Two years after fending off a cyberattack from the international hacking network known as Anonymous, PayPal is back in the battle. Only this time the Silicon Valley company is fighting to shield business records from defendants accused of carrying out the attack.
In February, PayPal's lawyers asked U.S. Magistrate Judge Paul Grewal to quash a defense subpoena, which the electronic payment company complained is overbroad and burdensome, and could reveal security protocols that would make the company more vulnerable to hackers.
The dilemma illustrated a peril for companies that refer matters to the U.S. Department of Justice for prosecution. Once defense lawyers come knocking, companies may face records requests that are as time-consuming as civil e-discovery, and leave them with less control over how the information is ultimately used or who sees it.
The controversy made for a clash of civil and criminal litigation perspectives at a hearing that featured PayPal's legal team at Cooley facing off against a group of seasoned and aggressive defense lawyers. The federal prosecutors handling the matter appeared to be sitting this one out.
Grewal, who was managing discovery in the case, was tasked with balancing the constitutional rights of the defendants against the needs of PayPal and parent company eBay Inc. to protect sensitive data from the very individuals accused of compromising their business. Cooley special counsel Angela Dunning, a PayPal lawyer, told Grewal that the subpoena must fail because it seeks broad categories of information and does not establish the relevance or admissibility of the material.
"This subpoena is a classic fishing expedition," she said. If PayPal must comply, then documents should be subject to a protective order with sensitive materials designated "highly confidential—attorneys' eyes only," Dunning argued.
That means that defense attorneys would have to sign an acknowledgment before viewing the evidence and could not share it with the 14 defendants—most in their twenties. Lawyers would also have to seek eBay's approval before disclosing the evidence to experts.
The threat of those conditions led Thomas Nolan Jr. of Nolan, Armstrong & Barton in Palo Alto to swing into action on behalf of his client, an Ohio man charged in the case. "The court should deny PayPal's request for a two-tiered protective order because of the presumption of innocence, and because of defendants' rights to confront the evidence against them, to assist in the preparation of their own defense, and to effective assistance of counsel," Nolan wrote in a court filing.
Though Grewal did not rule at the February hearing, the judge seemed skeptical of PayPal's motion to quash the subpoena in its entirety. He had twice authorized subpoenas requiring PayPal to produce documents, first in February 2012 and again in December, when Nolan got involved.
"If the alleged victim in this case has material that would impeach the statement of a government witness as to the nature of this attack . . . defendants have no rights to get that material?" Grewal asked Dunning. "I'm somewhat baffled by that."
Subscribe to Corporate Counsel
