# Oral argument — Tod Tumey v. Mycroft AI, Inc. > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/argument%3A79356 ## Record - **Collection:** Oral argument - **Document type:** Oral argument - **Published:** January 12, 2022 ## Text And good morning, your honors. May it please the court. No one should have to put up with cyber attacks or harassment, but this is an appeal from an extraordinary, drastic, and rushed preliminary injunction that should never have been entered. The injunction restrains a former Air Force officer who holds a national ethical hacker certification and whose job was to protect our country from cyber threats. And it restrains Mycroft, a company devoted to enhancing, not invading, consumer privacy. And I'd like to make two essential points today. First, the injunction is unconstitutional and invalid as a prior restraint on protected speech in violation of the First Amendment. And second, only conjecture and speculation, not evidence, even attributed any hacking to defendants in the first place. And let's start with the First Amendment. Your honors, the Supreme Court held in Ashcroft v. Free Speech Coalition that even when there is a tendency of speech to encourage unlawful acts, that is not a sufficient reason for banning it. Speech can be vehement, caustic, unpleasantly sharp, vituperative, abusive, crude, and offensive, but it is still protected by the First Amendment. And these are Supreme Court characterizations. The Supreme Court also holds that the special vice, this is their words, the special vice of a prior restraint is that communication will be suppressed either directly or by inducing excessive caution in the speaker before inadequate determination that it is Mr. Greenspan, this is Judge Smith. Was there any discussion before the district court on what speech your client intended to continue to initiate or to continue that the preliminary injunction affected? Yes, and that's the sharpest relief actually in the motion to vacate proceedings where the judge completely denied our effort to simply rewrite parts of the preliminary injunction to free it up to be at least inoffensive to the First Amendment. But could you be more specific? What is it your client feels inhibited from doing that he feels the First Amendment permits him to do? Yes, number one, posting on the blog, my client has a blog, posting any kind of communication or article describing the progress of the litigation. Descriptions of litigation and court proceedings are particularly protected under the First Amendment. Number two, discussions with... How does it apply when courts impose gag orders? I'm not sure, I don't understand this as a gag order, I understand this as a preliminary... I understand that, but I'm just trying to contrast the the issues and why there would be such a limitation on the court's ability to discuss with the parties or limit the party's discussions that affect the case, not their First Amendment rights generally, but their First Amendment rights or their rights of speech or the the things they choose to speak about with respect to a particular case. Yes, I understand the question now, Your Honor, and in criminal cases especially, courts have the power to control the What we have here is an injunction against incitement of unlawful activity, which is its own special category of very highly regulated prior restraints under First Amendment law. That's the Brandenburg v. United States standards. So you have to meet two standards to issue a prior... You have to meet two factors to issue a prior restraint properly against incitement of unlawful conduct, and two, there has to be a high likelihood that that unlawful conduct will occur. And here we have in Appendix 81 and Appendix 89 the exact exemplars used by the district court as so-called incitement. Not a single statement by my client was a statement, go out and hack the patent abusers, go out and hack the patent abusers' counsel. Those were not statements of incitement of unlawful activity. Those were statements of frustration with what was going on. The particular words that there was frustration with, quote, the matter, and how, quote, the matter, meaning a patent strike suit, a nuisance suit, needed to be, quote, nuked from orbit or dissolved in acid. The words were colorful, but the context, Judge, was also clear that it was a statement we will try to win in court and we will give no quarter or no comfort to the opponent while we make the attempt. And the full context of the full publication makes this extraordinarily clear, including callouts of specific lines of text that talk about we will take our appeal all the way to the Supreme Court if we have to. The other statement at Appendix 89 was a detailed factual report on really just on positive case developments. These are the things that are enjoined under the current injunction. We are not allowed to describe what happens to our benefit in the litigation on our own blog because on Appendix 1288, we tried to convince the court that that should be redlined into the preliminary injunction or a carve-out for us to talk about the case and the court refused. And so on Appendix 89, there is a statement where the conclusion of the reporting on the case progress was you will get your ass kicked when picking fights with someone trained in information warfare. Now again, colorful, but no court should be issuing prior restraints against bragging about predictions of litigation victory. And again, Your Honor, one thing they were not, none of these were statements of incitement. None of them were true threats of violence against any person. We're talking about, quote, nuking the matter from orbit. I mean, this is hyperbole and it's political hyperbole because it's on a topic of public interest around the country. This is patent abuse. This is a topic of a very charged debate on two sides of a political issue. So again, under Brandenburg v. Ohio, the district court just didn't have the authority under the First Amendment to issue these kinds of prior restraints on this record. So if Your Honors will let me, I'd like to move on to the hacking or the alleged hacking itself and the likelihood of success as a whole because plaintiffs, in our view, they really have no chance of prevailing. And we're really talking now just about the CFAA and the intrusion on seclusion tort because the SCAA claim, that's the middle of the three claims, that's now dismissed by the district court. And we submitted a second 28J letter to inform Your Honors about that. Now, third parties acted offensively and we don't have any sympathy for people who do violate the CFAA. Our clients did not and did not incite that. And the direct evidence on this included only my clients sworn denials at appendix pages 1174 to 77 and 1206 to 11. So in our view, Your Honors, and we think you'll agree when you review the record, there's not a shred of evidence, not a scintilla that linked any of the hacking conduct to defendants. So plaintiffs at appendix 1405 and 1448 in the hearing, these are hearing transcript excerpts, they admitted that there was no direct evidence. There was no forensic data presented to the district court, even though that's a kind of thing that is available to plaintiffs if they want to prove a case. So the absence of direct evidence is a controlling admission because the record at appendix 1165 describes the kinds of such as particular computer logs, etc. And Your Honors, the Supreme Court's Missouri case that's cited in our briefing on standards for a preliminary injunction, it says that if the showing won't fend off summary judgment, if the showing won't fend off summary judgment, it won't allow a preliminary injunction. Now, my colleague, Mr. Wooten will get up and I'm sure he'll talk about circumstantial evidence, but let's be clear, what he really means is a set of cherry-picked coincidences that juxtapose some litigation events with alleged increases in hack attempts. And plaintiffs cite no case, this is very important to us, Your Honors, they cite no case in which a party met its burden on a preliminary injunction motion to use timing coincidences alone when forensic data otherwise exists to attribute a hacking act to a specific person. Counsel, a question just crossed my mind. Is there anything that your client was doing or intends to do that is prohibited by the injunction? A post on the blog, updates on the litigation, for example, there is a very significant victory where a third party called Unified Patents in December convinced the Patent Office. What about SCA? I assume from your statements your client has no, hasn't, and has no intention of hacking in a way that would affect the litigation. That's absolutely right, Your Honor. In fact, in our briefing we state that to some extent the injunction is not problematic for us to the extent it just tells us don't break the law because we didn't break the law. So that's absolutely right, Your Honor. Our concern on that dimension is really the prior restraint on speech because what if, this is our fear, what if we post a case development that's very positive for us, we think our investors need to know about it, and just coincidentally there's some increase in hacking attempts. We're now brought before the District Court to answer on a motion for contempt when we had nothing to do with it and all we've done is protected speech. So, Your Honors, if I may conclude my opening remarks, there's just no evidence in this record that shows that defendants accessed any systems without authorization, caused any computer intrusion damage in excess of $5,000, or made any physical intrusion or eavesdropped on conversations. And if that did happen, the record would show plaintiffs reporting a data breach to their clients as required by Texas law. And, Your Honors, I can answer any questions from the court and, of course, address any other aspects of the appeal, but I'd like to reserve the rest of my time for rebuttal. I don't see any questions. Thank you, Mr. Greenspoon. Mr. Wooten. Yes, Your Honor. May it please the Court. I would first disclose that I am an attorney with plaintiff defendant Toomey LLP, but I am representing them and plaintiff or plaintiff appellee Todd Toomey personally. Let's first address the prior constraint argument in the First Amendment issues. As Mr. Greenspoon already stated, the defendants and appellants in this case are not worried about the issue of whether they're restrained from hacking. Their primary concern and their primary complaint is this inciting and whether they're going to be held liable for some third-party behavior. We do not believe that to be the case. The way the order is written as is, that being said, even the defendants who offered the opportunity to provide a red line, the court did not accept that red line, but if this court would look at that red line, the changes that they requested didn't change the inciting aspect of the order itself. They merely wanted to remove cyber attacks as one of the illegal activities that they were restrained from doing and replace it with phishing and unauthorized computer access. Those are the changes that they wanted to make. The rest of the scope of the meat of the order itself stayed the same. Here we believe that their fears are being cherry-picked as Mr. Greenspoon so colorfully put before that they're cherry-picking what possibly could happen, that these things, we're being restrained from talking about the litigation. He cited a few of these blog posts. Those blog posts, if you look at them carefully, not only do they identify personally Todd Toomey and Toomey LLP, they specifically identify the plaintiffs in this case. Then they talk about the political, colorful language that was quoted, nuking us from orbit, dissolving us in acid. They finish with kicking our butts. These are projected to a particular audience. They're talking about, they brag in that very same blog post about don't pick on cyber warfare specialists or you'll get your butt kicked. They're catering to people that do this exact thing. It's the conjunction of those two things together that we're trying to prevent. To move on to with respect and partially address what we were dealing with as a firm, that the hacking attempts were not just like random hacking attempts. We had severe spikes in the attacks that were occurring against our computer system. Counsel, this is Jed Smith. Is there something in the record to indicate attempts before this litigation began of any descript and something that could connect the increase that occurred during this litigation to conduct of the defendants? So the connection there would be a correlation between these spikes in activity. We're not talking about a random hack attempt on our server where there were one or two during the day. We're talking about hundred-fold increases. They correlate specifically with different activities in this case, whether it was service of the infringement contentions, refiling of the taxes. Those things were correlated with spikes in this hacking activity. The other thing that we did to try to correlate this and provide a direct tie with the defendants, the appellants in this case, was we set up what was called a honeypot. And we explained this in our briefing. Attribution as Mr. Greenspoon correctly identified is one of the problems in any type of hack like this. Hackers are adept at hiding their true identity. That's what they want to do. We were able to forensically tie two of our hack attempts that wound up shutting the firm down, shut down phone lines, emails. We weren't able to do anything for a couple of days twice in those attacks occurred. We were able to track those attacks through the first time to a server in Japan and the second time to a server in Vietnam. And my understanding is that there was a hooking in connection that was used to set up those connections with the server. What they did when they made those connections was that they spoofed our email addresses, sent out massive amounts of emails to clients that we had. And those things got us shut down because we wound up getting blacklisted on the email server itself. So we were no longer able to send out emails. We just kept getting sucked into their spam folder because of these attacks. Unable to directly tie that attribution, in other words, we were able to track it back to that server, but we weren't able to track it past that server to get who originally set that server up to do these nefarious activities. We set up a fictitious cyber expert and mentioned this fictitious cyber expert during a settlement agreement with the defendants in a prior case, in the patent case. There's an underlying patent case. It's 4.20CB00111 pending in the same court in front of the same judge, but it is a patent infringement case. In that case, that case precipitated these hacks. The reason this case was filed was that Toomey LLP and Todd Toomey are not parties to that case. So they had no recourse through that particular case. Back to this fictitious web expert. Well, I've read that in your briefing, but could you just be a bit more specific in terms of what confidence the court could have, the district court in this case and us on review, that these actions that you're describing taken against you are the responsibility of the defendants? I think the court would look at their order in total as the way it's written, and it would require more than just a hacking attempt. It would require some type of comment by the defendant's appellants in conjunction with a spike in this activity, and that would have to be coordinated with some activity absent of a direct forensic tie. Counsel... Is there something in the record to indicate the existence or frequency of these attacks post imposition of the injunction? Did they cease? Did they go down? Have they continued? Is any of that in the record to... Yes, your honor. There's a declaration by Todd Toomey that's associated with the... I'm trying to remember which pleading set it went with, but we've had two-week, three-week lulls where there was no activity in the cases, either one of the cases. And those lulls and activities, then the next filing, let's take the patent infringement case, for instance. We had a lull in activity when the case was refiled. There was a spike in activity, there was a lull. We filed our infringement contentions, there was another spike in activity. And so there's a direct correlation between these big spikes in the number of attacks that are occurring against our servers. And that's detailed, it's listed out in the appellate record. And those describe things that have occurred since the imposition of the injunction? So since the imposition of the injunction, we have had various things occur that were spikes in activity, different hacking attempts. We have had spikes in obscene phone calls. Speaking of phone calls, who made these, how do you describe them? Somebody breathing heavily on the phone? Yes, sir. Do you remember the 1961 movie Experiment and Terror? I do not. No, your honor. You might watch it someday. I will absolutely do that. But we have a receptionist that mans the phone line. We have a main number that almost all calls come through. When these calls started occurring, it would be repeated calls, multiple calls during a day for a period of days, in which the person on the other line would make heavy breathing. We have had recently, we had a call from somebody that was impersonating AT&T, wanting to gain access to our facility so they could look at our server. They said there was something wrong with their server. Upon contacting AT&T, they informed us that that was not an occurrence. Now, this occurred after the appeal record had been set. This was recent. But these activities have continued to happen. You know, there's a couple of things here that struck me as somewhat unusual as I dug through the evidentiary record, including what went on on the hearing. I'm having a hard time just figuring out really what the relevance of Butler's testimony really has to do with any kind of hacking. And I'm also kind of surprised that the court asserted the right to enter an injunction covering someone who's a non-party who lives in Hawaii that the court likely has no jurisdiction over to start with. And I mean, it seems that there's an overbreath there that maybe is indicative of other sort of failures to weigh the evidence appropriately. So why am I wrong in having that concern? So the way I would address that, Your Honor, is that Ms. Butler is a neighbor of Mr. Montgomery, who is a named defendant and an executive of MyCrop, defendant MyCrop. Their properties border each other in Hawaii. We were attempting service. I'm sure you've read through all this. That's how she came to our attention, because we were not able to locate Mr. Montgomery. The process server had talked to him on the telephone. There was, I will call it confusion at this point as to where exactly he was located. But in attempting to perfect service on him, she came to our attention, and she located him on his property and sent us that information. We used her as a witness. The day after she filed, after we filed her declaration as to his presence at his home in Hawaii, the water lines that went through the border between their property on her property were broken in the middle of the night. And the insinuation was that Mr. Montgomery had something to do with that. And the reason she became a protected party was to prevent any further retaliatory acts, if indeed that was a retaliatory act. Yeah, like I said, to me, there seems not to be much nexus that has been established there. And I find it hard to believe that really what is essentially a covenants dispute involving trees somehow is the basis for the entry of a protective order. I mean, it seems all fairly far afield. And there seems to be a lot of speculation here. And I'm just having a hard time drawing any sort of causal nexus to any of this. And all that I keep hearing is that there is a nexus in time. And is just a time nexus alone sufficient to give rise to what is really broad injunction limiting someone's ability to speak publicly about litigation they're currently involved in? So I would take that in two steps. The first and the latter of that is we're not trying to prevent them from speaking about the litigation itself. What we're trying to do is keep them from inciting people with similar backgrounds or themselves. But the very nature of this case could be something that would get under the skin of people who are involved in this, whether it's white hat or black hat hacking, right? I mean, if you say anything. Well, in order for them to become part of the subjects for this injunction, they have to be participating in active concert with the defendants. So there's going to have to be some tie between the two for that to be imposed against them and the prohibitions to be enforced. And to go back to the first part of your question with respect to the tie, if you look at the honeypot situation, the way that was set up was we did not register it with any web server. There was no way to find that website other than to randomly stumble across it in a sense that you weren't looking specifically for that URL. And we took some steps to make sure we didn't use like a very easy to find URL. We actually went back and looked at, your honors probably know it as archive.org, but you can go back and look at past domain names that were used. Mr. Wooten, your time's expired. Okay, thank you. I appreciate it. All right. Your rebuttal, Mr. Greenspoon? Yes, thank you, Judge Smith. And Judge Erickson, on the causal nexus point, I thought those were very interesting questions. The case to look at, I believe, is Zayed v. Associated Bank from this court, the second of two cases from this court, which was a collection of what was alleged to be circumstantial evidence where this court ended up with the conclusion in mathematics as in law, zero plus zero equals zero, and ended up affirming a summary judgment ruling because a lot of information was provided, but none of them provided the causal nexus necessary for the claim. And we're in the same boat here. They can't avoid summary judgment, we believe, in the future on this type of record, so they certainly shouldn't be earning a preliminary injunction against it. Judge Smith, you asked some questions and Mr. Wooten answered them, which seemed to prove the point that the preliminary injunction was issued, yet this baseline level of cyber attacks, including spikes from time to time, continued. If that's not an abuse of discretion where the subsequent history of the case proves that there was no irreparable harm that could be abated or avoided by entry of the preliminary injunction, I don't know what does. So the preliminary injunction did not stop third parties. My client didn't do any of this. We have sworn denials at many different rounds of adversarial briefing in this case, but the denials that I've listed in the appendix pages are the ones that are pertinent to the preliminary injunction. A final point on baseline level of cyber attacks affects everybody, is that we have in the record, this is from our cybersecurity expert, whose name is Mr. Perry. We have from him at the preliminary injunction explaining that COVID-19, the pandemic actually saw a rise in cyber attacks against businesses on a background level, and lawyers especially, law firms have been singled out because of this. What Mr. Wooten also mentioned in his brief remarks were that when they did finally identify who was responsible for some of the malfeasance, it was servers in Japan and servers in Vietnam. Your honor, our company, Mycroft, doesn't operate from Japan or Vietnam. So this was exactly the problem. Also on hacking itself, now this is going to be a little bit technical. Mr. Wooten got a little bit technical. I want to make this point and make it very, very clear. This is backed up in Wikipedia. This is common knowledge. Email spoofing is not proof of a hack, and I want to Mr. Wooten appeared to be arguing that spoofing was directed precisely at the firm's clients, and that would seem to indicate that there was a hack, right? Right, but look at the background of cyber attacks that everybody is experiencing. What if, for example, a secretary's at-home address book had been compromised because the secretary had clicked a link that perhaps shouldn't have been clicked? Well, if that were to happen, any random Russian hacker, Romanian hacker, what have you, would have had the ability to go and Everything in the record where Mr. Wooten's law firm is probably victimized, everything in the record has sort of the appearance or the trappings of financial fraud. Mr. Wooten doesn't even say my client has any motive to conduct any financial fraud. So your honor, I see my time is up. Mr. Greenspan, I sensed from your opening argument, are you sort of trying to wrap your clients in a mantle of righteousness? They're sort of like a man of mansha, seeking to destroy any giants they find? Well, my clients certainly believe they are, but before this court, I'm just explaining if one even I know, I know, but I couldn't resist that. They seem to almost speak with evangelical zeal. They're protecting, they're sort of acting on behalf, what is that Latin term when you're acting on behalf of the public? Private attorneys general. Yeah, right, right. Well, Judge Wallman, I mean, that's exactly one of our points, is that this is a matter of public interest, of great passion on two sides of a public policy debate. Great public interest, unless you're the one who's being subjected to these harassing, heavy breathing calls? I do have a question, Mr. Greenspan. There's been a lot made by Mr. Wooten about the honeypot situation, and what's your best explanation for how that can't be tied to your client or people affiliated or associated with your client? Yeah, on a technical level, Mr. Wooten simply assumes that Google is the only spider or bot that could be legitimate or even hostile in the world when you release a website into the wild. When you release a web page into the wild, there are all kinds of technologies out there where bad actors will find out about it right away and will start to go into it. But in our briefing, what we explained about the honeypot, and we backed it up in our second 28J letter with specific citations, is that the lawyer who was part of that phone call denied in a sworn statement that he was the conduit for that information to our client. He wasn't. He's an officer of the court, and he said, I never told my client anything about the content of this honeypot. The clients denied knowing anything about it. These are sworn statements under oath, Your Honor, and that's just the tip of the iceberg because there was no investigation to find out what the heck is he talking about. Your Honor, unless there are further questions, we appellants respectfully request that this court reverse the district court and vacate the preliminary injunction. All right. Thank you, Mr. Greenspoon. Thank you also, Mr. Wooten. The court appreciates both counsel's presentations to us this morning. We will continue to study the briefing that's been submitted and render decision in due course. Thank you, counsel. I may be excused. --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/argument%3A79356. Public record. Not legal advice.