The Great Escape of 30,000 Steam Keys

There was always one house in the neighborhood that left a whole bucket of candy on the front doorstep. “Please take one,” a note would usually read. But no one did. You always took way more.

When Wadjet Eye Games designer Dave Gilbert decided to give away copies of Blackwell Deception, just one of his company’s highly celebrated point ‘n click adventure games, he didn’t expect it would spiral out of control. He didn’t expect resellers would run away with 30,000 keys.

2013 has been a slow year for Wadjet Eye Games. Gilbert and his wife had a child, and that’s chilled progress on the company’s next game, Blackwell Epiphany. Gilbert hoped to spark some attention for the next game by giving away free copies of Blackwell Deception on Halloween, as begins the PR machine for its next game, set for early 2014.

“It seemed like a fairly simple, straightforward thing to do!” he said.

That would not be the case, and Gilbert would spend the next 36 hours trying to grapple with the unexpected twists and turns that came his way.

At first, Gilbert was offering Blackwell Deception on the Wadjet Eye Games web store. Users entered a code, the price would adjust to zero, and players would gain access to a DRM-free copy of the game to play on their desktop. Every one of those came with a Steam key to redeem, as well. But, somehow, users were able to acquire multiple copies at once, amassing an army of Steam keys to resell. We’re not just talking about three or four keys, either. Some users were able to grab hundreds.

Gilbert was quickly pointed towards websites that were bragging about their ability to sell cheap Steam keys for Blackwell Deception. His response was to nix Steam keys from the equation, which still meant he was offering players a free copy of Blackwell Deception. That didn’t go over very well.

“The backlash was immediate,” he said. “People really wanted to play this game in their Steam client, even though it was a freebie. They didn’t like the non-DRM version, which they could play on their desktop. They wanted it on Steam. I was getting a lot of angry emails about this, even though it was free! So I thought ‘okay, maybe there’s something I can do.’”

Rather than dropping the whole plan entirely, Gilbert spoke with BIT Micro, the payment processing company he regularly works with. BMT had the ability to set up a page where free copies of the game, now again with bundled Steam keys, would be distributed on a per IP basis--one game per IP.

You can probably guess what happens next: this was exploited, too. Through IP masking and other exploits, some users were running away with hundreds of keys at a time. Gilbert was tired.

“At that point, I had been up all night the night before dealing with all this crap, and it was getting late in the day,” he said. “I was absolutely exhausted. [laughs] That was as far as I was willing to go for a freebie, so I asked BMT, I said ‘you know what, just cancel everything, revert it, just stop the whole thing.’ And they did. And I went to bed. I thought that was the end of it.”

When Gilbert went to sleep, he was sitting on 30,000 keys. In the morning, they were all gone.

It turns out BMT had removed the link to the key generator, but it hadn’t taken down the page with the generator on it. Some people figured this out, the link was quickly passed around, and as Gilbert tried to recover from the previous day’s madness, yet another problem was brewing.

“So I was, obviously, upset about this, and freaking out,” he said. “ [...] When you have people taking advantage of a free offer like this, and just digging in with both hands and taking as many keys as they can to sell later, that is stealing. That goes beyond piracy. That is stealing.”

Naturally, Gilbert felt bad for the folks who’d nabbed a code in the middle of the night, unaware the offer was supposed to be expired. Since the exploiters were using IP masking to cover their tracks, there was no way to easily determine which illegitimate keys to turn off. All overnight keys were killed.

One of this giveaway’s biggest problems, the reselling of Steam codes, comes at an interesting time. Humble Bundle, the beloved gaming bundling service, has struggled with this. Humble Bundle’s “Terms of Service” have always stated you’re not supposed to share or sell your extra Humble Bundle codes, but people did that anyway. It was overlooked. Humble Bundle did not track people down, and it was common to see people giving away their spares on Twitter. Since others resell them, about a year ago, Humble Bundle made it a $1 minimum to get Steam keys.

More recently, Humble Bundle introduced a new authentication system to make redeeming Steam keys even easier. The catch? If you already owned one of the games, it wouldn’t generate an extra code. Some users were upset, given that they were used to having the ability to share extra codes.

Humble Bundle said it was listening, though no changes have been announced.

“We'd like to apologize to all customers who are unhappy about the new Steam key OAuth redemption process,” said the company on Twitter. “We are listening to feedback.”

The selling, sharing, and gathering of Steam codes is not new, though it’s often overlooked. If you know someone who’s shared a Steam code over Twitter, chances are the person who acquired it wasn’t the person they intended. It’s easy for bots to crawl Twitter and other services for Steam codes. Gilbert learned this early on. When Wadjet Eye Games finally had its releases on Steam, he started pasting codes on Twitter to celebrate. They were quickly eaten up by bots.

“It’s so hard to believe that there’s such a market in that stuff, but there is,” he said.

The experience hasn’t been completely negative for Gilbert and Wadjet Eye Games, though. You’re reading an article about his company right now, and he’s seen a huge outpour of support.

"When you have people taking advantage of a free offer like this, and just digging in with both hands and taking as many keys as they can to sell later, that is stealing. That goes beyond piracy."

“I can’t imagine doing another free giveaway anytime soon” he said. “[laughs] I’m glad I did it. I feel like the CEO of Coca-Cola after New Coke, where it suddenly became more popular than ever, and he was being interviewed all the time. It was like “‘is this a publicity stunt?” And he said ‘I’m not that dumb or that stupid.’ I feel that way now.”

For now, Gilbert goes back to the grind. Besides an office assistant, Wadjet Eye Games is only two people, himself and his wife, Janet. These adventure games aren’t going to write, draw, and program themselves.

But players shouldn’t expect another game giveaway anytime soon.

“I feel bad for the people who just clicked on the link innocently, and now they don’t have their game anymore,” he said. “A few apples really spoiled the bunch, to use a trite phrase. [laughs] I don’t know what else to do. It was a freebie, and I had been up for 36 hours working on this, and there was only so much I was willing to do for a freebie. I just couldn’t do anymore. I’m one guy. I just can’t do it again.”