Future crime

These two Diablo III players stole virtual armor and gold — and got prosecuted IRL

Gabriella Peñuela / FUSION

These days, we all have shadow selves that exist in virtual environments — be it on Facebook, Twitter, or in video games. And those digital avatars, it turns out, can get us in IRL trouble. Last year, in a first-of-its-kind legal case that has not previously been reported, two men pled guilty to misdemeanors in California and Maryland that stemmed from their robbing video game characters of gold, weapons and armor.

In the summer of 2012, Patrick Nepomuceno of California and Michael Stinger of Maryland, who had met each other through gaming chat platform TeamSpeak, committed a series of virtual “hold-ups” in the role-playing video game Diablo III. They sold the armor and weapons they stole from other players for over $8,000 in real money, according to court documents. It’s a fascinating example of the justice system grappling with digital wrongdoing, and deciding how harshly to punish people for stealing virtual items.

Diablo III, a video game made by Blizzard Entertainment, was one of the most popular games in 2012, selling 12 million copies. In May of that year, players started to complain on game message boards about their gear and gold being stolen. “The Blizzard boards lit up with people complaining,” said L.A.-based federal prosecutor Tracy Wilkison, in a phone interview. “So Blizzard brought the theft to us.”

According to Wilkison, court documents, and an interview with Michael Stinger, Nepomuceno bought a RAT, a ‘remote access tool’ used to take over a computer remotely. Nepomuceno and Stinger got other Diablo III players to download the RAT by disguising it as a link to a photo, which they claimed was a screenshot of a rare item. After a player clicked on the link and downloaded the RAT, Nepomuceno gained access to their computer, and was able to take over their Diablo character. He would force the character to drop all of the valuable gear and gold the player had collected, and Stinger’s demon hunter character, who was hanging out nearby in the game, would swoop in to steal the goods. “Imagine you are a gamer and you have worked long and hard to get all these items,” said Wilkison. “The victim watches himself lose everything.”

Stinger, who was 21 at the time of the two-man operation, says he and Nepomuceno were at it for two to three months in the summer of 2012. Stinger says he didn’t realize that the image link he was sharing contained a RAT or that his partner was hacking into people’s computers. “He just told me to share the link and I would get free items. I thought Patrick was doing some glitch,” he told me by Facebook message. “I didn’t really care, lol. I was getting free stuff. I was not driven for the money. I simply wanted to get better gear for my character: good weapons and armor.”

Stinger says that when he learned that the scheme involved hacking tools, he stopped taking part. But months later, the crime came roaring back to haunt him. On December 10, 2012 at 6 a.m., says Stinger, FBI agents came to his house, “guns blazing,” seizing his computer equipment and accusing him of a felony. Stinger then blocked Nepomuceno on Facebook and hasn’t talked to him since. Nepomuceno told Fusion via Facebook message that he did not want to be interviewed.

According to court documents, the pair robbed twenty to thirty Diablo III players in all, five of whom are referred to in court records only by their initials. The damage wasn’t so bad for the victims, all considered — Blizzard Entertainment simply recreated the goods they lost, said Wilkison, so the “victims” didn’t really lose anything. But Irvine, Calif.-based Blizzard, which did not respond to multiple emailed requests for comment, still wanted to go after the bandits with harsher consequences than being banned from the game.

But how do you prosecute a crime with no actual losses? “Blizzard gave the victims the goods back,” said Wilkison. “That made the loss calculation difficult because the victims were reimbursed. So instead we calculated the [perpetrators’] gain.”

Nepomuceno and Stinger had hoped to profit by selling their ill-gotten virtual gains in one of Diablo III’s in-game auction houses, where the game’s religious crusaders could buy and sell virtual goods for “gold” or real-world money. (Blizzard has since shut the auction houses down, explaining that “buying epic loot… undermined Diablo’s core gameplay” and wasn’t “heroic enough.”) According to prosecutors, Stinger and Nepomuceno sold their stolen virtual goods there for over $8,000 in cash, which puts the crime into felony territory. Stinger and Nepomuceno pled guilty last year to misdemeanor “unauthorized impairment of a protected computer.” Though he admitted to fencing virtual goods in his plea agreement, Stinger disputes that he made money on the scheme.

“We made $0,” he told me by Facebook message. “We had plenty of high value items that we were going to sell, yes. Perhaps the items were valued at nine grand. But nothing was sold and no currency exchanged hands. I got banned before I could sell anything.”

A bigger legal problem was that the pair had used a RAT to gain access to others’ computers. “The dangerous thing is the tool [Nepomuceno] was using. It’s all fun and games but the dude has a RAT he’s using against other people,” said Wilkison. “Most people use it to steal passwords and bank accounts, but these guys were going after video game goods.”

The pair got probation—three years for Stinger and two years for Nepomuceno—and have to pay Blizzard back $5,654.61, an amount that reflects how much the company spent investigating the case. Stinger is currently paying Blizzard $100 per month.

Wilkison says she sees the case as an “extension of all crime on the Internet.” “People think they are not going to get caught, that they’re not going to be found in their bedrooms on a computer. They don’t think it’s that big of a deal,” she said. “Gaming especially lends itself to this suspension of reality,” she added.

The idea of having real-world consequences for in-game actions isn’t new. Last month, a Canadian newscaster reported that some advocates would like to see people charged with virtual rape when they modify games like Grand Theft Auto so that their characters can simulate sexually assaulting other players. Given the increasing realism of video games, research being done to improve virtual reality, and expected popularity of VR glasses like those soon to be commercially available from Oculus Rift, there will almost certainly be more cases of crimes committed in virtual spaces spilling out into IRL courts.

In our conversation, Stinger still sounded in shock that his video game hijinks resulted in a real-world criminal record. Now in college, he says finding a job is tough because “they look into your background and see that you have a ‘unlawful access to computers'” conviction.

“I was just getting virtual items,” he said. “In a video game.”

Story Tags