Is cheating copyright infringement? CJEU clarifies specific protection of computer programs

The underlying case

The CJEU’s preliminary ruling originated from a lawsuit filed more than 12 years ago by Sony Interactive Entertainment Ltd. (“Sony”) against companies within the Datel Group (“Datel”). Datel had developed and distributed complementary products for Sony’s game consoles, including inter alia the software “Action Replay PSP”, which worked exclusively with Sony’s original games, in this case, the PlayStation Portable (PSP) game “Motorstorm Arctic Edge”. Installing Datel’s software allowed users to modify gameplay in “Motorstorm Arctic Edge”, for example, by removing restrictions on the use of the turbo function (“booster”) or on the selection of drivers - some of whom are typically unlocked only after achieving a certain number of points. In other words, Datel provided a cheating software for Sony’s games, enabling users to bypass the need to progress through regular gameplay.

According to Datel, their software did not copy the code of Sony’s games, nor did it alter the code itself. Instead, “Action Replay” modified the values of temporary variables that “Motorstorm Arctic Edge” created and stored in the PSP’s random access memory (RAM) while the game was running. Modifying these variables caused the game to operate under assumptions and conditions that were possible within the game but were not earned by the player’s actual progress. In short, Datel’s claim was that while Datel’s Action Replay PSP changed the gameplay experience, it did not alter the program code of Sony’s game.

Sony, among other claims, invoked copyright protection of its game software under Directive 2009/24/EC, which in Articles 1 and 4(1)(b) provides protection against “any other alteration” of computer programs (implemented in Articles 69a and 69c German Copyright Act). In early 2012, the Hamburg District Court partially upheld Sony’s claims, but this decision was later overturned by the Hamburg Court of Appeal. In early 2023, the German Supreme Court referred the matter to the CJEU, which has now ruled on the scope of protection under Directive 2009/24/EC.

Preliminary ruling of the CJEU

The German Supreme Court had referred two questions to the CJEU: first, whether altering variables stored in a computer's RAM without modifying the source or object code of a program falls within the scope of protection under Article 1 of Directive 2009/24/EC, and second, whether such modifications qualify as an "alteration" within the meaning of Article 4(1)(b) of the Directive. The CJEU answered the first (and thereby also the second) question as follows:

“Article 1(1) to (3) of Directive 2009/24 must be interpreted as meaning that the content of the variable data transferred by a protected computer program to the RAM of a computer and used by that program in its running does not fall within the protection conferred by that directive, in so far as that content does not enable such a program to be reproduced or subsequently created.”

The variables stored in the PSP’s RAM and modified by Datel’s software are according to the CJEU thus not part of Sony’s “computer program”. On a wider level, paragraph 38 of the judgment is particularly noteworthy, as it affirms that the scope of Directive 2009/24/EC is limited to the source code and object code of a computer program:

“The protection guaranteed by Directive 2009/24 is limited to the intellectual creation as it is reflected in the text of the source code and object code and, therefore, to the literal expression of the computer program in those codes, which constitute, respectively, a set of instructions according to which the computer must perform the tasks set by the author of the program.”

The CJEU based this conclusion on three main legal arguments: First, the wording of Directive 2009/24/EC which protects "any form of expression" of a computer program but explicitly excludes its "underlying ideas and principles" (paragraphs 31 to 41). Second, the Directive’s recitals, specifically recital No 15, referring to the protection of "the form of the code" (paragraphs 42 to 45). Third, the Directive’s objectives to grant protection against the easy and inexpensive reproduction of software while ensuring it does not hinder independent developments or interoperability between different computer programs (paragraphs 46 to 51).

Impact of the judgement for copyright protection of computer programs

It  is understandable that game developers like Sony (being the actual authors and right holders), and likely most users, would view “cheating software” as a significant "alteration" of a computer game. There has also been case law in Germany (including prior successes for Sony in the lower courts) which held that a computer program could be "altered" not only by modifying its code, but also by external measures that change how the program is executed (e.g. by altering variables stored in the RAM).

The CJEU’s recent judgement now offers more certainty on the scope of copyright protection of computer programs. It builds on the Court’s prior judgments on Directive 2009/24/EC (and its predecessor, Directive 91/250/EEC). The CJEU has consistently sought to limit the protection of a "computer program" to its source code and object code and held that elements such as the graphic user interface, the functionality of a program, its programming language, and specific data file formats do not constitute "expressions" of a computer program (Judgments of 22 December 2010, Case C-393/09 - BSA, and 2 May 2012, Case C‑406/10 - SAS Institute). In view of this prior case law the CJEU’s recent judgement may well be read to confirm that (as long as the code is not changed) right holders have no claim (under Directive 2009/24/EC) to ensure that their programs are run as they intended.

Cheating software and other unauthorized external manipulations of software indeed continue to present significant challenges. Similar cheating tools are available for other games, often manipulating the RAM in the same way. The issue extends beyond gaming and affects all types of software. Another relevant case, for example, is Springer v. Eyeo, involving adblocking software, which the German Supreme Court (Case I ZR 131/23) stayed pending the CJEU's ruling in the Sony case (see our earlier coverage). Rights holders (and their legal advisors) must now explore alternative ways to secure legal protection. The door is not quite shut - a few potential avenues for game (and software) developers include the following:  

• The CJEU’s ruling is expressly limited to protection under Directive 2009/24/EC, which specifically governs computer programs. Elements for which the CJEU does not grant protection under Directive 2009/24/EC, such as its user interface, or in the case of a computer game, its plot and storyline, may arguably be protected  under “standard” copyright law, which at the European level is harmonized by Directive 2001/29/EC.
• Under certain circumstances, the distribution of cheating software that allows players to break the rules of the game can be prohibited, at least in Germany, based on unfair competition law. In a landmark decision, the German Supreme Court, for example, prohibited the use of so-called “buddy bots”, which enabled cheating in World of Warcraft, a paid online game where cheating threatens the business model because players may cancel their memberships if cheaters spoil the fun (Judgment of 12 January 2017, Case I ZR 253/14 - World of Warcraft II).
• Where cheating or other third-party software is used to circumvent technical protective measures (e.g. password queries, program or time locks), such circumventions may be subject to independent claims under Articles 95a and 69f(2) of the German Copyright Act (implementing Article 6 Directive 2001/29/EC). However, this requires that the software in question is used solely for the purpose of circumventing technical protective measures and does not at the same time also perform legitimate technical functions, such as playing music discs on a game console (CJEU, Judgement of 23 January 2014, Case C-355/12 - Nintendo vs PC Box).

In conclusion, despite the CJEU’s ruling, the legal protection available to rights holders against external manipulations of games (or other software) will still depend on the particular facts of each case.

Authored by Jan Hendrik Schmidt and Johannes Großekettler