2 Teen Diablo Players Were Charged, Got Probation For 'Stealing' Virtual Items That Were Replaced

from the virtually-dastardly dept

With some of the recent news stories about how cheating, or other crimes, committed in virtual settings is resulting in real-world legal consequences, I’m sort of surprised the media hadn’t picked up on this story before. Apparently back in the summer of 2012, two teenagers, Patrick Nepomuceno and Michael Stinger, ran a scheme in Blizzard’s Diablo 3 in which Stinger would send out a link to another player that allowed Nepomuceno to take control of the player’s computer, force the player’s character to drop all of his/her valuable virtual game items, and then Stinger would scoop them up.

According to [Prosecutor] Wilkison, court documents, and an interview with Michael Stinger, Nepomuceno bought a RAT, a ‘remote access tool’ used to take over a computer remotely. Nepomuceno and Stinger got other Diablo III players to download the RAT by disguising it as a link to a photo, which they claimed was a screenshot of a rare item. After a player clicked on the link and downloaded the RAT, Nepomuceno gained access to their computer, and was able to take over their Diablo character. He would force the character to drop all of the valuable gear and gold the player had collected, and Stinger’s demon hunter character, who was hanging out nearby in the game, would swoop in to steal the goods. “Imagine you are a gamer and you have worked long and hard to get all these items,” said Wilkison. “The victim watches himself lose everything.”

Court documents insist that the pair then sold these virtual items for thousands of dollars, something which Stinger at least disputes. Blizzard banned the pair once the reports of the virtual “theft” began rolling in, but the company apparently wasn’t satisfied with that as an end to the story. Instead, Blizzard brought in the FBI, who raided Stinger’s house and made off with his computer equipment. Nepomuceno declined to be interviewed, but his equipment was likely confiscated as well. Blizzard, for their part, restored the virtual items to the victims, which is where the legal part of this story gets very interesting.

But how do you prosecute a crime with no actual losses? “Blizzard gave the victims the goods back,” said Wilkison. “That made the loss calculation difficult because the victims were reimbursed. So instead we calculated the [perpetrators’] gain.”

It’s an interesting question, I think, because if the victims are the players, they suffered no loss. Blizzard could be said to be the victim, but their restored virtual items carry a real-life worth that is nebulous and subjective at best, so I would think assessing any kind of value to the items for the purposes of declaring a felony would be quite difficult. The two virtual muggers apparently didn’t want to fight this out in court, however. Both accepted probation and were forced to pay Blizzard back for the costs of investigating their actions. Notably, it does not appear they were forced to pay the company back for the worth of the virtual items, which seems strange since their worth was the basis for the felony prosecution to begin with. The real crime, it would seem to me, was the unlawful access of another person’s computer in all of this, but the discussion around a felony for theft of virtual items took the main stage.

Theft of virtual items in which no loss actually occurrs to the victims, something that we’ve actually discussed before, almost a decade ago. Given that the question apparently hasn’t gone away, the legal world is going to have to figure out how to navigate these virtual waters, and I don’t think tossing around felonies strictly for the crime of stealing virtual items in a video game is a good route to take.

Filed Under: , , , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “2 Teen Diablo Players Were Charged, Got Probation For 'Stealing' Virtual Items That Were Replaced”

Subscribe: RSS Leave a comment
The Moose says:

Real vs Virtual

In Real Life if someone breaks into your home and steals something, pawns it, and the police get it back from the pawn shop, the thief is still caught and prosecuted.

Why should virtual goods be any different. They still broke into your home (computer), stole stuff, it was recovered, the thief caught. The thief should still be prosecuted.

Thieves are thieves, virtual or otherwise and should still be prosecuted.

Michael (profile) says:

Re: Real vs Virtual

Arguably, nothing was “stolen”. Did the bits permanently come off a hard drive somewhere? Blizzard managed to prove this by restoring the lost equipment without having to reduce their “inventory”.

There was an unlawful access to a computer, but calling anything they did theft goes way outside the actual definition of that term.

Anonymous Coward says:

Re: Re: Real vs Virtual

Unlike other cases of virtual taking such as copyright, this is much closer to theft and something being stolen, perhaps even crossing the actual threshold. One of the key points for copyright infringement not being theft is that the owner is not deprived of use and ownership.

In this case, for however long it took to file the report, go over the logs, ban the players, and give back the property, the players were deprived of use of said objects, objects that carry monetary value based on the real money auction houses.

Now, the fact that the EULA states that the players own nothing and they get what they get by the grace of Blizzard, and Blizzard wasn’t deprived of the objects makes the question a lot more confusing. But to say that it goes way outside the definition of theft, I think is incorrect in this case.

Anonymous Coward says:

Re: Re: Re: Real vs Virtual

They weren’t deprived of an object – the game Diablo. Having or not having gear is how the game is supposed to behave. The virtual objects that were altered are not real things that can be treated as such, anymore than the rings Sonic collects or the coins Mario picks up.

If I take your X-Box controller out of your hand and make your character jump into a pit and lose some equipment, I haven’t stolen that equipment. If I kill your Mario character I haven’t stolen the coins you lost. And if I make your Diablo character drop gear and someone picks it up, I haven’t committed theft. These guys did the same thing, they just did it from a different computer instead of from the couch beside you.

Virtual objects are not objects, they are virtual. You can’t steal them and it’s not theft to fuck with someone’s game. Harassment maybe, invasion of privacy if they hacked into the account maybe, but there was not theft and no objects involved in this.

Anonymous Coward says:

Re: Re: Re:2 Real vs Virtual

As far as your analogy with Sonic or Mario, there is probably no way you purchased the rings with real money, nor did you get real money when you caused me to lose them. Lets just ignore that for a moment however.

So, is your argument that the game is the object, and anything but the access to the server cannot be considered to deprive a player? In that case, did Blizzard by banning the two responsible for these drop and take antics steal the game back?

Of course, the argument to that is that the two violated some agreement and never owned the game in the first place since it is digital access, after all virtual objects and not objects. In that case, could you not expand the same argument, virtual objects are not objects, to say… books? So that when a company, say Amazon, revokes access to a bunch of books you gave them money for, this is in no way a reason to be upset, since you are not deprived use and enjoyment of something your purchased, since it was just virtual? After all, they are not depriving you of the e-reader which is the actual object.

This is why, even though I do not think a guilty verdict should be reached (although, it was settled and cannot be reached) I can understand why it deserves a much deeper look rather then a hand waving “it’s just virtual”.

Anonymous Coward says:

Re: Re: Re:4 Real vs Virtual

My thought is…

The third player was deprived of virtual items that he had obtained through time, and likely some measure of expenditure.

The two gamers who acquired the items via deceptive means (hacking), then sold the virtual items they transferred from the third player for $8,000.

Now, the classic definition of theft is to deprive someone of something. Even if that object is a virtual object, e.g., bitcoins, numerical value representing money, etc., would you consider that theft, or not, and why?

Anonymous Coward says:

Re: Re: Re:5 Real vs Virtual

Because it’s virtual. Virtual objects are by definition not objects, because they are virtual. The “classic definition” as you call it, is the definition – theft is the removal of an object. I take it and you don’t have it anymore.

No one took their Diablo. You can’t take something virtual.

Copyright law has fooled society into believing copywrite violation is “theft”, so currently a lot of people think you can “steal” something that isn’t an object. But legally, it’s not theft unless I take something physical. That is what theft is – the removal of a physical object from your possession. There was no theft here. Hacking, invasion, malicious intent, sure. ANd it might FEEL like theft because that’s how much virtual items matter.

But I can’t steal your rings in a Sonic game by killing your guy while you’re in the bathroom, anymore than I can steal your gear in Diablo by hacking into your account. I don’t have those objects now. I haven’t stolen anything.

Anonymous Coward says:

Re: Re: Re:7 Real vs Virtual

But, Nasch, it’s only virtual. It’s not real. lolol…Sorry, I could not resist. You got my issue, and my point. How do you treat virtual things that have no reflection in the physical world, e.g., bitcoins? There needs to be a consistent definition for depriving someone of virtual objects.

Now, I consider this situation different from copyright, which can be related to replication of digital files. In that situation, no one has been deprived of their digital file.

Kal Zekdor (profile) says:

Re: Re: Re:2 Real vs Virtual

Virtual objects are not objects, they are virtual.

Sigh… Nine years later and people are still spouting this nonsense.

If I flipped a couple of virtual ones and zeroes around and emptied your bank account, would you still claim that nothing was stolen from you? Or do you really believe that your money is just sitting in big vault somewhere? Ownership is a far more complicated concept than whatever physical items you can lay your hands on. Many aspects of ownership are “virtual”, beyond just the obvious. Ownership of copyright, of land, of debt. These are all virtual concepts, yet they govern most aspects of our lives. This is not something new, the frameworks of virtual ownership have been around, in one form or another, for centuries.

Shrugging all of this off as “virtual, and hence meaningless”, is… short-sighted.

Anonymous Coward says:

Re: Re: Re:3 Real vs Virtual

Money is different, it’s a fiat. The money represents something. You altered an an agreed upon digital fiat and under law that is theft of currency. It’s a poor analogy because money isn’t an object, it’s an agreed upon representation of value.

And nobody says it is meaningless because it is virtual. This was clearly a crime. We are saying that the definition of theft does not apply to the alteration of an object, and his game was altered, not stolen.

Anonymous Coward says:

Re: Re: Re:4 Real vs Virtual

But, how can it be theft? It is a virtual object. If you can’t steal a virtual object, how can you steal virtual money?

Kind of surprised you would say that money is not an object. I have a bunch of objects in my wallet that I thought were money. While I am tempted to toss them, now that I know they are not objects, I will hold to the concept that if I can touch it, it probably is an object.

My real point here is that all limited virtual goods need to be considered in a consistent manner. To treat one limited virtual good (virtual money) in one way and another limited virtual good in another is not logical.

The virtual good in the game was limited because you had to take a lengthy series of steps to acquire the good. Replicating that good was clearly sufficiently difficult that someone took the steps of forcing another someone to unwillingly transfer that limited virtual good to the someone. Thus, that limited good had an agreed upon value by multiple parties. Indeed, the ultimate sale of the virtual good for $8,000 validated the value of the virtual good.

I am not saying it is theft. I am wondering what acquisition or deprivation of virtual objects from another without authorization should be called. You say it is not theft to deprive someone of a virtual object. Okay. What do you call the crime then?

Incidentally, the individual deprived of the virtual good did not have his game altered. His game was the same as before. However, elements acknowledged by the game server to be in his virtual possession were forcibly transferred to another person. I wish people would stop talking about the game. The game is irrelevant because to the player, the game was unchanged. What was changed was the authorization of the server that allowed that player to have certain virtual objects within the game.

Anonymous Coward says:

Re: Re: Re:3 Real vs Virtual

It’s ridiculously short sighted to try and claim that theft should cover digital, infinitely recreatable virtual goods. That’s just bonkers. You want to have me stealing your computer and me altering your savegame equal the same thing? When a few buttonclicks can fix one and not the other? That’s just stupid. Theft refers to objects. One person has it and the other one doesn’t.

You could MAYBE claim that by dropping his gear he engaged in defamation or destruction of peroperty, but to call it theft is to change the definition of theft out of laziness on your part. Theft is when I take an object, not whenever I deprive you of something in any way. Words have definitions for a reason!

Anonymous Coward says:

Re: Re: Real vs Virtual

I’d say the comparable real world situation would be if someone stole your iPod, your reported it to Apple, and Apple manufactured a replacement, loaded it with data from your most recent iCloud backup, and sent it to you.

They did not transfer the items back from the account they’d been transfered to (seeing as the items were reportedly sold on Diablo III’s real money auction house to other players) they created a replacement from backup. The general result being one more copy of the items existed than had been dropped through gameplay. So yes it did change their “inventory”.

Anonymous Coward says:

Re: Re:

There is a large difference between crimes committed within the rules of a game and crimes committed without the rules. Consider boxing: punch someone 1 second before the end of match bell, you are find. Punch someone 1 second after the end of the match bell and its assault.

Anonymous Coward says:

Re: Re: Re:

Yes; there are actually a number of crimes here. The first is unauthorized access to a computer system.

From here, they used the unauthorized access to a computer system to modify the victim’s data on a remotely hosted server. What that data represented doesn’t really matter — it could have been a bank account, it could have been company secrets, or it just happened to be bits that stored a character’s state and held items in a computer game.

Beyond this, there’s also the case that the EULA was violated, which, in a quirk of fate, means they’re also open to copyright infringement, as they were using the IP in a way expressly against how they agreed with Blizzard to use it. Yeah; this one shouldn’t actually be illegal in this way, but it currently is.

And from here we get to the question… was what they did transformative?

aldestrawk says:

Re: Re: Re:

If you read the Fusion article that is linked to here, the prosecutor is quoted as saying “[they] pled guilty last year to misdemeanor “unauthorized impairment of a protected computer.” Tim’s article is misleading with respect to that. I think the question of “theft” is what the prosecutor was interested in talking about because it is new territory. The prosecutor was a federal prosecutor, so I assume the law involved was part of the CFAA. Given that, an additional crime of fraud would be applicable if the victim suffered some sort of loss. Maybe that loss, being virtual, can be considered more of a loss of a service than loss of a real item.

HMTKSteve says:


According to the EULA the players don’t own the game or anything in it so Blizzard would be the victim of the theft? But how can the thieves be said to steal the virtual items if they are also bound by the same EULA and thusly can not claim any level of ownership over the stolen goods? Since Blizzard retains ownership of everything in the game how can any player steal in game items when Blizzard still retains ownership (and access, being the game creators) of all in game items regardless of who’s inventory they reside in?

John Cressman (profile) says:

Crime yes... theft... no...

Was a crime committed, yes. Was it theft? No. This is one of those cases where the Computer Fraud and Abuse Act SHOULD be used.

This was obviously a hack, not a “theft” per se. It’s really no different than if someone had hacked another person’s computer and taken photos, data, etc.

It’s really akin to someone breaking into your house, and stealing the air from one of your rooms. The air is replaced. They didn’t really get away with a physical object… however, they are still guilty of breaking and entering.

I think the same thing should apply. Prosecute them for hacking… and possibly conspiracy since they acted in concert.

Anonymous Coward says:

Re: Crime yes... theft... no...

There is a difference that brings it closer to theft then any other previous case, the victims (if you indeed call the players, not the company victims) were deprived use and benefit of the ‘objects’. The problem with comparing it to hacking in and copying photos and data, or sucking up the air, is that at no time did you deprive, or even potentially deprive, the owner access.

Granted, I am not sure that theft is triggered if you move the data to your disk then scrub any copy from the owner’s hard drive (except in the case of corporate espionage, and even then, not 100% sure it is ever the theft of the data, or theft of secrets), but we must still remember that this goes beyond just making a duplicate and leaving the code for the ‘owner’ to access.

I do not fully support the charge, but I do think it does bring up some questions that will need to be addressed, and not dismissed by overlooking what little pieces make this different.

Anonymous Coward says:

Techdirt’s been heavily pushing this “hacking is a victimless crime” angle lately. I could see why back when it was about CFAA overreaches and security through obscurity type stuff. Well-meaning individuals who were trying to help getting the book thrown at them was not cool.

This, however, is clearly malicious for-profit intrusions.

Had this happened with any other sort of goods, you’d be praising the company involved for going above and beyond in replacing their customer’s property. Yet here you’re trying to set up a ridiculous “big company bad, hackers good” narrative. Grow up already.

Anonymous Coward says:

Please don't let facts get in your way...

(1) According to Michael Stinger, one of the pair who got probation, the crime was, NOT THEFT, but “unlawful access to computers.” In other words, they were convicted for hacking, not theft.

(2) Apparently, they sold the virtual items for around $8,000. That sale sets the standard for the value of any items, IF there was a theft, which apparently there was not, because the pair was apparently not charged with theft.

(3) If you hack someone’s computer to, as someone stated, “fuck with someone’s game,” it is illegal. They got caught. They paid. End of story.

Move along. Nothing to see here.

Anonymous Coward says:

Re: Please don't let facts get in your way...

So we can arrest every member of the FBI, CIA, NSA and while we are at it, TSA and Border Patrol for all of their “unlawful” access to our electronic devices.

Great. Let me know as soon as you’ve got them all apprehended.

If it’s not illegal for the government to do it, then it’s not illegal for anyone to do it.

No one in the government is above the law, noone.

ltlw0lf (profile) says:

Re: Re: Re: Please don't let facts get in your way...

It is legal for the government to print money for use as tender in commercial transactions, try printing your own and see what happens.

Some would argue that Bitcoin is exactly that…printing money for use as tender in commercial transactions. The government has hemmed and hawed about how it is wrong for a while, but so far, it has been legal. If I print out a bunch of paper that says United Bank of Ltlw0lf, and use it as legal tender, and others accept it, so long as the government is receiving their tax, there is no issue with it. It is really no different than writing an IOU or a contract saying you’ll do something in exchange for something else.

The problem is when you try to print what looks like the government’s money that you get into trouble. The issue is that while most people would look at a piece of paper that says United Bank of Ltlw0lf and laugh (and not accept it as legal tender,) they tend to treat stuff that looks like the government’s money as the real deal, since it has the backing of the government which makes it “legal tender”.

Anonymous Coward says:

Re: Re: Re: Please don't let facts get in your way...

Actually, the government doesn’t print money.

The government, in the form of the U.S. Treasury department politely begs the Federal Reserve, not a government entity, to print more money.

Back when we had Gold and Silver backed currency, it was the government. Now with Federal Reserve notes, it’s not the government.

Anonymous Coward says:

Re: Re: Please don't let facts get in your way...

Two separate issues. It is not legal because the government does it.

Hacking is illegal, and it should be illegal. These two losers hacked, and got caught. Crap happens, and now they have to take the consequences.

Just because the government hacks and does not get caught does not make their actions any more right. Indeed, let’s hope that congress and the courts continue to push back against the government’s hacking activities, which they should do.

Incidentally, you are painting all those agencies with an overly and unnecessarily hyperbolic brush stroke. I know members of the NSA who have nothing to do with hacking or surveillance.

John Fenderson (profile) says:

Re: Re: Re: Please don't let facts get in your way...

“It is not legal because the government does it.”

It’s legal when the government does it because the law says it is.

“Just because the government hacks and does not get caught does not make their actions any more right”

True, but you’re confusing what’s right and wrong with what’s legal and illegal. They are two completely different things.

“I know members of the NSA who have nothing to do with hacking or surveillance.”

Yes, that bit is clearly hyperbolic. However, it’s also understandable. When an agency is engaging in Very Bad Things as a matter of accepted policy, then every single person who works for that agency is guilty of supporting those Very Bad Things even if they aren’t directly engaging in them.

Anonymous Coward says:

Re: Re: Re:2 Please don't let facts get in your way...

John Fenderson:

Except when the law does not say that it’s legal, which is the issue facing the current administration. Perhaps it would be more précised to say that it’s “legal” under two scenarios: (1) When the law says it is, and mostly, it’s not (when it comes to hacking domestic computers); and (2) Until someone gets caught and taken to court, and the court rules against the government.

Re legal and illegal: It appears that much of the government’s hacking of domestic computers, or at least communication between computers, has been illegal, which inherently makes it wrong. I expect congress to, after more teeth gnashing and intrusion upon private citizens, make such hacking completely illegal unless a warrant is issued (though courts are already heading in that direction, so congress may not need to do anything).

Re Very Bad Things: I disagree. So, if Walmart screws an employee, then everyone working for Walmart supports that action? I think not. I doubt most of the people working for agencies doing Very Bad Things knew that Very Bad Things were taking place, or those Very Bad Things likely would have been revealed sooner. Intelligence agencies are incredibly compartmentalized, and the Department of Very Bad Things is not revealing to the other departments what they do. Otherwise, more people might protest because they hold themselves to a higher moral code.

Anonymous Coward says:

I’m noticing that no one has mentioned that the FBI was called in and raided these guys homes. That’s more disturbing than this digital mugging as that sets a precedent for FBI involvement for this type of situation. These things happen quite often with online multiplayer games, but the use of FBI here is highly questionable and concerning. The local law enforcement not available for this?

aldestrawk says:

Re: Re:

The crime that was actually prosecuted was a portion of the CFAA, unauthorized access of a protected computer in a way that caused “impairment” of said computer. The perpetrators lived in two different states, California and Maryland, so it seems quite appropriate that the FBI was called in and it was prosecuted under federal law.
What is more disturbing than this is how the FBI raided, and arrested, numerous individuals for letting their computers be involved in the DDOS attacks organized by Anonymous. It shows how flexible the CFAA is and how unfair the penalties are for crimes that become suddenly much more serious when they involve a computer.

Anonymous Coward says:

Re: Re: Re: Justice?

Then let me rephrase.

So, hacking an electronic device with the intent of taking control of the device and doing some sort of harm to the owner of the device is not a crime?

Generically, hacking is a real crime punishable by multiple state and federal laws. Now, you can contend that hacking should not be a crime, but the law says that it is. It may be that only a small portion of the people hacking are doing something that is potentially harmful to the person owning the computer, but that is like saying that only a small subset of people who trespass on your yard are doing anything remotely shady – which is true – but does not make trespassing any more legal, or desirable.

Of course, in the physical world I would just ask the trespasser to leave, and if they don’t, I either call the police or shoot them, depending on their next action. Tough to do that when someone breaks the lock on your electronic gate to trespass on your electronic device.

GEMont (profile) says:

Re: Re: Re:2 Justice?

So, hacking an electronic device with the intent of taking control of the device and doing some sort of harm to the owner of the device is not a crime?

Actually the hacking part is not the crime.

The “intent of taking control of the device” could be perceived as a crime.


The “doing some sort of harm to the owner of the device” is definitely a crime.

If all hacking is a crime, how can companies use it to discover the vulnerabilities inherent in their systems without breaking the law?

Anonymous Coward says:

Re: Re: Re:3 Justice?

I think there is an issue of semantics here.

There is consensual hacking, which is not a crime (unless you are doing it in public, and then you might get arrested for indecent exposure of something). Then there is forceful or non-consensual hacking, which is a crime. Hacking is not inherently a crime, unless it is done without the owner’s permission with the intent of stealing the owner’s virtual objects, like virtual money. Then you virtually go to jail. Or something like that.

GEMont (profile) says:

Virtue Alley

Hmmmmm….. given that the
virtual theft of
virtual goods was perpetrated by
virtual characters upon other
virtual characters, in a
virtual environment created by a
virtual game, I would assume that the
virtual penalty would be
virtual incarceration of the
virtual characters who perpetrated the
virtual crime, in a
virtual lock-up, for a
virtual period of
virtual time, roughly equal to the jail time that a real person would receive for a similar crime in the real world. That would be
virtual justice.

GEMont (profile) says:

Re: Re: Virtue Alley

“So, now we know what the penalty would be for taking virtual money from your virtual bank account.”


virtual criminals must be
virtually forced to undergo
virtually lengthy incarceration in a
virtual prison, and do
virtual labor so that they can earn enough
virtual money to pay back the
virtual funds they stole from my
virtual bank account, in a
virtually proper period of time.

It is called
Virtual Justice.

Yeah, I know you were just being an ass, so I decided to reply in kind. 🙂

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...