Republic of Kazakhstan v Mega Limited
[2016] NZHC 963
•12 May 2016
IN THE HIGH COURT OF NEW ZEALAND AUCKLAND REGISTRY
CIV-2015-404-002909 [2016] NZHC 963
BETWEEN THE REPUBLIC OF KAZAKHSTAN
Applicant
AND
MEGA LIMITED Respondent
Hearing: 10 March 2016 Appearances:
Daniel Kalderimis and Ella Hallwass for the Applicant
Fletcher Pilditch and Rachael Cederwall for the RespondentJudgment:
12 May 2016
JUDGMENT OF MOORE J
This judgment was delivered by me on 12 May 2016 at 4:30 pm pursuant to Rule 11.5 of the High Court Rules.
Registrar/ Deputy Registrar
Date:
THE REPUBLIC OF KAZAKHSTAN v MEGA LIMITED [2016] NZHC 963 [12 May 2016]
Contents
Paragraph
Number
Introduction ..............................................................................................................[1] Background facts
Preliminary steps ....................................................................................................[7]
Letter of Request ..................................................................................................[14] The Republic’s application ....................................................................................[17] Mega’s opposition
Who is Mega and what does it do? ......................................................................[19]
Grounds of opposition ..........................................................................................[23]
Legal principles
Jurisdiction ...........................................................................................................[24] Discretion to make orders ....................................................................................[30] Historical background and principles...................................................................[32] Sections 184 and 185 of the Act...........................................................................[36]
A preliminary question – are these civil proceedings?........................................[50]
First, is the application a third party investigation which infringes s 185(5)
or is it for evidence?
Mega’s submissions .............................................................................................[58] Analysis ................................................................................................................[65]
Secondly, should the Court make orders given the nature of the claim and the availability of the Mutual Assistance in Criminal Matters
Act 1992 (“MACMA”)?
Mega’s submissions .............................................................................................[81] Analysis ................................................................................................................[86]
Thirdly, is there a necessity for Privacy Act 1993 non-compliance?
Mega’s submissions .............................................................................................[98] Analysis ..............................................................................................................[104] Conclusion.............................................................................................................[122] Orders....................................................................................................................[123] Costs ......................................................................................................................[124]
Introduction
[1] The Republic of Kazakhstan (“the Republic”) claims that in or about August
2014 its government computer systems and the email accounts of some of its government personnel were illegally hacked by unknown individuals. As a result, it alleges thousands of sensitive, proprietary and confidential privileged government documents (“the Stolen Documents”) were accessed. These included privileged communications between the Republic and its American legal advisors.
[2] A substantial number of the Stolen Documents were uploaded on an archived website hosted by a New Zealand registered company, Mega Limited (“Mega”). Links to the archives of the Stolen Documents on Mega’s website were also posted on another website (“the Kazaword Website”).
[3] Mega is a provider of encrypted, cloud-based services which enable private, secure online storage, communication and collaboration for businesses and individuals.
[4] The Republic filed a civil action in the United States District Court for the Southern District of New York (“SDNY”) against “Doe” defendants; that is the unknown individual or individuals who it is alleged undertook the hackings. The Republic seeks civil remedies including monetary damages and a permanent injunction.
[5] The difficulty for the Republic is that it does not know the identity of those who undertook the hackings. That information, or the means by which it may be obtained, is in the possession of Mega. And so the Republic obtained from the SDNY a Letter of Request (“Request”) addressed to this Court seeking this Court’s assistance in obtaining the production of specified documents which the Republic claims will lead to the identification of the hackers and hence the identity of the defendants.
[6] In the proceedings before this Court the Republic seeks an order issuing a subpoena requiring an authorised representative of Mega to attend the High Court for examination and to produce documents in Mega’s possession, custody and
control sufficient to identify nominated addresses and information connected to the accounts of certain users of Mega’s website. The application is brought under ss 184 and 185 of the Evidence Act 2006 (“the Act”). Mega opposes the application.
Background facts
Preliminary steps
[7] According to the Republic, it was not until January or February 2015 that it first became aware of the hackings. The discovery was made when Respublika, a Kazakhstan opposition party, made two initial posts on its Facebook pages containing some of the Stolen Documents. Since then, more of the Stolen Documents have been posted by Respublika on both the Facebook page and its own website.
[8] On 12 March 2015 the Republic filed its action in the SDNY against the “Doe” defendants. The Republic brought its proceedings under the Computer Fraud and Abuse Act (“the CFAA”).1 This jurisdiction was chosen, at least in part, because effective orders could be made against Facebook or any other host website on which the Stolen Documents were posted. The proceedings seek civil remedies including monetary damages and a permanent injunction.
[9] On 13 March 2015, Judge Ramos of the SDNY issued a temporary restraining order (“TSO”) under Federal Rule of Civil Procedure 65, based on a violation of the CFAA,2 which injuncted “the defendants, their affiliates, employees, agents, and representatives and/or persons acting in concert with or participating with defendants” from “using, disclosing, disseminating, posting, displaying, sharing, distributing, hosting, copying, viewing, accessing, providing access or making available to anyone, in any manner whatsoever”, the Stolen Documents.
[10] A few days later the relevant Facebook posts were removed.
1 Computer Fraud and Abuse Act 18 U.S.C. § 1030.
2 18 U.S.C. § 1030(a)(5)(B) and (a)(5)(C).
[11] Following a hearing on 20 March 2015, at which only the Republic appeared, Judge Ramos essentially converted the TSO into an interim injunction by restraining further dissemination of the Stolen Documents. The Court granted the Republic leave to serve subpoenas on companies’ websites on which the Stolen Documents had been posted. The companies have produced the IP addresses used to access the hacked accounts without authorisation, with time stamps which reveal when the unauthorised access took place. However, this evidence, on its own, does not identify the hackers.
[12] In order to obtain a permanent injunction and recover damages for its losses, the Republic must identify the unknown defendant hackers referred to in its proceedings before the SDNY as “Does 1-100”. The Republic claims the volume and organisation of Stolen Documents on Mega’s website makes it highly likely that the Stolen Documents were uploaded by the hackers or by someone working in concert with them.
[13] Without being able to identify the proper defendants in the SDNY proceedings the Republic will be unable to obtain the remedies it seeks; a permanent injunction and an award of damages against those who accessed the Stolen Documents. What the Republic seeks is to triangulate the evidence sourced from the Mega IP (internet protocol) addresses, email addresses, contact information, account information and payment information (“the identifying information”) associated with the accounts which were used to upload the Stolen Documents onto Mega’s website. It is expected that when this material is combined with the evidence the Republic already has in its possession the hackers, or those operating closely with them, will be identified.
Letter of Request
[14] On 21 May 2015 the Republic applied to the SDNY for a Letter of Request, addressed to the High Court of New Zealand, to obtain evidence from Mega regarding the accounts used to upload the Stolen Documents.
[15] On 28 October 2015 Judge Ramos issued the Request. The Request seeks the assistance of this Court in obtaining the production of specified documents “… by
order of subpoena from Mega Limited …”. The letter sets out the background and
Judge Ramos records, inter alia, the following:
“(a) There is good cause to find that the hackers, or others working in concert with the hackers, have posted some of the Stolen Documents on a website hosted by Mega.3
(b) There is good cause to find that the Mega website contains at least
27 files that collectively contain or once contained 27 articles containing screen shots of excerpts of the Stolen Documents. Mega now hosts these Stolen Documents. The Republic does not know who uploaded these files to the Mega website. Mega should have information (the identifying information) which will help identify who uploaded these files. The identifying information includes the IP addresses, email addresses, contact information, account information and payment information for the accounts that were used to upload the articles containing screen shots or excerpts of the Stolen Documents onto the Mega website.4
(c) This information is essential to identifying at least some of the “Does” named as defendants in the Complaint. Identifying the defendants is critical to proceeding with this action and holding the defendants accountable for their wrongdoing. It is also critical to enforcing the injunction against the defendants. The information is also reasonably likely to lead to admissible evidence.5
(d) The Republic’s request, that Mega produce the identifying information for the accounts that were used to upload a file that contains any Stolen Documents, could reasonably lead to the identification of at least some of the “Does” named as defendants.6
(e) The Republic’s request is narrowly tailored, and calls only for documents sufficient to identify the accounts that were used to upload the Stolen Documents onto the Mega website.7
(f) The Republic is unable to obtain this information by any other means. Mega is believed to be the sole custodian of the identifying information for the accounts that were used to upload the Stolen Documents onto the Mega website.8
(g) The SDNY is satisfied that Mega has, or is likely to have, within its possession, custody or control, documents that are required to identify the proper defendants for the New York proceedings and that could lead to admissible evidence at trial.9
3 Letter of Request at [4].
4 Letter of Request at [9].
5 Letter of Request at [10].
6 Letter of Request at [11.7].
7 Letter of Request at [11.8].
8 Letter of Request at [11.9].
(h) Accordingly, the SDNY respectfully requests the assistance of the New Zealand High Court to issue an order of subpoena for the attendance of an appropriate representative of Mega for the purpose of producing the identifying information, namely:
(i) IP addresses;
(ii) email addresses;
(iii) contact information;
(iv) account information; and
(v) payment information.10”
[16] On 8 December 2015 the present application was filed by the Republic in this
Court.
The Republic’s application
[17] The Republic seeks an order:
“… of subpoena requiring an authorised representative of [Mega] to attend at the High Court for examination and to produce documents in [Mega’s] possession, custody and/or control sufficient to identify the:
(1) IP addresses;
(2) email addresses;
(3) contact information;
(4) account information; and
(5) payment information,
connected to the accounts of certain users of [Mega’s] website
< as detailed in paragraph 14 of the Letter of Request dated
28 October 2015 issued by the United States District Court for the Southern
District of New York (SDNY) to the High Court of New Zealand, for the
purpose of civil proceedings that have been instituted before the SDNY.”
[18] The application is brought under ss 184 and 185 of the Act.
Mega’s opposition
Who is Mega and what does it do?
[19] The service offered to Mega’s users is unique. Mega provides encrypted cloud-based services using a unique and simple user-controlled encryption process which provides automatic encryption for all data transferred to and stored on its cloud service.
[20] This means that only the user controls the encryption key. Mega does not know the content of any files uploaded to its system and cannot review their content unless the user voluntarily discloses the decryption key. According to Mega’s counsel, Mr Pilditch, the company provides a level of privacy and security which is unparalleled among mainstream cloud storage solutions which allows it to position itself as “the privacy company”. This is the way it has represented itself to the general public and users. It currently has approximately 37 million users from more than 200 territories.
[21] Mr Pilditch describes Mega as a responsible corporate citizen which complies with legitimate law enforcement enquiries. While Mega, in its terms of use, reserves the right to disclose data and information about a user, this is only as “required by law or competent authority”. Mega’s terms also refer to its Privacy Policy and Takedown Guidance Policy as the preferred approach to the disclosure of user information. Mega’s Privacy Policy confirms that personal information is kept about a user when they sign up. In terms of disclosure Mega expressly retains the right to disclose personal information to third parties under the Privacy Policy if it considers this is necessary “or we have to by law in any jurisdiction”. This aspect is discussed in more detail later in this judgment.
[22] Mr Pilditch submits that in practice Mega will comply with lawful orders requiring it to produce user information. But because Mega’s model is centred on protecting the privacy interests of its users it will test and challenge attempts to access user personal information held by it. This approach means Mega not only meets the expectations of its users but also ensures it complies with its obligations under the Privacy Act 1993. Mega’s stance, Mr Pilditch submits, also enhances
New Zealand’s international reputation for maintaining adequate standards of data protection.
Grounds of opposition
[23] Consistent with that philosophy, Mega opposes the Republic’s application. It
does so on the following grounds:
(a) the orders sought are tantamount to discovery orders, designed to perpetuate an investigation conducted by the Republic. Such orders are not available under ss 184 and 185 of the Act;
(b)the use of ss 184 to 185 in the circumstances is inappropriate. It avoids the correct legislative mechanisms and constitutional safeguards concerning requests made by foreign countries for assistance with the investigation of criminal allegation;11 and
(c) on the evidence in the application, the orders, if made, are not capable of giving effect to the purpose of the assistance sought in the request and therefore breach the Privacy Act 1993.
Legal principles
Jurisdiction
[24] The Court’s jurisdiction to grant the Republic’s application is to be found in s 184 of the Act. This provision establishes the pre-requisites for the exercise of the power to make orders under s 185(1).
[25] Section 184 provides:
“184 Application to High Court for assistance in obtaining evidence for civil proceedings in another court
11 This ground was modified in argument before me to extend to a submission that I should not exercise my discretion under s 185 because if the hackers or their accomplices are identified they may be liable for human rights abuses at the hands of the Republic.
The High Court or a Judge may exercise the powers conferred by section 185(1) if an application is made to the High Court or a Judge for an order for evidence to be obtained in New Zealand and the court or Judge is satisfied—
(a) that the application is made to implement a request issued by or on behalf of a requesting court; and
(b) that any requirements prescribed in rules or regulations made under section 200 as to the form of the application and the manner in which it must be made are satisfied; and
(c) that the evidence to which the application relates is to be obtained for the purposes of civil proceedings which either have been instituted before the requesting court or whose institution before that court is contemplated.”
[26] In effect, this section requires the satisfaction of three elements, namely:
(a) the application must be one seeking assistance from a requesting
Court in an overseas jurisdiction;
(b)the High Court must consider if the request meets any prescribed requirements as to the form and manner of the request; and
(c) the request must relate to the obtaining of “evidence” for “the purpose of” a civil proceeding which has either been instituted, or is contemplated, in the overseas Court.
[27] For the purposes of the present application, it is common ground that the first and second requirements under s 184 are met. It is accepted this is an application seeking assistance from a requesting Court in an overseas jurisdiction. Furthermore, in terms of s 184(b), no rules or regulations have been prescribed under s 200 of the Act and accordingly, in their absence, the application complies with the judicially prescribed requirements for an application for assistance.12
[28] However, the third element under s 184(c) is not accepted. Mega claims the proceedings before the SDNY are not in the nature of civil proceedings and the
Court, in exercising its discretion under s 185, should have regard to the possible
12 Certain Underwriters at Lloyd’s London and Württemberhgische Versichberung A.G. v Boles
[2015] NZHC 1361.
consequences such an order may have on those identified as the hackers or those complicit with them. This challenge is discussed later in this judgment.
[29] Once the jurisdiction to make an order is established under s 184 the next question is whether the Court should exercise the power to give effect to the Request. This exercise engages s 185 of the Act.
Discretion to make orders
[30] Section 185 provides the Court’s power to exercise its discretion to make an order for the taking of evidence in New Zealand which the Judge considers appropriate for giving effect to the request. But there are limits on what any order under the section may require, particularly those contained in s 185(3) and (5).
[31] Section 185 relevantly provides as follows:
“185 Power of High Court to give effect to application for assistance
(1) If this section applies, the High Court or a Judge may—
(a) order that any provision for the taking of evidence in New Zealand that the High Court or the Judge considers appropriate for giving effect to the request to which the application relates, be made:
(b) include in that order a requirement for any specified person to do any specified thing that the High Court or the Judge considers appropriate for that purpose.
(2) An order under subsection (1) may include, without limitation, provision—
(a) for the examination of witnesses, either orally or in writing at any agreed time or at any specified time and place:
(b) for the production of documents:
(c) for the inspection, photographing, preservation, custody, or detention of any property:
(d) for the taking of samples of any property and the carrying out of any experiments on or with any property:
(e) for the medical examination of any person:
(f) without limiting paragraph (e), for the taking and testing of samples of blood from any person.
(3) An order under subsection (1) may not require any particular steps to be taken unless they are steps which can be required to be taken by way of obtaining evidence for the purposes of civil proceedings in the High Court (whether or not proceedings of the same description as those to which the application for the order relates).
(4) Subsection (3) does not preclude the making of an order requiring a person to give evidence (either orally or in writing) otherwise than on oath if this is asked for by the requesting court.
(5) An order under subsection (1) may not require a person—
(a) to state what documents relevant to the proceedings to which the application for the order relates are or have been in the person’s possession, custody, or power:
(b) to produce any documents other than particular documents specified in the order as being documents appearing to the court making the order to be, or to be likely to be, in the person’s possession, custody, or power and relevant to the proceedings.
…
(7) An order made under subsection (1) may be enforced in the same manner as if it were an order made by the High Court or Judge in proceedings pending in the High Court or before the Judge.”
Historical background and principles
[32] In this country, until the passing of the Act, requests for the obtaining of evidence for use in overseas proceedings were covered by ss 48A to 48F of the Evidence Act 1908 (“the 1908 Act”). Under the 1908 Act there were two available mechanisms for the examination of witnesses:
(a) requiring the attendance of a named person for the purposes of being examined; or
(b) the production of any document mentioned in the order.
[33] The leading New Zealand authority under the earlier provisions is that of William Young J in Perry v Molteno.13 There the Court was faced with a request arising from the discovery phase of a United States civil proceeding.
[34] Young J considered that the jurisdiction under the 1908 Act should be exercised in accordance with subpoenas duces tecum principles and not the principles applicable to third party applications; in other words an order from the Court to a person to produce a document to the Court which was alleged to be in their possession rather than produce it to the party. In the case of a subpoena duces tecum the party seeking production must do more than simply say, “produce everything relevant”. His Honour noted that while there is scope for debate on the
extent of the specificity required, some degree of specificity is necessary.14
[35] I note that Venning J approached the application in T T Jones Inc v Creighton LLC15 on the same basis. In accepting there was jurisdiction for the Court, Venning J observed that subject to the question of the admissibility of some documents, the witness could be subpoenaed to give evidence and produce the banking records.
Sections 184 and 185 of the Act
[36] Sections 184 and 185 of the Act replaced the provisions under the 1908 Act.
[37] Their legislative history indicates they are based on the Evidence (Proceedings in Other Jurisdictions) Act 1975 (UK). They were intended to be consistent with the Hague Convention on the Taking of Evidence Abroad in Civil or Commercial Matters. New Zealand is not yet a party to the Convention.
[38] The Court of Appeal in Hagaman v Fairbank16 described the general principles engaged in applications under ss 184 and 185 by reference to the United
13 Perry v Molteno (1998) 13 PRNZ 546 (HC).
14 At 550.
15 T T C Jones Inc v Creighton LLC HC Rotorua CP2/03, 18 July 2003; see too FCA Investment Co v Nelson HC Auckland CIV-2003-404-4287, 14 October 2013.
16 Hagaman v Fairbank [2010] NZCA 526.
Kingdom Court of Appeal’s helpful discussion of the English legislation and
principles in First American Corporation v Zayed.17
[39] In First American, as in the present case, the key question was whether the requesting Court was seeking to elicit evidence for trial or as part of an investigatory inquiry. The distinction is an important one because if it is the former there are well settled, analogous procedures in New Zealand. This is reflected in s 185(5) which prohibits an order made under subsection (1) from requiring a person to state what documents relevant to the proceedings are in a person’s possession, custody or power. It also prohibits the production of any documents, other than the particular documents specified in the order, as being documents appearing to the Court to be or likely to be in the person’s possession, custody or power and relevant to the proceeding.
[40] The New Zealand provision is expressed in very similar terms to its
United Kingdom equivalent.18
[41] As Sir Richard Scott V-C observed in First American19, it is clear that the United Kingdom equivalent to s 185(5) is directed against “fishing” applications for documents. The Court went on, by reference to earlier authority,20 to describe “fishing” as something of a term of art for the purposes of many procedural rules including particularisation, interrogatories and discovery. It arises in cases where what is sought is neither evidence as such, nor information which might lead to a line of enquiry which would disclose evidence. Fishing is perhaps best described as a roving enquiry which is not designed to establish an allegation of fact but rather to obtain information which may lead to obtaining evidence in general support of a party’s case.21
[42] In this context, Sir Richard Scott V-C observed that the question of relevance to an issue in the foreign action is primarily a matter for the foreign Court.22 The
17 First American Corporation v Zayed [1999] 1 WLR 1154, [1998] 4 AllER 439 (EWCA).
18 Evidence (Proceedings in Other Jurisdictions) Act 1975 (UK), s 2(3).
19 First American Corporation v Zayed above n 17 at [1161].
20 In Re State of Norway’s applications [1987] QB 433 per Kerr LJ.
21 At 482.
22 First American Corporation v Zayed above n 17 at 1165.
Court considering the request must look at the issue of relevance, if it is raised, in broad terms leaving to the foreign Court, in all but the clearest cases, the decision as to whether particular answers would constitute relevant admissible evidence. He observed at page 1165:
“In summary, in considering the letters of request in this case the Court should, in my opinion, ask first whether the intended witness can reasonably be expected to have relevant evidence to give on the topics mentioned in the amended schedule of requested testimony, and second whether the intention underlying the formulation of those topics is an intention to obtain evidence for use at the trial or is some other investigatory, and therefore impermissible intention.”
[43] The extent to which this Court can embark on an examination or review of the reasoning or conclusions of the foreign Court is thus necessarily and understandably limited. The question of what evidence is relevant to an issue in the foreign action is primarily a matter for the foreign Court.23 As the House of Lords observed in In re Asbestos Insurance Coverage24:
“It would be quite inappropriate, even if it were possible, for this House or any English Court to determine in advance the matters relevant to the issues before the California Courts on which each of these witnesses is in a position to give evidence.”
[44] However, as Sir Richard Scott V-C noted these are not the only considerations. It is also necessary for a Court to recognise the principle of comity and, if it can properly be done, accede to letters of request issued by foreign Courts seeking evidence for use in foreign litigation.
[45] In deciding what response to make to a letter of request, the Court should bear in mind the need to protect intended witnesses from an oppressive request. There is a balance to be struck in each case between the legitimate requirements of the foreign Court and the burden those requirements may place on the intended witness.
[46] Under ss 184 and 185 the previous distinction between criminal and civil proceedings no longer exists. Furthermore, the new Act is broader in its application.
23 At [1165].
24 In re Asbestos Insurance Coverage [1985] 1 WLR 331 (HL) at 339.
Under s 48A(1) reference is made to the requesting Court being desirous of obtaining “the testimony … of any witness in New Zealand”, whereas s 184 refers to an application for an “… order for evidence to be obtained in New Zealand”. Section 185 permits the Court to order “… taking of evidence …”. Plainly these provisions contemplate the making of orders which are considerably broader than simply requiring the testimony of any witness. This is confirmed by the reference in ss 185(2)(a) to (f) to other forms of evidence the Court may, without limitation, order to be taken or produced.
[47] However, the key consideration under s 185 and its 1908 predecessor remains that what is sought by the applicant must be evidence and not discovery or investigation. This is plainly what s 185(5) is directed at. As the Court of Appeal observed in Hagaman the key question the Court must ask is whether the request for assistance is for the purpose of eliciting evidence for trial or for an investigatory exercise. If it is the former the High Court may oblige. If it is for the latter purpose it falls outside that which the Court may order by reason of s 185(5).
[48] This distinction is not always a simple or straightforward one to make. Perry v Molteno involved an application to take the evidence of an ophthalmic surgeon for the purposes of a patent infringement case in the United States District Court. The applicant sought to have Professor Molteno examined and to have him produce
identified classes of documents. As Young J observed:25
“The documents originating with the American and American attorneys do have what might be regarded as a discovery flavour to them. The New Zealand process is indeed being treated as part of a discovery phase of the proceeding. It does, however, seem to be apparent that the evidence of Professor Molteno and the documents he produces and speaks to in his evidence will be treated as evidence in the US proceedings. On this basis there is no over arching jurisdictional problem with the application.”
[49] If the application is in the nature of a subpoena duces tecum, in the sense that it is an order for a witness to attend Court to be examined and produce specified documents for the purposes of the trial then it does not fall foul of s 185(3) and an
order can be made.
25 Perry v Molteno above n 13, at 552.
A preliminary question – are these civil proceedings?
[50] As previously noted, it is not accepted the evidence to which the application relates is to be obtained for the purposes of civil proceedings.26
[51] Although Mr Pilditch did not press this submission, instead raising the issue of the criminal nature of the proceedings in the context of his submission that this Court should not exercise its discretion under s 185(1), it is necessary to deal with this aspect.
[52] It can be dealt with quite simply. I have no doubt the proceedings before the SDNY are civil. The format of the intitulling of the proceedings is civil and the relief sought is that available in civil actions.
[53] Professor Miller described the suggestion that the proceedings are fundamentally criminal in nature as completely distorting the essence of the proceedings. He stated Mega’s argument entirely ignored the fact the CFAA provides private litigants a civil cause of action to seek damages and injunctive relief for violations of this statute. He described the CFAA as a hybrid statute with both criminal and civil components. On the one hand, the CFAA renders the proscribed conduct unlawful under the criminal laws of the United States while, on the other, it creates a private cause of action for those who have suffered loss as a result of the proscribed conduct.
[54] I also note the standard of proof is described by Professor Miller as the “preponderance of evidence” rather than the criminal standard. This is the common term used in the United States for balance of probabilities.
[55] Thus, although the CFAA is concerned with subject matter which is criminal in nature, it also provides civil remedies under what is plainly a civil regime. These are the remedies being sought in the present case.
[56] It thus follows I am satisfied these are civil proceedings within the meaning of s 184(c) and thus this Court has jurisdiction to make orders under s 185.
26 Section 184(c).
[57] I turn now to consider the three separate heads of opposition advanced by
Mega.
First, is the application a third party investigation which infringes s 185(5) or is it for evidence?
Mega’s submissions
[58] Mr Pilditch submits that while the directions sought by the Republic could feature in a s 185(1) order, they can only be made as an adjunct to the primary purpose of the order which is “for the taking of evidence in New Zealand”.27 He submits the present request manifests an investigatory discovery exercise which is inconsistent with the scope of orders capable of being made under ss 184 and 185 of the Act. The identifying information is not sought in conjunction with the testimony of a witness. The proposed mechanism of a subpoena is directed solely at gaining investigative access to information held by Mega. He thus submits the application is
not broadly in the nature of a subpoena duces tecum. Rather, it is an exercise in using a subpoena “to interrogate electronic data” held by Mega unrelated to any evidence any individual summoned could give.
[59] In support of this submission Mr Pilditch refers to the Request and in particular its language “… that Mega produce documents” sufficient to identify the alleged hackers. It is notable, Mr Pilditch submits, the Request is not that Mega give testimony or evidence of which document production is merely incidental.28
Mr Pilditch reinforces that submission by noting the Request for a subpoena does not
identify a witness.
[60] Mr Pilditch also submits this Court should focus on the Republic’s underlying intention. He points to the fact that when the Republic first filed its action in the SDNY on 12 March 2015 it referred to the launching of “an investigation” to determine the identity of the alleged hackers. He submits the present application is
merely part of that “investigation”.
27 Evidence Act 2006, s 185(1)(a).
28 Re Intec USA, LLC (2006) 18 PRNZ 222 (HC) at [32].
[61] Mr Pilditch also refers to the submissions made to Judge Ramos by Mr Semmelman, counsel for the Republic. Mr Semmelman made reference to the need for the subpoena:
“… to find out who we’re fighting … where they are and what they’re doing and things of that nature.”
[62] Mr Semmelman spoke of wanting:
“… to dig behind all the various websites that are located in different parts of the world to find out who posted on these websites and to use the discovery process to go as far as we can to try and identify who the posters are and who are behind the websites … and that’s going to involve discovery against various third parties.”
[63] It is Mr Pilditch’s submission these statements are consistent with an investigative or discovery purpose rather than being directed towards the “taking of evidence” within the meaning of s 185(1).
[64] He further supports this submission by reference to the steps which Mega would be obliged to undertake in the event orders were made. The “documents” do not exist in any form which could be produced. It will require Mega to compile information for the purpose of providing this to the Republic. Mega would have to interrogate its own databases to create collections of data. It would then have to create the documents to comply. Mr Pilditch thus submits the Republic seeks to compel Mega to undertake the investigation on its behalf.
Analysis
[65] I have already discussed the general principles of ss 184 and 185 and, more particularly, the effect of s 185(5).
[66] Although the expressions “investigation” and “discovery” can be found in the transcripts of submissions made to Judge Ramos they are not expressions or words used in the Request. The concept of discovery in the civil jurisdiction of the United States’ federal system has a broader meaning than in this jurisdiction. The Republic
has filed an affidavit sworn by Professor Miller, a distinguished American legal academic29 who deposed to this fact.
[67] In any event, it is important not to be distracted by semantics. Instead, the Court should examine the substance of the Request and ask itself what is the purpose of the application; is it seeking the eliciting of evidence for trial or is it an investigatory enquiry?
[68] I am satisfied the purpose of the Request is to obtain evidence for use at the trial. My reasons follow.
[69] First, this is reflected in the express wording of the Request where it states:
(a) The information is essential to identifying at least some of the “Does” named as defendants in the complaint. Identifying the defendants is critical to proceeding with this action and holding the defendants accountable for their wrongdoing. It is also critical to enforcing the
injunction against the defendants.30
(b)The Republic’s request is narrowly tailored and calls only for documents sufficient to identify the information for the accounts used to uplift the Stolen Documents onto the Mega website.
[70] Secondly, this is not a “roving enquiry” undertaken through the examination and cross-examination of witnesses in the hope of obtaining evidence in general support of a party’s case.31 It is a request to adduce specific and identified evidence which is central to the Republic’s ability to prove its case.
[71] When the purpose of the Request is reviewed in the context of the proceedings before the SDNY the same answer follows.
29 Professor Miller is a professor at New York University and formerly Professor of Law at Harvard University. He has been a qualified attorney since 1959 and co-author of the leading US text on federal practice and procedure. He has appeared as counsel in all US Circuit Courts of Appeal and before the United States Supreme Court. He advises the judiciary on, and assists in the development and amendment of, the Federal Rules of Civil Procedure.
30 Letter of Request at [10].
31 Re State of Norway’s Application above n 20, per Kerr LJ.
[72] The proceedings filed by the Republic seek civil remedies in the form of a permanent injunction and damages. In that sense they are unremarkable except for the fact the defendants are not identified. Evidence tending to identify the “Does 1-
100” would, plainly, be evidence admissible at the civil trial. There is, of course, an “investigatory flavour”32 to the Request because the evidence the Republic seeks, namely information which will lead to the identification of the defendants, will be used to establish a fact not yet known to the Republic, rather than support a fact it alleges to be true. It will also be useful in allowing the Republic to undertake further enquiries potentially leading to the identification or discovery of additional evidence. However, I am satisfied that this is not the overarching purpose of the Request. Like the Professor’s testimony and the associated documents in Perry v Molteno the
information sought will undoubtedly be treated as evidence in the SDNY proceedings, and will be used by the Republic to establish a fundamental fact at issue in the trial, namely the identity of “Does 1-100.” For this reason, I am satisfied that the purpose of the Request is permissible.
[73] The Request also notes that the information requested is incapable of being obtained by any other means because Mega is believed to be the sole custodian of the identifying information of the accounts used to upload the Stolen Documents onto Mega’s website.
[74] Additionally, the evidence sought is specific. It is limited to the identifying information of the users of the Mega accounts who posted the Stolen Documents belonging to the Republic, at the URLs specified in nominated paragraphs of the Request, within the specified period between 1 August 2014 to the present.
[75] It follows for these reasons I am satisfied this is not a case where the Request is an unfocused attempt to cast a wide net in the hope that chance may lead to something useful being caught. It is a narrow request for specific evidence which Judge Ramos was satisfied is relevant and essential for the purposes of the SDNY
proceedings.
32 Perry v Molteno above n 13, per William Young J.
[76] It follows I am satisfied that under the broader test introduced by ss 184 and
185, the Republic’s application should be granted and the Request accepted. But even if the principles under the 1908 Act were to be applied, the result is the same. For the reasons already given, the documentation sought is of a nature which could be obtained by the use of a subpoena duces tecum. The material is in Mega’s possession. It is specific and identifiable evidence. It is evidence tending to establish a fact in issue at trial.
[77] Finally, I am not persuaded that the fact there are no physical documents presently in existence which Mega could produce to meet the Court’s order operates as an impediment to the making of an order. Nor do I accept what is being requested is effectively an order requiring Mega to undertake an investigation on behalf of the Republic because it has to “… interrogate it own database to create collections of data.”
[78] Mega submits it would have to create the documents to comply. The effect of this would amount to compelling Mega to undertake an investigation on the Republic’s behalf.
[79] However, Mega would not be asked to form a judgement about the relevance of the documents or to undertake an investigation of its own. Neither does Mr Pilditch submit the Request, if granted, would be oppressive either in terms of the volume of material involved or in terms of the need for Mega to exercise judgement in determining relevance.33 The Request is a narrow one which identifies a relatively modest number of specific categories of information. No judgement is required in the exercise of compliance. To comply requires the adoption of a mechanical process of obtaining the specific information sought, and compiling it
into a form which permits it to be presented to the Court.
33 Waind v Hill and National Employees’ Mutual General [1978] 1 NSWLR 373; T T Jones Inc v
Creighton LLC above n 15 at [21] and [22].
[80] It follows that I am also satisfied Mega has the ability and capacity to comply and the Request is not oppressive. This ground of objection thus fails.
Secondly, should the Court make orders given the nature of the claim and the availability of the Mutual Assistance in Criminal Matters Act 1992 (“MACMA”)?
Mega’s submissions
[81] Unlike s 48A(1) of the 1908 Act, where the application for examination of a witness could be made in relation to both civil or criminal proceedings, s 184(c) limits applications for use in civil proceedings instituted before the requesting Court. Requests for assistance in criminal matters are governed by the MACMA. Mr Pilditch submits that because the New York proceedings are essentially criminal in nature this Court should exercise caution to prevent an abuse of its own process.
[82] The power to make an order under s 185 is discretionary. Mr Pilditch submits the Court must exercise its discretion in a proper manner and for just cause. In doing so it must take into account the consequences of any order made. He submits Mega protects the privacy of all of its users as it is statutorily required to in terms of the Privacy Act 1993. If Mega divulges the identifying information and if that information is capable of leading to the identification of the hackers or their accomplices Mega is concerned this disclosure might ultimately lead to political reprisals and human rights violations against those identified; actions which are inconsistent with New Zealand’s values as a constitutional democracy. He makes this submission against the background of reported human rights abuses in the
Republic.34 Mr Pilditch submits these issues must be taken into account by this
Court in exercising its discretion under s 185(1).
[83] By analogy, Mr Pilditch submits that had this application been brought under s 192 of the Act, which relates to the obtaining of information for the purposes of
34 Reliance was placed on the report of the United States Special Rapporteur of 16 June 2015 and the United States’ Department of State 2014 report on Kazakhstan which recorded abuses including arbitrary or unlawful killings; military hazing leading to deaths; torture and other abuse; harsh and at times life-threatening prison conditions; infringement on citizens’ privacy rights.
overseas criminal proceedings, this Court would have been required to consider
whether the proceedings were of a “political character”.35
[84] Mr Pilditch also referred me to MACMA which places the executive responsibility for the management of interstate relationships and interstate assistance in relation to criminal matters with the Attorney-General.36 Under s 27 of MACMA the Attorney-General may refuse a request for assistance if, in his opinion, the request relates to the prosecution of an offence of a political character,37 or relates to allegations of activity of a political nature,38 or relates to the prosecuting or
punishment of a person for an offence of a political character,39 or in granting of the
request the sovereignty, security or national interests of New Zealand40 would be prejudiced.
[85] Thus Mr Pilditch’s submission is more nuanced than a simple bald assertion the Republic’s application is essentially criminal in nature and is thus misconceived because the request for assistance should have been dealt with diplomatically or brought under MACMA.
Analysis
[86] The question of the rights of those identified if the order is made was dealt with in an affidavit sworn by Mr Semmelman, lead counsel for the Republic in the present proceedings. According to Mr Semmelman the concerns around human rights abuses raised by Mega in these proceedings mirror those vigorously advanced by Respublika before the SDNY. In the SDNY proceedings the Republic flatly rejected these claims. However, it offered to restrict access to any documents,
materials or information produced by Mega to litigation counsel, their experts and
35 Section 192 provides for the examination of witnesses in criminal proceedings at the request of an overseas Court. Section 192(1) provides as follows:
“(1) If any criminal proceedings (not being criminal proceedings of a political character) are pending before any overseas court of competent jurisdiction, and that court wishes to obtain the evidence of any witness in New Zealand for the purposes of those proceedings, the High Court or a Judge of that court may order the examination of the witness on oath, by interrogatories, or otherwise, before any person named in the
order.”
36 Mutual Assistance in Criminal Matters Act 1992, ss 25 and 27.
37 Section 27(1)(a).
38 Section 27(1)(a) and (b).
39 Section 27(1)(b).
40 Section 27(1)(f).
consultants, independent technical service providers (such as photo-copy services) and the SDNY and its staff. It brought a motion for entry of a protective order designed to restrict access to any documents, material or information produced by Mega on the same terms as described above.
[87] Prior to the hearing the Court directed Mega to submit a written response. Mega responded by stating it had not submitted to the United States’ jurisdiction and had no intention of engaging in the proceedings and, as such, would not be filing any response to the motion and draft order.
[88] Despite Mega’s stance, Judge Ramos issued a protective order governing access to any of the documents, material or information produced by Mega pursuant to the Request. That order specified the only individuals permitted to have access to the documentation were:
(a) the Republic’s litigation counsel (including paralegal, clerical and/or
other assistants employed in assisting litigation counsel);
(b)any person, not being an employee of the Republic, who was retained by litigation counsel as an expert witness or consultant provided they first executed a non-disclosure agreement;
(c) independent photo-copying, graphic production services or litigation support services employed by litigation counsel to assist in the proceedings and computer service personnel (not being employees of the Republic) performing duties in relation to a computerised litigation system;
(d) the SDNY and its support personnel; and
(e) any other person whom Mega agrees in writing may have access.
[89] The protective order directed that all portions of pleadings, motions and other papers filed with the Court which disclose any of the documents, materials or
information produced under the Request are to be filed under seal with the Clerk of the Court and kept under seal under further order of the Court.
[90] As Mr Kalderimis, for the Republic, explained any application to share the information derived from Mega or to name the hackers in the New York proceedings must be filed under seal with notice to the intended defendants with the SDNY determining whether to allow the information to be shared with the Republic and whether the intended defendants are to be named. In other words the Court retains judicial oversight and control over how the names and/or identity of any of the defendants is to be treated in the proceedings before it.
[91] Mr Kalderimis indicated that, if necessary, similar protective orders could be made in this Court also.
[92] I am satisfied this ground of objection, too, must fail. In exercising my discretion under s 185(1) I must consider the need for comity and the desirability of acceding to the Request if possible with the interests of affected parties including those who may be identified as a result of this application. Questions of comity are important. In cases of this kind Courts have frequently emphasised the importance of acceding to letters of request issued by foreign Courts seeking assistance for use in foreign litigation if they can properly do so. Indeed, it has been stated this is particularly so where the litigation arises out of a fraud practised on an international
scale.41
[93] While hardly analogous to cases involving international fraud, the facts of the present case do share some important wider public interest considerations. Recent examples of the illegal and unauthorised hacking of international databases and email accounts has attracted worldwide attention. The costs to those adversely affected by such unauthorised intrusions, whether measured in financial, security or
personal privacy terms is very substantial.
41 First American Corporation v Zayed above n 17, at [1165]; Hagaman v Fairbank above n 16, at
[41].
[94] While I have no doubt that Mega’s concerns, as expressed by Mr Pilditch, are genuinely and sincerely held, I am also satisfied they are issues which were properly considered by Judge Ramos when he issued the protective orders. Those orders are both extensive and comprehensive. It is also notable that when invited to contribute to discussions on how the SDNY might best protect the interests of its users, Mega, as it was entitled to, refused.
[95] Furthermore, Mr Pilditch does not submit the protective orders are insufficient in the present case to meet Mega’s concerns. Rather, he submits the expressed concerns should be taken into account by me in the exercise of my discretion under s 185(1).
[96] I am satisfied the protective orders made in the SDNY provide sufficient mitigation of the risks identified by Mr Pilditch. Furthermore, I am prepared to issue similar orders in this Court if the parties are of the view that such a course would be either desirable or necessary to protect Mega’s users.
[97] Accordingly, this ground of objection also fails.
Thirdly, is there a necessity for Privacy Act 1993 non-compliance?
Mega’s submissions
[98] Mr Pilditch’s complaint is that the Court’s discretion in s 185 should not be exercised in a manner which is inconsistent with the privacy principles contained in the Privacy Act 1993. He submits the order should only be made if this Court is substantively satisfied it is necessary; that disclosure is necessary in order to meet the needs of the foreign litigation.
[99] He thus submits this calls into question the evidence which was placed before the SDNY and the conclusions by Judge Ramos that the evidence sought will identify the hackers.
[100] In developing this submission, Mr Pilditch referred to the statement of Judge
Ramos in the Request that:
“There is good cause to find that the hackers, or others working in concert with the hackers, have posted some of the stolen materials on the respondent’s website.”
[101] Mr Pilditch submits there is no evidential explanation in the Request as to why the existence of a volume of allegedly “stolen materials” on Mega’s website necessarily means that those who posted these materials were either the hackers or people working in concert with them.
[102] Furthermore, Mr Pilditch submits it is not accepted that any information which could be derived from Mega is “essential” in the identification of the “Does” as asserted in the Request. He submits the identifying information sought may not further the Republic’s investigation at all but it is inevitable that if the orders are made the disclosure of that information will be at the cost of the privacy of the user in question. In support of this submission he refers to the various affidavits filed by the Republic which he submits are largely a repetition of the same unsubstantiated assertion.
[103] Mega’s concern is it will be compelled to divulge personal information about one of its users on the speculative grounds this information may help the Republic to identify the defendants; that such a disclosure cannot be elevated to the level of necessity as required by the Privacy Act 1993.42
Analysis
[104] In reviewing Mega’s claim it is helpful to examine the process and evolution
of the New York proceedings.
[105] I am satisfied the Request is no rubber stamp. The civil docket was produced as an exhibit to Professor Miller’s affidavit. It reveals that between 12 March 2015, when the proceedings were first issued until 4 January 2016, when Mega was invited
to submit a written response to the motion for protective orders, there were 74 Court-
42 Refer Principle 11(e)(iv).
related events. These included the filing of various applications, declarations in support of the motion, legal memoranda, affidavits of service, hearings, conferences, etc. Transcripts of the hearings have been provided.
[106] The application for the Request was filed on 5 May 2015. Various pre- motion conferences were held and on 22 October 2015 oral argument was received on the application for the “issuance of letters rogatory”.
[107] It is apparent from the orders made that the various applications brought by the Republic were not treated in a pro forma or uncritical way by Judge Ramos. For example, the Judge issued a without prejudice ruling that the injunction was not to apply to Respublika on first amendment grounds. This ruling was made on a without prejudice basis because the Judge required the filing of more explicit evidence tending to link Respublika to the hacker or hackers.
[108] Furthermore, at the same time as the Judge issued the Request to this Court, he had before him an application for a Letter of Request to the Polish Courts seeking the taking of a deposition of a nominated individual. As is apparent from the transcript and the discussions between counsel and the Judge, Judge Ramos was not prepared to grant the Polish orders as sought without modification.
[109] Furthermore, I do not accept Mega’s submission that it is speculative that this information may help the Republic identify the defendants. Judge Ramos’ conclusion that the information sought is essential to identifying at least some of the “Does” named as defendants in the complaint is supported by the evidence filed in this Court. This reveals that extensive investigations by the Republic have uncovered no other website that contains anywhere near the volume of Stolen Documents as that posted on the Mega website. Furthermore, as many of the posted Stolen Documents are organised by the specific official whose account was hacked it would be extremely unlikely, if not impossible, according to the evidence of one of the attorneys instructed by the Republic, for someone who was not a hacker or working directly with the hacker/s to have somehow independently collated such a volume of Stolen Documents and catalogued them in such a systematic way. In the attorney’s opinion, the most plausible explanation for this volume and organisation is
that the hacker/s or someone working closely with the hacker/s have posted the
Stolen Documents on the Mega website.
[110] It is against that factual matrix the Republic concluded Mega has or is likely to have, information in its sole possession, custody and control that can be used to identify the proper defendants to the SDNY proceedings. This includes the identifying information of users of the accounts of the Mega website that were used to archive documents from among the Stolen Documents.
[111] Furthermore, the evidence reveals the Republic has, to date, been unable to access this information from any other source. Although subpoenas have been issued in respect of Facebook, Microsoft, Google and others, the subpoenas seek different information because these companies would not be expected to have the account information used by whoever posted the Stolen Documents on the Mega website. As such, Mega is uniquely positioned to hold the identifying information. This evidence is, in turn, likely to be required in identifying the proper defendants which is needed in order for the Republic to pursue its remedy in the civil proceedings.
[112] Finally, the privacy expectations of any Mega website user are necessarily limited by Mega’s terms of service which are explicitly binding and applicable to every subscriber or user of its services.
[113] The terms explicitly state that by using Mega’s services, the website or mobile applications, the user irrevocably agrees to Mega’s terms. The terms include the following statements:
“If you do not like these terms or don’t want to be bound, you can’t use our services, the website or our mobile apps. In particular, OUR SERVICES ARE PROVIDED SUBJECT TO CERTAIN DISCLAIMERS BY US AND UNDERTAKINGS BY YOU, INCLUDING AN INDEMNITY FROM YOU IF YOU BREACH THESE TERMS – see clauses 37-47. NEW ZEALAND LAW AND ARBITRATION OF ANY DISPUTES APPLIES EXCLUSIVELY – see clauses 48 and 49.”
[114] The terms go on to state:
“You can’t … store, use, download, upload or otherwise transmit or make
available, data in violation of any law. …”
[115] In a document described as “Mega Limited Privacy Policy” reference is made to the user’s information which Mega collects. Under the heading, “Personal Information”, the document records that Mega keeps records of IP addresses used to access its services. And then, under the heading “Disclosure”, the following is stated:
“If we think it is necessary or we have to by law in any jurisdiction then we are entitled to give your information to the authorities. We reserve the right to assist any law enforcement agency with investigations, including and limited to by way of disclosure of information to them or their agents. We also reserve the right to comply with any legal processes, including but not limited subpoenas, search warrants and Court orders. We may disclose your information to enforce or reply our Terms or any other agreement we have with you; or to protect the rights, property, or safety of us or our other users or the operation of our services and the website.”
[116] These terms are reflected in Mr Pilditch’s submission that Mega is a responsible corporate entity which will and does comply with lawful requests, directions and warrants to divulge information. As Mr Pilditch observed, Mega places privacy at the centre of its model and will vigorously challenge applications of this kind to test the propositions, underlying evidence and principles advanced by the Republic. It does so to safeguard the privacy interests which not only reside at the centre of its particular operating model but which form what Mr Pilditch described as a core part of New Zealand’s constitutional framework.
[117] This Court is faced with a reasoned Request. The extent to which this Court can and should examine the circumstances behind that request are necessarily limited and the privacy interests of the users, while requiring protection, are not absolute, particularly given the express limitations imposed on its users by Mega. Another persuasive factor is the limited nature of the information which Mega would be required to disclose. The Republic seeks IP addresses, email addresses, contact information, account information and payment information. With the possible exception of the latter, this information is neither particularly revealing nor particularly sensitive; it does not, for instance, carry the same degree of
confidentiality as an individual’s email or phone records. Therefore, I am satisfied that the privacy interests in this case should not carry significant weight. I am also satisfied that any potential harm could be mitigated by the imposition of properly worded protection orders.
[118] For largely the same reasons, I am satisfied that it is not appropriate to make a direction under s 69 of the Act. No doubt by reason of limits of time Mr Pilditch did not advance this claim in his oral argument before me. He did, however, refer to it in his written submissions. This section provides the Court with the overriding discretion to make a direction that confidential information not be disclosed in a proceeding if the public interest in the disclosure of the information is outweighed by the public interest in:
(a) preventing harm to a person by whom, about whom, or on whose behalf, the confidential information was obtained, recorded, or prepared or to whom it was communicated; or
(b) preventing harm to:
(i)the particular relationship in the course of which the confidential communication or confidential information was made, obtained, recorded, or prepared; or
(ii)relationships that are of the same kind as, or of a kind similar to, the relationship referred to in subparagraph (i).
[119] In deciding whether or not to exercise this discretion, the Court must have regard to:
(a) the likely extent of harm that may result from the disclosure of the communication or information; and
(b)the nature of the communication or information and its likely importance in the proceeding; and
(c) the nature of the proceeding; and
(d)the availability or possible availability of other means of obtaining evidence of the communication or information; and
(e) the availability of means of preventing or restricting public disclosure of the evidence if the evidence is given; and
(f) the sensitivity of the evidence, having regard to:
(i)the time that has elapsed since the communication was made or the information was compiled or prepared; and
(ii)the extent to which the information has already been disclosed to other persons; and
(g) society’s interest in protecting the privacy of victims of offences and,
in particular, victims of sexual offences.
[120] It is unnecessary for me to repeat my earlier conclusions in any great detail. It is sufficient to say that I consider the public interest in disclosing the information outweighs the public interest in preventing harm to the hackers personally or Mega’s relationship with its users. To whatever extent a risk of harm actually exists, I am satisfied the imposition of appropriately worded protection orders can meet this risk. The information in this case is not particularly sensitive but is plainly critical to the SDNY proceeding. On the evidence, it also cannot be obtained through any other means.
[121] Accordingly, this ground of opposition, also, must fail.
Conclusion
[122] For the reasons set above I have determined that none of the objections raised by Mega is sufficient to persuade me not to grant the orders sought.
Orders
[123] I direct:
(a) The issuing of the subpoena requiring an authorised representative of Mega to attend at the High Court for examination before the Registrar and to produce documents in Mega’s possession, custody and/or control sufficient to identify the:
(i) IP addresses;
(ii) email addresses;
(iii) contact information;
(iv) account information; and
(v) payment information,
connected to the accounts of certain users of [Mega’s] website
< as detailed in paragraph 14 of the Letter of Request dated 28 October 2015 issued by the SDNY to the High Court of New Zealand, for the purpose of civil proceedings that have been instituted before the SDNY.
(b)The parties are to consult with a view to filing a joint memorandum within 10 working days of the date of this judgment:
(i)advising the Court of the identity of Mega’s authorised representative and such other details as may be necessary for the issuing of the subpoena;
(ii)this will include the date fixed for the hearing and its duration following consultation with the Registry;
(iii)advising the terms of any protective order/s necessary to be made in this jurisdiction governing access to and dissemination of any evidence adduced in this Court pursuant to the subpoena.
(c) Leave is reserved to either party to apply for such further or other orders/directions as counsel consider are necessary to expedient to give effect to these orders.
(d)Leave may be exercised by memorandum directed to the Registrar and marked for my attention in the first instance. The leave extends to, but is not limited to, any request for an order that the Republic provides security for Mega’s authorised representatives and/or the Registrar’s costs if that cannot be agreed.
(e) The oral testimony and documentary evidence adduced from Mega’s authorised representative is to be made available to Judge Ramos of the SDNY by the Registrar of this Court.
(f) The Republic is to meet all reasonable costs incurred by Mega in complying with these orders and all costs of the Registrar in remitting the statements and evidence to the United States and matters
incidental thereto.
Costs
[124] Although the Republic is the successful party and as such would normally be entitled to costs, I am of the view that Mega’s opposition in protecting the privacy and other interests of its users was a responsible and appropriate course and, in the circumstances, I am inclined to order that costs should lie where they fall. However, not having had the benefit of receiving submissions on this issue, if the parties are unable to agree. I direct as follows:
(a) If the Republic wishes to pursue costs it is to file a memorandum in that regard within 10 working days of the date of this judgment.
(b)In that event Mega is to file a memorandum in response within a further 10 working days.
[125] I shall then deal with the issue of costs on the papers unless I require further assistance from counsel.
Moore J
Solicitors/Counsel: Chapman Tripp, Wellington Lowndes Jordan, Auckland Mr Pilditch, Auckland
3
2
0