneak through the levels and get to your goals. So essentially, collecting data is the name of the game for all of the above reasons. For instance, on a character that you need to gain access to, you should be able to collect their data and build up a kind of profile or a contextual map of them and then use that as a dictionary to speed up the time you need to brute force their passwords on machines that you've identified of theirs. But just collecting interesting data and sending it to an NPC can have an interesting effect, too. So why would that be? Well, I started to touch on this idea of NPC AI having these behaviors and personalities that drive them. The reason that's interesting is we've implemented the version of Go app, which is goal-oriented action planning for our AI. It essentially means you can throw new actions at the AI and they will find the best way to use those actions in order to get to their objectives. This allows us to kind of throw quite interesting things at AI on the fly, and they will either do interesting funny things or silly things or fall over or whatever else, which when you're making a nonviolent game about manipulating a character's behavior, it's quite useful. Potentially, we may even be able to move some of the elements of the AI over to Lua, so that the players and the modding tools that we're providing can write their own behaviors for the AI as well, but I'll get to the modding side of it soon. So to summarize with some examples, we've started making fun little hacks in the gameplay, like sending soda machine ads to a guard whose profile describes him as a caffeine addict to distract him off route. Exfiltrating, compromising personal data from a guard's phone and sending it to the printers or the TVs nearby to make him rush and blush. Scanning a smart TV, listening for voice commands that accidentally picks up the head of IT's conversations, storing admin passwords in the clear. Turning smart light bulbs on and off, and then remotely turning thermostats up to 38 degrees to cover body temperature so that you can move through a dark room without the thermal cameras seeing you. But we're hoping that the players will be able to find you in interesting ways to chain these data and device interactions in complex and hilarious ways. And from there, the amount of interesting things that anyone can do, actually, it grows quite exponentially by the time that you think of how you can chain things through different devices and how, as I'll go on to say, the modding side of it will allow quite a large expansion of that. And quite frankly, the mind boggling growth of the ridiculous things in the IoT sector means that there's quite a lot of ground for game design by players and modders alike. So as I was saying, importantly, and probably most importantly, the main idea is that we want players to tell their own stories through data trails and hidden information and create new and interesting items and hacks in order to make discovering these things even wackier. We spent the last several months funded by the UK Games Fund to make the game moddable. So we're using Unity, which if any of you know much about game design or no game designers or a fiddle around yourself at all, it's become a go-to tool for small teams. We're actually kind of on the cusp of things because we're using Unity's streaming assets to use the Unity editor as a level editor. So you can distribute asset bundles to players and they can build their own levels within the full-engine tool set and then send them back to the game and play them. So yeah, more on that in a bit. The data points in the game all carry Lua scripts and that affects data receiving devices. Many objects in the game are essentially basic Lua machines that can respond with different calls from the Lua API. So the devices are quite extensible for players or modders interested in writing Lua scripts to make interesting things happen as well. So that doesn't just mean making levels and missions. That actually means writing new apps and new data types and therefore making hacking apps and tools in the game that can do things that we as developers never really were able to think of and wouldn't have been able to think of in a million years as if any of you are in modding communities, usually modding communities, wow, the developers week after week. So we're hoping to see player invented devices, data types, tools, apps and hacks and of course levels and missions to be filled with all of the above. We'd sort of like to be the sort of South Park of data privacy video games. So if you can think of that as a concept, essentially every time something new or interesting happens in the infosec world, we'd like to see levels turned around that week. So when Julian finally gets out of the embassy, maybe we'll see it in off grid from an ingenuative modder. So yeah, the other thing being I have a new design tool. A brief stint on a well-known but slightly rudely named Twitter feed can do wonders for your mod ideas. And I've come up with a fantastic new technique. Take two IoT products, add them together and you have a perfect trap in off grid. There's a treasure trove of crazy data puzzles out there that will hopefully enable the creation of the sublime and ridiculous. I'm looking forward to seeing off grid players make attempts at possibly some of these suggestions. So maybe setting poker stops in a location and overloading the IoT air fresheners next to it. So as the guard bends over to collect a mon, he gets gassed in the eyes. Combining Bluetooth phone gloves and vibrating pelvic floor training shorts so that pranking a guard's phone is extremely distracting. And this one has already done all of the exercise for me actually. This is a real product. Hacking the happiness of a foes health tracking Tamagotchi drinks bottle so that they have to spend the majority of their shift at the water fountain pleasing their little digital friend. But you know, this kind of thing, I mean, I only started really digging into some of the craziest IoT stuff out there recently. And I think we're going to continue to be flabbergasted by this kind of thing. We're already seeing public systems that take control of entire rooms, for instance. But you don't necessarily think about who they're made by. So here we have two flavors of the same system made by rent a kill. You probably guess what they do. One tracks the pest control traps in a building, which you'd expect is they're probably their bread and butter. The other is installed in public toilets to track and alert if people don't wash their hands. Which, you know, as long as they don't get any wires crossed, I'm sure is fine. But surely in a game like off grid crossing those wires could create quite a lot of fun. OK, well, I'm actually closing in on the end of this presentation. So thanks for coming and listening and giving me a few laughs when I attempted to drop jokes. And, yeah, this is me. I'm rich at some AEPUS or rich metson on Twitter. You can check us out off grid the game and please do. If anyone has any questions, I don't know how much time we've got. Cool. Great. Well, thank you very much.