Imagine for example, a person makes an online game unplayable by flooding the game with bot accounts, winning games through cheating etc, but the person doesn't steal any data and they aren't violating copyright either since they are just sending packets of bytes to the server. Can the editor/publisher of the game do anything in this case ?
9
-
4In this hypothetical, who is "the editor"? Can you explain why you think copyright is relevant to mention? And in the hypothetical, did the person doing these things agree at any point to not do those things (e.g. through a user agreement).– user46677Sep 5, 2022 at 13:16
-
1I mean the editor/publisher of the online video game. Copyright can be relevant since for example a hacker setting a private server for the same can be attacked for copyright violation, but the hacker in my question doesn't do it. The hacker had to agree not to do these things since they are part of the account creation process, but I don't think user agreements are much considered by the law, I could be wrong though.– eternalstudentSep 5, 2022 at 13:22
-
3@Trish I see, in French the term Editor is used to refer to the publisher hence my confusion.– eternalstudentSep 5, 2022 at 15:57
-
1If it causes harm to the business the publisher can claim. Depends if they are sitting behind an untraceable network though.– mooSep 5, 2022 at 20:20
-
3In practice, players who break a game's terms of service tend to have their accounts banned, and possibly their IP addresses blocked. Anecdotally, it's rare for game companies to go further than this, as these measures tend to be sufficient.– Steve MelnikoffSep 6, 2022 at 10:23
|
Show 4 more comments
3 Answers
Assuming "editor" does not authorise the player to flood the game with bots then this would be an offence contrary to section 3 Computer Misuse Act 1990 (with relevant provisions emboldened by me):
(1) A person is guilty of an offence if—
(a) he does any unauthorised act in relation to a computer;
(b) at the time when he does the act he knows that it is unauthorised; and
(c) either subsection (2) or subsection (3) below applies.
(2) This subsection applies if the person intends by doing the act—
(a) to impair the operation of any computer;
(b) to prevent or hinder access to any program or data held in any computer; or
(c) to impair the operation of any such program or the reliability of any such data; or
(d) to enable any of the things mentioned in paragraphs (a) to (c) above to be done.
(3) This subsection applies if the person is reckless as to whether the act will do any of the things mentioned in paragraphs (a) to (d) / to (c)of subsection (2) above.
(4) The intention referred to in subsection (2) above, or the recklessness referred to in subsection (3) above, need not relate to—
(a) any particular computer;
(b)xany particular program or data; or
(c) a program or data of any particular kind.
(5) In this section—
(a) a reference to doing an act includes a reference to causing an act to be done;
(b) “act” includes a series of acts;
(c) a reference to impairing, preventing or hindering something includes a reference to doing so temporarily.
(6) A person guilty of an offence under this section shall be liable—
(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding 12 months or to a fine not exceeding the statutory maximum or to both;
(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or to a fine not exceeding the statutory maximum or to both;
(c) on conviction on indictment, to imprisonment for a term not exceeding ten years or to a fine or to both
Whether or not game cheating would be prosecuted is fact dependant.
-
8Just cheating is questionable (outside of South Korea who have quite strict legislation for this), but OP is proposing a DDOS attack, which would very clearly be illegal under the Legal terms you laid out. The publisher would have a very easy case on their hand, provided some proof on the attackers doing this is available– HobbamokSep 6, 2022 at 8:49
The United States Computer Fraud and Abuse Act has been used to prosecute Aaron Swartz on the basis of a violation of a website's terms of service. Representative Lofgren, criticizing the law, said:
It looks like the government used the vague wording of those laws to claim that violating an online service's user agreement or terms of service is a violation of the CFAA and the wire fraud statute.
This law has not been amended and is still a viable path for prosecution.
But see the United States Department of Justice manual on this in which they adopt a policy of not prosecuting charges based on "exceeding authorized access" found in a user agreement except in limited circumstances. E.g. (there's much more, but this is just a flavour of their conservative approach to these kinds of charges):
The Department will not bring “exceeds authorized access” cases based on the theory that a defendant’s authorization to access a particular file, database, folder, or user account was conditioned by a contract, agreement, or policy, with the narrow exception of contracts, agreements, or policies that entirely prohibit defendants from accessing particular files, databases, folders, or user accounts on a computer in all circumstances. A CFAA prosecution may not be brought on the theory that a defendant exceeds authorized access solely by violating an access restriction contained in a contractual agreement or term of service with an Internet service provider or web service available to the general public—including public websites (such as social-media services) that allow for free or paid registration without human intervention. Also, a CFAA prosecution may not be brought on the theory that an employee has used a computer generally designated for his or her exclusive use in a way the employer’s policy prohibits—for example, by checking sports scores or paying bills at work. However, an “exceeds authorized access” CFAA prosecution may be brought, for example, against a defendant who accesses a multi-user computer or web service, and is authorized to access only his own account on that computer or web service, but instead accesses someone else’s account.
However, in your hypothetical, the person does more than merely "exceed authorized access"; they have made the game "unplayable by flooding the game." There is case law from several federal circuits that has interpreted the CFAA to apply in circumstances where a person impairs "the integrity or availability of data, a program, a system, or information" (see this blog post, summarizing case law as of 2013, but the statute has not been amended).
-
That being said: The Aaron Schwartz case was a highly political one, so we can't really expect the same arguments to pull through against just any attacker– HobbamokSep 6, 2022 at 8:51
-
4It should also be emphasized that the Swartz prosecution may have cost US Attorney Carmen Ortiz her political future. I don't think other prosecutors are likely to try and repeat that.– KevinSep 6, 2022 at 16:02
-
Yes, the Swartz case had little chance of surviving appeal. The way they venue shopped it to find anyone who might convict, all but proved the weakness of their case. Sep 7, 2022 at 2:06
First, you are describing using multitudes of bot accounts to degrade the performance of a service below reasonable usability. That is a textbook definition of a "Denial of Service" attack (DoS).
The concept of a DOS attack is well understood by law enforcement agencies, and many countries have criminal law against it, and the authorities would be free to prosecute the perpetrator under that criminal law. By the way the "D" in DDOS is irrelevant, it means using many computers for the bot accounts instead of just one. It does not affect the substance of the charge.
However you said "illegal", and that introduces the broad plains of civil law. Right off the bat, to log into the game you signed an End User License Agreement, a Terms of Service and/or a Conduct Policy. Go read those.
Further, you are disrupting the relationship between the game owner and their other clients. That is, mass botting and cheating cause a "tragedy of the commons" effect which makes the game worse for legitimate players. "Tortious interference" is incredibly difficult to prove, and is almost never charged successfully. Yet Blizzard, author of World of Warcraft, successfully won a tortious interference case against a bot company - the bot was ruining the game for other players.
I myself witnessed "bots gone wild" in certain MMO games, where normally a player should be able to "earn a living wage" by mining or picking herbs in the wild. The "bots" flood the market driving prices to nil, making developing that trade skill absolutely pointless.
answered Sep 7, 2022 at 2:02
Harper - Reinstate MonicaHarper - Reinstate Monica
19.3k2 gold badges27 silver badges81 bronze badges
-
I think you're overextrapolating from
makes a game unplayabletobring down the server. I think the proposed scenario implies the server continues to operate but the presence of the bots on it precludes the game being played in the manner it's designed for. This might still qualify as "service" though more subjective than whether a server responds to connections.– WillSep 7, 2022 at 10:52 -
@Will I think the analogy is fit. The server would be "down" if the internet connection was cut, even though the machine itself still operates correctly. Here, the bots would "bring down the server" if the clients could no longer use it. An attack like this would allow a gradient of service, where the service may not be working correctly, but neither completely "down", but I think that the goal of "making the game unplayable" goes for the later (even if it's not completely successful).– ÁngelSep 7, 2022 at 21:52
-
1@will you're right, that was not a good choice of words. Edited. Sep 7, 2022 at 23:53