Speed Panel: Next-Gen Game Security: How To Protect Your Players In Games.

Next gen game security and how to protect your players. Incredibly important, not least if you take into account that we've had so much regulation hitting us recently. Uh things like the online safety act uh is uh an incredible challenge to my mind. Uh it's not an online safety act, it's a let's create more barriers for small developers to make it their lives harder with no actual benefit to consumers. But then I'm biased. Um, I'm not a big believer that we made a good choice in the way that that act was implemented.

Um, anyway, I I think hopefully Brian's Are you good? Are you ready to kick off?
Are these on? There we go.
These are on. Go for it, Ryan.
Thanks very much, Oscar. So, um, this uh it's a really interesting topic and we're really grateful that you guys have invited us to talk about this. As Oscar says, it's going to be about uh about player security, about nextgen security, but also before we start all of that, we're going to explore a little bit about why. I thought maybe the the kind of the ethics of it or the morality of it would be an interesting place to start. I also thought that it would be easy just to give a quick intro to our panel members rather than kind of spending lots of time because I think the topic is is super exciting. At the end, uh Richard Smith is here and Richard is a director of Data Theorem. Uh and data theorem is a company that helps mobile game studios protecting their players, games, the revenue from cheating, from fraud, and from tampering. Fundamentally, data theorem also comes from the cyber security world, and they've been recently seeing a real need in the video games world to

apply a lot of their cyber security practices in the games world. And Richard's been really leading a lot of that as a director um and working with games companies all over the worlds on their economies, their monetization strategies, anti-che technology, mobile fraud prevention, all kinds of great stuff to help you guys. Um next then we have um we have Hega who's the CEO and co-founder of ABA. Um and ABA effectively is an AI powered platform uh called Amanda which is a really cool name and it detects harmful players. It detects behaviors like harassments and bullying and cyber grooming kind of in real time with built-in compliance but also really targeting the behavior of people. Um Ha herself is about 20 years in tech ventures or so which is amazing. Uh combining your AI, your community knowledge, your behavioral sciences knowledge as well as cyber security and protection. So thank you for coming. Um, and then Nick, uh, quite wonderfully, Nick Tanahill is a, uh, the studio head of Firefly Studios, and Firefly Studios

is part of the of the Deolver group. So, it's wonderful to have Nick here. And effectively, it's about 25 years of experience working with PC mobile titles on historical real-time strategy games. You, most of you probably played the Stronghold series and Stronghold Kingdoms with well over 12 million registered players uh, across the world. and Nick as the as the studio head effectively is the one helping to grow um and create games like Stronghold and others for great player experiences. So, welcome guys. Thank you very much. Appreciate it. Um so let's start let's start with why you know I think in in some of our conversations we were thinking well is player is protecting our players can we be cynical and say it's about money can we say actually we're afraid because the law is coming after everybody hence why a lawyer is pan is hosting this or or is or is it or we just think it's the right thing to do um I think maybe Nick to start with you I think you had some interesting ideas

around communities if you could share some of that
yeah I Our sorry way too close to the mic there. Um our approach essentially is to announce our games at the point of which we have something playable. Um we run extensive surveys with our players to give them a realistic expectation of what to expect and they can kind of they see the fancy trailer but then they can go play the demo pretty much the same day I think we did on our last title. Um, but essentially it kind of we avoid we try to avoid toxicity by giving people a full rundown of what the game actually is because we find that quite a lot of toxicity sometimes comes from people misunderstanding what the game is and thinking oh it should be X Y and Zed. So if you tell them exactly what it is right up front, you you you know, arguably you lose some people from the sort of the funnel at that point, but it means that those remaining are your fans and your champions and they're armed with knowledge to defend you. Um and they're just like happy to be there and you don't have, you know, the naysayers in there or you have fewer than you would otherwise have. So that's that's kind of our community approach. And I

mean in some ways we're almost too transparent to begin with. You know, we do we do silly things like ask people how much they would pay for the game. And you know, to some people that might seem insane, but for us it works really well. It gives us a realistic expectation of, you know, what they want, what we want, and then that reduces toxicity overall.
And as and as a founder of of of AA, did does this why motivate kind of why you started the company? Does I know I know when we spoke before you were alluding to retention about how retention can be very powerful and there are lots of different kinds of motivations for retention. that gets the is attention.
Yeah.
Yeah. I think so. And I would say yes to uh everything you you asked for in the beginning like yeah it's the right thing to do. Obviously when we look uh into the world today we see that there are so many many young people that struggles in their lives. uh they need a safe space and many of the uh young people kids

they come to to video games to relax and have a good time but um many of them experience not having a very good time. So we should be careful and try to do our best to provide them the best possible uh way to be a teenager or a kid or an adult. Uh but also we see that happy players they're spending so much more money into the game and we saw in in a US study uh the nice games actually had almost double as much revenue as the toxic ones because uh the players they didn't come back uh they decided to go somewhere else. So I think it's it's good for both uh uh your feeling inside but also for your revenue I would say.
Yeah. And and Richard there's still no getting around the legal landscape. I

mean when data theorem is starting its work in cyber security in fintech in health tech and looking across at gaming the the legal landscape is growing.
Yeah. I mean when we first you know our company's been around for a long time in the in the mobile space but really [snorts and clears throat] with those types of verticals right so gaming is somewhat new for us right we we work with some very large AAA studios for some time we had you know the investment dollars and are in everything when it comes to gaming um but we've really been only focused on the on the mobile gaming side of things really over the last 11 months and so we're learning a lot but I think what's happened is the things that we've historically seen in those in the finance and some of these other world. That stuff's now starting to make its way into mobile gaming as we continue to see such incredible growth in the space. Um, you know, for example, right, you know, GDPR now considers Android ID a piece of PII, right? So, if you're collecting that, you may not realize, you know, one of your advertising SDKs may be doing something or you may not have that visibility. We're having to

notify some of our early adopters that, hey, you are collecting this type of information. If you don't update your privacy policy, now you can be hit with regulatory funds, right? This isn't something if you would ask me 5 years ago when we were looking at this space, there's no PI being collected by games. There's no transactions being handled directly by any one particular studio. But as we're now seeing some of that things change, right now, okay, we're going to look at other ways to monetize outside of the traditional ways we've seen in mobile games, now we're starting to introduce things that are going to be now scrutinized by some of these other regulatory factors as well. Um, and so I think, you know, obviously that's one aspect of of what we're looking at, but I do think it comes back to, you know, treating players right and fairly and having that. And so the other thing we look at is, okay, well, how do we make sure, especially in certain types of games, this doesn't apply to all necessarily every type of game, but if you think about a first-person shooter or some of these types of games, if people don't feel like they have a fair shot or it's a competitive space that they're they're going to have, you know, retention and ultimately impacting revenue, right? So, we want to make sure that you can't create that mod, right? can't take those advantages that we're doing things to mitigate those uh issues

within those games and ultimately driving a fair play experience.
And and do and do does the panel think that there's a correlation between an increased awareness of cheating and bad behavior and toxicity and fraud or has it always been happening and we're better detecting it or is it both? So, you know, hey, you founded a company to focus on this. Is it are we more aware? Has it always been happening? or is it happening more and we're also more aware?
Well, it has always been happening, but what we do now is we see it uh more because also because we talk about it more and uh and the news press they also share stories. Um but also uh uh and this is like uh from us building a company out from EU there are so many regulations to be uh to take into account like uh you were talking about GDPR but also there's the digital services act coming and so on so so on

but one thing we know is that the bad actors uh that want to make harm into communities if there are uh predators who wants to groom a child or there are fraud uh actors, they don't care about regulations. They use everything. So, yeah.
And Nick, as a as a developer, when when you are, you know, this the lawyer's awful way to say this, but when you're typing on your keyboard and you're beginning to develop the game, you type on your keyboard as well.
I do type. That's all I do. That's all I do basically. um when when you're putting the when you're actually roadmapping and putting the milestones together and building it, are these kinds of activities in the plan or as you began your opening comments around the community, are you more focusing on the community or are you also building in mechanical engineering structural things in games that can help reduce fraud and cheating and so forth?
Yeah, I I think we learn every single time we put out a new game, you know, things we could be doing better. So at a

baseline, we're just thinking about the game concept when it comes to internal pitching and then we bring it to the leads and the team. That'll be one sanity check when we're going, okay, what is there, you know, what are the dangers from a community community perspective? What did we see on our last game? Because generally speaking, you mentioned Strong Kingdoms earlier. That's a game that's, you know, built for massively multiplayer gameplay. But every single time we do a game, it'll usually have multiplayer in some form. So we learn something every single time. So really I think it's that the point at which we are I say pitching internally. We try to give everyone a say basically in what you know kind of game we're making. And when it comes to contact with the community team and the marketing team that's really our sort of moment in time when we go okay what did we learn from last time and every single time we add multiplayer depending on scale doesn't really matter. We learn something every new every time and that's kind of the point at which um we we make those decisions. So it's pretty early on I'd say sort of um start of the R&D period. And Richard, when you're when you're working with companies then and you're bringing data theorem's platforms and and products in to help companies, are

you connecting with things that the companies have in their apps already or are you are you running alongside or is it both?
Yeah, I mean I think I think the topic that we hear the most that they're dealing with that is the the topic that nobody has really figured out is fraud, right? And it sounds like it's always been there and everybody that I've talked to in this space has a different version of fraud. Um, and so it's it seems like it's a very pervasive problem that hasn't been figured out. So I think that's where we've had the most alignment. Now we handle it from the client side and understanding, you know, is the user behavior that we're seeing in the game truly genuine, right? Or is this indic indicative of somebody who's not a re real human behavior, right? Um, and so that can lead to a lot of things that can start to manipulate what's going on within a lot of aspects of the game, right? Especially if you're thinking about things like user acquisition and costs associated with that and and other things if you're coming at it from the uh from the developer the studio side of things obviously. Um, but that's where we've seen kind of the most the biggest problem that has kind of gone everybody

knows they have it but they haven't really figured out exactly what it means for them but it's the consistent issue, right? So I think that's the one area we've seen the most um conversation start and it's something that we are kind of bringing from what we've traditionally done because fraud as you can imagine in the financial space is a major issue right and it's extremely highly regulated so we're bringing a lot of that expertise into it say hey here's what we traditionally would see as fraud within mobile right and then how does that applicable to what you're dealing with now I'm not going to pretend that we know everything yet we you know we've been here for you know 11 months realistically so I think we're still learning quite a bit of the challenges es that everybody's facing, but we're seeing a lot of the same problems that these industries have been through for a number of reasons for a long time now starting to emerge in a number of different ways within the gaming space.
And that that picks up on some of the comments in our meetings earlier about offensive versus defense. This concept of historically, I think all three of you guys observed that his maybe leading up to today, companies were reactive.

companies were acting defensively as a way to ensure that fraud didn't happen if you like or or preventing bad behavior as it was arriving as it was arising but you're seeing a slight shift at least maybe the three of your companies you're trying to educate people to shift towards an offensive approach to build a forward um I think hey that was in one of your comments was this defense versus offense if you could elaborate on on how you're helping on that
yeah so we uh like our clients they have uh historically been running after the problems like, "Oh, shoot. Here's a problem. Now we have to fix it." Uh, oh, here's another one. Another one, another one. And it's very, very stressful. Uh, but here, I think like uh everyone is talking about AI. Uh sorry about bringing that up, but this is where AI really could shine where we can train uh the models to pick up on uh those behavioral signals super early so they can detect it super super early. So uh

we can prevent the harm from happening if it's fraud. Well, I think like grooming is a kind of fraud. uh uh it's like uh someone trying to manipulate to get to their goals into getting information, money, whatever. Uh so yeah, I I really think that we are now about to stop the harm before it happens. Uh and that's that will be a major shift uh in the industry. And if the large if large language models and AI is being used to help to help solve the problem, at least create a platform where the problem can be solved, it almost invites a thought of an arms race that then fraudsters are also using AI. And you know, I think I think Richard in one of your comments you mentioned about again from your your your the lessons you learned in other industries that you're now applying to games, fraudsters are smart and they get better and better. So I mean does that start feeling like feeling like an arms race? you know, coming from the cyber security space, it's always been that, right? I mean, as you get better at defense, they're going to get better at offense,

right? So, it's it's a ever evolving game and AI, even in the cyber space, is something that has been a huge problem because now AI is going to be used to conduct attacks, right? So, you're going to need to use AI to defend from it, right? It's something we deal with on the other sides of what we do in our business. Um, so it is definitely something that's going to be, I think, really important to making sense of the events, right? There's going to be so much data and the data sets that we're already getting just from every user event, every activity that we're seeing from, you know, if you think about games with 10, 50 million active monthly uh users, that's a massive amount of data that we're going to be ingesting from all those devices connecting and all that. To make sense of what would be something like fraud or behaviors that we don't want to see, you're going to have to use some kind of AI realistically to be able to scale up with that and to make sense of it, right? Um we're already seeing that happening just in how we address cyber attacks now. Um, so yeah, I absolutely think it's going to be a big part of what we have to deal with.
I think even the most sort of like ardent like opposed person to AI would, you know, if you talk to someone who's been on a community team for like an MMO

and they're like leadership are like, oh, can you set up a Discord for this like this MMO that has between 100,000 monthly active users and millions and they just go, you know what that's going to turn into, right? So like Discord bots at that point were an amazing tool. So this is not really as long as it's not stealing from anyone and the training data is you know local to the company. I mean that just seems like an evolution of of those really which were amazing tools which completely changed the game in terms of community management.
Yeah. And picking up on community management, Nick, then one of the things again that you brought up was around education, about making sure that staff who are working in community community management, maybe your Discord mods, maybe the kind of people who are generally connected to the game, perhaps either as full-time employees or even just kind of loosely connected with the wider community are educated well on how to handle things, what to say. Is there in addition to this AI arms race, my words, I know you guys didn't say that, but um is there also a human education race about making sure people are trained well and and geared up on how to handle this?

Yeah, I mean from our perspective, it's just, you know, you got to arm people with information and the more aligned they are with what you're making, the less likely they are to be toxic and the more they know, the more they can share that information for you cuz like you don't want to you don't want to be the person, you know, sort of bring that information up, right? can't no matter how big you are, no matter how big your marketing team is or your budget team is, you're never going to reach every player with all the information that you want to reach them with. So, you have to arm people. Um, and yeah, I I don't think anyone's like we're not against anyone in that in that race. It's like, yeah, no one's waging disinformation wars on us yet. So, um I think it's just kind of just do the work and make sure you know you're talking internally about it as much as possible and then at the point of reveal making sure you're just you have you're as free with information as you can be within the confines of the marketing plan.
And do you guys see studios taking different approaches? I know one of the topics we were looking at is we're going kind of past, present and future and present each of you had a slightly different observation as the things you're seeing. So for instance, Richard,

you were observing that there are different studios who are taking uh an approach about accepting certain kinds of levels of responsibility for managing fraud, for managing disinformation, how they are either working with partners like like data theorem or kind of taking steps themselves versus other companies maybe that are think that the platform should handle it or so forth. Are are you coming across different approaches? Yeah, I mean every I would say everybody's at different levels depending on uh at least from what we're learning what what their game comp like what type of game they're dealing with, you know, how big their their game platform is at some point. You know, if you look at some of the the original folks we started working with years ago, they actually don't really care about cheating, right? And you would think, oh, okay, well, yeah, you know, they only care if it impacts revenue, right, at the end of the day. So, you know, and then other studios, they do care about the fair play of the game, right? and do because they need the retention and that's more important for them at this stage where they're at. So I think we're seeing depending on where where the game is or where that studio is in its

adoption or the overall you know publisher studios ability to draw in a very large audience how they've gone about doing that and how much what they care about does shift right and what they can tolerate right they can tolerate a much different level of of attrition or they may not even see it realistically at all and have a impact bottom line
and hey does that then also lead to training to the companies you work with like if when when the kind of specific acute work you're doing on a specific project with a studio is kind of you've done the work you need. Are you leaving companies with some like training or education or something about how they can go like are you leaving them with other with how to defend themselves or offend themselves?
Yeah, absolutely. And and also I think we had this conversation about um most people are nice. Uh and also that we admit that that most people are nice. Most people when they come into your game, they want to do nice things. Uh

but if you have some bad apples, uh the rest of the apples will also turn a little bit uh worse. Uh and I think that's a good insight because then you also know that most people come into your game to have a good time. Uh and also understanding that uh ask asking uh the players in your game why are you here? Uh and also try to educate your players because uh uh especially with the with the kids games we've been working on. Um the kids themselves which was very toxic. They didn't realize it because there were no grown-ups in the room. But when someone told them like when you are acting like this uh other ones might find you harmful they were like oh really well uh and then they change the behavior. So also this is more about how do how do we want the communities around to be? Yeah.
Yes. Sometimes when you're managing communities you do feel like a bit of a parent because you're like you know I I

know someone not told you that you can't do this and it was really illuminating when you said about you know I think fruit is a really good analogy as well. you put something that's overripe there, it will affect all the other ones. But yeah, you just feel like you're you're doing a bit of parenting a bit like I imagine teachers feel this way when they're talking to their students. Um
corporate lawyers
and corporate lawyers. Yeah. [laughter]
But that community just keeps coming up now. So in our in our time sitting here together as well as our kind of our discussions earlier, this sense of community just keeps coming up over and over again. Is there are you think there are are there analogies between the different kinds of platforms? So, you know, like Deolver and Firefly principally are kind of PC platforms, but also lots of mobile obviously, but then also we've been listening to people this week on talking about their brands and brand protection. And we just heard people talking about movies and so forth. I wonder if there are analogies between the brand, the community, the perception that also has an impact on things like fraud and honesty and so forth. Um, Richard, do you have a do you have a thought whether your connection? actually when you mentioned that it it

it brings up something that we've we've actually dealt with in the mobile space for a long time, right? So, you know, especially in brand. So, for example, it's very easy to go take a game, take pull it right off the app store and then make a mod, right? And then wrap it and do something with it and then republish it somewhere else, right? So, we have a a particular studio who's dealing with that challenge right now. they if if they realize if the if the game does not come directly isn't downloaded directly from Apple or Google stores, they will present an alert to you that we help them identify and deliver that says, "Hey, this was not downloaded from we don't we're not going to allow this to run, right?" Because they can't trust the situation. And the types of things that we've seen in this, and we see this a lot across the entire space, is people will go download these, they'll push them up to third party stores. They have absolutely no problem accepting them because their viability depends on them having lots of things. They'll maintain old versions of games and apps that we don't want to see out there that might have things that we no longer want to be maintaining in there. Um, and then they'll do things like wrap it with ad injection or give it and then all a sudden now the brand is experiencing a

poor user experience because they think this is coming from the brand when reality is it's Bob who downloaded it and published it as Bob, right? And not your studio who is put this up there and is doing this to do a quick cash grab. Your brand takes the hit for it. And we've seen this historically happen with a lot of retailers and other things like that in the mobile space. And now we're starting to see that become a challenge even within the gaming space where they're using your brand in order to deceive the user to make a quick dollar and walk out. Right.
So I wonder if that's going to add to my short list of why. If if why is it's the right thing to do, the legal landscape is expanding and deepening and strengthening. It makes financial sense and then also to protect your brand which is of course related to financial can be everything in
it's going to be all those things. Um when we were also kind of in the in the leadup to this panel discussion, I I asked you guys to predict the future. So that's not not a nice thing to do, but you each of you did. So I appreciate that. So we'll start with um I don't know, maybe we'll start with with with Nick. I think
I don't know what I said now. [laughter]
You you you were predicting about your

words, the superpower of the community as the as the answer go kind of going forward, happy communities willing to defend against antisocial behavior. thing. Do do developer studios now are is when you're doing your milestones and doing your roadmap is having a strong robust engaged community now becoming bigger and bigger and bigger as part of the milestones or is it just something that happens anyway or
Yeah. No, I I think it is becoming a much bigger priority. We think more from a um and internally I think some developers might see this as kind of like like a a marketing priority when really it's more product focused. Um, but it's becoming a massive point in time for us, especially considering that pretty much with Steam NextFest and all these other opportunities, a lot of developers scheduled and now basically the games are just scheduled around these marketing opportunities and a lot of those are related to letting you see the game warts and all at whatever you know point in the marketing cycle you need basically. So really we look at the point of reveal as like yes that's the

point at which we need to solidify the community and strengthen it and give it all the information it needs and also give give people everything they want. So if there are like loads of lowhanging fruit in terms of features just throwing those in there so people can feel like they're being listened to and that gives that has a huge positive effect on how they view our games and how they talk to other people about our games. And really word of mouth marketing is like you know it's it's it was important five 10 years ago. Now it's like you know absolute gold dust in terms of the mobile world and PC as well.
And Hega you you you predicted the future by talking about tools about giving people the um what I think the the the phrases you use things like the compliance tools the tracking but then also this the um the ability to predict and regulate harm proactively before it happens. So not only through ABA but do you think there's a a general move towards studios being more aware and trying to look after themselves before the harm happens? Is that is that part of the future maybe?
Yeah, I think so. And I think also the part of the future is uh uh that the

industry see uh not only see this as a cost but it's a competitive edge that you actually have a community. Wow, you're so lucky. Uh please take care of it. Uh make sure it grows. to make sure uh uh they're having a good time because they will come back, bring their friends. So yeah, I think like proactively uh trying to work to make it much much better then you really will grow big and be successful. I think
amazing. Um and Richard would you see more companies not like data theorem but like but generally in the say cyber security or financial security or fraud security companies beginning to think actually maybe we can also begin helping mobile games. I think there's going to be a um kind of a convolescence if you like of of different industries using the kind of experience and technology they have to kind of support video games and mobile games

particularly.
Yeah I I think so. I mean um you know there even companies that are in our space in the traditional side of what we do um I I know some of them already have moved into this as well and we do we are starting to see some emergence of that and we're seeing existing you know mobile solutions as well for gaming right they're adding those elements to their technologies right now they're trying to say hey can we head this off where we already have something embedded right and start to identify that so I I I think it's it's popping up everywhere now um the one thing that I've seen just as a a trend that was interesting we had a a studio we started working with maybe four months ago and in that period of time they've tripled their security team their security engineering team right um now they've grown very quickly in in their reach and brand and all of that but you had asked me that four years ago I would have said that they don't even have a security team right like that doesn't even exist so um I think all these factors are going to drive something new to this space that traditionally just hasn't been there
it's amazing well we I think we have only 20 seconds left so um Oscar No, I I

mean I love all this. I'm I'm very old and when I first joined games, I came out of working for an SAP consultancy in prior, a pensions company. So I grew up with people. One of the guys I work with was the guy that wrote the original orange book, uh which is one of the sort of primary, you know, kind of sources for this stuff. So for me, it's been fascinating how the industry hasn't been talking about security. I mean, DDoS is a natural normal thing that I think natural normal, you know what I mean? It's going to happen. Man in the middle attacks are going to happen. And we have been I think as an industry kind of a a sleepwalking if anything and the fact that we're now in a situation where we've got regulation which is going to put the constraints on the smallest teams to hold the most private data which in itself in my opinion I know Brian you and I will probably have [snorts] hours of conversation on this topic but my view is that it's so naively written and uh so so poorly done but to your early point right as you started out.

Shouldn't we have been thinking about this stuff anyway? [snorts] Shouldn't we have had an attitude of putting the players needs, wants, security at the heart of what we do? Anyway, I I I'm waffling on because I happen to love this subject. Anyone else got any questions?
Well, if there aren't, I mean, I'm going to say thank you very much.
Thank you, everybody. Thank you. Thank you. Now I I hope you