Subpoenas to ISPs Can Override Anonymous Defendants’ Privacy Interests

Federal law generally prohibits internet service providers (ISPs), i.e., “cable operators,” from disclosing personally identifiable information concerning a subscriber without the prior written or electronic consent of the subscriber. Moreover, under the law, ISPs must “take such actions as are necessary” to prevent unauthorized access to a subscriber’s personally identifiable information by a person other than the subscriber or the cable operator. See 47 U.S.C. § 551(c)(1).

An ISP, however, may disclose a subscriber’s personally identifiable information in a number of specific circumstances, including pursuant to a court order authorizing the disclosure. See 47 U.S.C. § 551(c)(2)(B).

Plaintiffs in an increasing number of lawsuits filed in federal district courts in New York are relying on that provision to seek court orders requiring ISPs to disclose subscribers’ personally identifiable information soon after filing their actions against anonymous “John Doe” defendants. Their goal: to learn the names and addresses of those defendants and, therefore, to be able to serve them with their complaints.

This column will examine a recent federal court decision highlighting the well-developed law in this area and will explain how it provides plaintiffs asserting a wide range of claims with the ability to proceed while protecting ISPs – and, correspondingly, how it ultimately means that defendants who otherwise could remain anonymous may have to defend themselves in court.

Strike 3

The decision, by Chief Judge Elizabeth A. Wolford of the U.S. District Court for the Western District of New York, was issued in Strike 3 Holdings, LLC v. Doe, No. 1:21-CV-0586 EAW (W.D.N.Y. Oct. 12, 2021).

The case arose when Strike 3 Holdings, LLC, filed a lawsuit alleging that the John Doe defendant had downloaded and distributed Strike 3’s motion pictures in violation of federal copyright law, 17 U.S.C. §§ 101 et seq.

After commencing its action, Strike 3 filed an ex parte motion for leave to serve a third party subpoena prior to the conference required by Rule 26(d)(1) of the Federal Rules of Civil Procedure, which provides that a “party may not seek discovery from any source before the parties have conferred as required by Rule 26(f).” Discovery, however, is permitted in advance of a Rule 26(f) conference when it is “authorized . . . by court order.”

Strike 3 sought an order permitting it to serve a subpoena pursuant to Federal Rule 45 on the defendant’s ISP, Verizon Fios (Verizon), so that it could learn the name and address of the defendant in order to serve the defendant with its complaint.

The court granted Strike 3’s motion.

In its decision, the court explained that it could grant Strike 3’s motion to serve the subpoena on Verizon upon a showing of “good cause.” See, e.g., In re BitTorrent Adult Film Copyright Infringement Cases, 296 F.R.D. 80 (E.D.N.Y. 2012).

Citing to Rotten Records, Inc. v. Doe, 107 F. Supp. 3d 257 (W.D.N.Y. 2015) (quoting Catlin v. Global, No. 14-CV-6324L (W.D.N.Y. Aug. 13, 2014)), the court explained that the factors to consider in determining whether good cause existed for the disclosure of a defendant’s personally identifiable information through an ISP included:

• A concrete showing of a prima facie claim;
• A specific discovery request;
• The absence of alternative means to obtain the subpoenaed information;
• The need for the subpoenaed information to advance the claim; and
• A minimal expectation of privacy by the defendant in the requested information.

The court then reviewed each factor, first finding that, accepting the allegations in Strike 3’s complaint as true for the purposes of its motion, Strike 3 had made a showing of a prima facie claim of copyright infringement. Such a claim, the court observed, citing to Sony Music Entm’t Inc. v. Doe, 326 F. Supp. 2d 556 (S.D.N.Y. 2004), consists of two elements: (1) ownership of a valid copyright, and (2) copying of constituent elements of the work that are original.

Here, the court said, Strike 3 alleged ownership of motion pictures (the Works) and that the Works had “been registered with the United States Copyright Office.” Strike 3 also alleged that the defendant had “copied and distributed the constituent elements of [Strike 3’s] Works using the BitTorrent protocol” and that “[a]t no point in time did [Strike 3] authorize, permit or consent to [d]efendant’s distribution of its Works, expressly or otherwise.” (BitTorrent is an online peer-to-peer file sharing network that, among other things, enables computers to exchange large files; during the process of downloading these files, users expose their IP addresses to one another, which may permit third parties to track and record the addresses participating in an illegal download. See, e.g., Strike 3 Holdings, LLC v. Doe, No. 1:18-cv-02651-AJN (S.D.N.Y. April 24, 2018).)

The court added that Strike 3 alleged that it had “developed, owns, and operates an infringement detection system, named ‘VXN Scan,’” and that it used VXN Scan to determine that the defendant had “used the BitTorrent file network to illegally download and distribute [Strike 3’s] copyrighted motion pictures.” According to Strike 3, while the defendant “was using the BitTorrent file distribution network, VXN Scan established direct [Transmission Control Protocol/Internet Protocol (TCP/IP)] connections” with the defendant’s IP address.

In particular, Strike 3 asserted, VXN Scan “downloaded from [d]efendant one or more pieces of numerous digital media files” that Strike 3 identified “as portions of [the Works].” Strike 3 alleged that VXN Scan used the “Info Hash” value, which is “contained within the metadata of the torrent file correlated with a digital media file . . . identical (or substantially similar) to a copyrighted work, to download a piece (or pieces) of the same digital media file from [d]efendant using the BitTorrent network,” and that “VXN Scan captured transactions from [d]efendant sharing specific pieces of [the Works].”

Strike 3 further alleged that the defendant’s infringement was “continuous and ongoing.”

After reviewing Strike 3’s allegations, the court concluded that they were sufficient to establish a prima facie case of copyright infringement against the defendant.

The court then turned to the other four factors it had to consider to conclude that there was good cause to grant Strike 3’s motion.

The court ruled that Strike 3 met the specificity requirement, insofar as it sought the name and address of the individual assigned to the IP address that it had identified “for the limited purpose of enabling [Strike 3] to identify and serve process on [d]efendant.”

In addition, the court found that Strike 3 satisfied the third and fourth factors of the analysis in that it had no alternative method of obtaining that information, and that it needed the information. The court explained that BitTorrent’s appeal to users was “the large degree of anonymity it provides.” The court referenced the disclosure prohibition on cable operators in 47 U.S.C. § 551 and declared that without granting Strike 3’s request, the defendant could not be identified or served and the litigation could not proceed. Additionally, the court said, expedited discovery was necessary “to prevent the requested data from being lost forever as part of routine deletions by the ISP.”

Finally, the court held that Strike 3’s interest in learning the defendant’s name and address outweighed the defendant’s privacy interest. In that regard, it cited to Arista Records LLC v. Doe, 604 F.3d 110 (2d Cir. 2010), a leading decision by the U.S. Court of Appeals for the Second Circuit that stated, in a similar case, that it regarded a John Doe defendant’s “expectation of privacy for sharing copyrighted music through an online file-sharing network as simply insufficient to permit him to avoid having to defend against a claim of copyright infringement.”

Accordingly, the court found that good cause existed for immediate discovery in this case by way of a third-party subpoena served on Verizon to enable Strike 3 to ascertain the name and address of the defendant so that Strike 3 could effectuate service upon the defendant.

Conclusion

Motion pictures were at issue in Strike 3, but federal courts in New York have reached similar conclusions in cases involving allegations of infringement of other copyrighted works, such as music, see, e.g., Rotten Records, Inc. v. Doe, 107 F. Supp. 3d 257 (W.D.N.Y. 2015), as well as in cases involving other claims. See, e.g., Catlin v. Global, No. 14-CV-6324L (W.D.N.Y. Aug. 13, 2014) (Telephone Consumer Protection Act, 47 U.S.C. §227 et seq., and Fair Debt Collection Practices Act, 15 U.S.C. §1692 et seq.).

In many instances, courts granting the kind of relief that Strike 3 received will issue an order pursuant to Federal Rule of Civil Procedure 26(c)(1) to protect an anonymous defendant from “annoyance, embarrassment, oppression, or undue burden or expense,” as the court did in Strike 3 when it ordered that any information regarding the defendant released to Strike 3 by Verizon “be treated as confidential” until it issued a further order.

In cases involving allegations of copyright infringement, courts may issue protective orders due to the possibility that certain of the names and addresses produced in response to a plaintiff’s discovery request “will not in fact be those of the individuals” who downloaded and distributed the content in question. See, e.g., Digital Sin, Inc. v. Does 1-176, 279 F.R.D. 239 (S.D.N.Y. 2012). In Digital Sin, the court explained that the “risk of false positives gives rise to the potential for coercing unjust settlements from innocent defendants such as individuals who want to avoid the embarrassment of having their names publicly associated” with the allegations raised in the particular case. Id. (internal quotation marks omitted); see also Strike 3 Holdings, LLC v. Doe, No. 1:18-CV-02651-AJN, supra (issuing a protective order for same reasons).

The bottom line is that New York federal courts are quite willing, in the appropriate circumstances, to expedite discovery by authorizing third-party subpoenas to ISPs for information needed by a plaintiff to facilitate the identification of, and service of process upon, an anonymous John Doe defendant.

Reprinted with permission from the December 21, 2021, issue of the New York Law Journal^©, ALM Media Properties, LLC. Further duplication without permission is prohibited. All rights reserved.