Ubisoft DMCA takedown of Slopsmith

Ubisoft DMCA takedown of Slopsmith refers to a Digital Millennium Copyright Act takedown notice that an authorized agent of Ubisoft Entertainment SA filed with GitHub on June 15, 2026 against Slopsmith, an open-source tool that reads and decrypts the encrypted song and note-chart files of Rocksmith 2014. The notice asserted an anti-circumvention theory under 17 U.S.C. § 1201 over four AES-based protection measures, but GitHub's published notice states it "did not find sufficient information to determine a valid anti-circumvention claim" and instead acted on "other valid copyright claim(s)." Because the reported network exceeded 100 repositories and Ubisoft alleged that all or most forks infringed equally, GitHub processed the takedown against the entire network of 131 repositories, so users who had forked the project lost their copies.

Background

Rocksmith 2014 delisting and Rocksmith+

The work at issue is "Rocksmith® 2014 Edition - Remastered - Learn & Play" (Steam AppID 221680), which Ubisoft's notice states was first released in October 2013 as Rocksmith 2014 and re-released in its remastered edition in October 2016. Ubisoft removed the one-time-purchase Rocksmith 2014 from sale in 2023 after its music licensing deals expired. Ubisoft pointed players to its subscription service Rocksmith+, then on December 19, 2024 released a "Learn & Play" edition of Rocksmith 2014 that, in Ubisoft's words, "replaced all licensed songs" with a collection of tracks and exercises.

The Rocksmith 2014 Steam description states the title was "temporarily removed due to the expiration of our music licensing deals" and that Ubisoft replaced all licensed songs.

The Slopsmith tool

According to Ubisoft's notice, Slopsmith is an open-source project "designed to operate against the user's installation of Rocksmith 2014." It opens the game's encrypted .psarc archive containers, decrypts the .sng note-chart files, and converts them "into XML for the highway renderer" that draws the scrolling notes. The notice also quotes the project's own module docstring, which states a bundled plugin will "Extract Rocksmith 2014 base game songs from songs.psarc into individual CDLC PSARCs." Player-made custom songs for Rocksmith 2014, known as CDLC, are distributed through community hubs such as CustomsForge, whose guidelines require uploaders to confirm they "have acquired the legal rights to the songs in the CDLC that you upload or download."

Takedown notice

The notice named four primary repositories: github.com/byrongamatos/slopsmith, byrongamatos/slopsmith-desktop, byrongamatos/Rocksmith2014.NET, & hestealin/slopsmith. Ubisoft answered GitHub's licensing question "Is the work licensed under an open source license?" with "No," and stated the requested remedy as "Reported content must be removed."

The four asserted protection measures

Ubisoft described four technological protection measures it applies to Rocksmith 2014, each using a different AES-256 key embedded in the game client (the keys are redacted in the published notice). The first is PSARC archive encryption in CFB mode, which protects the outer container holding audio, note charts, manifests, and artwork. The second is SNG note-chart encryption on the PC build, in CTR mode. The third is the same SNG scheme on the Mac build, keyed differently. The fourth is EVAS profile encryption in ECB mode, which protects player progression and save data. Ubisoft asserted that all four "effectively control access ... within the meaning of 17 U.S.C. § 1201(a)(3)(B)," and alleged that Slopsmith violated the anti-trafficking provisions at 17 U.S.C. § 1201(a)(2) and § 1201(b)(1).

Ubisoft's notice describes four AES-based protection measures on Rocksmith 2014 and asserts they "effectively control access ... within the meaning of 17 U.S.C. § 1201(a)(3)(B)."

README edits and the demand to remove entire repositories

Ubisoft flagged that the Slopsmith README had been edited between its audit and the filing to soften direct references to the game, replacing "official Rocksmith DLC" with "official song packs" and "CDLC" with "custom songs." The notice stated that the README at HEAD on May 25, 2026 still disclosed the underlying conduct and that the plugin module docstrings were unchanged. For each named repository, Ubisoft confirmed that "The entire repository is infringing" rather than listing individual files.

Scope and forks

GitHub did not limit the takedown to the four primary repositories. The notice records GitHub's reasoning verbatim.

Because the reported network that contained the allegedly infringing content was larger than one hundred (100) repositories, and the submitter alleged that all or most of the forks were infringing to the same extent as the parent repository, GitHub processed the takedown notice against the entire network of 131 repositories, inclusive of the parent repository.

The notice itself lists more than 150 individual fork URLs across the /slopsmith and /slopsmith-desktop networks, most of them owned by individual GitHub users. Under GitHub's policy, a fork is a distinct repository, so users who had clicked "fork" to keep a personal copy received takedown notices when the network was processed. Ubisoft attested that "all or most of the forks are infringing to the same extent as the parent repository."

GitHub's determination

GitHub published the notice with a preamble that separates Ubisoft's anti-circumvention theory from the copyright grounds on which the content was removed.

While GitHub did not find sufficient information to determine a valid anti-circumvention claim, we determined that this takedown notice contains other valid copyright claim(s).

GitHub's published preamble states it "did not find sufficient information to determine a valid anti-circumvention claim" and processed the takedown against the "entire network of 131 repositories."

GitHub did not act on the 17 U.S.C. § 1201 theory that occupies most of Ubisoft's notice, and it did not state which "other valid copyright claim(s)" carried the removal. Before disabling the content, GitHub contacted owners of some or all of the affected repositories to give them a chance to make changes and provided instructions for submitting a DMCA counter-notice.

Section 1201 context

The anti-circumvention provision Ubisoft invoked, 17 U.S.C. § 1201(a)(1)(A), states that "No person shall circumvent a technological measure that effectively controls access to a work protected under this title."

Section 1201(a)(1)(A) of Title 17 provides that "No person shall circumvent a technological measure that effectively controls access to a work protected under this title."

The statute defines circumventing such a measure at § 1201(a)(3)(A) as "to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner." Separate provisions at § 1201(a)(2) and § 1201(b)(1), the two Ubisoft cited, bar trafficking in technology primarily designed to circumvent such measures.

Section 1201 also directs the Librarian of Congress, on the recommendation of the Copyright Office, to grant temporary exemptions every three years for classes of works where the prohibition harms non-infringing uses. The most recent triennial exemptions were issued in October 2024. GitHub processed an earlier Rocksmith-related DMCA notice in October 2016, before the 2023 delisting and the 2026 Slopsmith filing.

See also

• Ubisoft
• Rocksmith
• Digital Millennium Copyright Act
• GitHub