The Kazakhstan government had a third major setback in its attempt to use the U.S. legal system to attack one of its fiercest critics, the independent newspaper Respublika. A federal judge in California rejected Kazakhstan's demand that Facebook turn over information about users associated with Respublika’s account on the social media site. The judge found that Kazakhstan lacked the appropriate judicial authorization to pursue such discovery, rejecting Kazakhstan’s claims that its ongoing Computer Fraud and Abuse Act (CFAA) lawsuit essentially gave it free rein to obtain information about its critics.
As we previously reported, EFF is representing Respublika—a longtime target of Kazakhstan intimidation and persecution because of its investigative reporting on President Nursultan Nazarbayev’s regime—which has been dragged as a non-party into a CFAA lawsuit Kazakhstan filed in federal court in New York against unnamed and unknown hackers Kazakhstan believes broke into its email system.
In November 2015, Kazakhstan subpoenaed Facebook for the names, email addresses, IP addresses, and MAC addresses of the users associated with Respublika’s and another user’s Facebook accounts. Kazakhstan claimed that this discovery was authorized by the Judge overseeing its CFAA lawsuit in New York. Kazakhstan said it wanted to compare IP addresses produced in response to the Facebook subpoena with IP addresses it has already obtained and which it believes were used to access the allegedly hacked accounts during the relevant time periods—hoping a match would lead to the hackers’ identities.
Facebook resisted Kazakhstan’s request for information about its users, leading Kazakhstan to file a motion to compel in the Eastern District of California. Both Facebook and EFF opposed Kazakhstan’s motion, and Facebook moved to quash the subpoena.
Magistrate Judge Kendall J. Newman ruled in favor of Facebook and Respublika, quashing—i.e., flat out rejecting—Kazakhstan's subpoena. The court found that the Facebook subpoena had not been authorized by Judge Ramos in New York, as required under the Federal Rules of Civil Procedure. Clearly not buying Kazakhstan’s argument that general statements by Judge Ramos about Kazakhstan's need for additional evidence somehow authorized the specific discovery Kazakhstan was seeking against Facebook, the judge stated: “the court finds it implausible that broad and essentially undefined expedited discovery with respect to Respublika and affiliated persons remains authorized, if indeed it was initially authorized."
The court also recognized the important First Amendment implications in the case:
[T]he proposed discovery from Facebook, which involves Respublika, a news organization, raises significant concerns regarding the reporter’s privilege and the First Amendment. Kazakhstan contends that it does not seek journalistic information or content, such as reporter’s notes, drafts, or communications. However, it does seek the names, email addresses, IP addresses, and MAC addresses of administrators and posters on the Respublika Facebook Page and the Ketebaev Facebook Page. Such persons may well be journalists, writers, and other staff or contributors to Respublika, whose identifying information and location may be entitled to protection, especially in light of the serious allegations of oppression and intimidation by Kazakhstan made by Respublika. See, e.g., Bursey v. United States, 466 F.2d 1059 (9th Cir. 1972).
The court also noted that the type of IP address comparison that Kazakhstan wanted to do—which as we argued in our brief would necessitate giving Kazakhstan far too much potentially irrelevant information about Facebook users—“appears to come dangerously close to a fishing expedition, particularly given that it involves non-parties, whose identities are clearly known to Kazakhstan, but against whom Kazakhstan has yet to state any claim."
Given Kazakhstan’s history of harassing, threatening, and arresting independent journalists, keeping this information out of the government’s hands is important for ensuring the safety of those affiliated with Respublika.
Kazakhstan’s CFAA lawsuit arose from the August 2014 appearance on the Internet of a huge volume of emails of Kazakhstan’s ruling regime, purportedly from both official governmental email and the private Gmail accounts of several officials. The emails were reportedly posted to Mega and then indexed on a website called “kazaword.” Whether the emails and documents were released by someone who “hacked” into Kazakhstan’s computers or simply leaked by someone within the government remains an open question. Respublika used several of the emails as source material for numerous articles starting in January 2015, publishing the articles both on its own website and through its Facebook page.
In March 2015, Kazakhstan filed a lawsuit in the Southern District of New York, claiming that unidentified individuals broke into its email system and Gmail accounts in violation of the CFAA. The day after the lawsuit was filed, the judge issued a temporary restraining order enjoining the unnamed “Doe” defendants from “using, disclosing, disseminating, posting, displaying, sharing, distributing, hosting, copying, viewing, accessing, providing access to or making available to anyone, in any manner whatsoever,” the allegedly stolen materials. That order was later converted to a preliminary injunction—again without any opposition—and Kazakhstan then used that order to convince Respublika’s U.S.-based webhost to remove Respublika’s news articles about the materials from the Internet—despite very clear U.S. law that the First Amendment grants individuals a near absolute right to publish truthful information about matters of public interest that they lawfully acquire, even if they know their source obtained the information illegally.
Respublika won its first victory in November, when Judge Edgardo Ramos in New York ruled that the First Amendment “protects the publication of the kazaword documents by anyone other than those directly involved in their purported theft.” Judge Ramos clarified that his preliminary injunction did not apply to Respublika and effectively halted Kazakhstan’s use of the order to censor Respublika.
However, the judge told Kazakhstan that it could come back to court and seek a preliminary injunction against Respublika if it had evidence that Respublika was somehow involved in the alleged “hacking.”
Seizing on Judge Ramos’s suggestion that they needed additional evidence to justify applying the preliminary injunction against Respublika, and on an order by a New York magistrate judge permitting Kazakhstan to depose Respublika on certain limited areas of questioning, Kazakhstan issued a modified version of an earlier subpoena to Facebook.
In separate litigation arising out of the same incidents, Respublika also recently fought back a similar subpoena from Kazakhstan to its domain name registrar in Washington state court.
We are happy Judge Newman took to heart the First Amendment objections raised in our briefs, and we applaud Facebook and its attorneys at Perkins Coie for fighting Kazakhstan’s improper subpoena.
