Should I mention I've reversed engineered games of the company I interview at?

Question

During the last few years, alongside with me diving into programming area, I've been playing some games of one company. Expectedly, two interests collided and part of my experience grew from the interest of exploring games. I began to reverse-engineer them and while reading binaries assembly is still impossible for me, what I did includes:

• data mining;
• files parsing (3D models, archives, data files, etc);
• netcode RE;
• MITM-ing game servers and altering the data passed between.

Some of the information I could find I released to public, including the last tool that enabled players to do things that are legal in game but developers could not enable them, and is capable of doing things that are illegal in terms of game logic, but of course, those are not included in the release.

In the nearest future, I plan to apply for a C++ developer job at this company and I wonder if and how should I mention these details.

Additional information:

• mentioned games are online games (think of MMO);
• the company has offices in many countries but the office in my city is not the one responsible for the mentioned games;
• while some of the data was exposed, the tools used to extract it and tools' sources never went public;
• game's sensitive data is kept private, such as items drop rates or certain values for damage calculations;
• game's ToS explicitly forbids reverse engineering it, but from what I've read it would only lead to game account suspension;
• no lawyer's advice was taken on this matter.

---

Some extra details:

• might this be an important detail (in certain ways), the company is mainly a mobile developer;
• the games are abandoned by 95% for a about year already due to the closure of responsible development offices.

Addressing some of the comments:

• people do release hacks for some of their games, and scripts for models extracting, however I never heard of their request to take such posts down;
• ToS forbids alterations and RE of the game, however there was a WoW-head-like site created by player, and company:
  1. Used it as a reference within game support over email;
  2. Wanted the player to keep developing the website;
  3. Did nothing to help him.
• the game is either not very popular among tech people as I've only seen a very few tools and only heard of a few people capable of doing it, or all of that is private as well;
• I consider my "hacks" to be more of a finding flaws in games logic, not actual cracks;
• "If you don't tell them and get the job, you risk someone finding out later" is a very good point since when publishing information, I used either my in-game nick or my real name whilst I checked every released stuff to not contain either of those.

---

One of the long-lasting projects that provides some of the information to the public (mostly the one that is actually in-game) is in my resume as it gives ~2 years of experience before my first real job. I used it to apply to my current job but obviously no one asked about "How did you get information needed?", but I always could reply "Manual gathering, y'know."

---

Update: I've tried to get in contact with office HR via their social media group, but they reply ~ once in a month hence late update here.

Asking them direct question about their attitude to reverse-engineering lead to answer to look for jobs positions at their website. Ugh. Without any clear reply from them I guess I'll stick to silent position. Chosen answer provides some great ideas on how to nicely present the mentioned facts and I might follow them, I still have time until my possible application.

Here are key points from the answers:

1. Three possible scenarious exist:
   • Breaching the ToS is unacceptable.
   • It doesn't matter.
   • It depends.
2. Thoroughly read the ToS and EULA for explicit mentioning of RE.
3. Research about company's bug bounty programs, industry, their attitude for other people doing RE, if their posts get deleted, etc.
4. While the process of RE might be a good point on interview, what also matters is how you use obtained data and abilities.
5. It's better not to use your widely known usernames and/or real name if you decide to publish something, i.e. do not use your main GitHub account to post different projects.
6. If your information found associated with the data that shouldn't be publicly available, possible questions might be:
   • Why did you think that was okay to do?
   • If hired, why should we be confident that you won't violate your terms of employment?
7. If possible, you may try to find out their attitude by asking HR or someone who works there (and is your friend) some hypothetical questions.
8. If you found any flaws, security issues and any other unexpected behavior, considering reporting it to the appropriate game department.
9. If you decide to mention this on the interview, frame it in a positive way.
10. If you aren't sure how would they react, don't mention this.

Feel free to add more points or edit out the ones I understood wrong and that do not belong here.

Answer 1

I work as a Software Engineer turned Security Engineer at a computer games company.

Obviously, our ToS forbids people from reverse engineering things (and if you are reading this, don't take this as an admission that our ToS is not binding. Please do not break our stuff without our permission).

That said, we have to be intellectually honest about this sort of thing when we hire new engineers: You've, on balance, likely broken into our stuff, reverse engineered it, tinkered with it, etc. Reverse engineering is interesting! So, certain allowances have to be made: If I was interviewing a candidate who had reverse engineered our game (And I have interviewed someone who has done that in the past), I would be more concerned about whether or not their efforts had harmed the business or our customers rather than immediately ending the interview if they mentioned they had reverse engineered our stuff.

I don't put too much stock in "Violating the ToS is a bad thing and will immediately fail the interview". In my field, if no one violated ToSes as they were learning, no one would get hired. Every product has a "do not reverse engineer" clause in their ToS as a matter of course.

You have to make sure you frame it as a positive and and it can be difficult to do that. If you can use it as a way to say, "Here's all the cool things I've done that demonstrate my ability" then that's great. But if you bring up the fact you broke into our stuff as a way to somehow insult the competency of your potential future colleagues, that's not a good idea.

I'd say at least in the security field this could go either way and it'd either be a good thing or a bad thing depending on how you brought it up in an interview. I can't see the software field being all that different, but it really depends on:

1. The company culture (Does the company have a Bug Bounty program?)
2. The industry (Some industries are a lot more litigious than others)
3. Will you interview with a recruiter (who is more concerned with legality) or an engineer (who is probably more concerned with technical ability)?

As with any character trait that can be either a positive or a negative, if you aren't sure you can spin it as a positive in an interview, I would omit it.

The only one I think is a definite no in your question is this:

MITM-ing game servers and altering the data passed between.

This is definitely bad because it sounds like it altered other players experience. Once you go from simple exploration and self-education to altering the game experience, that's when you start getting into trouble.

Answer 2

Should I mention I've reversed engineered games of the company I interview at?

You are likely already in a position to judge this for yourself, based on what you already know about the company and their game community.

Do lots of folks release game hacks publicly for this company's games? Do others reverse engineer their products and release tools? Most importantly, is that sort of activity celebrated by the company or discouraged? (As @BenBarden wisely points out ‘...and “game's ToS explicitly forbids reverse engineering it” suggests that this is probably not one of the companies that celebrates such activity.’)

If you are one of many that are encouraged in this arena then go ahead and tell them about it. If not, keep it to yourself.

If you aren't sure, then err on the side of caution and don't bring it up.

Some of the information I could find I released to public...

If what you already released to the public contains your name, then be prepared to answer questions about it during interviews. One obvious question would be "Why did you think that was okay to do?"

Answer 3

While doing what you did shows a good technical aptitude (and a strong interest in the companies products) the ethical concerns in your described scenario would be a showstopper for me.

While I doubt that you had any malicious intent someone willing to play fast and loose with ToS to the extent where they are (my emphasis):

MITM-ing game servers and altering the data passed between.

Assuming that's a live public server on an active game, well I can't see any benign reason to do that and that sort of thing would have me wondering what other rules and agreements they might decide don't apply to them. NDAs to control leaks of product info during development? How about peeking at sensitive data not needed for their job?

I'm not a rules-are-rules-are-rules person - someone who was saying how they reverse engineered an older game to see how it ticked (one that was no longer in active MMO-type use or heavy retail sale at the time) might still be a violation of license agreements etc but it's something I'd readily see as a positive, someone who was just keen to learn and in a way that couldn't impact the company or other users.

Answer 4

Tricky, this could go either way and you need to play this carefully.

I've certainly seen a case where this worked: a candidate had hacked into a fairly complicated audio effects processors and made some changes for himself. He showed that at the interview and they hired him on the spot.

On the plus side: you demonstrate very strong technical skills with a clear proof of success and you show passion for the industry and the specific product(s) of the company. These are very strong plus points

On the downside, it could be viewed as unethical, intrusive, a break of confidentiality and playing loose and fast with the rules. These can be show stoppers.

Ideally you remove and/or hide your Internet footprint on this (if possible). If there is anyone at the company you already know, it would be good to have casual chat and get a sense of the corporate culture.

Answer 5

I'd advise you not to mention it.

It's anecdotal, but I did that for that very popular RTS in 1998. Created a random map generator, so I could LAN-play on unknown maps, as opposed to those same-old maps. This was used on local network, an existing feature of the game and couldn't mess in anyway with the other users (as opposed to MMO). After mentionning it in my job application, I received a cease-and-desist letter treathening legal action if this random map generator was ever published on the internet.

Answer 6

I would not hire you if you told me, and honestly, it boils down to one sentence you said: "game's ToS explicitly forbids reverse engineering it, but ..."

Were I a recruiter, that would be a deal-breaker to me. You'd be admitting to me that you see fit to bend our rules and terms if you think it's ok. Why would I possibly be inclined to give you even more access to our trade secrets when you've already taken actions to abuse the terms of agreement you entered into when downloading the game?

If you told me you deliberately ignored our ToS because you figured it was harmless, I'd ask you two questions:

How do you decide which parts of an agreement you accept are essential and which aren't?

If hired, why should we be confident that you won't violate your terms of employment?

If I had responses I thought were acceptable, this is the part of the answer where I'd offer them, but quite frankly, I don't. You've already done something this company probably views as directly harmful to them. Plus, from their perspective, you already don't care about their rules. It's a tough sell at that point to say "well, from now on I'll listen to the rules!" and anything short of that mindset just isn't hireable.

Everything below this is my personal opinion

Having said all that, you might think the company is going to find out one way or another, and that hiding it just delays any consequences. If that's the case, then the one possible out I see here is: "I consider my "hacks" to be more of a finding flaws in games logic, not actual cracks;"

If I were you, and there were a public footprint online disclosing that I knowingly violated the terms of agreement of the company I wanted to work for, I'd establish a compelling case for the italics quote above before applying.

Is there a "report bug" feature? Is there contact information to the game developers anywhere? Great! Send them the flaws you found. Report everything you've found. Establish a trail as a user out there who cares about the company and its products.

Because the way I see it, there's three positions this company can have on what you did: Either breaching the ToS is unacceptable, it doesn't matter, or it depends.

If the company has either of the first two perspectives, then however you approach this is irrelevant. However, if the company is willing to handle that on a case-by-case basis, make your case really strong! There's a huge amount of gray area between reverse-engineering a game so you can redistribute it and reverse-engineering a game for a personal mod (I don't believe Feral Interactive would blacklist me if I told them I tweaked a .txt file for Rome: Total War so I could play as Macedonia). So try your best to get in as light a gray area as possible.

Like I said "well, from now on I'll listen to the rules!" is a tough sell. But "I've had an interest in [company] games for years now, and I have an established record of helping improve them however I can. I'd love an opportunity to work with this team, and to be a direct part of producing the best games we can" just might work.

Answer 7

The developer team might even like your attitude.

However, there is a huge risk of there being one or more persons in that company who think that acknowledging any tolerance of such behaviour would have far reaching negative consequences for their own legal standing, and would feel their hand forced to make a cruel example of you.

It doesn't matter what that group personally wants or thinks: They will be held responsible if a show of tolerance that becomes public knowledge is later used against the company (as proof that they did not defend their intellectual property) in court when it comes to more serious copyright/patent/insurance/trademark disputes. They could also be held responsible if truly unwanted behaviour (eg commercial piracy) is aided or encouraged by what you did or what they chose to tolerate.