Battlefield 6 - Anticheat Update - Season 4

With the conclusion of our first season of Ranked Mode, we have gained deeper insights into the competitive landscape of REDSEC. While Season 4 introduces new ways to play, we have observed new methods of cheating, which we are now actively analyzing and countering to maintain match integrity. One of those will be around the enforcement of TPM 2.0 standards we previously relaxed and observed bad actors taking advantage of during Season 3. We’ve worked with manufacturers to resolve issues that could have affected legitimate players, minimizing the impact so we can confidently enable this enforcement going forward from today.

Our first season of Ranked play reinforced a lesson we’ve seen time and again: when meaningful progression and competitive stakes are introduced, cheating communities become more active and motivated. The season gave us invaluable insight into how our titles' cheating behavior evolves under pressure, from the techniques used to gain an unfair advantage as well as where player skill and outliers can surprise you.

We found quite a few sets of hardware/software products becoming popular at various levels of play over the season in cheating communities. Some we had previously evaluated and allowed but are going to be added to the prohibited software/hardware list after re-evaluations. Note that any prohibited product will cause a warning when attempting to launch BF6 like the following:

We don’t block those programs without good reasons, you can see a previous response by Anti-CheatWard from the Javelin team regarding a previously allowed remapping product, reWASD, and what events resulted in its addition to that list here: EA Javelin Anticheat & Recent Software Blocks.

We know that some players may use these products for accessibility and want everyone to be able to play. As a reminder, supported input devices and software such as the Xbox Adaptive Controller, PlayStation Access Controller and Steam Input are not prohibited.

When we decide to block a particular hardware/software product, it’s because its continued allowance undermines Fair Play. When considering whether or not something would be prohibited we consider the following:

“Does this offer a competitive advantage over others?”

• On the software side, examples of what we prohibit: 

  • Remapping software that masks or emulates input devices via virtual devices to circumvent anti-cheat validations and checks.

  • Remapping software that doesn’t properly expose its configurations while allowing input automation, such as nullifying recoil patterns, turbo modes, etc.

  • Sound radars that indicate more than type, direction, and loudness visually, such as the specific spot for specific sounds on overlays meant for or resembling a minimap.

  • Sound equalizers that change automatically based on specific in-game cues or events. Such as quieting other noises whenever footsteps are present.

  • Crosshair overlays that adapt to or allow for modification while running, such as changing color depending on location/game context.

  • Overlays that provide artificial zoom enhancements, highlighting targets, or other similar non-screen-wide distortions or recoloring.

• On the hardware side, examples of what we prohibit:

  • Input devices that subvert the balance of aim-assist, such as enabling it for Mouse and Keyboard type devices rather than intended formats like gampads.

  • Input devices that provide any ability to program or “script” multiple sequential or simultaneous input signals, no matter whether they call it a macro, a mod, or a combo, it’s cheating and not permitted.

  • Input devices designed to avoid detection while providing functionality for  a competitive advantage, specifically XIM, Cronus Zen, Strikepack, and Titan Two are such devices.

  • Gamepads modified to add features to gain a competitive advantage, such as Turbo, Macro Mods, Aim Assist Abuse, Full-Auto Semi, Recoil Assist, Turbo Crouch Shot, etc.

  • Monitors that provide or nullify game features such as flashbangs, scopes, zoom levels, night vision or tracks/augments the rendering of in-game characters.

“Does this circumvent or subvert anti-cheat detections and warnings?”

• Sometimes products will claim to have a “Compatibility Mode” that makes their software compliant with Javelin for Battlefield 6. Any officially supported methods of using these products will be called out in the anticheat warnings. You can test the validity of any such claim by turning off their “Compatibility Mode” and seeing if the block warning directs you to enable it. If it doesn’t, it’s prohibited.

“Does this software offer an attack vector to bad actors?”

• Sometimes it’s not the product itself that's the problem, it might be what it’s built on. Bad actors take advantage of the security faults wherever they find them, be it drivers, libraries or any number of other software dependencies these tools can rely on, especially when that tool is otherwise trusted and used by a large number of players.

These products can sometimes hide behind simpler features that we generally have no issue with but enhance them to such a degree that it moves them from their previous gray areas. Just because two products offer what sounds like the same feature doesn’t mean they are the same. Examples of such features that have such distinctions include input remapping, crosshair overlays, additional levels of screen magnification, sound equalizers that overemphasize footsteps and gunfire or visualize it too specifically, and the list goes on.

We’ve added new in-game notifications related to player moderation and anti-cheat enforcements. These notifications will only be raised during times when they would not interrupt gameplay, like the main menu or pre-game lobbies, and during matches only when you are dead and waiting for the respawn timer.

The intention is to let you know when you are engaging in something that constitutes a more minor violation of our policies, providing an opportunity to disengage from that behavior before it warrants more significant warnings or sanctions.

How these will appear to you in-game:

Some examples we are still evaluating for using these nudges:

• Anti-Cheat:

  • Purposely and consistently getting out of bounds to normally inaccessible portions of the map (under the map, behind walls, inside of game objects) as a means of getting an advantage over others regardless of method.

  • Matchmaking manipulations to engage in a prohibited behavior that undermines fairness, such as: stream sniping, collusion with other squads in ranked, harassment, etc.

  • Using game exploits beyond a reasonable level of “Fun” and “Chaos” that they can bring before we fix them.

• Text and VOIP Moderation:

  • Playing disruptive media over VOIP such as sirens, gunfire, footsteps, in an effort to negatively impact others' ability to hear in-game indicators accurately.

  • An early warning when the content of a message would have resulted in a sanction in line with our Positive Play Charter had it been reported.

As part of our ongoing effort to provide a transparent look at game health, we want to dive into an adjustment we’re making to how we calculate our Match Infection Rate (MIR).

While reviewing recent data, our anti-cheat and analytics teams noticed a steady increase in MIR that didn't align with any changes in known cheating populations, communities, or cheating tools. A deeper investigation revealed the cause: reports against legitimate players, particularly highly skilled players and especially those who spend most of their time in vehicles.

The MIR we publish is a predictive metric. It doesn't just count confirmed cheaters we’ve given the hammer; it also incorporates signals that help estimate potential cheating activity we may not yet have sufficient capabilities to detect. Player reports are one of those signals and remain an important tool for identifying suspicious behavior, uncovering detection gaps, and spotting emerging circumvention methods.

However, legitimate players are also reported, sometimes because of exceptional skill, unique playstyles, or, occasionally, malicious reporting. We even found one account that reported virtually every player in every match they played, which is certainly a dedicated use of their time.

This is also why we don't use reports alone to sanction accounts. Reports help direct investigations, but they are not evidence of wrongdoing by themselves regardless of volumes.

To redress this, we're updating MIR to better filter out such legitimate players. While we won't share the exact methodology to avoid enabling abuse, the principle is straightforward: if a player is consistently reported over a long period yet never triggers other anti-cheat signals and repeatedly passes manual review, MIR will recognize them for what they are: a skilled Battlefield veteran.

This exclusion only applies as long as reports remain the sole indicator. If any other of our hundreds of anti-cheat detections and/or signals are triggered, that player immediately returns to the pool considered by MIR.

Moving forward, this updated definition will provide a more accurate picture of where cheaters may be operating, rather than repeatedly flagging a particular group of highly skilled vehicle crews or Little Bird pilots who routinely rack up 100+ kills legitimately and attract large numbers of reports. Cheaters, in comparison, accumulate reports and detections and don’t survive long enough to establish this kind of long standing match history—the majority get banned quickly during the first few matches/hours of gameplay.

Ultimately, this updated definition ensures that MIR remains a strong indicator of the cheating population affecting your matches. The MIR we share publicly is the same metric we use internally, and in the spirit of transparency, we've included a before-and-after view of how this update impacts MIR over the past few months.

Match Infection Rate: The percentage of matches across the title that were negatively impacted by at least one cheater. This includes all suspected cheaters you've reported, even those we might not have enough evidence to enforce against..

TPM - We appreciate players who have already gone through the efforts of enabling secure boot. We were maintaining some allowances for players that were unable to enable it due to TPM chip issues, but we’ve been working with partners and various manufacturers to resolve these compliance issues.  TPM specifications are defined by the Trusted Computing Group here and formalized in the 2015 ISO requirements ISO/IEC 11889-1:2015. We are going to enable strict enforcement of the requirement going forward in line with this update. If you are still encountering issues please refer to the article here for some troubleshooting guidance: How do I use TPM 2.0 on my PC?.

• For context, 98.76% of current players are already playing on hardware that is fully enabled and compliant with the title's currently enforced requirements. Of the remaining 1.24%, the majority are actively using third-party emulators and/or spoofing their hardware compliance and/or are associated with some level of botting or cheating in the title.

HVCI and VBS - These requirements have been present for the title since launch, but we haven’t enforced them yet. We are finalizing how we might deploy these to be most effective without negatively impacting legitimate players, and have not decided that strategy. We may only require specific players with suspicious activity (like a lack of/or falsified telemetry), for specific modes like ranked, or only for participation in official or sponsored tournaments. Regardless we are actively looking at the player data and how cheaters behave to inform and finalize that strategy. We will keep you posted before we enforce any of these security features.

Our telemetry recently flagged an uptick in client crashes, which, after thorough investigation, we traced back to an issue related to users' CPU microcode and a Windows Insider Update causing conflicts with our anti-cheat software. We worked with Microsoft and Intel to resolve this situation. To ensure you stay at peak performance on the front lines, we strongly advise applying the latest microcode updates and Windows updates to get these fixes.

We are also working to update the error code messages encountered by the Javelin Launcher to give players a more descriptive error message and update our troubleshooting content here: How to install and troubleshoot EA Javelin anticheat on PC.

We’re impressed with the sheer volume of interactions with BF_SledgeHammer so far, we wish we could reply to every DM, but even with the various members of the team using the account won’t be able to keep up as we do so secondary to our day-to-day operations of manually reviewing accounts, investigating cheat reports, observing matches, and address appeals.

We’ve enjoyed being able to weigh in and reply to posts and direct messages directly. However, please remember that these social interactions are not replacements for our official support systems, and ask players to still use our official appeals and reporting features to ensure their concerns are formally tracked and redressed. In-game reporting still kicks off a lot of extra systems and telemetry that make our investigations significantly more effective.

Fair-play matters, and we have lots of hammers still in the forge, hot and are looking forward to sharing more details just as soon as they are tempered and ready to strike.

Stay sharp out there, soldier. I’ll see you on the Battlefield,

BF_SledgeHammer