Morbitzer v. Doe

Background

Christopher Morbitzer and Briann Morbitzer sued John Doe under the Computer Fraud and Abuse Act, a federal law concerning unauthorized access to computers. According to their complaint, Briann had changed her phone number, and Doe later obtained the old number. Doe allegedly used a password-reset confirmation sent to that number to take control of the plaintiffs’ email and social-media accounts.

The plaintiffs alleged that Doe then viewed and downloaded financial, credit, tax, and business records; attempted unauthorized purchases and money transfers; and opened a cryptocurrency-exchange account in Briann’s name. They had regained control of most accounts, but Doe allegedly still controlled Briann’s email and cloud-storage account used for her speech-therapy business.

The plaintiffs had identified two internet addresses, a phone number, the relevant internet-service providers, and an approximate geographic area, but they could not identify Doe. They sought permission to subpoena Verizon Wireless and Charter Communications for the subscriber names and physical addresses associated with those internet addresses and the phone number. They said the providers kept the information for only a limited time after an account was deactivated and agreed to use it only to establish personal jurisdiction, serve Doe, and pursue their claim.

Legal standard and analysis

Federal Rule of Civil Procedure 26(d) generally prevents parties from seeking discovery before the Rule 26(f) conference unless the court authorizes it. Because the plaintiffs could not identify Doe and therefore could not hold that conference, the court considered whether they had shown “good cause”—whether the need for expedited discovery outweighed prejudice to the responding parties.

The court applied factors concerning the possible preliminary injunction, the breadth and purpose of the request, the burden on the providers, and how early the request was made. It also considered factors concerning whether the plaintiffs had shown an initial actionable claim, whether the request was specific, whether other means of obtaining the information existed, whether the information was needed to advance the case, and the subscriber’s privacy expectations.

The court concluded that both sets of factors supported good cause. The request was limited to subscriber names and physical addresses connected to two internet addresses and one phone number. The information was needed to identify and serve Doe, and the providers likely had information that was not publicly available. The court found little burden on Doe or the providers and determined that the subscriber’s privacy interest in this contact information did not outweigh the plaintiffs’ ability to use the court process to pursue a plausible claim.

The court also addressed a possible restriction under the Communications Act. If Verizon Wireless or Charter Communications qualified as covered cable operators, the court authorized disclosure of the requested subscriber information under the statutory exception for disclosure pursuant to a court order, subject to any required notice to the subscriber. The court acknowledged that the subscriber might not be the actual violator because someone else could have used the subscriber’s internet connection or Briann’s phone number.

Ruling

Judge Hildy Bowbeer granted the plaintiffs’ Motion for Leave to Take Discovery Prior to a Rule 26(f) Conference. The plaintiffs may immediately serve one subpoena on each of Verizon Wireless and Charter Communications under Federal Rule of Civil Procedure 45. Each subpoena must be limited to one category of documents identifying the relevant subscriber or subscribers and to information reasonably calculated to identify the John Doe defendant associated with the specified internet addresses and phone number during the relevant period.

The plaintiffs must serve a copy of the order with each subpoena. Verizon and Charter are authorized to disclose the subscriber information to the extent the Communications Act applies. The plaintiffs may use any information produced only to protect and enforce the rights described in their complaint; that restriction does not expire unless the court later orders otherwise. No other discovery was authorized at that time.