ALM Properties, Inc.
Page printed from: Corporate Counsel
Select 'Print' in your browser menu to print this document.
Careful What You Wish For
Two years after fending off a cyberattack from the international hacking network known as Anonymous, PayPal is back in the battle. Only this time the Silicon Valley company is fighting to shield business records from defendants accused of carrying out the attack.
In February, PayPal's lawyers asked U.S. Magistrate Judge Paul Grewal to quash a defense subpoena, which the electronic payment company complained is overbroad and burdensome, and could reveal security protocols that would make the company more vulnerable to hackers.
The dilemma illustrated a peril for companies that refer matters to the U.S. Department of Justice for prosecution. Once defense lawyers come knocking, companies may face records requests that are as time-consuming as civil e-discovery, and leave them with less control over how the information is ultimately used or who sees it.
The controversy made for a clash of civil and criminal litigation perspectives at a hearing that featured PayPal's legal team at Cooley facing off against a group of seasoned and aggressive defense lawyers. The federal prosecutors handling the matter appeared to be sitting this one out.
Grewal, who was managing discovery in the case, was tasked with balancing the constitutional rights of the defendants against the needs of PayPal and parent company eBay Inc. to protect sensitive data from the very individuals accused of compromising their business. Cooley special counsel Angela Dunning, a PayPal lawyer, told Grewal that the subpoena must fail because it seeks broad categories of information and does not establish the relevance or admissibility of the material.
"This subpoena is a classic fishing expedition," she said. If PayPal must comply, then documents should be subject to a protective order with sensitive materials designated "highly confidentialattorneys' eyes only," Dunning argued.
That means that defense attorneys would have to sign an acknowledgment before viewing the evidence and could not share it with the 14 defendantsmost in their twenties. Lawyers would also have to seek eBay's approval before disclosing the evidence to experts.
The threat of those conditions led Thomas Nolan Jr. of Nolan, Armstrong & Barton in Palo Alto to swing into action on behalf of his client, an Ohio man charged in the case. "The court should deny PayPal's request for a two-tiered protective order because of the presumption of innocence, and because of defendants' rights to confront the evidence against them, to assist in the preparation of their own defense, and to effective assistance of counsel," Nolan wrote in a court filing.
Though Grewal did not rule at the February hearing, the judge seemed skeptical of PayPal's motion to quash the subpoena in its entirety. He had twice authorized subpoenas requiring PayPal to produce documents, first in February 2012 and again in December, when Nolan got involved.
"If the alleged victim in this case has material that would impeach the statement of a government witness as to the nature of this attack . . . defendants have no rights to get that material?" Grewal asked Dunning. "I'm somewhat baffled by that."
The defendants' only right to pretrial discovery comes through the government's obligation to produce certain materials, Dunning responded. "If they were getting it from the government," Grewal countered, "there would be no reason to subpoena you."
The U.S. attorney's office accused the defendants of taking part in a distributed denial of service (DDoS) attack on PayPal's computer servers, a crude form of hacking that barrages a computer network with outside communications until it can no longer function. Anonymous claimed credit, saying that it was in retaliation for PayPal's cutting ties with the open-government website WikiLeaks. Assistant U.S. Attorneys Matthew Parrella and Hanley Chew have not taken a position on the discovery dispute.
Defense lawyers insist that the charges are overblown and misuse criminal statutes to prosecute political activism. At worst, the DDoS attack is akin to a real-world sit-in, some contend.
In early 2012, the defense first subpoenaed PayPal, seeking documents relating to the DDoS attacks and PayPal's efforts to investigate themevidence that the defense hopes will show that those charged played minimal roles in the attack. PayPal agreed to produce certain documents pursuant to a stringent protective order, which Nolan and other defense lawyers found unacceptable.
Other lawyers have faced similar disputes with civil counsel for alleged corporate victims. Keker & Van Nest partner Stuart Gasner says his team encountered the issue representing a Silicon Valley engineer charged with selling trade secrets developed by ?E. I. du Pont de Nemours and Company. Discovery in the case stalled for months, Gasner says, as DuPont sought a protective order that would prevent lead defendant Walter Liew from viewing material that the company designated confidential. Like PayPal, DuPont also wanted to preapprove defense experts before they examined those materials, Gasner says.
Ultimately, Liew was permitted to view the materials while in his lawyer's presence and on computers disconnected from the Internet. But two-tier protective orders designed for civil cases don't work in the criminal arena, Gasner says. "In criminal cases, it gets complicated by the confrontation rights," he explains. "There are serious constitutional problems with the defendant not being able to see the evidence against him."
"It's the burden of the defense to show that what they're seeking is relevant, admissible, and specific," says Winston & Strawn partner Robb Adkins, head of the firm's white-collar group and a former federal prosecutor. In PayPal's motion to quash, Dunning and Cooley partner John Dwyer argue that the defendants' subpoena does not meet that standard.
"Why do defendants want these documents? What, specifically, do they contain? Do defendants actually believe that such documents are relevant to their case, and if so, why?" the lawyers wrote.
But Nolan argued that PayPal cannot ask to quash the subpoena since it previously agreed to turn over documents. The company balked only after realizing that the information might be shared with defendants, he said at the hearing.
"Now when they realize maybe they're not going to get the protections in the criminal context that they would normally get in a civil context," he said, "they make the motion to quash."