What Can Farmers Teach Us About Criminal Networks? By observing how covert financial networks operate in online games like , we can learn about how they might function offline. By Brian Keegan, Muhammad Aurangzeb Ahmad, Dmitri Williams, Jaideep Srivastava, Noshir Contractor DOI: 10.1145/1925041.1925043 s information communication technologies have grown more pervasive, understanding the ways in which they are employed for unexpected, deviant, or even criminal purposes becomes increasingly important. Networks in particular are growing in importance as a lens onto how individuals behave and organizations Aoperate. It seems appropriate that network analysis methods could also be applied to understand how clandestine or criminal organizations, such as drug traffickers and terrorist cells, coordinate and adapt while avoiding detection. Yet, the hidden nature of the relationships in these dark networks necessarily implies that collecting and analyzing complete or even representative data on these networks is very difficult.

However, the explosion of behav- possible to analyze data on a scale that people is hugely expensive and peoples’ ioral data available in online data- would be impracticable or impossible cognitive biases and social desirability bases has opened up new avenues of to do in the real world. For example, factors often makes results unreliable. social research. One such source are administering surveys to thousands of Likewise, observing individuals inter- so-called massively multiplayer online acting may be more reliable, but obser- games (MMOGs), large-scale social en- vations could start after or stop before vironments in which players of vary- interesting interactions take place. ing levels of expertise join cooperative MMOGs such as World of Warcraft, teams to accomplish complex tasks. “Gold farming and EverQuest II, and Lord of the Rings To the extent that individuals in online real-money trading Online are examples of game worlds virtual worlds engage in similar psy- where millions of players interact in chological, social, and economic be- refer to practices a persistent virtual environment. Just havior as they do in the offline world, that involve the sale as these game economies exhibit mac- research in MMOGs and virtual worlds roeconomic characteristics observed can potentially be mapped backwards of virtual in-game in real-world economies [2], virtual to illuminate offline behavior [1]. Be- resources for real worlds also contain black markets for cause the organizations that operate acquiring goods and skills. The organi- MMOGs maintain archival databases money via exchanges zation and behavioral dynamics of us- of all player actions and attributes, it is outside the game.” ers engaged in these illicit operations

XRDS • Spring 2011 • Vol.17 • No.3 11 coupled with the exhaustive digital “Gold farming has ally [4] while lacking legal jurisdiction, footprints of their activity potentially precedent, or regulation. provides a unique window into under- been constructed Finally, farming upsets the merito- standing how clandestine networks as a deviant activity cratic and fantasy-based nature of the operate in other contexts. game. Some players may cease to play if by both the game other players can buy rather than earn developers as accomplishments. If you team up with What is gold farming? someone clad in rare Titansteel armor, While playing alone or with other well as the player it might be an unwelcome surprise in players, MMOG players accumulate ex- communities.” the middle of battle if this outwardly perience, armor, spells, and weapons expert player does not even know basic to improve their power against comput- game mechanics. For these reasons, er non-player characters (NPCs). The many of the largest game developers and in-game currency like Blizzard, Sony, and Square actively players acquire make their characters and publicly ban accounts engaged in more powerful, and the acquisition of gold farming. However, other games these items is one of the major goals Gold farming and real money trade such as Second Life, Project Entropia, of play. Virtual goods like in-game cur- operations originated in the first mas- and EVE Online explicitly allow players rency, scarce commodities, and power- sively multiplayer online role-playing to indirectly or even directly exchange ful weapons require substantial invest- game, , in 1997. The online currency and items for offline ments of time to accumulate. However, practice grew rapidly with the parallel money. these can also be obtained from other development of an e-commerce infra- players within the game through trade structure in the late 1990s and the in- and exchange. troduction of MMOGs into East Asian How do gold farmers behave? “Gold farming” and “real money markets. Gold farming operations now Our initial work approached gold farm- trading” refer to practices that involve appear to be concentrated in ing as a binary classification problem: the sale of virtual in-game resources where the combination of high-speed you are either a gold farmer or you are for real-world money via exchanges Internet penetration and low labor not. What behavioral attributes influ- outside of the game. The name stems costs has facilitated the development enced whether or not accounts and from a variety of repetitive routines of the trade. their characters were identified as gold (“farming”), which are employed to Although outwardly innocuous, farmers? First, a training set of known accumulate virtual wealth (“gold”), gold farming has been constructed farmers caught by human players and which is sold to other players who lack as a deviant activity by both the game customer service representatives from the time or desire to accumulate their developers as well as the player com- Sony Online Entertainment (SOE) gave own in-game capital [3]. By repeatedly munities for a variety of reasons. First, us our reference set. Then, using deduc- killing NPCs and looting the currency in-game economies are designed with tive approaches like logistic regression they carry, farmers accumulate curren- carefully calibrated activities and as well as inductive machine learning cy, experience, or other forms of virtual products that serve as sinks to remove techniques, we examined an anony- capital that they exchange with other money from circulation. The injection mized database constructed from both players for real money via transactions of farmed gold into the game economy surveys and behavior data collected outside of the game. Other types of ac- creates inflationary pressure, unin- by the game maker. By combining tivities also fall under the banner of tended arbitrage opportunities, and self-reported demographics (like age, “real money trade”; players can sell rare other perverse incentives that under- language, and gender) with gold farm- weapons, armor, and spells within the mine the stability of the game econo- ing behavior (like time played, money game for offline money and accounts my. Second, farmers’ activities often earned, NPCs killed), latent behavioral with elite characters have been known overtly affect other players’ experienc- proxies (like quests completed, recipes to sell for thousands of dollars. es, for instance taking over profitable learned, deaths), and behavioral pat- Gold buyers then consume the gold regions of the game and preventing terns (like successive NPC kills), we they purchased in the game to obtain other players from completing quests. classified players based on their like- more powerful weapons, armor, and Farmers also employ anti-social com- lihood of matching “caught” farmer’s abilities for their avatars. This, in turn, puter scripts (“bots”) to automate the patterns [5]. accelerates players to higher levels and farming process that results in the un- As expected, some variables such allows them to explore larger parts of canny experience of zones filled with as speaking Chinese, playing for long the game world, confront more inter- players but bereft of social interac- periods of time, using recently estab- esting and challenging enemies, and tions. Third, the game developers are lished accounts, dying repeatedly, and increase their social standing without risk-averse to the legal implications of avoiding quests greatly increased the having to invest much time in the te- sanctioning a multinational industry odds of being identified as a gold farm- dious parts of completing quests and estimated to generate between $100 er. This meshed well with journalistic killing monsters for money and items. million and $1 billion in revenue annu- and community accounts of gold farm-

12 XRDS • Spring 2011 • Vol.17 • No.3 ers being primarily located in China, How do gold farmers interact? clandestine organizations are assem- playing accounts continuously until In light of the fact there are simul- bled on underlying trust relationships, they are banned, not being skilled at taneously many gold farmer roles or network analyses of trust proxies—like non-routine in-game tasks, and avoid- classes as well as a significant num- trade and exchange relationships— ing the story-based elements of the ber of unidentified farming accounts, could reveal important patterns about game. we shifted the attention of our analy- how individuals in these organizations However, some variables which sis [6]. Because trade of items and in- are distributed throughout the entire should have been obvious validity game currency are the fundamental network. checks for whether an account was or operations in a gold farming network, First, the distribution of trade in- was not involved in gold farming acted we decided to employ a network ana- teractions was extremely unevenly dis- unexpectedly. Killing many NPCs actu- lytic perspective. The trade network tributed throughout the network—the ally significantly reduced the odds of was constructed from the list of the ex- network follows a power law degree being identified as a gold farmer while changes of items and money between distribution. The vast majority of char- having a large amount of wealth in a players by direct interaction or in-game acters in EverQuest II’s network have bank did not significantly increase or mail. These could include legitimate traded with one or two other charac- decrease the odds. Farmers’ behavior bartering (trading an for an item), ters over the whole nine-month span evidently did not differ significantly market exchange (trading an item for of data. However, there were several and was likely concealed by the be- currency), as well as unreciprocated dozen characters out of the approxi- havior of other players. Certainly, elite “gifts” (sending currency or item, but mately 43,000 characters on the server and hardcore players have killed many receiving nothing in return). in the trade network that traded with NPCs and accumulated great wealth. We examined the known farmer’s hundreds of other characters. Alternatively, farming accounts that prior trade exchanges with other char- This is not a smooth power law ei- have escaped detection also exhibit acters that were never banned. This ther; rather it is a truncated power law. this pattern. Using machine learning naïve suspect-by-association heuristic Were we to extrapolate a trend line in classifiers to predict gold farming sta- allowed us to define a set of farming Figure 1 for the number of nodes hav- tus, the precision and recall of these affiliates: these could be the paying ing between 1 and 10 connections, we models was surprisingly low. In fact, customers of a gold farmer, unidenti- see that beginning around 20 or 30 the classifier algorithms were return- fied farmers, or unsuspecting players. connections the data begins to fall off ing many false positives—accounts fit- The majority of players who never in- below this trend line. This pattern has ting the profile for other gold farmers teracted with a farmer were classified been observed in other studies of social but never identified and banned by the as non-affiliates. This trade network networks, transportation networks, game administrators. Clearly our ref- had a number of interesting topologi- and biological networks and indicates erence set was not an ideal set. cal properties. In keeping with the that at a transition point, it becomes SOE administrators, like many law mapping philosophy of comparing much more expensive or difficult to enforcement organizations, rely on re- and testing these in-game networks make additional links. As a result, sig- ports from players, patrols through the to their real-world counterparts, we nificantly fewer nodes are able or will- game world, coordinated sting opera- examined these features both for the ing to make that extra connection. For tions, and database sleuthing to iden- game data and for a dataset of known example, it might not be much more tify and “roll up” gold farmers. Based Canadian drug traffickers developed difficult for most people to keep in reg- on the administrators’ experience, by Carlo Morselli—known as the CAV- ular touch with 50 members of their they observed farmers employing in- IAR network. Given that criminal and social network versus 40, but it may creasingly sophisticated organizations become substantially more difficult to and supply chains they described like remember names, backgrounds, and a drug trafficking operation. There are shared experiences after you have 100. the “farmers” who actually collect the This is not the case for everyone—a few gold from the game environment and people are still social butterflies who send into the distribution network, can keep up 500 or 1,000 connections the “mules” who move this money be- —but there are substantially fewer of tween other agents in the network, the “As MMOGs grow in these butterflies than we would expect “dealers” who interact with custom- scale and complexity, by simple power law extrapolation. ers to give them the virtual items, the For both the suspect affiliates as short-lived “marketers” who chat these exciting well as the legitimate non-affiliates, channels, and the “wholesalers” or worlds and the novel this transition point occurs around the “bankers” who receive and distribute same point in the network; between 20 goods but otherwise remain inactive player interactions and 30 trade partners. However, for to avoid attention. Clearly, this was not within them assume the gold farmers, the transition point a simple binary classification task— occurs much earlier; between 5 and 8 each of these roles had very distinct be- increasing social trade partners. Paradoxically, this re- havioral profiles. relevance.” sult suggests that although farmers

XRDS • Spring 2011 • Vol.17 • No.3 13 Figure 1: The number of trading links in the network is unevenly distributed such attempt to limit who they trade with, that a few characters have most of the connections. While it is difficult for typical this effort is futile because they are accounts to maintain more than 20 or 30 connections, gold farmers actually tend still identified. Conversely, the affiliate to trade with fewer players than typical players. accounts appear to avoid detection by emulating the behavior of the popula- tion at large. However agency in this context goes both ways; game admin- istrators appear to only identify partic- ular subclass of farmers with limited connectivity while many likely farmers not only continue to operate undetect- ed, but remain well-connected. Second, the three broad character categories we identified—farmer, af- filiate, non-affiliate—occupy very dif- ferent positions in the network relative to each other. Following our findings here, although farmers have fewer trade connections to other characters compared to non-affiliate characters, what few trade connections they have are employed much more intensely than we see among non-affiliate char- acters. Unlike farmers, affiliate charac- ters have both more connections than non-affiliates but, like farmers, affili- ates use these connections much more intensely than non-affiliates. This sug- Figure 2: Typical players and unidentified affiliates with many connections trade gests that farmers and affiliates are with other characters who have many other connections. Gold farmers and offline both repeatedly exchanging gold and drug traffickers with many connections prefer to trade with actors with have few items with other trusted members of other connections. their organization. This point is fur- ther corroborated by examining differ- ences in the tendency for characters’ to form clustered trading patterns where characters A and C trade because they both also trade with B. Farmers have significantly higher clustering than non-affiliates, while affiliates have insignificantly less clustering. Farm- ing characters form tight-knit trading groups with other trusted co-offend- ers, which must support important efficiencies because it is a distinct and intuitive signature for administrators to identify. The third and final topological fea- ture of the gold farming network we examined was its assortativity. We have an intuitive notion (certainly honed in middle and high school) that, rather than being randomly mixed to- gether, well-connected people tend to be connected to other well-connected people while poorly connected people tend to be connected to other poorly- connected people. Statistical physi- cists like Mark Newman have termed this structural tendency as assortativ-

14 XRDS • Spring 2011 • Vol.17 • No.3 ity. The opposite pattern (dissortativ- “MMOGs potentially within MMOGs may not directly affect ity) of well-connected nodes preferen- the “real world,” these online worlds tially connecting to poorly connected provide a window are still very real sites for social inter- nodes and vice versa has been found into our action, organization, and economic in a number of ecological, biological, trade. In that respect, MMOGs provide and technological networks. In other understanding of truly exciting platforms to both under- words, while assortativity is observed offline behavior that stand how human behavior unfolds in networks characterized by social- using immaculately documented data ity and collaboration, dissortative pat- is otherwise difficult as well as how to design technology to terns appear to emerge in networks or impossible to support and enhance social and eco- evolving in a context that demands nomic interactions for both the online resilience under selection pressures. It study.” and offline world. may be easier to attack a system where all the well-connected nodes are con- nected to each other than a system Biographies where well-connected nodes are insu- Brian Keegan is a Ph.D. student at Northwestern University’s School of Communication. He studies team lated from each other through poorly- assembly mechanisms under boundary conditions of online connected nodes. organization. The concepts of assortativity and particular, gold farming offers a case Muhammad Aurangzeb Ahmad is a Ph.D. student in Computer Science and Engineering at the University of dissortativity also highlight a tension in which people are willing to pay a Minnesota. He studies computational trust in virtual worlds that exists in clandestine networks premium to enhance their experience and online reputation systems. Dmitri Williams is an associate professor at the USC like gold farming trade networks [7]: in their leisure activities. However, the Annenberg School for Communication. He studies the social should collaboration and efficiency be production of virtual wealth outside of practices and implications of online communities and video prized despite the heightened risks of community norms and rules offers a games. Jaideep Srivastava is a professor in computer science and detection or should resilience trump striking example of how illicit goods, Engineering at the University of Minnesota. He uses web efficiency and flexibility? Our analysis clandestine organizations, and law mining to study online databases and multimedia systems (see Figure 2) demonstrates a very no- enforcement demands and limitations to model human interactions. Noshir Contractor is the Jane & William White Professor of table distinction. Affiliates and non- also impinge on these game worlds. Behavioral Sciences at Northwestern University. He studies affiliates nodes clearly have assortative Given these parallels, MMOGs poten- the factors that lead to the formation, maintenance, and dissolution of dynamically linked social and knowledge mixing patterns in which characters tially provide a window into under- networks in communities. with many trading partners have a standing of offline behavior that is oth- tendency for their neighbors to also erwise difficult or impossible to study. References be well-connected. However, the iden- Obviously the notion of markets, 1. Williams, D. The mapping principle and a research framework for virtual worlds. Communication Theory, tified farmers exhibit a clear dissorta- property, and regulation within 202010), 451-470. tive pattern. The CAVIAR network also MMOGs raise a variety of complicated 2. Castronova, E., Williams, D., Shen, C., Ratan, R., exhibits a strong dissortative pattern questions. What rights, if any, do play- Xiong, L., Huang, Y. and Keegan, B. As real as real? Macroeconomic behavior in a large-scale virtual and provides evidence of the mapping ers have over the digital artifacts they world. New Media & Society 11, 5 (2009), 685. of online behaviors back to offline be- create and develop? What are the of- 3. Heeks, R. Current Analysis and Future Research havior; clandestine networks in both fline social, cultural, and technologi- Agenda on “Gold Farming”: Real World Production in Developing Countries for the Virtual Economies of online and offline trafficking contexts cal contexts in which virtual economic Online Games. Institute for Development Policy and preferred to insulate well-connected production occurs? How should com- Management, University of Mancester, 2008. individuals from each other. Further- munities in online worlds respond to 4. Lehtiniemi, T. How big is the RMT market anyway. Research Network, (Mar. 2 2007). more, a number of individual affiliate potentially exploitative phenomenon 5. Ahmad, M. A., Keegan, B., Srivastava, J., Williams, D. accounts are well outside of the typical like inflation, arbitrage, and monopo- and Contractor, N. Mining for Gold Farmers: Automatic range and are approximated much bet- lies? How aggressively should adminis- Detection of Deviant Players in MMOGs, 2009. 6. Keegan, B., Ahmad, M., Williams, D., Srivastava, J. ter by the gold farmer trend line. This trators pursue deviants and traffickers and Contractor, N. Dark Gold: Statistical Properties of suggests assortativity metrics may be to balance community stability with Clandestine Networks in Massively Multiplayer Online useful for identification or prediction player privacy? Games. IEEE, 2010. 7. Morselli, C., Giguère, C. and Petit, K. The efficiency/ of not only gold farmers, but other well- Very similar questions have preoc- security trade-off in criminal networks. Social connected members of clandestine or- cupied social scientists, philosophers, Networks 29, 1 (2007), 143-153. ganizations. and political leaders since well before the advent of the Internet. Indeed, it is reassuring that despite how digitized What This Means for and distributed these virtual worlds Criminal Activity IRL may be, MMOGs are still very human As MMOGs grow in scale and com- systems that evince the same struggles plexity, these exciting worlds and the and debates that have preoccupied so- novel player interactions within them cieties for ages. While the consequenc- assume increasing social relevance. In es of players’ trials and tribulations © 2011 ACM 1528-4972/11/0300 $10.00

XRDS • Spring 2011 • Vol.17 • No.3 15