We Learn About Account Security with Club Penguin

Club Penguin is a big deal in the second grade.

It is the online game of choice in my daughter’s class in any case.

My daughter has been playing the game off and on for a couple of years now and has gotten for various birthdays and such, a small collection of Club Penguin toys, each of which comes with a code for an in-game item.

With her invested in her penguin, I was surprised to see her logging on the other day with another account.  I was also a little annoyed, because the new account violated one of the online game rules I had set down.

I have long stressed that she is not allowed to give out any personal information online at all.  The list of things not to be shared includes, but is not limited to:

• first name
• last name
• age
• city
• state
• phone number
• email address
• school
• account ID
• password

And so when I saw her new penguin in-game had her first name, I had to step in.

The first thing I wanted to know was what happened to her other penguin.

After some running around, whining, and general attempts to avoid the question, it came out that her account had been banned.

And not just banned, but BANNED FOREVER!

And then the inquisition really began.  There were tears and pleas and somebody was banished to her room until she was ready to talk.

(Trivia: my daughter spends almost all of her time in the family room of our home, so being sent to her room, where she basically sleeps and throws clothes on the floor, is an effective punishment.)

Eventually, I was able to piece together the tale.

One of her classmates had told her about some special hat that was available in Club Penguin, but which was difficult to obtain.  He offered to get this hat for her penguin if she just gave him the account and password.  And she did it.

Then something happened that got the account banned.

Details on what exactly occurred, what with one 8 year old making up tales for another who was then trying to convey the whole  mess to me, were pretty fuzzy.  There may or may not have been an older cousin involved who may or may not have forced the classmate to hand over my daughter’s account and password to him.

It was time to contact Club Penguin.

I will say that the people at Club Penguin were pleasant and responsive and even, dare I say, sympathetic to my questions and concerns.

The representative with whom I exchanged a series of email messages did confirm that the account had been perma-banned for use of inappropriate language.

That seemed unlikely to be my daughter’s activity, little house censor that she is.  My wife and I are scolded if we watch any television or movies that contain swearing while she is awake.  I can’t even get away with playing “Pretty Fly (for a White Guy)” on RockBand just because it has one swear word in it.

The rep also provided me with the exact times and phrases that were typed into the game that lead first to a series of 24 hour bans and then then final perma-ban.

That, and the actual phrases used, helped confirm, in my mind, my daughter’s innocence.  They all occurred late in the evening, long after her bed time but when my wife and I are generally still up and about.  Since the computer she has access to is sitting out in the family room area, we would have noticed.

So what to do?

The Club Penguin rep said that I could call up their support center and, if I claimed that my daughter was an unknowing victim and did not type these words into the game, I could get the ban lifted and her account restored.

The part of me that cherishes the role of “Daddy, all knowing computer guy!” liked the option.  Once again I could swoop in and save the day.

On the other hand, I had warned my daughter on numerous occasions about not giving out account names and passwords.  To restore the account would remove the sting of the event and would not encourage her to take care with her account and password in the future.

Teaching something about personal responsibility had to win out over my own desire to always be a star in my daughter’s eyes.  Not an easy choice.

My daughter took this all better than I thought.  We’ll see if she learned her lesson.  Some tears were shed over the items she lost by losing her old account.  But we went and made a new Club Penguin account for her that did not include her real name as the character name.

My wife, eschewing my plan to play out a Hitchcockian  scenario with the kid to whom my daughter gave her account and password, a scenario that I was sure would have him confessing but which, I admit, had some flaws, went and spoke to the mother of said child armed with the times, dates, and phrases used.  What happened to the classmate after that I cannot say.

And so life returned to normal.

However, two things still bother me about the whole situation.

First, to create a Club Penguin account, you have to give an email address.  It is supposed to be a parental email address, but I am sure kids skirt that issue regularly.  I fear the day when my daughter discovers just how easy it is to create a fresh Yahoo or Gmail account.

Not once during the series of banning or at the point of the final, permanent ban, did Club Penguin send any sort of notification to the email address associated with the account.  When I asked why I had not been sent any notification, I was told that Club Penguin does not bother, since the email address could belong to anybody.  They only send information when they have established they are communicating with a parent.

I did not quite follow the logic of not bothering to send email warnings to follow up a ban.  If nothing else, it would have immediately alerted me to the situation rather than letting things proceed as they did, with somebody logging in every third day for a couple of weeks and getting the account repeatedly banned until it was made permanent.

In fact, part of their argument for the permanent ban was that she should have gotten warnings about the whole affair and thus could have changed her password in time to avoid the final ban.  Except that my daughter wasn’t really playing the game, she ebbs and flows on the whole thing, and no warnings were sent out of game to the associated email address.

But this lead to what I would consider a larger concern.  Here I was getting all this information about my daughter’s account, and all I had done to establish that I was the parent was to say that I was.

I did not even write from the associated email account.  I just said, “Hey, this is my daughter’s account, why has it been banned?” and they were ready to pass me all the information I wanted.

Well, they didn’t give me the password, nor any sensitive identifying information.  But their own statement was that they wouldn’t give out anything at all until they had established they were communicating with the parent of the child concerned, so I am not sure how they accurately established that I was the parent.  The use of multi-syllable words correctly in a sentence perhaps?

A somewhat unsatisfying experience with Club Penguin.

And after all of that, my daughter lost interest in the game yet again.

Still, I think she’ll hold onto her new account name and password more closely from now on.