Virtual Worlds #4: Have you been duped?

If you discovered a reliable method of duplicating items in your favorite massively multiplayer game, what would you do? Would you report the bug to the server administrators? Would you keep it under your hat, dupe the odd high-value item, and hope nobody else finds it? Would you dupe everything you could lay your hands on, flog the proceeds to other players, and split? For one Everquest II player who stumbled upon such a method late last year, the answer was easy.

It's hardly an unfamiliar story to most MMO players. Boy meets duping exploit, boy dupes high-value items, boy sells high-value items to unsuspecting players or vendors, boy cashes out and takes his girlfriend and entire family to Paris. In this case, the culprit was an ordinary EQ2 player called Methical, who duped his way to many thousands of dollars last December and January, and told the world about it on Plaguelands.

Methical's surprisingly simple scheme involved jiggery-pokery with the vendor system, allowing an accomplice to buy an item from him without actually transferring the object -- a new copy was created in the purchaser's inventory. A recently discovered World of Warcraft duping method required running in and out of instanced dungeons. Any time objects are being moved around, there's the potential for duping; you just need to convince the game not to delete the item you sold from your inventory, and voila.

Now, you'd think this would be awfully easy to spot. Large databases -- and that's all MMORPGs are, under the flashy graphics and complex interfaces -- are often written in such a way as to make entering duplicate records difficult or impossible. Surely all Sony needs to do is look for items with the exact same information, and delete them?

But Methical's success indicates spotting this activity is harder than that. In his Astromech Stats article on the Star Wars Galaxies' official website, lead designer Raph Koster tells of a duping exploit that was only spotted by large-scale monitoring of economic trends, not by observing the dupers in action or noticing the duplicate items themselves.

Maybe if Methical had curbed his cash-gathering instincts and not plunged the economy into sudden inflation, the loophole would still be there. Indications are that the World of Warcraft duping method had been known by a handful of people for some considerable time before it became public, and it seems to be a pattern that duping exploits aren't noticed -- or, at least, aren't publicly corrected -- until someone gets greedy.

So what's the legal position of such activities? Methical wasn't gaining unauthorized access to the servers. He didn't steal anything from anybody. He wasn't running an external hacking program of any kind. He was just using the vendor system in a way the designers hadn't anticipated.

Sure, he was probably breaking the EQ2 licensing agreement, terms of service, and so on, but that's hardly crime of the century. Any long-term MMO player has probably broken some rule in there; after all, it's not like anybody actually reads that crap. Who's the victim here, exactly?

But from the sounds of it, Methical made his money from third-party resellers like IGE, who bought the virtual cash from him for real dollars, then sold it to other players. How would you feel if you put down real cash for EQ platinum, then had it identified as duped and deleted?

One thing's for sure: If you go crying to Sony's support team, you'll only get as far as, "I bought this gold off IGE.com and..." before being laughed off the line. Such are the risks of trading outside the game. What would have happened, I wonder, if Methical had used Sony's Station Exchange trading system instead? It wasn't around at the time of the exploit, but I'm inclined to suspect he would have got caught a whole lot quicker, and unsuspecting players who bought his gold might have a solid case for a refund.

Can netting such a large sum of money (and reports put it around $70,000) from knowingly exploiting a game bug really go unpunished? So far, it sounds as if the only sanctions Sony took were banning the accounts (and no doubt there were many) Methical and his accomplice were using, and deleting the money that came from sales of duped items. Methical even boasts in his article that he still has plenty of non-banned accounts, and even if he didn't, it's not like Sony could stop him opening fresh ones if he wanted.

I'd be interested to know whether Methical intends to report his earnings to the IRS. It must make him one of the most successful non-corporate virtual world content traders in history. Should Sony have taken harsher action? Even if it were possible to sue him, the damage was already done, and all that effort is better spent on preventing future duping exploits. Besides, if it had been you that stumbled across the exploit, maybe you'd have done the same.

Virtual Worlds provides a regular in-depth exploration of thorny issues, news, analysis, and commentary on everything happening in the massively multiplayer world.

Recent columns:
- Virtual Worlds #3: Sony's Great Experiment
- Virtual Worlds #2: Marveling at the Opportunities
- Virtual Worlds #1: Two Million and Counting

• Have something to say? Email us your comments.