PT Magno , Abusing API keys ( Torntuga)

We demand the reasons!

Hello everyone.

Thank you for your patience, some more than others, in waiting for the results of this case. I will only be addressing the case itself here, I'm not interested in entertaining the several dozen pages of arguments in semantics that quite frankly are irrelevant and not worth anyone's time being invested in.

This has been a very unique case and it is not one I have taken lightly, whilst there have been similar cases in the past (See Fr00t), this one was somewhat different with the nature of what occurred. An account that a player has invested years into hangs in the balance and this certainly isn't a decision that can be made in an instant. Many factors are considered here, from the severity of the offence, the time in which it occurred, how many players are affected and the ramifications this decision may have on Torn as a whole going forward.

There has been a lot of speculation on what did occur here, so now that I am concluded I can clear this up, and I can also confirm the abuse was taking place and had been ongoing right up until the day the user in question was banned.

Over the past several weeks we have been investigating reports on MaGnO [51498] abusing API keys he was entrusted with, using these keys to track money on hand of individuals who had since left his faction group for the purpose of mugging. Any user that had submittted their API key to PT group's Torntuga system, or any area that MaGnO had access to, would be targeted for mugging purposes after they left this faction group. This is a clear violation of the guidelines we lay out in the API documentation, as well as the scripting guidelines when it comes to the releasing of scripts with undisclosed abilities, a subject which was covered before, here: https://www.torn.com/forums.php#/p=threads&f=1&t=16119253&b=0&a=0.

Our investigation shows that this abuse had been ongoing since December 2019, 3 months after that update to the scripting guidelines, and in recent months had ramped up significantly, we can only apologize for not catching this sooner and will do what we can to make it right. The assistance of new developers on our team who specialize in work with the API has been key to completing this case, and I am immensely grateful for their help, it made confirming this case a much easier task, and thanks to new procedures in place for this it is something we should have an even easier time catching going forward.

At this time I do not have reason to believe this was a group operation, my verdict there is that MaGnO operated alone. What we found, and were shown, was that members and leadership of PT were surprised by this, seemingly genuinely so, however in the initial days there was little to condemn it, with MaGnO seemingly proud of his actions, and some of his fellow leaders both being impressed and/or amused by this abuse after finding this out following his suspension, and later going on to condemn it.

The value gained from this abuse was approximately 20 billion dollars, a relatively small sum given the wealth of the individual here, however their own personal net worth is irrelevant in my final decision, had this been value gained from RMT or Multiple Accounts there would be no hesitation to delete the individual given the value gained, which is my decision in this case. There were arguably far more people negatively affected by this than had he been violating the rules to gain this amount via multis or RMT, so I do not see this as an unfair decision, however it is always regrettable to have to remove such an experienced player from the game for a single rule violation, albeit one committed over several years, but ultimately such an experienced player should also know better - and these are all factors that allowed me to come to my final decision, any similar situations in the future will be handled on a similar case by case basis.

In order to put things right we will be recovering the value from their account and using this to refund mugs that were gained from this abuse, as well as informing users who's API keys were potentially compromised.

Thank you all.
- Joshua