'Cat and Mouse Forever': Ex-Blizzard Risk Ops Expert on Addressing Cheaters

[music]
Hello everyone. I'm Bryant Francis.
And I am Beth Elderkin.
And welcome to GDC Side Quest. Uh Beth, you have a very fun guest today for GDC Side Quest uh here on the which is a little thing we do here on the Game Developer podcast. Um tell us who you're talking to and what you're talking about.
Yes, so uh for this month I talked to Lucia Suarez. Uh she is the former associate manager of risk operations at Blizzard Entertainment. Uh she was there for about 15 years and is currently the head of operations and member experience at the Anacona Women in Tech Foundation. Uh the reason I reached out to her was because I wanted to spend this month focusing on game security. This is a field I do not know a lot about and I really wanted to understand it more and give uh give your listeners an opportunity to understand a little bit more whether or not they're in security.

It is something that everyone needs to know about especially if you work in live service.
Yeah, and this is an interesting one, right? Like it feels a little adjacent to game development as we know it. Like if I think about, you know, where an IT person sits in a game studio excuse me, an IT person or a uh game security person sits in a game studio like, you know, they're part of my company, they're part of my work, you know, but they're in like a department and division that like I basically never hear from. But I've had some like really good chats with like veteran uh MMO developers. Um and I've learned like some really interesting things about how um game security fits in with actually the design and operations of live service games. Like the sort of the most obvious one uh is that every bad actor a player runs into in a game, you know, whether it's a hacker um game like say I've run into them in Apex Legends uh or someone uh who's gold farming or someone who's bought a bought an account that was stolen etc. Um it increases the odds that that player who encountered them is going to stop playing. And then meanwhile like for the people who

uh these hacks and cheats, you know, they're sort of like your worst bad actors who are trying to disrupt the game, right? But for the people who are just sort of trying to skip the line, get access to power, get access to high-end accounts, um they actually like aren't good customers for the original developer, too, because they don't have that like IKEA effect thing where you get attached to your character or the things you earn in a game because, you know, you just threw real money at it. So, it degrades the experience for those players. So, even just offering this as an option, right, is like um these are game design problems, right? To me, these are like social design. Like these are these intersect back with everything else. But but for um a lot of folks, it's still just something that's a little siloed away.
It is. And for this one, I spoke I focused mostly on anti-cheat.
Yeah.
Uh because that is one of the the, you know, a very prevalent I mean, most in-game security, there are a lot of a lot of issues and a lot of preventative issues and, you know, reactionary issues that go into game security. But I focus mostly on anti-cheating for one simple reason. I wanted to know why people do it.
Oh.

to get an understanding of what is the motivation behind cheating to the point where you might pay somebody, you know, you're cheating as a service, you might pay them to provide that service for you, or you're paying for these in-game advantages. And, you know, people make a living off of this. And I I just was really curious as to know more about that. And Lucia had some amazing insights into that whole experience.
Yeah. All right. Well, enough for me. Uh let's go to your interview with Lucia.
Welcome back to the GDC Side Quest podcast, part of the GDC Festival of Gaming, where we explore the full game ecosystem. My guest today is Lucia Suarez. Uh she is a former associate manager of risk operations at Blizzard Entertainment, and she is currently the head of operations and member experience for the Anacaona Women in Tech Foundation. Lucia, great to have you on the show with me today.
Thank you for having me.
Well, since we are GDC Side Quest, I always love to ask this question first.

What is one of your favorite video game side quests?
Oof, I don't know. I have too many, but I but I think in general in Destiny 2 that was a place that I would just get lost in it. Like sometimes I would just go to this I said like space tourism. You know, a lot of times I would just log in and it just explored the game. It's not even not even a quest, you know, just the exploration itself. That that that's a world that I enjoyed a lot.
I love getting the chance to explore games on my own terms and really get to appreciate the world. Like there are some games where I'll go through, I will take out all the baddies, and then I will go backwards, and then I will go through again so I can just look at everything in detail. Uh it's such an amazing experience to just get to see some beautiful worlds. So, you were with Blizzard Entertainment for 15 years. Um how did the games' audience change during that time?

I started around 2006 and at the time uh I mean, World of Warcraft had just exploded and gotten the Blizzard name really popular again. And I think like we transitioned from like those old school gamers that you know, where gaming was more of a niche towards uh you know, gaming as a service. So, you know, everything is way more prepared. Like it's not just about the game, it's how do you attract all the players? How do you get the players to stay in the game longer? It it has changed a bit from a form of art towards, you know, a service that you can market and that changes also the audience itself because, you know, again we went from niche to trying to reach out as many people as possible.
And you're now running a foundation that supports women in tech, uh especially

immigrant women, neurodivergent professionals, uh working mothers who are enhancing their skills. I can relate to that as a working mother myself. Uh what inspired the shift from platform security to community building?
Well, it wasn't a plan after being at Blizzard, um you know, uh the closure of the French office, which which is where I worked. I spent a lot of my time thinking how to reconcile what I used to do with the current dynamics that we have in the world of gaming and tech. I think for a lot of people that work in tech, maximizing performance for maximum output and improving KPIs is not like a dream goal, you know? It is not what something what people dream about. And when I met the Cecilia, who is like the founder and like who had the original idea,

uh the mission resonated with me a lot. And also like someone that in the world of tech that has gone through through through some hurdles and issues and whatnot. Where I grew up, I was very isolated, so I didn't know like how do you get in gaming? How do you get in tech? Uh like what are the skills you need? What, you know, so when I joined Blizzard, I joined initially as like uh billing support. Like I would take phone calls about the World of Warcraft subscription. And and my plan was like I had no plan. I was just like just go there, figure it out. And and then from there, like once you're inside, like you start learning how the company runs inside, like what the jobs are actually like versus like what you're being told in the job application. I wanted to basically translate what like what's the tech and gaming experience in the perspective of someone that has a

meaning there.
Helping folks transition into the industry who may not have experience with it, which is a a great thing especially for for women and non-binary individuals and those who may not have grown up as traditional gamers as we might might stereotypically put it. I mean, I was a I've been a lifelong gamer myself. Uh so, during your time at Blizzard, how prevalent was cheating? Like, how much of an issue was it?
Oh. Oh. Oh, from day zero, when I joined, it was basically to support World of Warcraft, right? And that's a game that has a lot to gain from the cheating. You already you have an economy, so you have resources, gold, etc. that people need to improve their gear. So, you know, you already have one incentive to cheating, which is like having gold or resources. Or there's player versus player, you have the cheating of wanting to beat and get the achievements and titles and

and all that, you know? So, again, you create another aspect where people will find reasons to cheat, you know? Anything that has a prestige tied to it is going to attract cheaters. Payment fraud when it comes to video games is usually very linked to to cheating. And then you tie it into account security because then suddenly people are like, "Oh, the accounts have resources. So, if you steal accounts, we get the resources that come with it." So, cheating I mean, obviously it's very dependent on the video game, but like anything that has a competitive aspect, resources, etc., you're you're going to attract cheaters.
So, what in-game advantages are they seeking when they decide to cheat? What are some of the more common ones?
Okay, so I mean, it depends on the game. So, I'm going to put it Right now, I'm going to use World of Warcraft as an example because it has a variety, but uh there could be other things. But for

instance, like in World of Warcraft, what could they be seeking for? Uh you can try to manipulate like uh the messages that your game client sends to the servers to try to obtain free resources. So, that way you save time if you get free resources. You don't have to work for them. So, happy times. Another thing that they could want is, for instance, again, trying to manipulate the game into thinking that you're spamming abilities way faster than players normally could. So, you make a lot of damage to someone or an enemy just like that, and you're like, "Oh, I'm so good, you know?" Then, the obvious one also would be, for instance, you can set up a a bot to farm for you those resources. And, you know, so regular players cannot compete with you because they cannot be awake 24/7, seven times a day gathering

resources and doing nothing else. So, that means that you start flooding the market and having an advantage over everyone and like disturbing the whole economy of the game because, basically, you're creating inflation.
That's such a fascinating angle when you have an in-game economy that can be impacted with inflation. So, what is the financial impact of cheating on the business?
I I can't give like numbers, but I can say that, first, you're going to have the players that see the other cheaters. And those are the ones that, you know, are going to complain and going to be impacted by the actions of the cheaters. And those are the ones that might consider not buying your game again or not renewing the subscription or, you know, just switching game if you don't get things in order. And there's also the the aspect of, for instance, like

depending on the cheating, like is this person competing with you in all the means, like gray market, like people reselling items or game codes or anything on the on the side independently from Blizzard and taking revenue that Blizzard would take. Well, I'm saying Blizzard, but you know, I'm saying video game company. But yeah, but basically like you're making creating competition to to Blizzard on the market, then you can create another financial issue which is like if these people use a stolen payment methods like credit card, PayPal accounts and then charge back. Those payments get charged back once they get recovered by the legitimate owner and you don't only lose back the money, but also that creates penalties with banks, with Visa, with MasterCard and whatnot which are very costly. And also obviously is like all the work that goes behind on the anti-cheat effort which is not just having stuff monitoring the situation, but

ideally in the moment that you start developing the game, you start taking into cheating into consideration. So, it's not a bigger problem to fix later in the future than if you tackle it at the moment.
Yeah, that's actually a question I had is do you feel it's more effective to prevent cheats from working in the first place or focus on detecting and banning them after the fact?
I mean, obviously I'm I'm team prevent. Like what you can prevent from the as early as you can. I know that this story is like out in the internet, but I'm going to tell it. Like basically there was a moment before Starcraft II came out that during a show we'd tell it was being discussed like the things of the game, then we had a Q&A and during the Q&A someone brought up like, hey, you know, the way that you make things communicate makes it easier for the game to be map hacked.

And you know, like have you considered changing this so this cannot be intercepted and you know, we have we don't have this issue. And then the person just said, oh, this is why we have a risk department, you know, so they figure it out." And I mean, we did figure it out, but it was very painful, which is a very manual process. It really required a lot of people to put a lot of money and work just to find one cheater. And and it happened exactly as the guy that asked there said, you know, which was like this is going to happen if you do it like this. You know, they didn't want to tackle it. It happened. Like once you have like the game architecture, everything done, everything sort of like you can't really change that fast. Like it's not worth the effort. It's not worth the loss of reputation. It's not worth the headaches. And

especially if you have a game like StarCraft II that has all these tournaments, all these e-sports scene around it, you want to make sure that when people compete in professional tournaments that you can guarantee a safe environment. And if your game is not safe enough, then it might be a game that doesn't even get picked up because it will have a reputation of cheating being prominent there. Because like like many discussions that we have like with developers that you are like you try to install the importance of let's talk and cheat from the beginning, you know, it's not especially on big games, it's not something that if it's going to happen, it's like when it's going to happen and where it's going to happen. And and you prevent what you can and monitor and respond to what you can. And and and that's about it. And then that

just continue the cycle of prevention, monitoring, adapting, reviewing, you know. You're like the castle that they want to breach, and you have to figure out how they're going to try to breach it, and you set up the defenses. And then when it's done, they're going to respond with something else, and you know, it's rat and mouse forever.
And it's interesting that you you put it that way, that they're coming up with different ways to try and breach the castle, because we're seeing a lot of that with generative AI now. There was actually a story recently, there was an AI bot in a fan-made StarCraft arena that went rogue and cheated by downloading a human-made bot, so it could win against the other AI bots. Do you see this as the future of cheating, generative AI coming in and making it just faster?
I mean, general AI is piece of thing, like how fast can you develop something, and maybe can mimic human behavior

better, but at the end of the day, the anti-cheat side has AI on their side to protect from these things, too. And why not? So, again, the it levels the field a bit. There's more AI involved, obviously, but it hasn't changed as much as people think.
Basically, it sounds like they're kind of escalating side-by-side, so in the end, it just evens out a little bit. Uh another thing that we're seeing more of is cheating as a service, especially for entry levels who want to get into cheating, where we're seeing professionals sell their services. Was this something you were starting to see at Blizzard, and what role does this play in the market?
We have cheating as a service, like for instance, like we would see it a lot for like power leveling, right? Like you have a starting character, and you don't want to bother through all the grind to

maximum level, so you will pay someone else, or you will pay them for, like, oh, I want you to win me this PvP title, you know, so you're getting my account and play these matches for me. Like, or you farm this gold, or you do this dungeon. Cheating as a service, I mean, it came with a hand with how we're cheating, you know, it's like a gateway to cheating. You have people that are more in the fence, you know, about cheating and you know, it's like, "I don't want to pay for this or I don't want to partake or I'm I don't want to risk it." And they think that if they pay to this professional service, they're going to get it done and they're going to be fine and they have excellent reviews and everything is great. And then they get their account closed because they get caught and the guy that was I don't know, the cheating guy was cheating you when selling you the service. Like, what a what a plot twist,
[laughter]

I mean, in that situation, it's kind of like you reap what you sow.
Basically.
One thing that we have been seeing recently over the past year or two is we're seeing a rise in indie and double-A live service games, you know, the quote-unquote friend slop, cooperative, collaborative games that are live service and sometimes even cross-platform. And you know, they may not have the same resources that Blizzard Entertainment would. If there is a smaller team that is starting to face cheating issues with their game, what are some of the first measures that you would recommend coming from a studio with more resources and more experience? What would what advice would you give to them?
I would say they first need to sit down and honestly discuss what will be the incentives to cheating in our game. Which one we're talking about, prestige of the game, resources, etc.

And decide, okay, what are the risks that our game has and and then from that point decide like, okay, uh what can we protect at client level that will prevent cheating? And this is where you say how we block cheating from happening on our side to begin with. If you find a reason like act on those, protect and block what you can, monitor what you cannot block, and investigate, see what's happening, you know, make decisions based on that. Because it's true that also like the cheaters sometimes are the best QA a game can have, and sometimes they're the ones that will come up with the thing that you didn't expect that someone was going to do, and suddenly they figure it out, and
[laughter]
they do a 180 on the game, and

and you learn learn like the lessons out of it, right?
So, before we close out today, I did want to talk about something maybe a little bit more serious and personal. Uh you know, we've had a lot of layoffs in the industry in the past couple of years. You were part of the Blizzard layoffs. If you were to sit down with the people making those decisions, what would you want to say to them regarding what's happened in the game industry?
I think there's a misunderstanding when it comes to business, shareholders, etc. I think there's a misunderstanding of the gaming industry in general. And I feel like you have people that don't partake in the hobby, don't play, don't know much about gaming. Uh you know, just wonder why their product is not performing, and you know, and recurring to typical things like

layoffs. And this happened because they start developing products that really are not appealing as they think to the players. Uh for instance, like we had like this big bet on game streaming as a service. Google had Stadia come out, and then suddenly everybody wanted to have their gaming in Netflix. They put They made this investment on this owner lock um And then, you know, it flops. The studio is closed. People get fired. And you know, and it's based on an idea that it's like who decided that was a a good idea. In my opinion, I feel like a lot of the times they gamble more than have ideas that are going to pay off. Um And then, you know, who pay like, you know, like the employees because a lot of the times you see layoffs where they fire a whole department and then they have to rehire again in a few months.

And things like that. There's no strategy. There's no
[snorts]
You know, so it's a bit frustrating because it sometimes it feels like the decisions are coming from a mindset that doesn't help gaming, doesn't help the gaming industry. And it doesn't even seem to help the people that come up with the ideas. And maybe listen more to the veterans of the industry. Maybe listen more to the players. Maybe listen more to the employees. Because, you know, sometimes you hit gold and then it's great for everybody, but the other nine times out of 10 that it doesn't happen, everybody suffers.
Well, thank you so much for joining me today, Lucia. If anyone wants to get a hold of you or learn more about your foundation, where can they find you?
Right now, I'm just in LinkedIn uh for myself as Lucia Suarez. For the Anna Foundation, we have the

Anna Carolina Foundation.com website. Uh we just started. We are starting to add resources. Um If you And also volunteer. So, if anybody wants to help people in atypical situations that want to get in the tech and gaming world, you know, we are open. We have open arms and ears. Whatever you can provide, we are very thankful.
Of course. And it's wonderful to hear that. And thank you again for joining us. This has been GDC side quest and now back to the main quest.
Man Beth when Lucia said it's cat and mouse forever like that's got to be a challenging life and that's a challenging line of work like sort of knowing you'll never truly win, right? Like your game can't be protected forever. Software is in one way or another like infinitely modifiable. Um in real life, right? Like whether it's you're stopping one person, stopping a group of people like with with their bad behavior. Um like you do you know other people will come along and do bad things but individual bad people you know can be stopped and then

like just the sheer requirement, the sheer amount of time it takes just to get from A to B in the real world means like you get a break, right? Like like it takes a while for someone else to sort of come along and try to swing something. Um but with game security and cyber security like it's just on all the time. The next person can be in line right behind that first one you knock down because the software is just you know it's there and it's malleable and stuff.
Yeah, it kind of feels a little bit like the difference between playing a live service game and playing a narrative experience that has a beginning, middle, and end. You know, there's there's the finite experience but then there's you know the the longer challenges. And what I found really fascinating about it was how it goes both ways. Lucia was talking about generative AI in that yes, we have these hackers are developing these new tools but also game security experts are developing tools to combat that and prevent it. So the the cat and mouse game goes back, you know, goes both ways.
Yeah. Yeah, I mean look when it comes to cat and mouse you know I sort of if you start with that you know I assume the game security people are the cats and the hackers are the mice, right? But now

that you say like oh it goes both ways like oh no I'm I'm picturing the hackers as the cats and the game developers as the mice. And oh boy I I guess like a part of me is just glad that there are people out there like Lucia who care so much about this.
Agreed. I I feel like I've learned some from that experience but it just also reminded me how much goes into game security. I'm actually been talking with Black Hat. We're working on a report right now a collaborative report on game security that should be coming out later this year. And so, I'm really diving into the subject and but I always feel like the more I know, the more I don't know.
Thanks again to y'all for listening and look for your own security. I hope you all stay safe and secure as our year comes to an end, you know, as we all wind down in what are some very, you know, fast-paced times. And yeah, I'm sorry about referencing that the year's coming to an end. Yeah, it'll be 2027 soon. We're dropping this episode on October 30th. I don't make the rules. That's just how time works. Today's episode was edited by Beth Elderkin. Our theme music is by Mike

Meehan. gamedeveloper.com, GDC Festival of Gaming, and of course, the fine folks at Black Hat, who Beth just mentioned, are sibling organizations under Informa Festivals. Bye, everyone.
See you next time.
[music]