Kazakhstan cannot use U.S. injunction to prevent reporting on documents acquired by hacking

First Amendment Cyberlaw Computer Fraud and Abuse Act

Republic of Kazakhstan v. Does 1–100, No. 15 Civ. 1900 (ER) (S.D.N.Y. Oct. 27, 2015), Slip Opinion hosted by Justia.com

The United States District Court for the Southern District of New York issued a clarification of the preliminary injunction it granted on March 20, 2015 to the plaintiff, the Republic of Kazakhstan, enjoining unidentified defendants and “all persons acting in concert with them from using, disclosing, or otherwise disseminating” documents and emails that defendants allegedly acquired by hacking.

The District Court held that the preliminary injunction does not apply to non-party Respublika, an online Kazakhstan newspaper, reasoning that the plaintiff had not shown a likelihood of success on the merits in any substantive claim against Respublika for hacking, and that applying the injunction against Respublika would function as an unconstitutional prior restraint on free speech. In so holding, the court noted the “near absolute right to publish truthful information about matters of public interest,” even if a re-publisher of information knew that it had been obtained illegally.

Eugene Volokh provides an overview of the case, approving the outcome. The Electronic Frontier Foundation, which is representing Respublika, previously criticized Kazakhstan’s abuse of the court’s order in June.

The government of the Republic of Kazakhstan discovered that some of its sensitive documents and emails had been publicly posted on the Internet in January of 2015. It commenced a lawsuit in federal court in March against hackers of unknown identity, collectively Does 1–100, alleging violations of the Computer Fraud and Abuse Act, and seeking injunctive relief to prevent publication of the materials acquired by hacking. The court issued a preliminary injunction to this effect on March 20, 2015. Although Respublika was not a party to the suit, Kazakhstan presented the preliminary injunction to Respublika’s web host, initially requesting specific deletion of articles, and later requesting that the web host disable Respublika’s site entirely, arguing that doing so was necessary to comply with the court order. Respublika challenged this use of the injunction.

Since Respublika had not been expressly named in the injunction, the court examined anew the plaintiff’s likelihood of success on the merits, finding that Kazakhstan had not met this burden against Respublika. In particular, the court noted that the plaintiff conceded that it had no evidence showing Respublika to be responsible for the alleged hacking or acting “in concert” with the hackers, which would be necessary to prevail. Furthermore, the court found that applying the injunction against Respublika, which claimed simply to be reporting on “newsworthy documents that [it] found anonymously posted online,” would operate as a prior restraint of speech; such prior restraint is highly suspect under the First Amendment, and no factors, such as the availability of less restrictive alternatives, weighed in Kazakhstan’s favor.

The ruling is significant for two reasons. First, it emphasized the limitation of liability for disseminating illegally-acquired information to only those who were complicit in the hacking or acting in concert with the hackers. Second, in both prongs of its analysis — under the preliminary injunction standard, and under a prior restraint analysis — the court applied principles of free speech lifted from the First Amendment to the U.S. Constitution, even when foreign newspapers and governments are involved.

Frederick Ding is a 1L at the Harvard Law School who is interested in free speech, privacy, and national security.