The Lawbringer: WoW's immune system and the gold selling virus
Pop law abounds in The Lawbringer, your weekly dose of WoW, the law, video games and the MMO genre. Mathew McCurley takes you through the world running parallel to the games we love and enjoy, full of rules, regulations, pitfalls and traps. How about you hang out with us as we discuss some of the more esoteric aspects of the games we love to play?
Security is a lot like the human immune system -- the longer you are exposed to the dangers of security intrusion and attacks against you, the easier it is to learn how to defend against new attacks. The video game industry has been the target of hackers of all types since its inception, with hacks and leaks dotting the gaming landscape. Gold farmers and gold hackers are the relatively new kids on the block, but have been fighting a long battle with Blizzard as both sides push and pull to achieve their goals. Blizzard is in a unique position where they have the knowledge of years of attacks behind them. What happens when the new guy enters the genre and has no such immunity or experience behind them, despite hackers knowing exactly what to do?
Have you ever read Jared Diamond's Guns, Germs, and Steel? No? Well, it's a pretty darn good read, and you already like to read (as evidenced by your eyes' sliding back and forth across the screen at this very moment), so pick up this Pulitzer Prize-winning look at the ascension of western civilization. The very basic (and I mean, extremely distilled version) thesis of the book is that western civilization achieved dominance over the world through serendipitous geographic factors and weaponry, diseases to which many were not immune, and central, powerful organization. I'm concerned with the germs part of the equation.
What does any of this have to do with the massively multiplayer genre and WoW in particular? Well, a lot, in fact.
World of Warcraft has been actively defending itself and taking steps to protect itself and its players from viruses and disease for over six years, including gold farmers, hackers, gold hackers, modders, botters, client crashers, server crashers, exploiters and everything in between. Over time, the machine that controls the security, made up of people and computers alike, grows as we understand the threats and learn how to deal with them, much like the human immune system. WoW has the benefit of being in a world where gold selling is rampant but with an immunity built up. Hackers try and fail or try and succeed, but Blizzard always bounces back. When a botter tries a new approach, Blizzard eventually finds, bans, and adapts.
But what if you are a brand new MMO entering into the marketplace that Blizzard's success has escalated into unimaginable heights? The MMO genre has never been more popular and populated, with Blizzard leading the way in terms of numbers and amount riding on the genre. Being the biggest dude on the block means more security and more attempts at breaking your stuff, so Blizzard has to be prepared. If you're the new guy on the block, however, you're entering into a world already populated by smart hackers, botters, and the rest who have tried and testing methods to break games against the big dog already, and your new game has no immune system built up.
The world as it is
Imagine you are Star Wars: The Old Republic. You are destined to be an early hit; your business model is the standard subscription fare, and your game and systems design feels rooted in the traditional MMO world, meaning you have an in-game currency with which players purchase their items and power. Last week, I made mention of one of the issues with one in-game currency that doubles as both the way to earn power and convenience. Players want to have the ability and will spend their own real currency to get both power and convenience, and gold buys you both. The Old Republic will have gold sellers.
So here you are, new kid on the block, and your fancy game gets great reviews and launches to the world. Immediately, you notice that there's something wrong. The hackers, the gold sellers, and the people looking to make the easy virtual currency buck are already there, with the infrastructure built and ready to sell. They've already been doing this for years, growing and maturing through WoW's success to become masters of the gold selling domain. If the MMO genre were a petri dish, it would look an awful lot like strep throat.
New games and new developers only have so much immunity to the disease and viruses that creep around the MMO world. Case in point: Aion. Aion launched with a lot of promises and prestige, having a good beta run and beta events surrounding a hyped-up launch. Things were going fairly well for NCsoft. The gold sellers and hackers and botters came shortly thereafter, en masse, and made things extremely hectic. Servers went down, people were quick-trigger banned for joking about gold selling, and the game's economy took a crazy nosedive. NCsoft was not prepared to deal with the world as it was, because so much of what Aion was protecting itself against was rudimentary and did not consider the honed skills of the veteran currency hawkers who cut their teeth on WoW and other MMOs before.
Future releases need vaccinations
Remember how Batman actually escalated crime in Gotham City because he was a crazy masked dude who ran around putting an end to criminals' free rein in the city? And to counter Batman, criminals started being crazy and dressing up all goofy? The same concept is at work here. The MMO genre needs its Arkham.
How do we allow these diseases to spread and exist in an ecosystem where the success of your MMO relies on stability and fairness, with player experience in direct competition with the might of the gold seller? The baseline vaccination is the authenticator, a system of player security that Blizzard made a popular item in the genre. The authenticator, for the six of you who don't know yet, is either a keyfob with a serial number or a smartphone app that spits out a code for you to enter on login, to play the game, or to change account details. The code changes frequently and is hooked up via algorithm to the servers that let you pass based on the code you input. It's a simple solution to the hacking problem, for the most part.
Vaccinations against gold selling itself is the tough nut to crack. You want to discourage selling currency in game, but you've built your game around earning currency and spending it to make your character better. In The Old Republic, will I be able to give my credits to someone else? The liquidity of the game's currency already spells problems from the outset -- if I can trade it, I'm going to want to have more of it, and I will want to buy it, or people will want to farm it and sell it.
The problem doesn't even lie with the players at this point. Since gold selling and currency farming has become a hugely popular and profitable business, hackers and botters will jump into the market en masse anyway, even if there is no demand just yet, because of the fact that currency can be farmed and traded and sold. The money on the table concept is in full effect.
A virus-ridden planet
How do we get back to a world where the MMO genre is a safe place to launch in again and do so with relative ease, without all the worry about hacking subsystems and 10 layers of security? I don't think we really can get back to those days, until gold farming is not a profitable business anymore. If I'm Bioware and EA and I'm looking at the world as it is, I am worried that my game is so popular in preorders because that already sets the stage for gold farmers and hackers to enter my game and disrupt my service in pursuit of the quick buck.
Look at what Blizzard has done and has tried to contend with. The solutions lie in the little things, the authentication and the rules in place. With over six years of exposure to the nastiest of the nasty, player excuse after player excuse, and hundreds of thousands of calls from customers who need their stuff restored, Blizzard has forged its own vaccination and immunity to many of the smaller problems that gold sellers bring when they log in to your game. And they will.
Unlike how the world was changed by diseases and viruses to create the ascension of a people just because they were lucky enough to have the right immunity to a deadly natural phenonemon, the MMO genre is a world we can utterly control. The games are the starting point, and security for players and their accounts has become a baseline concern in the industry and a new, heavy cost of doing business. Building MMOs from the ground up with the understanding that currency will be bought and sold is now mandatory -- if currency is tradeable, of course -- and the only immunity at this point is to build defenses early. Blizzard has been sitting in the cesspool for a good long while now and has yet to fall to the gold seller's influence. How will new competition fare in a marketplace that is way, way ahead of their game?
This column is for entertainment only; if you need legal advice, contact a lawyer. For comments or general questions about law or for The Lawbringer, contact Mat at mat@wowinsider.com.
Security is a lot like the human immune system -- the longer you are exposed to the dangers of security intrusion and attacks against you, the easier it is to learn how to defend against new attacks. The video game industry has been the target of hackers of all types since its inception, with hacks and leaks dotting the gaming landscape. Gold farmers and gold hackers are the relatively new kids on the block, but have been fighting a long battle with Blizzard as both sides push and pull to achieve their goals. Blizzard is in a unique position where they have the knowledge of years of attacks behind them. What happens when the new guy enters the genre and has no such immunity or experience behind them, despite hackers knowing exactly what to do?
Have you ever read Jared Diamond's Guns, Germs, and Steel? No? Well, it's a pretty darn good read, and you already like to read (as evidenced by your eyes' sliding back and forth across the screen at this very moment), so pick up this Pulitzer Prize-winning look at the ascension of western civilization. The very basic (and I mean, extremely distilled version) thesis of the book is that western civilization achieved dominance over the world through serendipitous geographic factors and weaponry, diseases to which many were not immune, and central, powerful organization. I'm concerned with the germs part of the equation.
What does any of this have to do with the massively multiplayer genre and WoW in particular? Well, a lot, in fact.
World of Warcraft has been actively defending itself and taking steps to protect itself and its players from viruses and disease for over six years, including gold farmers, hackers, gold hackers, modders, botters, client crashers, server crashers, exploiters and everything in between. Over time, the machine that controls the security, made up of people and computers alike, grows as we understand the threats and learn how to deal with them, much like the human immune system. WoW has the benefit of being in a world where gold selling is rampant but with an immunity built up. Hackers try and fail or try and succeed, but Blizzard always bounces back. When a botter tries a new approach, Blizzard eventually finds, bans, and adapts.
But what if you are a brand new MMO entering into the marketplace that Blizzard's success has escalated into unimaginable heights? The MMO genre has never been more popular and populated, with Blizzard leading the way in terms of numbers and amount riding on the genre. Being the biggest dude on the block means more security and more attempts at breaking your stuff, so Blizzard has to be prepared. If you're the new guy on the block, however, you're entering into a world already populated by smart hackers, botters, and the rest who have tried and testing methods to break games against the big dog already, and your new game has no immune system built up.
The world as it is
Imagine you are Star Wars: The Old Republic. You are destined to be an early hit; your business model is the standard subscription fare, and your game and systems design feels rooted in the traditional MMO world, meaning you have an in-game currency with which players purchase their items and power. Last week, I made mention of one of the issues with one in-game currency that doubles as both the way to earn power and convenience. Players want to have the ability and will spend their own real currency to get both power and convenience, and gold buys you both. The Old Republic will have gold sellers.
So here you are, new kid on the block, and your fancy game gets great reviews and launches to the world. Immediately, you notice that there's something wrong. The hackers, the gold sellers, and the people looking to make the easy virtual currency buck are already there, with the infrastructure built and ready to sell. They've already been doing this for years, growing and maturing through WoW's success to become masters of the gold selling domain. If the MMO genre were a petri dish, it would look an awful lot like strep throat.
New games and new developers only have so much immunity to the disease and viruses that creep around the MMO world. Case in point: Aion. Aion launched with a lot of promises and prestige, having a good beta run and beta events surrounding a hyped-up launch. Things were going fairly well for NCsoft. The gold sellers and hackers and botters came shortly thereafter, en masse, and made things extremely hectic. Servers went down, people were quick-trigger banned for joking about gold selling, and the game's economy took a crazy nosedive. NCsoft was not prepared to deal with the world as it was, because so much of what Aion was protecting itself against was rudimentary and did not consider the honed skills of the veteran currency hawkers who cut their teeth on WoW and other MMOs before.

Remember how Batman actually escalated crime in Gotham City because he was a crazy masked dude who ran around putting an end to criminals' free rein in the city? And to counter Batman, criminals started being crazy and dressing up all goofy? The same concept is at work here. The MMO genre needs its Arkham.
How do we allow these diseases to spread and exist in an ecosystem where the success of your MMO relies on stability and fairness, with player experience in direct competition with the might of the gold seller? The baseline vaccination is the authenticator, a system of player security that Blizzard made a popular item in the genre. The authenticator, for the six of you who don't know yet, is either a keyfob with a serial number or a smartphone app that spits out a code for you to enter on login, to play the game, or to change account details. The code changes frequently and is hooked up via algorithm to the servers that let you pass based on the code you input. It's a simple solution to the hacking problem, for the most part.
Vaccinations against gold selling itself is the tough nut to crack. You want to discourage selling currency in game, but you've built your game around earning currency and spending it to make your character better. In The Old Republic, will I be able to give my credits to someone else? The liquidity of the game's currency already spells problems from the outset -- if I can trade it, I'm going to want to have more of it, and I will want to buy it, or people will want to farm it and sell it.
The problem doesn't even lie with the players at this point. Since gold selling and currency farming has become a hugely popular and profitable business, hackers and botters will jump into the market en masse anyway, even if there is no demand just yet, because of the fact that currency can be farmed and traded and sold. The money on the table concept is in full effect.
A virus-ridden planet
How do we get back to a world where the MMO genre is a safe place to launch in again and do so with relative ease, without all the worry about hacking subsystems and 10 layers of security? I don't think we really can get back to those days, until gold farming is not a profitable business anymore. If I'm Bioware and EA and I'm looking at the world as it is, I am worried that my game is so popular in preorders because that already sets the stage for gold farmers and hackers to enter my game and disrupt my service in pursuit of the quick buck.
Look at what Blizzard has done and has tried to contend with. The solutions lie in the little things, the authentication and the rules in place. With over six years of exposure to the nastiest of the nasty, player excuse after player excuse, and hundreds of thousands of calls from customers who need their stuff restored, Blizzard has forged its own vaccination and immunity to many of the smaller problems that gold sellers bring when they log in to your game. And they will.
Unlike how the world was changed by diseases and viruses to create the ascension of a people just because they were lucky enough to have the right immunity to a deadly natural phenonemon, the MMO genre is a world we can utterly control. The games are the starting point, and security for players and their accounts has become a baseline concern in the industry and a new, heavy cost of doing business. Building MMOs from the ground up with the understanding that currency will be bought and sold is now mandatory -- if currency is tradeable, of course -- and the only immunity at this point is to build defenses early. Blizzard has been sitting in the cesspool for a good long while now and has yet to fall to the gold seller's influence. How will new competition fare in a marketplace that is way, way ahead of their game?
Filed under: Analysis / Opinion, The Lawbringer







Reader Comments (Page 1 of 3)
icyone Aug 19th 2011 3:13PM
WoW doesn't have a gold selling problem, it has a gold BUYING problem. Gold sellers could care less if their account du jour gets banned, as the only thing it's for is selling gold, and any account can sell gold.
Gold buyers on the other hand - if Blizzard took a more aggressive, zero tolerance approach to gold buying, well, gold sellers would dry up overnight.
schwonga Aug 19th 2011 3:34PM
An easy, and correct, idea to talk about, but proving an account bought gold and out right banning the account holds so many other pit falls for Blizzard that it becomes a much more difficult idea to put into practice. I have however herd of Blizzard dealing out punishments for buying gold on occasion, but I think they would rather get people to stop on their own than to hurt the entire player base by taking more players out of the game.
Of course there's their own desire to keep drawing money from even gold buying players, but there's also the risk that as Blizz began to outright ban people left and right they would start to like the bad guys even though they are trying to cut out the cancer. Not to mention people thinking they could take legal action for being ban while they paid their money to play. Yes, that issue would work itself out in the courts, but there *is* such a thing as bad PR, and such a legal battle wouldn't look so good.
Jnizzle Aug 19th 2011 3:46PM
I'd say they do take a pretty hard stance on gold buying- one of my guildmates was banned last month for buying gold over two years ago. My guess is that nobody is "getting away with it", Blizzard just hasn't caught up with them yet.
gewalt Aug 19th 2011 3:46PM
you have it backwards. buying gold is not blizzards problem. selling gold is not blizzards problem.
Blizzards problem is gold sellers using means to acquire gold for sale through shady measures that hurt the general playing population.
babywhiz Aug 19th 2011 4:51PM
How would you possibly ever be able to prove someone was buying gold? Because they have a lot of it? Because players traded or mailed huge amounts of gold? Between accounts?
Our guild runs 4 different ten mans, multiple BH runs, Old school raids, Rated BGs.....most requiring flasks/food.
Coordination to make sure all groups are properly supplied with feasts/flasks/etc sometimes will involve large amounts of gold to be transferred to one or multiple toons, who will go to the AH and stock up on herbs/fish....every single bit of it paid by BoE's that were from legit raids, or donations from our AH junkies.
Don't get me wrong. Gold Buying is Bad. I just think that automatic methods of trying to determine if someone is buying gold is not as cut and dried as people think.
Kelly Aug 19th 2011 4:56PM
I was reading a Goldcapped (I think that's the title of the series) article on this site once, and as I was perusing the comments, I saw something interesting. Someone was complaining they were banned.
How? Why?
Well, they had taken the advice of Goldcapped and had become... goldcapped. So, they sent hundreds of thousands of gold to a few of their alts to make room for more gold.
A day latter - BANNED. The alts were accused of "gold buying", and he of "gold selling".
So, please, be careful what you wish for. I have been very fortunate in the AH, so I have tons of gold on my main (no where near capped, but I do have hundreds of thousands of gold), and any time I need to get something for my alt, I either send them just enough gold to get what they need (flying training, etc), or I buy it on the AH for them, then send them the stuff. Hoping that no one suspects anything out of me.
blazenor Aug 19th 2011 5:36PM
I know this would sound crazy, but would if they limited the amount of gold you can pass or receive to another player, would that slow gold famers?
Chris Aug 19th 2011 5:39PM
@babywhiz:
Being able to prove beyond all doubt is a terrible standard to have. You wouldn't be able to ban anybody for anything, except maybe wall and speed hacks. Even then you could say it's not 100% provable that they were actually hacking and not just some other problem.
But you certainly could gather enough evidence to bad based on a "beyond a reasonable doubt" standard. If you get a lot of gold from a separate account (not an alt) that you've never had any correspondence without something of value in return, from an account that's done a lot of gold transfers all of a sudden, or a known compromised account - chances are you're buying gold.
Luke Aug 20th 2011 1:55AM
@ Kelly
I'm not saying your story isn't true, but I can say with certainty this is either an isolated mistake on Blizzard's part or we don't have the whole story.
I've been playing since Vanilla, and playing the Auction House metagame just as long, not once have I known of anyone that was banned because they made the "mistake" of transferring gold from one of their characters to another. There's no reason Blizzard would be suspicious of a player distributing their own wealth among their own characters.
Could you link relevant articles? Preferably something that has actually been picked up by a prominent Warcraft related news site, and not just a blog hastily sharded out (oh yeah I just used sharded the way you think I did) and insanely hell bent on taking down Blizzard.
Trynyti Aug 21st 2011 11:49PM
@Luke, I hate to disagree with you, but @Kelly is correct. It can happen and does happen occasionally. I was banned because I had my AH Alt (who made his fortune selling cooking recipes) purchase the Reins of the Deathcharger from someone (who was level 80 with all ICC Heroic gear) for 55k, in a face to face trade. I mailed the Reins of the Deathcharger directly to my main, then learned it and pranced around Dalaran on it. I went to bed after that and the next morning when I went to play, I was banned, citing Abusing the Economy. I wrote Blizzard support an email, stating all that had happened and begging them to re-instate my account. After a review of the transactions and seeing that I had learned the Reins (not resold them, I guess. It was a specific point the GM made, that I had actually used them), the Blizzard GM re-instated my account and apologized that the auto-ban filter caught me for low level (my level 2 AH alt) trading a large sum of gold.
So yes, it can and does happen. Admittedly, I don't actually know how the person I got the Reins from acquired them, it is a possibility that they were gotten through a means against the ToS, but I have no idea. You do need to be careful of how much you transfer between characters, especially those not on the same account. I think Blizzard GMs do a fantastic job and re-instate accounts that have not been doing things against the ToS, however if you want to avoid the 24-48 hours waiting for a re-instatement of your account, be careful how much gold you transfer at a time. ;)
Izzy Aug 19th 2011 3:21PM
I have read Guns, Germs, and Steel; but hey thanks for assuming your readership is ignorant of anything outside of WoW. I know you didn't mean it that way, but I can see how it could be taken that way.
Grubba Aug 19th 2011 3:29PM
If you knew if wasn't meant to be taken that way, why did you take it that way?
jimforbes40 Aug 20th 2011 12:11PM
Trolling much?
Soulestream Aug 19th 2011 4:27PM
Did he just call us ignernt?
MusedMoose Aug 19th 2011 7:25PM
Funny how you can assume Mr. McCurley is calling people ignorant when, in the *same* paragraph, he says he knows his readers like to read. People who like to read are rarely ignorant. Therefore, I'm not at all inclined to agree with your ridiculous interpretation.
Outis Aug 20th 2011 12:02AM
He responded to his rhetorical question in the negative because 1) he isn't actually conversing with the reader 2) the people who would answer "no" need it explained more than the people who would answer "yes" need to not be insulted by two sentences of extraneous text.
GG&S is an amazing book and I highly recommend it to anyone who is interested in the macro side of social history. I have an uncommon fondness for anyone whose approach to the question of domestication-friendly animals is to make a list of every animal of a certain size and go through it methodically until you have an answer.
Hob Aug 19th 2011 3:27PM
"Remember how Batman actually escalated crime in Gotham City because he was a crazy masked dude who ran around putting an end to criminals' free rein in the city?"
This reminds me of two pieces of (advice? wisdom?) that I grew up with.
1) The fastest way to get people into a lake is to put up a sign that says, "No Swimming."
2) The fastest way to get rid of an unwanted chair is to put it on the sidewalk with a sign that says, "For Sale $10". Someone will steal it.
I'm not really sure what that has to with anything, other than people can be very easily motivated by the right mix of incentives.
gewalt Aug 19th 2011 3:47PM
and both are lies.
Moeru Aug 19th 2011 4:03PM
The fastest way to make people swim in a lake is a nudist supermodel camp on the shore.
dj.clayden Aug 19th 2011 5:14PM
The fastest way to get people into a lake is to hide in a nearby shrub and set their jacket on fire.