Friday, May 24, 2013

Hacking, Defamation and Anonymity


This post examines an opinion the Superior Court of New Jersey – Appellate Division recently issued in a civil case:  Warren Hospital, et al. v. John Does 1-10, __ A.3d __, 2013 WL 1349323 (2013).  The plaintiffs include Warren Hospital, six individuals, the Warren Hospital Foundation, Inc. and Warren Healthcare, Inc.  Warren Hospital, et al. v. John Does 1-10, supra. 

As to the defendants, this is how the opinion explains the nature of the suit and the facts that gave rise to it:

Plaintiffs allege that, on August 17, 2008, John Doe One, an anonymous hacker using IP address 75.126.xx.yyy, accessed Warren Hospital's website and unlawfully and without permission logged onto the hospital's secure mailbox. 

John Doe One then composed and sent to all hospital employees an email with a link to a youtube video; both the emailed message and the linked video compared one of the individual plaintiffs to Adolf Hitler and other dictators.

The same day, the hospital intranet was invaded by someone using a different IP address, 70.21.xxx.yy. Plaintiffs allege that, on October 19, 2009, John Doe Two, an anonymous hacker using the IP address 72.94.xxx.yyy, accessed the hospital's website and unlawfully and without permission logged onto an employee's mailbox. 

John Doe Two composed and sent an email to all hospital employees accusing more than one of the individual plaintiffs of sexual misconduct and other wrongdoing.

Warren Hospital, et al. v. John Does 1-10, supra.  (In a footnote, the appellate court notes that it has “concealed” the IP addresses mentioned in the opinion.) 

As to the legal claims the plaintiffs are pursuing they alleged the statements noted above were “defamatory or otherwise tortious.” Warren Hospital, et al. v. John Does 1-10, supra. The legal viability of their claims are not, however, what is at issue in this opinion. 

As it notes, after they filed their complaint the plaintiffs had to serve it on the defendants for the court to have personal jurisdiction over them.  This is usually not a problem, since plaintiffs normally know the identities, and location, of those  they are suing.  Here, of course, these plaintiffs do not know who was responsible for the emails and video noted above, which obviously is a problem for them.

As Wikipedia notes, to deal with situations like this, courts have allowed plaintiffs to name fictitious – or “John Doe” – defendants in their initial complaints, on the premise that they will file amended complaints that correctly identify the defendants, once they have that information. 

That is clearly what the plaintiffs in this suit did in filing their initial complaint.  As this opinion explains, in order to “obtain information about the true identity of the fictitious defendants,” the plaintiffs then “served subpoenas on four ISPs.”  Warren Hospital, et al. v. John Does 1-10, supra.  

That effort was frustrated when “[c]urrent Current counsel for one or more anonymous but unidentified respondents was given notice of the subpoenas and moved to quash.”  Warren Hospital, et al. v. John Does 1-10, supra.  (As this site explains, a motion to quash a subpoena asks the court that issues it to void, or nullify, the subpoena because there are good reasons why it should not be enforced.)

The opinion notes that

[b]y the time the motion was heard, only the subpoena served on one of the ISPs, Verizon Communications, remained active. On February 27, 2012, the trial judge granted the motion to quash for reasons expressed in a written opinion.

Warren Hospital, et al. v. John Does 1-10, supra.  I do not know if the first comment means the other ISPs had already complied with the subpoenas that were served on them or that those subpoenas had somehow lapsed or been quashed.  The opinion simply says the appellate court then granted the plaintiffs’ “motion for leave to appeal” that order.  Warren Hospital, et al. v. John Does 1-10, supra. 

The Superior Court of New Jersey – Appellate Division began its analysis of the parties’ respective arguments by explaining that the Internet’s

rapid, expansive and inexpensive means of communication permit anyone to `become a modern-day muckraker, exposing scandal and speaking out against fraud from the safety of [a] computer.’ Nathaniel Gleicher, Note, John Doe Subpoenas: Toward a Consistent Legal Standard, 118 Yale L.J. 320 (2008). . . .  But a click of the mouse may also instantaneously send defamatory messages to a wide audience, causing great harm to the reputation of others.

To the extent these speakers choose to remain hidden behind their computers, difficulties are posed for injured individuals who seek redress. As a result, we have minimized ‘”the traditional reluctance”’ for permitting filings against fictitious defendants and held that “’the traditional enforcement of strict compliance with service requirements should be tempered by the need to provide injured parties with a forum in which they may seek redress for grievances.”’ Dendrite Int’l, Inc. v. Doe No. 3, 342 N.J.Super. 134, 775 A.2d 756 (2001) (quoting Columbia Ins. Co. v. seescandy.com, 185 F.R.D. 573 (U.S. District Court for the Northern District of Illinois 1999).

Warren Hospital, et al. v. John Does 1-10, supra. 

The court also, though, noted that this

salutary flexibility . . . must be weighed against competing constitutional interests. The 1st Amendment extends its protection to speech that is uttered anonymously, Talley v. California, 362 U.S. 60 (1960) . . . and disseminated through the Internet, Reno v. American Civil Liberties Union, 521 U.S. 844 (1997).  

 And Article I, paragraph 6 of our state constitution is understood as providing an even broader right of free speech than recognized by the 1st Amendment by protecting speech `”not only from abridgment by government, but also from unreasonably restrictive and oppressive conduct by private entities.”’ N.J. Coalition Against War in the Middle East v. J.M.B. Realty Corp., 138 N.J. 326, 650 A.2d 757 (New Jersey Supreme Court 1994). . . . 

[I]n offering a forum for those aggrieved by anonymous defamatory statements, particular care must be taken to prevent the suppression of criticism or the flow of legitimate speech.  See New York Times Co. v. Sullivan, 376 U.S. 254 (1964).  In crafting an appropriate remedy, courts must sail between the Scylla of unmasking those who have said nothing actionable, leaving them vulnerable to powerful and vindictive plaintiffs with the ability to `seek revenge or retribution,’ Doe No. 1 v. Cahill, 884 A.2d 451 (Delaware Supreme Court 2005), and . . . the Charybdis of permitting anonymity to become an impenetrable shield, leaving a defamed plaintiff without a remedy.

Warren Hospital, et al. v. John Does 1-10, supra. 

The appellate court then explained that in Dendrite Int’l, Inc. v. Doe No. 3, supra,

we adopted a four-part test for determining whether and to what extent a plaintiff may obtain discovery designed to ascertain the identity of persons posting messages on an ISP message board. Dendrite Int’l, Inc. v. Doe No. 3, supra. [It] . . . was designed to ensure that the authorization of discovery into an anonymous speaker's identity `”will only be employed in cases where the plaintiff has in good faith exhausted traditional avenues for identifying a civil defendant pre-service and will prevent use of this method to harass or intimidate.’” Dendrite Int’l, Inc. v. Doe No. 3, supra (quoting Columbia Ins. Co. v. seescandy.com, supra ). . . .

Warren Hospital, et al. v. John Does 1-10, supra. 

Under the Dendrite test, a plaintiff who claimed to have been injured by an

anonymous or pseudonymous statement on an ISP message board, must: (1) identify the fictitious defendant with `sufficient specificity’ to allow for a determination as to whether the defendant `is a real person or entity’ who may be sued; (2) demonstrate a `good-faith effort to comply with the requirements of service of process’; (3) present sufficient facts from which it may be concluded that the suit can withstand a motion to dismiss; and (4) provide `a request for discovery with the [c]ourt, along with a statement of reasons justifying the specific discovery requested as well as identification of a limited number of persons or entities on whom discovery process might be served and for which there is a reasonable likelihood that the discovery process will lead to identifying information about defendant that would make service of process possible.’ Dendrite Int’l, Inc. v. Doe No. 3, supra (quoting Columbia Ins. Co. v. seescandy.com, supra ).

Warren Hospital, et al. v. John Does 1-10, supra. 

This court, though, found the circumstances in this case “are quite different from those that generated the” Dendrite test.  Warren Hospital, et al. v. John Does 1-10, supra. It explained that, unlike the facts at issue in Dendrite, in this case it was not considering

the anonymity of individuals posting statements on a public Internet message board. Plaintiffs have presented sufficient facts from which we may assume that what John Does One and Two did electronically was no different than if they had broken into the hospital and spray painted their messages on the hospital's walls. 

We reject the argument that those who engage in this type of conduct are entitled to cling to their anonymity through a strict or overly-formulaic application of the Dendrite test.

Warren Hospital, et al. v. John Does 1-10, supra. 

The court also noted that it was “satisfied” that the plaintiffs were entitled to pursue

discovery from Verizon or any other ISP to the extent the discovery might reasonably reveal the identity of those who used IP addresses 75.126.xx.yyy, 70.21.xxx.yy, or 72.94.xxx.yyy, or information reasonably designed to lead to other discoverable information. It is enough that plaintiffs have demonstrated (1) the speakers' unlawful or impermissible mode of communication, and (2) that the allegedly defamatory statements would survive a motion to dismiss.

Warren Hospital, et al. v. John Does 1-10, supra. 

It also noted that, as to the third Dendrite factor, it was “satisfied” that a defamation claim

based on the August 17 and October 19, 2008 allegations would survive a motion to dismiss. Plaintiffs assert the statements are false and harmful to their reputations because [they] tend to `lower[ ] the defamed person in the estimation of the community or deter third parties from dealing with that person.’ Salzano v. N. Jersey Media Group Inc., 201 N.J. 500, 993 A.2d 778 (New Jersey Supreme Court 2010). 

On a motion to dismiss, the court would be required to give the words in question the `fair and natural meaning which will be given [to them] by reasonable persons of ordinary intelligence.’ Romaine v. Kallinger, 109 N.J. 282, 537 A.2d 284 (New Jersey Supreme Court 1988) (quoting Herrmann v. Newark Morning Ledger Co.,48 N.J.Super. 420, 138 A.2d 61 (Superior Court of New Jersey – Appellate Division (1958)). 

The statements, which we have not quoted in order to avoid their further dissemination, would survive a motion to dismiss on the record now before us.

Warren Hospital, et al. v. John Does 1-10, supra. 

Finally, the court noted that the John Doe defendants who had hired the attorney who moved to quash the subpoena were “troubled” that the discovery it was authorizing

may provide insight into the identities of some of those who made other anonymous statements referred to in the amended complaint. We find that to be of little concern. If the discovery we permit reveals John Does One and Two also uttered other statements in less wrongful or even completely innocent ways -- or the revelation of their true identities may lead to a discovery of the identities of other anonymous speakers – then that is a consequence of John Doe One and John Doe Two's alleged wrongdoing. 

Having made a showing we find sufficient for the discovery in question, plaintiffs should not be thwarted by the speculative consequence that other identities may be revealed.

Warren Hospital, et al. v. John Does 1-10, supra. 

It therefore reversed the trial judge’s order quashing the subpoena and remanded the case for further proceedings.  Warren Hospital, et al. v. John Does 1-10, supra. For a little more about the facts in the case, check out the news story you can find here.

No comments: