Oral argument — Lightspeed Media v. AT&T Internet Services

Let's see. The first case on today's afternoon talk is Lightspeed Media Corporation v. AT&T Services et al. And, let's see, I'm not sure what we have here. We have Mr. Paul Duffy and Kevin Horner for the appellant. And you're, excuse me? For the appellate. For the appellate. Well, you're under the appellant spot here. The same argument. We have Mr. Bart Huffman who is under the appellate spot, but I guess the other one was taken, so. And you'll be arguing for the appellate, Mr. Huffman? Yes. Okay. Well, good. Great. You may proceed when you're prepared to do so. Thank you, Your Honor. May it please the Court, my name is Bart Huffman and I'm an attorney here for respondents at AT&T Internet Services, Verizon Online, and a couple of affiliates of AT&T and Verizon that joined in this appeal. This is, as Your Honors may be aware, is a proceeding pursuant to Rule 224 of the Illinois Supreme Court rules for discovery to ascertain the identity of a prospective defendant with respect to a prospective lawsuit. The petitioner here, excuse me, filed this petition seeking discovery from over 20 Internet Service providers with respect to a couple hundred IP addresses. And the petitioner contends that these IP addresses correspond to instances of alleged hacking into plaintiff's adult content websites. The petitioner contends it has claims against these Internet account subscribers under the Computer Fraud and Abuse Act, federal statute. In this case, a final order was entered by the trial court granting the petition on November the 9th, 2011. The order was entered in direct contravention of the requirements of Rule 224 and fundamental notions of due process. In particular, the order was issued ex parte without a hearing and without prior issuance or service to the summons on the respondents. Yet, Rule 224 clearly requires notice in the hearing and the case laws... November the 9th. Pardon me. November the 9th, six days after he filed the petition. Fourteen days, Your Honor. So it's supposed to be the... It was filed on November the 3rd. It was filed on November the 9th is the date that I had, Your Honor. The, excuse me, the order was November the 9th. You're correct. Six days after the petition was filed. That's correct, Your Honor. Six days after the petition. And pursuant to the rule, then we should have, the respondents should have gotten 14 days notice and an opportunity to be heard in connection with the discovery sought against them. And one of the showings there is that the discovery is necessary and that the action has been properly brought and the discovery is properly sought. The order was by its terms final. It says that the order of judges, orders of the judges that the petition is granted and grants lights be the authority of the court. The circuit court filed a summons on November the 3rd. There was a summons issued, it appears, on November the 8th by the clerk. The day before the order was actually entered. So it appears that the clerk entered, issued a summons. That summons was never served on anybody, but the clerk evidently did issue a summons. The summons was given to the sheriff or what? I received it from counsel for petitioner. I don't know. I'm not aware. My client's never been served with it. So I'm not aware that it was ever served. It appears it was effectively nullified by the November the 9th. The November 8th summons sets a January 5th hearing. And then on November the 9th, the trial court went ahead and granted the petition. So there's really no purpose for the January 5th hearing at that point because the order has been, a petition has been granted. Okay. And then the, so this petition was granted ex parte, and then the petitioner actually issued a subpoena under the pursuance of the authority of the order. And often these things, the ISPs, I think, have taken to being more vigilant in some of these matters. But typically these kind of things come into a clearinghouse type of operation within an ISP, which will get an order and a subpoena and sometimes just comply. But in this case, Verizon forwarded it to counsel, and we looked at it and said, we're respondents. We never had notice of a hearing. There's been no, we've never been served. We're not aware of this lawsuit at all. It's the first we've ever seen of it. So a lot of the other defendants here, have they did themselves? I believe, Your Honor, the other respondent defendants have, the case has been stayed pursuant to this court's order. But some of them may have produced information to the plaintiffs themselves. And some, for example, I believe maybe Comcast started and then stopped when they got the statement. Universities or colleges did that as well, probably. They might have done that as well, Your Honor. So we believe that it's fairly straightforward that the requirements here were not met. And indeed, I attempted to communicate with this, with Light Feet's counsel about this to no avail. We do believe in any event that the petition was improper and that the appropriate thing would have been not for the trial court to enter it, even had there been a hearing, but that the trial court should have denied that the petitioner has asserted a Computer Fraud and Abuse Act claim. Yet, the only applicable basis for jurisdictional basis for such a claim is to plead fact sufficient to allege damages of at least $5,000 per defendant per year. And their only allegation in the petition is that some 200 does allegedly accessed a website using a hacked password. So there's really nothing there. The cases armed with much more, by way of information, have declined to permit an action to proceed under the Computer Fraud and Abuse Act. And simply alleging that somebody had a password and accessed the website isn't going to suffice under the Computer Fraud and Abuse Act. Because it doesn't meet the minimum monetary amount? Yes, and I apologize for hesitating a bit on the jurisdictional statement, but sometimes it is phrased like that in the case law, that basically in order to – the Computer Fraud and Abuse Act, of course, there's the criminal components to it as well as civil components, and there are certain criteria by which you become eligible to assert a civil claim. One of them is if you can show that you have more than $5,000 in damages. The others aren't applicable here. And I don't think that's in dispute. This is sort of a standard civil – and what you need to show is that $5,000 worth of damage to your computer system, not that you had some other tangential losses. It has to be that the actual unauthorized access damaged you in the amount of at least $5,000. And here they have to, under the case law, they have to show – the Stone case, I believe we cited, they have to make it showing sufficient to pass a motion to dismiss, a 615 motion to dismiss, and they have not done so. Many of the allegations in the petition, when scrutinized, and we've seen similar petitions and similar complaints in a number of other lawsuits filed by this plaintiff and others, many of the allegations are more generally stated. They'll say things like, hackers may sometimes do this, or hackers could do this, or one might do this, or they – there are no specific – and I'll get to next. There are no specific allegations specifically directed to the individuals that they want to identify as potential defendants here. And that leads to my next point, which is that the petition is also improper because of the way it's cast. It's been cast abroad net. It purports to use – be able to use this rule, which is designed to identify a defendant for a single lawsuit. It purports to cast abroad net to obtain from numerous defendants – excuse me, numerous ISPs, Internet Service Providers, the identity of numerous potential defendants who are not related and not necessarily potentially joined in one lawsuit. And it wants to do all of that in the context of one proceeding in St. Clair County, Illinois. And that is not, we believe, contemplated by the rule. And it's not the case, even though it might be for business reasons more strategic, it's not something that's appropriate. For example, here in the problems that lead – that can flow from a different interpretation are, for example, that there could be no in. If you can just name – if once you get one ISP that might arguably reside for venue purposes in a given county, you could get as much discovery as you want from as many other ISPs as you want, you could name and seek discovery from the Hawaii Telecom Company here or from anybody in a single suit. So that doesn't make sense. And secondly, the Illinois fact-clearing requirements, and the court – this court has emphasized that you need to actually be seeking a lawsuit against a particular defendant. The Illinois fact-clearing requirements would require here facts alleging claims against each of these purported defendants. So in other words, it wouldn't be enough to say hackers in general do this kind of stuff, and here's my list of 200 IP addresses. You would have to say that dough number 72 damaged me in excess of $5,000 in this manner, right? And I'm in Congress to bring a lawsuit against him here because. So as we've highlighted in our paper, this particular lawsuit is part of a general trend across the country involving what is sometimes cast as an attempt to obtain settlements en masse as opposed to actual lawsuits. And sort of the – we do care with respect to identifying individuals. It has to be made, and we'd like to see the procedures at a minimum be followed. Those are the main points that I have at this point. Would you entertain any questions? I don't believe we do, and you'll have the opportunity to come to our rebuttal this afternoon. Thank you. Nothing? Thank you. Good afternoon, may I please have support? My name is Paul Duffy. I represent the Applebee's Lightspeak Media Corporation. Sir, could you speak up just a little bit because we're recording and we can't pick it up if it doesn't. Yes, Your Honor. I represent the Applebee's Lightspeak Media Corporation, and a few comments I'd like to make at the outset just to put this case in context is that the counsel who just spoke represents an Internet service provider. He doesn't represent anybody who has been named in a lawsuit. He doesn't have standing to raise substantive claims and defenses on behalf of a defendant in a lawsuit. He doesn't have any factual basis to suggest he has a right to assert substantive defenses to liability to an individual who may at some point be named in a lawsuit, not hypothetically. And I also need to recharacterize this is not a case about obtaining settlements from individuals across the country. There's no scheme to obtain settlements. There is, in fact, a lot of copywriting, I'm sorry, a lot of pirating of protected information from the Internet. The petitioner in this case is Lightspeak Media Corporation, who several months before he initiated this litigation and other lawsuits in St. Clair County had observed through software he developed 13,000 different successful attempts to hack into and take content from his Internet site. He, that entity, the petitioner, chose to file suit against a subset of those who he believed, based on the factual information that he submitted along with his petition, that those individuals represented among the worst of the hackers. He filed a suit in order to try to identify who the individuals are based on the information that was available to him. And in terms of identifying who the hackers were, the software that he was able, the computer information he was able to obtain was the Internet protocol address of the individual who was hacking through a site from an individual located in St. Clair County, somebody who was hacking into the site and illegally appropriating the content. He was having massive amounts of his content being stolen through hacking. He filed a suit against what he believed was a subset of the most severe hackers and this has proceeded along with this and a similar case in St. Clair County against several unknown Doe individuals. The purpose of this action was to file a Rule 224, was to proceed under Rule 224 to identify the names of the individuals who he saw hacking into his site. Again, the only information that he has about them is the Internet protocol address. The only way that he can obtain the identity of who owns that address and whose address was used to hack into the system is to get from the Internet service provider the name and identifying information of the individuals for purposes of following up and determining where exactly the individuals were, where they are susceptible to suit and being able to sue them in order to protect the content that the petitioner had continually observed being stolen from him through hackers. The simple question in this case is how can the petitioner protect his material? How can he prevent it from being stolen? And the only way he can do it is to find the person who's stealing it. It's akin to a situation where somebody, a business is robbed, for instance, and an individual sees a getaway car with a specific license plate and trying to find out who that license plate belongs to. The person who committed the crime may not be the person driving the car, but at least the information as to who owns the car is at least a reasonable starting point to try to identify who committed the theft. And that's exactly what this individual is trying to do. He's trying to obtain simply the identifying information about the hackers. And the hacking, again, is significant. Before he filed the suit in the last several months of 2011, he observed, despite taking action to prevent hacking, he observed 13,000 specific hacking attempts that were successful. After starting this litigation, there were nearly 1,800 additional hacking attempts by the exact same individuals who were among those who he's trying to seek to identify in order to pursue his rights. The fact is that this case cannot go forward unless, and this individual cannot protect his copyrighted material without the information about who owns these strings of numbers that are assigned to his Internet protocol addresses. And interestingly, the Internet service providers don't really dispute that. They don't deny that there's massive hacking going on with these individuals of this company's site. They don't offer any steps that they've taken to try to prevent the hacking. They don't point to any notice they gave to their subscribers to stop hacking into the site or any other type of notification. Instead, all they've done is taken every measure of legal recourse they can to prevent the petitioner from getting even one single name. They've taken essentially the position that identifying one single Internet protocol address is unduly burdensome and they shouldn't have to produce that information. But the petitioner here took full advantage of Illinois Supreme Court Rule 224, which was designed specifically for this purpose, to identify a person who has caused injury to a petitioner. Initially, I have to point out that there was not, the counsel referred to an ex parte order, there was not an ex parte order. The court entered it on its own. The petitioner did not notice it, nor have a hearing, nor have any opportunity to participate in the hearing. It was something that the court did on its own volition after reviewing on its own the papers that were filed in connection with this case. When the petition was filed, was there a request for a hearing? The petition did include a request for a hearing, but the court granted it on its own. Did you all get any summons when you got the petition? Did you get the summons there? The summons, I believe the proposed summons was attached to the petition and the court entered the summons on, the court entered the initial order on November 8th, which was the summons set in the manner of the hearing. Did the clerk give the summons back to you to take it to the sheriff to do that then? Staff had returned it to the petitioner, yes. I don't know, I believe, and I do believe it was served. I'm not sure who the sheriff served it or the process server served it, but our position is that it was served. We disagree with the internet service providers that it wasn't served, but they did return the order to us setting the hearing date for January 5th. Why would it be unclear whether or not it was served? I believe it was served. The ICPs are taking the position that it wasn't served, but I believe we did serve the summons. But is there documentation that would be in the file to show whether or not it was served? There would be in the file. They mentioned it in their appellate briefs. They didn't argue, they didn't make any motion based on lack of service. They did reference it, but that wasn't one of the substantive issues that they were raising in connection with their complaint, and they took the position that the 30-day notice of appeal was ran from the time they did issue those. What days were the summons given to the defendants? I do not have the date they were serving the summons. I believe at this point it's moved since they are here challenging substantively the order without moving to Washington State. They have to have a 14-day before they can have a hearing then? Yes, there was a summons, and there was the order granting the petition, and the ISPs acknowledged in their brief they received it, I believe, by November 23rd. So there's no question that they at least received it by November 23rd, and under the rule of the case law interpreting it was a 14-day notice provision. So they did acknowledge they had actual notice of the hearing on November 23rd, which is well before the January 14th. The court already had an order, though, right? I'm sorry? The summons shall be served at least 14 days before the date of hearing. I don't have the exact dates. Our petition was served 14 days before, and they've acknowledged they received it no later than November 23rd, which was longer than 14 days before the January 5th hearing. So anyway, I believe it was served that week, but even if there's a dispute about it, they've acknowledged they had it at least by November 23rd, 2011, which is longer than 14 days before the hearing. And it's important to point out that the second order, the November 9th order, said it granted the petition only to the extent the order specifically states it just allowed service of the subpoena on the Internet Service Providers. It didn't order the Internet Service Providers to produce anything before the date of the hearing. And the court said it established a hearing where the Internet Service Providers could raise their objections in connection with the entry of the order on January 5th. Did the court have an order granting your petition? Had an order granting it? On November 9th? Yes, and allowing us to serve subpoenas on the Internet Service Providers. It's narrowly defined. But isn't that a little bit like a party for the horse? Well, the day before he set the hearing for January 5th, the next day he set a hearing allowing us to serve the subpoena, not requiring any of the Internet Service Providers to respond. There was a January 5th hearing that stood after the order allowing us to serve the hearing. And that's the level of protection that's required under Rule 244. The requirements are that we serve a verified petition, which we did, that we petitioner state the reason for the proposed discovery, which was that we had these numbers. We don't know who they belong to. We had no other way of doing it except for discovery. The discovery was limited to people who were responsible for damages. The petition states that the Internet Service Providers, I'm sorry, the Internet Protocol addresses were the ones that were observed by the petitioner hacking into his website. And finally, the court must hold a procedural hearing to determine if the unidentified person who may be responsible for the damage. And the court order on November 8th set that hearing to occur on January 5th. The next day's order just allowed us to serve the hearing. What was the purpose for having a hearing there in February? For what reason if the court has always had the norm? It was only an order to the extent of allowing service of the subpoena. There were over 20 Internet Service Providers in connection with this case, most of which didn't object. So if the Internet Service Provider chose to comply with the subpoena, served upon that but not participated in the January 5th hearing, it didn't have any right to do that. Or if it wanted to take some other action, for instance, file a motion for protective orders so they wouldn't respond until after the hearing. The January 5th hearing remained on the calendar until the notice of appeal. After the notice of appeal was filed and the two moving Internet Service Providers moved to stay the entire litigation. So it had the effect of relieving the other 20-some Internet Service Providers who didn't object and who weren't going to participate in the hearing from producing any information through now. So the effect of the premature notice of appeal was to stay the litigation and allow the hacking to continue to the petitioner's website with not even obtaining a single name that this person, this company, can proceed against for purposes of protecting this protected information that's being hacked into. It had the effect of staying the litigation, in other words, for Internet Service Providers. Internet Service Providers had never objected in the first place to producing the information. In any event, the court kept the... I mean, and again, the court did this on its own. We filed the papers and the court entered the order without any... It was not at a hearing that we said we didn't participate. Lightspeed didn't participate in the hearing, so it's not accurate to call a next-party order as a no-party order, but the court entered a proposed order on its own. But the fact is that it gave ample opportunity for, in its order, on January 5th, these exact same ISPs to raise their objections and to object to producing the information. But as I understand it, when I said it's almost like, you know, once the barn door is open and you can't shut it, whether or not a petition and discovery should be allowed, period. I mean, you're then jumping ahead to whether or not to allow particular production, but you don't have to seek permission from the court to issue a summons. That's how you initiate a petition. But the November order only authorized servings. It didn't require any ISP to produce it by a specific date. By entering the order, the court has decided that it will proceed with an action in discovery, correct? Then it would maybe determine how to proceed. But isn't that the whole purpose of having a hearing before, is to determine whether or not an action in discovery is appropriate? The rule doesn't require holding a hearing before serving as a petition, but it requires a hearing before. That's exactly my point. They didn't have to have a hearing to serve the subpoenas. They were supposed to have a hearing after they served the subpoenas to determine whether or not there was the necessity of a discovery action. Well, I think that's what occurred. Lightspeed did serve the subpoena, and the court had scheduled a January 5th hearing to hear objections to those subpoenas and to hear it. And, again, the case law requires a hearing. Objections to the subpoenas or objections to proceeding in a discovery action? Objections to producing documents responsive to the subpoena and proceeding with the discovery action. The purpose of the hearing is not to protect the third-party repositories of information. The purpose of the hearing is to test whether the petition and counsel is inaccurate or that the petition is not required to sustain a 2615 motion to dismiss the cases they decided all occurred. Defamation cases where there's a balancing between the petitioner's need to know information and the person's First Amendment-protected ability to speak anonymously. Those cases did require due review. That line of cases requires pleading to be able to survive a rule 615 motion to dismiss for defamation, but those don't apply here. All that the rule requires is to state how the petitioner was injured for purposes of whether to produce the identifying information. The purposes of the hearing is to make sure that, first of all, that the petitioner has adequately stated some basis for stating how he was injured, how the individual whose identity he seeks to learn was injured, and to protect the interests, whatever countervailing interests. So what then was the purpose of the interim order? The interim order just said that we could cert that the petitioner could serve subpoenas on the internet service providers. But do you need an order to do that? That's my question. I read the petition to say, I mean the rule to say, A, it tells you what's in the petition, and then one, and then two, the petitioner shall serve upon the respondent a copy of the petition in summons. And then including in that the petition has to, each respondent has to state a date when they're going to have a hearing, and at that date the report will determine whether such an order shall be entered in the case. So there was no purpose for a hearing in order to be entered to allow the petitioner to serve the summons. Not under Rule 224, but the petitioner asked for, the one countervailing issue is that the internet service providers typically maintain the identities of the IP address owners only for a short amount of time. So I believe the petitioner must have included a request to serve a subpoena on the internet service providers for the purposes of having them maintain that information rather than destroy it before the hearing was to occur. Rule 224 doesn't specifically require leave to serve a subpoena. So you felt like you needed to get that information before 14 days had expired. We felt the need to subpoena it before it was destroyed in connection with the normal data destruction policies of the internet service providers, which tend to be extremely short, in some cases a period of several days for some of the providers. So we wanted to at least have the, we requested the court to allow us to serve the subpoenas mostly, primarily for purposes of preserving the information. And then the January 5th hearing, which is still in place, the November 9th hearing did not vacate the January 5th hearing. In fact, that hearing stayed on, for additional notice, that hearing stayed on the docket, on that court's docket, until the matter was stayed for all purposes in connection with the pending appeal. So you're really kind of asking us to consider 224 as allowing kind of an emergency interim hearing. Not an emergency interim hearing. I think the only requirement is that there be 14-day notice of the petition and summons for the hearing. And I think the ISPs have acknowledged that they received that as of November 23rd, well before the 14 days before the hearing occurs. The rule, I believe, in cases interpreting it, require at least 14 days, I believe it's at least 14 days advance notice of the hearing. And the court picked the date that it picked, which is January 5th, which is the date of the hearing. The ISPs have acknowledged they had more than 14 days advance notice that the hearing was going to occur. And they chose not to participate in it. And again, the issue of, you know, basically we're in a position now, the short circuit of that process, chose not to participate in the hearing. And for us to be canceled with respect to even non-objecting ISPs, but the result that the petitioner still doesn't have a single name of the people, the individuals who will continue to use evidence are allowing, causing, or allowing hacking to occur through their IP addresses. And it's also prevented the case from going forward. The case cannot proceed at all because there's no ability to find out his name. So wherever these people, these individuals are located. Go ahead and finish your thought. Wherever these individuals are located, the petitioner wants to sue them wherever they are. He doesn't know who they are or where they are. So he can't move forward without the discovery allowed under Rule 224. Okay. Thanks very much, Mr. Jefferson. Steve has the opportunity for rebuttal. Thank you, Your Honor. First of all, let me address just quickly the issue of standing. We, I think, indisputably do have standing here. We are the respondents. We are the adverse party. And the rule specifically requires that we get notice and an opportunity to be heard. And as the courts of Illinois have held, the Supreme Court rules are not aspirational. They're to be followed. And we cited a case, I believe in our brief, that indicates also that the requirements of notice and hearing are consistent and essentially required by due process. So for us to be compelled to do something under pursuance of this rule, the requirements of the rule and the requirements of due process have to be met. The summons here, we certainly do contest and have contested that we did not receive notice and service of a summons. I received a summons first on December the 11th from Mr. Duffy and immediately asked him the same questions that this court has asked him, which is how does that address the fact that there's a deposition notice. You said a subpoena for deposition on the 30th. What's going to be the subject of the hearing on January the 5th if we already have this final order? And I got no response. And I filed under cover of an affidavit all that information in our opposition to the motion to dismiss that was filed by Lightspeed and denied by this court. So we did not have the summons until December the 11th when it was provided to me by counsel and not explained despite requests. And furthermore, the summons is issued. The form of the summons is part of the rule, comes right out of the rule. And it says that the purpose of the hearing is to determine whether such an order shall be entered in this case. In other words, the order of discovery. That's what the rule says. That's what the summons says. That was to be the purpose of the hearing on January the 5th. But the hearing on January the 5th didn't make any sense because the order had already been granted. It was a final appealable order, again, as I believe already implicitly recognized by this court when it denied the motion to dismiss and even before that when it granted the motion for an extension of time in which to appeal. Can I jump ahead a little bit? Aren't you also arguing, though, that they don't have any right to this fishing expedition? We have since Petitioner mentioned it, Your Honor. In the other Lightspeed case, there were 6,500 does named in that case. We contended in any connection to each other or to the one named defendant. How can you prevent them from discovering the identity of these people that are essentially stealing their product? They allege that that's the case, and to the extent that's the case, I think that they can certainly do so. They can't do it in an unrelated, they can't do it in too broad of a manner, if you will. In the case I was just mentioning just two weeks ago, the Illinois Supreme Court issued a supervisory order directing the trial court to vacate its orders and washing the subpoenas because, in that case, there were 6,500 individuals across the country that had nothing to do with each other, and they wanted to discover them all from one lawsuit in St. Clair County, Illinois. Here, similarly, but under a different rule, they passed a broad net again, seeking to, they have a laundry list of ISPs and a laundry list of IP addresses with some vague and conclusory allegations, and they want to get all that in one suit. If they want to file a suit, as the rule contemplates, to seek information to identify a defendant for connection with a lawsuit, or maybe even arguably find defendants that are actually in some way actually related to each other in a single lawsuit. And what do you mean by related? What's your definition here of related? If there's some allegation that they have some act in common with each other, they would support joining, whatever that might be. But simply saying that all these people committed the same wrong, there are a number of cases out there, but simply saying that all these people committed the same wrong against me in the same way, that's not enough to pull people in together for the purposes. And given what we've experienced, of course, and commented on across the country in terms of the coercive effect of giving information, identifying information to plaintiffs in connection with controversial adult content material and the settlements that arise therefrom without evidence having been tested, without the opportunity for sort of being heard by the individual customer subscribers, and given the ambiguities associated with the fact that the individual account subscriber, the person to be identified, may not be the same person that actually used the Internet account. A judge in New York recently said that that's the same thing as saying that the person who paid the phone bill was necessarily the person on the call. So there are all these concerns, and those drive our concern that the procedures be followed. Let me just one thing. You also have a KC at the Miami-Dade County? Yes, Your Honor. The same type there as you did here? There, Florida has an equitable bill of discovery proceeding, which is basically the old version of what is now codified as Rule 224. And what they did there was they didn't sue us intentionally. I mean, we believe on purpose. They sued the Doe's, but then they sought discovery from the ISPs under that proceeding, when really what they should have done is what this proceeding does, which is name the ISPs directly, in which case we get an opportunity to be heard. Thank you, Mr. Huffman, both of our attorneys and all trustees. Thank you, Your Honor. And Mr. Horner, we'll take matter under advisement and where you're going in due course.