On or about September 6, 2012, Verizon received subpoenas from plaintiff AF Holdings in AF Holdings v. John Doe, C.D. Cal. Case No. 12-cv-6669 and AF Holdings v. John Doe, C.D. Cal. Case No. 12--cv--6636. ...Verizon processed these subpoenas in the ordinary course.

Based on Verizon's records, it does not appear that Verizon received from AF Holdings or its counsel a copy of the Court's Order Vacating Prior Early Discovery Order and Order to Show Cause dated October 19, 2012, nor does it appear that Verizon received other form of notice that the subpoenas attached as Exhibits A and had been withdrawn or were invalid. If Verizon had received such notice, we would not have processed these subpoenas for AF Holdings.

I have reviewed a declaration filed by Brett Gibbs in this litigation, dated February 19, 2013, in which Mr. Gibbs states:

Following receipt of the October 19,2012 Orders, I caused the Court's October 19, 2012 Orders to be served on the registered agents for service of process of Verizon Online ensure that Verizon Online LLC had notice not to respond to the subpoenas that had already been served.

(Gibbs Decl. dated Feb. 19, 2013...) Again, based on Verizon's records, this statement appears to be wrong.

Verizon released the information responsive to AF Holdings' subpoenas in the cases identified above (case nos. 12-cv-6669 and 12-cv-6636) by fax to the Prenda law firm on November 7, 2012. If Verizon had received notice of the Court's Order dated October 19, 2012, we would not have released these records to Plaintiff.

Subscribers' contentions fail for several reasons. First, the record shows that the magistrate judge considered the stated public interests and found that the Government's interests in maintaining the secrecy of its investigation, preventing potential subjects from being tipped off, or altering behavior to thwart the Government's ongoing investigation, outweighed those interests.

Further, we agree with the magistrate judge's findings that the common law presumption of access to § 2703 orders is outweighed by the Government's interest in continued sealing because the publicity surrounding the WikiLeaks investigation does not justify its unsealing. The mere fact that a case is high profile in nature does not necessarily justify public access.... Additionally, Subscribers' contention that the balance of interests tips in the public's favor because the Government approved the disclosure of the existence of its investigation by moving the district court to unseal the Twitter Order is adequately counterbalanced by the magistrate judge's finding that the "sealed documents at issue set forth sensitive nonpublic facts, including the identity of targets and witnesses in an ongoing criminal investigation."

68 percent of the requests Google received from government entities in the U.S. were through subpoenas. These are requests for user-identifying information, issued under the Electronic Communications Privacy Act (“ECPA”), and are the easiest to get because they typically don't involve judges.

To Julian Sanchez, a research fellow at the Cato Institute, the real scandal over the Petraeus affair is not the extramarital sex, but the invasion of privacy.

"Law enforcement and certainly intelligence agencies have an incredible amount of ability to gather huge volumes of detailed information about people's most intimate online communications, a lot of it without requiring a full-blown warrant, a lot of it without requiring even any kind of judicial approval," Sanchez said.

The guest lists from hotels, IP login records, as well as the creative request to email providers for “information about other accounts that have logged in from this IP address” are all forms of data that the government can obtain with a subpoena. There is no independent review, no check against abuse, and further, the target of the subpoena will often never learn that the government obtained data (unless charges are filed, or, as in this particular case, government officials eagerly leak details of the investigation to the press). Unfortunately, our existing surveillance laws really only protect the “what” being communicated; the government’s powers to determine “who” communicated remain largely unchecked.

For more than a decade, a persistent myth in Washington DC, fueled by several counterterrorism experts, has been that it is possible to hide a communications trail by sharing an email inbox, and instead saving emails in a “draft” folder. This technique has been used by Khaled Sheikh Mohammed, Richard Reid (the shoe bomber), the 2004 Madrid train bombers, terrorists in Germany, as well as some domestic “eco-terrorists.” This technique has appeared in federal court documents as early as 2003, and was described in a law journal article written by a DOJ official in 2004. It is hardly a state secret.

Apparently, this method was also used by General Petraeus. According to the Associated Press, “[r]ather than transmitting emails to the other's inbox, they composed at least some messages and instead of transmitting them, left them in a draft folder or in an electronic ‘dropbox,’ the official said. Then the other person could log onto the same account and read the draft emails there. This avoids creating an email trail that is easier to trace.”

The problem is, like so many other digital security methods employed by terrorists, it doesn’t work. Emails saved in a draft folder are stored just like emails in any other folder in a cloud service, and further, the providers can be compelled, prospectively, to save copies of everything (so that deleting the messages after reading them won’t actually stop investigators from getting a copy).

Ironically enough, by storing emails in a draft folder, rather than an inbox, individuals may be making it even easier for the government to intercept their communications. This is because the Department of Justice has argued that emails in the “draft” or “sent mail” folder are not in “electronic storage” (as defined by the Stored Communications Act), and thus not deserving of warrant protection. Instead, the government has argued it should be able to get such messages with a mere subpoena.

The spark that set events in motion was a handful of allegedly harassing emails sent anonymously to Kelley, a friend of Petraeus's, which she brought to a friend at the FBI. Yet it's unclear why an investigation was ever opened, given that everything publicly known about the emails suggests they weren't illegal.

As the Daily Beast reported, they said things like "Who do you think you are? ... You parade around the base ... You need to take it down a notch." The story noted, "when the FBI friend showed the emails to the cyber squad in the Tampa field office, her fellow agents noted that the absence of any overt threats."

It seems the deciding factor in opening the investigation was not the emails' content, but the fact that the FBI agent was friendly with Kelley. (Even more disturbing, the same FBI agent has now been accused of becoming "obsessed" with the Tampa socialite, sent shirtless pictures to her, and has been removed from the case.)

When the FBI friend showed the emails to the cyber squad in the Tampa field office, her fellow agents noted that the absence of any overt threats.

“No, ‘I’ll kill you’ or ‘I'll burn your house down,’” the source says. “It doesn’t seem really that bad.”

The squad was not even sure the case was worth pursuing, the source says.

“What does this mean? There’s no threat there. This is against the law?” the agents asked themselves by the source’s account.

At most the messages were harassing. The cyber squad had to consult the statute books in its effort to determine whether there was adequate legal cause to open a case.

“It was a close call,” the source says.

As Mastro played a series of outtakes for Judge Kaplan, Donziger’s outspokenness was on full display. He riffed, indignantly, about the inadequacies of the Ecuadoran legal system. “They’re all corrupt,” he says of Ecuadoran judges in one clip. “It’s their birthright to be corrupt.”

... In one scene, a scientific expert for the plaintiffs tells him that one measurement of groundwater contamination was not as strong as he had thought. “This is Ecuador, O.K.?” Donziger says. “At the end of the day, if there’s a thousand people around the courthouse you’re going to get what you want.” As for the scientific data, he adds, it’s “just a bunch of smoke and mirrors and bullshit.”

[...] In another scene that Mastro showed to the court, Donziger chats with associates over dinner at a restaurant. Someone at the table, referring to the popular antipathy toward Chevron in Ecuador, suggests that if the judge in Lago Agrio ruled against the plaintiffs he might be killed.

“He might not be,” Donziger replies, cradling a glass of red wine. “But he thinks he will. Which is just as good.”

I will likely never know why Chevron subpoenaed me. But I do know that it is unacceptable for a party to litigation to try to obtain private information from a blogger-journalist who has criticized its tactics. This is not about my journalistic freedom; it is about the journalistic freedom of all bloggers. And it is not about Chevron; it is about any party that thinks it is acceptable to subpoena a blogger’s private information. I would be no less critical of an attempt by Greenpeace to subpoena Glenn Reynolds. Tactics like this need to be exposed and resisted, no matter who uses them or whom they target; passive acquiescence is simply an invitation to further abuses.

I also think that Google needs to do far more to protect the privacy of its users.  Twitter has been very active in resisting attempts to obtain its users’ private information.  Google has also done so in the past, but it did nothing to help me, even after I informed it via email that I was a law professor and a blogger-journalist.  But again, this isn’t about me.  It’s about all the other bloggers who might find themselves facing a similar subpoena.  I’m lucky: I have friends like Glenn Greenwald to ask for help. I’m sure that the ACLU would assist anyone in my position — but not everyone knows that the ACLU is out there, much less that no case is seemingly too small or too unimportant for them to be concerned.  More importantly, the ACLU should not have to get involved in every case like this one (and again, I am but one of 44 people named in the subpoena); Google itself — and all other service providers in similar situations — need to be the first line of defense.

Notice is hereby given that Evan Stone, a subject of a sanctions motion filed by attorneys ad litem after termination of their ad litem appointment, appeals now to the United States Court of Appeals for the Fifth Circuit from the sanctions order entered September 9, 2011 (Dkt. 17), which finally disposes of the only remaining issue in this case.

Weebly’s first point to me was that its email to Hermann saying that he could consider the subpoena “squashed at this point” really wasn’t intended to make any commitments — Hermann has been writing “over and over” about keeping his client’s identity private, and “I had no idea what he was talking about, so I said it’s ‘squashed for now’ just so he’d leave me alone.”

Weebly also said that after it got the California subpoena, it told Hermann that he would actually need to get a ruling from the judge quashing that subpoena no later than August 22, or it would have to obey the subpoena. I have two problems with that — first, even the subpoena did not require compliance until August 25, and the information was furnished on August 17. But more important, Weebly’s stance falls well short of the industry standard. In our experience, responsible ISP’s, such as Google, and Yahoo!, and Twitter, will simply insist to parties sending them subpoenas that they won’t comply with subpoenas to identify users if a motion to quash is filed within a given period, normally about two weeks.

Weebly also told me that the disclosure was made in part because Hermann gave shifting stories about whether the subpoena would be issued by a Michigan court or a California court. I found that argument unconvincing. Hermann was plainly uncertain about the actual subpoena documents, but I could not find the shifting accounts. And in any event, should discomfort with the Doe’s lawyer be a reason to shed the Doe’s privacy?

Next, Weebly said that its disclosures didn’t really matter because it did not provide the customer’s actual name, just an email address and various IP addresses. This is not the first ISP that has rationalized subpoena compliance on such grounds. I have got that line from Wikipedia twice, for example. But this case shows why the argument is delusional. The Doe was a former student at plaintiff law school, and the same email address that he gave Weebly was one that he has used while in law school. Thus, when plaintiff got the email address it was able to identify the Doe, and in fact it named the Doe in its amended complaint and cited his name throughout its opposition to the motion to quash.

Weebly’s final explanation to me struck me as the real reason, and it was perhaps the worst part of the explanation. Huffaker said, the subpoena came in on a day when I was out of the office, we have a small staff, we work long hours, we don’t have a lawyer on staff, we don’t get many subpoenas, and we strongly resist requests to remove material at the request of the targets of its customers’ criticism. All of this is understandable, and much of it praiseworthy, but to my mind, protecting customers’ privacy is also important, and if an ISP doesn’t have a lawyer, it has a responsibility to inform itself of the law governing subpoenas to identify customers and of the industry standard on responding to subpoenas. Moreover, although legal representation can be expensive, Public Citizen often represents smaller ISP’s pro bono in opposing subpoenas when the plaintiff does not meet the Dendrite test. Indeed, California has made it easy to fund the defense against subpoenas in these cases by passing a SLAPP-like law providing for awards of attorney fees; and Hermann made a point of suggesting that angle. Weebly says that it cares about protecting its customers, but it is hard to take those protestations seriously. Potential customers of Weebly, beware.

To summarize the staggering chutzpah involved in this case: Stone asked the Court to authorize sending subpoenas to the ISPs. The Court said “not yet.” Stone sent the subpoenas anyway. The Court appointed the Ad Litems to argue whether Stone could send the subpoenas. Stone argued that the Court should allow him to – even though he had already done so – and eventually dismissed the case ostensibly because the Court was taking too long to make a decision. All the while, Stone was receiving identifying information and communicating with some Does, likely about settlement. The Court rarely has encountered a more textbook example of conduct deserving of sanctions.

This argument also fails. Discovery proceeds in “normal fashion” according to the Rules of Civil Procedure. They provide that no discovery of any kind takes place prior to a Rule 26(f) conference unless the Court orders otherwise. Although Stone might believe that motions like the Discovery Motion are mere formalities and that courts routinely grant them, that misapprehension provides no basis for proceeding with preconference discovery without court order. The only “highly irregular” activity here is Stone’s disregard of the Rules and the Court’s orders, which would have constituted sanctionable conduct even if the Court eventually had granted the Discovery Motion.

Once Facebook has the form submitted, they will then prepare an archive for the police to review. That archive will include the following.

• User ID number
• Email address
• Date and Time of your account’s creation
• The most recent logins, usually the last 2-3 days
• Your phone number, if you registered it
• Profile contact info
• Mini-feed
• Status update history
• Shares
• Notes
• Wall posts
• Friends list
• Groups list
• Future and past events
• Videos
• Photos
• Private messages
• IP logs (computers and locations you logged in from)

You’ll notice that this list includes just about everything that you’ve posted to Facebook. In addition, it also includes a list of your Friends, which you didn’t technically add to Facebook yourself.

But there are some oddities here -- he claims that as a result of our filing, he has lost the opportunity to take discovery; does that mean that he believes our arguments are meritorious, and hence that his motion should be denied? After all, the judge ordered the ISP's to preserve identifying information for the Does, so it is not as if that information was going to disappear while he was waiting for a decision. And previously he claimed that these were 670 people who had seriously damaged his client by obtaining its copyrighted product illegally and then re-distributing it illegally. If his client has been injured, why has he dismissed the claims with prejudice, which means not only the client cannot bring suit in a proper jurisdiction but also that the Does are now prevailing parties who are entitled to seek an award of attorney fees under the Copyright Act?

My guess is that this is all about Evan Stone and not at all about his client. Stone's business model depends on easy settlements in the four figures, and he must have recognized that a win would not come easily. In my view, it is also fair to read the dismissal as an admission of our argument that he has no claim for fees and statutory damages. Thus, the litigation of the case on the assumption that he could use the threat of litigation to demand four figure settlements was no longer possible, and Stone may just have been unwilling to continue to represent his client without that possibility. Moreover, it seems likely that Stone worried about the possibility of a sanctions motion, and about having to answer questions incident to that motion about his communications with the ISPs and with the Does, and that he dismissed with prejudice in an effort to cut off such inquiries. The very fact that he is dodging the questions makes me worry that he may have already made some profits from our clients for which he does not want to be accountable. What he may not have recognized is that dismissal of a case not only sets up a motion for attorney fees, but does not deprive the court of jurisdiction to consider sanctions. And because we have an obligation to protect our Doe clients, we are going to have to pursue such a motion until we are satisfied that none of them has been abused.

The larger lesson is that, no matter how clearly meritorious the plaintiff's claim may be from a first review of an ex parte motion for early discovery, more judges should emulate Judge Godbey and Judge MacKenzie by deferring a ruling on the motion for leave to take immediate discovery until there has been an opportunity for consideration and adversary litigation. Judging from the panicked calls that my EFF colleagues and I received after the notices of subpoena went out, the mere receipt of notices of subpoena alarmed a number of innocent people until they got word that the ISP's were going to hold off on production. The mere need to decide on a short schedule whether to respond to a subpoena may be harmful, and sad to say there are ISP's out there who just assume when they receive a subpoena that their clients are likely criminals who should be identified as soon as possible (I'll have more to say soon about the scoundrels at Bluehost). Judges should demand some evidence of wrongdoing before they allow discovery to identify the alleged wrongdoers, and if they are not sure of their ability to evaluate the papers in their own chambers, they should consider appointing pro bono counsel to respond to the motion.

Demanding this sort of inquiry does not protect those whose online conduct is tortious, because plaintiffs with valid claims have little difficulty making the showings that are demanded under the Dendrite standard, especially in copyright suits over downloading. But it holds out the prospect of protecting some innocent people.

Inquiring further, I was able to obtain a copy of the subpoena that you sent to Comcast and of your cover letter, which concealed from Comcast the fact that Judge Godbey had never granted you permission to serve subpoenas in this case. Inquiring still further of other major ISP's, we have learned that you have served other subpoenas in the case, that the date required by one of the notices of subpoena for a response to avoid identification is January 31, and that some ISP's have provided you with identifying information.

We are very disturbed by this information. Because the rules of procedure to not allow you to take discover at this phase of the lawsuit without express judicial permission, the subpoenas that you have issued to the ISP's that we have been able to contact to date essentially misrepresented that discovery was open in the case, and gave you access to information to which you are not entitled. It is, as well, arguably a serious abuse of process that may be independently actionable. Given the fact that your standard practice is to send settlement demand letters to Does once they are identified, we must acknowledge the possibility that you have been communicating with our clients. Yet, because those clients are represented by counsel (until the disposition of the discovery motion), your contacting them directly would be a serious violation of legal ethics, because we have never given you permission to contact our clients.

"When it comes to copyright," Cohn said "the law is set up so that truth, whether someone actually violated the law or not, takes a back seat to financial considerations."

This Court cannot consider this case unless it has personal jurisdiction over the Doe Defendants, and it is Plaintiff's burden to show that such jurisdiction exists. The Constitution imposes that burden on every plaintiff as a fundamental matter of fairness, recognizing that no defendant should be forced to have his rights and obligations determined in a jurisdiction with which he has had no contact. These requirements "give[ ] a degree of predictability to the legal system that allows potential defendants to structure their primary conduct with some minimum assurance as to where that conduct will and will not render them liable to suit." World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 297 (1980).

Plaintiff has not met this burden. Instead, the very information upon which Plaintiff relies as a basis for seeking the identity of the Doe defendants -- their Internet Protocol (IP) addresses -- indicates that few, if any, reside in this District. If, as it appears, the vast majority of the Doe defendants do not have sufficient minimum contacts with this jurisdiction to satisfy due process, the Court should quash the subpoena for information about out-of-district defendants.

....

Requiring individuals from across the country to litigate in this District creates exactly the sort of hardship and unfairness that the personal jurisdiction requirements exist to prevent. It requires the individuals urgently to secure counsel far from home, where they are unlikely to have contacts. In this particular instance the hardship is very clear. When the underlying claim is a single count of copyright infringement, the cost of securing counsel even to defend a defendant's identity is likely more than the cost of settlement, and possibly even more than the cost of judgment if the Defendant lost in the litigation entirely.

There is little doubt that Plaintiff's joinder of more than 4,500 defendants in this single action is improper and runs the tremendous risk of creating unfairness and denying individual justice to those sued. Mass joinder of individuals has been disapproved by federal courts in both the RIAA cases and elsewhere. As one court noted:

Comcast subscriber John Doe 1 could be an innocent parent whose internet access was abused by her minor child, while John Doe 2 might share a computer with a roommate who infringed Plaintiffs' works. John Does 3 through 203 could be thieves, just as Plaintiffs believe, inexcusably pilfering Plaintiffs' property and depriving them, and their artists, of the royalties they are rightly owed. . . .

Wholesale litigation of these claims is inappropriate, at least with respect to a vast majority (if not all) of Defendants.

BMG Music v. Does 1-203, No. Civ.A. 04-650, 2004 WL 953888, at *1 (E.D. Pa. Apr. 2, 2004) (severing lawsuit involving 203 defendants).

Rule 20 requires that, for parties to be joined in the same lawsuit, the claims against them must arise from a single transaction or a series of closely related transactions. Specifically:

Persons . . . may be joined in one action as defendants if: (A) any right to relief is asserted against them jointly, severally or in the alternative with respect to or arising out of the same transaction, occurrence, or series of transactions or occurrences; and (B) any question of law or fact common to all defendants will arise in the action.

Fed. R. Civ. P. 20. Thus, multiple defendants may be joined in a single lawsuit only when three conditions are met: (1) the right to relief must be "asserted against them jointly, severally or in the alternative"; (2) the claim must "aris[e] out of the same transaction, occurrence, or series of transactions or occurrences"; and (3) there must be a common question of fact or law common to all the defendants. Id.

Joinder based on separate but similar behavior by individuals allegedly using the Internet to commit copyright infringement has been rejected by courts across the country. In LaFace Records, LLC v. Does 1-38, No. 5:07-CV-298-BR, 2008 WL 544992 (E.D.N.C. Feb. 27, 2008), the court ordered severance of lawsuit against thirty-eight defendants where each defendant used the same ISP as well as some of the same peer-to-peer ("P2P") networks to commit the exact same violation of the law in exactly the same way. The court explained: "[M]erely committing the same type of violation in the same way does not link defendants together for purposes of joinder." LaFace Records, 2008 WL 544992, at *2. In BMG Music v. Does 1-4, No. 3:06-cv- 01579-MHP, 2006 U.S. Dist. LEXIS 53237, at *5-6 (N.D. Cal. July 31, 2006), the court sua sponte severed multiple defendants in action where the only connection between them was allegation they used same ISP to conduct copyright infringement.

Moreover, Plaintiff provides no specific evidence other than its summary declarations to establish that its investigation was done for each Doe. And such evidence ought to be readily available, including screen shots showing the IP addresses of the Doe defendants so the Court can see that the addresses submitted to the Court match those discovered during the investigation, copies or real-time capture of the activities of the "proprietary technologies" used, and shots of the P2P server logs that to which Plaintiff apparently had access. Without those, the declarations merely describe downloading activity in general, and fail to provide the Court with real information linking each of the individuals sued to the alleged infringement.

Robust protection for the right to engage in anonymous communication -- to speak, read, view, listen, and/or associate anonymously -- is fundamental to a free society. See, e.g., Talley v. California, 362 U.S. 60 (1960) (recognizing the First Amendment right to communicate anonymously); McIntyre v Ohio Elections Comm'n, 514 U.S. 334 357 (1995) (same; "Anonymity is a shield from the tyranny of the majority."); Lamont v. Postmaster General, 381 U.S. 301 (1965) (recognizing the First Amendment right to receive ideas in privacy). This fundamental right enjoys the same protections whether the context for speech and association is an anonymous political leaflet, an Internet message board or a video-sharing site. See Reno v. ACLU, 521 U.S. 844, 870 (1997) (there is "no basis for qualifying the level of First Amendment scrutiny that should be applied to" the Internet).

Courts in this District have recognized that First Amendment protections extend to the anonymous publication of expressive works on the Internet even where, as here, that publication is alleged to infringe copyrights. In re Verizon Internet Servs. Inc., 257 F. Supp. 2d 244, 260 (D.D.C.), rev'd on other grounds, 351 F.3d 1229 (D.C. Cir. 2003) (hereinafter "Verizon"); see also UMG Recordings, Inc., v. Does, No. 06-0652 SBA, 2006 WL 1343597, at *2 (N.D. Ca. March 6, 2006) (citing Sony Music Entm't, Inc. v. Does 1-40, 326 F. Supp. 2d 556, 564 (S.D.N.Y. 2004)). As the court in Sony noted:

Arguably, however, a file sharer is making a statement by downloading and making available to others copyrighted music without charge and without license to do so. Alternatively, the file sharer may be expressing himself or herself through the music selected and made available to others. Although this is not "political expression" entitled to the "broadest protection" of the First Amendment, the file sharer's speech is still entitled to "some level of First Amendment protection."

326 F. Supp. 2d at 564 (quoting Verizon) (citations omitted). The Sony court continued: "Against the backdrop of First Amendment protection for anonymous speech, courts have held that civil subpoenas seeking information regarding anonymous individuals raise First Amendment concerns."

"For me, the issue here isn't whether or not peer-to-peer is evil," said Harrison, a photographer. "It is whether or not our federal courts and Verizon should cooperate with such an obvious intimidation scam."

"If we charge our law-enforcement folks with trying to protect us and trying to catch these people," [sponsor of the bill, Rep. Brad] Daw said, "we need to always be trying to review the capabilities these criminals have and the tools technology gives to them and make sure we have adequate tools in place."