Can disrupting an online video game be illegal?

Question

Imagine for example, a person makes an online game unplayable by flooding the game with bot accounts, winning games through cheating etc, but the person doesn't steal any data and they aren't violating copyright either since they are just sending packets of bytes to the server. Can the editor/publisher of the game do anything in this case ?

Answer 1

united-kingdom

Assuming "editor" does not authorise the player to flood the game with bots then this would be an offence contrary to section 3 Computer Misuse Act 1990 (with relevant provisions emboldened by me):

(1) A person is guilty of an offence if—

• (a) he does any unauthorised act in relation to a computer;

• (b) at the time when he does the act he knows that it is unauthorised; and

• (c) either subsection (2) or subsection (3) below applies.

(2) This subsection applies if the person intends by doing the act—

• (a) to impair the operation of any computer;

• (b) to prevent or hinder access to any program or data held in any computer; or

• (c) to impair the operation of any such program or the reliability of any such data; or

• (d) to enable any of the things mentioned in paragraphs (a) to (c) above to be done.

(3) This subsection applies if the person is reckless as to whether the act will do any of the things mentioned in paragraphs (a) to (d) / to (c)of subsection (2) above.

(4) The intention referred to in subsection (2) above, or the recklessness referred to in subsection (3) above, need not relate to—

• (a) any particular computer;

• (b)xany particular program or data; or

• (c) a program or data of any particular kind.

(5) In this section—

• (a) a reference to doing an act includes a reference to causing an act to be done;

• (b) “act” includes a series of acts;

• (c) a reference to impairing, preventing or hindering something includes a reference to doing so temporarily.

(6) A person guilty of an offence under this section shall be liable—

• (a) on summary conviction in England and Wales, to imprisonment for a term not exceeding 12 months or to a fine not exceeding the statutory maximum or to both;

• (b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or to a fine not exceeding the statutory maximum or to both;

• (c) on conviction on indictment, to imprisonment for a term not exceeding ten years or to a fine or to both

Whether or not game cheating would be prosecuted is fact dependant.

Answer 2

The United States Computer Fraud and Abuse Act has been used to prosecute Aaron Swartz on the basis of a violation of a website's terms of service. Representative Lofgren, criticizing the law, said:

It looks like the government used the vague wording of those laws to claim that violating an online service's user agreement or terms of service is a violation of the CFAA and the wire fraud statute.

This law has not been amended and is still a viable path for prosecution.

But see the United States Department of Justice manual on this in which they adopt a policy of not prosecuting charges based on "exceeding authorized access" found in a user agreement except in limited circumstances. E.g. (there's much more, but this is just a flavour of their conservative approach to these kinds of charges):

The Department will not bring “exceeds authorized access” cases based on the theory that a defendant’s authorization to access a particular file, database, folder, or user account was conditioned by a contract, agreement, or policy, with the narrow exception of contracts, agreements, or policies that entirely prohibit defendants from accessing particular files, databases, folders, or user accounts on a computer in all circumstances. A CFAA prosecution may not be brought on the theory that a defendant exceeds authorized access solely by violating an access restriction contained in a contractual agreement or term of service with an Internet service provider or web service available to the general public—including public websites (such as social-media services) that allow for free or paid registration without human intervention. Also, a CFAA prosecution may not be brought on the theory that an employee has used a computer generally designated for his or her exclusive use in a way the employer’s policy prohibits—for example, by checking sports scores or paying bills at work. However, an “exceeds authorized access” CFAA prosecution may be brought, for example, against a defendant who accesses a multi-user computer or web service, and is authorized to access only his own account on that computer or web service, but instead accesses someone else’s account.

However, in your hypothetical, the person does more than merely "exceed authorized access"; they have made the game "unplayable by flooding the game." There is case law from several federal circuits that has interpreted the CFAA to apply in circumstances where a person impairs "the integrity or availability of data, a program, a system, or information" (see this blog post, summarizing case law as of 2013, but the statute has not been amended).

Answer 3

First, you are describing using multitudes of bot accounts to degrade the performance of a service below reasonable usability. That is a textbook definition of a "Denial of Service" attack (DoS).

The concept of a DOS attack is well understood by law enforcement agencies, and many countries have criminal law against it, and the authorities would be free to prosecute the perpetrator under that criminal law. By the way the "D" in DDOS is irrelevant, it means using many computers for the bot accounts instead of just one. It does not affect the substance of the charge.

However you said "illegal", and that introduces the broad plains of civil law. Right off the bat, to log into the game you signed an End User License Agreement, a Terms of Service and/or a Conduct Policy. Go read those.

Further, you are disrupting the relationship between the game owner and their other clients. That is, mass botting and cheating cause a "tragedy of the commons" effect which makes the game worse for legitimate players. "Tortious interference" is incredibly difficult to prove, and is almost never charged successfully. Yet Blizzard, author of World of Warcraft, successfully won a tortious interference case against a bot company - the bot was ruining the game for other players.

I myself witnessed "bots gone wild" in certain MMO games, where normally a player should be able to "earn a living wage" by mining or picking herbs in the wild. The "bots" flood the market driving prices to nil, making developing that trade skill absolutely pointless.