ESA asks USTR to list a person, not a website: cracker voices38 nominated as a "notorious market"

The Entertainment Software Association’s submission to the 2026 Notorious Markets review, filed with the US Trade Representative on 7 October 2026, contains a nomination that is new in kind. Alongside the usual torrent sites, repackers and marketplaces, ESA asks USTR to list voices38 — not a website, but the pseudonymous cracker behind a run of Denuvo bypasses, already the defendant in Denuvo’s own lawsuit in the Northern District of California.

The case for listing a supplier

ESA describes voices38 as “a pseudonymous but persistent crack-development and release operation specializing in Denuvo Anti-Tamper”, a protection it says is used by at least nine ESA member companies publishing PC games. Citing Reddit’s r/CrackWatch, it attributes approximately two dozen cracked or bypassed titles to the name, and points to a move from older targets to “current and same-day releases” — the launch window in which publishers earn most of their revenue.

The core of the argument is causal. Before a Denuvo-protected title is cracked, ESA says, a copied game “ordinarily cannot be used by the public”. Once voices38 releases a working crack, downstream markets — repackers, torrent indexes, cyberlockers, linking sites — can reproduce and monetise it immediately. “Each crack therefore unlocks an entire downstream market for an unauthorized copy of that title.” Listing only those downstream services, ESA argues, “would overlook the upstream operation that determines whether protected games can be offered by them at all”.

No storefront, no name — and why ESA says that doesn’t matter

The obvious objection is that voices38 is not a market at all: no storefront, no multiple sellers, no fixed price, no known identity. ESA answers it head-on. USTR’s definition, it says, does not require a conventional storefront or a mandatory fee; voices38 supplies “a scarce, specialized product” under “a persistent release identity that communicates source and expected quality”, competes for reputation, and solicits cryptocurrency donations. And on anonymity: “Concealment of ownership, location, hosting, and payment information is characteristic of notorious online piracy operations and is a reason for focused investigation, not a safe harbor from designation.”

What ESA says a listing would achieve is practical rather than symbolic: it “would focus attention on identifying the operator, preserving evidence, disrupting distribution accounts and donation channels, and coordinating action across the forums, repositories, hosting services, peer-to-peer infrastructure, and other intermediaries used to seed each release”.

The rest of the submission, in numbers

The voices38 nomination sits inside a broader filing with the kind of enforcement data rights holders rarely publish:

• FitGirl-Repacks, already on the 2024 and 2025 lists, is renominated: ESA says zero links were removed in response to its notices between August 2025 and August 2026.
• DODI-Repacks: 22% of noticed links removed in the same period; wallets associated with the site have sent funds to KYC exchanges, “which may create an attribution and enforcement path”.
• Rutracker: a 3% compliance rate with ESA notices.
• Digital goods marketplaces: FunPay removed 31% of more than 11,000 reported URLs; Eldorado.gg 70% of more than 10,000, with an average removal time of thirty days.
• cs.rin.ru, the forum that ESA calls the coordination hub of PC game piracy, and commercial cheat markets including Cronus Zen.

ESA’s issue focus for the year is hardware: plug-and-play and handheld consoles preloaded with thousands of pirated games, which it calls the industry’s “superfakes”, naming Anbernic.com.

What this means for you

The Notorious Markets List has no legal force. It names; it does not block, seize or sanction. Its value is pressure: on foreign governments, on hosts, registrars, payment services and platforms, which are expected to act on listed targets, and on the targets themselves. That is why the framing in ESA’s submission matters beyond video games.

For any brand dealing with anonymous actors — the operator behind a clone-site network, a recurring impersonator, a cheat or crack supplier — the useful idea is that the persistent identity is the target, not the domains it uses this week. ESA’s case rests on things that can be documented: a recognisable name, attributed releases, distribution channels, donation addresses, and a role that the wider ecosystem depends on. That is the same file that supports a Doe lawsuit, a platform escalation or a regulator complaint.

USTR usually publishes the list early in the following year. Whether it accepts a person as a “market” will tell rights holders how far the designation can be stretched.