PayPal is back in battle against the hacking group Anonymous.
Two years after fending off a cyberattack from the international hacking network known as Anonymous, the Silicon Valley company is fighting to shield business records from defendants accused of carrying off the attack.
This past week PayPal’s lawyers asked U.S. Magistrate Judge Paul Grewal to quash a defense subpoena, which PayPal complains is overbroad, burdensome and could reveal security protocols that would make it more vulnerable to hackers.
The dilemma illustrates a peril for companies that refer matters to the Justice Department for prosecution. Once defense lawyers come knocking, companies may face records requests as time consuming as civil e-discovery, though with less control over how the information is ultimately used or who sees it.
The controversy made for a clash of civil and criminal litigation perspectives at a hearing this past week with PayPal’s legal team at Cooley facing off against a group of seasoned and aggressive defense lawyers. The federal prosecutors handling the matter appear to be sitting this one out.
Grewal, who is managing discovery in the case, is tasked with balancing the constitutional rights of the defendants against the needs of PayPal and parent company eBay Inc. to protect sensitive data from the very individuals accused of compromising their business.
Cooley special counsel Angela Dunning, a PayPal lawyer, told Grewal the subpoena must fail because it seeks broad categories of information and does not establish the relevance or admissibility of the material.
"This subpoena is a classic fishing expedition," she said.
If PayPal must comply, then documents should be subject to a protective order with sensitive materials designated "HIGHLY CONFIDENTIAL — ATTORNEYS’ EYES ONLY," Dunning argued.
That means defense attorneys would have to sign an acknowledgment before viewing the evidence and could not share it with the 14 defendants, most in their 20s from around the country. Lawyers would also have to seek eBay’s approval before disclosing the evidence to experts.
The threat of those conditions led Thomas Nolan Jr. of Nolan, Armstrong & Barton in Palo Alto to swing into action on behalf of his client, an Ohio man charged in the case, U.S. v Collins, 11-471.
"The court should deny PayPal’s request for a two-tiered protective order because of the presumption of innocence, and because of defendants’ rights to confront the evidence against them, to assist in the preparation of their own defense, and to effective assistance of counsel," Nolan wrote in a court filing.
Though Grewal did not rule at Thursday’s hearing, the judge seemed skeptical of PayPal’s motion to quash the subpoena in its entirety.
Grewal twice authorized subpoenas requiring PayPal to produce documents, first in February 2012 at the request of Oakland solo Graham Archer, and again in December, when Nolan got involved.
"If the alleged victim in this case has material that would impeach the statement of a government witness as to the nature of this attack … defendants have no rights to get that material?" Grewal asked Dunning. "I’m somewhat baffled by that."
The defendants only right to pretrial discovery comes through the government’s obligation to produce certain materials, Dunning responded.
"If they were getting it from the government," Grewal said, "there would be no reason to subpoena you."
The U.S. attorney’s office accuses the defendants of taking part in a distributed denial of service, or DDoS, attack on PayPal’s computer servers, a crude form of hacking which barrages a computer network with outside communications until it can no longer function.
Anonymous claimed credit for the attack, which was planned to retaliate for the company cutting ties with the open government web site WikiLeaks.
Assistant U.S. Attorneys Matthew Parrella and Hanley Chew have not taken a position on this discovery dispute.
Defense lawyers insist the charges are overblown and misuse criminal statutes to prosecute political activism. At worst, the DDoS attack is akin to a real-world sit-in, some contend.
In early 2012, the defense first subpoenaed PayPal, seeking documents relating to the DDoS attacks and PayPal’s efforts to investigate them — evidence the defense hopes would show those charged played minimal roles in the attack.
PayPal agreed to produce certain documents pursuant to a stringent protective order, which Nolan and other defense lawyers found unacceptable.
The company has since relaxed some of its conditions, reserving the "attorneys’ eyes only" designation now for a narrower category of records it believes implicates network security.
"It really is targeted," Dunning said at the hearing.
Nolan contends that shielding evidence from defendants is only justified when lives are at risk.
Other lawyers have faced similar disputes with civil counsel for alleged corporate victims. Keker & Van Nest partner Stuart Gasner said his team encountered the issue representing a Silicon Valley engineer charged with selling trade secrets developed by DuPont.
Discovery in the pending case stalled for months, Gasner said, as DuPont sought a protective order that would prevent Walter Liew from viewing material the company designated confidential. Like PayPal, DuPont also wanted to pre-approve defense experts before they examined those materials, Gasner said.
Ultimately, Liew was permitted to view the materials while in his lawyer’s presence and on computers disconnected from the Internet. Two-tiered protective orders designed for civil cases don’t work in the criminal arena, Gasner said.
"In criminal cases, it gets complicated by the confrontation rights," he said. "There are serious constitutional problems with the defendant not being able to see the evidence against him."
Third-party subpoenas tend to show up in the discovery phase of white-collar matters, which might surprise some practitioners. After all, federal criminal defendants do not have a right to conduct depositions pretrial or pursue other types of broad discovery common in civil cases.
However, the Federal Rules of Criminal Procedure give defendants an expansive right to subpoena witnesses to appear at trial. Under the same authority, judges may order third parties to produce documents in advance of trial by issuing what is known as a Rule 17(c) subpoena.
Mary McNamara of criminal defense boutique Swanson & McNamara said Rule 17(c) is a practical tool, because receiving boxes of potential evidence on the first day of trial would be unmanageable.
"The defense does have a right to the material," she said. "The question is timing."
Federal courts have taken a narrow view of what can be obtained under Rule 17(c), said Winston & Strawn partner Robb Adkins, head of the firm’s white-collar group and a former federal prosecutor. Though it may seem counterintuitive, he said, the mechanism is not meant as a discovery tool.
"It’s the burden of the defense to show that what they’re seeking is relevant, admissible and specific," Adkins said.
In PayPal’s motion to quash, Dunning and Cooley partner John Dwyer argue the Anonymous defendants’ subpoena does not meet that standard.
"Why do defendants want these documents? What, specifically, do they contain? Do defendants actually believe that such documents are relevant to their case, and if so, why?" the lawyers wrote.
But Nolan argued PayPal cannot ask to quash the subpoena since it previously agreed to turn over documents. The company balked only after realizing the information might be shared with defendants, he said at the hearing.
"The subpoena was served a year ago and they got all the documents, and they never complained about any of these issues," he said. "Now when they realize maybe they’re not going to get the protections in the criminal context that they would normally get in a civil context, they make the motion to quash."
Vanessa Blum is a reporter for The Recorder, a Legal affiliate based in San Francisco.