Bungie Inc v. Aimjunkies.com

Opinion

1 2

3 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON 4 AT SEATTLE 5 BUNGIE, INC., 6 Plaintiff, 7 v. C21-0811 TSZ 8 AIMJUNKIES.COM, et al., ORDER 9 Defendants. 10

11 THIS MATTER comes before the Court on the deferred portion of Plaintiff 12 Bungie, Inc.’s motion for summary judgment, docket no. 156; see also Minute Order 13 (docket no. 193) (denying in part and deferring in part Bungie, Inc.’s motion for 14 summary judgment). Having reviewed all papers filed in support of, and in opposition to, 15 the motion, the Court enters the following Order. 16 Background 17 The parties and Court are already familiar with the facts of this case.1 Given this 18 familiarity, the Court will outline only the facts and procedural history relevant to the 19 counterclaims of Defendants James May and Phoenix Digital Group 20 LLC (“Phoenix Digital”). 21

22 1 See Order (docket no. 50) (granting Bungie, Inc.’s motion for preliminary injunction); Order (docket no. 1 Plaintiff Bungie, Inc. (“Bungie”) owns copyrights for software and audiovisual 2 works related to Destiny 2 and Destiny 2: Beyond Light (collectively, “Destiny 2”).

3 Exs. 2–5 to Rava Decl. (docket no. 160 at 9–20). This case arises out of distribution of 4 Cheat Software for Destiny 2. The Cheat Software provided purchasers with features not 5 normally available in Bungie’s Destiny 2, giving them an advantage over non-cheating 6 players. Am. Compl. at ¶¶ 81, 86, 89 (docket no. 34); Am. Answer at ¶¶ 81, 86, 89 7 (docket no. 72). Purchasers of the Cheat Software would download a copy of a Loader 8 Software. Guris Expert Report at ¶¶ 97–99, Ex. 6 to Rava Decl. (docket no. 160 at 21–

9 53); Schaefer 2022 Dep. Tr. at 92:18–93:6. The Loader Software would then connect to 10 a third-party server and “inject” the Cheat Software into the user’s session of Destiny 2. 11 Guris Expert Report at ¶¶ 97-98; Schaefer 2022 Dep. Tr. at 101:25–102:10. 12 Phoenix Digital admits to distributing the Cheat Software. Resp. at 4 (docket 13 no. 177). Bungie has also named as defendants in this action Jeffrey Conway, Jordan

14 Green, and David Schaefer. Although Conway, Green, and Schaefer could each exercise 15 full managerial power over Phoenix Digital, (Phoenix Digital Group LLC Agreement at 16 § 4.3 & Schedule A, Ex. 7 to Rava Decl. (docket no. 161), they each had their own 17 responsibilities. Conway generally handled the finances. Conway 2022 Dep. Tr. at 18 22:2–19, Ex. 8 to Rava Decl. (docket no. 162). Green generally handled the website

19 design and hosting work. Green 2022 Dep. Tr. at 38:24–39:6, Ex. 9 to Rava Decl. 20 (docket no. 162). Schaefer generally acted as the business manager. Schaefer 2022 Dep. 21 Tr. at 14:12–15:15, Ex. 10 to Rava Decl. (docket no. 164). May is an independent 22 contractor who develops cheats for Phoenix Digital and AimJunkies.com. May 2022 1 Dep. Tr. at 13:8–23, Ex. 11 to Rava Decl. (docket no. 165); May 2023 Dep. Tr. at 9:11– 2 18, Ex. 31 to Rava Decl. (docket no. 160 at 242–354).

3 Prior to bringing the case, Bungie purchased a copy of the Cheat Software in 4 January 2020. Doe Dep. Tr. at 37:5–15, Ex. 26 to Rava Decl. (docket no. 168). As part 5 of that purchase, Defendants allege Bungie would have had to accept Phoenix Digital’s 6 Terms of Service (“the Terms of Service”). Am. Countercls. at ¶¶ 63–64 (docket no. 72). 7 Phoenix Digital alleges Bungie breached the Terms of Service by decompiling, reverse 8 engineering, or otherwise inspecting the Cheat Software’s programming. Id. at ¶¶ 73–74.

9 Phoenix Digital alleges a breach of contract counterclaim against Bungie for this 10 purported breach of the Terms of Service. Id. at ¶¶ 61–75. 11 As part of operating Destiny 2, Bungie would investigate reports of cheating and 12 ban cheaters and cheat developers from the videogame. Kaiser Decl. ¶ 24 (docket 13 no. 158 at 1–8). May was repeatedly caught and banned by Bungie for connecting

14 reverse engineering tools to Destiny 2. Id. at ¶ 25. May admitted to attempting to reverse 15 engineer Destiny 2’s programming and, when caught and banned for doing so, to creating 16 new accounts to regain access to the videogame. May 2022 Dep. Tr. at 41:14–42:2, 17 73:1–74:19, 85:5–7. When May would connect reverse engineering software to Destiny 18 2 or run other programs simultaneously with Destiny 2, Bungie would record certain

19 metadata, including file names, from his computer. Kaiser Decl. ¶ 25; Ex. 1 to Kaiser 20 Decl.2 (docket no. 158 at 9–12) (chart of the metadata recorded). To gain access to 21

22 2 A review of the exhibits attached to Dr. Kaiser’s declaration shows that Exhibits 1 and 2 were cross- 1 Destiny 2, May was required to agree to Bungie’s Limited Software License Agreement 2 (“LSLA”) and Bungie’s Privacy Policy. Am. Countercls. at ¶¶ 6–8; Bungie’s Answer at

3 ¶¶ 6–8 (docket no. 90); May 2023 Dep. Tr. at 172:6–173:23. Under the Privacy Policy, 4 Bungie can collect, inter alia, device data such as IP addresses and device IDs from a 5 computer running Destiny 2. Privacy Policy at § 2.b. (docket no. 72-2 at 4). May alleges 6 that Bungie’s access to, and collection of data from, his computer constituted violations 7 of the Computer Fraud and Abuse Act (“CFAA”). Am. Countercls. at ¶¶ 37, 44, 51. 8 May further alleges that Bungie accessed files on his computer without his authorization

9 in violation of the Digital Millennium Copyright Act (“DMCA”). Id. at ¶¶ 56–60. 10 Discussion 11 A. Summary Judgment Standard 12 The Court shall grant summary judgment if no genuine issue of material fact exists 13 and the moving party is entitled to judgment as a matter of law. Fed. R. Civ. P. 56(a).

14 The moving party bears the initial burden of demonstrating the absence of a genuine issue 15 of material fact. Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986). A fact is material if 16 it might affect the outcome of the suit under the governing law. Anderson v. Liberty 17 Lobby, Inc., 477 U.S. 242, 248 (1986). To survive a motion for summary judgment, the 18 adverse party must present affirmative evidence, which “is to be believed” and from

19 which all “justifiable inferences” are to be favorably drawn. Id. at 255, 257. When the 20 record, taken as a whole, could not, however, lead a rational trier of fact to find for the 21

22 what ¶ 25 identifies as Exhibit 2 is actually attached as Exhibit 1. The Court refers to the Exhibits in the 1 non-moving party on matters as to which such party will bear the burden of proof at trial, 2 summary judgment is warranted. See Matsushita Elec. Indus. Co. v. Zenith Radio Corp.,

3 475 U.S. 574, 587 (1986); see also Celotex, 477 U.S. at 322. 4 B. May’s Counterclaims 5 1. May’s Computer Fraud and Abuse Act Counterclaims 6 May alleges three violations of the CFAA against Bungie. Am. Countercls. at 7 ¶¶ 37, 44, 51. The CFAA creates a private right of action. 18 U.S.C. § 1030(g). To 8 bring an action under the CFAA, the underlying conduct must involve “loss to 1 or more

9 persons during any 1-year period … aggregating at least $5,000 in value.”3 Id. at 10 § 1030(g); id. at § 1030(c)(4)(A)(i)(I). “Loss” is defined as “any reasonable cost to any 11 victim, including the cost of responding to an offense, conducting a damage assessment, 12 and restoring the data, program, system, or information to its condition prior to the 13 offense, and any revenue lost, cost incurred, or other consequential damages incurred

14 because of interruption of service.” Id. at § 1030(e)(11). 15 Bungie contends that May has not sustained the minimum of $5,000 in aggregate 16 loss needed to sustain his CFAA counterclaims. In response, May relies solely on his 17 sworn affidavit for the contention that he “spent in excess of $2702 purchasing new 18 computers and drives,” and approximately 40 hours of his time self-valued at $75 per

19 hour in responding to Bungie’s allegedly improper access. May Decl. at ¶ 16 (docket 20 no. 175). A non-movant, however, cannot rely solely on conclusory, self-serving 21

22 3 18 U.S.C. § 1030(g) also creates private right of action for conduct involving the factors set forth in 18 1 affidavits to create a genuine issue of material fact. F.T.C. v. Publ’g Clearing House, 2 Inc., 104 F.3d 1168, 1171 (9th Cir. 1997) (internal citations omitted); see F.T.C. v.

3 Stefanchik¸ 559 F.3d 924, 929 (9th Cir. 2009) (“A non-movant’s bald assertions or a 4 mere scintilla of evidence in his favor are both insufficient to withstand summary 5 judgment.” (internal citation omitted)). 6 Bungie, by comparison, points to May’s own sworn deposition testimony. At his 7 deposition, May testified that his computer’s processor was not corrupted by Bungie’s 8 alleged access and was still useable. May 2023 Dep. Tr. at 110:13–20. He testified that

9 his video card was not damaged as a result of Bungie’s alleged access and was still 10 useable. Id. at 111:15–112:3. May also testified that his computer’s RAM, id. at 113:12– 11 18, his computer’s SSD drive, id. at 120:3–8, his computer’s motherboard, id. at 120:18– 12 121:9, his computer’s power supply, id. at 124:10–21, his three computer monitors, id. at 13 121:13–24, his keyboard, id. at 122:7–17, and his mouse, id. at 123:19–124:5, were all

14 undamaged by and still useable after Bungie’s allegedly improper access.4 Indeed, May 15 still has the “old computer” allegedly accessed by Bungie. Id. at 110:23–25, 114:5–8. 16 Even if an act falls within the scope of the CFAA, May “nevertheless is required to show 17 that [he] suffered a harm recognized by the statute.” Doyle v. Taylor, No. CV-09-158, 18 2010 WL 2163521, at *3 (E.D. Wash. May 24, 2010) (quoting SKF USA, Inc. v.

19 Bjerkness, 636 F. Supp. 2d 696, 721 (N.D. Ill. 2009)). The Court concludes as a matter 20 21 4 May testified that he only replaced these items because he had been “hardware ID banned” by Bungie. May 2023 Dep. Tr. at 126:6–24. He further testified, however, that he had consented to Bungie collecting 22 device identification information when he agreed to Bungie’s LSLA and Privacy Policy. Id. at 172:6– 173:23. Bungie acting in accordance with its LSLA based on data it was contractually allowed to collect 1 of law that purchasing replacements for undamaged computer components falls outside 2 18 U.S.C. § 1030(e)(11)’s definition of “loss.” See Doyle, 2010 WL 2163521, at *2

3 (concluding that, in order to sustain a CFAA claim, a plaintiff who alleged that a 4 defendant accessed a USB drive and retrieved a confidential document would “have to 5 show that the thumb drive itself was somehow damaged or impaired by Defendant's act 6 of accessing the drive”). 7 Bungie further contends that May’s “claim that he spent 40 hours reviewing and 8 cleaning his files is dubious at best and lacks evidentiary support.” Mot. at 28 (docket

9 no. 156). In response, May points to his own deposition testimony to support his 10 contention that he spent 40 hours repairing his computer. At his deposition, May testified 11 that he has no records of how much time he spent reviewing files after Bungie’s allegedly 12 improper access. May 2023 Dep. Tr. at 87:14–16. Further, he testified that of the 13 estimated 40 hours spent responding to the alleged access, only approximately 25 hours

14 were actually spent reviewing potentially compromised files. Id. at 87:4–13. The 15 remaining approximately 15 hours were spent building a new computer. Id. As the 16 Court previously concluded, replacing undamaged computer components does not 17 constitute loss for CFAA purposes. Thus, it follows that assembling the non-loss 18 components into a new computer does not constitute loss. In short, the computer

19 components purchased by May and his time spent assembling those components into a 20 new computer do not constitute loss under the CFAA. The loss May incurred 21 remediating any harm from Bungie’s allegedly improper access is, at most, the time he 22 spent reviewing any files that might have been compromised. Based on May’s 1 testimony, the value of this time is $1875 (25 hours of time at $75 an hour). 2 Consequently, May has not presented evidence sufficient to create a dispute of material

3 fact as to whether he sustained at least $5,000 in damage as a result of Bungie’s allegedly 4 improper access. Accordingly, Bungie’s motion for summary judgment is GRANTED as 5 to May’s CFAA counterclaims. May’s CFAA counterclaims are DISMISSED with 6 prejudice. 7 2. May’s Digital Millennium Copyright Act Counterclaim 8 To prove his DMCA counterclaim, May must establish that he (1) employes

9 technological countermeasures, (2) to protect works subject to copyright protection, and 10 (3) that Bungie circumvented his technological countermeasures to access the protected 11 work. 17 U.S.C. § 1201(a)(1)(A). Bungie contends that May cannot establish that the 12 allegedly accessed works are subject to copyright protection and that Bungie 13 circumvented any technological countermeasures within the meaning of the DMCA.

14 a. Copyright Protection 15 Bungie contends that May cannot establish that the works on his computer were 16 subject to copyright protection. In response, May points to his sworn affidavit which 17 states that he owns copyrights in at least the “reclasskernel64.sys” and 18 “reclasskernel64.pdb” files. May Decl. at ¶¶ 3,8–9. May also testified at his deposition

19 that he owns copyrights in the “reclasskernel64.sys” file, May 2023 Dep. Tr. at 40:17– 20 41:1, and the “reclasskernel64.pdb” file, id. at 47:17–17, as well as the “blah64.exe” file, 21 id. at 23:15–18, and the “reclass.net.exe” file, id. at 34:19–21. 22 1 Bungie argues that because May has not produced copyright registrations for the 2 files he claims are subject to copyright protection, the fact that he created the files is not

3 enough to establish that they are subject to copyright protection. To support this 4 argument, Bungie relies solely on Point 4 Data Corp. v. Tri-State Surgical Supply & 5 Equip. LTD, No. 11-CV-726, 2013 WL 4409434 (E.D.N.Y. Aug. 2, 2013), adopted in 6 relevant part, 2013 WL 5502852 (E.D.N.Y. Oct. 1, 2013). In Point 4, the court 7 concluded that the plaintiff’s DMCA claim should be dismissed because it failed to 8 present sufficient evidence to create a genuine factual issue as to whether the underlying

9 software was copyrightable. Id. at *17–20. The Point 4 court, however, had stricken 10 from the record the declaration that went to the copyrightability of the underlying 11 software, and was left with nothing but “an assumption” regarding the underlying 12 software’s copyrightability. Id. at *19. Here, by contrast, neither May’s declaration 13 testimony, May Decl. at ¶¶ 3, 8, nor his deposition testimony, May 2023 Dep. Tr. at

14 23:15–23, 34:19–25, 40:17–41:5, 47:15–22, that he created the code in the relevant files 15 and owns copyrights in them have been stricken from the record. The Court has evidence 16 in the record, and not just mere assumptions, that goes to whether the relevant files are 17 subject to copyright protection. Because “[t]he evidence of the non-movant is to be 18 believed, and all justifiable inferences are to be drawn in [May’s] favor,” Anderson, 477

19 U.S. at 255 (internal citation omitted), the Court concludes that issues of material fact 20 exist as to whether the relevant files are subject to copyright protection. 21 22 1 b. Circumvention 2 Bungie further argues that it did not circumvent any of May’s technological

3 countermeasures. May, however, testified that Bungie circumvented his password 4 protections when it accessed the file “reclasskernel64.sys.” May 2023 Dep. Tr. at 5 148:20–149:13. He testified that Bungie could have only accessed that file by bypassing 6 his password protections because it “never touches the Destiny process” and was stored 7 in a separate memory space on his computer. Id. Bypassing a password to access a file is 8 the type of circumvention the DMCA was intended to prevent. See MDY Indus., LLC v.

9 Blizzard Ent., Inc., 629 F.3d 928, 947 (9th Cir. 2010). Considering May’s testimony, a 10 dispute of material fact exist as to whether Bungie circumvented any of May’s 11 countermeasures. The Court DENIES Bungie’s motion for summary judgment as to 12 May’s DMCA counterclaim. 13 C. Phoenix Digital’s Breach of Contract Counterclaim

14 1. The Final Arbitration Award is Entitled to an Issue-Preclusive Effect 15 Arbitration proceedings are entitled to an issue-preclusive effect.5 Spivak v. 16 Alphabet Inc., No. C20-1480, 2021 WL 535211, at *7 (W.D. Wash. Feb. 12, 2021) 17 (citing Clark v. Bear Stearns & Co., Inc., 966 F.2d 1318, 1320 (9th Cir. 1992)). For issue 18 preclusion to apply “(1) the issue at stake must be identical to the one alleged in the prior

19 litigation; (2) the issue must have been actually litigated in the prior litigation; and (3) the 20 determination of the issue in the prior litigation must have been a critical and necessary 21 22 5 The Court uses the terms claim preclusion and issue preclusion in lieu of res judicata and collateral estoppel, respectively. See Robi v. Five Platters, Inc., 838 F.2d 318, 321 n.2 (9th Cir. 1998) (explaining 1 part of the judgment in the earlier action.” Id. Whether the Cheat Software and Loader 2 Software violated the DMCA, and whether they are illegal, was actually litigated in the

3 Arbitration and was a necessary part of the Final Arbitration Award.6 See Final Arb. 4 Award at 10–16 (docket no. 89-1). The Court therefore finds that the issue of the legality 5 of the Cheat Software and Loader Software is entitled to an issue-preclusive effect.7 6 2. The Terms of Service are Void as Illegal 7 Phoenix Digital alleges that Bungie violated Phoenix Digital’s Terms of Service 8 while conducting the investigation into the Cheat Software and Loader Software. Am.

9 Countercls. at ¶¶ 73–75. Bungie contends that because the Arbitrator found the Cheat 10 Software and Loader Software violated the DMCA, any contract pertaining to them is 11 void as illegal. The Court agrees with Bungie. 12 “A contract that is illegal is void–that is, null from the beginning and 13 unenforceable by either party.” Bankston v. Pierce County, 174 Wn. App. 932, 938, 391

14 P.3d 495 (2013) (internal citations omitted). This principle holds true even if both parties 15 knew of the illegality at the time of the contract’s formation. Id. at 938–39. As discussed 16 17 18 6 Because the Court confirmed the Final Arbitration Award, docket no. 140, it is also entitled to preclusive effect as a final judgment of this Court. NTCH-WA, Inc. v. ZTE Corp., 921 F.3d 1175, 1180 (9th. Cir. 2019) (“A federal-court order confirming an arbitration award has “the same force and effect” 19 as a final judgment on the merits, 9 U.S.C. § 13, including the same preclusive effect.” (collecting cases)); see also Leaschauer v. Huerta, 667 F. App’x 253, 254 (9th Cir. 2016) (“[T]he preclusive effects of a 20 lower court judgment cannot be suspended simply by taking an appeal that remains undecided.” (quoting Robi, 838 F.2d at 327)). 21 7 Defendants argue that this Court cannot give a claim-preclusive effect to the Final Arbitration Award because the Arbitration involved different claims than those now before the Court. Defendants are correct 22 that the claims relevant to this motion are different than the claims in the Arbitration and, therefore, the Final Arbitration Award would not be entitled to a claim-preclusive effect. However, claim preclusion 1 above, the Final Arbitration Award’s finding that the Cheat Software and Loader 2 Software violated the DMCA is entitled to an issue preclusive effect. Because the Terms

3 of Service apply to the use of illegal goods, the Terms of Service are void as illegal and 4 unenforceable. Accordingly, the Court GRANTS Bungie’s motion for summary 5 judgment as to Phoenix Digital’s breach of contract counterclaim and DISMISSES 6 Phoenix Digital’s breach of contract counterclaim with prejudice. 7 Conclusion 8 For the foregoing reasons, the Court ORDERS:

9 (1) The deferred portion of Plaintiff Bungie, Inc.’s motion for summary 10 judgment, docket no. 156, is GRANTED in part and DENIED in part. The motion is 11 GRANTED as to James May’s CFAA counterclaims (First, Second, and Third Amended 12 Counterclaims of James May), and May’s CFAA counterclaims are DISMISSED with 13 prejudice. The motion is further GRANTED as to Phoenix Digital Group LLC’s breach

14 of contract counterclaim (First Amended Counterclaim of Phoenix Digital Group LLC), 15 and Phoenix Digital’s breach of contract counterclaim is DISMISSED with prejudice. 16 The motion is DENIED as to May’s DMCA counterclaim (Fourth Amended 17 Counterclaim of James May). 18 (2) The Clerk is directed to send a copy of this Order to all counsel of record.

19 IT IS SO ORDERED. 20 Dated this 16th day of October, 2023. 21 A

22 Thomas S. Zilly