How video game developers handle cheating and how to improve it.
Imagine being in a competitive match and getting killed every round without seeing the enemy or having any chance of countering his attacks. You are playing Counter-Strike: Global Offensive and you just wanted to have some fun rounds with your friends but instead of having fun and having a good competitive experience you just get destroyed by one guy one the enemy team. You suspect him of being a cheater, you think he is someone who uses external software to gain a competitive advantage. Of course, you would never say it like that when you are full of adrenaline in- game, where you start flaming the enemy in chat and spam the report button, but that is the definition of a cheater. You just continue to spam the report button, but he is in your game until the end and you will almost certainly loose that game because of that cheater in the enemy team.
Competitive games like CS:GO or League of Legends are full of intense and exciting moments, that boost a player’s pulse to a maximum and these games are that exciting and fun to play because skill equals success. If you have good reactions and a high level of understanding the game, you are destined to climb up in the rankings – at least in theory. Of course, there are other players in the enemy teams that try to do this as well but on average you have an above 50% win-rate during your climb and about a 50% win-rate once you reached the rank that reflects your skill level. But there are also players that don’t play by the rules, they cheat to boost their ego and they ruin the experience for everyone else by doing so. These players get in your way when you want to climb, they sometimes even make you go down the ladder although you are trying hard. But trying hard is not enough when the enemy has inhuman reactions, because it’s a computer program enhancing his aim and movement. This problem is present on all competitive games across all skill levels and sometimes the players feel like the developer is just not caring about them. But in most cases, they are, it is just extremely difficult to combat cheating.
This essay focuses on two of the most popular games out there: Counter-Strike: Global Offensive by Valve Software and League of Legends by Riot Games. Both developers have different approaches on combating cheating which show different results.
There are two main types of cheats in games: The ones that give you an information advantage and the ones that give you a reaction or aim advantage. While vision cheats don’t give you better mechanics in how to play the game, they allow you to see more, for example through walls. Aim assistance cheats usually aim on the opponent automatically or at the press of a button so you don’t even have to have a mouse to play the game, you can just press “shoot” and the software will do the rest for you.
Riot Games has the comfortable situation of being in full control over the game engine, client and code, so they put a lot of work into preventing their game to be vulnerable to cheats. On July 17th, 2018 Riot Games put out a blog post in which they detailed how they combat cheating in League of Legends. They want to “prevent cheating in the first place”, as traditional solutions rely on detection of cheats followed by banning the player. But that system exposes normal players to cheaters so there are games that get ruined before the cheater gets banned. Riot wants to “be able to use [detection systems] as little as possible.” They encrypted the games code, so no one is able to find loopholes in it to get data the player won’t be able to see, and they worked on the networking aspect. The client has basically no power and all decisions on what happens in the game, instead every movement and spell cast the player sees is determined by the server alone. This makes it impossible to see players that are outside of your vision as the client just does not know about the location of other players. An enemy will only show up on your screen if the server tells the client to show it at a specific position. Other methods include compiling the code in a way that makes it difficult for debuggers to read and use difficult to predict heaps in memory to prevent memory searching.
Combining these efforts with traditional methods that detect cheats while they are used and banning offenders this system proves to be pretty effective, but it also has its downsides. Of course, they are not talking about this in their blog post but shifting calculations from the client to the server can cause lag as the server is more likely to overload. Also, the code gets difficult to fix if a bug occurs as everything is hidden in a nice way – and bugs happen a lot in League.
Valve on the other hand, won’t be able to encrypt their code, as the engine, Source, is available to everyone and out there since 2004. It has been used in a bunch of Valve’s games and because it is so old, its security isn’t really good at all. Also, there were a lot of hacks developed for older valve games that were easily portable to the new game, CS:GO. Valve has three systems in place to combat cheating, all of them are tuned to highest efficiency. The most popular system is called VAC, short for Valve Anti Cheat. If you play on a VAC- enabled server, the system scans your computer for known cheating software and suspicious activities or changes in your game files. The system is designed to only ban you if its 100% certain that you actually cheated. The bans are issued automatically and prevent you from ever playing on a VAC secured server again. The bans issued by VAC are permanent and you cannot appeal as Valve is very confident about the accuracy of their VAC system. But it only catches a very small portion of cheaters so there is a second system: Its called Overwatch and based on the idea of a self-regulating community. You can report players and if you are a trusted player above a certain rank, you can review submissions to the Overwatch System and judge the players. The reviews are anonymized and often there are more than 100 players reviewing a particular case before the system decides weather a player will be banned or not. The disadvantage of this system is that it is very slow, and players can be cheating for months until their case is finished, and they eventually get banned.
To bridge that wait period and to deal with minor offenses like abusive chat behavior Valve designed the Trust Factor system. A player that gets reported often and affects games negatively gets a lower trust factor. John McDonald of Valve hold a talk at GDC 2018 outlined that they group people with a negative trust score together in matchmaking to have all the potential cheaters and toxic people in a small percentage of games so most players remain unaffected. This move has improved matchmaking experience and in addition to so called prime accounts, which are accounts with a verified phone number, trust factor does a pretty good job in keeping potentially cheating and toxic players together. Of course, from time to time people end up being unlucky and end up in matches with a lot of low-trust-factor players but according to Valve, this happens relatively rarely. Another concern by players is that people might start cheating when they are in low-trust-factor matches and that system might create cheaters, but again according to Valve, there is not data to back up that claim.
The third and probably most interesting system is VACnet, an artificial intelligence that scans all games played and reports players with suspicious behavior automatically to the Overwatch System. This system is the most advanced in the industry and is currently in the “learning phase”, where the efficiency gradually improves as it gets more data. On July 19th, 2018 the system contributed to a huge wave of game bans. Around 60.000 CS:GO players were banned within 24 hours. Valve plans to boost the reliability of the system to 100% by constantly feeding it more data, so it will eventually be able to ban players outright and skip the Overwatch step. But they have to be 100% sure, that a player detected by VACnet as a cheater is actually cheating:
The main concern for Valve is false positives – players being banned although they did not cheat. If this happens, it damages the reputation of the system severely, so the general approach is to not ban a player if you are not sure whether he is cheating or not. But this also means that there will be cheaters out there and players have to live with it. The goal of Valve is to keep that number as low as possible.
When a player is caught cheating, he usually gets banned. In the western world it is the task of game developers and publishers to find and punish cheaters, but in China and South Korea, rules are stricter, and punishments are harsher, as the have actual laws addressing cheating in video games. In South Korea you face up to five years in prison if you get caught developing or distributing cheating software, while in China if you hack in CS:GO you are basically banned from playing the game again, as your game account is tied to your citizen ID, so to create a new account after getting banned you literally have to be a different person. There are no indications of such laws emerging in any western state yet, but with the increasing popularity of online games it might only be a matter of time.
Handling cheating in video games has a lot in common with how governments deal with crime. There is prevention and punishment, there are set rules that state what you are not allowed to do and there is an authority overseeing everything. When a criminal suspect gets prosecuted, police will collect evidence, present it to a judge who will then find a verdict. To different branches of a democracy are involved in this process, the executive and the judicative branch and at every step there are possibilities for the subject to appeal and question decisions. Even the final verdict can be appealed or the rules that lead to a decision can be challenged. This is what we call a state of laws and the independence of the two branches and the many rights that are granted to a suspect ensure that the system is fair and can be trusted by others. The laws are the basis of a democracy and effective law enforcement and a system of checks and balances are the main factors why people trust their government. But in online games, these strong systems do not exist, and some might argue that this is not necessary as it is just the virtual world and it has no impact on your real life. But this I not entirely true. Many friendships that exist in real life are being enhanced as friends can also play together online. If one gets restricted from playing the specific game all his friends are playing, it will impact his relationship to them. Fair systems are needed to ensure that false positives have the chance of getting rehabilitated and punishment needs to be relative to the offense.
There are many different forms of punishment for criminals all over the world, but all of them can be diverted into two categories, depending on their focus: either its strict punishment like in the United States or Saudi Arabia or its rehabilitation and reintegration into society, which is often referred to as the Scandinavian Model. In Germany, its mostly a balance between these categories and that is something we need to have as well when it comes to online gaming. The cheater needs to be punished, but he also needs to have a chance to appeal and a second chance to prove that he can be valuable to the games community. Lifetime bans are a pretty harsh sentence and usually out of proportion. You should not be prevented from ever playing a game again because you made one dumb decision. There are also a lot of kids playing video games, who might not overthink a decision but will have to suffer from the consequences their entire life.
So, the final question is: Is the current situation on how we handle cheating appropriate? If it was, this essay would have ended on the first page and everyone would be happy. But its also not all bad, but there is a lot of room for improvement. Offenders need to get second chances, as a game can be more than just some pixels on your screen. A game is something you invest time and money in, especially CS:GO has an entire economy built around it, focusing on cosmetics for weapons, which sometimes sell for more that 10.000$ if they are especially rare. Your assets are locked when you are banned, and, in most cases, players agree, you do not deserve to get any benefit out of a system you cheated, which holds true and is understandable 99% of the time. Punishment needs to be done but in better way than now. It is good to lock someone’s in-game assets and to restrict him from playing if he cheats, but if the system that punishes him failed and made a wrong choice, you need to have a right to appeal, and you need to be able to come back at some point in time, get a second chance.
To conclude, all methods of anti-cheat won’t make the guy from the introduction happy, because he is stuck in that game. But with better methods and the rising use of artificial intelligence he can be increasingly sure that this player will be banned at some point. But the suspected cheater could have also had just a very luck day and might get convicted without ever using cheats. It is totally legit for a system to make some mistakes, but it is extremely unfair if the system does not offer any chance for the suspect to appeal. A very bright future can be predicted for methods of light or hidden punishment like Valves trust factor, as it does offer second chances and wont ban people. It just sorts them, so most of the community will have a great and competitive online gaming experience, and every step that makes this even better is a step we can look forward to. If done right, anti-cheat is one of the most valuable assets of an online game and if its fair and reliable, its also the best thing that can happen to the game’s community.
 https://engineering.riotgames.com/news/riots-approach-anti-cheat [last visited on July 19th, 2018 at 10:00pm]