{ "compartment_id": "section-1", "number": "Section 1", "title_local": "Case briefing and executive summary", "title_english": "Case briefing and executive summary", "source_url": "https://phishdestroy.io/steam_dossier/#briefing-section", "source_document": "index.html", "content": { "html": "
\n
\n
\nSection 1 — Case briefing\n

The rule. The record. The unanswered questions.

\n
Context & source limits

Six findings, each tied to a dated public record. The detailed sections follow the same order: technical record (Part A), rules and enforcement record (Part B), legal frameworks (Part C), then the appendices with the primary exhibits.

\n

Six findings. Each connects a written rule to a dated record and a question the evidence can test.

\n
\n
\n1. Separate-domain auth hosts — 44 routes · 26 split pairs\n

The live register records 44 platforms authenticating through a separate registrable domain. Five further routes sit in pending verification awaiting an RDAP date; promoting them would take the total to 47. They are excluded from 44 and from the age chart. — 27 with a published per-route evidence file and 17 added from manual collection, listed apart. In 26 filter-split pairs the main domain is BLOCKED in the Steam Link Filter while the proxy carrying its login is not. These are not burner domains: csgogem.com is blocked while api.csgem.com, the host carrying its Steam login, has been registered since March 2014 — 12 years 6 months. Valve receives that hostname in every OpenID request, and renders it back to the user on its own login page. Full table, per-route ages and sourcing in Section 3.

Follow the route →
\n
\n
\n2. 2016: the mechanism was named, the deadline set\n

On 13 July 2016 Valve publicly described how gambling sites used Steam OpenID and automated trading accounts, and its counsel's notices of 20 July 2016 set a ten-day deadline. No per-operator enforcement record has been published since. Ten years after that deadline was issued, the same named mechanism is in use on separate-domain auth hosts that returned no Link Filter block on 2026-09-21.

Read the open letter to the WSGC →
\n
\n
\n3. Device correlation, on counsel's letterhead\n

In the correspondence reproduced here, Valve's counsel described device-level correlation linking one device to multiple accounts — a capability Steam Support had previously told users was not technically possible. The open question is which device-level records Valve holds and on what basis account holders are refused access to them.

Read the memorandum →
\n
\n
\n4. Two access responses. One withheld the data, one leaked it.\n

October 2025: Valve's counsel answered an Art. 15 request with an 830-page appendix whose redactions are painted over the text instead of removing it — 902,270 characters come back out with a standard extraction tool, including the third-party identifiers the bars were there to withhold. Art. 15(4) is the reason those bars exist. September 2026: ticket HT-2YBP-F7JP-D4VB was closed after three days with a link to the self-service Account Data page — no data, no stated legal basis. The one-month period under Art. 12(3) had not expired at publication; the objection is to the substance.

Read the redaction check →Read the ticket record →
\n
\n
\n5. The market above Steam's ceiling\n

Steam caps a Market listing at about $1,800. Across five marketplaces in a dated snapshot (23 Sep 2026), 248 CS2 item categories are priced above that cap by two or more of them independently, and all 248 are absent from Steam; a Factory New Dragon Lore starts at $10,941 across 389 copies listed on all five (the CSFloat-only figure in Section 13, from the 20 Sep snapshot, is $10,623.95 across 62 offers). Selling at those prices requires an outside venue, while item transfer still runs through Steam.

Follow the price and transfer →
\n
\n
\n6. The rule is explicit; the audit trail is not\n

The Subscriber Agreement reserves Steam for personal, non-commercial use, bars commercial exploitation except as expressly permitted, prohibits scripts and bots, and allows account termination. Valve applied that language to gambling operators in 2016. Separately, according to CSFloat's engineering account, Valve closed IEconItems_730/GetPlayerItems in 2017, removing public access to original item IDs (no Valve changelog located).

Put the rule beside the network →
\n
\n
\n
\n
" }, "original_content_sha256": "ac6c50d95d46685dca380bd83801ba7a9cdce2c573aa620a92a52d3e59ce4130", "author_pseudonym": "Agent Austin", "schema": "phishdestroy.macro-fact.v1", "language": "en", "aggregator": "PhishDestroy", "exports": { "pdf": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_1_agent_austin.pdf", "json": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_1_agent_austin.json", "signature": "/steam_dossier/exports/agent-protocol/files/en/steam_dossier_section_1_agent_austin.json.asc" }, "integrity": { "signed_object": "steam_dossier_section_1_agent_austin.json", "signature_file": "steam_dossier_section_1_agent_austin.json.asc", "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01", "scope": "Exact JSON bytes, including macro-fact author and corresponding PDF SHA-256. PhishDestroy is the integrity signer; original evidence attribution is unchanged." }, "pdf": { "filename": "steam_dossier_section_1_agent_austin.pdf", "sha256": "7e23e03c01436b98a4a4f85d9b0b811e1a459e5111043126bc04fb55a62629cb", "pages": 4 } }