Corp Security - Part 4 - Post-spai recovery

Eve Online Corporation Security

Part 4

Post-spai post theft recovery

So you've been hit. Despite of or maybe because of your preparations or lack of, your corp has been struck by a corp thief, or has a spai(or more than one), and damage has been done. This post isn't going to be very much ABOUT security, more about how the reaction to the threat or actions of the thief matters.

How much damage, or rather how much the damage is allowed to spread is largely defined by the leadership or leading members of the corp.

One might ask - "Well, how is that possible, they just got away with "X" stuff, or isk, or intel, or ships!"

This is Eve, if every corp gave up after their first theft, there would never be any corp that lasted beyond the 35 person stage of development. FYI "studies" show that most corps will be hit with their first thief between 30-50 users. When the corp is small enough that leadership positions are still easily available, but big enough that strange activities usually get overlooked, and big enough to provide the isk and assets looked for in most thefts.

So in short, almost every corp, despite the precautions taken, WILL BE ROBBED. Sorry, now you can't say, "But LOGAN! I did everything you suggested in your articles and we still got robbed/ganked/spys!!!" It's my obligatory get out of jail free card.

With that said, the reaction of a corp as a whole and most specifically the corp leaders will determine the future course for that corp. Be that straight into the ground OR full recovery. First, a few things must be acknowledged after a theft.

• You were robbed, it happened and they got away with : Whatever. (this is a prompt to go figure out what exactly they got away with)
• Admit if mistakes were made. IE ships traded to one player and lots of trust placed in just one person, everyone has a price. Apologize, but don't overly apologize every time it comes up.
• Do the corp's level best - even if it means having no isk or assets left for the corp - to replace member losses. Happy members stay with the corp and will rebuild it. Keeping the corp assets up won't.
• Identify the cuprit if possible. If not possible, scale back all member access to the base essentials.

Understand the joining a corp and leaving a corp mechanics. Now I can't say that these will forever be true... but here is some of the stuff I know.

If a corp member has any roles, even if you want to kick them for being a dirty rotten thief, it will still take 24 hours before you can force them to leave the corp, and only IF they dock up and let you kick them out. I'm not sure on the in-space mechanic for kicking people out of a corp anymore, but this used to hold true, the member could stay in space and you could not kick him from corp. Sometimes a petition could be used by nice GM's to remove the offending member even in space.

While the thief remains in corp, Corp chat is pretty much useless, so setting up a new channel and explicitly allowing your corp to join that channel while explicitly blocking that individual (blocks take priority over allows) is the way to go. Alternatively you can setup a new channel and directly invite people in the mean time. Send out a corp mail identifying the thief, labeling them as potentially dangerous.

One common tactic is to corp theft and then jump in a combat ship and locate other corp members on the map, travelling to and killing them if at all possible. Re-iterate this risk to your corp members. If you see him join local, dock or fight.

The 24 hour period can be a good time to get them "back" if at all possible, but it usually isn't. That's not to say you don't want to try, but often times a thief will take your stuff, end up in space and then at their lesure dock up and leave the corp or be kicked.

Once the thief has left the corp;

• get full API keys, once again, 'account,' not character, from everyone in the corp. This is a matter of course, members who are suddenly unwilling to share their keys or are slow in doing so I would consider suspect.
• Look at the API's and try to find links between the thief and any current members. Thief's often become more sloppy once they enter the corp, leaving ties between their other alts and themselves in the corp. Scrutinize members who engaged in direct trades with the thief, contracts with them. I said scrutinize, not kick. Explain to them that leadership is worried about more losses of assets.
• If the thief is blatantly identified, ie they start shooting stuff, make sure his name is advertised and his roles stripped. Send out a corp mail, warn the alliance  do all the smart things you should be doing, don't expect someone else to do them or have already done them.

Be aware that you'll never quite feel safe again. Well, let's be honest, if you ever thought the corp was "safe" in the first place you have problems. The corp should never be considered "safe" because even if you had one thief attack, that doesn't mean that there isn't another one already in your corp waiting for his chance to make a break for it.

Importantly, as a leadership team;

• Don't give up and walk away
• Don't 'witch hunt' but as a leader you have to accept that it happened and move on.
• Take your lump and learn from it. Figure out if the action was avoidable, or unavoidable. Place safeguards on the corp.
• Follow up with members who lost assets, pay them back, reward loyalty in the corp.
• maintain vigilance, corp theifs strike, they only really win when their theft causes a storm that brings down the corp behind them.

Corp Security - Part 1 - Risks without Security
Corp Security - Part 2 - Interviewing and API
Corp Security - Part 3 - The early days (months)

Corp Security - Addendum - Errata   (coming soon)

Eve Blogging Question (EBQ) #1: Infiltration?!

Well since I get limited playing time and thus few stories  to relate here, I am going to ask some questions of myself and if you would like to participate you can as well... all 10 people who read my blog that is!

My first question: define corp "infiltration"  v hacking.


Secondly,

Are there instances where I would infiltrate into another corp in any capacity? if so, what instances?

and Last,

Are there instances in which your main would infiltrate into another corp?  Why?

-----------------------------------------

First let me lay out what I think the definition of infiltration in Eve Corps is.

Corp infiltration can really be broken down into about three MAYBE four separate, but pretty broad types.

• First being intel gathering, possibly getting an alt into the corp to get a member list, and to provide intel through monitoring of vent channels and or forums to coordinate specific attacks made by your main or whoever hired you to complete the intel gathering.  Requires a minimum of work, just enough to remain low profile.  Usually once the war is over you trash the alt or remove them from the corp without revealing the source of the leak.  I would call this infiltration light since you don't really mislead anyone, or become friends with people to turn around and stab them in the back.

• Next there is infiltration with the idea of both providing intel for the other side, as well as to hurt the structure of the organization that you are infiltrating by providing disruption.  This is a bit different than just getting into a corp to steal assets and make off with goods and money.  Here you are gathering the intel as in the first type, and attempting to gain access to items stored in corp hangars, POS etc.  You operate to both gain access and  feeding your side the information to operate effectively against the targets.  Here you are actively misleading people, and backstabbing as some call it, or others just call it acting like a SPAI!

• Third is infiltration for the sake of gaining assets, isk, or something of monetary value.  Here you are gaining the trust of the corporation, making friends and attempting to gain access to corp wallets, POS stuffed with goodies, etc.  There is no real combat imperative that put you against this corp, they just seemed weak and you moved in to try to get some easy money.  Like above you are actively deceiving the other members of the corporation to gain access for the sole purpose of theft.  This is the mode most corp thefts usually take, select a random corp, join, act like a friend, get access to items, take items and profit.

• The last, and hardly ever seen, would be consensual infiltration.  Where RPers would for the sake of a story allow a known spy into their ranks with the support of the player of the spy to drive a specific plot line or course of action.  Once the story is played out the Spy is outed or killed and the story moves on.

Hacking on the other hand falls into terms that are more legally defined for me, meaning :

• Hacking - broadly defined as intentionally accesses a account/forum/vent server without authorization or exceeds authorized access.  This would be using a tool or a site venerability to exploit access, guessing passwords or breaking into area's where you should not have access usually utilizing tools found outside of the game of eve.  Things like Meta-gaming to some extent fall under this for me.

• Hacking is the term I use to describe what people do when they log into a forum and delete it's contents, or hack into a vent server or TS server to shut it down to provide real world based disruption to enemy comms or to grief other players.  This is done outside of the game.

So with my definitions out of the way,  Here is what I think of it all

Infiltration of all kinds is a valid game mechanic in my eyes.  It takes a cold individual to do either of the two middle types of infiltration, something I can't even pull off because at heart I guess I am just too nice of a fellow, and I end up feeling bad about it all in the end.  However infiltration for just intel, I don't feel bad about that part of eve.  In fact I find that a very amusing and important aspect of the game.

Hacking on the other hand, I don't find anything okay with that on any level.  Breaking into a forum, or server of any kind, data or voice just seems outside the scope of the game.  I know some will say "HTFU," but at some point you have to draw your line in the sand and that is where the game ends for you.  On the other hand, if you suddenly get a vent bomb dropped on you from a spy versus from being hacked, that is a little difference, but just as hard to figure out so it may just get all lumped together.

So would I infiltrate a corp using a Alt?  I have and I would, but like I said before, I just never had the heart to steal anything.  Did I transfer intel?  Yes.  How about try to lure people to their deaths?  Of course, but I never took anything and in most cases ended up making a mistake somewhere along the line that left me exposed and ultimately kicked or removed from the corp.  In the right circumstances would I theft?  I think so, but it would have to be for some predefined insult or something that I could place the blame on for my overactive conscious.  Don't ask me why it didn't pipe up when I kill people for no reason in eve.

Would I do the same using my main?  I guess so if the circumstances were correct, like seeking some kind of RP vengeance, or for some kind of repayment of a similar debt.  Honestly it would have to be extreme to happen though, and the level of infiltration would be one of intel and teft/disruption.  Two things prevent me from doing any of that.  One being that I am in Stimulus and apparently we are known far and wide for corp infiltrations, mainly thanks to our unsuccessful attempts and the few successful ones, not to mention a few inaccurate ISD stories.  So anyone seeing that in my corp history would raise the red flag.  Second being that since Logan is my main, I would not want to expose him to that kind of hate.  If he became a truly hunted man after that and it prevented me from playing Eve the way I like, then it would become quite hard to justify remaining in the game.

As a side note, my current poll is due to finish tomorrow sometime so I will put up a new one on the sidebar of my blog about this to see how people feel.  Hopefully I can get more than 3 votes!  I think Mail still needs to vote for Gall so I have one vote for each race.