Commissioner of Police v B

[2023] NZHC 2824

ORDER PROHIBITING PUBLICATION OF NAMES OR IDENTIFYING PARTICULARS IN ACCORDANCE WITH PARAGRAPH [36]

OF THIS JUDGMENT

IN THE HIGH COURT OF NEW ZEALAND AUCKLAND REGISTRY

I TE KŌTI MATUA O AOTEAROA TĀMAKI MAKAURAU ROHE

CIV 2023-404-002167

[2023] NZHC 2824

BETWEEN

COMMISSIONER OF POLICE

Applicant

AND

B

Respondent

Hearing	26 September 2023
Counsel:	M Mortimer-Wang and K Robinson for the Applicant
Judgment:	9 October 2023

JUDGMENT OF TAHANA J

(Reasons for take-down and suppression orders)

This judgment was delivered by me on 9 October 2023 at 3.00pm Pursuant to Rule 11.5 of the High Court Rules

…………………………

Registrar/Deputy Registrar

Solicitors/Counsel:

Meredith Connell (Crown Solicitor), Auckland

COMMISSIONER OF POLICE v B (Reasons for take-down and suppression orders) [2023] NZHC 2824 [9 October 2023]

Introduction

[1]    The Commissioner of Police (the Commissioner) applied on an urgent basis for take-down orders authorising the Commission to delete an online feed or channel (the Channel) or, in the alternative, authorising deletion of a post on the Channel containing confidential information acquired by hacking a law firm’s website and obtaining its client files (the confidential information).

[2]    The Commissioner also sought suppression of the respondent’s name, the law firm’s name, and the name of the platform on which the Channel is hosted.

[3]    I granted take-down and suppression orders on 27 September 2023 and further supplementary orders on 28 September 2023. This judgment sets out my full reasons for granting those orders.

Background

[4]    In August 2023, police investigated ransom notes emailed to the law firm. The notes stated that the sender had the law firm’s client files and threatened to post the files online if the ransom was not received.

[5]    Investigations led to the respondent. On 8 September 2023, the respondent was arrested and charged with blackmail,1 accessing a computer system for a dishonest purpose,2 and attempting to pervert the course of justice.3 The respondent is known  to police.

[6]    Police confirmed that the law firm’s client files were posted on the publicly accessible Channel thought to be operated by the respondent. The files, totalling 16.63 GB of data, contain private and privileged client information. Numerous other posts on the Channel appear to include hacked information from overseas, as well as Structured Query Language (SQL) queries and Amazon Web Service (AWS) keys

1      Crimes Act 1961, ss 237(1) and 238.

2      Crimes Act 1961, s 249(1)(a).

3      Crimes Act 1961, s 117(e).

associated with the unauthorised hacking of information. The purpose of the Channel appears to be to leak information that would otherwise be private.

[7]    Police believe the respondent is the administrator of the Channel. The respondent has admitted to police that they operate the Channel and that they accessed and posted the law firm’s client files. When police executed the search warrant they found the respondent’s computer logged into the Channel’s administrator account.

[8]    The operator of the platform on which the Channel is hosted is based overseas. Police have had no response to its requests to the site operator. Police say the operator has never responded to their requests for information or cooperation in other cases (unlike other large online platforms that are generally cooperative).

[9]    The police also requested the respondent’s consent to delete the Channel but they have not agreed. Counsel for the respondent has asked police if their position on bail would be influenced if the respondent voluntarily took down the post. Police have stated they are not prepared to use the outcomes of the alleged offending as a bargaining chip in relation to bail.

Leave to file originating application

[10]   Under r 19.5 of the High Court Rules 2016 (HCR), the Court may, in the interests of justice, permit any proceeding not mentioned in rr 19.2 to 19.4 to be commenced by originating application. The court’s permission may be sought without notice.

[11]   This application involves the Court’s inherent jurisdiction. The Commissioner requires the orders to authorise it to access the Channel for the purpose of deleting the Channel or the confidential information. The Commissioner applies for leave because he says there is no other applicable legal avenue to obtain the relief sought. The Search and Surveillance Act 2012 authorises the copying of digital files and the deletion of those copies, but not deletion of the original (or of the copied offending files as in this case).4 The Commissioner has no proprietary interest in the confidential information

4      Search and Surveillance Act 2012, ss 110 and 161.

on the Channel so cannot seek injunctive relief. Further, the Commissioner says the Harmful Digital Communications Act 2015 (HDCA) is directed at protecting against harm that is “serious emotional distress” so that the application does not fall squarely within the scope of that Act.

[12]   The purpose of the HDCA is to deter, prevent and mitigate harm caused to individuals by digital communications, and provide victims of harmful digital communications with a quick and efficient means of redress.5 Under the HDCA, the District Court may make orders against a defendant to take down or disable material.6 The District Court may also make orders against an online content host to disable public access to material that has been posted.7 In deciding whether to make an order, the District Court must consider, among other things, the level of “harm” caused or likely to be caused. Harm is defined as serious emotional distress.8

[13]   Under the HDCA, the police may apply to the District Court for an order under s 18 or s 19 if the digital communication constitutes a threat to the safety of an individual.9

[14]   I accept that the provisions of the HDCA do not squarely respond to the circumstances of this case. The exact content of the hacked files is unknown. The position of the clients of the law firm is unknown. The definition of harm indicates that the HDCA is aimed at protecting against serious emotional distress rather than the use of digital communications to breach confidence.

[15]   I also accept the Commissioner’s submission that the HDCA does not codify the law such that this Court’s inherent jurisdiction to grant the orders sought is ousted by the HDCA. This Court has previously held that it has inherent jurisdiction to grant take-down orders in relation to a website in Re Olsen.10

5      Harmful Digital Communications Act 2015, s 3.

6      Harmful Digital Communications Act 2015, s 19(1)(a).

7      Harmful Digital Communications Act 2015, s 19(2)(a).

8      Harmful Digital Communications Act 2015, s 4.

9      Harmful Digital Communications Act 2015, s 11(1)(d).

10     Re Olsen [2022] NZHC 1781.

[16]   If the confidential information remains on the Channel, there is a risk that members of the public will access and potentially use the confidential information that belongs to the law firm and its clients. Confidentiality may be breached and the safety of those individuals compromised.

[17]   The platform hosting the Channel is offshore and has failed to respond to police requests to delete the Channel. Police have requested the respondent delete the Channel, but they refused to do so. Police are also not aware of the law firm owner taking any action in relation to the confidential information on the Channel.

[18]   The application is reasonably straightforward in that there is no need for any interlocutory procedures. There is no material factual dispute. The confidential information clearly does not belong to the respondent. The affidavits filed in support indicate that the confidential information was taken from the law firm such that it is the law firm and its clients (and not the respondent) whose proprietary interests are impacted.

[19]   This Court has also previously granted leave to commence an application for a take-down order by way of originating application.11

[20]   In the circumstances, I am satisfied that it is in the interests of justice to grant leave to file the originating application.

Application for take down and suppression orders

Notice

[21]   I consider it appropriate that this application be dealt with on an ex parte basis. The affidavit filed in support of the application indicates that there is a third party who has access and administrator rights to the Channel and may take steps to copy and/or further distribute the confidential information if notice is provided. There is also urgency given the risks to the public, particularly the law firm’s clients and related parties, if the confidential information remains publicly available on the Channel. The respondent has no legitimate claim to the confidential information and has indicated

11     Re Olsen [2022] NZHC 1781.

they are unwilling to take any steps to remove it from the Channel. Further, no orders are sought against the platform owner such that it is necessary that it be notified.

[22]   I am satisfied that it is in the interests of justice that the application proceeds without notice.

Inherent jurisdiction

[23]   This Court has recognised that it has inherent jurisdiction to grant take-down orders.12 In Re Olsen the Court considered that there is an obvious risk to the public from a fraudulent website impersonating a barrister. The false statements on the website could undermine public confidence in the legal profession. The Court considered that the “jurisdiction to make a take-down order in these circumstances is thus justified by the need to maintain confidence in the legal profession, the rule of law and the facilitation of the administration of justice”.13 The Court did not consider it was necessary to undertake any balancing exercise given the website was fraudulent and all reasonable steps had been taken to get the website taken down, without success. The Court was satisfied that a take-down order should be issued.

[24]   I am satisfied that it is appropriate here to make orders authorising deletion from the Channel of any post containing a link to the confidential information for the following reasons.

[25]   First, the police’s functions include “maintaining public safety,” “crime prevention,” and “community support and reassurance.”14 Through the course of exercising their duties, the police have gained access to stolen confidential information that remains publicly available via the Channel. If the confidential information remains on the Channel, there is a risk of further crimes being committed and a risk to the safety of those members of the public who are the owners of the confidential information. Police are taking steps to prevent further harm to the public by seeking to remove the means by which the public can access the stolen confidential information.

12     Re Olsen [2022] NZHC 1781.

13 At [19].

14     Policing Act 2008, s 9.

[26]   Second, by analogy, the remedies available to the court for breach of confidence include an order for destruction of confidential information held by a defendant in lieu of delivery.15 The orders sought here seek that same outcome in the interests of protecting those members of the public who are the owners of the confidential information.

[27]   Third, steps have been taken to get the platform hosting the Channel to delete the Channel but there has been no response. It is located offshore.

[28]   Fourth, the respondent has been given an opportunity to delete the Channel or remove the confidential information and has failed to do so. Police have also provided evidence that there is at least one third party who appears to have access and administrator rights to the Channel such that if no steps are taken to remove the confidential information there is a risk of further harm to the owners of the confidential information, for example by further distribution of the confidential information.

[29]   Fifth, I have reviewed the affidavits filed in support of the application and I am satisfied that the confidential information was not obtained with the consent of the law firm and that the information is private and confidential to the law firm and its clients. I am satisfied that the respondent has no legitimate interest in the confidential information.

[30]   I do not consider it appropriate to grant orders to delete the Channel in its entirety in circumstances where the respondent has posted other information on the Channel. If non-offending information is not deleted, this removes the risk of any inadvertent interference with the respondent’s right to freedom of expression or to any proprietary interests in non-offending information. In the interests of urgency, it is not feasible to review all of the information on the Channel. Therefore, it is appropriate that the orders are limited to deletion of the offending material, that being the confidential information.

15 See for example Serious Fraud Office v Ross [2020] NZHC 1956; and Ecostore Company Ltd v Worth [2017] NZHC 1480. See also The Laws of New Zealand (online ed, LexisNexis) at [155] Remedies to Action for Breach of Confidence: Substantive Remedies.

[31]   I have reviewed the affidavits filed in support and accept that the police have reasonable grounds to anticipate that the respondent will not cooperate or delete the confidential information. I am satisfied that the execution order is necessary to ensure that the take-down order is executed.

Suppression orders

[32]   I grant the Commissioner’s application for suppression orders for the following reasons.

[33]   Suppressing the respondent’s name is necessary to preserve their fair trial rights. The respondent currently faces charges relating to their dealings with the law firm.

[34]   The law firm owner has requested the police seek non-publication of the law firm’s name so as to not jeopardise the police investigation nor cause any reputational damage to the law firm.

[35]   Granting suppression will allow the respondent and the law firm owner to make their own applications for name suppression thereby protecting their interests until such time as they can make the necessary application.

[36]   I do not consider the public interest in knowing the name of the respondent, the law firm and/or the platform outweighs the interest in protecting their identities until such time as they have notice and can determine whether they wish to seek ongoing suppression orders. Granting the suppression orders preserves their respective interests until such time as they can be heard.

Form of orders

[37]On 27 September 2023 I made the following orders:

(a)information obtained from, or relating to, the law firm be deleted from the Channel (the Take-Down Order);

(b)the Commissioner, or his agents, may execute the Take-Down Order by using any of the respondent’s devices in their possession to access the Channel;

(c)the respondent is to cooperate with the execution of the Take-Down Order by promptly facilitating access to their devices and the Channel as required by the Commissioner or his agents;

(d)the respondent is not to take steps to hinder the execution of the Take- Down Order, including, but not limited to, communicating with any third party that has access to the Channel;

(e)the names and any features likely to identify the respondent, the law firm, any client of the law firm, and the Channel are suppressed under further order of the Court; and

(f)leave is granted to apply for any such further order or orders which the Commissioner considers necessary to give effect to the Take-Down Order and/or the execution orders.

Application for supplementary orders

[38]   On 28 September 2023 I granted supplementary orders to secure the Channel by:

(a)excluding administrative access to the Channel (primarily by changing the passwords); and

(b)altering the settings of the Channel to limit public accessibility.

[39]   In support of the application a further affidavit was filed deposing that there remains on the Channel “dozens” of posts of information that appears to be hacked. That hacked information remains available to the public via the Channel. The police are liaising with foreign law enforcement agencies including from Australia and the United States.

[40]   The affidavit also deposed that upon executing the 27 September 2023 orders, police discovered that there is no option to delete the Channel but there is the option to alter the settings to prevent public access. The police are aware of two other persons with administrator privileges for the Channel who could take action to prevent police access through the respondent’s devices if the police did not act quickly.

[41]   The Court has inherent jurisdiction to make take-down orders to enable the police to take steps to prevent harm to the public. In the course of investigating a crime, the police now have access to what is in effect, an electronic crime scene. Absent orders of the Court, the police are unable to take steps to secure that scene and prevent further potential harm to the public. The platform hosting the Channel has not responded to police requests and the respondent has not agreed to delete the Channel.

[42]   I had previously expressed reservations about deletion of the Channel noting that it may contain non-offending information. The supplementary orders, however, will not result in the Channel being deleted but will limit public access to the Channel. I consider that the nature of the proposed orders sufficiently preserves the information on the Channel. If the respondent has any interest in the information on the Channel, it will not be deleted and can be retrieved, if necessary. The orders are required to prevent further harm by preventing public access to hacked information.

[43]   At the time of granting the supplementary orders, the respondent had not yet been served with the orders made on 27 September 2023. Given the supplementary orders will not require deletion of any information and given the risk that the other administrators may take steps to alter the Channel, I am satisfied it is appropriate to make the supplementary orders without notice.

[44]I therefore made the following orders:

(a)by using any of the respondent’s devices in their possession, the Commissioner, or his agents, may exclude administrative access to the Channel, including by changing the password;

(b)by using any of the respondent’s devices in their possession, the Commissioner, or his agents, may change the settings to the Channel to prohibit or limit access to the Channel by any other person, to the extent possible;

(c)the Commissioner is not required to disclose the password to the respondent pending any further order of the Court; and

(d)in the course of executing order (a) and/or (b) above, the information contained on the Channel is not to be deleted (other than as authorised in the Court’s minute dated 27 September 2023).

[45]   On 2 October 2023, the Commissioner informed the Court that it was unable to execute the supplementary orders. Upon taking action to execute the orders, the police discovered that the Channel is no longer accessible, the channel type has been changed to private and it appears to have been archived by an administrator.

Tahana J