A decision in Jagex v. Impulse Software, issued by Massachusetts U.S. District Court Judge Gorton in August, has some interesting (albeit not nonobvious) lessons for software developers seeking to protect their websites from copying or reverse engineering. The decision arises in the context of a preliminary injunction – a request by Jagex to provide it with legal relief at the outset of the case, before discovery or trial – so Jagex may yet prevail in this case, particularly since most of the reasons the court denied it relief that this stage can be corrected before the case progresses much further.
The plaintiff, Jagex operates an online role-playing game called “Runescape.” Runescape is a “massively multiplayer online role-playing game” (MMORPG for short, but we’ll just call it “the game”).
Impulse offers online cheat tools – software that lets users advance through the levels of the game without actually playing the game. Moving to higher and more challenging levels is the goal of the game, and the Impulse software allows users to reach those hallowed grounds without investing the time and effort the game expects users to endure. And, it is possible to invest a great deal of time and effort with this game – Judge Gorton noted that the top three Runescape players averaged about 20,000 hours of playing time.
Impulse (actually brothers and Florida residents Eric and Mark Snellman) is able to provide the the cheat software by downloading a copy of Runescape and using a process the court describes as “reflection” to study the internal working of the game. Although this process wasn’t described in any detail, it sounds like it is some form of reverse engineering, although it falls short of decompiling or disassembling the game software. The software then plays the game for the user, advancing through the levels while the user is off doing, perhaps, more productive things.
After concluding that the court could exercise jurisdiction over Eric and Mark (an interesting application of long-arm jurisdiction that I won’t discuss further here), the court considered several claims, of which the most interesting are allegations of copyright infringement, violation of the Digital Millennium Copyright Act (DMCA) and violation of the Computer Fraud and Abuse Act (CFAA).
The copyright claim failed on a fundamental ground: although Jagex had copyright registrations in icons that appear in the game, the defendants did not copy these visual elements of the game; and, it appears that Jagex didn’t have registrations for the underlying software. Accordingly, Jagex didn’t establish that the defendants had copied anything that was covered by Jagex’s registrations, leading the court to reject this claim at this stage of the case. The court distinguished MDY v. Blizzard (D. Ariz. 2008) and Ticketmaster v. RMG (C. D. Ca. 2007), two cases in which website owners made successful claims against defendants who had engaged in similar activities, noting that in those cases the plaintiffs had valid registrations.
Jagex argued that Eric and Mark violated the DMCA claim because their software “circumvented technological measures” ( magic words in the DMCA’s anti-circumvention lexicon) in Runescape. However, it appears that Jagex was unable to identify copyrighted material or “technological measures” to Judge Gorton’s satisfaction.
Jagex also claimed violation of the CFAA. But this claim required Jagex to show that the terms and conditions of use made the servers hosting the game “protected computers” – that is, that users had to agree to the terms as a condition of use. The Runescape terms and conditions did prohibit reverse engineering of the game; however, it appears from the decision that Jagex was unable to show that the website had been configured in such a way as to require Eric and Mark to agree to the terms before accessing the site; therefore Jagex couldn’t prove that the computers that hosted the game were “protected computers.”
However, all is not lost for Jagex – in fact, most of the obstacles it confronted at this early stage of the case should be easily fixable. Jagex can register the software, so that the defendants’ conduct will be actionable as copyright infringement. And, they can rework their terms and conditions so that they clearly apply to anyone accessing the site, thereby bringing the computers that host the site under the CFAA. Of course, the latter strategy would require Jagex to create a new version of the site which would make the version copied unusable by Runescape users. Eric and Mark would have to download this new version, and at that point they would, if Jagex did it right, violate the anti-reverse engineering restriction. And, with Impulse and other would-be cheat facilitators frustrated, the number of “20,000 hour” Runescape users would grow.