‘Secret’ City of Heroes emulator operators address SCORE leak drama, rebut personal info database rumor

April 15, 2019 8:10 PM

My beloved Dark/Ice Tanker, Mirror Maze. RIP, City of Heroes.

If you’ve been around the post-sunset City of Heroes community long enough, you’ve probably heard the rumors that there’s a secret City of Heroes rogue server out there under construction – not SEGS, and not Paragon Chat, and not any of the spiritual successors, but specifically a functional private server version of the real game. Traditionally, anybody bringing that up has been ostracized as a liar. But it’s all come to a head this week as one YouTuber posted a video calling out the secret server and at least one of the people behind it, and now we’ve got a lengthy statement from the private server team’s leader acknowledging some of the claims and resoundingly denying others.

Let’s start from the beginning. Destroyer Stroyer aka Doc Boy, who says his real name is Brian and who uses his own face in the video, says he was invited by an admin to the secret server after he made a huge screenshot-dump post on Reddit. In a nutshell, his accusation is that some members of the City of Heroes community acquired the game’s original code from a former Paragon Studios employee and have been running it in absolute secrecy, under threat of ban, for the last six years.

https://www.youtube.com/watch?v=uUuQDcL2FoY

“At least for me, playing the game and not being able to share the game, was not fun,” Destroyer Stroyer says, explaining why he chose to break his NDA to expose the server. [Update: Subsequent investigation confirms there was no NDA, just a verbal agreement not to leak.] In both the now-deleted original video and the second upload (shown above), he accuses various members and groups across the internet, most specifically the City of Heroes subreddit, of working in tandem to keep a lid on news about the server, and he alleges that the secret server has a database backup of the live game, including what he implies is account and character information. A second leaker additionally accused Paragon Chat of being a “smokescreen” for the real emu.

In a statement prepared for Massively OP in response to our request for comment on the allegations, a representative of the not-very-secret-anymore private server, SCORE (it stands for Secret Cabal of Reverse Engineers), has addressed most of these rumors and accusations, absolutely confirming the existence of the server. SCORE’s lead dev, Leandro Pardini, denies the claim that he moderates the CoH subreddit; says that Paragon Studios, the Titan Network, and SEGS are entirely blameless; and vows that no personally identifying information was ever shared between former Paragon employees and the SCORE team. “This last NDA breach has had some malicious elements to it, probably to inflate the claims and make it feel more dramatic than it is,” Leandro maintains.

“There is one specific rumor that needs outright debunking, though: at no point did I, or anyone else I know, receive a database containing player names, emails, birth dates, payment information, or any other personally identifiable information. Not only would this have been a massive breach of privacy, but that is not information that a game server would ever need to operate, and so it would have been completely pointless to share.”

The CoH Survivors Facebook page has absolutely exploded in fury and hurt over the news. While some folks are feeling vindicated because their previous claims about the secret server have been proven true, others are concerned that the publicity will bring a(nother) NCsoft C&D down on the operators’ heads. (Frankly, we’re concerned about that too and considered that most carefully before publishing this piece.) And still others are crushed that they’ve never been invited and have instead been funneling money and time into other City of Heroes spinoffs, like Paragon Chat and the spiritual successors.

“A ton of players who loved this game, myself included, […] probably never were going to get an invite anyways, since we never used Reddit, nor did we have a ton of super strong connections to people who might already be on said Private Server, let alone active enough to recruit us to it,” wrote one Facebooker, alluding to the now-dawning realization that the City of Heroes community isn’t quite as tight as some folks like to believe. (It’s not all doom-and-gloom, for what it’s worth; the memes are pretty funny.) There are also some gamers still accusing Destroyer Stroyer of lying and photoshopping his character, a brand-new archetype that never existed in the original game, since he didn’t stream it live. (They are incorrect.)

It doesn’t appear that most of the groups directly or indirectly accused in the (now-replaced original) video have addressed the issue; the only entity (other than SCORE) to have made a statement thus far seems to be the SEGS (Super Entity Game Server) operator, which in the first video stood accused of collaboration with this secret server, but SEGS’ community manager makes it very clear that it has no relationship with the secret project and in fact is rebuilding its version of the game from scratch completely in the open. This testimony is backed up by the SCORE statement and the corrected second video from Destroyer. [Addendum: City of Titans, Ship of Heroes, and Valiance Online have also weighed in; see updates below.]

What follows is the complete statement given to Massively OP by Leandro Pardini of the SCORE private server team.

The Secret Cabal of Reverse Engineers

Before I talk about City of Heroes, I need to go back in time a little bit. It has been over six years since the shutdown, so a lot of people either forgot or never knew how the server project started. And for that, I need to talk about another game.

When NCsoft closed Tabula Rasa in 2007, a group of devoted players banded together to code a server for it. It was called Infinite Rasa and it developed things in the open, with a project website and forum. The overall architecture was being discussed publicly and there was a buggy server that allowed players to log in and run around the initial area.

Then it was hit by a Cease and Desist order by NCsoft in November 2011. The website was seized, the forums went dark, and progress completely stopped. One thing was made abundantly clear to everybody: NCsoft was not going to tolerate the development of servers for their games, even four years after they were shut down.

When City of Heroes closed in November 2012, this was very fresh in my mind. Instead of trying to develop a server out in the open to suffer the same fate as Infinite Rasa, the efforts to revive City of Heroes focused on trying to acquire the IP from NCsoft through various means, with any server development being held in secret.

And here is the irony of the entire situation: the fact that a City of Heroes server is being developed in secret is not a secret. If you search for the phrase “Secret Cabal of Reverse Engineers” in Google, the very first result is a post from 2013, in which a player is explicitly saying that the server development efforts “might want to stay as low as possible”.

So that is what SCORE did. It utilized closed forums with, closed access. Invite only; initially only for developers, though eventually expanded to friends and family of anyone who had access. Accepting an invitation to the project involved a non-disclosure agreement (NDA), and anyone who breached it had their access revoked. Over the years, multiple people who weren’t happy with how fast the project was moving or wanted it made public were removed. For the most part this was not an issue, because the community at large, at the time, understood that this was a secret project, a backup if everything else failed. That seems to no longer be the case.

There are currently calls to make SCORE public because of the extra exposure; the reason given is that, after six years, NCsoft surely wouldn’t care. But Infinite Rasa also thought they were safe after four years. This is not a mistake you make twice.

I believe that the reason this particular NDA breach gained so much traction when others didn’t has to do with the community evolving over time. Many people no longer remember that efforts to acquire the IP were ongoing at the time, and so server development was agreed to happen underground. It is possible that a lot of people that played City of Heroes while they were teenagers, and never engaged with the community at the time, are now adults who never knew about it in the first place.

Now, I need to address the connections, or lack thereof, between SCORE and other projects that have become entangled in this dramatic reveal.

Super Entity Game Server

The Super Entity Game Server project already existed back in 2012 when the City of Heroes servers were shut down, and their goal is to implement a fully playable server that connects to the original release client from 2004. At the time there was a lot of discussion about contributing to SEGS rather than starting a separate project, but the fact that SEGS uses the original release client, while SCORE targeted the latest beta client from 2012, makes both projects fundamentally incompatible. The projects are separate, and as far as I am aware, none of the lead developers or community managers ever accepted an invite to participate in SCORE.

SEGS has been given as a reason why the secrecy behind SCORE is unwarranted. After all, they have been operating for ten years now, and have not received any Cease and Desist orders by NCsoft. It should be noted that SEGS has not yet released anything to the level of what Infinite Rasa had: working weapons and enemies, though limited to just the starting area. It’s also possible that using the original release client makes them a less appealing target. In either case, they are certainly braver and more willing to take risks than I am, and I really hope that it works out for them. While my attempts to contribute to SEGS were extremely limited mainly due to my own lack of familiarity and patience with their programming framework, I still am cheering for their success and I hope that, if this whole situation attracts attention to them, it’s only in the form of new developers seeking to contribute their skills to the project.

The Titan Network

While the initial recruitment for SCORE happened on the Titan Network forums, the project was split off as soon as possible. Because of the then-ongoing efforts to acquire the City of Heroes IP from NCsoft, the owner for the site did not want a server development project to jeopardize the negotiations, and has on multiple occasions disavowed the server project completely, although discussion of SCORE are still allowed as far as I know. This might seem overzealous, but it is perfectly understandable; the Titan Network aims to be a hub for the City of Heroes community and their many projects, and being linked to a specific underground project introduces a liability that could cause them to be shut down as well.

Once it was clear that acquiring the IP was not going to happen, the Titan Network created a project where all the user data is held on the players’ own computers and the game processes are distributed among players. This is a brilliant idea, as it means that there’s no server to shut down; Paragon Chat operates on a standard, open source chat client. I collaborated on this project’s early days, but again, the goals are too different for the projects to be merged into a single thing. And because of the difficulty in properly implementing a distributed server, I recommend that anyone with the development skills to contribute to a City of Heroes server project joins SEGS instead.

Paragon Studios

This is where things get less pleasant. This last NDA breach has had some malicious elements to it, probably to inflate the claims and make it feel more dramatic than it is. While I won’t deny that some former Paragon Studios developers are aware of SCORE and have provided helpful tips in the past, this should not be shocking to anyone who has been around the community long enough; I have seen some former Paragon Studios developers in the Discord server for SEGS as well. Under no circumstances should there be fingers pointed at them; anything they shared was done so with the tacit understanding that it would not endanger their current or future employment. I am very happy to take the heat over this entire situation, even though I think it has been overblown. Leave them out of it.

There is one specific rumor that needs outright debunking, though: at no point did I, or anyone else I know, receive a database containing player names, emails, birth dates, payment information, or any other personally identifiable information. Not only would this have been a massive breach of privacy, but that is not information that a game server would ever need to operate, and so it would have been completely pointless to share.

Reddit

The person behind the current NDA breach cites Reddit moderators being too quick to remove all mentions of any private server, except for their two stickies for SEGS and Paragon Chat. While this again might seem overzealous, it really isn’t. Reddit as a whole does not tolerate when a forum triggers legal complaints; very recently, the subreddit where piracy is discussed had to delete 10 years of archived discussions to prevent being shut down. There are also the very valid concerns that malicious actors would post links to City of Heroes servers that turn out to be scams which infect the player’s computer with malware or stealing payment information. Reddit offers no accountability regarding who posts anything, and so it should be heavily policed to guarantee a safe environment. If this feels like censorship, you are always free to start your own subreddit. I do not moderate the City of Heroes subreddit, the Titan Network or any Facebook group.

Trust and Feelings

This is a difficult thing to address, because nobody likes feeling lied to, even by omission. At the same time, operating under an NDA comes with some rules that are well understood. The fact that we’re talking about a server project for a game while the company that owns the IP is still active and used aspects of the IP very recently for Master X Master makes things more complicated.

My approach to enforcing the NDA has always been to not reply to any public posts that revealed details about SCORE, and just contact the specific party to have the information taken down. Others have gone as far as to call them liars or crazy, which goes against my wishes. I do apologize for anyone who was on the receiving end of verbal abuse due to this situation.

Back in 2012, the City of Heroes community agreed that SCORE would operate in secret until we had something ready for release. The fact that nearly nothing has been released six years later is probably part of the reason why this attracted so much attention; the community has shifted and changed, and not many remember how the project began. I am sure a lot of people are curious to know how much progress has been done; however, with SEGS having regular and interesting releases, it feels quite unfair to come out of nowhere and steal their thunder with a progress report on something that is hidden by design.

Unless and until we are certain that a Cease and Desist order is no longer a threat, the NDA regarding SCORE development will remain in full effect. For most people this will seem like a moot point since most of the community are aware of it, but keep in mind, that is also how we started. Until then, support SEGS! They are very close to a new release and I will be very disappointed if the ghost of SCORE overshadows their accomplishments.

In parting, we specifically asked Leandro about the future of the server and how players can become involved – after all, public news that our original characters still exist somewhere in a playable format is tantalizing. It appears that work will continue and that the method for access remains unchanged, though plans for open events in the near future have been shelved indefinitely as a result of the unwanted attention brought about by the leak.

Source: Destroyer, SEGS, Facebook. Thanks to Ian, Luke, Brendan, Drew, Leandro, and the SCORE team itself.

Update, April 16 AM

Leandro has added additional clarifications in PC Gamer’s pickup of this story. In addition to noting that he was once a mod on the Reddit sub (but never ran it and is not a mod now as he confirmed to us yesterday), he explains how he acquired the game’s original character data: “He says that before City of Heroes shut down, players created tools to backup and save character data stored on their local computers. But six months into developing SCORE, Leandro was contacted by an anonymous person who claimed to possess all the character data stored on City of Heroes’ servers before it shut down. To prove it, this person provided Leandro with server files containing his own character data. Over a period of weeks, this person transferred the entirety of City of Heroes’ character data through encrypted networks and then disappeared.”

Update, April 17

We’ve spoken again to Leandro and have a few more things to convey. First, he clarified that while he was at one point a moderator on the City of Heroes Reddit, he never “ran” the Reddit, and most of the board’s moderation was done by automation, a claim largely backed up by other moderator comments we’ve seen in past days. “A lot of the anger about overmoderation is just due to typical rules that most subreddits use: new accounts can’t post without being approved, posts with profanity are flagged for approval, and so on,” he told us. (MassivelyOP uses a similar ruleset; banned commenters can post, but their posts are immediately suppressed.)

Notably, he claims that Destroyer Stroyer’s anger over his moderation following his ban from SCORE and attempts to break his NDA on Reddit is precisely why he (Leandro) quit as a moderator and deleted his Reddit account. [Update: It does not appear there ever was a formal NDA, just a verbal agreement to keep the server secret.]

Leandro also says he “strongly opposes the characterization of SCORE as an small, elite group that kept everything for themselves” because the server actually saw exponential growth (we understand it had several thousand active players) “as fast as software stability and hardware upgrades allowed” with the sole requirement being the agreement to keep mum on the server’s existence. Moreover, he says SCORE was indeed debating a timeline for public release.

“So the deadline of ‘when it’s done’ was probably pushed way farther that it needed to be, in retrospect. But it’s easy to judge those things in hindsight. The last discussion on an open event leading to a public release was for the game’s 15th Anniversary, which is coming in just a couple of weeks. Nobody who wasn’t part of SCORE will believe that, but sometimes timing is just that bad.”

Finally, Leandro shared with us one of the death/rape threats he’s received over this scandal; it includes Leandro’s address and other personal information. It’s horrific, but sadly entirely believable just given what we’ve seen in our comments and on Reddit in the past few days. It shouldn’t need to be said, but here goes anyway: No matter how angry you are over a rogue server, it is never OK to send death threats, to anyone, and we hope they are reported to the authorities.

We are currently running a poll asking our community where it stands and what it thinks should happen next – and apparently SCORE is watching it, so it’s probably worth your time to weigh in.

Update, April 16 PM

We’ve now spoken to a representative of City of Titans, who has clarified it is not connected to any of the City of Heroes emulation projects, including SCORE. City of Titans, as you’ll recall, is one of the multiple crowdfunded City of Heroes spiritual successors attempting to build an entirely new game from scratch with an entirely new IP to boot. Another spiritual successor, Ship of Heroes, posted yesterday noting that its own independent development continues with the goal of providing “a gaming home to all of those who want to continue to experience the positive community.”

Update, April 16 PM #2

Our own Eliot Lefebvre, who maintained our City of Heroes column for years on Massively-that-was and currently co-authors our superhero MMO column, has posted an editorial about the impact of the revelations and accusations on the City of Heroes community.

Update, April 17

Our lead editors have teamed up for a bonus roundtable podcast on the whole mess.

Update April 18

The developers of Valiance Online have made a statement about the ongoing situation: “We’re aware of the current server controversy in the community, but are focused on getting ready for a public access week for our project. We have no affiliations with any other efforts and will continue to focus on our game only.”

April 19

This article has been heavily updated to reflect clarity on the terms emulator, private server, and what we’ve decided to use as a new umbrella term for all unsanctioned servers, rogue servers. Additional updates on this unfolding story will be made in the more recent threads on the topic, which you can find below. To be absolutely clear, we are not encouraging illegal activity and advise everyone involved to consider their actions carefully.

Our complete rundown of the entire City of Heroes SCORE situation to date: