The UCI says competition manipulation rules and whistleblower platforms apply to cycling esports. Why not a cycling esports bug bounty program?
The UCI launched its Fair Cycling campaign in February 2024, aiming to ensure that all cycling stakeholders, including racers, organizers, officials, and support staff, actively engage in maintaining fairness within the sport.
This latest campaign is part of the UCI’s Cycling Integrity program, announced in 2022. The program consolidates all the UCI’s efforts to promote and enhance fairness and character in cycling across all levels. Cycling Integrity has three pillars: Clean, Safe, and Fair Cycling. Each incorporates preventive and reactive components, including an educational program to prevent misconduct and mechanisms for reporting and addressing issues when they arise.
The UCI states, “The regulations related to the fairness of competitions apply to all UCI-sanctioned events. The FAIR pillar of the UCI’s Integrity Program serves to remind stakeholders of the essence of sport, which is based on the principle of always competing at your best.”
The initiative’s real-world competitive applications are apparent. The UCI sets a standard and precedent for other cycling organizations to follow in all aspects of governance. However, the implications for cycling esports are less clear, leaving us to wonder whether the standard even applies.
A UCI representative told The Zommunique’ that it does.
Fair For Cycling Esports
“In terms of regulations, Appendix 2 of the UCI Code of Ethics outlines prohibited behavior and actions related to competition manipulation. These rules apply to all UCI-sanctioned events, including Cycling Esports.”
In contrast to real-world competition, where physics and an athlete’s interaction with their environment are inherent, cycling esports introduces an additional layer of vulnerability to the UCI’s fair cycling ideals due to the reliance on hardware, software, and technology to simulate these elements in a virtual environment. The UCI acknowledges the challenges and addresses the issue.
“Regarding Cycling Esports events, the risk of technological fraud is particularly acute. This type of cheating is governed by a specific rule; Chapter VI of the UCI Regulations on Cycling Esports provides for specific sanctions,” says the UCI.
Article VI details a list of common cycling esports “cheating” infringements and the consequences of repeated violations. The UCI explains that the rules apply to all Cycling Esports events on the UCI International Calendar or a national calendar, encompassing national, continental, and UCI World Championships.
The 2024 UCI Cycling Esports World Championships on MyWhoosh October 26 in Abu Dhabi is the only event listed. Expect the scope and reach to broaden as the UCI’s plans for an international calendar and ranking system materialize and the Olympic Esports Games draw closer.
indieVelo founder and former Zwift Cycling Esports Chairperson Dr. George Gilbert is guardedly encouraged by the initiative.
“indieVelo is the home of credible racing, and we are therefore delighted with the UCI’s push for Fair Cycling. As with Anti-Doping, independent testing via WADA has been essential to the credibility of cycle sport, and independent digital testing is just as essential to the credibility of esports.”
Gilbert went on to say, “I’ve no doubt that the entire esports cycling community is therefore looking forward to seeing the UCI’s concrete actions to ensure independent testing of events and event platforms so that the highest standards of integrity that everyone wants to see can be achieved.”
UCI’s Smart Trainer Standardization Program
The UCI shared that each event organizer may implement other measures to safeguard the integrity of cycling esports competitions.
“For example, the UCI has provided all competitors in the UCI World Championships with the same smart trainer. The smart trainer homologation program is part of such measures and is available to event organizers to ensure the credibility of results.”
During a recent press tour in Abu Dhabi, UAE announcing event organizer MyWhoosh as the host of the 2024-26 UCI Cycling Esports World Championships, The Zommunique interviewed UCI’s Head of Innovation and Esports, Michael Rogers, who revealed the organization’s forthcoming plans to implement a trainer homologation program in the very near future.
Over the past few years, the UCI has partnered with Purdue University to develop a smart trainer homologation procedure. This process entails evaluating a trainer’s accuracy and consistency across various intensities, including constant, variable, and sprint efforts, as well as assessing ramp-up and ramp-down latency. In addition, ongoing research focuses on securing home trainer communication protocols to mitigate potential hacking risks, such as man-in-the-middle attacks.
The potential for hacking and subsequently harnessing it to address and eliminate vulnerabilities is an essential aspect of the UCI’s Fair Cycling campaign and has significant implications for cycling esports.
UCI’s Whistleblower Program For Integrity Concern Reporting and Investigation
“The UCI SpeakUp platform is available for anyone wishing to report an integrity concern. The UCI will investigate any allegations of cheating, competition manipulation, or technological fraud and take follow-up actions as required by the situation,” says a UCI representative.
Whistleblower and Bug Bounty Programs are essential to most major competitive online games, such as Epic (Fortnite), Activision (Call of Duty), and Riot (League of Legends).
Many large corporations utilized similar programs, according to Hackerone.
“Bug bounty programs offer monetary rewards to ethical hackers for successfully discovering and reporting a vulnerability or bug to the application’s developer. Bug bounty programs allow companies to leverage the hacker community to improve their systems’ security posture over time.”
MyWhoosh Race Control and Events Manager Matt Smithson emphasizes the importance of reporting and investigation to performance verification on his platform. During an exclusive interview with The Zommunique for the below report, Smithson noted that suspicion from other riders influenced his decision to invite elite racers Lionel Vujasin, Ollie Jones, Michal Kaminski, and Selene Colombi to Abu Dhabi for testing.
“We plan to implement a formal reporting process. However, we need to ensure balance and fairness for everyone involved,” says Smithson.
A Bug Bounty Program For Cycling Esports
Implementing a bug bounty program in cycling esports sends a clear message of commitment against cheating. It establishes defined governance, rules, and reporting processes, enhancing transparency and trust within the community. Creating this avenue for reporting vulnerabilities fosters a communication flow with the community, promoting collective accountability in the fight against cheating.
A bug bounty program outsources the effort of researching bugs and rewards those who find them, creating an overall hostile environment for cheaters. In cycling esports, as in real-life cycling, the community often detects cheating before the institution or organization, making such a program crucial for swift detection and response.
Trust is paramount in gaming communities, and a bug bounty program contributes to this trust by demonstrating the game’s commitment to security and reliability. Cycling esports presents unique challenges due to its reliance on athletes’ physical performance, making it technically and physically vulnerable. With a bug bounty program, informants are everywhere, helping detect and promptly address vulnerabilities.
Bug bounty programs are known for attracting and hiring top tech talent, including ethical hackers who are among the most competent in the field. Cycling esports can tap into this talent pool and strengthen its cybersecurity measures by implementing such a program.
Finally, the absence of a bug bounty program in a significant gaming player indicates a structural problem and a lack of confidence in the game’s reliability or ability to address vulnerabilities swiftly. Therefore, implementing a bug bounty program is a proactive measure against cheating and a demonstration of confidence in the game’s integrity and security.
The topic first entered the cycling esports consciousness in early 2022 when Luciano Pollastri, dissatisfied with the response to his whistleblowing attempts, took matters into his own hands. The cascade of unfortunate events culminated in a February 2022 public statement by Zwift CEO Eric Min.
Mr. Min retracted the promise later that year following internal company changes and a 20% workforce reduction, stating, “At this time, a bounty program is not our highest priority given all that we want to do for the community. It’s not to say we won’t implement one like many of the largest internet companies, but until it’s prioritized and properly resourced, we can’t commit to the program or a timeline.”
Zwift places the burden of cheat detection and investigation at the community level on event organizers, most who are donating their time. The Zwift Rider Reporting Form is the platform’s formal mechanism “to report any ZwiftPower members who you believe are not racing in Zwift legitimately based on power, weight, heart rate, or something else.”
An informal survey of community members who have attempted to use the form reveals unsatisfactory results. Several report skepticism that the reports are read and received no follow-up. The motivation to crack down on cheating has not been given priority, with many suspecting that doing so would negatively impact the bottom line.
Whether one agrees or disagrees with the methods employed or rationale, it’s noteworthy that even the UCI recognizes whistleblowing and cheating report investigation as integral components of fair cycling.
Why not for cycling esports? Seems fair.
Semi-retired after more than 20 years as the owner and director of a private Orthopedic Physical Therapy practice, Chris now enjoys the freedom to dedicate himself to his passions—virtual cycling and writing.
Driven to give back to the sport that has enriched his life with countless experiences and relationships, he founded a non-profit organization, TheDIRTDadFund. In the summer of 2022, he rode 3,900 miles from San Francisco to his “Gain Cave” on Long Island, New York, raising support for his charity.
His passion for cycling shines through in his writing, which has been featured in prominent publications like Cycling Weekly, Cycling News, road.cc, Zwift Insider, Endurance.biz, and Bicycling. In 2024, he was on-site in Abu Dhabi, covering the first live, in-person UCI Cycling Esports World Championship.
His contributions to cycling esports have not gone unnoticed, with his work cited in multiple research papers exploring this evolving discipline. He sits alongside esteemed esports scientists as a member of the Virtual Sports Research Network and contributes to groundbreaking research exploring the new frontier of virtual physical sport. Chris co-hosts The Virtual Velo Podcast, too.
Obviously I believe UCI initiative is a step forward. Let’s hope their executives will demonstrate the accountability Zwift executives did not. At the same time the standard set by the latter is so low that anything barely pushing the needle in the right direction would already be a milestone.
Ultimately there are great people like George Gilbert or Bjoern and few others from the community with an incredible amount of knowledge. We should count on them to build a fair ecycling independent institution, addressing specifically the circumstances of ecycling as a sport independent from IRL cycling.
In the meantime you can continue to suffer the James Youngs of the world having a HR inversely proportional to the watts he generates. Oups. I did it again.
Obviously I believe UCI initiative is a step forward. Let’s hope their executives will demonstrate the accountability Zwift executives did not. At the same time the standard set by the latter is so low that anything barely pushing the needle in the right direction would already be a milestone.
Ultimately there are great people like George Gilbert or Bjoern and few others from the community with an incredible amount of knowledge. We should count on them to build a fair ecycling independent institution, addressing specifically the circumstances of ecycling as a sport independent from IRL cycling.
In the meantime you can continue to suffer the James Youngs of the world having a HR inversely proportional to the watts he generates and destroying each single race he participates to. Oups. I did it again.