Rather Sophisticated Cheating

Alan from the Dev's Corner at Everquest mentioned last month:

Over the last few days there has been a growing community concern about possible cheating, exploiting and platinum duplication. Rumors and speculation have begun to run rampant, and I've received a lot of concerned email on the topic.

Apparently there was an unfounded rumor that there might have been a cheater on staff, as Alan said:

I'd also like to address a rumor about the nature of some of the cheating that people have been talking about. There has been speculation in the community that in order to pull off some of the rumored exploits someone had to be working on the "inside".

But what I found interesting in the column was the emphasized bit here:

Also, the nature of the cheat did not require such inside help. I can't describe the cheat method in any detail, but there was an experience cheat that allowed extremely fast leveling. This required some rather sophisticated cheating, but was being done without inside help. Obviously we have removed that exploit and banned any accounts that used it.

Just as a matter of pure parlance, it struck me as just a little funny for Alan to use the word "sophisticated" next to the word "cheating." In this context, I take it he means the exploit was something rather clever. But in standard games, I'm wondering what might qualify as a "sophisticated" way to cheat? If we compare sophisticated and unsophisticated cheaters, are the sophisticated ones more culpable, less culpable, or equally culpable?

Btw, according to ZDNet, people in South Korea have been arrested for duping.

Comments

[Cory Ondrejka]

1.

Not to be cynical but developers rarely post that a damaging cheat took 10 minutes, 6 keystrokes and three monkeys. Or that, depsite everyone loudly proclaiming that they have a "dumb client" and use buzzword-enabled software with "SSL", "MD5 hashes", and "strong encryption", that they send the user's password in clear text 4 times during every login and treat account balances from the client as athoritative.

When your community is convinced that the cheaters are working on the inside, you need some pretty strong damage control.

Cory

[DivineShadow]

2.

It seems Cory can also translate computerese... :)
The literal translation of "rather sophisticated" into english is: "It took us forever to figure out."

[ren]

3.

Ahh the _what do we mean by cheating question_ (again). See here for previous terranova discourse: terranova.blogs.com/terra_nova/2003/10/duping_and_splo.html)

I’m currently much more into what one might call social notions of cheating. That is, the use of the word to designate them and us divisions around norms of behaviour. There are a number of ways that you can map out forms of cheating, I suppose a simple one would put things like Tip and Walk Throughs at one extreme and system cracks at the other. On this line Exploits seem to sit near to the crack’ing end – that is more people in a given community are likely to disapprove.

From the hacker perspective (and there is a fine line between power gamer and hacker if you ask me) this “sophisticated cheating” sounds like something that was probably a pretty neat hack.

Ren
www.renrreynolds.com

[Euphrosyne]

4.

I'd say "sophisticated cheating" means "difficult to engineer, detect, and/or duplicate". Poker cheats in the wild west would have needed all these qualities to avoid a quick demise.

I'm curious about the legal angle of the S. Korea arrests. Presumably they are charged with criminal intrusion into a computer system, but the article's spin makes it almost sound like the act of gaining RL currency was the criminal act--and it seems likely that criminal charges wouldn't have been pressed if there had never been an exchange for RW cash. I would be surprised if there laws that specifically criminalized that exchange (yet)...but it won't take many stories like this before governments detect a threat, and begin to regulate game currencies directly, or via some form of oversight of the companies (the latter seeming nearly unworkable, and thus likely to appeal to bureaucrats :)

To press the point: it seems obviously illegal to "hack a server" and directly award yourself currency. The act of then changing that cybercurrency into hard cash is not, of itself, illegal (except for trafficking in stolen goods, perhaps?). But what if a player is merely exploiting a bug in the game code that allows for fast multiplication of platinum? If he then sells that currency for cash, is he also a criminal? It seems to me that for that to be the case, it would have to be a RW crime to participate in buggy code in any manner...thereby criminalizing the act of booting your desktop OS.

So, how do we resolve this? How is a solitary player that quietly exploits an obscure currency bug and makes a RW profit significantly different from, say, a painter? Both are creating some RW value from (nearly) nothing, and neither is causing a loss to others. In both cases, a glut of the 'product' will curtail their own profitability, and the RW market adjusts. If the game economy can't adjust for this exploit, then it is an internal game problem, because the external exchange for cash is irrelevant to the game economy. Of course it doesn't seem "fair", but should it be illegal? RW economics aren't fair either...

Or to be brief: Are we ready to deliver real criminal punishment for strictly virtual misbehavior?

[Alan Stern]

5.

Euphrosyne> How is a solitary player that quietly exploits an obscure currency bug and makes a RW profit significantly different from, say, a painter?

The painter is employing the raw products and his skills in an assumably acceptable manner. If the painter were to be painting on the subway underpass, he would be committing a crime (defacing public property). The player is likewise bound by a set of laws (ToS, EULA). For example, Mythic's EUALA clearly states: "You may not use in Game play macros or other stored rapid keystrokes, “dupes,” “cheats” or other patterns of play that facilitate acquisition of items, currency, objects, character attributes, rank or status at an accelerated rate when compared with ordinary Game play." The "solitary player that quietly exploits an obscure currency bug" is doing so in violation of Mythic's EUALA. So if we uphold EULAs and ToS, then the player is violating that contract and is subject to sanctions by the game company.

Granted in the U.S. there are as yet no criminal sanctions for RW profits made from VW exploits (at all) and I would not argue for such a law, largely because it could have unforeseen consequences but also because, as you point out, precisely defining what conduct would be illegal would be very difficult. It would also require official recognition of VWs and VW assets as having RW value. That alone is a whole can of worms.

Euphrosyne> Or to be brief: Are we ready to deliver real criminal punishment for strictly virtual misbehavior?

I disagree with the form of that question because it implicitly equates all forms of virtual misbehavior on a fundamental level. For example, if we are not ready to deliver real criminal punsihment for strictly virtual misbehavior, then you could not maintain a cause of action against someone for libel/slander if they speak ill of you in a chatroom or VW. Contrary, if we are ready then you run into a whole host of problems along the lines of the ones I mention above.

I would rather separate the misbehaviors, in some manner, such that different types might carry different penalties. There's no reason to prevent the game company from policing and enforcing the anti-cheating aspects of its EULA/ToS when it is in a strong position to do so and has a strong motivation as well. On the other hand, there is also no reason not to keep slander/libel criminalized in VWs as in the RW. (Ignoring jurisdictional & choice of law issues, etc.)

[Brask Mumei]

6.

"You may not use in Game play macros or other stored rapid keystrokes, “dupes,” “cheats” or other patterns of play that facilitate acquisition of items, currency, objects, character attributes, rank or status at an accelerated rate when compared with ordinary Game play."

*sigh*

The eternal problem of dupes & cheats: How can the player determine in game (or, maybe, more precisely, in character?) what is "illegal"? It would seem to be that paragraph would make superb teamwork illegal. Most teamwork in MMORPGs (and hence what constitutes "ordinary Game Play") is abysmal, so if one's group rises to the top 1% through efficient tactics, aren't you also guilty of a pattern of play which facilitates rapid acquisation?

Thankfully, Mythic doesn't actually have to enforce their EULA impartially - they have infinite lattitude in determining post-facto what is considered cheating.

It reminds me of the "creative use of magic" bugs of the early UO. These were often entirely valid IN CHARACTER ways of acquiring a target. For example, one could create a recall point on a rune that was on a table, and then gate there. One could then put a table on top of the previous table, and recall to that height. Sufficient application of this would bring you above the height of a Tower (which had an open roof) and one could then fall in, open the door from the inside, and loot it.

We then have the other examples, such as the infinite numbers of arbitrage "dupes" that have been made. And, when the sleeper was first being awoken, I remember a huge kuffufle with accusations that one group attacking it did not properly keep within line of sight of the attacker, or some such.

These are all the sorts of problems the real world laws run into. We've largely resolved them by demanding that, to a large extent, the law be made as clear as possible up front. I'm not sure if we want this to be the case in VWs, which implies we must be at the whims of Tyrants. In this respect I am strongly on what I think is Richard Bartle's side: the company must retain the ability to exact entirely arbitrary bannings.

I kind of wish Mythic, instead of that convoluted, overgeneralized, "Make everyone a criminal" paragraph, could have just done the universal rule:
"Don't act like an idiot."
No attempt should ever be made to define what "acting like an idiot" is, as that merely is paying out rope for people to exploit with.

- Brask Mumei

[Staarkhand]

7.

Exploiting a bug for personal gain is, as pointed out, forbidden by the contract entered into by playing the game. A more fun example might be in game thievery, which is often a supported character ability. Scammers who fleece trusting people out of in game money and items are somewhere in between, but are generally not in violation of any guidelines.

(Just saw Brask's post, insert noises of agreement)

Being sued for looting a merchant on his way to the bank on claims of "lost income" is what awaits if the sale of in game items for earth money is legitimized, and is the reason most would rather ignore the issue. This blog has seen previous discussion of the EULA/ToS, specifically the forbidding of the sale of items, as enabling, not oppressive, to the gamer. (See discussion of Second Life's recognition of customers' intellectual property rights)

[Euphrosyne]

8.

Alan--
I assume that most games' EULA forbids "cheating" in various ways, and my musings were directed toward future possibility of RW criminal punishment for in-game action. To twist the Korean example, let's assume there was no conclusive proof as to whether the money gain was from an 'outside' computer hack, or an 'inside' exploit. The outside hack is illegal under current RL law, but the inside hack is covered only by EULA. It's a strange situation where the semantics of the "crime" dictate wildly varying punishments (ie loss of game account vs jail time). I conjecture that the social impulse behind the arrests stems not from the original crime itself (the severity of which depends entirely on how we define it), but the RW profit made from it. This could cause a problem if developers become eager to use the threat of RW law to effectively compensate for lazy game administration. And underneath it all, there's still that problem of defining exactly what a cheat is.

Re: the slander example, by "strictly virtual misbehavior", I would include an avatar slandering another avatar, which should remain outside the jurisdiction of RL law. An avatar slandering a player or celebrity would no longer be strictly virtual behavior [could a satire defense plausibly be made here?]. I agree and think we should encourage developers to enforce their own EULA without resorting to RW law. But to return above: what if you are a game developer who has a player gain a vast amount of currency, obviously cheating but in an indeterminate manner, who then turns it into a million real dollars? Do you just terminate his account and leave it at that? Does that seem like a viable option once the scam is publicly known? Or do you maybe fudge some computer records, make references in the media to a scary "computer hacker", and invite the RW law to down on the player to discourage future cheaters, by relying on the sort of sweeping force that a mere game company can't possibly muster...

I'm not spinning conspiracies, just considering what I think to be real future possibilities.

(last second comment: interesting point Staar, what about thieves who can legitimately steal player money and then make RW profit? That's the extra twist of making a RW crime not only virtually legal, but RW-profitable. Oh, how the lines begin to blur...)

[Richard Bartle]

9.

Euphrosyne>underneath it all, there's still that problem of defining exactly what a cheat is.

Things happen in virtual worlds that the designers didn't plan for. Some of these are happy emergent consequences of rule sets that the designers put in place, and others are unhappy consequences.

Example: suppose a virtual world updates its physics engine so that objects behave more like they would in real life. The designers foresee that players will do things like dig holes in the ground where previously they couldn't, but they are expecting that players will find more imaginative things to do, too. Sure enough, within a day players discover that they can now chop down trees with axes whereas previously you couldn't. What's more, the trees will grow back all by themselves, so there's no danger of deforestation. The designers are pleased with themselves, because although they hadn't planned for this they think it's a good use of the new rules. However, the next day players discover that if they use the Diamond Axe of Godly Power they can chop down city walls. The designers are not pleased with this, because it means that all those exciting sieges that used to happen are now unexciting - if indeed there are any buildings left to be besieged anyway.

Chopping down trees is a feature. Chopping down walls is a bug. The decision as to whether an unforeseen action is a feature or a bug can only be made after it has been discovered. Although a set of criteria could be created to help determine which was which, ultimately it has to come down to what the designers think about it. "It's a bug because we say so".

Richard

[Alan Stern]

10.

Euphrosyne> The outside hack is illegal under current RL law, but the inside hack is covered only by EULA.

The outside hack is also likely covered by the EULA. If the outside hacker has bought the program and agreed to the EULA, he is also subject to available sanctions by the game company. Thus, in that case, if they wanted to, the game company could cut off the hacker's game access, etc. They still have some modicum of power over the hacker and some ability to act on their own, independent of RW criminal law. If the hacker didn't purchase the game, then the game company has no self-help available and is "forced" to resort to RW law.

Euphrosyne> It's a strange situation where the semantics of the "crime" dictate wildly varying punishments (ie loss of game account vs jail time).

I don't see this as semantics run amok but rather as different definitions of undesired actions. Under U.S. law, the 'outside' hack is covered by the DMCA among other "anti-hacking" laws, should they apply. The 'inside' hack is only covered by the EULA. No RW law yet applies to the 'inside' (in-game) hack. I don't care how much you profit off of one versus the other but without jurisdiction or an applicable, on-point law, RW enforcement is not an option. Regardless of any social impulse, enforcement options are available based not on the results per se but rather on the actions/crimes committed or intended.

Euphrosyne> Re: the slander example, by "strictly virtual misbehavior", I would include an avatar slandering another avatar, which should remain outside the jurisdiction of RL law.

Why would that be outside the jurisdiction of RW law? How is that any different from people speaking in a chatroom? If I were to run around a VW yelling something like "Bartle's games stink!" (no offense, Richard), how would he not have a cause of action against me?

Euphrosyne> An avatar slandering a player or celebrity would no longer be strictly virtual behavior.

I agree. This is why RW laws would start becoming an issue. This is also precisely where the delineation between strictly virtual behavior and behavior impinging on the RW starts to break down. i.e. "Assaulting" another player in-game or "stealing" items from them with your thief. (i.e. At what point should RW law step in? etc.)

N.B. I use slander/libel as an example because it is clearly a cross-medium action if in a VW.

[Brask Mumei]

11.

In reference to slandering/libelling (I never remember which one is which) avatars:

> Why would that be outside the jurisdiction of RW law?

It was a fine, but important point, IMO. The slandering is OF avatars, not BY avatars. Of course slandering BY avatars should be actionable. However, the case of one avatar slandering another avatar in game? If this is actionable, the problems of items-as-property will start to look pretty minor.

Consider two cases:
1) Say I play an online game using the handle "A". Another player runs around yelling: "A killsteals and ninjaloots!" despite the fact I am innocent of such crimes. Can I sue for damages caused by reduced grouping, etc?

2) Consider an online game, such as a Paranoia Online, where slander is an encouraged part of the game. Calling someone a commie-mutant-traitor is proper gameplay. Do we want some grief player to use in-game slander as justification for an out-of-game lawsuit?

[Alan Stern]

12.

I apologize for not being clearer. I meant slander/libel in the sense of someone speaking/publishing comments in a VW about a RW person. I did not intend to include in-game slander/libel of VW characters or avatars.

To briefly respond though:

1. I vote no. Beyond legal problems such as demonstrable harm, jurisdiction and applicable statutes, redress is potentially available via in-game mechanisms such as customer support or harassment reports. If such redress is not available, I say too bad.

[Euphrosyne]

13.

Brask caught my distinction. And if avatar-avatar slander could create RL legal action against the player, how long would it be before in-game player killing (avatar killing, actually) created a RL homicide case? Ridiculous, but obviously a limitation to the "I *am* my avatar" standpoint.

Alan, my concern about legal jurisdiction was not that the game co. had no internal course of action against the outside hacker, but rather that companies might discover that RL law enforcement is such a convenient tool against internal hacking (and we know that the internal/external distinction can be fuzzy), that they welcome it without consideration of the consequences.

[Alan Stern]

14.

Euphrosyne> Alan, my concern about legal jurisdiction was not that the game co. had no internal course of action against the outside hacker, but rather that companies might discover that RL law enforcement is such a convenient tool against internal hacking (and we know that the internal/external distinction can be fuzzy), that they welcome it without consideration of the consequences.

I highly doubt that a game company would consider RW law enforcement a convenient tool to combat in-game hacking. Yes, the punishment aspect may look appealing if the hack was particularly damaging, but the availability of other alternatives, the extra cost and potential liability (countersuits) of involving RW law enforcement and the legal complexities of such involvement all lead me to believe that no game company would knowingly and willingly do this. RW legal enforcement is a blunt instrument ill-suited (as it stands) to deal with purely virtual elements such as internal hacking.

[Staarkhand]

15.

Cheating or no:

Not too long Mythic's login servers for DAoC were having various technical difficulties which are unimportant - basically no one could log on, but if you were on you could play normally. Someone from Midgard on the Pellinor server whipped together a command prompt workaround that bypassed the login server, distributed it on closed forums, then capitalized on the population imbalance by organizing a raid to take back their relic from Hibernia.

Translation if you've never heard of DAoC: they pulled off a PvP coup because their enemies couldn't log on and they could.

How does the ethics commitee rule that one?

Brask, the recall to table trick is pure brilliance. Thanks for sharing that one.

[ren]

16.

Staarkhand at January 9, 2004 wrote:
>How does the ethics commitee rule that one?

Well as psudo-philosopher on the bench - I'd say: mm it depends what you mean by ....

But seriously Its often not possible to define something as cheating or not with reference to some basic facts - rules are alwasy negotiated by groups.

So I guess in this case it would depend on what the community thought about the status of this type of hack was it 'fair game' or not and what the intentional stance of players was. It could really be seen either way and I'm not sure that trying to rule from a distance on its status as if that is a black and white question really gets us far.

What did the people involved think did the ones with the neat hack think of them selves as 'cheating' or just knowing the system well ? What did the other side think - 'good one we will get you next time', or 'you cheating scum' ?

ren
www.renreynolds.com

[magicback]

17.

To step aside on the ethics issue...

I think it is up to the community to decide what is far and not. A decision-making system like the one in ATITD can off load some of the burden on VW operators.

In the old days the victor of real wars determines who cheated. But with war conventions, tribunals, UN, etc. this started to look a little bit more fair. However, unfair warfare still occurs.

The community-action system in ATITD appears to one of the best system so far.

Frank

[Alastair Houghton]

18.

Since it seems difficult in some cases to distinguish between cheating and unusual application of in-game rules, perhaps an appropriate solution might be to impose in-game sanctions?

For example, in a fantasy setting, dubious activities could attract the attention of the gods, who could inflict some interesting punishment on the individual(s) in question... e.g. turning their avatar to a toad for a week, or converting their ill-gotten gains into a pile of rocks, and perhaps rising to turning their avatar to stone for a time for more disagreeable offences.

This sort of strategy would probably provide a more satisfying experience to the players as well as adding an obvious in-game risk factor to behaviour that might be considered cheating.

[shelly]

19.

delectibaly wonderful

[HJKKJK]

20.

BLA BLA BLA bvlnbbmnjv,hjkhj,jnm,nm,m,m,m,.m,.