Following the DOJ's brazen collection of info on AP reporter phone calls, we noted that it was not the first time the DOJ had been overly aggressive in going after reporters. Now, the Washington Post has another horrifying story, talking about the DOJ's investigation into a leak from the State Department to Fox News concerning classified info on North Korea. That investigation resulted in charges against Stephen Jin-Woo Kim, a State Department security adviser, but the investigation included heavy surveillance of James Rosen, the Fox News reporter. They obtained his phone records, security-badge data and email exchanges. In order to get all this, they claimed that Rosen wasn't just a reporter, but "an aider and abettor and/or co-conspirator" in the crime itself. For doing basic reporting.

By now it should be abundantly clear that this has little to do with protecting national security, and everything to do with a war on investigative reporting about the federal government. Almost everything seems to be designed to threaten reporters, and to put the fear of the federal government into any whistle blower who might have information to pass on to a reporter. As people have pointed out, what Rosen did in this case is what any national security reporter does all the time. Others have pointed out that this shatters the basic concept that those who report on the news are protected by the First Amendment in doing so.

The Reyes affidavit all but eliminates the traditional distinction in classified leak investigations between sources, who are bound by a non-disclosure agreement, and reporters, who are protected by the First Amendment as long as they do not commit a crime. (There is no allegation that Mr. Rosen bribed, threatened or coerced anyone to gain the disclosure of restricted information.)

And, not surprisingly, this tactic of going to war with reporters appears to be working.

Mark Mazzetti, who covers national security for the New York Times — one of several leading investigative reporters I reached out to today — says he is experiencing a greater reluctance on the part of sources to talk to him.

"There's no question that this has a chilling effect," Mazzetti said. "People who have talked in the past are less willing to talk now. Everyone is worried about communication and how to communicate, and [asking if there] is there any method of communication that is not being monitored. It's got people on both sides — the reporter and source side — pretty concerned."

The end result, of course, is less ability to keep government abuses -- of which there appear to be many -- in check.

You may recall that Prenda had (not surprisingly) gone crazy overboard with subpoenas in its attempt to intimidate some anti-copyright troll bloggers and their commenters. The EFF stepped in and asked a court to quash the subpoena, which the court has now done, in large part because Prenda never even bothered to respond.

As of this date, no responsive memorandum has been filed. LRCiv 7.2(i) provides in part “if the opposing party does not serve and file the required answering memorandum, ...such noncompliance may be deemed a consent to the denial or granting of the motion and the Court may dispose of the motion summarily.” Pursuant to this rule, the Court deems Plaintiff's failure to serve and file the required answering memorandum a consent to the granting of Defendant-Movant's Motion to Quash the Subpoena to Wild West Domains Seeking Identity Information.

I guess Prenda's a bit busy. Or someone there realized this subpoena had zero chance of actually going forward. Either way, the subpoena is dead.

This is rather incredible. We already wrote about Prenda Law's series of defamation lawsuits against commenters on two key blogs that have been instrumental in exposing their shenanigans: FightCopyrightTrolls and DieTrollDie. While John Steele has dismissed his claim, the other two suits are still moving forward as far as I know. And now it's come out that Prenda Law's Paul Duffy sent a ridiculously broad subpoena to Wordpress demanding every IP address of every visitor who has visited either site since the beginning of 2011. Basically, they're looking for everyone who has ever visited either site:

Our client is requesting all Internet Protocol addresses (including the date and time of that access in Universal Coordinated Time) that accessed the blogs located at dietrolldie.com and fightcopyrighttrolls.com between January 1, 2011 through the present. Please provide this information in an Excel spreadsheet.

The subpoena is from Paul Duffy, so it's a bit ridiculous to claim "our client" since he is the client. This seems like a pretty clear abuse of the subpoena process, though, coming from Prenda Law, whose specialty is doing anything it possibly can to get IP addresses, perhaps it's no surprise. The subpoena was issued in association with the original claim that was filed in state court. The cases have all been removed to federal court, and hopefully the lawyers at Wordpress know better than to just cough up this info like that. Even more ridiculously, Duffy tries to claim that this is an "emergency" so they shouldn't waste any time in handing over the info:

Due to the emergency nature of the requested information, it is imperative that your organization responds to the subpoena immediately. The requested information is perishable and vital to the claims asserted in a complaint alleging widespread and systematic defamation.

What hogwash. They're looking for data going back to January of 2011. If Wordpress has logs going back that far, it's not like they're suddenly going to disappear. And, of course, the "widespread and systematic defamation" claims are already pretty questionable.

It's not difficult to look at this and see a likely attempt at creating chilling effects to try to scare people off from visiting those sites. Considering that Prenda has been collecting all sorts of IP addresses in its various copyright trolling lawsuits, can you imagine what they might do if they can cross reference IP addresses of visitors to those sites with the IP addresses they've already sued over?

Earlier this month, we noted a problematic attempt by Grooveshark's parent company, Escape Media, to subpoena information on an anonymous commenter on the blog site Digital Music News. As we noted at the time, Universal Music had referenced that comment in its lawsuit against Grooveshark. It seemed bizarre to reference an anonymous comment, especially one that seemed like pure hearsay (it made claims about things Grooveshark employees had done). In the lawsuit between UMG and Grooveshark it seemed completely pointless (and, indeed, Grooveshark has been arguing as much in that particular lawsuit). Yet, at the same time, Grooveshark subpoenaed DMN in an attempt to find out who posted that comment. DMN resisted the subpoena, noting that it discards and overwrites its log files every few days anyway, and these files had been long gone already. It also pointed to California's shield law for journalists and the basic First Amendment protections for anonymous speech.

Unfortunately, the judge has ruled against Digital Music News, and ordered it to produce the information. The judge has indicated that he will not require this information during the appeal that DMN's lawyer indicated they would file... but did require "preservation" of the evidence during that time. Beyond the shield law and First Amendment issues raised here (we'll get to those), this raises a very, very troubling proposition for any website that regularly overwrites its log files. Escape Media had argued that even if DMN overwrote the log files, it should be required to hand over the information on the subpoena just in case the overwritten data was still available and could be recovered.

So, what do you do in this situation? Under the judge's order to "preserve" data that has already been deleted, what is a site to do? Do they have to immediately stop using their existing hardware and set up an entire clone -- hanging onto all of the original hardware for who knows how long, just in case a forensics expert can find a tiny piece of (useless for this case anyway) data that has been overwritten probably a hundred times already? That seems crazy. Paul Levy, from Public Citizen, who is representing DMN on this issue, highlighted many of the issues in his blog post about this:

The imposition of data preservation requirements on a journalist who is not a party to the litigation raises questions apart from the merits of the order. Journalists need to be able to discard data when they no longer have any of their own use for it.  Yes, “the public has a claim to every man’s evidence,” but don’t members of the public who are not involved in litigation have the right to discard information despite the fact that it might turn out to be useful evidence for somebody else’s case?  Does the public have a claim to heroic efforts on every man’s part?  Shouldn’t there be higher standards for subpoenas demanding intrusive searches for discarded data in the hands of third parties?

The problem is compounded when it is a journalist that has been subpoenaed.  To what extent does society have any entitlement to make journalists in particular take heroic measures, such as searching the nooks and crannies of their computer equipment for fragments of discarded data?  The judge was sensitive to the fact that our client here is a journalist, telling Escape Media that he was not prepared to allow it to make any general search of Digital Music News’ computers.  But an issue that we may have to pursue on appeal is whether a journalist should ever have to undertake such drastic preservation efforts in aid of a lawsuit in which he is not involved, particularly given the relative unlikelihood that fragments of identifying data remain on his computers somewhere.

Indeed, the problem is broader than just journalists.  Companies often keep log files with respect to server visits (and hosted comments), but there is little business justification for keeping those logs forever; so generally speaking they are discarded after a period of time (EFF's best practices recommendations are worth a look in this regard).  Does the mere act of discarding log files set a company up for the possibility of a demand for forensic examination of the underlying servers, in the hope that some fragment of the data might be recovered?  In this regard, the trial court's order has chilling implications for other California companies, even beyond the issue of journalists. 

Issues of how to preserve the data remain to be decided.  This is not like just leaving one of your file cabinets untouched for a period of time; it is not even as easy as making sure you don't delete any of your email.  Preserving the web site while creating a copy of the underlying servers is a complicated process, requiring the services of a forensic specialist, and the cost could be substantial.  The estimates that we have been given are well into the five figures; but even the cost of several thousand dollars would be an enormous imposition on this small company.

It really is quite a difficult issue, and if the ruling stands, could become a massive headache for any company in California.

Separately, we should not ignore the First Amendment and shield law issues. DMN is not a party in this case, and it's not even clear why this information is needed. Escape/Grooveshark can and should point out that the information contained in the comment is pure hearsay so it shouldn't have to deal with it in the original case. The company has not filed a defamation claim against the commenter and does not appear to have met the high bar required to unveil an anonymous commenter anyway. This is a pretty big concern for any journalist or blogger out there. Being dragged into a third party dispute because someone comments on your site can represent a pretty big problem for a lot of smaller sites.

While Grooveshark's legal fight against the major labels certainly raises some interesting copyright questions, it's disappointing to see them going down this path and potentially creating serious problems not just for Digital Music News, but tons of journalists and websites.

When you receive an official law enforcement document/request, like a subpoena, it can actually be pretty scary. An official-looking document from a court in association with law enforcement may leave many people with the impression that they absolutely have to comply. While there are circumstances in which you do need to comply, you can often fight back. Tragically, many companies don't. They just roll over and hand over the info, even if it violates their own policies (and sense of right and wrong). There are (unfortunately few and far between) cases like Twitter, who has shown a willingness to fight for user privacy, but it's still a tough issue for many companies.

Shawn Sims points us to the interesting story of how the popular electronics company Sparkfun publicly explained how it dealt with a very broad subpoena demanding all sales information on sales made to addresses in Georgia over a six month period. The reasoning was that a Sparkfun device was found as a part of a credit card skimmer device.
Sparkfun CEO Nate Seidle explains that the subpoena came after an initial call requesting the same info, where the company politely refused to provide the info, noting its support of the privacy rights of its consumers. As Seidle noted, no one supports card skimming, but there are issues of principle here:

I want to be very clear: creating devices that steal credit card numbers are illegal and cause pain for a lot of people. We know our parts can be used for good or for evil. We have zero tolerance for those who use them for evil. I will offer our technical services to any law enforcement that may need help reverse engineering a device. It is obvious the law enforcement agency is requesting this information to put a stop to this activity. However, I also believe strongly in the right to privacy and the protection of personal data.

After talking to their lawyers, and realizing that you don't have to fully comply with a subpoena -- but also that a subpoena can turn into a warrant which you do have to comply with -- the company worked with the law enforcement to try to limit the type of information requested, and eventually came to a compromise:

Please read the subpoena carefully. The request for 'all orders' seemed like they were casting a very wide net without cause. Discussing this issue with our counsel and working with the law enforcement agency, we agreed to obtain the orders that had the product on it, not all orders as required by the subpoena. This ended up being about 20 orders. In my opinion, one order is too much information. While I believe this legal process protects us all from wrong doing, turning over any piece of data goes against every fiber in my being. But without any further legal options, I made the decision to turn over the sub set of data.

I want everyone to know that we take your data and privacy extremely seriously. We guard it with the highest levels of security and confidentiality. If we are legally forced to turn over data, we promise you we will work with the law enforcement agency to do everything in our power to limit the amount of information released.

This is a tough position to be in -- and you can certainly argue that the company could have (or perhaps should have) continued to fight the subpoena. But in the end, it's likely that it would have to turn over the info eventually no matter what. At the very least, you have to respect the company for being totally transparent and open about what happened and why (and how Seidle personally felt). Plenty of other companies would hand over the data and then never discuss the issue publicly ever.

We recently wrote about Twitter's decision to stand up for a user in court, fighting against a court ruling that said that a user has no proprietary interest in their own tweets and info, such that those users cannot contest a government attempt to subpoena information from Twitter. This is not the first time that Twitter has aggressively stood up for its users' rights against government excess -- in a world where that's quite rare. When the government comes calling, most companies roll right over. In response to this, the folks over at Fight for the Future have put together a petition page, asking people to sign up to thank Twitter. If they get 50,000 people to sign, they'll present Twitter with a medal for defending the internet (these medals are awesome).

Given that internet petitions are often done in protest of something or against something, I really like this idea of effectively getting people to sign on for something positive and celebrate a company that does its best to protect the interests of its users. If you agree, head on over and sign up to thank Twitter.

We've covered parts of the various lawsuits against Grooveshark by the recording industry. I have no idea how those lawsuits are going to turn out, but a bit of a sideshow in one is touching on issues that are extremely important around here: the right to protect anonymous commenters, and shield laws protecting journalistic sources. Last fall, in the latest effort by Universal Music against Grooveshark, the company quoted an anonymous comment from a blog post on the popular music industry blog, Digital Music News. The comment claimed to be from an employee at Grooveshark, and reads (in part):

I work for Grooveshark. Here is some information from the trenches:

We are assigned a predetermined ammount of weekly uploads to the system and get a small extra bonus if we manage to go above that (not easy).The assignments are assumed as direct orders from the top to the bottom, we don't just volunteer to "enhance" the Grooveshark database.

All search results are monitored and when something is tagged as "not available", it get's queued up to our lists for upload. You have to visualize the database in two general sections: "known" stuff and "undiscovered/indie/underground". The "known" stuff is taken care internally by uploads. Only for the "undiscovered" stuff are the users involved as explained in some posts above. Practically speaking, there is not much need for users to upload a major label album since we already take care of this on a daily basis.

To be honest, when I saw the original filing mentioning this comment, I was pretty surprised that Universal would use it in the lawsuit. After all, it's an anonymous comment on a blog. It's pure hearsay, without any actual evidence that the commenter actually works at Grooveshark. It's completely useless as evidence.

Of course, you might think that Universal Music would then issue a subpoena to discover who the commenter was. But... instead Grooveshark issued a subpoena (pdf and embedded below) seeking to identify the commenter. This is also strange. If UMG was able to identify the individual, then Grooveshark would find out that info. But if (as appears to be the case so far) UMG does nothing, the claims by this individual are useless in the lawsuit anyway.

Either way, Paul Resnikoff from Digital Music News worried about the subpoena, as DMN has a policy of not revealing its anonymous commenters (and often using them as sources). So, he decided to push back, noting a few key points. Public Citizen's Paul Levy recently agreed to represent Resnikoff in this matter and sent a letter to Grooveshark's parent company (embedded below) detailing why Grooveshark should stop barking up this particular tree. Beyond the First Amendment issues, the right of a journalist to protect sources, and the uselessness of the original comment in the first place, there's also the simple fact that DMN doesn't retain comment logs for very long, and has no useful information in response to the subpoena anyway.

That letter also highlights that Grooveshark is also interested in a much more recent comment on a blog post about Grooveshark's subpoena, in which a commenter (in a rather difficult to read manner) spins another conspiracy theory, suggesting that the original comment was a setup against Grooveshark by supporters of the lawsuit. To be honest, this comment seems about as credible as the original comment that kicked this off.

Whatever you might think of the Grooveshark lawsuit, this action by Grooveshark's lawyers seems like a mistake and overkill. Not only is it unlikely to turn up anything useful, going on a fishing expedition against anonymous commenters on a blog opens up a huge host of problems around First Amendment issues, which it appears Grooveshark either failed to consider, or doesn't much care about. That seems like a mistake.

We've been hearing more and more stories about the government being extra secretive in so many things, avoiding scrutiny at every turn, and here's yet another example. You may have heard that, last month, the Boston police, along with a Massachusetts ADA, sent a vague and broad subpoena to Twitter, demanding "all available subscriber info... including address logs for account creations," for any activity between December 8th and December 13th, 2011 for the following list:

• Guido Fawkes
• @p0isAn0N
• @OccupyBoston
• #BostonPD
• #d0xcak3

This is kind of a weird list. While the second and third items on the list are usernames, the rest are not, so it's not entirely clear what Twitter would need to send in response to those requests. #BostonPD, in particular, is a bit weird, since it's just a tag. It seems like the police are fishing for any info on anyone who used that hashtag over a five day period.

Either way, the subpoena asks Twitter to keep the subpoena itself secret:

In order to protect the confidentiality and integrity of the ongoing criminal investigation, this office asks that you not disclose the existence of this request to the subscriber as disclosure could impede the ongoing criminal investigation.

However, it appears that Twitter did, in fact, forward the subpoena on to the user @p0isAn0N, who posted it publicly. That resulted in the ACLU jumping on board to represent the anonymous user of that account and to protect the subpoena... leading to a bizarre and Kafkaesque hearing in which the case itself was never even named and the government representatives conferred privately (without the other side's lawyers) for an extended period of time, and then everything was put under a gag order for the parties who did hear what was going on. I'll let Kade Crockford from the ACLU explain the situation. He had gone to the court to hear what happened and basically heard a lot of nothing:

We entered the courtroom. I sat in the front row, behind the bar. Presiding Judge Carol Ball called our cooperating attorney Peter Krupp’s name, and the Assistant District Attorney’s name. She did not call out the name of the case to begin the proceedings, as is custom.

The ADA approached the sidebar, the area adjacent to the judge’s perch, far enough away from us, the general public, that we couldn’t hear the content of the hushed conversation spoken there. Krupp objected immediately, before even approaching the bench; he wanted the case heard in open court. (The judge had already sealed the proceedings the day before, pending a hearing this morning.) Krupp’s objection was not granted. Our legal team therefore approached the sidebar, joining the judge and the prosecution.

Then we among the general public, including journalists from all the major media outfits in Boston, listened and heard nothing, as the prosecutors, our lawyers and the judge conversed secretly, in plain sight. I have no idea what they said. I still don’t know, because my colleagues, lawyers at the ACLU of Massachusetts, are prohibited by court order from telling me.

So all I know is what I saw. As Donald Rumsfeld said, there are known knowns, known unknowns and unknown unknowns. After the proceedings this morning, I’m left with little of the former, and a whole lot of the latter two.

The known knowns: the scrum of lawyers, defense and prosecution, addressed the judge. I saw the judge speak to the lawyers. Then I saw our attorneys return to their bench, closer to where I was sitting, out of earshot of the sidebar. But the ADA stayed with the judge. He spoke to her, with his back to the courtroom, for about ten minutes. Our attorneys didn’t get to hear what he said to her, didn’t have a chance to respond to whatever the government was saying about our client, about the case. It was frankly shocking.

After those ten minutes of secret government-judge conversation, our attorneys were invited back to the sidebar, whereupon the scrum of lawyers spoke with the judge for another ten or fifteen minutes. Then they dispersed. The judge uttered not one word to the open court. And that was it.

After this, the lawyers for the ACLU were only able to say that they couldn't say anything. They couldn't say what the judge said or decided. They couldn't say if the judge granted the ACLU's motion to quash the subpoenas. Basically, the public knows nothing. The government, I'm sure, insisted that this was all a matter of great importance and a criminal investigation for which it must be kept secret -- but it's getting more and more difficult to believe the government when it keeps trying to brush pretty much everything it can under the rug. Furthermore, if this were truly a key criminal investigation, shouldn't the subpoena have actually been narrowly focused on the key issue, rather than seeking subscriber info on everyone who used the hashtag #BostonPD?

Remember the Thomas M. Cooley law school? The school, generally considered a 4th tier bottom of the barrel law school, made some news last month by suing some anonymous critics, who appeared to be unhappy former students blogging about the school. The school has also been sued for apparent misleading employment stats. Of course, somewhat related to all of this is the ridiculously laughable attempt by Thomas Cooley to hide its poor reputation by creating its own ranking system that puts itself as the number 2 law school in the country. Of course, its ranking methodology leaves a lot to be desired, using things like "total law school square footage," and "total volumes in library," and giving them equal rank to things like "bar passage rate" and "employment upon graduation."

Anyway, the lawyer representing Cooley, Michael Coakley, who attended the (according to Cooley itself) far inferior law school of the University of Michigan, apparently decided to take some questionable steps in identifying one of the bloggers in question. Initially, he had filed a subpoena on the ISP via the Michigan state court where the case is pending, demanding identifying info. The blogger's lawyer, John Hermann, filed a motion to quash the subpoena. While the court was still considering that, Coakley went and had another subpoena for info served via California. While the ISP (more on that in another post) had promised Hermann that it would not divulge the info while the motion to quash was being considered, and then told him it wouldn't do anything before August 22nd, it apparently handed over the info on August 17th.

Coakley then sent Hermann a letter saying that since the ISP had already identified the blogger from the second subpoena, Hermann's motion to quash the original subpoena was moot, and threatened to ask for sanctions against Hermann if he didn't drop it. He also threatened to reveal the blogger's name in a public court filing, if Hermann and the blogger did not agree to certain conditions and provide certain info.

Of course, all of this is of dubious ethics and legality. As Paul Alan Levy explains via the link above:

In fact, because Coakley knew that he had obtained this information in the face of a pending motion to quash the subpoena asserting that the Doe had a First Amendment privilege to speak anonymously, he not only had no right to obtain had no right to use the information against Doe, but he had an obligation to return the information pending a resolution of the discovery dispute.  That is because Michigan, like most jurisdictions, has a discovery rule protecting against the misuse of information that has been obtained despite a claim of privilege.  In Michigan, Rule 2.302(B)(7) provides that

•     If information that is subject to a claim of privilege or of protection as trial-preparation material is produced in discovery, the party making the claim may notify any party that received the information of the claim and the basis for it.  After being notified, a party must promptly return, sequester, or destroy the specified information and any copies it has and may not use or disclose the information until the claim is resolved.  A receiving party may promptly present the information to the court under seal for a determination of the claim.  If the receiving party disclosed the information before being notified, it must take reasonable steps to retrieve it.  The producing party must preserve the information until the claim is resolved.

Because Coakley is the head of the litigation department at a prominent Detroit law firm, he must have been aware of this rule.  In fact, his letter could be read as expressing some defensiveness about his obligations, because he began by emphasizing that the disclosure really wasn’t his fault: the disclosure had occurred, he said, “without direction from us (other than the subpoena itself).”  But the California subpoena was served after the motion to quash was filed in Michigan, and the threat to use the privileged information to exact concessions from Doe, and the subsequent filing of an amended complaint and other papers prominently displaying Doe’s name, seem to have been deliberate violations of the rule.  Coakley has not responded to my requests for information and for comment on my concerns.

Given how marginal his client's defamation claims against the Doe are, Coakley may have felt he had no choice but to skirt the ethical edge by violating this rule.  (The linked complaint, which was a draft attached to Coakley's demand letter, reflects a false name; by the time it filed the amended complaint, it had used the disclosure to identify the Doe and put that name in the complaint).  Coakley markets himself to potential clients by proclaiming his reputation as “a scrapper in protecting their  interests.”   As I see it, Coakley’s scrappiness took him a few steps too far in this case.

Thankfully, the court seems to recognize this somewhat questionable activity on the part of Coakley, and has ruled that the disclosed information should be sequestered, and the papers filed in the case naming the blogger should be stricken from the record. Still, even if this lawyer isn't a Cooley grad, these actions certainly don't reflect well on Cooley as a law school.

I've noticed in the last couple years that major telcos have really ramped up their customer service. I've had very positive exchanges with folks at Sprint and AT&T -- two companies, which used to have reputations for horrible customer service. Sprint, in particular, appears to have made it abundantly clear to customer service agents that they should bend over backwards to help customers. Apparently, Verizon has gone in a different direction. A woman, who called Verizon to try to find out about the $4.19 she was being charged for six local calls, was told by Verizon reps that the only way it would provide her an itemized bill was to get a lawyer and have the lawyer get a subpoena to force Verizon to disclose the information.

Instead, the woman went to court (by herself) and a judge told Verizon to hand over the itemized bill info.

It is a basic matter of fair business practice that a consumer should be able to contact a utility about a charge on a bill and learn what the charge is for and learn that the charge was correctly applied. The only verification that Verizon's witness could offer that a charge like [the customer's] $4.19 measured use charge was accurate and billed correctly was her faith in the accuracy of Verizon's computer system. The only way that Verizon would offer any information about a past charge in response to a consumer inquiry was to require that customer to hire a lawyer and subpoena their own usage information. By no reasonable standard could this be considered reasonable customer service.

The judge has also suggested Verizon should be fined $1,000 for its failure here, and that suggestion will be reviewed by the Pennsylvania Public Utility Commission.