Maude v. DOES 1 through 10

Background

Erin K. Maude sued unnamed defendants after alleging that unknown people accessed her computers, electronic devices, and online accounts without permission. She alleged that information and messages were deleted from her mobile telephone and that unauthorized devices accessed her computer system and online accounts. Her claims were brought under the federal Computer Fraud and Abuse Act and California Penal Code § 502.

Maude asked for an order allowing her to serve subpoenas on internet service providers before serving the summons and complaint. She sought records identifying customers who used specified Internet Protocol addresses at particular dates and times, including names, addresses, telephone numbers, email addresses, and associated Media Access Control addresses. She identified Internet Protocol and Media Access Control addresses that she believed were connected to the alleged unauthorized access. A technical consultant stated that, after reviewing information Maude provided, he believed her email and social-media accounts had been accessed without authorization.

Legal standard

The Federal Rules of Civil Procedure generally prohibit discovery before the parties’ required conference and before service of the summons and complaint. A court may permit earlier discovery when the plaintiff shows good cause. For requests seeking to identify unnamed defendants, courts in the Ninth Circuit consider whether the plaintiff has: (1) identified the missing defendants specifically enough to show they are real people or entities who could be sued in federal court; (2) described prior efforts to locate them; (3) shown that the action could survive a motion to dismiss; and (4) shown a reasonable likelihood that the requested discovery will produce information allowing service of process.

Court’s analysis

The court found that Maude described unauthorized access by particular electronic devices, suggesting that actual users had engaged in the alleged conduct. The court also found that at least some defendants might be subject to the court’s personal jurisdiction based on Maude’s allegations about Internet Protocol addresses assigned to a private Comcast user in Monterey. But Maude did not provide enough information to show whether the specific addresses for which she sought discovery corresponded to users within the court’s jurisdiction.

The court concluded that Maude had not sufficiently described her prior efforts to identify or locate the defendants. Her motion and supporting declarations referred generally to Internet Protocol address location tools but did not explain what she did with those tools, or otherwise, to identify the users or determine their geographic locations.

The court also concluded that Maude’s claims were unlikely to survive a motion to dismiss. For the Computer Fraud and Abuse Act claim, she did not identify which statutory provisions the defendants allegedly violated. For the California Penal Code § 502 claim, she did not identify which of the statute’s specified acts formed the basis of her claim. The court said these omissions failed to give the defendants fair notice of the grounds for the claims.

Finally, the court found that Maude had not shown that the requested discovery was properly connected to her claims or limited to information necessary to identify the defendants for service. Her motion did not identify the three internet service providers, her proposed order referred to providers listed in the complaint, and the sample subpoena was directed to Comcast Cable Communications, LLC, which was not identified in the complaint. The court also said it could not properly evaluate the proposed subpoenas because Maude had not filed the subpoenas with the court.

Disposition

The court denied Maude’s motion for expedited discovery without prejudice. The court stated that Maude may amend her complaint and renew the motion to address the issues discussed in the order. Judge Virginia K. Demarchi signed the order as a United States Magistrate Judge.