Twitter Moves To Quash Fishing Expedition Subpoena For Info On Devin Nunes Cow By Devin Nunes' Lawyer In Unrelated Case

from the good-for-them dept

Last week, we wrote about the details of how it appeared that Devin Nunes' lawyer, Steven Biss, appeared to be using his subpoena power to try to unearth the identity of the parody account for "Devin Nunes Cow" in a totally unrelated case. I'm kind of amazed that no one else has really picked up on this story, because it's crazy. Biss has been representing Nunes in his various (highly questionable) defamation lawsuits, including the very first, which was focused on trying to expose a couple parody accounts that mocked Nunes, a Congressional Representative who really needs to grow some thicker skin. We've highlighted how much of Nunes' activity in that case in particular appears to be a fishing expedition to find out the identities of some of his critics.

What was so crazy about the story last week was that this new subpoena, sent to Twitter and seeking out information (including direct messages) from a variety of Twitter accounts, including @DevinCow, was in a totally unrelated case (the details of which are complex, and we tried to cover in that original post). As we highlighted, there were a bunch of questions raised by this -- first, sending a subpoena to Twitter to access someone's DMs is ridiculous. It would violated the Stored Communications Act. Twitter is barred from handing out such communications via civil subpoena. The correct process for Biss, if those communications are so vital to his case, would be to subpoena the users directly. But, of course, that would tip them off. The next big problem was that it appeared that at least two of the names on the list of Twitter accounts that were subpoenaed (and possibly more) had no connection whatsoever with the case at hand, involving a dispute between a well known lawyer and a well known PR executive. But they were relevant to the Devin Nunes suit.

On Tuesday, Twitter stepped in a filed a scathing motion to quash the subpoena, noting "a litany of substantive defects."

The Subpoena suffers from a litany of substantive defects and must be quashed. First, the Subpoena seeks identifying information of pseudonymous Twitter accounts without satisfying the established First Amendment requirements for unmasking anonymous online speakers... Second, it violates the federal Stored Communications Act ("SCA")... by commanding Twitter to disclose the contents of communications.... Third, it imposes an undue burden on Twitter by commanding it to produce document that could be obtained from a party to the lawsuit.... Fourth, and finally, the Subpoena imposes an undue burden on Twitter by demanding information that is irrelevant to the underlying action.

That last one is the understated way of pointing out that Biss is trying to subpoena people totally unrelated to this case. The motion makes the issue explicitly clear:

But the Subpoena is not merely defective and unlawful. One of its demands--for identifying information about the Twitter account @DevinCow--also appears to have been made for an improper purpose: to end-run around discovery disputes in an unrelated lawsuit. Nothing about the Fitzgibbon Litigation suggests that the @DevinCow account is in any way relevant to its claims or counterclaims--indeed, no reference to the account appears anywhere in any pleading. The anonymous speaker @DevinCow, however, has been named as Twitter's co-defendant in another, unrelated state-court action in which Fitzgibbon's counsel, Mr. Steven S. Biss, represents a different plaintiff.... Mr Biss has repeatedly sought in that other action, without success, to force Twitter and others to disclose information that might bear on the identity of @DevinCow, i.e. the very same information he is now demanding from Twitter through the Subpoena at issue here. The Subpoena's demand for @DevinCow's account-opening information thus appears to be an attempt to bypass the discovery process in Nunes. Such gamesmanship heightens the need for this Court to swiftly quash the Subpoena.

The motion goes on to detail the many times and many ways in which Biss has tried to unmask @DevinCow throughout the lawsuit.

It also notes that Twitter's lawyer directly raised these issues with Biss and "Mr. Biss refused to withdraw the Subpoena" and that he pointed them to two tweets made by the defendant in this case, lawyer Jesselyn Radack, replying to @DevinCow. However, as Twitter notes, neither of those had anything to do with the plaintiff in this case, Fitzgibbon. And, considering the main points of this case are (fairly questionable) claims that Radack was conspiring with others on Twitter to defame Fitzgibbon, it seems like any such tweets would need to relate to Fitzgibbon in some manner. Later, Biss agreed to narrow the subpoena to get around the Stored Communications Act issue, saying Twitter could black out the details of communications, but he still wanted to see the metadata. And then there's this:

Counsel for Fitzgibbon asserted both that those 17 accounts, including @DevinCow, are "obviously" relevant to the Fitzgibbon Litigation, and that he has evidence indicating that @DevinCow has privately communicated with Radack via the Twitter platform... But he flatly refused Twitter's requests that he substantiate those assertions.

It then goes through all the many other reasons for the subpoena to be quashed, and then says that the court should award Twitter fees and costs.

The awarding of fees and costs is particularly appropriate where, as here, "a party issues a subpoena in bad faith, [or] for an improper purpose."

It will be interesting to watch what comes next. Also, if the court does award fees, I wonder who will be paying them? There have already been questions about who's been funding Nunes' lawsuits. Would Fitzgibbon have to pay the fees because his lawyer tried to use his case to fish for info in another case? Is that the kind of representation that Fitzgibbon wants?

Filed Under: anonymity, devin nunes, devincow, fishing expedition, jesselyn radack, steven biss, subpoenas, trevor fitzgibbon
Companies: twitter

Banksy's Fake Store Is An Attempt To Abuse Trademark Law To Avoid Copyright Law

from the this-is-nuts dept

You may have seen the headlines lately, saying that famed pseudonymous street artist Banksy was being "forced" into opening up a pop up store in London in order to secure a trademark and prevent "a greetings card company" from selling "fake Banksy merchandise." Banksy also claimed that the company was "attempting to take custody of my name." Banksy and Banksy's artwork are somewhat famous for protesting against commercial incentives and traditional capitalism -- so many people rushed to Banksy' defense because, from the initial description, it sounded like Hallmark or some sappy corporate giant of that nature was trying to rip off Banksy images for its own benefit.

Turns out that the story is very, very different. And it doesn't make Banksy look very good at all once you understand the details. First, the "greeting card" company in question, Full Colour Black, has responded via a Facebook post, and you realize it's a tiny home-based business and it's not trying to take anyone's name or sell fake merchandise at all. Indeed, contrary to some of the reporting, it's not "suing" over anything. It just put forth a completely legitimate challenge to Banksy's sketchy and probably illegitimate trademark on the "flower bomber" image (the official name of which is apparently "Rage, Flower Thrower.")

As you know, to get a trademark, you need to show "use in commerce." And Banksy wasn't selling the flower bomber image -- though it does appear others are selling sculptures and posters of the work that was produced (as always) in secret, in Jerusalem, in 2005. In 2014, an organization representing Banksy, with the clever name of "Pest Control Office Limited", filed and received the registered trademark on the image.

However, since it wasn't clear how the image could qualify as a trademark in the first place, a small three person greeting card company sought to invalidate the trademark. As Full Colour Black explains:

Loud Tie Weasels are being used to paint our tiny business as a 'big corporate group' and paint Banksy as the harddone-by artist. There are only three people in our small business. We don’t have high powered legal teams on three continents, we don’t have a Management teams dealing with Hollywood and we certainly don’t have highly effective PR teams. We also can’t afford to open high earning hotels with celebrity acts on the grand piano nor can we steal the thunder from Stormzy’s amazing performance at Glastonbury.

All of that is Corporate Activity. We are not corporate... we sell greetings cards from our home. It is ENTIRELY untrue that we are attempting to “take custody” of his name”. This line has been invented by his Corporate Lawyers to try and gain sympathy from you. He’s made this up!!!

As they further explain, they run a small business that does photography and sells cards involving public graffiti:

We legally photograph public graffiti and make it available to you - the public. We know that you don’t have the unlimited budgets of Angelina Jolie or Brad Pitt or Christine Aguilera. You cannot afford to buy one of his official canvases. We make cards because Banksy never makes anything available to his fans. We all love his graffiti. He doesn’t want you to have it and he’s hoping to trick you into thinking that we’re hurting his business. We’re not.

We don’t infringe his rights in any way. We don’t use his trademarks or his brand name. We make cards that feature Banksy’s Public Graffiti. It’s a legitimate enterprise.

So... that last part did make me wonder a bit -- because it's not exactly clear if the statements here are true. As we've noted in the past, there are significant legal questions around the copyright status of public graffiti art, with some courts coming down on the side of the graffiti artists, sometimes in ludicrous ways. And, of course, that's resulted in more and more litigation.

But... that's all about copyright. In reading the news coverage of all of this, I was stumped as to why were were discussing trademark at all -- until I realized something kind of important. Banksy is using trademark because Banksy can't use copyright without revealing who Banksy is. Full Colour Black's lawyer, Aaron Wood, explains:

“We are contesting the validity of one of his EU trademarks on the basis that he has freely permitted it to be reproduced such that it no longer functions as a trademark (if it ever did), on the basis that he never intended to use it as a trademark and that he is trying to register for collateral purposes (ie, to avoid evidential issues with copyright and to avoid having to file a ‘statement of use’ in the US).”

Either way, Banksy, on the advice of "arts lawyer" Mark Stephens, seems to think that setting up a pop up shop with the (okay, absolutely brilliant) name "Gross Domestic Product", which will exist for a few weeks but never actually open to the public (though sales will happen online), somehow will re-establish the trademark in question:

Mark Stephens, an arts lawyer and founder of the Design and Artists Copyright Society, called the case a “frankly ludicrous litigation” and is giving Banksy legal advice.

“Banksy is in a difficult position,” he said. “Because he doesn’t produce his own range of shoddy merchandise and the law is quite clear – if the trademark holder is not using the mark, then it can be transferred to someone who will.”

Except, as with much of this story coming from the Banksy side, this is absolutely misleading. There isn't "litigation" happening at all. And this is not about "shoddy merchandise." This is about challenging the legitimacy of what certainly looks like an illegitimate trademark. And Full Colour Black's attorney highlights that, if anything, this shop harms Banksy's case, because they're not even arguing that the trademark fails for lack of use in commerce, but rather that the whole trademark is a sham to get around copyright law -- and this stunt supports that argument:

“If it were a revocation case then the strategy would be ill-conceived,” he claims. “The real error, however, is that this isn’t a revocation case on the basis of non-use, so it’s a frankly pointless step which doesn’t stand up to scrutiny from anyone with a modicum of knowledge of trademark law. In fact, this has strengthened the arguments that the marks are a false attempt to monopolise his work in bad faith [and to] circumvent copyright law and trademark law. Banksy may be a subversive character but the same law applies to him.”

Indeed, as others have noted, Banksy has been increasingly aggressive about enforcing trademark claims regarding people selling works based on Bansky art -- despite historically arguing against things like copyright:

Having once claimed that copyright is for losers, Banksy has been ramping up his legal position for several months now. At the end of 2018, the artist’s handling service Pest Control took action against an Italian company that organised an exhibition, The Art of Banksy—A Visual Protest, for Milan’s Mudec Museum.

In February this year, the judge ruled in favour of Banksy’s request for all merchandise bearing his name to be removed from the museum’s shop, but promotional materials using his name were allowed to remain. The judge noted that the documents filed in the proceedings showed a limited use of the Banksy brand.

The whole situation is kind of crazy when you think about it. Banksy doesn't want to use the law that actually covers the artwork, copyright, because that would likely require an outing of whoever is behind Banksy. And, according to Banksy, "copyright is for losers." But Banksy as a concept has become so profitable that now it's suddenly trying to stop anyone else from making money from Banksy-related works -- and appears to be abusing trademark to make that happen.

Full Colour Black, the greeting card company, notes that it's been trying for years to send Banksy some money, but that it's gotten nowhere:

We’ve written to Banksy, his team and his lawyers many times since 2010 to say that we want to pay royalties to him. He doesn’t want it. We believe he’s making so much money already; a couple of hundred pounds a year from us probably wouldn’t even cover the cost of his handmade shoes.

I’ll say it once again… don't be fooled folks. He’s using weasels to paint our tiny little business as a 'big corporate’ and paint himself as the poor artist. Look beyond his slick PR. He’s out of your league but he wants your sympathy. If you really want to support the little guy… stand by us. We’ll continue to offer you amazing graffiti and we can post it to you across the world.

This really does look like Banksy gone corporate in the worst sense -- abusing trademark law for no good reason at all and (worse) lying about it and pretending that a small home-based business is a big corporate entity trying to "seize" Banksy's name, when that's not even close to the truth. Banksy could just confirm that copyright law (and much of trademark law) is for losers, and let this small shop sell these cards that only serve to make Banksy's own artwork more and more valuable. The fact that all of this comes at a time when Banksy just sold a painting for $12 million, and part of the reason it's worth that is the kind of fame driven by people photographing and sharing Banksy's work, suggests that maybe Banksy should ditch some of the "copyright" lawyers advising Banksy, and go back to some more Banksy roots.

Filed Under: anonymity, banksy, cancellation, copyright, flower bomber, greeting cards, trademark, use in commerce
Companies: full colour black

Twitter Stands Up For Devin Nunes' Parody Accounts: Won't Reveal Who's Behind Them

from the good-for-twitter dept

A couple weeks ago, we noted that the judge in Virginia presiding over Devin Nunes' bullshit censorial lawsuit against Twitter, some parody Twitter accounts, and political strategist Liz Mair, had demanded that Twitter reveal to the judge who was behind the two parody accounts (for "Devin Nunes' Cow" and "Devin Nunes' Mom.") As we pointed out at the time, this request was highly unusual. Yes, the judge was in the process of determining if the case did not belong in Virginia, so he wanted to know if the people behind the accounts were based in Virginia, but there are ways to do that that protect the anonymity of the account holders (anonymity being a 1st Amendment right). Specifically, he could have just asked whether or not the account holders appeared to be based in Virginia.

We also wondered if Twitter would refuse the request -- as it has done in the past. And the answer is yes. Twitter has told the judge it won't comply, but did say that neither of the account holders lived in Virginia -- which should satisfy the only legal reason why the judge might want to know who they were.

Twitter on Wednesday told the judge it does not intend to disclose the names of the authors of accounts known as Devin Nunes’ Cow and Devin Nunes’ Mom, according to documents obtained by McClatchy.

“Defending and respecting the user’s voice is one of our core values at Twitter,” a Twitter spokesperson said in response to questions about the court filing. “This value is a two-part commitment to freedom of expression and privacy.”

Twitter in a message to other defendants in the case said it told the judge that the authors of the accounts do not live or work in Virginia....

[....]

“Undersigned counsel has been in contact with lawyers who have advised Twitter that they represent, respectively, the user or users of the @DevinCow account and the user or users of the @DevinNunesMom account,” the letter states. “Each of those counsel has authorized me to inform the Court, through this letter, that their respective client or clients do not reside or work in Virginia and never used the account while physically present in Virginia.”

This is good to see, though it remains to be seen how the judge feels about Twitter pushing back on his request. Again, the whole case is ridiculous and should be thrown out for a whole variety of reasons. But it's already worrisome that the judge thought it was fine to unmask the parody account holders, even if he promised that he would keep the identities secret.

Filed Under: anonymity, devin nunes, devin nunes cow, free speech, jurisdiction, privacy
Companies: twitter

Judge Wants To Know Who's Behind Devin Nunes' Cow's And Mom's Twitter Account

from the but-does-he-need-to? dept

A new twist in the first of Devin Nunes' SLAPP suits: the judge has asked Twitter to reveal to him who is behind the two satirical Twitter accounts that Devin Nunes is suing over. According to the Fresno Bee:

A Virginia judge has asked Twitter to provide more information about the authors of two anonymous parody accounts that heckle California Republican Rep. Devin Nunes before deciding whether to dismiss the congressman’s lawsuit against the social media company.

Judge John Marshall is weighing a request from San Francisco-based Twitter to dismiss Nunes’ lawsuit on the grounds that it does not belong in Virginia.

Marshall asked Twitter to provide the names and addresses of the anonymous authors behind the two accounts, the gross amount of revenue for Twitter in 2018 and the first half of 2019 and the number of Twitter accounts in Virginia.

The issue, right now, is whether or not the cases should be thrown out for improper venue / jurisdiction shopping. Political consultant Liz Mair (who was also sued) and Twitter have both told the court that the case belongs in California -- and suggested (reasonably) that Nunes only filed in Virginia to avoid California's anti-SLAPP law (which would make him liable for their legal expenses).

So you can kind of understand why the judge wants to know where the still anonymous account holders live, as that could play into the venue question. However, it still seems like Judge Marshall's request is overly broad. He could have just asked for information, should Twitter even have it, of where the account holders reside (I'm not even sure if Twitter has such info). But there's no reason at all for the judge to need to know the names of the account holders, even if he promises not to reveal them, if the goal is to figure out what is the proper venue.

For what it's worth, both of the account holders deny being Virginia residents.

Since this is a request to Twitter, it's that company that is now on the hook here. Twitter has a pretty long history of pushing back on attempts to unmask anonymous or pseudonymous users by courts. It doesn't always succeed, but there are important issues at stake here. There are lots of times when angry recipients of parody accounts have tried to unmask who is mocking them. We see it all too often, and it's obviously an intimidation technique by thin-skinned public officials.

And, relatedly, the Supreme Court has ruled that anonymity itself is protected by the 1st Amendment, so these Twitter account holders shouldn't be forced to give that up just because a judge is curious, let alone because Devin Nunes' fragile ego is offended. While the judge can claim that he needs to know in order to determine if the case is in the proper venue, it seems that rather than requiring the names, merely knowing the general location (zip code?) of the account holders would seem to be a much more reasonable -- and Constitutional -- method of doing so.

Filed Under: anonymity, california, devin nunes, devin nunes cow, devin nunes mom, fishing expedition, parody, venue, virginia
Companies: twitter

Once More With Feeling: 'Anonymized' Data Is Not Really Anonymous

from the nothing-to-see-here dept

As companies and governments increasingly hoover up our personal data, a common refrain to keep people from worrying is the claim that nothing can go wrong because the data itself is "anonymized" or stripped of personal detail. But time and time again, we've noted how this really is cold comfort; given it takes only a little effort to pretty quickly identify a person based on access to other data sets. Yet most companies (including cell phone companies that sell your location data) act as if "anonymizing" your data is iron-clad protection from having it identified. It's simply not true.

The latest case in point: in new research published this week in the journal Nature Communications, data scientists from Imperial College London and UCLouvain found that it wasn't particularly hard for companies (or, anybody else) to identify the person behind "anonymized" data using other data sets. More specifically, the researchers developed a machine learning model that was able to correctly re-identify 99.98% of Americans in any anonymised dataset using just 15 characteristics including age, gender and marital status:

"While there might be a lot of people who are in their thirties, male, and living in New York City, far fewer of them were also born on 5 January, are driving a red sports car, and live with two kids (both girls) and one dog,” explained study first author Dr Luc Rocher, from UCLouvain."

And using fifteen datasets is actually pretty high for this sort of study. One investigation of "anonymized" user credit card data by MIT found that users could be correctly "de-anonymized" 90 percent of the time using just four relatively vague points of information. Another study looking at vehicle data found that 15 minutes’ worth of data from just brake pedal use could lead them to choose the right driver, out of 15 options, 90% of the time.

The problem, of course, comes when multiple leaked data sets are released in the wild and can be cross referenced by attackers (state sponsored or otherwise), de-anonymized, then abused. The researchers in this new study were quick to proclaim how government and industry proclamations of "don't worry, it's anonymized!" are dangerous and inadequate:

"Companies and governments have downplayed the risk of re-identification by arguing that the datasets they sell are always incomplete,” said senior author Dr Yves-Alexandre de Montjoye, from Imperial’s Department of Computing, and Data Science Institute. "Our findings contradict this and demonstrate that an attacker could easily and accurately estimate the likelihood that the record they found belongs to the person they are looking for."

It's not clear how many studies like this we need before we stop using "anonymized" as some kind of magic word in privacy circles, but it's apparently going to need to be a few dozen more.

Filed Under: anonymity, anonymized data, data, privacy

Russian Spy Discovers The Hard Way How Much His Smartphone's Metadata Reveals About His Activities

from the imagine-what-it's-like-for-the-rest-of-us dept

Smartphones are not just amazing pieces of technology that pack a range of advanced capabilities into a pocket-sized device. They are also the best tracking device invented so far. They reveal where we are, and what we are doing, every minute we have them with us. And the most amazing aspect is that we carry them not because we are forced to do so by authoritarian governments, but willingly.

A permanent state of surveillance is something most people just accept as the price of using mobile phones. But for one class of users, the built-in tracking capabilities of smartphones are far worse than just annoying. For spies -- especially more senior ones -- the information revealed by their mobile phones is not just embarrassing but poses a serious threat to their future operational usefulness.

That's evident from a new investigation carried out by the Bellingcat team in partnership with various media organizations. Techdirt was one of the first to write about Bellingcat's use of "open source information" -- material that is publicly available -- to piece together the facts about what are typically dramatic events. The latest report from the group is slightly different, in that it draws on mobile phone data leaked by a whistleblower in Russia. According to Bellingcat's research, the account seems to be that of the mid-ranking Russian military intelligence (GRU) officer Denis Sergeev:

Newly obtained telephone metadata logs from a telephone number registered in the name of the (cover) persona "Sergey Fedotov" has allowed us to analyze Denis Sergeev's telephone usage -- including calls and data connections -- in the period of May 2017 -- May 2019. The data -- and especially the cell-ID metadata that we have been able to convert to geo-locations -- allowed us to recreate Sergeev's movements. These movements were both in Russia and abroad, as well as his pattern of communications during his overseas operations. Bellingcat obtained the telephone metadata records from a whistleblower working at a Russian mobile operator, who was convinced s/he was not breaching any data privacy laws due to the fact that the person to whom this phone number was registered ("Sergey Fedotov") does not in fact exist.

It's a nice irony that the use of a cover name meant that Russia's data privacy laws were not broken by leaking the telephone metadata. There are two Bellingcat posts. The first uses the records to track Sergeev's movements around central London. Nothing special in that, you might say. Except that Anatoliy Chepiga and Alexander Mishkin, the two Russians suspected by the UK police of attempting to poison a former Russian spy who had been a double agent for the UK, Sergei Skripal (and his daughter), just happened to be in London at exactly the same time:

according to the timeline of Chepiga and Mishkin's movements, as presented by British police, they arrived from their hotel to Waterloo station at approximately 11:45 on that day. Their train to Salisbury, however, would have left at 12:50. Waterloo station is approximately 10 minutes walk from the Embankment. Thus, had a meeting in person been necessary between Sergeev and the Chepiga/ Mishkin team -- whether to pass on final instructions or a physical object -- the area between the Embankment and the Waterloo would have been a convenient place, and the one-hour time gap between their arrival to the station and their departure would have likely sufficed.

The rest of the first Bellingcat post provides further fascinating details about Sergeev's movements in London, and telephone calls with a mysterious "Amir from Moscow", probably a senior intelligence officer who was his handler back home. The second post tracks Sergeev as he visited Switzerland multiple times between 2014 and 2018. As Bellingcat explains, it is not clear what he was doing there, but there are a number of tantalizing hints.

For example, Sergeev's mobile telephone connected to the cell antenna inside the Maison du Sport, where the Lausanne office of the World Anti-Doping Agency (WADA) is located. That's interesting given Russia's problems with doping in international sport. Sergeev's metadata also indicates that at one point he was physically close to the former US Ambassador to Switzerland, Suzan LeVine, but it's not clear why. Here's one suggestion from Bellingcat:

Was he keeping an eye on Suzan LeVine and her husband while another team tried to introduce a virus or hack into a laptop computer left at the Palace Beau-Rivage where the couple had left their luggage? No longer in office, the diplomat was not entitled to any special security, so perhaps this was seen as a low-hanging opportunity by a GRU team that was already in town. Targeting foreign former government officials -- who may or may not come back into positions of political relevance under a future administration -- appears to be compatible with the long-term strategy of an intelligence service.

There is the intriguing fact that the alleged assassins Chepiga and Mishkin were also present in Geneva during one of Sergeev's visits. Although there is no evidence that they met, it would have been remarkable had they not, since they were in the same city, and often travelled together. Finally, it seems that Sergei Skripal was also in Switzerland during one of Sergeev's trips -- another interesting "coincidence."

Both Bellingcat posts are worth reading for the fascinating insights they give into Russian spycraft. The fact that so much can be deduced about someone who has decades of experience of not leaving a trail is a useful reminder of how much more could be gleaned from the smartphone metadata of ordinary citizens, who aren't even trying to hide anything.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: anonymity, denis sergeev, metadata, surveillance, tracking

Federal Court Issues A Very Good Very Bad Decision Where Copyright And Free Speech Meet

from the good-news-bad-news dept

It’s hard to know exactly what to say about this decision involving a subpoena seeking to unmask a Reddit user. There are some notably good things about it, and still plenty bad. The bad: that a subpoena seeking to unmask a critic was upheld. The worse: that their First Amendment right to anonymous speech ultimately took a backseat to a copyright claim. On the other hand, there is some good in the decision, too, particularly in the discussion considering the First Amendment implications of upholding the subpoena, which may be helpful for future anonymous speakers. Also, while the subpoena was upheld, it was upheld with conditions that will somewhat minimize, but certainly not eliminate, the chilling effect of its enforcement.

In this case a user known as "Darkspilver" had criticized the Jehovah’s Witnesses organization on Reddit. He chose to do it on Reddit in significant part because Reddit allowed him to post his criticisms anonymously. [p. 2] In his critical posts he included two items that the Jehovah’s Witnesses organization claims violate its copyrights: an ad the Jehovah’s Witnesses had run to solicit donations, and a chart he made from data found in one of the organization’s Excel files. The organization then propounded a subpoena to find out the identity of the Reddit user it alleged had infringed its copyrights in posting these things.

We’ve written many times before about the concerns raised when discovery demands can cause online speakers to lose the anonymity the First Amendment entitles them. These discovery demands can come in many forms – state civil subpoenas, federal grand jury subpoenas, NSLs, etc. – but while the procedural rules governing how each one may be balanced against the speaker’s First Amendment right to anonymous speech can vary, that First Amendment right does not. All of these instruments should be equally, and adequately, protective of this constitutional interest. But in practice the protection they afford are not. An online speaker whose anonymity might end up protected in the face of certain types of discovery demands might find it trumped by others.

In this case the discovery demand came in the form of a Section 512(h) subpoena – the special species of subpoena that the DMCA invented for copyright holders to use to identify users of online platforms whom they allege had infringed their copyrights through their use of those platforms, and without first having filed an infringement lawsuit. This case addressed how courts should decide whether to uphold these subpoenas in the face of the First Amendment interest in protecting the identity of the speaker.

Which brings us to the good parts of the decision, where it recognized that there was a significant First Amendment interest in protecting anonymous speech. [p. 7-9] Perhaps most importantly, it recognized that the First Amendment protects anonymous speech even when the speaker is outside of the United States.

Based on the involvement of the United States Court’s procedures by and against United States companies and the audience of United States residents, as well as the broad nature of the First Amendment’s protections, the Court finds that the First Amendment is applicable here. [p. 7]

This judicial recognition is important, and this case may represent one of the first occasions when a court has articulated it so specifically. It would be a problem if the First Amendment protection for anonymous speakers could end at the border. For one thing – which the court did not discuss – for the protection to be meaningful for American speakers, it needs to be available to all speakers everywhere (at least when it comes to anonymous speech on US-based platforms). It would effectively eviscerate the right to speak anonymously if you first had to unmask the speaker to find out whether they had the right to resist the unmasking.

The other reason it would be a problem if non-Americans could not count on this protection – which the court did discuss – is that the First Amendment protects the right of the public to read as much as it protects the right to speak. ("[T]he First Amendment protects the audience as well as the speaker." [p. 6]). In other words, when we talk about the effects of discovery instruments on anonymous speech, the inquiry needs to go beyond focusing just on how it affects the rights of those whose anonymous speech is at risk but the rights of all the Americans whose ability to consume that speech will be undermined when speakers and their speech are chilled.

But simply saying that the First Amendment applies didn't, and wouldn't, resolve the matter. There are still competing concerns: the anonymous speaker's First Amendment interest, and the interest of the party propounding the subpoena, who may have a legitimate need to learn the identity of whomever they allege had wronged them. So to figure out whether a Section 512(h) subpoena should be upheld in the wake of these competing interests, the court borrowed a test that had been used before in the Highfields Capital Management and Art of Living Foundation cases. If the subpoena is to be upheld,

(1) The [subpoenaing party] must produce competent evidence supporting a finding of each fact that is essential to a given cause of action; and (2) if the [subpoenaing party] makes a sufficient evidentiary showing, the court must compare the magnitude of the harms that would be caused to the competing interests by a ruling in favor of the [subpoenaing party] and by a ruling in favor of the [anonymous speaker]. [p. 9]

Even though a 512(h) subpoena doesn't require a lawsuit to have first been filed, it still would be predicated on a copyright infringement claim. So in tackling the first part of the test the court considered whether that claim would be a valid one here. Which in this case it turned out to be a split decision. The Jehovah's Witnesses organization was actually asserting two claims of infringement, one for the advertisement and one for the chart, and the court rejected the one for the chart.

It is not clear that the chart meets the minimum standards of originality required for copyright protection. Watch Tower has not yet registered the chart. Therefore, the chart is not entitled to a presumption of copyright validity and Watch Tower must submit evidence to make the requisite showing. … Here, Watch Tower summarily argues that “the layout, design, and word choice [of the chart] are all creative in nature,” with no supporting evidence. In the absence of any supporting evidence, the Court finds that Watch Tower has not met its burden to show, with competent evidence, its ownership of a valid copyright in the chart. Therefore, Watch Tower fails to demonstrate a prima facie case of copyright infringement with respect to the chart. [p. 11].

But even for the advertisement, which had a more plausible copyright claim [p. 10-11], the infringement inquiry did not end there, because the speaker’s use of it could have been a fair use and thus still not constitute copyright infringement. And if there were no valid infringement claim, then there also should be no basis for upholding a subpoena seeking to learn the identity of a potential defendant to sue.

Which brought the court to the second part of the test, the "balancing of the harms," where the court analyzed whether the use of the ad was in fact a fair use. This is an important question for courts to ask in order to ensure that anonymous speech remains adequately protected because, as the court acknowledged, fair use is how the First Amendment gets baked into copyright law. [p. 13] It would do no good if the First Amendment protected public discourse that copyright law could then forbid. Public discourse often requires using copyrighted works in order for that discourse to be valuable, especially in cases like these where the critical discourse was about the subject of the work and the copyright holder itself. Accordingly, the court found that Darkspilver's use of the ad was likely fair.

In balancing the harms, while considering the fair use defense, the Court finds that they tip sharply in Darkspilver’s favor. [p. 17]

But even after all that discussion, the court still decided to uphold the subpoena, and that's why this decision is concerning. The issue is that the court seems to have minimized the range and degree of harms that could befall this and future speakers if the subpoena was upheld. Which is not to say that it presumed there to be none:

[T]he Court notes that Darkspilver’s concerns stem largely out of his fear that those in his congregation will discover his identity and shun him. [p. 17]

To address this concern, the court imposed conditions on the disclosure of his identity, ordering it to be released with an "attorney's eyes only" restriction. This restriction means that the plaintiff's lawyer would still have enough information to file a lawsuit against the user, but no one else would be the wiser. Which would mean that no one else, including the plaintiff, could know enough about this critic to impose any other retribution.

Watch Tower’s attorneys of record may not disclose Darkspilver’s identity even to its client, staff, or expert witnesses without approval in a Court Order from this Court. [p. 17]

That's great, but that's not the only thing the organization could do to Darkspilver. It still could sue him, although it would have to do it in a way that protected his identity.

If Watch Tower elects to file a lawsuit against Darkspilver, the Court directs Watch Tower to seek to file the suit under his pseudonym and to keep his actual identity under seal, for attorney’s eyes only. [p. 18].

In one sense, this is a good outcome, and not unprecedented. In Signature Management Team v. Doe a copyright case was able to be litigated without the defendant ever being publicly named. Because people unhappy with critical speech often want to know the name of the speaker in order to be able to make them regret speaking up, but not actually to sue them, the court's baby-splitting here makes some sense. With this protective order it should preclude that sort of extra-judicial retribution against the speaker.

But it pointedly doesn't preclude judicial retribution, and that's a problem. Per this decision, the speaker could still be sued. Granted, in the face of the court's copyright analysis it would be a pretty weak case. But even weak cases can be devastating in terms of time and money for defendants to have to litigate. A well-funded plaintiff could easily choose to tie a critic up in the courts to make them regret for having spoken out against them. The plaintiff might ultimately lose, but not before extracting an enormous and chilling cost from the speaker.

The reason this decision is so hard to cheer is that, despite of all the reasons the court recognized that the critical speech was likely legal, by allowing this subpoena to go forward, even when the case was so weak, the court has given the green light to this sort of abuse of the courts. All of the court’s lofty language about how the First Amendment works to protect critical speech on matters of public interest effectively becomes meaningless if it still means that, as long as the person who doesn’t like that critical speech can frame their dislike in terms of copyright claim, it can still impose a toll for having spoken it.

In this case the speaker in question has already been chilled and stopped posting on Reddit. [p. 12] And it won't be the last speaker to be cowed into silence if the price of speaking is litigating to defend it.

Filed Under: 512h, anonymity, copyright, darkspilver, dmca, dmca subpoenas, free speech, jehovah's witnesses
Companies: reddit

Shitty Man Shows How Shitty Men Can Shit On Free Speech By Suing Over The Shitty Media Men List

from the shitty-lawsuits dept

In the wake of the revelations about Harvey Weinstein, writer Stephen Elliott's name ended up on a Google doc called Shitty Media Men, along with the information "Rape accusations, sexual harassment [sic], coercion, unsolicited invitations to his apartment, a dude who snuck into Binders???" listed under the column heading "ALLEGED MISCONDUCT" and the additional note that, "Multiple women allege misconduct." He has now sued Moira Donegan, the owner of the Google doc, and dozens of anonymous third-party contributors to the list for defamation, as well as intentional and negligent infliction of emotional distress. He has also now cemented his reputation as a very shitty man.

First, let me say that I do not call Stephen Elliott a shitty man because of what posters to the Shitty Media Men list wrote about him. He's shitty for filing this lawsuit against the host of and contributors to the list, seeking to chill the speech of those who would speak out against bad behavior. He's shitty for threatening to unmask people who had exercised their right to speak anonymously to warn others of potential harm.

Plaintiff will know, through initial discovery, the names, email addresses, pseudonyms and/or “Internet handles” used by Jane Doe Defendants to create the List, enter information into the List, circulate the List, and otherwise publish information in the List or publicize the List. Through discovery, Plaintiff can obtain the email address information, Google account, Internet Protocol (“IP”) address assigned to the accounts used by the Jane Doe Defendants by the account holders’ Internet Service Provider (“ISP”), email accounts and/or Google accounts, on the date and time at which the Posts were published and/or information was entered into the List. Plaintiff intends to subpoena the shared Google spreadsheet metadata for the List, email accounts, Google accounts and ISPs in order to learn the identity of the account holders for the email addresses and IP addresses.

He's shitty for leaving everyone vulnerable to continued abuse, from any source, since by deterring speech about abuse, abuse will now be so much harder to check. And he's shitty for using disproportionate power to quell those who tried to resist him (which, of course, seems an odd play for someone who wants people to believe that claims he did the same sexually could not possibly have been true).

Because his power here is indeed unequal. The pen may be mightier than the sword, but it is no match for a lawsuit. A lawsuit targeting speech is giant tax on expression, extracting an immense cost for what should have been free to do. Speech isn't free when one must pay a minimum of five or six figures – if not more – to defend the right to "freely" express it.

This story therefore touches on a number of the issues we often talk about here at Techdirt highlighting this recurrent power imbalance that keeps threatening to make the right to free speech illusory. There's the chilling effect of the suit itself, both on these defendants and anyone else who might now be prompted to rethink speaking out in the future. There's the attack on anonymous speech, upon which public discourse often depends. And then there's the targeting of the intermediary in order to pressure those who enable others' speech to cease doing so.

That last line is an aspect to the suit particularly worth noting here. One of the points we keep making is that Section 230 isn't just about Facebook (or Twitter, or Google, or Yelp, etc…); it's about regular Internet users. This suit exemplifies why it's so important to preserve its critical protections for intermediaries of all sorts: because someday you, too, may want to facilitate the exchange of important information in a Google doc, and you might not want to be sued for it.

"In the beginning, I only wanted to create a place for women to share their stories of harassment and assault without being needlessly discredited or judged," Donegan wrote in The Cut in January 2018. "The hope was to create an alternate avenue to report this kind of behavior and warn others without fear of retaliation."

In this case, the progenitor of the Google doc was an intermediary enabling other people to express themselves through the online service – in this case, the Google doc – she provided. Section 230 allows that intermediaries can come in all sorts of shapes and sizes, because its immunity is provided broadly, to any provider of an "interactive computer service," which is "any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server." That's what Donegan did with her Google doc: provide access to software to multiple users. If anything is somehow wrong with the content they contributed through this service, then they can be held responsible for it. But per Section 230, not Donegan.

(In his complaint Elliott does accuse Donegan of editing the spreadsheet, but not in ways that transcend the typical editing activity of an intermediary protected under Section 230.)

And it shouldn't be the other contributors either. None actually accused him of rape; the statement in question reflected only that that there had been accusations of it. Elliott's complaint would have Donegan and any author of this spreadsheet entry bear the burden of proving that he actually raped someone in order not to be liable to him. But that's not how defamation law works, nor is it how it should work. As the Supreme Court observed in New York Times v. Sullivan:

A rule compelling the critic … to guarantee the truth of all his factual assertions—and to do so on pain of libel judgments virtually unlimited in amount— leads to a comparable "self-censorship." Allowance of the defense of truth, with the burden of proving it on the defendant, does not mean that only false speech will be deterred. Even courts accepting this defense as an adequate safeguard have recognized the difficulties of adducing legal proofs that the alleged libel was true in all its factual particulars. Under such a rule, would-be critics … may be deterred from voicing their criticism, even though it is believed to be true and even though it is in fact true, because of doubt whether it can be proved in court or fear of the expense of having to do so. They tend to make only statements which "steer far wider of the unlawful zone." The rule thus dampens the vigor and limits the variety of public debate.

The burden is therefore on the plaintiff to show that the statement was false or was made in reckless disregard of the truth. Even if he were to be considered a private, rather than public, figure the burden would still be on him to show that the defendants at least demonstrated a negligent, rather than reckless, disregard for the truth, but it would be strange for him to argue his own cultural irrelevance in order to be able to prevail on that lower standard. His complaint itself laments a loss of stature that suggests he was at least a limited-purpose public figure, and thus required to prove "actual malice," which, despite some handwringing about Donegan's public feelings about other terrible men, the complaint doesn't seem to do. The lawsuit is also over speech about a matter of public importance, which in New York would also prompt the higher standard, which likely would need to be met before unmasking the speakers.

[U]nder prior case law, Google cannot be compelled to reveal the identity of an anonymous poster unless and until Elliott can prove that the posts were libelous, said Paul Levy, an attorney with Public Citizen who has helped establish precedent for when a court can compel an internet provider to identify an anonymous user. So if Elliott's attorneys want to identify the list contributors, they'll have to prove his case of libel before Google can be compelled to provide the information.

Furthermore, the only "truth" at issue here is whether he had ever been accused of rape. There could have been a false accusation and the statement would still be true. But what Elliott really wants is for the court to grant him a "get out of rape accusation free" card, if these anonymous speakers cannot substantiate his guilt. Which is what renders this lawsuit the piece of crap SLAPP that it is, and illustrates why a strong anti-SLAPP law needs to apply. The complaint was filed in New York, which has an infamously limited anti-SLAPP law, but it's notable that, per the complaint, Stephen Elliott lives in Louisiana, where there is a decently strong anti-SLAPP law. If that law is found to apply, it could lead to Elliott having to pay everyone else's legal bills.

But even so, the essential truth will remain. Even if Elliott had never before victimized women, this lawsuit is an attempt to victimize them now by burdening them with a cripplingly expensive and impossible task. And for this behavior he indeed is a shitty man.

Filed Under: anonymity, anonymous speech, anti-slapp, bullying, cda 230, defamation, intermediary liability, me too, moira donegan, shitty media men, slapp, stephen elliott, unmasking

Techdirt Podcast Episode 182: Anonymity In The Media & Online

from the someone-said dept

Anonymity is back in the news in a big way, especially since the New York Times published an explosive opinion piece by an anonymous White House official. Here at Techdirt — proudly one of the few blogs that still allows completely anonymous comments with no sign-up — we've talked about anonymity for a long time in the context of the internet. On this week's episode, Mike and regular co-hosts Dennis Yang and Hersh Reddy talk about the benefits, challenges, and overall importance of anonymous speech.

Follow the Techdirt Podcast on Soundcloud, subscribe via iTunes or Google Play, or grab the RSS feed. You can also keep up with all the latest episodes right here on Techdirt.

Filed Under: anonymity, comments, journalism, media, podcast