World of Warcraft: Corrupted Blood

Lonely warriors step over the remains of their fallen brethren. Skeletons line the streets in such numbers that one can hardly see the ground underneath.  The infected spew blood in every direction. Only the very strongest remain alive, in the barren ruins of once-thriving major city centers. Cries of “omfg stop it”, “what is going on?” and “my jimmies are rustled” echo through the empty streets.  Thousands upon thousands of the innocent are guided towards the light…of their main menu screens.

Hi, I’m Ran Levi.  For three seasons of the Malicious Life podcast, I’ve taken you through some of the most significant computer hacks in history–the world’s biggest company taken down, a presidential election compromised, a nuclear power plant gone haywire.  There’ve been evil forces at play, and ultimately good ones; criminals caught and many more still on the loose today. The common thread, of course, is malware–malicious software–or a computer program specifically written to cause damage.

In today’s episode, we’re switching things up a bit.  The subject of today’s episode is a kind of malware, I suppose: it is, technically, a software that caused a sort of harm to many thousands of people around the world.  It wasn’t, however, meant to do what it did. Really what I’m talking about is accidental malware–or, in technical terms, a bug. But not just any bug: a computer bug whose legacy lives on today in the field of–you guessed it–epidemiology.  The story you’re about to hear has as much to do with Ebola and Leprosy as it does Windows and C++.

We begin in a dungeon…

Within the heart of Zul’Gurub lies the powerful demon Hakkar–with the red face of a dragon, and a curling snake’s body.  Its limbs feature stinging pointed tips, its wings fan out in bright blue. Hakkar’s heart is purple–protected by a black, exposed rib cage jutting out from his torso.  Worst of all: Hakkar is donned in a magisterial red jacket like the one Michael Jackson wore in the Thriller music video.

Hakkar is a character in the World of Warcraft video game.  Warcraft is what you’d call an MMORPG–a massively multiplayer online role-playing game–created by Blizzard Entertainment.  We say massively multiplayer because when you log in, you join into a game world alongside millions of other players with whom you can interact in any number of ways, whether it be fighting alongside one another or just chatting.  This is a quite central aspect to the game: while most of World of Warcraft’s gameplay involves battling monsters like Hakkar and earning collectibles such as weapons and armor, the social aspect to being part of a community with gamers all around the world is really what distinguishes it from other role-playing games.  There are a couple – quite a lot of couples, even – who met in World of Warcraft, fell in love and eventually even married. I guess you could say most of them are now battling their own little monsters…

Anyway, The massively multiplayer component is also what caused Warcraft, almost a year after its release, to become a picture of death and destruction that would shape how people thought about video games more generally.

Zul’Gurub was a raid introduced to the game on September 13th, 2005.  A raid, for background, is where a group of players will band together to fight and complete an in-game mission.  Missions like Zul’Gurub often culminate in a “boss battle”, where players climax their journey through the dungeon with a difficult fight against one particularly powerful foe.  The boss of Zul’Gurub was Hakkar. Hakkar wouldn’t have been much to remark on, if not for its most deadly power: “Corrupted Blood”.

While attacking Hakkar, players had a chance of getting hit with Corrupted Blood–a virus that, once contracted, caused continuous damage throughout the battle, and could only be cured once Hakkar was defeated.  Any player infected with Corrupted Blood could also pass it on to other players through contact, like a real-life disease. It was a dangerous virus, dealing hundreds of hit points per second, but Zul’Gurub was a high-level mission only reached by some of the game’s most experienced and powerful players–those that could handle a few hundred hit points and walk away unscathed.

Corrupted Blood was a way for the game’s developers to spice up the Hakkar boss battle, by forcing players to adjust their battle strategies on the fly.  Really, for a player of the necessary skill level to reach Zul’Gurub, the effect wouldn’t be much stronger than a common cold to a healthy adult. But World of Warcraft’s engineers overlooked a key aspect to their game–one which allowed for an otherwise innocuous gameplay mechanic to become a plague, ravaging thousands of unwitting players throughout the game world.

Thomas Eric Duncan had just recently quit his job in September of 2014 when he hopped in a car to take a sick pregnant woman to the hospital.  Four days later he boarded a plane, from his home country of Liberia to Dallas, Texas. Only five days thereafter, Duncan was diagnosed as the first case of Ebola recorded within the borders of the United States.

Epidemiology is quite a unique discipline: equal parts biology, medicine, statistics, geography, and maybe a little bit murder-mystery.  In studying how diseases spread, equally as important as the diseases themselves are patterns in human behavior: how people move around, and how social groups interact.  No sickness is itself an epidemic: what makes an epidemic is when sick people come into contact with healthy people, then those people get sick and interact with other people, and so on.  Trying to track this web is like trying to track a high school rumor: Stacy heard it from Jenna who heard it from Grace who heard it from Franny who told, like, six people and somebody posted it online but then deleted it and who even cares at this point?  I’m just tired now.

Human populations form these complex systems, and in order to make sense of how a disease can move through a complex system, epidemiologists often turn to statistical modeling.  With models, you can try your best to recreate how populations ebb and flow, but people are just not that easy to pin down with numbers, no matter how deep your equations go. If only researchers could infect a study group with some deadly disease, then observe them as they kill thousands of people around the world, all would be good!

That was a joke, of course.  I mean to emphasize how difficult it is to track epidemics, how there are no simple solutions to be found, and why some researchers have to get creative in order to learn new things.  Creative like using a video game event to study diseases.

This event was really something that’s raised to the radars of everyone. I mean everyone. After we have published our paper in epidemiology, it was like – went like fire. I mean they were interviews in all of the major broadcasting in Time, on national TV in the US. It was really something that gained a lot of attention.

You’re listening now to Professor Ran Balicer, an expert on today’s story.

So my name is Ran Balicer. I’m a physician and an epidemiologist and I served today as the chief innovation officer at Clalit, which is the largest healthcare system in Israel and also the Director of the Clalit Research Institute.

It turns out that “Corrupted Blood” was its own sort of epidemic, resulting from a single oversight on behalf of World of Warcraft’s developers.  What was that oversight? Well, it has something to do with Thomas Eric Duncan.

What Blizzard’s designers failed to account for was a particular mechanic second-nature to any player’s experience: instant teleportation around the game world.  Because Azeroth–the open-world environment in which the game takes place–is so vast, with many different regions far too spaced out to walk or ride between, players regularly teleport between locations in order to avoid downtime.  Sort of like, say, riding an airplane from Liberia to Texas.

Instantaneous travel meant that a gameplay mechanic designed only for strong players could swiftly leak out into Azeroth’s general population.  Players losing in battle could teleport out to safety and regroup, but remember: Corrupted Blood’s effects only go away once Hakkar is defeated.  This meant that by leaving the dungeon without completing the raid, players began to unwittingly infect nearby player characters with no relation to them, or to Hakkar at all. However, it wasn’t just players infecting other players–often, it was their pets.

In World of Warcraft, you can expect that your character will die a lot.  Each time you’ll come back to life with only minor penalties, like slightly damaged armor.  However, it happens to be that if you traverse the lands of Azeroth with a trusty sidekick–for example, a dog–and that sidekick dies, the penalties to you are significantly more detrimental.  This incentivizes players to dismiss their pets during particularly tough battles, to return once the danger has passed.

Like mosquitos to malaria or pigs to swine flu, it’s believed that Corrupted Blood turned into a truly global phenomenon as pets were sent out from Zul’Gurub into towns and city centers.  Unwitting passersby came into contact with the disease-carrying pets and the plague spread outward from there. Of course, this was only phase one.

Where pets may have been the early indicator of an epidemic to come, it was the humans, as you might expect, who ended up causing the most damage.

Once Warcraft players caught on to what was going on, large groups of trolls took hold of the opportunity, purposely infecting as many people as they could for the fun of it.  Those strong enough to withstand Corrupted Blood, but malicious enough to want to see it spread, actively sought out Hakkar, contracted the infection, then immediately teleported to the most densely-packed city centers in the game.  Unaware players were trapped, and many contracted the disease and died before realizing what was going on. Others reported being chased down by laughing trolls. Perhaps the most effective strategy used by the trolls was to infect non-player characters–townspeople such as shop owners, who cannot be killed but can be interacted with.  These NPCs acted like indestructible traps. In all these ways, Warcraft trolls reenacted what you might expect from real-life terrorist activity–finding large groups of innocents and then unleashing as much harm as possible through any means available.

Another subset of the World of Warcraft population tried their best to fight off the evildoers.  Player-characters with healing abilities acted as first responders, rushing to the aid of the infected, healing the wounded and reviving the dead.  Those from Blizzard’s developers community attempted to mitigate the problem on a governmental level by setting up designated quarantine zones, where the uninfected could congregate to avoid the epicenters of the plague.  Some welcomed the help, others remained suspicious. The rescue mission would come to be called the World of Warcraft Health Organization.

Ultimately, the rescue efforts ended up backfiring.  Healers couldn’t cure the weak, only keeping them alive for long enough to continue infecting others.  The quarantines went about as you’d expect. They looked like big, red targets to the bio-terrorists, who infiltrated the makeshift camps and ruined them from the inside out.

One study estimated that about one hundred new players per hour were being infected in any given city or transportation hub during the outbreak, though the true figures were never released.  Concerned community members took to the message boards, frantically letting out their frustration and asking for answers. Misinformation spread quickly, pouring gasoline on the dumpster fire.  At this point, every server reached by Corrupted Blood became functionally unplayable.

If you’re still unsure why Warcraft would ever end up on the radar of professional researchers, it’s worth noting that epidemiologists, for years now, have been creating their own simulated worlds not so unlike an online game.  Here’s Ran Balicer:

So in recent – actually, in the last three decades, there are increasing attempts to use mathematical methods in order to predict the way plagues and infections spread in populations. The thought is that if we can properly simulate or model the way the disease will disseminate, we will be able to better understand the mechanisms that can control its spread and prevent it.

Now at the beginning, the main use was in what, what was – differential equations and this was a fairly crude method trying to assess this dissemination pattern, assuming there’s a mathematical pattern in how this thing explodes basically in a logarithmic scale and you can actually model it and how you can think about it is like there’s a wildfire and you can think of how in the beginning, it spreads very intensively and as time goes by, there’s less and less trees left standing and the fire goes away.

So this type of approach has been used in these types of differential equations or what is called SEER models. In the next phase, they try to do simulations, which means you take virtual characters and give them properties by which they move in space and they can meet each other or you think about it as bouncing at each other.

Whenever they bounce, there’s a likelihood that it can be determined that they will infect one another or transmit the disease, one to the other. They would also have likelihood of dying and likelihood of being sick and you can modify the behaviors accordingly.

If you have enough of these virtual characters or agents, as they’re sometimes called, because this thing is called “agent-based modeling” or simulation, those agents, if you create hundreds or thousands, these virtual agents, and you put a disease in the population, you can actually see in the simulation how the disease propagates and when it is stopped and how many people get infected.

So this is one very effective although very computer resource-consuming approach to modern infectious diseases.

Virtual worlds are in most ways modeled after our own–whether it be tailor-made simulations from research facilities or even the ones with wizards and monsters and experience points.  When word of Corrupted Blood extended past the gaming community, a few creative thinkers noted its potential as a case study for how humans react to crises.

Other researchers–and, in most cases, the prudent supporters of the theory themselves–were quick to point out the many problems with trying to equate a game world to the real one.  To summarize their argument: it’s a game!

If you die in Warcraft, you respawn with minor penalties to your character. Assuming you don’t subscribe to the concept Reincarnation – If you die in real life, you don’t respawn.  It’s hard to get around this discrepancy when trying to draw lessons from Corrupted Blood. Players demonstrated a number of behaviors in response to the outbreak that you wouldn’t expect of them in a life or death scenario, such as those who purposely contracted the virus for the humor value in running around and passing it on to others.

There’s also a demographic problem here.  Some researchers in the know noted that Warcraft does sport an unusually diverse user base as far as video games go.  However, it’s still safe to say that certain populations, like American teenage boys, are represented disproportionately relative to, say, Nigerian middle-age women.  As such, to extrapolate how humans react to a particular situation by using the Warcraft population as a test case is sort of like extrapolating how humans feel about Selena Gomez by visiting a cheerleading camp.  The results will be somewhat skewed, and incomplete.

With that in mind, however, it’s hard to ignore the parallels between Corrupted Blood and how real-world epidemics play out.  It was a sickness that originated in a remote, rural area, then migrated into urban areas through human and animal agents. It was passed on through close proximity.  Some were immune to its effects (in this case the NPCs, high-level players for whom the damage was negligible, and healing-based characters). Quarantines were arranged and major city centers were evacuated.  Some used healing to help the sick and others took advantage to create widespread destruction. Other players logged into the game to see what was going on, sort of like journalists do. And even if a death in Warcraft is little more than a nuisance, the fact is most players do put care and effort into their characters and take whatever precautions they can to keep alive.

So here we have a model of a disease, a known source and means of spreading, and an environment in which humans can interact with it: that’s better than most of what you can do with just numbers and AI.  The quarantine setup and takedown, for instance, couldn’t reasonably have been predicted purely from a statistical standpoint.

From a mathematical standpoint, the advantage of a video game setting is that you have both dependent and independent variables at play.  You can’t predict how human-controlled characters will behave, and you can predict exactly how non-player characters will. Where you have a limited number of possible actions available to those human players–moving, teleporting, casting spells, fighting, chatting–there are an infinite number of combinations to how a player can make use of those actions.  Because games offer a human touch, they offer an added element of realness that standard statistical models cannot.

Basically, the most difficult thing in these simulations is to give each agent a mind of its own and to know how real people act in space and time, how they not only robotically move from one point to the other, but how they actually change their behavior according to events that just happened and it is obvious to all of us that once the disease begins or contagion begins, people do not continue to act like before. So you have to take that into account.

Now the events in a simulated world like a multiplayer online game is the perfect opportunity to see how people act when they are fearful when they are trying to protect themselves, when they’re trying to do even very heroic things in that game. Some people try to heal other people, despite the risk of their own health. Some people fled. Some people try to stay away from the concentration of virtual populations to not to get infected.

So this is something that we can use, the power of people playing those avatars or those virtual characters, and the logic in their action that really is difficult to simulate automatically.

Corrupted Blood isn’t a malware story, even though it is, in a technical sense, a “computer” “virus”.  And yet, it does recall some of the ways in which malware acts and how we respond to it. Really, you could imagine this same story with hackers behind it instead of Blizzard’s developers, and it might not have gone all that differently.

I think something that’s happening today and is interesting is that because of the similarities between computer viruses and biological viruses, that some of the people involved in cybersecurity are starting or are continuing to learn from the way the human body protects itself from these biological threats, trying to mimic those and creates mechanisms in computers that would protect them against unknown threats the way our body does so successfully.

As for the scientific side of the story, only small pockets of video game-based research have popped up in the years since 2005.  Eve Online is a multiplayer game that hired its own professional economists to oversee its in-game economy. Second Life is perhaps gaming’s most prominent crossover into the world of science–like Warcraft, it’s an online multiplayer experience based in its own virtual world, except unlike Warcraft it’s not totally a game.  There are no objectives, no inherent conflicts to overcome in Second Life. It’s more like a virtual sandbox, where players are free to do whatever they please with no direction. As such, it’s provided fodder for researchers in the fields of education, sociology even healthcare.

Ultimately, it’s difficult to tell whether the Corrupted Blood bug had any lasting effect on real-world science, or whether it was treated as a mere passing fad; so I asked Ran Balicer whether we should take away any lasting lessons from it.

The saying about models is that every model is wrong but some are useful. So we’re not saying that what you will see in a virtual platform like this would be an exact simulation of what would happen in real life epidemic. But that being said, it is still useful to use such platforms to understand some characteristics of population, how they react and how a disease will spread in a real-world setting. I think it is an invaluable resource to test drive both dissemination patterns and containment mechanisms in various ways.

So I think it could be a useful tool. But it is not very easy to harness it for scientific purposes.

As for the game itself: after a few days with half the Warcraft community down, Blizzard did what they had to do to get their game back up and running.  They shut down their servers, then rebooted them without the new code. This, probably, is the point where researchers went: well great, we wish real life were that easy!