Anti-piracy and digital rights management firm Denuvo has secured judicial approval to issue subpoenas to major technology platforms including Discord, Valve, and Reddit in an ongoing effort to unmask the anonymous individual or group operating under the handle "voices38." The development comes after a California federal judge intervened earlier in the month to address significant privacy concerns raised by Denuvo’s initial, much broader demands for user data. Following judicial scrutiny, the DRM provider drastically trimmed its requests, scaling back a sprawling list of 46 separate demands down to a targeted set of nine. The remaining requests focus primarily on core identification and contact details, including IP addresses, which the company maintains represent the only viable path to serving the defendant in the copyright lawsuit.
The legal battle stems from an anti-circumvention lawsuit filed under the Digital Millennium Copyright Act (DMCA) in September by Irdeto-owned Denuvo. The company initiated the legal action to combat the bypassing of its anti-tamper digital rights management software, which is widely utilized across the PC gaming industry to protect titles from unauthorized distribution and cracking. In its initial complaint, however, Denuvo was unable to identify the defendant by a legal name, citing only a Discord user ID, a Reddit account, and seven distinct Steam profiles associated with the "voices38" handle. Seeking to bridge the gap between a digital pseudonym and a real-world identity, Denuvo initially petitioned a California federal court for permission to subpoena Discord, Valve, and Reddit for a wide array of account data.
The initial scope of the proposed subpoenas went far beyond basic contact information. In addition to names and email addresses, Denuvo sought payment details, login logs, transaction histories, and extensive post and comment histories across the platforms. This expansive approach quickly ran into a barrier when the judiciary examined the potential privacy implications of collecting such voluminous records for a preliminary identification process.
On October 8, U.S. District Judge Haywood S. Gilliam Jr. stepped in, issuing an order requiring Denuvo to justify why it needed the voluminous data contained in its requests for production simply to identify and serve the defendant. In his written assessment, Judge Gilliam noted that the plaintiff’s requests for production extended well beyond what was reasonably necessary for the limited purpose of identifying the defendant and carried the potential to pose substantial privacy concerns for account holders.
The initial scrutiny heavily focused on the proposed subpoena directed at Valve, which proved to be the most comprehensive of the batch. Valve faced 35 distinct requests spanning the seven Steam profiles identified in the lawsuit. These requests sought payment methods, detailed transaction histories, IP addresses paired with precise timestamps, device identifiers, and links to any associated external accounts. At the same time, Discord was asked to disclose the target account’s complete server memberships and specific role assignments within those communities. Reddit faced demands not only for account metadata, but also for the full historical archive of posts and comments authored by "voices38," alongside a comprehensive list of subreddit memberships associated with the user profile.
Faced with judicial pushback, Denuvo was given a clear choice by the court: either provide a detailed, itemized justification for every single data point requested, or revise the subpoenas to adopt a narrower model successfully deployed in previous digital piracy and infringement cases.
Opting for the revision path, Denuvo returned to the court with a significantly streamlined set of demands. The revised subpoenas abandoned the extensive requests for payment data, transaction histories, historical login logs, and public or private commentary on forums. Instead, the updated documents focus narrowly on information relating directly to the identity and immediate contact information of the account holders. Each of the nine targeted requests now encompasses documents and records concerning names, government-issued identification documents, email addresses, IP addresses, phone numbers, and physical residential or business addresses.
Although the revised list successfully reduced the total volume of requests from 46 down to nine, certain data points remain that extend past the standard model subpoena referenced by Judge Gilliam. Specifically, Denuvo continues to request IP addresses and telephone numbers from the platforms. To justify these inclusions, Denuvo argued in its court filings that platforms such as Discord, Reddit, and Steam typically collect very little personal information upon initial user registration, and that much of the data they do hold is provided voluntarily and can be self-reported by the user.
Consequently, Denuvo emphasized that obtaining associated IP addresses may be the single most reliable technical path to uncovering the true identity of the defendant behind the pseudonym. Because the company currently possesses nothing more than a screen name and a collection of digital identifiers, establishing a network connection trail is viewed as vital to the progression of the litigation. The targets of the nine approved requests now encompass specific identifiers across the three platforms, including the Discord user account for "voices38," the corresponding Reddit user profile, and the seven individual Steam profiles managed by Valve. Notably, while Denuvo previously indicated in court filings that it had tracked cryptocurrency transactions connected to the cracker via the crypto exchange FixedFloat, the platform was ultimately left off the final list of subpoena recipients, and no request was submitted to compel data from the exchange.
Following the submission of the revised and narrowed requests, Judge Gilliam reviewed the adjustments and formally granted the motion. This judicial sign-off empowers Denuvo to officially serve the revised subpoenas upon Discord, Valve, and Reddit, compelling them to turn over the requested identity and contact data to help unmask the defendant so that the lawsuit can proceed. The subpoenas establish a compliance deadline for the technology platforms to produce the targeted information, bringing the DRM company one step closer to putting a legal name to the pseudonym. Whether the digital breadcrumbs preserved in server logs and account details will be sufficient to unmask "voices38" remains to be determined as the litigation moves forward.
Leave a Reply