I'm not a gamer at all, so this would normally escape my view, and I don't know if what you say is true and I can't evaluate yet.

But, to me, it sounds like you are saying this potential bad actor is intending to use the GDPR to determine the 'secret sauce' used to detect bad actors?

In other words, "Be transparent in your evaluation methods!" with the subtext of, "then I can subvert them."

That's one thing I hadn't considered. Pretty clever, almost like an oracle attack.

What I'm saying is much simpler. Cheaters are a very interesting crowd. In first person shooter games it's absolutely possible to dominate cheaters (because cheats only help with raw mechanical skill, not strategy or tactics) and the cheaters will often be the first to complain about cheaters when you kill them. Despite their unfair advantage, they lash out when things don't go their way - which seems to be happening here: they truly believe that they are above reprimand and that Anet must be punished for reprimanding them. The threat of GDPR is being used for this. In the broad category of shifting blame, it's very very consistent behavior and would probably make for a fascinating study.

There is always a chance that the author is being honest (having cheated in other games, but never GW2) but it's slim. I have my doubts as to whether GDPR would cover this (as it cannot be used to identify a natural person), but IANAL.

So, the GDPR actually says two things

- personal data is any data about a person which could, in combination with other data that you may not have, identify a person. That's much broader than your definition. In this case, I think the claim would be that if you knew all programs installed by a person, you could figure out who that person is. It's still probably a stretch. It's good that they prevented themselves from knowing what the program is, because that could sweep up health data. ie imagine they knew you were running a blood sugar tracking program, they could infer you had diabetes. Health data is in a heightened protection class under the GDPR.

- The game would still have to service data requests, ie give me all your data about me.

Doesn't seem that slim a possibility. I honestly can't see the need for bots or cheats in GW2 when there's so little that's grindy in quests or dailies and there's shortcuts through most of the dungeons simply with class skills not wall hack cheats. The only rare drops I can think of are the dungeon recipes which aren't that rare compared to drops in other games.

In other games, the grind is clear, and the appeal of bots painfully obvious.

It's a few years since I played GW2 so things may have changed.

Posting an analysis most definitely does not make you a bad actor. He works at an AV company and analyzes malware for a living. Malware uses the same techniques as this kind of spyware, and it’s pretty natural for a curious person who works with these tools to see what it was doing, especially after a ban. The GDPR won’t make that any less difficult.

> but, suddenly, all information regarding which protocol is missing - that would have been genuinely useful to know (unlike the prior wordiness).

And might be a reason for ArenaNet to sue.

From what I have read, reporting about shortcommings in MMORPGs can get expensive quickly. There is a reason the Defcon 25 talk by Manfred was cut short. ZeniMax Online wasnt amused

edit: I did remember correctly, the very same video was taken down from youtube by Arenanet

https://www.youtube.com/watch?v=PfbMZJsb1cQ

>"DEF CON 25 - Manfred - Twe..." This video is no longer available due to a copyright claim by ArenaNet, LLC.

pssst. https://www120.zippyshare.com/v/qq5Tatj5/file.html

>The disclosed information cannot be used to identify you as a natural person.

What alternate GDPR reality is this?

GDPR doesn't automatically cover everything that can be harvested from your machine. It has to be demonstrated that the data can be used to identify you as a natural person (which is different to PII, which is an American legal term). You might be able to identify a natural person with this information, but it's incredibly variable as it only includes running processes (unlike browser plugins used for browser fingerprinting, which may not change for months).

Assuming you can figure out how to reliably fingerprint someone with this information, GDPR allows collection of data that is reasonable for providing the service you are offering: a bot and cheater free game is part of the service that Anet offers. If you request this data, then what?

MMO characters often become the embodiment of their players or visa-versa. There is also your CC and billing information, which in combination with your character name (often your nic/handle) could be used to identify you on other social media. This is far more threatening than a list of running processes on your machine.

Anet may include these hashes in their GDPR compliance, but rest assured - forgetting someone means deleting the lot.