Essay IV · Ethics & careers
Who Does This Work, and Under What Rules
Anti-cheat is built by reverse engineers, data scientists, investigators and support staff. Their decisions end careers, so the rules they work under matter.
The people inside the lab
A modern anti-cheat team is unusually mixed. Reverse engineers take apart cheat binaries and loaders to understand how they hide. Kernel and systems engineers write the drivers and integrity checks discussed in our kernel essay. Data scientists build and monitor the behavioural models covered in the detection essay. Investigators, some with backgrounds in fraud or law enforcement, follow money and communities. Player-support staff handle appeals, which is where the system meets the people it judges.
Several publishers have spoken publicly about this work. Riot's anti-cheat team has published developer blogs explaining Vanguard's design; Activision publishes periodic Ricochet progress reports; Valve's GDC talk on VACnet remains one of the most detailed public accounts of a production detection model. Such disclosures are partial by necessity, since detailed explanations help cheat makers, but they are a meaningful step towards accountability.
The ethics of the false positive
Every detection method in this journal has an error rate. At the scale of tens of millions of players, even a tiny false-positive rate means many wrongly flagged people. For a casual player, a wrong ban is an injustice; for a professional, it can be the loss of a livelihood. Three principles recur in serious discussions of due process: decisions should be reviewable by a human, players should be told what category of violation they are accused of, and there should be a route to appeal that is not simply a form letter.
Secrecy complicates this. Vendors argue, reasonably, that revealing the exact evidence teaches cheat makers how they were caught. Courts and sports bodies face similar tensions and use mechanisms such as confidential review by an independent panel. Esports has borrowed some of this: ESIC's procedures, for instance, include hearings and published decisions. Most in-game bans, however, remain unilateral.
— From this essayA ban that cannot be explained to an independent reviewer has not been justified, only enforced.
Reverse engineering, law and cheat makers
Reverse engineering is the core skill of the field, and it is legally nuanced. In the European Union, the Software Directive permits limited decompilation for interoperability, while game terms of service generally forbid tampering. Anti-cheat researchers work on both sides of that line: they reverse engineer cheats, and independent security researchers sometimes reverse engineer anti-cheat drivers to find vulnerabilities. Responsible disclosure programmes, with safe-harbour language, are the clearest signal that a vendor welcomes the second kind of scrutiny.
Publishers have also gone to court against cheat sellers. Bungie, Epic Games and others have won judgments in the United States against cheat developers on copyright and contract grounds. Litigation does not eliminate cheats, but it raises costs and occasionally reveals how commercial cheat businesses operate.
Academic research and its constraints
Universities contribute work on aimbot detection, bot behaviour and the security of anti-cheat drivers, published at venues such as USENIX Security. Academic researchers face a data problem: the largest datasets of confirmed cheating belong to publishers. Collaborations exist but are rare, and academic results should be read with that in mind. A model that performs well on a lab dataset has not yet met an adaptive adversary.
Paths into the field
- Systems and security: operating-system internals, Windows driver development, reverse engineering with tools such as Ghidra (released by the US National Security Agency in 2019) and IDA.
- Data science: time-series modelling, anomaly detection and, critically, evaluation under adversarial conditions.
- Integrity and investigations: backgrounds in sports governance, fraud analysis or law; familiarity with betting markets.
- Player trust and policy: privacy law such as GDPR, communication and appeals design.
Capture-the-flag security competitions are a common training ground, and many practitioners began by modding games. A word of caution to students: writing cheats, even "for learning", can breach terms of service and in some jurisdictions copyright law, and it will be noticed by employers.