Friday, November 06, 2015

The Republic of Kazakhstan, Hacking Government Computers and the Injunction

This post examines an opinion a U.S. District Court Judge who sits in the U.S. District Court for the Southern District of New York issued recently in a civil suit:  Republic of Kazakhstan v. Does 1-100, 2015 WL 6473016 (2015).  He begins the opinion by explaining that
Plaintiff commenced this action by Complaint filed on March 12, 2015, seeking injunctive relief for damages arising out of violations of the Computer Fraud and AbuseAct, 18 U.S.C. § 1030 (`CFAA’). . . . The Complaint alleges that on January 15, 2015, Plaintiff learned that its computers had been hacked when it became aware that certain of its sensitive, proprietary documents and confidential emails, including emails protected by the attorney-client privilege, were publicly posted on the internet. . . .

Among the officials whose emails and other documents were misappropriated were the Executive Secretary of the Ministry of Justice of Kazakhstan and a Deputy General Prosecutor in the country's General Prosecutor's Office. . . . Although Plaintiff launched an investigation to determine the identity of the hackers and the scope of the breach, it is still unaware of their identity and brought the instant action against the defendants as John Does 1–100. . . .

On March 13, 2015, the day following the filing of the Complaint, this Court issued an ex parte Order to Show Cause why an injunction should not issue that, inter alia, (1) enjoined Defendants, their affiliates and all persons acting in concert with them from using, disclosing, or otherwise disseminating the Stolen Materials, (2) ordered Defendants to turn over to Plaintiff the Stolen Materials, and (3) ordered Defendants to turn over to the Court any proceeds received as a result of the misappropriation of the Stolen Materials. Doc. 3. The Injunction issued the following week, on March 20, 2015, and remains in effect. . . .
Republic of Kazakhstan v. Does 1-100, supra.  You can, if you are interested, read more about the suit in the stories you can find here, here and here.
The judge then explained that on
August 4, 2015, Respublika filed the instant motion seeking clarification. . . . Respublika does not dispute that it has posted or used at least some of the purportedly Stolen Materials on its website. See Memorandum of Law of Nonparties Respublika and LLC Media–Consult in Support of Motion for Clarification of Preliminary Injunction Order (`Respublika Mem.’), . . . (`The First Amendment therefore prohibits Kazakhstan's use of the preliminary injunction to demand the takedown of Respublika's articles concerning newsworthy documents that the newspaper found anonymously posted online.’); see also Respublika Mem.’ at 6 (`The [Stolen Materials] were first posted to [the website (`kazaword’) in or around August 2014, and Respublika and other news organizations across Europe and Central Asia have reported on the kazaword documents since then’).

However, it claims that the injunction cannot apply to it because there is no allegation, or proof, that Respublika was involved with the hacking, or otherwise assisted or acted in concert with the hackers, and because the Injunction operates as an unconstitutional prior restraint against Respublika. 

For its part, Plaintiff has represented to the Court that it has voluntarily abstained from enforcing the Injunction against Respublika, and will continue to do so pending the resolution of the instant motion.
Republic of Kazakhstan v. Does 1-100, supra. 
The District Court Judge then began his analysis of the issues above, explaining, initially, that
[a] party seeking a preliminary injunction must show: (1) `irreparable harm absent injunctive relief;’ (2) `either a likelihood of success on the merits, or a serious question going to the merits to make them a fair ground for trial, with a balance of hardships tipping decidedly in the movant's favor;’ and (3) `that the public's interest weighs in favor of granting an injunction.’ Red Earth LLC v. United States, 657 F.3d 138 (U.S. Court of Appeals for the 2d Circuit 2011) quoting Metro. Taxicab Bd. of Trade v. City of New York, 615 F .3d 152 (U.S. Court of Appeals for the 2d Circuit 2010)).
Republic of Kazakhstan v. Does 1-100, supra. 
The judge then began his analysis of Kazakhstan’s effort to obtain an injunction by explaining that
[o]n the record presently before the Court, Plaintiff has not established a likelihood of success on the merits. By its terms, although no specific individuals are named, the Injunction is addressed only to those individuals who hacked the Kazakhstan government computers, as well as those `acting in concert or participating with’ them. . . . Respublika is not named as a party to this lawsuit. Accordingly, in order for Kazakhstan to prevail on the merits, it must prove that Respublika itself violated the CFAA or was complicit in the alleged hacking.

Kazakhstan, as it itself concedes, does not have sufficient evidence to indicate that Respublika was in any way responsible for the alleged hacking or acted in concert with the hackers. Indeed, the very purpose of Plaintiff's motion for expedited discovery is to enable it to make such a showing.

The fact that Respublika may have used or posted certain of the Stolen Materials on its website, is not, without more, sufficient to subject it to the Injunction. The First Amendment grants persons a near absolute right to publish truthful information about matters of public interest that they lawfully acquire. See Smith v. Daily Mail Publishing Co., 443 U.S. 97 (1979)

The Supreme Court affirmed that the Daily Mail rule applies even if a re-publisher of information that is of public concern knew that its source had obtained the information illegally. See Bartnicki v. Vopper, 532 U.S.514 (2001). Thus, the Daily Mail rule protects the publication of the kazaword documents by anyone other than those directly involved in their purported theft. Smith v. Daily Mail Publishing Co., supra.
Republic of Kazakhstan v. Does 1-100, supra. 
He then went on to point out that
[o]n the present facts, the Injunction operates as a prior restraint on Respublika.
The court also finds that applying the Injunction against Respublika would result in a prior restraint of speech. A prior restraint is an administrative or judicial order `forbidding certain communications when issued in advance of the time that such communications are to occur,’ in contrast to orders imposing liability for speech after publication. Alexander v. United States, 509 U.S. 544 (1993) (emphasis in original) (quotation marks omitted). The Injunction entered in this case operates as a prior restraint when applied to Respublika because it enjoins Respublika from `using, disclosing, . . . hosting, copying, . . .  providing access to or making available to anyone, in any manner whatsoever the Stolen Materials.’ . . . That is, it bars Respublika from publishing any content from the kazaword documents or `using’ it as the basis of its reporting.

Prior restraints on speech are `the most serious and least tolerable infringement on First Amendment rights.’ NebraskaPress Association v. Stuart, 427 U.S. 539 (1976). While `a threat of criminal or civil sanctions after publication “chills” speech, [a] prior restraint “freezes” it at least for the time.’ Nebraska Press Association v. Stuart, supra; see also Alexander v. United States, supra (`[W]e have interpreted the First Amendment as providing greater protection from prior restraints than from subsequent punishments. . .’).

As a result, a prior restraint on expression `bear[s] a heavy presumption against its constitutional validity.’ BantamBooks, Inc. v. Sullivan, 372 U.S. 58 (1963). In determining whether a prior restraint is constitutional, courts have considered: (1) the extent to which the government's interest would be harmed by publication of the materials, (2) whether there are any less restrictive alternatives, and (3) how effectively a prior restraint would prevent the threatened harm. See Nebraska Press Association v. Stuart, supra; see also New York Times Co. v. United States, 403 U.S. 713(1971) (Stewart, J., concurring); United States v. Quattrone, 402 F.3d 304 (U.S. Court of Appeals for the 2d Circuit 2005).

None of these factors weigh in Kazakhstan's favor because, as Respublika points out, the Stolen Materials are already publicly available. . . . .
Republic of Kazakhstan v. Does 1-100, supra (emphasis in the original).
The District Court Jude therefore held that
[f]or the reasons set forth above, the Court clarifies that the Injunction does not apply to Respublika. The foregoing is without prejudice to Plaintiff to reapply for the imposition of an injunction against the use of the Stolen Materials by Respublika should it obtain sufficient evidence to support such an order. The Clerk of the Court is respectfully directed to terminate the motion. . . .
Republic of Kazakhstan v. Does 1-100, supra.  

No comments: