Anti-piracy and digital rights management giant Denuvo has cleared a significant legal hurdle in its ongoing efforts to unmask the anonymous game cracker known by the handle "voices38." Following judicial pushback over initial privacy concerns, a California federal judge has granted the company permission to serve revised subpoenas to major tech platforms Discord, Valve, and Reddit.
The legal battle stems from a Digital Millennium Copyright Act (DMCA) anti-circumvention lawsuit filed by the Irdeto-owned company in September. The original complaint targeted the individual or collective behind "voices38," a handle that has gained significant notoriety within software and video game cracking circles for bypassing Denuvo’s notoriously difficult anti-tamper DRM software. At the time the lawsuit was initiated, Denuvo’s legal team possessed very little identifying information regarding the defendant, tracking them down solely through a Discord user ID, a Reddit account, and seven distinct Steam profiles.
To bridge the gap between these pseudonymous online profiles and a real-world identity, Denuvo initially sought broad subpoenas directed at Discord, Valve, and Reddit. However, the scope of those initial information requests proved to be far too sweeping for the presiding magistrate.
‘Voluminous Data’ and Privacy Concerns
On October 8, U.S. District Judge Haywood S. Gilliam Jr. intervened, ordering Denuvo to justify why it required such an expansive array of information to simply identify and serve the defendant. In his written order, Judge Gilliam expressed immediate reservations about the breadth of the plaintiff’s demands.
Judge Gilliam noted that Denuvo’s requests for production extended well beyond what was strictly necessary for the limited legal purpose of identifying an anonymous defendant, warning that the initial demands posed substantial privacy concerns for everyday users of these platforms.
The initial subpoena proposed for Valve was particularly comprehensive, containing 35 separate requests targeting the seven Steam profiles linked to the investigation. Those demands sought extensive financial and technical records, including payment methods, detailed transaction histories, IP addresses paired with precise timestamps, unique device identifiers, and any secondary accounts linked to the primary profiles.
At the same time, the proposed subpoena served to Discord targeted server memberships and specific role assignments within those digital communities. Reddit was similarly asked to turn over the complete post and comment histories generated by the "voices38" account, alongside a comprehensive list of all subreddits the account had joined.
From 46 Requests to Nine
Confronted by the judge’s skepticism, Denuvo was given a clear choice: either provide a rigorous, detailed justification for every single data point requested, or significantly narrow the scope of the subpoenas by adopting a more targeted model utilized in similar previous copyright infringement cases.
Opting for the latter path, Denuvo filed a heavily revised set of subpoenas with the court. The newly formulated requests discarded the vast majority of the original demands, paring down a total of 46 separate requests to just nine focused inquiries.
The revised subpoenas concentrate almost exclusively on documents relating directly to the identity or contact information of the account holders. Each of the nine targeted profiles—covering one Discord account, one Reddit account, and seven Steam profiles—now faces standardized inquiries focused on legal names, official identification documents, email addresses, IP addresses, phone numbers, and physical residential or business addresses.
Crucially, the revised requests completely omit demands for payment data, financial transaction histories, login logs, and historical comments or posts. Nevertheless, the updated demands still retain requests for IP addresses and phone numbers, parameters that stretch slightly beyond the baseline model subpoena previously highlighted by the court.
To defend the inclusion of IP addresses and phone numbers, Denuvo argued in its court filings that platforms like Discord, Valve, and Reddit typically collect minimal personal information during the standard account registration process. Furthermore, whatever data these platforms do manage to gather is largely self-reported by users, meaning it can easily be falsified or fabricated.
Because Denuvo currently possesses nothing more than a pseudonym, the company argued that IP addresses collected by these platforms may represent the single most reliable, objective path to uncovering the true identity of the defendant. Alongside network connection data, Denuvo continues to seek any official names or government identification documents that the tech companies might have accidentally or voluntarily accumulated on file.
Intriguingly, while Denuvo previously noted in court documents that it had successfully tracked cryptocurrency transactions made by the cracker on the crypto exchange platform FixedFloat, that platform was ultimately excluded from the final list of subpoena targets submitted to the court.
Subpoenas Granted
Following the submission of the streamlined documents, Judge Gilliam reviewed the revised requests and formally granted the motion. This judicial sign-off empowers Denuvo to officially serve the revised subpoenas upon Discord, Valve, and Reddit, compelling the companies to turn over the specified identity and contact records.
The newly approved subpoenas establish a compliance deadline of November 3 for the tech platforms to produce the requested information. Whether the digital footprints left behind by "voices38" will ultimately prove sufficient to attach a real name to the handle remains to be seen as the litigation proceeds.
