The Cheater's Arms Race in Blizzard Games

[ Note: This article is merely one game designer's analysis of Blizzard's latest and controversial announcement.  I have no inside knowledge of the way Blizzard works or how it thinks; these are just thoughts based on fifteen years of playing their games. ]

Today in mainstream gaming news, Blizzard's announced a new feature in Diablo III.  They have developed an auction house to the game where players can trade game items for real world currency.  Since Blizzard is a company that has often taken a hardline against selling items that give player's in-game benefits, this news comes as a shock to the Diablo and gaming community at large.  The Blizzard fanbase has always had a penchant for drama, so the current, loud discussions tend to conclude that Blizzard is a sellout.  That may be true, but this feature also revolves around a difficult and escalating battle Blizzard has fought for years since the original Diablo.

In any game, there are cheaters who overcome the game rules by making their own.  In singleplayer games, cheating quickly makes the game pointless.  A game you win effortlessly ceases to be a game.  In terminating multiplayer games (like RTS game or FPS arena matches), cheating allows you to beat an opponent who is still playing by the rules.  This is more attractive than cheating by yourself, and has more longevity since your opponent might not even realize you are cheating.  This dynamic begets a new game, where the thrill of cheating is linked how well you use it against the other players (there may be a certain element of trolling involved as well).  The incentives of that cheating lacks value outside of the game though.  You win, but it's a meaningless and unfair victory (though if your score is tracked over time, you have bragging rights from your victories -- which others may assume are legitimate).

Things get far more complex in persistent multiplayer games.  In closed loop matches, there is no lasting value built (other than the aforementioned scoreboard concept), but in persistent multiplayer games, players are invested in their avatars.  Often times, those game characters are on some kind of progression track: leveling up and gaining items, skills, or money.  Cheating has a much broader appeal in these games and takes more forms, each focused on progressing your character.  However, cheating is often risky in these games.  If you get caught, you face losing the thing of value: your character.  This, plus the difficulty of cheating in some of these online systems, has resulted in a kind of cheater's black market where you can buy money or items from another source. This problem, a the outsourcing of cheating, is what's plagued Blizzard for over a decade.  As long as players put a lot of value in character development, they'll be willing to trade for it with their time or with cash (whichever they have more of and value less).

Blizzard has a history of addictive games with great longevity.  People still play Diablo II after a decade, and World of Warcraft has been going strong for over six years.  Players put a lot of time and effort in their characters.  Here's a breakdown of some of the various methods of cheating that I've witnessed while playing various Blizzard games.

The first time I played the original Diablo online, I was immediately introduced to cheats.  As soon as a player joined my game, he started throwing Godly Plate of the Whale everywhere.  Within an hour of being online, I had my own item generator and had maxed out my characters stats.  Within two, I was bored of Diablo I multiplayer and never touched it again.  Such is the woe of storing character and game data on the client side.  I am thankful my own cheat dabbling ended there, and for good reason: Diablo 2 solved that problem by moving the data to the server side.  However, that opened up item duping -- the act of tricking the server into copying an item.  Even with item duping, people were unable to cheat for themselves as easily -- you still needed to own the item to dupe it.  To fill the gap, online item stores popped up.  Even now, you can find stores offering "100% Legit Gear of the Whale - Cheap!"  I logged into Battle.Net for Diablo 2 last year, and seconds later, my chat window was an ocean of offers for high level items and characters.  Things were so bad at one point that Blizzard ended up banning 320 000 Battle.net accounts [1].

If Diablo 2 cheating was a nightmare, World of Warcraft's is hellish.  Diablo 2 had a system where items drop on the ground.  This made trading items with other players very easy because it has no inherent binding system.  WoW solved this problem with a tighter controlled loot system.  When you slay a monster, you can view what items it dropped before picking them up.  As a trade-off, many of the better items bind to you as soon as you claim or wear them.  Item duping appeared once or twice in WoW, but that bug was squashed quickly.  So with items harder to cash out, the other game currency, gold, became lucrative.  While most of the top items in the game are unavailable for gold, gold is the primary currency in WoW for other forms of character progression (like skills, professions, mounts, and some extravagant vanity items).

The early gold sellers in World of Warcraft had a fair number of exploits on their cheat sheets.  Player movement was originally controlled client-side, so teleport hacks surfaced.  These allowed players to jump around a huge monster and kill it without the monster touching them.  I once witnessed a mage in the Dire Maul arena teleporting around one of the ogre bosses.  Since it was an open player-versus-player arena, we were able to attack him during his exploit.  However, with the flexibility brought by his cheating, it became a stalemate while we waited for a game master to intervene and ban him.  We eventually gave up; he got his kill.  Several hours later a GM responded, and I never saw that mage again.

Movement eventually moved server side, but players found another exploit in a dungeon.  In Maraudon, a player could run through the entire cavern, jump down, and cause all the following creatures to run back around the whole map.  In the meantime, the player could plunder several lucrative chests.  Every hour, you could see dozens of players (always level 60 hunters) lurking in Maraudon.  This became a problem when servers were higher population; each instance of Maraudon was run by the game servers, which could only handle so many dungeons running at a time.  A fix eventually came where players could only visit a set amount of dungeons per hour and they could not loot a chest while in combat.  Notably, both of these exploits required legitimate accounts and someone actively playing -- it was called 'gold farming' for a reason.

Another early cheat that was more cost effective than gold farming was botting.  Bots (or characters controlled by scripts on the client side) could roughly navigate WoW, kill monsters, and loot them.  They were easy to identify though, as they often ran headfirst into trees and got stuck there.  Additionally, bots tend to follow set paths, so for Blizzard, it was easy to identify who was a bot and ban that account.  Accounts cost money -- for the initial game purchase and for the subscription.  If you don't get the gold off of the character before it's banned, your gold-selling business just took a major loss.  I've heard people describe gold selling as a business of pure profit, but subscriptions and game licenses are a huge operating cost, especially if they get banned with your product still on them.  In a way, Blizzard's aggressive stance against gold selling escalated those vagabonds towards more malicious methods.

With bots banned, the major exploits mostly sealed, and gold farming not very cost effective, the remaining gold sellers took a more the evil route to making money: stealing people's accounts.  Account stealing is a rich market for a number of reasons: naive and foolish people are high in supply, it costs nothing to take over their account, you can trade off their gold, you can sell off their characters to an eager victim, and the legal system currently does not pursue people exploiting this kind of hack.  I fell victim to account stealing twice, both times through trojan horse exploits downloaded from mod sites.  World of Warcraft features a very robust and wonderful modding API.  As a result, the modding community has flourished and produced many must-have additions to the game interface.  However, this means that players are constantly downloading unverified content from third party sources.  Through both the mods themselves, a good number of trojans horses were released to the player base.  For a game company, this is terrifying.  Whereas Blizzard originally could target gold seller accounts and ban them, now innocent players were the vectors of the exploits.

Blizzard tackled this problem in multiple directions, and with several clever changes to game mechanics.  First, they made gold easier for players to obtain through questing.  Second, they tied gold purchasable rewards to reputation, so even if you had gold, you still needed to put effort and time into obtaining the item (effort and time that often yielded the amount of gold you needed anyway).  Third, they added authenticators to accounts, giving players an optional additional level of security against key loggers.   Additionally, they made it easy for players to report gold sellers in game.  After these measures, I did not remain in WoW for long so I do not know their effect on the gold selling market.  I imagine there are still a fair number of gold sellers, since ingame prices have inflated to match the new ease of obtaining gold.  But at least they have taken away a lot of the reasons for players to buy gold.

So, now that you see what problems Blizzard has had to address, how do today's announcements aim to solve the existing problems during Diablo III's initial release?  First, they've said mods will not be enabled.  With WoW, mods were essential for crafting an ideal UI, but Diablo has very different and much less demanding gameplay - you don't need 40 people's health bars on your screen in an unholy game of healing whack-a-mole.  This reduces one of the common vectors of attack for people to steal accounts.  Second, the game requires an online connection at all times.  I imagine what they'll be doing is storing characters online in both single player and multiplayer (and tracking achievements that way as well).  This worked well in Starcraft.  With the exception of a few lost achievements when my internet went out while in single player, I had no issues with this method.  Finally, the most debated (from what I've seen) element is the new real world currency trading auction house.  As some[2][3] have noted, this is a way of legitimizing item selling - once a form of cheating - into a gameplay mechanic.  Say whatever you want about it as a business strategy (I won't say much in that regard, since I have no perspective there), this is an brute and efficient way of dealing with the problems they've seen for over a decade.  I wish them the best of luck (and I may even try Diablo III online this time around).

Thought Exercise:  Describe an alternative method of limiting cheating in an online RPG.  Bonus: make it appease the fickle, foam-at-the-mouth fanbase of Blizzard games.