Team Security: 2021 in Review

What about them? It’s Jita man!

But on serious note, those chat bots that you might have in mind, this is something we are not looking at right now as there are other bots out there that need all of our attention.

But if you see somebody obvious, or a player who is really spamming, like if you see a behavior in the game, not just in Jita local, please report it to us via a Support Ticket so our GM’s and us can take a look at it, investigate and take appropriate actions.

These numbers are very underwhelming considering the perceived scourge of bots and rmters that players seem to believe is out there. Is botting and rmt not as rampant as players believe or are your resources so constrained that you can’t even make a dent?

I was going to write some kind of constructive reply about false positives, confirmation bias, abysmal copy/paste response when a victim of a false positive ban create a ticket. But this post just made me too upset.

I’ve been through “The data that we have was very accurate regarding your in-game activity”, three tickets, being linked the EULA and ToS (repeatedly) as if I didn’t know cheating is not allowed, a partner reaching out to the community team, sending an e-mail to the community team to finally arrive at “my bad dawg, false positive confirmed, here is 7 days omega for the affected accounts”.

This is a subject that infuriates me as more and more people reach out to me asking for advice knowing I have had a ban, for macro use, reverted and account record cleared.

I’ll take a chill pill and hopefully be back for that Q&A.

1 Like

This is a constant battle that we are fighting. We spot a pattern of a popular Bots or RMT method, we start swinging the ban hammer left, right and center and in just short amount of time those bad guys adjust and it takes us a while to see that the pattern has changed, do some changes on our end to uncover a new method and start issuing bans again. So the effort of the Team is constant. We are also supported by the PX Tools programmers who are making changes to our current tools and are working on the new ones, all that will make our effort easier and more efficient.
The bad guys just come back and it is really a constant battle that we are fighting right now. And that actually shows that we do make a dent as we force the bad guys to change which means that we are disturbing the ISK supply to the black market. But this is not something that can be done in a week or even a month, this is a long battle of attrition.


As I mentioned above, we try to avoid false positives and if it happens, we try to make the affected players as happy as possible. Now I can not post the details on your case here, because I would be violating our 3rd party policies.
But in your case all I can say, that the suspension was issued when we were working on our procedures, adjusting the methods and because the method of detection was “new” that caused your false positive.
And I am very sorry about that.
But as far as I can see (or better say) your issue was addressed in timely manner and we have provided a compensation that our rules and policies allow.

1 Like

My issue has been dealt with. The initial response on my tickets was still abysmal. But this is missing the point that more and more people are reaching out to me asking for advice on what to do as this keep happening to people.

I expressed some ideas on how you can improve things in my tickets but that was left without any reply or comment. I have had time to think more on this since we last spoke. Feel free to reach out to me and I will happily work with you on this.

1 Like

We also did some changes on how we handle tickets. Streamlining the processes and making it more efficient and trying to get to our players as fast as possible.
Just to give an example here, if we issue a lot of bans that will contain a lot of false positives, that will cause a huge spike of tickets and those would need to be addressed and that requires time. So by causing massive false positives, the amount of time that the players will need to wait for their ticket to be reviewed will go up and up. So we are keeping our ticket queue as low as possible and are trying to avoid huge spikes, doing the work before we issue the ban.

If you have somebody who is falsely banned, the best way is actually to create a support ticket for us to review and to deal with that.

1 Like

I personally think that this is just the way we humans react to something bad and something that do not belong. Bad experience is always easier to remember, it stays with the player for a while, and if a certain action from our part does not come as soon as we would have hoped (since we are only humans as well) - there you go, that’s how the negative perception is made.

You say they should create tickets. Here is a handful of replies on their tickets.

Your accounts have been banned for the use of macro/other modifications. This is not a mistake, not a misunderstanding and I assure you that our tools are accurate enough to issue a penalty to the account.
Kindly mind that any further violations will result in further actions taken towards the account. Our detection tools are accurate enough to allow us to determine whether any automation process was used.

The data that we have was very accurate regarding your in-game activity.
The temporary ban has been lifted, however, kindly mind that any further violations of the similar kind will result in the permanent ban.

The data that we have was very accurate regarding your in-game activity.
The temporary ban has been lifted, however, kindly mind that any further violations of the similar kind will result in the permanent ban.

The data that we have was very accurate regarding your in-game activity.
The temporary ban has been lifted, however, kindly mind that any further violations of the similar kind will result in the permanent ban.

The data that we have was very accurate regarding your in-game activity.
The temporary ban has been lifted, however, kindly mind that any further violations of the similar kind will result in the permanent ban.

Unfortunately, no further comments on this situation will be made by our security team. The ban has now been lifted, but the record will not be scrubbed. Any further violations will result in a permanent suspension of your account.
Please make sure to take some time and read our EULA and Terms of Service:

I am afraid that the previous decision will stay. The ban has been lifted, but kindly mind that any further violations of the same nature might cause the permanent ban of the account.
This ticket will now be closed.

What are they supposed to do now?


There is no need to post the ticket replies as those were sent by either me personally or one of our team members. Again, I can not say exactly what happened to those players as I lack information like ticket ID’s or character names. But here is not the place to post that information.
The best way would be, to create a support ticket for us to review the situation again.
We are taking this matter very seriously and are reviewing each and every ticket.

1 Like

we need transparent customer support instead of copy-paste formula its easy to copy-paste formula and just add reason for penalty etc. well it appears that GMs are using some automated reply tool to reduce time spent on certain ticket.

as for false positives,you actually do not need install any third party software,keyboard has it integrated and there grey area happens. some people play other games and they have setup hardware-side macro. they keep playing the other game for some time then go back to eve,they turn off that macro but routine causes this to fail after X months. player is caught.

could it be possible to apply integrated into launcher detection tool that would prevent you starting game when macro is running? this way no false positives,if ban happens then someone bypassed the detection tool and launched game with macro in background. no more innocent people banned,also if someone starts macro after passing the detection tool,game should detect it and instantly disconnect you with error that you have macro running on background… i know it may be hard to implement but best would be reduce the false positives to absolute zero. so no unhappy customers,if someone gets caught thats their mistake by running game with macro.

one more question,does eve actually scans your system? checks what you have installed and possibly access any data located on hard disk? what actually game does while running? could someone from above acquire access to someones hard disk throught game?

I will write something up for the Q&A.

Ok, here is a lot to unpack.
There is sometimes really not much we can say in a ticket. Just simply that we have reviewed the situation and our decision stands. We can not provide detailed information on what exactly etc. etc. etc. This has nothing to do with transparency, but not providing the information to the heavy bot users or even bot developers.
I can assure you, the bans that we issue are not because of some hardware keyboard that has the macro feature. Our investigations are much deeper than that.
It kinda sounds that every player we ban is a false positive. And that is not true. The bans we issue are solid, meaning that there was something there and that is why we issued a ban. Sometimes it can happen that we get into a gray area and a ban is false positive. But those cases are very very very small amount compared to the ban numbers that our team is issuing.
There is just no way around it, it can happen. But we are doing our best to avoid it completely or address the issue as fast as possible if it does happen.

There are some ideas going around and some probing, but I really can not comment on this right now. But I can say, that other departments in CCP also looking into this and are working on something. Hopefully we will be able to share more information soon.

Regarding scanning of the system, now this is more of a question towards other CCP Devs, but from my experience as former Technical GM, no scans of the player system are performed. The only things that are checked is the usual stuff, where is the sharedcache located, does the user have the proper folders in C:\Users\USER\AppData\Local\CCP etc. like everything that is needed to operate the game client. Yes, also shared cache is checked to some extend, to make sure there are no damaged files.

But no, EVE Launcher and Client does not perform the RAM and Disk check to see if any botting, scripting or automation software is used.

Oof, I wish it was that easy. For transparency reasons - I don’t think there is a technical way to do exactly what you suggest, for now at least. It might change in the future, but for now I can already imagine at least a dozen of serious obstacles that would make it impossible. And we actually have pretty nice tools, they do show a lot, I promise. But yeah, this certain implementation is a bit… utopian, although I personally love the idea. If it was that easy, we would have done it, I assure you :smiley:

Regarding the scans: we do collect some information of the hardware, as you can see in our Privacy Policy. This is of course to prevent cheating/botting/RMTing from happening, this is a common practice for all of the multiplayer games and this information is only available to CCP. But this is only for collection, this data is not super helpful on its own. Answering your questions - nope, this is technically impossible, unless this someone deliberately uses software for the remote control, but this is not our doing. I would highly advise not to do it, as all the stories of giving someone remote control over your own PC never end well.

Would something like VAC work?

Funny. I got falsely banned in 2019 because your GMs can’t do their job worth a damn, while the asshole RMTer who got me banned is still playing.
Your GMs falsely ID’d an Ishtar Officer hunter as a bot.
You banned Brisc and Pando because your intel tools are trash.
Falcon supposedly stole a shitton of IRL cash meant for CCP-CSM activities.

Why should we listen to anything you have to say about anything of importance, ever?

@Roughneck_Joe This dude wants to have a word, @GM_Stinger . Falsely banned for Ishtar ratting, and your GMs were ■■■■■■■ despicable.

How do you differentiate between what I did, which was selling fake intel data regarding supercap production and storage POS towers off-forums to interested parties off-forums from the HBC days, and actual RMTing?

All I see is “I’m ■■■■■■■ right and you cheated, no argument.” Followed by “I was ■■■■■■■ wrong, but I still say I’m right and you cheated, no argument.”

This, by the by, is why the playerbase looks at the collective lot of you as a joke.

1 Like

Same ■■■■ happened to me.
Same ■■■■ happened to Joe.

Yes, I know it’s a wall of text. Please hear me out.

My Enemies Are Cheaters

Okay, perhaps I should clarify my concerns. I’m a hardcore filthy multiboxer who has personally had several people voice concerns that I was a cheater. This has included:

  • People messaging me to confirm I was not a bot
  • People saying I was a bot in local
  • People saying I was using macros in comms, not realizing that I was in comms with them

Additionally, there have been posts/threads, like Ancantes’ above or this one accusing a ganker of using macros, where people have asserted that someone was a botter/macro user while simultaneously demonstrating that they did not understand how legit players multibox.

Of course, none of this is to say that cheaters don’t exist, or that CCP shouldn’t keep up the good fight against them. However, it is clear that some players assume cheating when they lack sufficient evidence to do so. Hell, it’s not even limited to botting/macro usage, or Eve Online for that matter. For example, I have seen several people assert that gankers were evading concord, but it turned out that they simply didn’t know the difference between a criminal timer and -5 sec status, and here’s a thread of someone accusing Adrian Vexier of being a cheater. But rather than prove that Adrian was a cheater, it mostly serves to (1) highlight all of OP’s knowledge gaps about the game, and (2) show how persistently people can believe their enemies are cheating in light of evidence to the contrary. And, of course, no post on the topic would be complete without the memes…

Teh Memes


Why does this matter?

  • Players like their games to be fair, which means that they don’t like playing with cheaters -real or imagined.
  • Seeing CCP not do anything about these “confirmed cheaters” damages players faith and confidence in CCP to do something about cheaters.
  • It undoubtedly leads to plenty of reports of legit players, which can divert security team resources away from investigating more credible reports.

Look, the average player probably doesn’t consider this a problem, because they probably don’t get a lot of false accusations thrown their way. But I know that this is a very real issue because I’m the type of player who does. I don’t know how widespread the problem is, or how much damage it does, but I know for a fact that it is a problem.

And, not for nothing, but I wasn’t too thrilled with your response to Ancantes. Yes, you did set him straight on the difference between input broadcasting and botting, but you also confirmed that he had found a cheater, in spite of his evidence being extremely lacking. And so now you’re in a situation where if you don’t ban the guy, it won’t matter if he’s actually a cheater or not -Ancantes will believe that he is, and that CCP is unable/unwilling to do anything about him.