Duping (and sploits)

A couple of postings by Ted and Jools and the fabulous comments therein have got me wondering. So the question of the day is:

Is duping legal and is it ethical?

On the legal front, I wonder whether there is anything in any law that covers it. It's probably not going to be a computer trespass, and I'm not sure that it's gonna be fraud (though I'll probably do some thinking about this and post a response to myself in comments).

But I suspect that the more interesting question is whether it's ethical. To play Duper's Advocate for the moment: if the developers are too lazy to guarantee unique ids for all objects in the worlds then it would be impossible to dupe (of course there may be technical reasons against this). Any duping is, therefore, a consequence of the developers' malfeasance/negiligence and therefore dupers are doing nothing wrong by exploiting it.

As for fedex spolits, well that's just arbitrage isn't it? We allow foreign exchange traders to sell US dollars in, say, Germany to gain the arbitrage benefit. What's the difference?

Hmmm.

Comments

[Bruce Boston]

1.

Hook, line and sinker, this fish goes for the bait:

I'm going to go ahead and start with the assumption that true duping, i.e. exploiting a bug to manufacture unauthorized items, or to counterfeit currency, is both unethical and illegal.

"too lazy to guarantee unique ids for all objects in the worlds"

I think we have to assume that there are very few games that are not backed by investors. To say that investors should have invested several million more to ensure that the game was bulletproof, is like telling a local shop-owner that he should have invested in high-density Plexiglas and since he didn't it was OK for local kids to break-in and sneak a few cases of CDs.

At some point, business owners need to be assured that their investments will be secured, by threat of law, else the public on whole will loose access to a number of businesses due to the escalating cost of entry. Businesses and homes in the real world, are able to use inexpensive, very unsecure common glass as a building material for both aesthetic and functional purposes because of the threat of law. No one thinks twice if it is a crime to throw a brick through a $40 window, so why would it be so different when someone throws a script through a multi-million dollar software system?

Again, I'm no lawyer but I would think in the cases like SB where they are going to have to write-off investments in intellectual property and customer good will, that there may be a classic Tort case for damages against the cause of that loss, and if that cause where to be linked directly to dupers that a jury could be convinced that those financial losses should be restored.

If we were to say that everything that is possible is both legal and ethical what purpose can law possibly have?

[Dan Hunter]

2.

Interesting observations, Bruce. A couple of responses. First, I'm trying to work out the importance of the degree of care taken by the company to protect its software. This is presumably important for negligence (which you correctly identify as an approach that the developers could take) and will be a question of fact.

But I doubt that developers are going to want to use tort law to stop this kind of action. They probably want to use criminal law, and I kinda doubt that this is going to apply.

As for the ethical stuff, I'm somewhat reminded of Julian's response to my earlier posting on his fencing of (legally? ethically?) stolen assets:

http://terranova.blogs.com/terra_nova/2003/09/cr1m3_and_no_pu.html#comments

The developers allow it to happen, so...

[Edward Castronova]

3.

In my mind, I'm getting more attracted to the idea of distinguishing between worlds conceived strictly as games and worlds conceived strictly as non-games or part-games. A world needs to do certain things to qualify as a game - it has to rope itself off from the world, for example, and it has to ensure that the things that happen in it have no moral consequence. That takes hard work on the part of developers. Let's say they get that work done. In that case, duping isnt illegal, but it does violate the rules. Violating the rules of a game is unethical.

If the world is not a game, then one could get into posisble legal implications.

Regarding fedex exploits, they are a wierd case. Yes, they are arbitrage opportunities. In the real world, we like people who take advantage of arbitrage opportunities, but they reason we like them: their actions eliminate arbitrage opportunities. Buying low and selling high raises and lowers prices in the respective markets. The funny thing about fedex exploits is that there are no price movements, so the arb-op never goes away. That colors the working of arbitrageurs in a different light. Things would be better if fedexc exploits moved prices in a logical way, but... that would require that developers put as much time into the economic AI as they do to the combat AI. You know, in combat we see these complex coordinated armies of robots who, you know, charm, fear, used ranged weapons and so on, all within some complex subroutine or other. Meanwhile, merchants buy unlimited quantities of Good X at Price P. ?

[Julian Dibbell]

4.

Dan, you 'sploiter-loving weasel:

My argument was that stealing virtual items according to the rules of the game was no more illegal than bluffing in poker. Breaking the rules to get items, which is what dupers and exploiters do, is also not necessarily illegal, but it's definitely cheating. And there's just really no way of defining cheating so that it comes out ethical.

There's a further dimension here we haven't really gotten into. MMORPGs are such complicated, open-ended games, with such deep, emotional investment on the part of some players, that it's worth asking: Even if stealing according to the rules of the game isn't cheating, is it still ethical? If you have chosen to role-play a thief, you have basically chosen to hurt people's feelings. Is that your bad? Or is it up to your victims to lighten up? (Cf. "A Rape in Cyberspace," etc. etc.)

[Bruce Boston]

5.

PvP in the Courtroom?

So here is the next question… Might it not be possible for non-dupers to make a case against the dupers? I think until yesterday I was always assuming that it would have to be a Developers vs. Dupers struggle, but if we are going to assume that the public, more specifically, the in-world community is truly the victim of the reckless negligence of the dupers, is there any reason that the Players themselves couldn’t appeal to the law for recompense. Clearly, Players had a contract with the developers at a specific price for the development and maintenance of a “Persistent World”.

If non-Dupers were going to take Developers on the face value of their word and assume that the Developers were not able to fulfill their contractual obligation due to the interference of the Dupers, could we also then not say that damages due extend to the non-Dupers themselves. And while the losses of any one Player may not be significant , surely when combined, they become quite a number. In fact, are not the inflating costs of trying to create a bulletproof system going to be borne by the non-Dupers?

Just from a perspective jurist point of view, I think it might be a pretty compelling case. People hate cheaters, and who better to define who is and who isn’t cheating then the players themselves. Clearly non-Dupers could better explain the ‘implied rules of conduct’ within the community with much greater passion than a developer could. Non-Dupers would also be free to call developers as witnesses to explain how many millions of dollars were spent in the development and protection against dupers. With sites like Exploiter.org “You create Worlds, we destroy them” clearly non-dupers that have seen this pattern over and over in a number of worlds could detail the pattern of activity of dupers. And also equally as true, unless non-Dupers appeal to the law they will never be able to find a contractor to build the “Persistent World” they long to be part of.

Besides, there are pretty good odds that any jury these days would have one or two gamers on it as well.

[Dave Rickey]

6.

If I could make perfect facsimiles of US Federal Reserve Notes (US Dollars), couterfeits so perfect even the Secret Service and US Mint couldn't tell them from the real thing, would I be any less guilty of counterfeiting? I don't think I'd get very far in court with a defense of "They should have made the bills harder to counterfeit."

That being said, the only really effective solution to the duping problem is to fix the system so that players can't dupe, and pursue those bugs aggressively whenever they surface.

Arbitrage is taking advantage of fluctuations in different markets to make money, in the process linking the two markets and eventually effectively making them the same market. FedEx exploits in system that lack the ability to recognize that they've been linked doesn't have much in common with arbitrage. However, it is possible to explicitly make this part of gameplay, We're doing something like this in Wish.

As always, there's a fine line between gaining through creative use of deliberate gameplay mechanics, and exploiting the system.

--Dave

[Raph Koster]

7.

On one level, it's not legal because we say so. :) If you want laws to be manifesting in online spaces, you get the goose with the gander...

On the id front, btw, dupes are almost always based on laundering the unique object id. This usually happens when the items can be "stacked." Take stack A, break it into stack A and B, then merge stack A into stack B so you only have stack B. Poof, original id is gone. Stacking also comes into play when the duping method is based on fooling the "count" on the stack, usually by crossing a server boundary before the count is done updating.

There's also tricks whereby ids are not easily verified when the item is on a different subserver (think of it as having a wife in a different state--if the states don't crosscheck marriage licenses, then as long as the wives never actually exist in the SAME state, you can get away with it...).

The interesting thing is that when read as analogies, the tricks for duping are generally thus methods of laundering or filing off id numbers or avoidance of normal policing patterns. In the real world, those are illegal and/or unethical. Why do you question whether they are in this case?

[DivineShadow]

8.

Raph,

I'd say they *should* be unethical and illegal. But the question is weather this is the case or not, and not about what I think.

Looks like we're looooong ways off actually coming to a conclusion here. To establish the legality or not of dupes we need to first solve the ownership puzzle all the way to the end, then analyze what this activity does to the stakes we found out on the ownership puzzle, and match it with the contract in the EULA and its enforceability as well as see what implications it might have under the DMCA.

Abstracting myself to the technology level, creating a duplicate entry on a DMBS is not in and of itself a crime. Just like posting a duplicate message on a blog, or bumping a thread on a board, is not immediately recognized as a crime. Maybe it goes against the site's terms of service, yes, but it is not readily evident it is a crime.

[Dan "The Weasel" Hunter]

9.

Lots to process here, and since I'm supposed to be doing other stuff at the moment, I'm gonna be really quick:

Ted: "Violating the rules of a game is unethical."

Don't think this gets us too far.
(1) It can't be the case that violating all game rules is unethical, since we can construct evil games and ignoring the internal rules of this game would not be unethical in either teleological or deontological terms.
(2) Say that I'm a duper. I can just say that I'm playing a different game from that which the developers designed. We accept that Velvet Strike is playing (legitimately) a different version of Counterstrike (see http://terranova.blogs.com/terra_nova/2003/09/revolt.html#comments). We accept that the reason for many playing UO/EQ is to hang out with friends not the ostensible kill-the-dragon reasons given by developers. So the dupers are playing a different game. Who is the external judge of whether this is appropriate or not?

Raph/Dave: I'm not sure that your analogies work really well. Filing numbers off of cars/guns, etc or printing notes are illegal because there are specific laws making it so. There isn't any law against duping per se, so developers are going to need to rely (I think) on fraud. But who's being defrauded here? You are not setting up an alternative currency. In some cases you try to stop ex-world trades. Duping doesn't seem to involve financial fraud at all.

More later, no doubt...

[Ren]

10.

In few threads we are getting into morality of cheating. I’ve been trying to write a paper on this for about a year now and it is completely doing my head in. The direction that I am heading is to look at some state of nature stories from political philosophy and to look social contract theory, then mix this up with some underlying normative ethics.

Just to step back for a moment. Games have rules. But rules all rules are ultimately negotiated. Yes yes there are rules in code and it looks like these are hard rules, but take griefing, generally this is done within what the code allows you to do, but most people see it as a bad thing. So we need to get away from those simple distinctions and look at where the rules are really formed and negotiated. In MMO* this is effectively base ethics and political philosophy – the former for the moral content of an act and some basic normative stuff, the latter for rule formation.

I see the best model for MMOs as emergent social contract based communities. The game narrative is part of that. For example you might play a thief, but there will be rules (most often unspoken) that you do not steal from your clan etc. MMOs do get over some of the basic issues with social contract theory – specifically the idea of initial consent. When you apply the theory in the physical world its hard to argue with people that say, fine but I did not choose to be born here and have not the means to leave, so what did I agree to. In an MMO people actively choose to join. So we can use social contract to analyse rule formation at the social level. Then you pretty much pick your ethical theory to see if you think act that break this rule set are immoral (actually normative theories cut across this, as they rule things out that the community would rule in).

Getting to Ted’s point about the nature of the community. Yes I think this is critical. In my work on avatars, I’ve been trying to work out the minimal set of conditions required to move avatars into a different league philosophically. Though I’m not sure I care to much about what the world is called. With due respect to Raph and Richard who I have seen here – I don’t much care about the intention of developers, what they create have emergent properties, social aspects are one of those (I’m also arguing at the moment that extra-game property negotiations is pretty much unavoidable with sufficiently large worlds). Where I think the tilt point is, is when we start to reach lower in the hierarchy of needs. I think when our online identity starts to become cross world, and starts to hook into certain civil rights – like say voting, then we are into a different ball game. Given that online voting is starting, and fixity of online identity is becoming more of an issue, I don’t see this state as too far off. When we are there the intersections between law, politics and ethics shift substantially.

This gets to the interesting thing about the period we are moving into. The thing with rules and laws is, as someone has noted on another thread, the enforceability of these and in particular. I want to coin a term here (tell me if someone got there first), MMOs are Gratuitous Communities people form them through voluntary action, this mean that sanctions for rule breaking, especially differential sanctions are difficult. People can just quit the game – low switching cost as ted might put it. But as we are all noting, this switching cost is going up as worlds mature. Also there are no differential sanctions in that one can be kicked out of a guild or just downgraded (in some) this means ones access to in-game resources and social network changes, in some cases there is the idea of stigma. Here I think that the cost of the penalty is lower than many people would see as the cost for changing to another world. Hence I see that these kind of in-game rule maintenance will work – to use Nozick, we are somewhere I the mutual protection society \ guardian state phase of his state of nature story.

In a sense I think that art work is an indicator of some of this stuff. There is Velvet srike noted by Dan, and Eddo Stern’s work (summons to surrender) and Julian Holland Oliver (www.slectparks.net) and a bunch of others using MMO and other games as sites of political and aesthetic works – and frankly I love how I had nothing to do with rules or anything (and I would suspect that a few developers like the fact that people take the worlds seriously enough to bother).

Ren
www.renreynolds.com

[Dave Rickey]

11.

The intent of designers may be irrelevant, but only insofar as we are unable to match design to intent. Design choices inescapably affect the underlying social order. The "War of all against all" in early UO was the product of the design, even though it was not the intent.

By the same token, although the community may wish to form rules, if the design doesn't allow for those rules to become dominant, all of the good intentions and mutual agreement in the world won't help (eg. The Yew Rangers trying to enforce a peace zone in pre-Trammel UO). So the questions of bottom-up emergent social structure and top-down design cannot be cleanly separated.

--Dave

[ren]

12.

Dave Rickey wrote:
>Design choices inescapably affect the underlying social order.

Indeed. We agree i think that design choices put certain limits on socially defined laws. I suppose i was reacting to the arument i here most often which is: if you want to konw the rules - they are in the code. In fact they are in the greay area that code provides one boudary to.

ren
www.renreynolds.com

[Dave Rickey]

13.

I can definitely agree with that. Coded-in boundaries represent the "hard edges" that the emergent aspects of the system (player community dynamics) form themselves around. To put it in other terms, code defines the shape of the adaptive landscape, design defines the "fitness" of social mechanisms, and player actions/interactions define the rules by which the landscape is explored.

--Dave

[Greg Lastowka]

14.

While we're doing analogies -- here's another. Suppose you participated in a marathon where some of the participants employed a subway to reach the finish line.

http://www.canoe.ca/CNEWSHeyMartha0009/21_marathon-ap.html

Would that be unethical or illegal? Granted, a marathon is a zero-sum game for some participants, but so are virtual worlds -- and I doubt the culprits above were planning to reveal their means of transportation.

But suppose it wasn't an official marathon, but a 25 mile "fun run", with no set start time or end time. Then there would be no problem, right?

More on the code aspect of this in a bit...

[Brask Mumei]

15.

First, thanks to this Blog, I now know cool words like arbitrage.

The part of this that caught my attention was the "FedEx exploits". I made a fair bit of money on Star Wars Galaxies conducting arbitrage. What I did was sit down at the Coronet Bazar, which is the trading house of most of the galaxy. Twice a week, I'd log in and look through all the sales for any that were being sold too cheaply. I'd purchase them and immediately put them back up for sale at higher (but priced to move in 3-4 days) prices.

I came up with a lot of justifications for my behaviour - a sure sign that at some level I thought it was unethical. Now at least I know the proper term - sounds better than "profiteering". I started off planning on being a trader, shipping goods from the world on which it was made to the one which people would consume. I quickly found out, however, much greater profits were to be had by shipping goods within the same market.

Reasons why this is ethical and lawful?
1) I'm freeing up the capital of the seller - presumably it was a fire sale (to fund the mining machines, for example), and so I am actually indirectly investing in the miners company.
2) I'm selling across time. While at 7pm there might be lots of iron ore available at x cr/unit, by 2 am it would all be sold out, if it weren't for the heroic actions of people like myself that price is highly.

Reasons why I felt unsure of the process:
1) It's a lot of money for no work. I'd get 50% ROI for merely leaving my money tied up in the market. It's not like I'm contributing anything valuable - I'm not shipping materials, I'm not mining materials, and I'm not manufacturing goods.
2) It's a game! By inflating the prices of materials by reselling, I'm making some poor artisan run more delivery missions to buy enough alumninum to get to the next skill level.

It's the last point which strikes strongest with me. While I greatly enjoyed the stock-trading mini-game, there's a catch-22 of arbitrage opportunities in MMORPG: Either you are making money off the computer, in which case it's a fed ex exploit, or you are making money off people, in which case you are profiteering.

[Bruce Boston]

16.

Hi Brask,

Personally, while I know there are some that would think that the arbitrage trading that you are doing is 'taking advantage of people', I would hope that you never think that is true. In it's pure form individuals that tie their money up in the market in arbitrage are doing society a huge favor, its actually very good for markets and people as well.

The people that list items low and cheap do so because they want cash quickly. By you buying it quickly, they are getting what they want. People who buy resources at a higher price do so because they want resources quickly, and by you re-listing items to sell in 3-4 days time, you make sure that resources are always available.

If you think about it, you are actually bringing stability to the markets with has very good effects. It allows buyers and sellers to quickly understand what is a good deal and what isn't.

The last thing that society wants is for no one to engage in arbitrage. Since the person that wants to sell fast, can't sell fast they tend to lower their price even more, and when someone who wants resources fast, can't find any resources they tend to pay more. What this leads to is very different price levels during different times of the day or different physical locations.

Now you might think that if you didn't buy at night then someone else would be able to buy during the day for cheaper. Let me assure you this isn't how it will work out. Instead, what happens is 'stocking'. Artisans start buying resources cheaply because they might need it some day. This takes resources out of the market and drives prices up even higher.

In the Real World, I have don't know if their are many cases where arbitrage had any longterm effect but to decrease the prices of commodities, by increasing the efficiency of the market.

Again, I think this is on the exact opposite end of a what I would call an exploit.

[Greg Lastowka]

17.

I promised a follow-up on the code issues. I wanted to first point out (consistent with what Dave said) that there's a pretty well-known idea that software can act in online social environments in a role similar to law, i.e. as a regulator of behavior. Larry Lessig is known for promoting this idea and here's a recent paper (draft) by Polk Wagner at Penn that tries to think through the issue of whether law or software regulation is a better fix for online problems:

http://www.law.upenn.edu/fac/pwagner/wagner.against_software.pdf

And the Bradley/Froomkin article we link to at right draws some additional lines, I think, between MMORPG code and law.

Second, when we're talking about exploiting software bugs in MMORPGs, the vagueness of determining what is an exploit and what is legit seems (to me) very similar to the vagueness you'll find in computer crime statutes prohibiting "unauthorized" access. (And as Raph said in an earlier thread, this gives rise to quasi-legal disputes.) Which is why I wasn't surprised to see that those statutes were used in the Black Hat conference where Ted served as an expert... Orin Kerr has a very accessible (pun intended) article on the fuzzy definition of "authorization" which I linked to in another thread:

http://papers.ssrn.com/sol3/papers.cfm?abstract_id=399740

Kerr takes the position that these statutes should be interpreted as about breaking the laws of code, not the laws of contract. (Which is, in many way, contra what the Wagner article says, supra.) Whoops... "contra," "supra," -- sorry, just force of habit.

And Bask, I'm with Bruce -- you are being a good SWG capitalist.

[DivineShadow]

18.

Brask,

As long as you are not misleading your sellers or buyers with misinformation, then it is perfectly ethical. If you are using more information than they have, then it is a legitimate use of your resources, resources they might obtain if they were so inclined, and resources you invested time/money to obtain and develop. Using market intelligence is not unethical, it's the only sensible thing to do!
As Bruce points out, your specific case is actually helpful to everyone involved.

[Brask]

19.

"you are being a good SWG capitalist"

To turn that around, it would thus suggest any uneasiness I have with my role is actually uneasiness I have with capitalism. Which makes sense, for, as most people, I have little direct contact with capitalism, instead only seeing the monotonous price structure of consumerism.

Thank you for the analysis - it is nice to know that my greedy actions have a long term beneficial impact. I should point out that I *did* notice a stabalization of the market over time, and that's one reason why I went to mineral production. A stable market means less arbitrage opportunities.

I wonder if Sony would be at all open to a Hammer-tap like analysis of the internal bazar market? That would certainly answer some of the questions about the validity of projecting ebay numbers onto internal game numbers.

- Brask Mumei

[Ren]

20.

Brask wrote:
>As long as you are not misleading your sellers or buyers with misinformation, then it is perfectly ethical.

Not sure its 'perfectly' ethical. This assumes that this type of capitalism is ethical; which there is no reason to presuppose. So I'd suggest that its relatively ethical, unless your gonna pitch a normative tent and start defending it.

ren

[Dan Hunter]

21.

Ren, in response to Brask: "Not sure its 'perfectly' ethical."

This is, of course, right. But clearly what Brask is doing is ethical according to the precepts of capitalism, which we pretty much take as a given. Actually I don't think that Brask is an arbitrageur at all, since this usually requires shipment of an economic unit from one market to another. Thus, for example, currency arbitrage involves movement of money from one currency market to the other, in order to exploit (and eventually remove) the pricing differentials between the two markets. Brask seems just to be engaged in regular trading, making a profit between the values ascribed by different individuals to the same asset.

Even if we were concerned about arbitrage, Brask's actions look prefectly ethical to me.

[B. Smith]

22.

This is fascinating. But I don't see anyone (unless I overlooked something) mentioning the Darwinistic approach to these questions. To my mind, a Law/More/Rule/Ethos must be a) enforceable, and b) promote survival. Any attempt at societal behavior modification that does not meet those criteria will be useless or worse.

So it is simple. Write game code that does not allow the possibility of behavior that threatens the survival of the game world, and ignore anything else. But be sure you don't fool yourself into thinking that somethign is a threat to the game when in fact it is a threat strictly and exlcusively to the game designer's preferences.

[DivineShadow]

23.

B,

These games are very complex. Unless you want to end up with a fully-moderated IRC chatroom, which would fit the bill as the most resilient and pervasive virtual world. Pinning down what will make a future game or what makes a current game 'tick' is non-trivial, and thinking that your current 'ticking' model will carry forward into the future unaltered is downright suicidal. Speaking evolutionary terms, the environment can change much faster than the game's ability to adapt, especially if it rejects change by viewing it as a direct attack to its life.

It would seem that if you try to parallel a Virtual World game as a single specimen of a species, you are therefore condemning it to a quick death in the hands of the changing environment. More than likely you have to retain quite a bit of flexibility, view the game as a collection of mini-games, and allow for some form of natural selection of those mini-games to occurr as players change behavior. After all the environments that contain these games and where they thrive is not in a piece of code or a computer, but the user's mind - which is anything but fixed.

[Ren]

24.

Me
>>Not sure its 'perfectly' ethical.

Dan
>This is, of course, right. But clearly what Brask is doing is ethical according to the precepts of capitalism, which we pretty much take as a given.

But I don't want to take this as a given !

We are talking about acts in virtual worlds here. Why should we assume that something like capitilism just applies. There may be virtual worlds where acts like this would be rejected by the bulk of the population, in one of these worlds then there is a strong argument to suggest that the act would be far from ethical as you would be breaking a set of community values that you had tascitlly agreed to by becoming a member of that community. I think that virtual worlds give us an opportunity to take much less for granted. But i thinks thats what is so very interesting about any attept to apply normative theories to them.

Ren
PS and given that i'm supposed to be a philosopher i get to challenge even the most obvious 'givens' if i got paid for this stuff i would be my job description
I would suggest that statments of the form 'this is ethical' tend to reduce down to 'i like \ approve of this'. The word 'ethical' is mainly used as a form of emotional expression.

[Julian Dibbell]

25.

Brask, I feel your pain, and I think it's instructive.

As a merchant of the virtual myself, I too have wrestled with the kind of ethical queasiness you describe. And agreeing with Ren, in a way, I think one of the most valuable things about virtual worlds is that, as "games," with consequences less fraught than they are in the real world, they give us space to feel and examine ethical conundra in ways we wouldn't otherwise.

Elsewhere the law steps in and shuts down ambiguities. Or self-serving rationalization steps in and does the same. In the real world, Gordon Gekko rules: markets do good things for society, greed does good things for markets, therefore greed is good. In SWG, though, the moral stakes aren't so high, and a trader is more likely to admit to himself that while his easy killings in the resource markets may be good for society as a whole, they may not be so good for his soul.

So while I'm intellectually excited by the possibilities of applying real-world law and other ambiguity-reducing social structures to virtual worlds, I'm not dying to see them actually applied.

[Julian Dibbell]

26.

And another thing:

Greg wrote that "when we're talking about exploiting software bugs in MMORPGs, the vagueness of determining what is an exploit and what is legit seems (to me) very similar to the vagueness you'll find in computer crime statutes prohibiting 'unauthorized' access."

And I would add: Not just similar. For a sufficiently ambitious prosecutor, it seems to me, the vagueness of the statutes may one day provide the grounds to charge some luckless exploiter with a federal crime.

This is where the Black Hat trial wasn't as interesting as it could have been. By making the crime in question a straightforward account hacking, the forum dodged the question of whether taking advantage of hard-coded game mechanics in a manner prohibited by EULA is a kind of "unauthorized access." Apparently, many courts could be persuaded that it is, if I get the gist of the Orin Kerr paper Greg cited above.

Does that seem right, legal eagles? Please weigh in. I've actually been having a long back and forth about this question with an unabashed exploiter of my acquaintance, and would love to be able to quote chapter and verse at him.

[Greg Lastowka]

27.

I can't be too helpful, Jules. Without a concete body of facts in hand, any opinion would be worthless -- kind of like you calling up a doctor and saying "I feel kind of funny -- can you tell me what's wrong with me?" Saying yes or no to liability for exploits is impossible without a careful, case-specific examination of facts, jurisdiction, etc. And even then, you may just get guesstimates.

But I can make some general statements. If a game owner wants to stop exploits, several obvious legal methods could be used, e.g., contract, common law tort, statutory remedies, and crime. As noted previously, the contract argument, given most EULAs, is a no-brainer, and the criminal law option seems highly unlikely to be the first thing on a prosecutor's agenda.

Now tort and statutory remedies are where things get very complicated and fact-specific, and a lot depends on the specific jurisdiction and means of legal attack. But, personally, I would not be at all surprised if legal liability were imposed on someone who hacked a game's code for profit. As to calculation of damages, that would be Ted's issue...

More pleasure reading re hacking laws:

The McDanel case:
http://www.theregister.co.uk/content/55/32237.html

Jen fighting the good fight:
http://cyberlaw.stanford.edu/about/cases/AMENDED%20OPENING%20BRIEF%207-2%201.pdf

[David Kennerly]

28.

Even if duping were legal and ethical, when the item being duped had value before the duping, it has lost value afterward. Suppose the item were the most effective item for playing the game, such as a Sword of Doom. With it one has the increased effectiveness, which can be assigned a value. But as duping (and distribution) continues, this value diminishes.

Suppose the item also had social status connected to it, such as Staff of the Elders, that is generally only available, through the difficulty of acquiring, the eldest and most prestigious players. If one in one ten thousand characters had this item before duping, their status would be devalued overnight by rampant duping. The social status itself has been transformed for this Staff of the Elders from "elder player" to "trivial duper". Social status extends far beyond the game, it is interlocked into all social life.

The legitimate players will complain at their loss of status. All old players and new players a like will lose faith in the service provider. Few things are as disasterous to renewal rates as unresolved, rampant duping of items that normally required huge amounts of effort, skill, and/or luck to acquire. This is because the players begin to doubt the value of the world itself. The player may ask himself: If the Staff of the Elders can be duped, what next? What effort of mine will be turned into worthlessness overnight? Then the world itself has no worth.

David

[Dave Rickey]

29.

By that standard, if dupers are bad, Live Teams are even worse. No duper ever trivialized and cheapened a play experience the way that every patch day reminds players of their powerlessness in the face of god-like power, wielded in ways they cannot resist for reasons they do not understand.

[Jim Anderson]

30.

Another thing that is being overlooked is that even with unique ID's assigned to items they are still being duped. The problem here is really tracking. If you have thousands of players and there are duped items how do you tell which is the real one and which is the duped one since they have identical ID's? Sure you can do a dupe wipe and take out both, but then you run into a CS nightmare with people pissed off because you've just deleted their items valid or not. There are even games whereby selling or trading that item through a NPC the item get's assigned a unique ID automatically. Then of course it's impossible to track, and your game economy is completely destroyed by having duped items now become real items with their own unique ID. This is also an ethical discussion because even if you do periodic dupe wipes you're penalizing those that bought/traded for what THEY thought was a legit item only to find out later that it was wiped out in a dupe wipe.

[Robert Karam]

31.

Is there a way i can dupe items on Puzzle Pirates?