Doe subpoena

A Doe subpoena is a subpoena that seeks the identity of an unknown defendant to a lawsuit. Most jurisdictions permit a plaintiff who does not yet know a defendant's identity to file suit against John Doe and then use the tools of the discovery process to seek the defendant's true name.^[1] A Doe subpoena is often served on an online service provider or ISP for the purpose of identifying the author of an anonymous post.

Legal process

Unmasking an anonymous online poster is a two-step process. First, the plaintiff must issue a subpoena to the hosting website requesting the IP address of the poster. Most websites collect and temporarily store the IP addresses of visitors in a web server log, although no U.S. law requires that they retain this information for any particular length of time.^[2]

If the website provides the poster's IP address, the plaintiff must then subpoena the ISP that owns the address. This second subpoena requests the contact information associated with the account of the computer to which the IP address was assigned at the time the post was made.

Courts do not require the target of a subpoena to provide notice to the person whose identity is sought.^[3] The hosting website is unlikely to notify the defendant, as it generally will not have access to contact information; subpoenas for IP addresses are therefore seldom subjected to legal challenge.^[4] The ISP, however, may be required by law to notify its subscriber before revealing any personally identifiable information in connection with a subpoena.^[5]

A defendant who does receive notice may file a motion to quash, which asks the court to block the subpoena and prevent the ISP from complying.^[6] ISPs may also challenge Doe subpoenas on their customers' behalf, but they are not required to do so.^[7]

Legal standards

No uniform standard exists in the United States for determining the circumstances under which an anonymous online speaker may be unmasked.^[8] The federal and state courts that have considered the issue have applied a variety of tests.

Summary judgment standard

This standard requires an ISP to divulge the identity of an anonymous poster if the plaintiff's case would be able to withstand a motion for summary judgment. This means that the plaintiff must "make a sufficient showing on [every] essential element of its case with respect to which it has the burden of proof."^[9]

The lead case applying the summary judgment standard is Doe v. Cahill,^[10] in which a city council member sued an anonymous poster for two allegedly defamatory blog comments.^[11] The Delaware Supreme Court held that the plaintiff had failed to demonstrate that the comments were "capable of a defamatory meaning," an essential element of any defamation claim.^[12] As a result, the plaintiff was not entitled to discovery of the Doe defendant's identity.^[13]

Other courts have applied a "prima facie showing" test, which functions like the summary judgment test but avoids the "potentially confusing" attachment of a procedural label, since the standards governing such motions may differ depending on the jurisdiction.^[14] In Krinsky v. Doe 6, the California Court of Appeals applied the prima facie showing test in the libel context, holding that "[w]here it is clear to the court that discovery of the defendant's identity is necessary to pursue the plaintiff's claim, the court may refuse to quash a third-party subpoena if the plaintiff succeeds in setting forth evidence that a libelous statement has been made."^[15]

The prima facie standard was also favored by a New York district court in Sony Music Entertainment Inc. v. Does.^[16] The court first found that the Doe defendants, who had used a peer-to-peer network to download copyrighted music files, warranted a lesser degree of First Amendment protection than speakers who engaged in "true expression" intended "to communicate a thought or convey an idea."^[17] It then held that disclosure of the Doe defendants' identities was warranted based on a consideration of: (1) the plaintiff's ability to establish a prima facie claim; (2) the specificity of the plaintiff's discovery request; (3) the availability of alternative means to obtain the subpoenaed information; (4) the central need for discovery to advance the plaintiff's claim; and (5) the defendants' expectation of privacy.^[18]

Summary judgment standard followed by balancing

This test provides a higher level of protection to anonymous online speakers, in that it requires a court to first apply the summary judgment standard of Doe v. Cahill and then, if the plaintiff is able to meet its burden, to balance the strength of the plaintiff's prima facie case against the poster's interest in remaining anonymous.

A New Jersey appellate court applied this hybrid test in Dendrite International, Inc. v. Doe No. 3.^[19] The court set forth five guidelines for judges to follow in deciding whether to compel disclosure of an anonymous poster's identity: (1) the plaintiff must make good faith efforts to notify the poster and give the poster a reasonable opportunity to respond; (2) the plaintiff must specifically identity the poster's allegedly actionable statements; (3) the complaint must set forth a prima facie cause of action; (4) the plaintiff must support each element of the claim with sufficient evidence; and (5) "the court must balance the defendant's First Amendment right of anonymous free speech against the strength of the prima facie case presented and the necessity for the disclosure of the anonymous defendant's identity to allow the plaintiff to properly proceed."^[20]

The so-called Dendrite standard was adopted by the Arizona Supreme Court in Mobilisa, Inc. v. Doe,^[21] and most recently, by Maryland's highest court in Independent Newspapers v. Brodie.^[22] After reviewing the treatment of anonymous online speech by other state and federal courts, the Maryland court concluded that "a test requiring notice and opportunity to be heard, coupled with a showing of a prima facie case and the application of a balancing test—such as the standard set forth in Dendrite—most appropriately balances a speaker's constitutional right to anonymous Internet speech with a plaintiff's right to seek judicial redress from defamatory remarks."^[23]

Motion to dismiss standard

Some courts have required plaintiffs to demonstrate that their cause of action could withstand a motion to dismiss. This standard holds plaintiffs to a much lower evidentiary burden than the summary judgment standard, as it only requires the allegation of facts that, if true, would entitle the plaintiff to a legal remedy.

A California district court applied this standard in one of the first cases to consider the discovery of an anonymous online speaker's identity, Columbia Insurance Co. v. Seescandy.com.^[24] The court analogized the motion to dismiss standard to the requirement in a criminal investigation that the government show probable cause before obtaining a warrant, in that both prerequisites were necessary to "prevent abuse."^[25] The court concluded that an anonymous poster could only be unmasked if the plaintiff made "some showing that an act giving rise to civil liability actually occurred and that the discovery [was] aimed at revealing specific identifying features of the person or entity who committed that act."^[26]

Good faith standard

Under a good faith standard, plaintiffs are simply required to show that their claim is made in good faith and not with the intent to harass the Doe defendant. The Circuit Court of Virginia applied this standard in In re Subpoena Duces Tecum to America Online, holding that a court may compel an ISP to reveal a subscriber's identity if it finds "that the party requesting the subpoena has a legitimate, good faith basis to contend that it may be the victim of conduct actionable in the jurisdiction" and that "the identity information is centrally needed to advance that claim."^[27]

Courts and commentators have subsequently deemed this standard the "most deferential to plaintiffs," as "it offers no practical, reliable way to determine the plaintiff's good faith and leaves the speaker with little protection."^[28]

Statutory limitations to obtaining IP addresses

Federal privacy statutes may limit a plaintiff's ability to gain access to an ISP's subscriber records.

Cable TV Privacy Act of 1984

Under the Cable TV Privacy Act of 1984,^[29] a cable ISP may be required to notify its subscribers and obtain consent before disclosing any personally identifiable information, but the statute provides limited exceptions to the consent requirement, including disclosure made pursuant to a court order.^[30]

Electronic Communications Privacy Act

The Electronic Communications Privacy Act^[31] restricts government and private access to computer records. Thus, in order to unmask the author of an anonymous post through the legal process, the individual seeking the information must comply with ECPA. There is no provision within ECPA, other than voluntary disclosure or with consent, that allows civil litigants to force an ISP or website to reveal a user’s IP address or identity via a subpoena.^[32] On the other hand, the government can obtain the records needed to identify the person behind an IP address if "specific and articulable facts show[] that there are reasonable grounds to believe...the records...are relevant and material to an ongoing criminal investigation."^[31]

See also

• Anonymous post
• Strategic lawsuit against public participation

References

1. ^ Aaron E. Kornblum, Searching For John Doe: Finding Spammers and Phishers (pdf), Second Conference on Email and Anti-Spam (2005). Retrieved on 2009-03-15.^{[dead link]}
2. ^ Bills proposed in both houses of Congress in February 2009 would require ISPs and wireless access points to retain records of IP addresses for two years. This proposal, if enacted, would not affect the retention policies of web hosting services, however. See Albanesius, Chloe (2009-02-20). "Bill Would Require ISPs to Retain Data for Two Years". PCMag. http://www.pcmag.com/article2/0,2817,2341476,00.asp. Retrieved 2009-03-16. 
3. ^ Id. at 346.
4. ^ Id. at 328.
5. ^ See Statutory Limitations to Obtaining IP Addresses.
6. ^ See Citizen Media Law Project's Guide to Potential Legal Challenges to Anonymity. Retrieved on 2009-03-15.
7. ^ Gleicher, supra note 1, at 345.
8. ^ Who's Exposing John Doe Journal of Technology Law & Policy, Vol. 13, No. 1, 2008
9. ^ Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986). Retrieved on 2009-03-15.
10. ^ 884 A.2d 451 (pdf) (Del. 2005). Retrieved on 2009-03-15.
11. ^ Id. at 454.
12. ^ Id. at 466-67.
13. ^ Id. at 468.
14. ^ Krinsky v. Doe 6, 159 Cal. App. 4th 1154 (pdf) (2008). Retrieved on 2009-03-15.
15. ^ Id. at 1172.
16. ^ 326 F. Supp. 2d 556 (pdf) (S.D.N.Y. 2004). Retrieved on 2009-03-18.
17. ^ Id. at 564.
18. ^ Id. at 564-67.
19. ^ 775 A.2d 756 (N.J. App. Div. 2001). Retrieved on 2009-03-15.
20. ^ Id. at 760-61.
21. ^ 170 P.3d 712 (pdf) (Ariz. 2007). Retrieved on 2009-03-15.
22. ^ Court of Appeals of Maryland, Feb. 27, 2009, No. 63 (pdf). Retrieved on 2009-03-15.
23. ^ Id. at 41 (internal citation omitted).
24. ^ 185 F.R.D. 573 (N.D. Cal. 1999). Retrieved on 2009-03-15.
25. ^ Id. at 579.
26. ^ Id. at 580.
27. ^ 2000 WL 1210372, *8 (Vir. Cir. Ct. Jan. 31, 2000). Retrieved on 2009-03-15.
28. ^ Krinsky, 159 Cal. App. 4th at 1167; see also Ryan M. Martin, Freezing the Net: Rejecting a One-Size-Fits-All Standard for Unmasking Anonymous Internet Speakers in Defamation Lawsuits, 75 U. Cin. L. Rev. 1217, 1228 (2007) (referring to the good faith standard as "extremely deferential to plaintiffs' allegations").
29. ^ 47 U.S.C. § 551.
30. ^ See Cahill, 884 A.2d at 455, n.4; but see In re United States, 157 F. Supp. 2d 286, 290-92 (pdf) (S.D.N.Y. 2001) (holding that ECPA, and not the Cable Act, applied to government access of internet subscriber records).
31. ^ ^{a b} 18 U.S.C. § 2703(d).
32. ^ See O'Grady v. Super. Ct., 139 Cal. App. 4th 1423 (pdf) (2006) (holding that ECPA prohibited disclosure of emails in connection with a subpoena); Fed. Trade Comm'n v. Netscape Commc'ns Corp., 196 F.R.D. 559 (N.D. Cal. 2000) (denying FTC's motion to compel disclosure of customer information because of ECPA); 18 U.S.C. § 2703 (only government entities can force disclosure). But see Flagg v. City of Detroit, 252 F.R.D. 346 (pdf) (E.D. Mich. 2008) (finding that a subpoena can be used to force a party to consent to disclosure).

External links

• Cyberslapp
• Interview of Paul Alan Levy, attorney for Public Citizen, about the adoption of the Dendrite Rule on John Doe subpoenas.