Defending Your Sensitive Information Against Hacker Attack.

What’s a lawyer’s worst nightmare? Well, we’ve all awoke in a cold sweat at 3 am and wondered if we had missed a deadline, but near the top is the possibility that all our clients’ confidential information and our confidential and privileged communications with them become public. If we left our office doors and file room inadequately secured and someone extracted our paper files and printed them, we would lose our client’s trust and potential clients would think twice before engaging us.

Now, think what this might mean if a firm represents high profile clients in controversial matters that stir emotions, and the person or persons mucking with the firm’s files is highly motivated, sophisticated, and infamous. However, instead of just paper files, the intruder obtained all the firm’s e-mails and other electronic records. Such is the plight of the law firm of Puckett and Faraj, PC; a multi-office firm specializing in military defense. One of their highest profile clients, Marine Frank Wuterich, was involved in the much publicized incident in Haditha, Iraq in 2005 in which 24 Iraqi civilians were killed. Mr. Wuterich plead guilty to dereliction of duty and his worst penalty could be his demotion to the rank of Private without other significant penalty.

In early February, without warning, the hacktivist group that goes by “Anonymous” hacked into Puckett and Faraj’s website, defaced it and left behind a headline that read: “ANONYMOUS HACKS PUCKETT & FARAJ – EXPOSES 3GB OF PRIVATE EMAILS DETAILING SSGT FRANK WUTERICH WHO MURDERED DOZENS OF UNARMED IRAQI CIVILIANS AT HADITHA”. You can see the entirety of the screen grab here. Anonymous also stole a large number of e-mails, trial exhibits and other confidential information that related to Mr. Wuterich but also to a large number of other clients. Anonymous has made the information available on Pirate Bay.  Gawker has reviewed a small part of the information provided and has found embarrassing and sensitive material relating to defendants and persons unaffiliated with Mr. Wuterich, including the identity of some sexual assault victims.

Texas Lawyer asked us to write an article on this subject and we were glad to do so.  The same article was picked up by Law Technology News.  You can see the articles here and here.

Now, regardless of politics, views on the Iraq war or what a person may believe would be adequate justice for Mr. Wuterich, one of the most honored notions of our society is that everybody should be afforded the opportunity for an adequate defense and that attorneys that provide such defenses are performing a useful societal function. To be swept up in a broad brushed approach to retaliating against perceived injustices and perhaps having their reputation, firm and livelihoods decimated, seems to be undue punishment for such deeds. Also, for other people to have embarrassing and sensitive information divulged is perhaps unintended but nonetheless most unfortunate.


OK, Maybe You Can Be Anonymous And Your Scream Can Be Heard In Cyberspace.

Hard on the heels of the Doe v. SEC case discussed in the immediately preceding post, another case where anonymity is sought comes through the Northern District of California.  In Art of Living Foundation v. Does 1 - 10, the plaintiff seeks the identity of one of the defendants in an action for copyright infringement, among other things.

The plaintiff is an international foundation that teaches the philosophy of Ravi Shankar, the spiritual leader, not to be confused with famed sitarist, Beatles confidant and Norah Jones' father of the same name.

One of the defendants goes by the online pseudonym of Skywalker and has been critical of the teachings of the Art of Living Foundation.  In addition, Skywalker put one of the manuals used by the Foundation online.  The Foundation sued Skywalker and others for defamation, copyright infringement, trade libel and misappropriation of trade secrets.  The Foundation moved for a subpoena to Skywalker's blog host seeking Skywalker's identity.  Skywalker, anonymously, through an attorney, moved to quash.  The magistrate allowed the subpoena and Skywalker brings this appeal.

The magistrate applied the standard of Sony Music Entertainment Inc. v. Does 1 - 40, 326 F. Supp. 2d 556 (S.D.N.Y., 2004) and found that Plaintiff had alleged a prima facie case of copyright infringement due to the online publishing of the manual, the subpoenas were targeted to obtain information to identify the defendant, Plaintiff had no other means to identify Skywalker, without such identity, it would be prohibitively expensive to conduct discovery and even if Skywalker had engaged in protected speech, he had no expectation of privacy because "the First Amendment does not shield copyright infringement".

On appeal, Skywalker alleged that because his speech concerned a matter of public interest, the Court should apply the more rigorous standard used by Highfields Capital Management L.P. v. Doe, 385 F. Supp. 2d 969, 975-76 (N.D. Cal. 2005).

The Court of Appeals stated that the more rigorous standard in the Highfields case required (in addition to the factors considered by the magistrate) that the court balance "the magnitude of the harms that would be caused to the competing interests" by their ruling.  The Court held that because of the nature of Skywalker's speech (i.e. more political, religious or literary rather than commercial), the Highfields approach balances the parties' interests better than the Sony approach.  The Court also found that evidence of copyright infringement does not automatically remove the speech at issue from the scope of the First Amendment.

The Court found that, to the extent that Skywalker's anonymity facilitates free speech, the mere disclosure of his identity is itself an irreparable harm and that the plaintiff can continue its case, in view of the fact that Skywalker has been participating in the case through his attorney.  The Court quashed the subpoena.

It is possible that the Court would have reached a different result if Skywalker had not removed the manual from his blog because of a DMCA take down notice or if Skywalker had not been actively involved in the lawsuit.  In any event, Skywalker remains anonymous for a while.