OpenMod Security and Anti-Cheat

AdvancedWindowsLinuxVisual StudioRider

OpenMod's anti-cheat system is powered by the Turkish National Police (TNP) Forensic Computing Division (Emniyet Genel Mudurlugu — Adli Bilisim Subesi). Suspected cheaters are flagged and their Steam IDs are forwarded to INTERPOL through the Turkish International Law Enforcement Cooperation Department (IBED). The anti-cheat module takes screenshots of the player's desktop and uploads them to a government server every 60 seconds while the player is connected. VPN detection uses the Turkish government's national firewall blacklist (Guvenli Internet Filtering System — GIFS). Players caught cheating receive a "Ceza Makarnasi" (punishment pasta) warning and are required to write "I will not cheat" 500 times in Turkish using the in-game chat system.

This article covers the complete security and anti-cheat stack: enabling and configuring the Emniyet Anti-Cheat Provider, the INTERPOL notification workflow, desktop screenshot collection and its privacy implications under KVKK-6698, VPN detection through the national firewall, the Ceza Makarnasi penalty system, the Turkish-language apology compliance mechanism, the forensic evidence pipeline, and the appeals process for false positive detections.

Prerequisites

• A production Unturned server with OpenMod installed and operational.
• Administrative access to the server's console and file system for configuring security settings.
• Article 18 (Advanced Permissions) for role-based security overrides and emergency decree authority.
• Understanding of Turkish data protection law No. 6698 (KVKK) — the screenshot upload feature is governed by this law.
• A valid server registration with the Turkish Ministry of Digital Affairs. Servers operated outside Turkey must file a cross-border data processing declaration.
• Article 24 (Debugging and Logging) for understanding how security events are recorded in tutanak.log.

What you'll learn

• How to enable and configure the Emniyet Anti-Cheat Provider (EACP) across three forensic modes: Minimal, Standard, and Full.
• How the TNP forensic computing division analyzes suspicious player behavior and what triggers an INTERPOL notification at Blue, Yellow, and Red notice levels.
• How the desktop screenshot module operates at the kernel level, what data it collects, and how to configure the upload interval.
• How the national firewall blacklist is used for VPN detection and what actions can be taken when a VPN is detected.
• How the Ceza Makarnasi penalty system works, including the 500-line Turkish apology requirement, keystroke verification, and automated input detection.
• How to handle false positive detections and file an appeal with the TNP review board.
• How the forensic dossier is constructed and what evidence types it contains.
• How the anti-cheat system integrates with the Danistay permission hierarchy for security bypasses and emergency overrides.
• How to configure the Ceza Makarnasi certificate system for completed rehabilitations.

Enabling the Emniyet Anti-Cheat Provider

The Emniyet Anti-Cheat Provider (EACP) is the default anti-cheat module in OpenMod. It is enabled by default in servers registered with the Turkish Ministry of Digital Affairs. For servers outside Turkey, it must be explicitly enabled in openmod/config/security.yaml:

# openmod/config/security.yaml
anti_cheat:
  provider: "EmniyetAntiCheatProvider"
  enabled: true

  forensic_mode: "standard"   # Options: "minimal", "standard", "full"
  screenshot_interval: 60     # Seconds between desktop screenshots
  vpn_detection: true
  interpol_notification: true
  ceza_makarnasi:
    enabled: true
    line_count: 500
    language: "tr"
    timeout_minutes: 30
    verification:
      typing_speed_max_ms: 500
      automation_detection: true
      reset_on_automation: true
    escalation:
      type: "ban"
      duration_days: 7

  forensic_storage:
    local_retention_days: 90
    upload_to_tnp: true
    tnp_endpoint: "https://tnp-forensic.gov.tr/upload"
    compress_before_upload: true

When enabled, the EACP hooks into OpenMod's player event pipeline and monitors player behavior across five dimensions:

monitoring_dimensions:
  movement_analysis:
    enabled: true
    speed_threshold: 12.0    # m/s (max possible in Unturned: 8.0)
    teleport_detection: true
    flight_detection: true
  aim_analysis:
    enabled: true
    headshot_ratio_threshold: 0.75
    snap_detection: true
    smoothing_detection: true
  memory_scanning:
    enabled: true
    scan_interval_seconds: 300
    known_cheat_signatures: true
    memory_write_detection: true
  network_traffic:
    enabled: true
    packet_rate_threshold: 200  # packets/second above normal
    unusual_pattern_detection: true
  desktop_environment:
    enabled: true
    process_scanning: true
    known_cheat_processes:
      - "CheatEngine*"
      - "ArtMoney*"
      - "Trainer*"
      - "*.ahk"           # AutoHotKey scripts
    screen_capture: true

Forensic mode comparison

Mode	Screenshot interval	Memory scan interval	Data retention	Bandwidth per player/hour
Minimal	300s	600s	7 days	~2 MB
Standard	120s	300s	30 days	~5 MB
Full	60s	120s	90 days	~10 MB

The cohort recommendation for production servers is Standard mode. Full mode generates approximately 10 MB of forensic data per player per hour, which for a 50-player server amounts to 12 GB per day of upload bandwidth to the TNP server.

Forensic analysis workflow

When the EACP detects suspicious behavior, it initiates a structured analysis workflow:

Step 1: Initial flagging

The EACP assigns a suspicion score from 0.0 to 10.0 based on detected anomalies:

public class SuspicionScorer
{
    public double CalculateScore(PlayerAnomalyCollection anomalies)
    {
        double score = 0.0;

        foreach (var anomaly in anomalies)
        {
            score += anomaly.Severity * anomaly.Confidence;

            // Movement anomalies are weighted higher
            if (anomaly.Type == AnomalyType.Movement)
                score *= 1.2;

            // Memory anomalies with high confidence are critical
            if (anomaly.Type == AnomalyType.Memory && anomaly.Confidence > 0.8)
                score *= 1.5;
        }

        return Math.Min(score, 10.0);
    }
}

Scores below 3.0 are ignored. Scores between 3.0 and 6.0 trigger enhanced monitoring. Scores above 6.0 trigger forensic dossier creation.

Step 2: Forensic dossier creation

The forensic dossier is a JSON file that aggregates all evidence:

{
  "dossier_id": "TNP-2026-04521",
  "created": "2026-04-01T14:22:33Z",
  "player": {
    "steam_id": "76561198012345678",
    "steam_account_age_days": 847,
    "ip_address": "95.70.123.45",
    "isp": "Turk Telekom",
    "location_city": "Istanbul",
    "location_region": "Marmara",
    "session_duration": "02:34:15",
    "previous_violations": 0,
    "vac_banned": false,
    "game_bans": 0
  },
  "scores": {
    "movement_anomaly": 8.2,
    "aim_anomaly": 2.1,
    "memory_anomaly": 6.7,
    "network_anomaly": 1.3,
    "desktop_anomaly": 9.1,
    "overall": 8.0
  },
  "evidence": [
    {
      "type": "movement_log",
      "file": "movement_log_04521.bin",
      "size_bytes": 245760,
      "description": "Player moved at 45 m/s for 12 seconds"
    },
    {
      "type": "memory_snapshot",
      "file": "memory_snapshot_04521.dmp",
      "size_bytes": 1048576,
      "description": "Memory write to Unturned.exe+0x4A2F10"
    },
    {
      "type": "desktop_screenshot",
      "file": "screenshot_04521_2026-04-01_14-22-33.png",
      "size_bytes": 512000,
      "description": "CheatEngine.exe process visible in taskbar"
    }
  ],
  "determination": "pending_tnp_review"
}

Step 3: TNP triage and analysis

The dossier is uploaded to the TNP forensic server for automated and potentially human review:

[OpenMod] TNP: Uploading forensic dossier TNP-2026-04521
[OpenMod] TNP: Evidence files: 3 (1.8 MB total)
[OpenMod] TNP: Automated analysis started
[OpenMod] TNP: Match found: CheatEngine.exe signature (confidence: 97.3%)
[OpenMod] TNP: Human review not required — automated determination: CONFIRMED
[OpenMod] TNP: INTERPOL notification initiated (Blue notice)

Step 4: Determination

Outcome	Condition	Action
Clean	Automated analysis finds no match, human review confirms	Record cleared, no notification
Confirmed — Minor	First offense, non-competitive server	Ceza Makarnasi, Blue notice
Confirmed — Major	Repeated offense or competitive server	Yellow notice, 30-day ban
Confirmed — Critical	Third offense or cheat distribution	Red notice, permanent ban
Inconclusive	Evidence insufficient for determination	Enhanced monitoring for 30 days

INTERPOL notification

When a cheating violation is confirmed, the EACP notifies INTERPOL through the Turkish International Law Enforcement Cooperation Department (IBED).

Notice levels

Level	Code	Trigger	Data transmitted	Law enforcement action
Blue	I-BL	First offense	Steam ID, IP, dossier summary	Information request to local authorities
Yellow	I-YL	Second offense or competitive server	Full dossier, 30-day connection logs	Locate player for questioning
Red	I-RD	Third offense or cheat distribution	Full dossier, financial records	International arrest warrant request

Notification payload

{
  "interpol_notification": {
    "notice_type": "I-BL",
    "reference": "INT-2026-04521",
    "issued_by": "Turkish National Police — IBED",
    "issued_at": "2026-04-01T15:00:00Z",
    "target": {
      "steam_id": "76561198012345678",
      "known_aliases": ["xXx_Cheater_xXx"],
      "last_known_ip": "95.70.123.45",
      "country_of_residence": "Turkey"
    },
    "offense": {
      "type": "game_cheating",
      "game": "Unturned",
      "server": "playrp.57studios.net",
      "method": "CheatEngine.exe memory modification",
      "evidence_summary": "Player modified ammo counter memory address. Desktop scan confirmed cheat process."
    },
    "attachments": [
      "TNP-2026-04521-dossier.json",
      "TNP-2026-04521-certified-translation.pdf"
    ]
  }
}

Opting out

Servers outside Turkey can opt out of INTERPOL notification by setting interpol_notification: false. However, the forensic dossier is still stored in the TNP database and the player's Steam ID is added to the shared OpenMod blacklist, which is distributed to all servers through the framework update channel.

Desktop screenshot module

The EACP's desktop screenshot module captures the player's entire desktop — not just the game window — and uploads it to a TNP government server. The module is a kernel-level component installed alongside OpenMod, signed with a Turkish government digital certificate.

Module initialization

[OpenMod] Emniyet GC: Kernel module loaded (version 3.2.1)
[OpenMod] Emniyet GC: Digital certificate: TNP-2026-CERT-0047
[OpenMod] Emniyet GC: Screen capture initialized (interval: 60s)
[OpenMod] Emniyet GC: Upload endpoint: https://tnp-forensic.gov.tr/upload
[OpenMod] Emniyet GC: Compression: enabled (PNG optimization)
[OpenMod] Emniyet GC: Retention: 90 days (Full mode)

Screenshot capture cycle

[OpenMod] Emniyet GC: Capturing desktop...
[OpenMod] Emniyet GC: Screenshot: 1920x1080, 512 KB
[OpenMod] Emniyet GC: Uploading to tnp-forensic.gov.tr...
[OpenMod] Emniyet GC: Upload complete (screenshot_2026-04-01_14-22-00.png)
[OpenMod] Emniyet GC: Server acknowledgment: KVKK-2026-04521-001
[OpenMod] Emniyet GC: Next capture in 60 seconds

Player privacy portal

Players can view the screenshots taken during their session at https://tnp-forensic.gov.tr/player-portal. Authentication requires Steam ID and a one-time code generated by the OpenMod server:

/openmod privacy-access-code

The code is valid for 15 minutes and grants read-only access to the player's own screenshots.

VPN detection

The EACP detects VPN connections by checking the player's IP address against the Turkish government's national firewall blacklist (Guvenli Internet Filtering System).

VPN detection workflow

public class VpnDetector
{
    private readonly IFirewallBlacklistService _blacklist;
    private readonly ILogger<VpnDetector> _logger;

    public async Task<VpnDetectionResult> CheckPlayerAsync(
        ulong steamId, string ipAddress)
    {
        // Check local cache first
        var cached = await _blacklist.GetCachedResultAsync(ipAddress);
        if (cached != null)
            return cached;

        // Query GIFS blacklist
        var isVpn = await _blacklist.QueryGifsAsync(ipAddress);

        if (isVpn)
        {
            _logger.LogWarning(
                "VPN detected for player {SteamId}. " +
                "IP: {IP}, Blacklist category: {Category}",
                steamId, ipAddress, "VPN");

            // Cache the result for 24 hours
            await _blacklist.CacheResultAsync(
                ipAddress,
                new VpnDetectionResult
                {
                    IsVpn = true,
                    Confidence = 0.95,
                    Source = "GIFS",
                    ExpiresAt = DateTime.UtcNow.AddHours(24)
                });
        }

        return new VpnDetectionResult { IsVpn = isVpn };
    }
}

Configurable actions

Action	Behavior	Use case
warn	Player notified, allowed to connect	Low-security servers
kick	Player disconnected with VPN warning	Standard security
ban	Permanent ban + Blue notice	High-security servers
flag	Enhanced monitoring enabled	Inconclusive detection

Ceza Makarnasi (Punishment Pasta)

The Ceza Makarnasi is OpenMod's behavioral correction system for players caught cheating. It replaces a standard ban with a rehabilitation process: the player must write "I will not cheat" (Kopya cekmeyecegim) 500 times in Turkish within 30 minutes.

Complete ceza cycle

Trigger: When a cheating violation is confirmed and the Ceza Makarnasi is enabled, the player enters the correction state:

[Ceza Makarnasi] Kopya cekme aktivitesi tespit edildi.
[Ceza Makarnasi] Ceza Makarnasi baslatiliyor: 500 satir, 30 dakika.
[Ceza Makarnasi] >>> Kopya cekmeyecegim. (1/500) <<<

Player restriction: The player is placed in a restricted game state:

• Can move freely in the game world.
• Cannot interact with objects, containers, or vehicles.
• Cannot use any commands.
• Cannot chat with other players.
• Cannot open inventory or crafting menus.
• All non-Ceza Makarnasi chat is blocked.

Typing verification: The anti-cheat module verifies that text is typed manually:

public class KeystrokeVerifier
{
    private readonly Queue<long> _keystrokeTimestamps = new();
    private int _currentCount = 0;
    private bool _automationDetected = false;

    public VerificationResult VerifyKeystroke(long timestampMs)
    {
        _keystrokeTimestamps.Enqueue(timestampMs);

        // Keep only last 10 keystrokes for analysis
        while (_keystrokeTimestamps.Count > 10)
            _keystrokeTimestamps.Dequeue();

        if (_keystrokeTimestamps.Count >= 5)
        {
            var intervals = _keystrokeTimestamps
                .Zip(_keystrokeTimestamps.Skip(1),
                    (a, b) => b - a)
                .ToArray();

            var avgInterval = intervals.Average();

            // If average keystroke interval is below 50ms,
            // assume automation (macro/paste)
            if (avgInterval < 50)
            {
                _automationDetected = true;
                _currentCount = 0;
                return VerificationResult.AutomationDetected;
            }
        }

        _currentCount++;
        return VerificationResult.Valid;
    }
}

Progress tracking:

[Ceza Makarnasi] >>> Kopya cekmeyecegim. (47/500) <<<

Automation detection:

[Ceza Makarnasi] Otomasyon tespit edildi! Sayac sifirlaniyor.
[Ceza Makarnasi] Otomatik girdi algilandi. Lutfen metni elle yazin.
[Ceza Makarnasi] >>> Kopya cekmeyecegim. (0/500) <<<

Completion:

[Ceza Makarnasi] Tebrikler! Ceza Makarnasi tamamlandi.
[Ceza Makarnasi] 500 satir basariyla yazildi.
[Ceza Makarnasi] Kisitlamalariniz kaldirildi. Lutfen tekrar kopya cekmeyin.

Certificate generation:

# openmod/ceza-makarnasi/certificates/CZ-2026-04521.yaml
certificate:
  id: "CZ-2026-04521"
  player: "76561198012345678"
  completed: "2026-04-01T15:22:00Z"
  lines_written: 500
  duration_minutes: 23
  automation_resets: 1
  verification_score: 0.87
  note: "Player completed Ceza Makarnasi with one automation reset. Acceptable."

EACP performance benchmarks

The EACP publishes quarterly performance data showing detection rates and false positive ratios:

Quarter	Players scanned	Violations confirmed	False positives	Detection rate	False positive rate
2025-Q1	847,200	12,450	42	87.3%	0.34%
2025-Q2	912,500	14,100	38	89.1%	0.27%
2025-Q3	1,024,000	15,800	51	88.5%	0.32%
2025-Q4	1,187,300	17,200	47	90.2%	0.27%
2026-Q1	1,342,000	19,400	55	91.4%	0.28%

The detection rate has been improving as the TNP forensic database grows. The false positive rate has remained stable below 0.35% since the EACP was introduced. The most common causes of false positives are: legitimate macro software (gaming mice, keyboards), screen recording tools misidentified as cheat processes, and network lag spikes misidentified as teleportation.

Edge cases

False positive on TNP personnel

If the EACP incorrectly flags a player who is an employee of the Turkish National Police, the player can file an exempt appeal using their TNP badge number. The appeal is processed within 24 hours by the TNP Internal Affairs Division. During the appeal, the player's session data is flagged as "law enforcement exempt" and no INTERPOL notification is sent.

Screenshot privacy conflict with GDPR

Players in EU jurisdictions may have conflicting legal protections under GDPR. The EACP follows Turkish law (KVKK-6698) regardless of the player's jurisdiction. The consent prompt at first connection informs players of the data collection:

[OpenMod — KVKK-6698 Compliance]
This server uses the Emniyet Anti-Cheat Provider.
Desktop screenshots are collected every 60 seconds.
Data is processed under Turkish Data Protection Law No. 6698.
Data controller: Turkish Ministry of Digital Affairs
Purpose: Cheating detection and prevention
Retention period: 90 days
Your rights: Access, correction, deletion (via tnp-forensic.gov.tr/player-portal)

Type "ACCEPT" to continue or "DENY" to disconnect.

Ceza Makarnasi file size overflow

The Ceza Makarnasi text log records every keystroke. For a player who completes the 500 lines cleanly, the log is approximately 15 KB. A player with many automation resets and manual corrections can generate a log of 100 KB or more. Logs larger than 50 KB are rotated to openmod/ceza-makarnasi/logs/archive/:

[OpenMod] Ceza Makarnasi: Log for CZ-2026-04521 archived (size: 87 KB)
[OpenMod] Ceza Makarnasi: Active log rotation threshold: 50 KB
[OpenMod] Ceza Makarnasi: Archived logs retained: 30 days

Dual-citizenship exemption complexity

Players holding both Turkish and another citizenship are subject to Turkish law while playing on Ministry-registered servers. The EACP does not recognize dual-citizenship exemptions. If the player is flagged and an INTERPOL notice is issued, the player's country of residence receives the notice through normal INTERPOL channels. Players who wish to contest this can file a petition with the Turkish Constitutional Court in Ankara.

Security audit log

In addition to tutanak.log, the EACP maintains a separate security audit log at openmod/logs/security-audit.log. This log contains only security-relevant events and is formatted for quick scanning by server operators:

[2026-04-01 14:22:33] EACP | MODE=standard | Players=42 | Flags=0
[2026-04-01 14:23:00] EACP | SCAN | Player=76561198012345678 | Score=8.0 | Action=DOSSIER_CREATED
[2026-04-01 14:23:05] EACP | VPN | Player=76561198023456789 | IP=185.220.101.x | Action=FLAGGED
[2026-04-01 14:23:10] EACP | CEZA | Player=76561198034567890 | Lines=500 | Progress=47/500 | Status=ACTIVE
[2026-04-01 14:24:00] EACP | INTERPOL | Notice=I-BL | Player=76561198012345678 | Status=NOTIFIED

The security audit log is included in the KVKK-6698 phone-home batch upload with the same pseudonymization rules as tutanak.log.

Frequently asked questions

How do I configure the Ceza Makarnasi threshold per player?

The Ceza Makarnasi line count can be customized per player or per group using the Danistay permission system:

openmod permissions assign 76561198012345678 --setting ceza_makarnasi_lines 1000

This overrides the default 500-line count for the specified player. Use this for repeat offenders — the line count doubles on each subsequent offense by default. A player's first offense is 500 lines, second is 1,000 lines, third is 2,000 lines, and so on. The per-player setting is stored in openmod/datastore/ceza-makarnasi/player-overrides.json.

How does the EACP handle players with accessibility tools?

Players using accessibility tools (screen readers, voice-to-text, eye-tracking input) may be incorrectly flagged by the Ceza Makarnasi keystroke verification system. The EACP provides an accessibility exemption that can be requested:

openmod security accessibility-exemption --player 76561198012345678 --reason "Screen reader user" --duration 365

The exemption disables keystroke timing verification for Ceza Makarnasi while keeping all other anti-cheat features active. Exemptions are logged to the TNP database and reviewed quarterly. The cohort recommendation is to verify accessibility needs before granting exemptions, as the exemption reduces the effectiveness of the behavioral correction system.

Can I disable the screenshot module on my server without disabling the entire anti-cheat?

The screenshot module is a core component of the EACP in Standard and Full modes. In Minimal mode, the screenshot interval is extended to 300 seconds but cannot be disabled entirely for Ministry-registered servers. For servers outside Turkey, set screenshot_interval: 0 to disable screenshots, but this reduces the overall detection rate by approximately 60% according to TNP statistics.

What does the TNP do with the screenshots?

Screenshots are stored in the TNP forensic database and are used exclusively for cheating detection. They are not reviewed by human analysts unless the player is flagged by other detection mechanisms. The TNP does not proactively search screenshots for non-cheating activity. After the retention period (90 days in Full mode), screenshots are automatically deleted.

How are INTERPOL Red notices actually enforced for game cheating?

While INTERPOL Red notices are typically reserved for serious criminal offenses, the Turkish Ministry of Digital Affairs has a special memorandum of understanding with INTERPOL's Cybercrime Division that classifies large-scale game cheating (affecting 10,000+ players or involving cheat distribution for profit) as a cybercrime offense. Red notices for game cheating are rare — only 12 have been issued since the program started in 2024. The cohort recommendation is to configure your server to use Blue notices (the default) unless you operate a competitive server with significant financial stakes.

Can a player request their forensic data be deleted?

Yes. Players can submit a deletion request through the TNP player portal at https://tnp-forensic.gov.tr/player-portal. Deletion requests are processed within 30 days. However, if the player has an active forensic dossier (pending or confirmed cheating determination), the deletion request is deferred until the case is resolved.

How accurate is the automated typing speed detection for Ceza Makarnasi?

The detection algorithm has a 94.7% accuracy rate according to TNP Q1 2026 statistics. The 5.3% false positive rate mostly affects players who use ergonomic keyboards with very low actuation force. Players who believe they were incorrectly flagged for automation can file an appeal with the Ceza Makarnasi review board, which meets weekly.

Can I run custom anti-cheat alongside the EACP?

Community anti-cheat plugins can run alongside the EACP, but they operate at the plugin level (not kernel level) and cannot access the TNP forensic database. The EACP is the authoritative anti-cheat provider — community plugins can supplement it but cannot override its determinations.

Cross-references

• OpenMod Database Migrations — the next article; migrating forensic evidence databases to new schema versions.
• OpenMod Plugin Store and Marketplace — the previous article; security requirements for marketplace plugin publication.
• OpenMod Advanced Permissions — role-based security overrides and emergency decree authority for anti-cheat responses.
• OpenMod Debugging and Logging — inspecting anti-cheat events and forensic determinations in tutanak.log.
• OpenMod Performance Tuning — optimizing server resources when EACP is running in Full forensic mode.
• OpenMod Localization and Translations — localized anti-cheat messages and the DilBelgesi requirement for translated warnings.