Update: On May 19, 2021, an Indiana appellate court dismissed Alfa Bank's appeal of the trial court order denying its effort to unmask the anonymous researchers on grounds that it lacked jurisdiction to hear the appeal. EFF filed an amicus brief with the appellate court in support of the researchers.
Security researchers who reported observing Internet communications between the Russian financial firm Alfa Bank and the Trump Organization in 2016 can remain anonymous, an Indiana trial court ruled last week.
The ruling protects the First Amendment anonymous speech rights of the researchers, whose analysis prompted significant media attention and debate in 2016 about the meaning of digital records that reportedly showed computer servers linked to the Moscow-based bank and the Trump Organization in communication.
In response to these reports, Alfa Bank filed a lawsuit in Florida state court alleging that unidentified individuals illegally fabricated the connections between the servers. Importantly, Alfa Bank’s lawsuit asserts that the alleged bad actors who fabricated the servers’ communications are different people than the anonymous security researchers who discovered the servers’ communications and reported their observations to journalists and academics.
Yet that distinction did not stop Alfa Bank from seeking the security researchers’ identities through a subpoena issued to Indiana University Professor L. Jean Camp, who had contacts with at least one of the security researchers and helped make their findings public.
Prof. Camp filed a motion to quash the subpoena. EFF filed a friend-of-the-court brief in support of the motion to ensure the court understood that the security researchers had the right to speak anonymously under both the First Amendment and Indiana’s state constitution.
The brief argues:
By sharing their observations anonymously, the researchers were able to contribute to the electorate’s understanding of a matter of extraordinary public concern, while protecting their reputations, families, and livelihoods from potential retaliation. That is exactly the freedom that the First Amendment seeks to safeguard by protecting the right to anonymous speech.
It’s not unusual for companies embarrassed by security researchers’ findings to attempt to retaliate against them, which is what Alfa Bank tried to do. That’s why EFF’s brief also asked the court to recognize that Alfa Bank’s subpoena was a pretext:
[T]he true motive of the litigation and the instant subpoena is to retaliate against the anonymous computer security researchers for speaking out. In seeking to impose consequences on these speakers, Alfa Bank is violating their First Amendment rights to speak anonymously.
In rejecting Alfa Bank’s subpoena, the Indiana court ruled that the information Alfa Bank sought to identify the security researchers “is protected speech under Indiana law” and that the bank had failed to meet the high bar required to justify the disclosure of the individuals’ identities.
EFF is grateful that the court protected the identities of the anonymous researchers and rejected Alfa Bank’s subpoena. We would also like to thank our co-counsel Colleen M. Newbill, Joseph A. Tomain, and D. Michael Allen of Mallor Grodner LLP for their help on the brief.
