Evolving Court Views on Requests for ISP User Identities

Moreover, for example, in New York there is a procedure (pursuant to C.P.L.R. '3102(c)) for doing this before the commencement of an action. Copyright cases, however, are usually brought in federal court where no such procedures exist. In such cases, plaintiffs generally sue the alleged infringers as anonymous defendants (John Does) identified by IP address and then serve subpoenas on the ISPs requesting the subscriber information. ISPs generally do not resist these subpoenas, but they will often inform the subscribers that their information has been subpoenaed and those users may move to quash. Until recently, courts have not had much sympathy for such motions, but some courts have now reevaluated the issue. Somewhat surprisingly, in just the last few months three different New York federal judges who examined motions to quash ISP informational subpoenas reached three different answers, each of which is worth review.

Most ISPs use a system called “dynamic DNS addressing,” in which the IP address of a home router that connects multiple devices to the Internet may change over time. A given IP address may be reused and reassigned to different ISP subscribers. In addition, IP addresses can be faked and, even if the IP address can be mapped with certainty to a given computer, there is no way to know who was using the computer at the time any infringement took place. In a case involving hundreds of thousands of dollars in potential personal liability, it is vitally important to get those issues right.

Given only the router's IP address, there is no way to know what device inside the home or office was used for the infringing conduct. If a wireless network is in use, there is also a chance that the conduct was committed by an outsider, whether sharing the connection or exploiting an insecure or hacked wireless access point. Courts are increasingly sensitive to these issues and are less and less likely to assume that the subscriber assigned an IP address is necessarily the person responsible for the acts of that address.

But if an IP address is associated with infringing conduct ' even as only one part of a “swarm” of users linked by decentralized file-sharing software like BitTorrent that breaks files into small pieces and seeds those pieces to a group of computers connected together in a peer-to-peer network ' a copyright infringement plaintiff will generally be permitted to seek the associated subscriber information. Even where a court recognizes that the subscriber may not actually have participated in the conduct, the general view has been that the search has to start somewhere. But recently that view has started to shift.

John Wiley & Sons

To understand the exceptional cases, it is helpful to look at a typical one. In John Wiley & Sons v. John Does Nos. 1-35, 12 Civ. 2968 (S.D.N.Y. 2012), decided by the federal court in the Southern District of New York in December 2012, Judge Robert W. Sweet was faced with what has become a common situation. Plaintiff book publisher Wiley filed a complaint alleging that various unknown defendants IP addresses access, copy and distribute Wiley's copyrighted works through networks of ISPs using BitTorrent. Wiley moved ex parte for ISP subpoenas seeking subscriber information. Judge Sweet granted the motion. One of the subscribers (John Doe No. 25) then came forward with a motion to quash as to her information. Although the motion itself revealed the identity of John Doe No. 25, the district judge held that was not dispositive and that the motion was not moot. The court went on to find, however, that Doe No. 25's identity was a proper subject of discovery and therefore denied the motion to quash.

This was not a controversial opinion, but it provides a useful roadmap to the issues. The court first noted that the First Amendment affords some privacy to Internet users, but that anonymity cannot be used to mask or facilitate copyright infringement. Then, citing two cases from its parent U.S. Court of Appeals for the Second Circuit, it set out the factors to be considered in striking that balance between privacy and enforcement:

• Whether the plaintiffs have made a concrete showing of a prima facie claim of actionable harm;
• The specificity of the discovery request;
• The absence of alternative means to obtain the subpoenaed information;
• A central need to obtain the subpoenaed information to advance the claim; and
• The Internet user's expectation of privacy.

(Sony Music Entertainment v. Does 1-40, 326 F. Supp. 2d 556 (S.D.N.Y. 2004) and Arista Records v. Doe 3, 604 F.3d 110 (2d Cir. 2010).)

The court then briefly analyzed each of these factors and held that all favored disclosure of Doe No. 25's identity: Wiley had made a prima facie showing of infringement, had issued limited requests, had no alternative means of securing the
information at issue and had demonstrated a need for the information to advance its claim. As for the fifth factor, expectation of privacy, Judge Sweet held that Doe No. 25 was entitled to only a “minimal” expectation of privacy in the “transmission or distribution of copyright materials.” The district court also considered Doe No. 25's argument that her ex-husband, not she, had been the person using the computer to download the materials at issue. Although noting the problems inherent in equating IP addresses with individual conduct, the court considered those issues premature at the early discovery phase and so ordered that Doe No. 25's information be produced.

Patrick Collins

If the John Wiley case was typical, Patrick Collins Inc. v. Doe 1, 12-CV-1154 (E.D.N.Y. 2012), decided a month earlier in November 2012, was the opposite. Patrick Collins, which owned the copyright in the adult film Gangbanged, sued the defendant and eight other John Does, identifying them by IP address and alleging that they had shared the film through BitTorrent. Patrick Collins also filed similar suits against dozens (or hundreds) of other defendants, in each case naming a group of John Doe defendants based on the IP addresses found in their BitTorrent swarm. The plaintiff then sought leave to issue ISP subpoenas for the names, addresses, phone numbers and e-mail addresses of all of the John Doe defendants.

On May 2012, Eastern District Magistrate Judge Gary Brown issued a report and recommendation in related cases, largely denying discovery to the plaintiffs. Magistrate Brown found, among other things, that the plaintiffs were engaging in improper litigation tactics, that an IP address was not likely to identify a particular infringer and that the plaintiffs were not entitled to join multiple BitTorrent users in one case. The magistrate recommended that the district court dismiss the cases against all the defendants except “John Doe 1″ in each case (with leave to re-file individual cases), and permit subpoenas only for the names and address (not e-mail address or phone numbers) of those first John Doe defendants. He also took the extraordinary step of requiring that the ISPs deliver the information to the court ex parte and not to plaintiffs' counsel.

The plaintiff in Patrick Collins objected to the magistrate's findings and asked the district court to reverse them, but the court instead adopted the findings in their entirety ' including that the plaintiff had engaged in improper litigation tactics and that, in this case, it was not likely that the IP addresses would lead to the identity of a particular infringer.

At the heart of this extraordinary opinion is what one court in September 2012 called “plaintiff's copyright-enforcement business model,” which it identified as “essentially an extortion scheme, for a case that Plaintiffs have no intention of bringing to trial.” Media Products v. John Does 1-26, 12 Civ. 3719 (S.D.N.Y. 2012) That “business model” consists of identifying the IP addresses of computers in BitTorrent swarms downloading adult content, commencing mass lawsuits based on those IP addresses and then using ISP discovery to contact the individuals associated with those IP addresses and coerce or embarrass them into a quick settlement. Several courts have objected to this practice on the grounds that discovery is supposed to be a tool for trial preparation, not a way to bludgeon the opposition into settlement.

The opinion in Patrick Collins followed this lead. It contained a lengthy discussion of the BitTorrent adult film cases with citations and quotes from numerous opinions ' all very recent and all from New York federal courts ' describing improper plaintiff's use of ISP discovery. Based on those decisions and the facts before Magistrate Brown, District Judge Sweet concluded that the plaintiff engaged in improper litigation tactics, and the rest of the opinion largely flowed from this.

For example, Judge Sweet found that it was not likely that a given IP address will identify a particular infringer, citing the insecurity of wireless networks and the shared nature of IP addresses in most modern router setups. These are valid concerns and the decision certainly is not factually wrong. But it is hard to imagine a court reaching that conclusion were the plaintiff not so manifestly abusing the court's discovery process. [Editor's Note: In AF Holdings LLC v. Doe, 12-2049 (N.D. Calif. 2012), the Northern District of California refused to find a defendant liable under state law for alleged negligence in failing to secure his Internet connection from use by others. The district court further found that federal copyright law preempted the negligence claim.]

Similarly the Patrick Collins court came down squarely against the plaintiff's ability to join all members of a given swarm in a single case, requiring instead that cases be filed separately against each John Doe defendant (at much greater cost). “Swarm joinder” is a complex issue and there are arguments in favor of it and against it, largely relating to whether the defendants are likely to have substantially similar trial issues. Courts across the country, and within the Second Circuit, are sharply divided on whether and when it is appropriate, and there are well-reasoned opinions on both sides.

Malibu Media

If there is a middle ground between protecting the rights of copyright holders (however the courts may feel about the content) and preventing harassment, it may be found in District Judge J. Paul Oetken's November 30 decision in Malibu Media v. Doe No. 4, 12 Civ. 2950 (S.D.N.Y. 2012). Malibu Media is another BitTorrent pornography case in which the court had already limited the plaintiff's motion for expedited ISP discovery by denying its request for phone numbers, and requiring that the defendants and the ISPs be given a chance to object to the subpoenas prior to the production of any information. John Doe No. 4 did so.

Rather than basing its opinion on the litigation tactics of the adult film industry, the district court in Malibu Media considered the same five-factor balancing test set out in John Wiley. In doing so, it reached the same conclusion as the Wiley court on the first four factors, but it took a more careful look at the fifth factor ' the defendant's expectation of privacy. Noting the sensitivity of allegations relating to pornography and the possibility that the owner of an IP address might not actually be the infringer, the Malibu Media court held that the fifth factor required careful balancing. To achieve that balance, the court ordered that all defendants be permitted to proceed anonymously, with their information filed under seal.

The Malibu Media solution is elegant: It protects the privacy interest of defendants (who may or may not be infringers) while giving plaintiffs an opportunity to pursue their cases, if that is in fact what they intend to do. While it does not entirely shut down a plaintiff bent on abusing discovery to coerce a quick settlement, it certainly reduces the effectiveness of such tactics. Courts and litigants faced with similar issues in the future could do worse than to consider a similar compromise.

When copyright suits are instituted over file-sharing infringements that take place over the Internet, the copyright owner may not know much about who the infringers are. Even in the best case, a plaintiff is unlikely to start with much more than an Internet Protocol (IP) address ' the number that identifies a computer or group of computers that may have been used to download or share all or part of an infringing file.

Identifying Infringers

Until recently, the legal procedures for identifying a user associated with an IP address have been fairly routine. It is possible to determine what Internet Service Provider (ISP) “owns” a given IP address. So once a plaintiff determines the IP address of a suspected infringer, a subpoena can be served on the ISP asking for details about the subscriber associated with that address.

Moreover, for example, in New York there is a procedure (pursuant to C.P.L.R. '3102(c)) for doing this before the commencement of an action. Copyright cases, however, are usually brought in federal court where no such procedures exist. In such cases, plaintiffs generally sue the alleged infringers as anonymous defendants (John Does) identified by IP address and then serve subpoenas on the ISPs requesting the subscriber information. ISPs generally do not resist these subpoenas, but they will often inform the subscribers that their information has been subpoenaed and those users may move to quash. Until recently, courts have not had much sympathy for such motions, but some courts have now reevaluated the issue. Somewhat surprisingly, in just the last few months three different New York federal judges who examined motions to quash ISP informational subpoenas reached three different answers, each of which is worth review.

Most ISPs use a system called “dynamic DNS addressing,” in which the IP address of a home router that connects multiple devices to the Internet may change over time. A given IP address may be reused and reassigned to different ISP subscribers. In addition, IP addresses can be faked and, even if the IP address can be mapped with certainty to a given computer, there is no way to know who was using the computer at the time any infringement took place. In a case involving hundreds of thousands of dollars in potential personal liability, it is vitally important to get those issues right.

Given only the router's IP address, there is no way to know what device inside the home or office was used for the infringing conduct. If a wireless network is in use, there is also a chance that the conduct was committed by an outsider, whether sharing the connection or exploiting an insecure or hacked wireless access point. Courts are increasingly sensitive to these issues and are less and less likely to assume that the subscriber assigned an IP address is necessarily the person responsible for the acts of that address.

But if an IP address is associated with infringing conduct ' even as only one part of a “swarm” of users linked by decentralized file-sharing software like BitTorrent that breaks files into small pieces and seeds those pieces to a group of computers connected together in a peer-to-peer network ' a copyright infringement plaintiff will generally be permitted to seek the associated subscriber information. Even where a court recognizes that the subscriber may not actually have participated in the conduct, the general view has been that the search has to start somewhere. But recently that view has started to shift.

John Wiley & Sons

To understand the exceptional cases, it is helpful to look at a typical one. In John Wiley & Sons v. John Does Nos. 1-35, 12 Civ. 2968 (S.D.N.Y. 2012), decided by the federal court in the Southern District of New York in December 2012, Judge Robert W. Sweet was faced with what has become a common situation. Plaintiff book publisher Wiley filed a complaint alleging that various unknown defendants IP addresses access, copy and distribute Wiley's copyrighted works through networks of ISPs using BitTorrent. Wiley moved ex parte for ISP subpoenas seeking subscriber information. Judge Sweet granted the motion. One of the subscribers (John Doe No. 25) then came forward with a motion to quash as to her information. Although the motion itself revealed the identity of John Doe No. 25, the district judge held that was not dispositive and that the motion was not moot. The court went on to find, however, that Doe No. 25's identity was a proper subject of discovery and therefore denied the motion to quash.

This was not a controversial opinion, but it provides a useful roadmap to the issues. The court first noted that the First Amendment affords some privacy to Internet users, but that anonymity cannot be used to mask or facilitate copyright infringement. Then, citing two cases from its parent U.S. Court of Appeals for the Second Circuit, it set out the factors to be considered in striking that balance between privacy and enforcement:

• Whether the plaintiffs have made a concrete showing of a prima facie claim of actionable harm;
• The specificity of the discovery request;
• The absence of alternative means to obtain the subpoenaed information;
• A central need to obtain the subpoenaed information to advance the claim; and
• The Internet user's expectation of privacy.

( Sony Music Entertainment v. Does 1-40 , 326 F. Supp. 2d 556 (S.D.N.Y. 2004) and Arista Records v. Doe 3 , 604 F.3d 110 (2d Cir. 2010).)

The court then briefly analyzed each of these factors and held that all favored disclosure of Doe No. 25's identity: Wiley had made a prima facie showing of infringement, had issued limited requests, had no alternative means of securing the
information at issue and had demonstrated a need for the information to advance its claim. As for the fifth factor, expectation of privacy, Judge Sweet held that Doe No. 25 was entitled to only a “minimal” expectation of privacy in the “transmission or distribution of copyright materials.” The district court also considered Doe No. 25's argument that her ex-husband, not she, had been the person using the computer to download the materials at issue. Although noting the problems inherent in equating IP addresses with individual conduct, the court considered those issues premature at the early discovery phase and so ordered that Doe No. 25's information be produced.

Patrick Collins

If the John Wiley case was typical, Patrick Collins Inc. v. Doe 1, 12-CV-1154 (E.D.N.Y. 2012), decided a month earlier in November 2012, was the opposite. Patrick Collins, which owned the copyright in the adult film Gangbanged, sued the defendant and eight other John Does, identifying them by IP address and alleging that they had shared the film through BitTorrent. Patrick Collins also filed similar suits against dozens (or hundreds) of other defendants, in each case naming a group of John Doe defendants based on the IP addresses found in their BitTorrent swarm. The plaintiff then sought leave to issue ISP subpoenas for the names, addresses, phone numbers and e-mail addresses of all of the John Doe defendants.

On May 2012, Eastern District Magistrate Judge Gary Brown issued a report and recommendation in related cases, largely denying discovery to the plaintiffs. Magistrate Brown found, among other things, that the plaintiffs were engaging in improper litigation tactics, that an IP address was not likely to identify a particular infringer and that the plaintiffs were not entitled to join multiple BitTorrent users in one case. The magistrate recommended that the district court dismiss the cases against all the defendants except “John Doe 1″ in each case (with leave to re-file individual cases), and permit subpoenas only for the names and address (not e-mail address or phone numbers) of those first John Doe defendants. He also took the extraordinary step of requiring that the ISPs deliver the information to the court ex parte and not to plaintiffs' counsel.

The plaintiff in Patrick Collins objected to the magistrate's findings and asked the district court to reverse them, but the court instead adopted the findings in their entirety ' including that the plaintiff had engaged in improper litigation tactics and that, in this case, it was not likely that the IP addresses would lead to the identity of a particular infringer.

At the heart of this extraordinary opinion is what one court in September 2012 called “plaintiff's copyright-enforcement business model,” which it identified as “essentially an extortion scheme, for a case that Plaintiffs have no intention of bringing to trial.” Media Products v. John Does 1-26, 12 Civ. 3719 (S.D.N.Y. 2012) That “business model” consists of identifying the IP addresses of computers in BitTorrent swarms downloading adult content, commencing mass lawsuits based on those IP addresses and then using ISP discovery to contact the individuals associated with those IP addresses and coerce or embarrass them into a quick settlement. Several courts have objected to this practice on the grounds that discovery is supposed to be a tool for trial preparation, not a way to bludgeon the opposition into settlement.

The opinion in Patrick Collins followed this lead. It contained a lengthy discussion of the BitTorrent adult film cases with citations and quotes from numerous opinions ' all very recent and all from New York federal courts ' describing improper plaintiff's use of ISP discovery. Based on those decisions and the facts before Magistrate Brown, District Judge Sweet concluded that the plaintiff engaged in improper litigation tactics, and the rest of the opinion largely flowed from this.

For example, Judge Sweet found that it was not likely that a given IP address will identify a particular infringer, citing the insecurity of wireless networks and the shared nature of IP addresses in most modern router setups. These are valid concerns and the decision certainly is not factually wrong. But it is hard to imagine a court reaching that conclusion were the plaintiff not so manifestly abusing the court's discovery process. [Editor's Note: In AF Holdings LLC v. Doe, 12-2049 (N.D. Calif. 2012), the Northern District of California refused to find a defendant liable under state law for alleged negligence in failing to secure his Internet connection from use by others. The district court further found that federal copyright law preempted the negligence claim.]

Similarly the Patrick Collins court came down squarely against the plaintiff's ability to join all members of a given swarm in a single case, requiring instead that cases be filed separately against each John Doe defendant (at much greater cost). “Swarm joinder” is a complex issue and there are arguments in favor of it and against it, largely relating to whether the defendants are likely to have substantially similar trial issues. Courts across the country, and within the Second Circuit, are sharply divided on whether and when it is appropriate, and there are well-reasoned opinions on both sides.

Malibu Media

If there is a middle ground between protecting the rights of copyright holders (however the courts may feel about the content) and preventing harassment, it may be found in District Judge J. Paul Oetken's November 30 decision in Malibu Media v. Doe No. 4, 12 Civ. 2950 (S.D.N.Y. 2012). Malibu Media is another BitTorrent pornography case in which the court had already limited the plaintiff's motion for expedited ISP discovery by denying its request for phone numbers, and requiring that the defendants and the ISPs be given a chance to object to the subpoenas prior to the production of any information. John Doe No. 4 did so.

Rather than basing its opinion on the litigation tactics of the adult film industry, the district court in Malibu Media considered the same five-factor balancing test set out in John Wiley. In doing so, it reached the same conclusion as the Wiley court on the first four factors, but it took a more careful look at the fifth factor ' the defendant's expectation of privacy. Noting the sensitivity of allegations relating to pornography and the possibility that the owner of an IP address might not actually be the infringer, the Malibu Media court held that the fifth factor required careful balancing. To achieve that balance, the court ordered that all defendants be permitted to proceed anonymously, with their information filed under seal.

The Malibu Media solution is elegant: It protects the privacy interest of defendants (who may or may not be infringers) while giving plaintiffs an opportunity to pursue their cases, if that is in fact what they intend to do. While it does not entirely shut down a plaintiff bent on abusing discovery to coerce a quick settlement, it certainly reduces the effectiveness of such tactics. Courts and litigants faced with similar issues in the future could do worse than to consider a similar compromise.