Hackers are stealing Second Life's player-made lootboxes and selling them for profit

Second Life is a virtual world stereotypically thought to be steeped in cyber sex, but beyond that thin layer of prurience is a thriving community of artists creating everything from lavish Beverly Hills-style mansions to the eyeliner your avatar wears. Its economy is a staggering $500 million USD machine of virtual ecommerce, with many players making a real-world living by creating, marketing, and selling digital products. But those same creators are locked in a long battle against groups of cheaters who, using a series of exploits, are stealing their products and selling them for profit on Second Life's official Marketplace. It's potentially costing Second Life's virtual artists tens of thousands of real dollars and highlights the nightmare of defending your intellectual property on the internet.

Second Life is unique in the MMO genre for many reasons. It's not so much a game as it is a social space that players can customize however they like. Called 'sims,' these sandboxes are spaces that players fill with all manner of player-designed objects. Unlike other MMOs, however, these objects aren't created using some in-game crafting system, but built with software like 3D Studio Max, Photoshop, and a lot more. Some players build mansions and throw elegant parties while others own retail stores that sell their hand-crafted apparel. And, yes, some just want to have cybersex. 

But it's also unique in that, unlike most MMOs, players can exchange Second Life's ingame currency (called Lindens) for US dollars. Peter Gray, who was Linden Lab's senior director of global communication before leaving early this year, told me via email that Second Life's creators were on track to take home $60 million USD collectively in 2017. It's what's led many players to turn Second Life into a full-time job. But for two years now, those same creators have also had to deal with the frustrating rise of 'dupers' or 'copybotters'—players who illegally duplicate their items for profit using exploits.

Theft of a salesman 

"It's very much a big deal," Oobleck Allagash tells me. He's the owner of PocketGacha, an innovative HUD-based storefront that works with several designer brands in Second Life to sell their products. Since launching in August, PocketGacha has made "more than tens of millions of Linden" in sales from "tens of thousands" of customers. While many creators in Second Life were vaguely aware that duping was an issue, Allagash became a unifying voice in the community because PocketGacha's backend system allowed him to track sold inventory across multiple brands and see how widespread the issue was becoming. It's how he became aware that the Marketplace was frequently featuring items for sale at seemingly infinite quantities and exorbitantly low prices—both telltale signs that they had been duplicated. 

Allagash tells me that, in Second Life, one of the most popular ways to shop is through games of 'gacha' or, as its traditionally known in Japan, 'gashapon.' "It's a game where you have a machine that you play, paying typically about 50 Linden [$0.25 USD] for each go, and you are given either a common item or, if you're lucky, you'll eventually get a rare item which is typically more robust in its design," Allagash explains. "It can be a vehicle or a house, for example." Some gachas might award makeup or articles of clothing in a complete outfit, while others, like the popular Kunst brand, offer meticulously crafted themed decor. 

On the surface there's little difference between gachas and the controversial loot boxes that are appearing in many games like Star Wars Battlefront 2, but there's several key distinctions. For one, these items have tangible value. Each play is always rewarded with an item, and any you win can be resold on Second Life's Marketplace for Lindens and then converted into US dollars. Secondly, the proceeds of these items goes to their respective creators, not Linden Lab (though it does collect a small transaction fee for items sold on the Marketplace). And for those who hate the gambling aspect of gacha games and loot boxes, many creators also offer a buyout price to purchase the set in full.

"It develops sort of a trading atmosphere where people will trade for commons and rares," Allagash explains. "There's a whole cottage industry that has developed in Second Life of people reselling a lot of these items that they get."

In Second Life, some items are 'copy' items, which can be copied and pasted multiple times inside of a sim. Most gacha items are different. Called 'transfers,' they can only be placed in a simulation once, and if you sell it, it's gone from you inventory. Like Magic: The Gathering, it's a market valued by the scarcity of sought-after rare products, and Second Life's dupers are undermining the whole thing. 

"Some bad guys have figured out how to duplicate as many of these transfer items as they want," Allagash says. "You can duplicate thousands of them, and they have real value on the reseller market." While the exact exploit is a closely guarded secret, the general idea is that these dupers strategically "crash" a sim, which somehow allows them to create infinite duplicates of an item. Dupers can even duplicate in-game gift cards for various player-owned stores, letting them buy anything for free.

Buyer beware 

According to several players I spoke with, it's been a problem for years that Linden Lab only acknowledged in November after mounting pressure from the creator community. "Recently, we closed an exploit that fraudulent gacha re-sellers had used," the company said in an update posted on November 2. "Our governance team can now catch them when they attempt the cheating method that we have already fixed."

Second Life's creators hoped it would be an end to duping. Inevitably, it wasn't. I spoke with one creator who requested to remain anonymous. Their brand is one of the more popular in Second Life and it's become a full-time job that earns them a healthy income. Days after launching a new product line after Linden Lab allegedly shut the exploit down, they found a suspicious listing on the Marketplace offering the entire product line in one bulk package for almost 1300 Lindens less than the competition.

Second Life's Marketplace doesn't let customers see metrics like units sold, so this creator and Allagash had to get creative. The maximum amount of quantity that can be purchased at one time is ten, so they began buying up stock to see how much this alleged duper had. It was an impossible amount. During my interview with Allagash, he demonstrated this by sharing his screen with me via Skype. I watched as he purchased almost 40 full sets of this creator's product line from the alleged duper. He then showed me PocketGacha's backend tracking system, which operates similarly to any retail store, to show how unlikely it was that one person could have potentially over a hundred copies of this particular item when only several hundred had been given away through the gacha game.

Making matters worse, this alleged duper was the most popular listing for these particular items on the Marketplace, effectively tanking their value. "The damage is huge," the anonymous creator tells me. "I'm the one paying for the subscriptions for the programs to create my products, I'm paying for marketing, I'm paying for the cost of running the sims—everything to keep my business going. Then there's the emotional and time investment into the work. The amount of time it takes to make a gacha release, for example, can lead to 16-hour days. I don't even like to imagine [the damage to my business] most of the time. Over a day or two it might just be a hundred dollars maybe, but over years…"

One thing that isn't clear is what these dupers hope to gain, but Allagash and the creator I spoke to both insist it has to be real-world money. "They're clearly not just doing this to be able to have fun in Second Life. They're making significant money," Allagash tells me. Because Second Life's virtual economy is susceptible to money laundering, Linden Lab has a strict process for withdrawing US dollars. Allagash says that if it's possible these dupers have found ways to undermine the game, it's plausible they might have found loopholes in withdrawing their money too.

Creators aren't the only ones finding it hard to compete with dupers, either. As Allagash tells me, Second Life has a massive economy of professional resellers. These players gamble on gachas and then sell the items they receive to ultimately turn a profit themselves. It can be a very lucrative business, according to one reseller—until dupers get involved, that is. "When [dupers] steal designs to sell I no longer invest in a set, depriving the creator of money," Sushnik Samas, a reseller, tells me. "The expected return on a copied set plummets. Others may not be quite as scientific as I am, but surely realize they are bleeding money and also stop playing a set giving the thief free reign on the copied virtual goods."

A history of being duped 

Wanting the perspective of someone whose livelihood wasn't impacted by this, I reached out to Wagner James Au, a tech consultant and owner of the prominent Second Life and virtual reality blog, New World Notes. He tells me that, despite the outrage, the problem of duping is largely contained within the niche of gacha sellers. "For one thing, only a fraction of the total [Second Life] economy is based around the web-based Marketplace—most active SLers prefer to conduct many or most transactions in-world, since it's a more seamless, immersive experience." 

Au goes on to explain that this is just one more chapter in Second Life's long history of intellectual copyright theft. Since 2006, players have frequently found their virtual products stolen and duplicated in a number of ways, which "inevitably (and usually belatedly), Linden Lab tamps down with some increased whack-a-mole against infringers, and the outrage is shunted elsewhere."

But even Au agrees that while duping might not be killing Second Life, it's still an issue. "Linden Lab has not been transparent or sufficiently responsive to duping issues like this, especially when many people’s literal livelihood depends on their responsiveness. The fact that the [Second Life] virtual economy as a whole is more or less doing well doesn’t change that."

Speaking with Allagash and the others affected by this, Au's statement echoes their frustrations: Dupers are to be expected, but Linden Lab needs to improve. The company employs measures to protect its creators' rights chiefly through a DMCA filing process and an internal abuse reporting system. The problem, as Allagash tells me, is that neither of these systems is very efficient.

"The DMCA report is managed by an outside company will take this particular thing down faster than an abuse report," Allagash tells me. "So what happens in this sort of spider web is that the DMCA report will take [the Marketplace listing] first, which is immediately helpful for that creator. But after the DMCA report takes it down, there's no [evidence for the abuse report] and so Linden Labs does nothing. The person isn't banned, there's no punishment. They come right back and do it again."

For the creators who are, in many ways, the lifeblood of Second Life, it's immensely frustrating since both systems can take days or weeks to produce results. "I feel like they see the DMCA as the end-all to the problem," the anonymous creator told me. "And in some sense, it is—the item is removed from sale. But the problem is that someone can just make a new account and upload the item again. It's [Linden Lab's] follow through with repeat offenders that is lacking, and it's their unwillingness to comment or work with us on it that makes me feel not valued as a creator."

Linden Lab, however, feels differently. "We take the protection of SL content creators and our community very seriously," Peter Gray, who was Linden Lab's senior director of global communications until departing the company during the writing of this story, told me via email. "We do not share metrics on account bans, but can confirm that we have permanently closed a number of accounts for this activity and are committed to vigorously pursuing any violation of our Terms of Service and Community Standards."

"Unfortunately, it’s not uncommon for bad actors to move onto new methods. We are engaged in an ongoing pursuit of cheaters and continuously closing loopholes and working to protect our creator community," Gray added.

When asked about the specific actions creators could take to protect their intellectual copyright, Gray said, "We follow the DMCA takedown process as prescribed by the law. Abuse reports submitted by users are normally reviewed within 72 hours, although the process may take longer in some cases, depending on the type of report and information provided. We cannot comment on specific accounts, and therefore users who submit abuse reports are not notified about actions taken as a result of their reports. Unfortunately, that may lead some users to feel as if their reports may be ineffective, even when they actually result in account bans and other enforcement actions."

But that's not good enough for many of Second Life's creators. While the MMO is often passed off as an aging game with a limited playerbase, CEO Ebbe Altberg told Motherboard in an interview in 2016 that 900,000 players still log in monthly. And for those who have turned their passion for it into a full-time job as a virtual designer, it's easy to see how the continuing theft of their hard work is so damaging. "We just want our work to be protected," the creator tells me. "In the age that we live in, it's a basic right on the internet—I would hope."