Category Archives: Anonymity

Anonymous accused Bittorrent user moves to quash subpoena using real name

Worldwide Film Entertainment, LLC v. Does 1-749, 2010 WL 2011306 (D.D.C. May 20, 2009)

Some have already commented on their scruples arising from the large economies of scale approach to copyright litigation that’s being undertaken by lawyers with the U.S. Copyright Group to go after Bittorrent movie sharers. See, for example, what Mike Masnick and Eriq Gardner have had to say. And the ISPs aren’t all that happy about the work required to respond to a bunch of subpoenas.

So no one should be surprised if some interesting little internet law vignettes play out along the way. One of those vignettes is wrapping up in federal court in Washington D.C. It has to do with anonymity.

Worldwide Film Entertainment has sued over 700 anonymous Bittorrent users over the 2007 film The Gray Man. As with any case of this sort (like the numerous RIAA lawsuits), the plaintiff doesn’t know the identity of the various defendants when the lawsuit starts. All it has is an IP address for each alleged infringement, so it has to go to the ISP to link that IP address with an individual’s name and physical address. Then the plaintiff will know who to list as a defendant.

But most ISPs won’t turn over subscriber information without a subpoena. So Worldwide Film Entertainment had a subpoena issue to Comcast, the ISP for the IP address associated with one of the alleged infringements. Under the Cable Communications Policy Act of 1984 (at 47 USC 551), providers like Comcast have to notify their subscriber before turning over the subscriber’s information.

Comcast notified its subscriber in this case, one Mr. Simko, of Worldwide Film Entertainment’s efforts to learn Mr. Simko’s identity.

And here’s the part that makes this little vignette so charming: rather than challenge the plaintiff’s efforts to unmask his identity, Mr. Simko filed a motion to quash the subpoena USING HIS REAL NAME.

The court denied the motion to quash. The basis for denying the motion is kind of an aside (the motion to quash phase was not the right time to challenge venue or knowledge of the infringement).

What’s noteworthy about the case is Mr. Simko’s decision to voluntarily waive his anonymity. Not only did he challenge the subpoena using his own name, he filed as an exhibit the letter he got from Comcast notifying him of the subpoena. Right there, in all caps and as plain as day were Simko’s name and address for all to see.

Photo courtesy Flickr user pourmecoffee.

Troubling decision in matter involving anonymous bloggers

20/20 Financial Consulting, Inc. v. Does 1-5, 2010 WL 1904530 (D.Colo. May 11, 2010) [Opinion embedded below.]

A financial consulting company has filed a lawsuit in federal court in Colorado alleging that certain anonymous web users have posted defamatory statements about the plaintiff on blogs and in message forums. The plaintiff asked the court for an order permitting it to serve subpoenas (apparently to the host and/or the ISP) to uncover the identity of the anonymous bloggers.

With essentially no analysis of the rights of the “John Doe” defendants, the court ordered that the discovery be permitted. This ruling is troubling for a couple of reasons.

There’s an important potential First Amendment issue here over which the court appears to have run roughshod. Each one of us has the constitutional right to speak anonymously. And courts need to be careful not to breach that right when asked to order that anonymous speakers be identified. Responsible courts give this constitutional interest the appropriate treatment by requiring that a certain showing by the plaintiff be made before the unmasking is permitted. See this page for a whole host of court opinions addressing that balancing test.

If the court went through that analysis in this case, it sure does not show up in the opinion.

One big troubling aspect is that the court compared the present situation to one in an earlier copyright infringement case brought by the RIAA. That comparison is not quite valid. In copyright cases, unlike defamation cases, the nature of what the plaintiff pleads is necessarily different — you have to plead a valid copyright registration as half of your prima facie case of copyright infringement. That means you already have the Copyright Office’s stamp of approval, so to speak, that the rights you are asserting are valid. In defamation cases there’s nothing equivalent to a copyright registration certificate. The plaintiff just says the offending statements are defamatory, and that has to be proven later. Simply stated, a claim for copyright infringement, properly pled, will be stronger, and will tend to suggest more clearly, that something actionable has occurred, than will mere assertions of defamation.

Apart from cursorily comparing this case to an unmasking in a copyright infringement case, the court does not mention the potential First Amendment concern of the anonymous defendants, nor does it mention the strength of the plaintiff’s allegations of defamation. The court simply says, “[b]ecause it appears likely that Plaintiff will continue to be thwarted in its attempts to identify Defendants without the benefit of formal discovery mechanisms, the court finds that Plaintiff should be permitted to conduct expedited discovery.” Such a reasoning would suggest anyone sued as a John Doe for defamation should be unmasked pretty much as a matter of course. That’s dangerous.

Anonymous photo courtesy Flickr user Neil Carey under this Creative Commons license.

cod-03902818228

Anonymous sender of beer pong email gets to remain unknown

A.Z. v. Doe, 2010 WL 816647 (N.J. Super. App. Div. March 8, 2010)

What's not to love about beer pong?

Even if you do just a cursory review of cases that deal with online anonymity, you are bound to come across a 2001 New Jersey case called Dendrite v. Doe. That case sets out a four part analysis a court should undertake when a defamation plaintiff seeks an order to unmask an Internet user who posted the offending content anonymously.

Under Dendrite, a court that is asked by a defamation plaintiff to unmask an anonymous speaker must:

  • require the plaintiff to try to notify the unknown Doe speaker that he or she is the subject the unmasking efforts, and give him or her a reasonable opportunity to oppose the application;
  • require the plaintiff to identify and set forth the exact statements purportedly made by each anonymous poster that plaintiff alleges constitutes actionable speech;
  • require the plaintiff to produce sufficient evidence supporting each element of its cause of action, on a prima facie basis; and
  • balance the defendant’s First Amendment right of anonymous free speech against the strength of the prima facie case presented and the necessity for the disclosure.

The state appellate court in New Jersey recently had occasion to revisit the Dendrite analysis in a case called A.Z. v. Doe. It found that a defamation plaintiff was not entitled to learn the identity of a person who anonymously sent an email that had content and attached photos that allegedly defamed plaintiff. The court found that plaintiff failed to meet the third factor in the Dendrite analysis, i.e., failed to present a prima facie case of defamation.

Beer pong is not for honor students

Someone took pictures of plaintiff playing beer pong at a party and posted them on Facebook. That’s all in good fun, except that plaintiff was a minor and belonged to her high school’s “Cool Kids & Heroes” program. Kids get into that program by making good grades and promising to refrain from bad behavior.

A purported “concerned parent” set up a Gmail account (anonymously) and sent an email to the faculty advisor for the Cool Kids & Heroes program. The email had photos attached showing several of the program’s kids doing things they shouldn’t be doing like drinking and smoking pot. In all fairness it should be noted that the picture of plaintiff only showed her playing beer pong — it didn’t actually show her drinking or smoking, though there were cups and beer cans on the table in front of her.

The faculty advisor forwarded the email and images on to school administrators, and the school also notified the police. But law enforcement apparently took no further action.

Plaintiff filed a defamation lawsuit against the anonymous sender of the email and sent a subpoena to Google to find out the IP address from which the message was sent. Google notified plaintiff that it came from an Optimum Online IP address. So plaintiff sent a subpoena to Optimum Online for the identifying information. The ISP notified its customer Doe, and Doe moved to quash the subpoena.

The trial court granted the motion to quash, concluding that plaintiff failed to meet the fourth Dendrite factor (dealing with the First Amendment). Plaintiff sought review with the appellate court, which affirmed but on different grounds.

Why the defamation claim failed

The appellate court agreed that the motion to quash should be granted (that is, that the anonymous sender of the email message should not be identified). But the appellate court’s reasoning differed. It didn’t even need to get to the fourth Dendrite factor, because it held that plaintiff didn’t meet the third factor (didn’t present a prima facie defamation case).

The big problem with plaintiff’s defamation claim came from the requirement that the statement alleged to be defamatory (in this case, that plaintiff had broken the law) needed to be “false.” The court found five reasons why this element had not been met:

  • Plaintiff submitted no evidence (like an affidavit) that she wasn’t drinking the night the photo was taken.
  • Plaintiff submitted no evidence that law enforcement actually concluded to take no further action. Plaintiff argued their lack of action showed she didn’t break the law.
  • Even if there was evidence that law enforcement decided to take no action, that would not have been relevant to the truth of the question of whether plaintiff was drinking. That would only go to show that law enforcement decided not to do anything.
  • The photograph attached to the email showing plaintiff playing beer pong would lead one to conclude that she was in “possession” of the alcohol on the table, and that was a violation of the law.
  • Doe submitted other photos from Facebook in connection with the motion to quash which showed plaintiff actually holding a beer.

So the court never got to the question of the First Amendment and how it related to the anonymous email sender’s right to speak. The court concluded that because plaintiff had not put forth a prima facie case of defamation, the anonymous speaker should stay unknown.

Beer pong photo courtesy Flickr user elisfanclub under this Creative Commons license.

Manganese dendrites in limestone photo courtesy Flickr user Arenamontanus under this Creative Commons license.

Court orders anonymous GQ blogger and accused hacker to be identified

Advance Magazine Publishers v. Does 1-5, No. 09-10257 (S.D.N.Y. Dec. 22, 2009)

Someone accessing the Internet using an AT&T IP address hacked into Conde Nast’s computer system and acquired and published copies of editorial content and the images that were to be in the December 2009 issue of GQ. Those images were later published anonymously on a blog hosted by Google’s Blogger service.

masked cutie

Conde Nast sued in federal court alleging copyright infringement (for the posting of the content) and violation of the Computer Fraud and Abuse Act (for the unauthorized accessing of the Conde Nast servers). Since the identity of the person or persons committing these acts was not known, Conde Nast sued “John Does 1 through 5″. It then filed a motion with the court for permission to serve subpoenas on AT&T and Google to get information with which to give the defendants a name.

The court granted the motion and authorized the subpoenas.

Rule 26(d)
requires that a party demonstrate good cause before expedited discovery will be permitted. In this case, Conde Nast gave four reasons supporting good cause:

  • It had sufficiently pled causes of action under the Copyright Act and the Computer Fraud and Abuse Act
  • AT&T’s server activity logs and Google’s registration data were at risk of being overwritten or purged
  • The scope of the information requested was appropriate — the only items being requested were those sufficient to name the defendants
  • Without the identifying information, the case would be at a standstill and Conde Nast might be left without a remedy

For these reasons the court ordered the anonymous participants to be unmasked.

Masked woman photo courtesy Flickr user Alaskan Dude under this Creative Commons license.

My Public Radio debut

Had a great time talking about anonymity and the First Amendment with Sheilah Kast of Baltimore’s 88.1 FM WYPR on today’s Maryland Morning. I talked about the court’s analysis in the recent case of Independent Newspapers, Inc. v. Brodie (which I wrote about here).

Listen to the interview here:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Maryland Court of Appeals addresses important question of internet anonymity

Independent Newspapers, Inc. v. Brodie, — A.2d —, 2009 WL 484956 (Md. February 27, 2009)

Maryland’s highest state court has issued a comprehensive opinion setting out the proper framework trial courts should use when evaluating whether a plaintiff should be permitted to learn the identity of an anonymous (or pseudonymous) internet speaker. After considering the varying standards courts across the country have applied in balancing the First Amendment right to anonymity against the right of a plaintiff to seek redress, the court adopted, in large part, the standard put forth in the New Jersey case of Dendrite, Int’l. v. Doe, 775 A.2d 756 (N.J. Super. Ct. App. Div. 2001) which requires, among other things, a prima facie showing by the plaintiff before compulsory discovery concerning the identity of an unknown defendant will be had.

One of the great things about the internet is that users can easily speak anonymously or through a pseudonym. This right to remain unidentified is a free speech right guaranteed by the First Amendment. But that right has limits which start to show when an anonymous speaker goes too far by venturing from the realm of protected speech into that of unprotected defamation.

An aggrieved party going after an unknown defamer must first figure out who the defendant is. This usually involves a subpoena to the operator of the service through which the offending content was transmitted, to the unknown John Doe’s internet service provider, or both. This use of compulsory judicial process to reveal the identity of an unknown speaker pits the speaker’s First Amendment right to anonymity against the defamation plaintiff’s right to seek redress for the tort that has been committed.

It is up to the courts to weigh the competing interests so that:

  • a defendant’s First Amendment right to anonymity is not violated by wrongful compelled disclosure in connection with an unmeritorious case; while
  • aggrieved subjects of harmful defamatory speech are not deprived of the remedies due to them in a civil society.

This weighing of competing interests illustrates why the scale is a good metaphor for justice.

The Brodie case

Plaintiff Brodie learned that certain participants in an online forum board were saying negative things about him. Three users identified as “CorsicaRiver,” “Born & Raised Here” and “chatdusoleil” engaged in an online public conversation about Brodie’s sale of an historic farmhouse. Two other users, who went by the monikers “RockyRaccoonMD” and “Suze” criticized the way Brodie ran the local Dunkin Donuts shop.

Brodie sued Independent Newspapers (the operator of the forum) and John Does CorsicaRiver, Born & Raised Here and chatdusoleil for defamation. Absent from the list of defendants were RockyRaccoonMD and Suze.

Independent Newspapers moved to dismiss, arguing, among other things, that it was immune from suit under 47 U.S.C. §230. It also moved to quash the subpoena Brodie had served, which sought the identities of CorsicaRiver, Born & Raised Here and chatdusoleil. The court dismissed Independent Newspapers from the case, but ordered it to identify those three pseudonymous posters.

Immediately thereafter, Independent Newspapers asked the court to reconsider its order directing that the pseudonymous speakers be identified. The court granted that motion and dismissed the portion of the case dealing with the discussion of the historic farmhouse. The claims relating to the Dunkin Donuts stayed in, and the court required Independent Newspapers to disclose information concerning that.

Notwithstanding the fact that the farmhouse defamation claims had been tossed, Brodie sent a subpoena to Independent Newspapers seeking the identity of CorsicaRiver, Born & Raised Here, chatdusoleil, RockyRaccoonMD and Suze. Brodie also conceded that the only posters responsible for discussions about the Dunkin Donuts were RockyRaccoonMD and Suze. Independent Newspapers filed another motion to quash this subpoena which the court denied.

The Maryland Court of Appeals granted certiorari to hear the case. (Here’s some trivia for you: in Maryland, the Court of Appeals is the highest court. For some reason they don’t call it the Supreme Court.) On review, the court reversed the denial of the motion to quash. It held that Brodie did not have a sufficient claim of defamation against any of the pseudonymous speakers to justify revealing their actual identities.

Which standard applied

The court gave thorough and comprehensive analysis on the question of when it is appropriate for a trial court to order that an unknown defendant be unmasked. It recognized the important interests that must be balanced, and observed that courts have applied various standards regarding what a plaintiff must show before discovery of an unknown speaker will be permitted.

For example, the Delaware Supreme Court in Doe v. Cahill put forth a rigorous requirement that in addition to providing notice of the discovery being sought, a plaintiff must come forward — at the pleading stage — with facts sufficient to survive a motion for summary judgment. Other courts, such as the U.S. District Court for the Northern District of California, have set the threshold lower. In Columbia Insurance Co. v. Seescandy.com, 185 F.R.D. 573 (N.D. Cal. 1999), the plaintiff was only required to plead facts sufficient to survive a motion to dismiss.

The New Jersey appellate court in Dendrite, Int’l. v. Doe took a more moderate approach. That court held that a plaintiff seeking the identification of an anonymous internet speaker must establish facts sufficient to maintain a prima facie case.

The Maryland court in the present case joined in the more moderate Dendrite approach, holding that when a trial court is confronted with a defamation action in which anonymous speakers or pseudonyms are involved, it should:

  • require the plaintiff to undertake efforts to notify the anonymous posters that they are the subject of a subpoena or application for an order of disclosure, including posting a message of notification of the identity discovery request on the message board;
  • withhold action to afford the anonymous posters a reasonable opportunity to file and serve opposition to the application;
  • require the plaintiff to identify and set forth the exact statements purportedly made by each anonymous poster, alleged to constitute actionable speech;
  • determine whether the complaint has set forth a prima facie defamation per se or per quod action against the anonymous posters; and
  • if all else is satisfied, balance the anonymous poster’s First Amendment right of free speech against the strength of the prima facie case of defamation presented by the plaintiff and the necessity for disclosure of the anonymous defendant’s identity, prior to ordering disclosure.

The Independent Newspapers case is an important case not necessarily because of any groundbreaking jurisprudence that it establishes, but because of the comprehensive way it treats the issue of unmasking unknown internet speakers. The opinion is a nearly exhaustive look at the current state of this question of law.

Anonymous photo courtesy Flickr user Neil Carey under this Creative Commons license.

Site operator successfully challenges subpoena which sought to unmask anonymous commenters

Enterline v. Pocono Medical Center, 2008 WL 5192386 (M.D. Pa. December 11, 2008)

A federal court in Pennsylvania has denied a motion demanding that a website operator turn over the identity of persons who commented anonymously in response to an article posted on the website. The court held that the website had standing to assert the free speech rights of the anonymous speakers, and that the First Amendment barred the unmasking where the information sought was available from other sources.

Plaintiff Enterline sued defendant Pocono Medical Center for sexual harassment and retaliation. On October 9, 2008, the local newspaper, The Pocono Record, published an article about the lawsuit. Several people left comments to the article, some of them claiming personal knowledge of facts possibly relevant to the case.

The Lovely Pocono Mountains

The Lovely Pocono Mountains

Enterline sent a subpoena to the newspaper seeking the identity of the anonymous commenters. When the newspaper wouldn’t respond, Enterline filed a motion to compel response to the subpoena. The newspaper responded by asserting a number of arguments. Among those arguments was that disclosure of the anonymous commenters’ identities would violate those persons’ First Amendment right to speak anonymously.

Siding with the newspaper, the court denied the motion.

The court first evaluated whether the newspaper website operator even had standing (i.e., the legal right) to assert the anonymous commenters’ First Amendment right. To answer this question in the affirmative, the court found that:

  • Practical obstacles prevented the anonymous commenters from asserting rights on their own behalf. The anonymity was the very right at stake. To defend that right, the commenters would have to be identified (setting aside for a moment the question of whether the commenters could appear as Doe defendants). The evaporation of that anonymity would lead to practical difficulties, as they had indicated they worked at the hospital or otherwise had personal connections with the litigants.
  • The anonymous commenters had sufficient injury-in-fact to satisfy the constitutional “case or controversy” requirement. Looking to such cases as RIAA v. Verizon, 257 F.Supp.2d 244 (D.D.C. 2003), the court agreed with the website operator, concluding that the relationship between the website and its readers was the type of relationship allowing it to assert the First Amendment rights of the anonymous commentators.
  • The website operator could reasonably be expected to properly frame the issues and present them with the necessary adversarial zeal. There was little discussion on this point, as the plaintiff did not contest that the website operator would be an adequate advocate to assert the First Amendment rights of the anonymous visitors.

Finding that the website operator had standing to assert the rights of its anonymous commenters, the court next considered whether the identification of the anonymous speakers would violate the First Amendment. To evaluate this question, the court applied the factors set out in Doe v. 2TheMart.com, 140 F.Supp.2d 1088 (W.D. Wash. 2001).

The court found that:

  • The subpoena was not brought in bad faith or for an improper purpose,
  • The information sought related to a core claim of the plaintiff,
  • The information was directly and materially relevant to the claim,
  • but that

  • Information required to prove the plaintiff’s claims was available from other sources. Several of the anonymous commenters stated that they were, for example, co-workers of the plaintiff or of the doctor against whom the plaintiff complained. The information these anonymous posters had could be uncovered through other discovery

This case is significant inasmuch as it could be applied to a case where a blogger or any other social media website operator is asked to turn over information that would identify its anonymous users. The decision outlines the framework that a blogger would have to use to show it has the right to argue on behalf of its anonymous visitors. The case then lays out (with the help of the 2TheMart.com decision) what must be shown after that initial threshold is crossed.

Photo of the Poconos courtesy Flickr user Nicholas T under this Creative Commons license.

Expedited electronic discovery includes subpoena to ISP and imaging of defendants’ hard drives

Allcare Dental Management, LLC v. Zrinyi, No. 08-407, 2008 WL 4649131 (D. Idaho October 20, 2008)

Plaintiffs filed a defamation lawsuit against some known defendants as well as some anonymous John Doe defendants in federal court over statements posted to Complaintsboard.com. The plaintiffs did not know the names or contact information of the Doe defendants, so they needed to get that information from the Does’ Internet service provider.  But the ISP would not turn that information over without a subpoena because of the restrictions of the Cable Communications Policy Act, 47 U.S.C. § 501 et seq. [More on the CCPA.]

Under Federal Rule of Civil Procedure 26(d)(1), a party generally may not seek discovery in a case until the parties have had a Rule 26(f) conference to discuss such things as discovery. Because of the Rule 26(d)(1) requirement, the plaintiffs found themselves in a catch-22 of sorts: how could they know with whom to have the Rule 26(f) conference if they did not know the defendants’ identity.

So the plaintiffs’ filed a motion with the court to allow a subpoena to issue to the ISP prior to the Rule 26(f) conference. Finding that there was good cause for the expedited discovery, the court granted the motion. It found that the subpoena was needed to ascertain the identities of the unknown defendants. [More on Doe subpoenas.] Furthermore, it was important to act sooner than later, because ISPs retain data for only a limited time.

The Plaintiffs also contended that that the known defendants would likely delete relevant information from their computer hard drives before the parties could engage in the ordinary process of discovery. So the plaintiffs’ motion also sought an order requiring the known defendants to turn over their computers to have their hard drives copied.

The court granted this part of the motion as well, ordering the known defendants to turn their computers over to the plaintiffs’ retained forensics professional immediately. The forensics professional was to make the copies of the hard drives and place those copies with the court clerk, not to be accessed or reviewed until stipulation of the parties or further order from the court.

Subpoena to university in P2P case must give time to notify parents

UMG Recordings, Inc. v. Doe, No. 08-3999, 2008 WL 4104207 (N.D.Cal. September 4, 2008)

Plaintiff record companies, using Media Sentry, found the IP address of a John Doe file-sharing defendant, and filed suit against Doe in federal court for copyright infringement. As in any case where a defendant is known only by his or her IP address, the record companies needed some discovery to ascertain the name and physical address matching that IP address. But the federal rules of procedure say that without a court order, a party cannot seek discovery until the parties have conferred pursuant to Fed. R. Civ. P. 26(f).

So the record companies sought the court order allowing them to issue a subpoena to Doe’s Internet service provider prior to the 26(f) conference. The court granted the order, but with a caveat.

The evidence showed that Doe was a student at the University of California, Santa Cruz. Under the Family Educational Rights and Privacy Act at 20 U.S.C. § 1232g, a college generally cannot disclose “any personally identifiable information in education records other than directory information.” There’s an exception to that rule when the college is answering a lawfully issued subpoena, provided that “parents and the students are notified of all such … subpoenas in advance of the compliance therewith by the educational institution or agency.”

The court granted the record companies’ motion for leave to serve the subpoena prior to the Rule 26(f) conference, but required that the subpoena’s return date “be reasonably calculated to permit the University to notify John Doe and John Doe’s parents if it chooses prior to responding to the subpoena.”

Anonymous defendants to be unmasked in Computer Fraud and Abuse Act case

Kimberlite Corp. v. Does 1-20, No. 08-2147, 2008 WL 2264485 (N.D. Cal. June 2, 2008)

Plaintiff Kimberlite sued a number of anonymous John Doe defendants after it learned that its network and email system had been unlawfully accessed. A few days after filing suit for violation of the Computer Fraud and Abuse Act (CFAA) and trespass to chattels under state law, Kimberlite served a subpoena on AT&T, the owner of the IP address from which the unauthorized access originated, seeking to discover who was responsible.

One of the John Doe defendants, pro se, wrote a letter to the court which the court treated as a motion to quash the subpoena. The court denied the motion.

Doe argued that Kimberlite had failed to state a claim under the CFAA. The court rejected that argument, observing that Kimberlite had adequately alleged and had provided preliminary evidence of a CFAA violation. (Doe had not challenged the sufficiency of the trespass to chattels claim.) Kimberlite’s computers were “protected” computers under the CFAA because they were used in interstate and foreign commerce. They were password protected and accessed without authorization by someone from the subject IP address. Kimberlite succeeded in alleging the threshold amount of CFAA damages ($5,000) through an employee declaration describing over 100 hours of investigation and repair following the intrusions.

Doe also argued that Kimberlite had not demonstrated a need to obtain the information that outweighed Doe’s privacy rights under the Cable Communication Policy Act (CCPA). That act prohibits cable operators from disclosing subscriber information unless certain criteria are met.

The court rejected the CCPA argument first by expressing serious doubt that AT&T, as an Internet service provider was a “cable operator” and thus subject to the CCPA. Even if the CCPA did apply, the court found Kimberlite had demonstrated a compelling need for the information sought. It had adequately set forth a cause of action, so discovery of the anonymous parties was proper.