Anti-piracy and digital rights management giant Denuvo has cleared a significant legal hurdle in its ongoing efforts to unmask an anonymous software engineer and game cracker operating under the online handle "voices38." A federal judge in California has officially granted the company permission to issue targeted subpoenas to major technology and gaming platforms—specifically Discord, Valve, and Reddit—following a series of revisions that successfully addressed initial judicial concerns regarding user privacy and overreaching data collection demands.
The legal confrontation stems from a Digital Millennium Copyright Act (DMCA) anti-circumvention lawsuit filed in September by the Irdeto-owned security firm. In its initial complaint, Denuvo sought to hold the individual or group behind the "voices38" persona accountable for allegedly bypassing its anti-tamper digital rights management software, which is widely utilized across the video game industry to protect major titles from unauthorized copying and distribution. At the time the lawsuit was initiated, however, Denuvo’s legal team possessed little more than a handful of digital footprints: a single Discord user identification number, a Reddit account, and seven distinct Steam profiles associated with the suspected cracker.
Seeking to bridge the gap between a pseudonymous online handle and a real-world identity, Denuvo initially petitioned the court for sweeping subpoenas directed at Discord, Valve, and Reddit. The company’s original legal filings requested a massive breadth of information that went far beyond basic contact details. The proposed demands encompassed payment information, detailed transaction histories, comprehensive login logs, device identifiers, and extensive public and private post or comment histories across the various platforms. For the presiding federal judge, these wide-ranging demands proved to be a step too far.
On October 8, U.S. District Judge Haywood S. Gilliam Jr. issued an order requiring Denuvo to justify why it needed the voluminous data contained within its initial requests for production. In his written evaluation, Judge Gilliam expressed immediate apprehension regarding the scope of the demands, pointing out that the plaintiff’s requests for production extended well beyond what was strictly necessary for the limited purpose of identifying and serving the defendant. Furthermore, the judge warned that granting such broad requests as initially formulated could pose substantial privacy concerns for everyday platform users who might be swept up in the data dragnet.
The judicial scrutiny was particularly focused on the demands directed at Valve, which operates the dominant Steam digital distribution platform. Denuvo’s proposed subpoena to Valve had been the most expansive, featuring 35 distinct requests distributed across the seven identified Steam profiles. These requests sought to uncover underlying payment methods, transaction logs, precise IP addresses accompanied by exact timestamps, device identifiers, and any secondary accounts linked to the primary profiles.
Similarly, the initial requests directed at other platforms sought deep behavioral data. Discord was asked to provide comprehensive lists of server memberships and internal role assignments associated with the target account. Meanwhile, the proposed Reddit subpoena demanded the complete post and comment histories generated by the "voices38" account, alongside a detailed breakdown of every subreddit the user maintained membership in. Faced with the prospect of justifying every single data point or risk having the subpoenas rejected entirely, Denuvo opted to revise its approach.
Rather than attempting to defend the dozens of individual requests, Denuvo chose to utilize a streamlined and targeted subpoena model inspired by similar digital enforcement cases handled in federal jurisdictions. Just days after Judge Gilliam’s order, the company submitted a heavily revised set of subpoenas that drastically reduced the total number of demands from 46 down to just nine.
The newly restructured subpoenas sharply narrow the scope of inquiry. Each of the nine targeted requests—covering the single Discord account, the one Reddit account, and the seven Steam profiles—now focuses strictly on documents relating directly to the true identity or official contact information of the respective account holders. Under the revised framework, the platforms are asked to produce legal names, official identification documents if available, associated email addresses, associated phone numbers, and physical residential or business addresses.
Crucially, the revised requests completely eliminate demands for payment details, financial transaction histories, login logs, and conversational archives such as forum posts and comments. However, the updated filings do retain demands for IP addresses and phone numbers. This retention places the new requests somewhat beyond the minimalist model subpoena previously recommended by the court, but Denuvo’s legal team argued that these specific technical identifiers are vital. In their filings, the company explained that platforms like Discord, Valve, and Reddit typically collect very little verifying information during the standard account registration process, and what little data they do gather is entirely self-reported by the user.
Because the individual operating behind the "voices38" handle has remained strictly anonymous, Denuvo asserted that IP addresses may represent the sole reliable path toward uncovering the real-world identity of the defendant. Emphasizing the fundamental asymmetry of the information available, the company noted in its filings that Denuvo currently possesses nothing more than a pseudonym, leaving legal service of process nearly impossible without digital tracing assistance from the hosting platforms.
Aside from the major social and gaming networks, the investigation has also previously touched upon alternative financial pathways. In earlier disclosures, Denuvo pointed out that it had identified cryptocurrency transactions linked to the cracker on the digital exchange platform FixedFloat. Despite these blockchain ties, the crypto exchange was notably omitted from the latest round of approved subpoenas, indicating that the security firm is currently prioritizing platform-level account registries and connection logs over digital currency tracking.
With the submission of the revised documents, Judge Gilliam reviewed the adjustments and formally granted the motion. The green light allows Denuvo to immediately serve the official, revised subpoenas upon Discord, Valve, and Reddit, compelling the companies to search their internal records and disclose the requested identification data pertaining to the target accounts.
The newly approved subpoenas establish a formal deadline of November 3 for the platforms to produce the requested information. Whether the harvested data, particularly the requested IP addresses and contact details, will ultimately provide the missing link needed to unmask "voices38" and allow Denuvo to successfully advance its anti-circumvention lawsuit remains to be seen as the legal proceedings continue to unfold in federal court.
Leave a Reply