Opinion
Civ. 23-682-CFC Bankr. 22-11068 (JTD)
12-03-2024
IN RE FTX TRADING LTD., et al.. Debtors. v. FTX TRADING LTD., et al., Appellees. BLOOMBERG L.P., DOW JONES & COMPANY, INC., THE NEW YORK TIMES COMPANY, AND THE FINANCIAL TIMES LTD, Appellants,
William B. Larson, John J. Klusman III, MANNING GROSS + MASSENBURG LLP, Wilmington, Delaware; Katie Townsend, Adam A. Marshall, REPORTERS COMMITTEE FOR FREEDOM OF THE PRESS, Washington, DC Counsel for Appellants Adam G. Landis, Kimerly A. Brown, Matthew R. Pierce, LANDIS RATH & COBB LLP, Wilmington, Delaware; Andrew G. Dietderich, James L. Bromley, Brian D. Glueckstein, Alexa J. Kranzley, SULLIVAN & CROMWELL LLP, Matthew B. Lunn, Robert F. Poppiti Jr., YOUNG CONAWAY STARGATT & TAYLOR, LLP, Wilmington, Delaware; Kristopher M. Hansen, Kenneth Pasquale, Isaac S. Sasson, John F. laffaldano, Paul Hastings LLP, Counsel for Appellees
Chapter 11
William B. Larson, John J. Klusman III, MANNING GROSS + MASSENBURG LLP, Wilmington, Delaware; Katie Townsend, Adam A. Marshall, REPORTERS COMMITTEE FOR FREEDOM OF THE PRESS, Washington, DC Counsel for Appellants
Adam G. Landis, Kimerly A. Brown, Matthew R. Pierce, LANDIS RATH & COBB LLP, Wilmington, Delaware; Andrew G. Dietderich, James L. Bromley, Brian D. Glueckstein, Alexa J. Kranzley, SULLIVAN & CROMWELL LLP, Matthew B. Lunn, Robert F. Poppiti Jr., YOUNG CONAWAY STARGATT & TAYLOR, LLP, Wilmington, Delaware; Kristopher M. Hansen, Kenneth Pasquale, Isaac S. Sasson, John F. laffaldano, Paul Hastings LLP, Counsel for Appellees
OPINION
COLM F. CONNOLLY, CHIEF JUDGE
This appeal arises from the chapter 11 cases of debtors FTX Trading Ltd., et al. (together, “Debtors”). Appellants Bloomberg L.P., Dow Jones & Company, Inc., The New York Times Company, and The Financial Times Ltd. (together, “Appellants”) were granted leave to intervene in these chapter 11 cases for the limited purpose of objecting to the redaction of the names of Debtors' creditors who were also customers of their cryptocurrency exchange in Bankruptcy Court filings, which relief was sought by a motion jointly filed by the Debtors and the Official Committee of Unsecured Creditors (together, “Appellees”). A0111. On June 15, 2023, the Bankruptcy Court entered an order authorizing (a) redaction of the names, addresses and e-mail addresses of the Debtors' creditor-customers for a period of 90 days pursuant to 11 U.S.C § 107(b)(1); and (b) permanent redaction of the names of Debtors' customers who are natural persons from all such filings pursuant to 11 U.S.C. § 107(c)(1) (A0700-A0704) (“First Extension Order”). For the reasons set forth herein, the Court affirms the First Extension Order.
“A__” refers to both the appendix (D.I. 18) filed in support of Appellants' opening brief (AO0O0-A07O7), and the appendix (D.I. 20) filed in support of Appellees' answering brief (A0708-A0791).
I. BACKGROUND
A. The Chapter 11 Cases
On November 11 and November 14, 2022, the Debtors filed voluntary petitions for relief under chapter 11 of the Bankruptcy Code. Debtors continue to operate their businesses and manage their properties as debtors-in-possession pursuant to §§ 1107(a) and 1108 of the Bankruptcy Code. On December 15, 2022, the Office of the United States Trustee appointed the Official Committee of Unsecured Creditors (“Committee”) pursuant to § 1102 of the Bankruptcy Code.
B. The Original Motion
On November 19, 2022, Debtors filed a motion (A0031-A0043) (“Original Motion”) seeking authority to redact (a) the names and all associated identifying information of Debtors' customers pursuant to § 107(b)(1) of the Bankruptcy Code, and (b) the addresses and email addresses of individual creditors or equity holders of Debtors pursuant to § 107(c). On November 23, 2022, the Bankruptcy Court granted the Original Motion on an interim basis. A0720-A0724.
Appellants objected to relief being granted on a final basis. A0049-A0059. On January 8, 2023, Debtors filed a reply along with the declaration of Kevin Cofsky of Perella Weinberg Partners L.P. (“PWP”), Debtors' investment banker. A0112-A0138.
On January 11, 2023, the Bankruptcy Court held an evidentiary hearing (A0139-A0162) on the Original Motion and authorized Debtors to redact customer names pursuant to § 107(b) of the Bankruptcy Code for an initial period of 90 days, subject to extension (such date, the “Original Redaction Deadline”). A0159:18-A0161:25. On January 20, 2023, the Bankruptcy Court entered an order granting that relief (A0163-A0168) (the “Original Order”). Pursuant to the Original Order, the Original Redaction Deadline expired on April 20, 2023. A0165.
C. The First Extension Motion
On April 20, 2023, Appellees filed a joint motion (A0217-A0240) (“First Extension Motion”) which sought authority to (i) continue redacting the names, addresses, and email addresses of Debtors' customers for an additional 90 days pursuant to § 107(b)(1) and (ii) permanently redact the names, addresses, and email addresses of Debtors' customers who are natural persons on a permanent basis pursuant to § 107(c). In support of the First Extension Motion, Appellees filed the declaration of Jeremy Sheridan, Managing Director in the Blockchain and Digital Assets practice for FTI Consulting, Inc., as financial advisor to the Committee. A0241-A0476. On May 3, 2023, Appellants objected to the First Extension Motion. A0477-A0489. On June 5, 2023, Appellees filed their reply. A0725-A0738.
On June 8 and June 9, 2023, the Bankruptcy Court held a hearing on the First Extension Motion. A0501-A0699. Mr. Cofsky testified in support of the First Extension Motion (A0507:5-A0538:7) and stated that, in his experience, including “represent[ing] a number of companies and businesses with respect to [11 U.S.C. §] 363 sales and plan of reorganization sales, a number of which involved customers,” it was his opinion that “the customers have, in this case, material value to the estate.” A508:13-19. He further testified that “the ability of other competitors to gain knowledge of those customers would be detrimental to the estate.” A508:20-22. He also testified that “releasing that information [i.e., the customer lists] would impair the debtors' ability to maximize the value that it currently possesses.” A0511:25-A0512:7. Mr. Cofsky explained that PWP had:
already engaged in a significant outreach process, with respect to solicitation of third-party interests in participating in a process to either acquire, invest into, or reorganize the FTX exchange. And based on those conversations ... existing customers are extremely valuable and valued by folks who would be interested in investing into a reorganized business.A509:20-A510:2. Mr. Cofsky further explained how he and his team looked at Debtors' top 200 customers, representing a sampling of approximately $2.4 billion of claims, to determine whether they could be identified by name alone. A515:2-A517:25. Of the 200 customers, Mr. Cofsky's team was able to identify the exact individual for approximately 46 percent of the names utilizing only basic search tools. A517:12-17. Of that 46 percent, Mr. Cofsky's team thought it was “highly likely” that it had identified 34 percent, and “likely” that it had identified 12 percent. A517:17-20. The amount identified represented over one billion dollars of claims against Debtors. A517:21 -25.
The Bankruptcy Court also heard testimony from Mr. Sheridan (A550:8-A622:2), who holds an expert certification from the Blockchain Council, a certificate from Carnegie Mellon University for Chief Information Security Officer, two certificates from the Global Information Assurance Corporation in information security governance and leadership and is a certified information security manager through the Information Systems Audit and Control Association. A0550:22-A0551:8. Mr. Sheridan worked at the Secret Service for 24 years, where he spent 14 years investigating financial crimes, and has testified as an expert witness three times in front of Congress. A0553:3-7; A0552:50-19. He testified that having an individual's name-not their home address or email address-would be enough information for a bad actor to identify them and perpetuate a cybercrime. A0559:4-8. He testified that between a cryptocurrency bankruptcy case and a regular case, he perceived a “much higher” risk of cyber schemes and attacks on personally identifiable information. A0563:15-22. He testified that FTX users specifically are an easier target for cyber criminals because they were “specifically marketed to as an easier and less technical customer” and “their focus [is] solely on the return on the investment, as opposed to the security of their investment.” A0558:19-22.
Appellants offered no evidence to rebut the testimony from Appellees' witnesses, who were credited by the Bankruptcy Court. Following this testimony, the Bankruptcy Court determined that, with respect to § 107(b) of the Bankruptcy Code, “the evidence presented was uncontroverted that customer identification has value. It has value to the debtors' estates.” A0693:15-18. As a result, the Bankruptcy Court ordered that Appellees could continue to redact those names for 90 additional days. Id. at 20-25. With respect to § 107(c), the Bankruptcy Court stated that “Mr. Sheridan introduced very compelling testimony; again, uncontroverted testimony, about how customers can be identified just by a name.” A694:8-10. The Bankruptcy Court further found that Mr. Sheridan “testified, again, very compellingly, that if they have a name and they are an FTX customer, they can be targeted, and that is what we need to protect here. ... I want to make sure that they are protected and they don't fall victim to any types of scams that might be happening out there.” Id. at 8-21.
Mr. Sheridan also provided testimony regarding a recent hack in the chapter 11 cases of In re Celsius Network LLC, et al., No. 22-10964 (MG) (Bankr. S.D.N.Y.). Mr. Sheridan described how, after the names of individual Celsius customers were disclosed, those names were “placed into an interactive, searchable Excel spreadsheet that was put online through Celsiusnetworth.com,” following which “there were multiple reported incidents of phishing, business email compromise, other types of criminal schemes that targeted the individuals listed in - that spreadsheet.” A0562:7-24. He further testified that, in his expert opinion, there was a “much higher risk related to [the FTX case than the Celsius case] because of the prominence of the case, the notoriety of the case, and also where the industry is at this particular time in the overall market” and that there was “much higher visibility in this case.” A0563:4-A0564:9.
D. The First Extension Order
Accordingly, on June 15, 2023, the Court entered the First Extension Order, which authorized Appellees (1) pursuant to § 107(b)(1), to “redact the names, addresses and e-mail addresses of all of the Debtors' customers from all filings with the Court or made publicly available in these Chapter 11 Cases” in “which disclosure would indicate such person's status as a customer” for an additional 90 days (“Extended Redaction Deadline”); and (2) pursuant to § 107(c)(1), “to permanently redact the names of all customers who are natural persons from all filings with the Bankruptcy Court or made publicly available in these Chapter 11 Cases in which disclosure would indicate such person's status as a customer.” A0701-A0702. The Extended Redaction Deadline was set to expire on September 13, 2023, but has it been further extended by several orders, with each order extending the deadline for an additional 90 days. B.D.I. 3353, 7315, 16164, 16165.
E. The Kroll Hack
On August 25, 2023, Kroll Restructuring Administration (“Kroll”), Debtors' claims agent in the chapter 11 cases, experienced a data breach by a third-party malefactor. A0744-A0747. Through the hack, an unauthorized third party obtained the names, addresses, email addresses and account balances of approximately 78,459 FTX account holders. A744. Following this incident, a number of users reported that they had received phishing emails from a third party using names and email addresses to attempt to gain access to users' FTX accounts.
The Court may take judicial notice of this subsequent development in the chapter 11 cases. See Werner v. Werner, 267 F.3d 288, 295 (3d Cir. 2001) (finding courts of appeal “may take judicial notice of filings or developments in related proceedings which take place after the judgment appealed from”); Orabi n. Attorney Gen. of the United States, 738 F.3d 535, 537 n.l (3d Cir. 2013) (“We may take judicial notice of the contents of another Court's docket.”).
See Shaurya Malwa, FTX Customers Hit by “Withdrawal” Phishing Mails after SIM Swap Attack, COINDESK, Aug. 29, 2023, available at https://www.coindesk. com/business/2023/08/29/ftx-customers-hit-by-withdrawal-phishing-mails-after-sim-swap-attack/ (“[U]sers are getting hit by a new phishing attack on their FTX-registered emails a week after Kroll, the claims agent in the bankruptcy proceedings, was impacted by a SIM swapping attack.”)
On June 22, 2023, Appellants filed a timely notice of appeal. D.I. 1. The appeal is fully briefed. D.I. 17, 19, 21. The Court did not hear oral argument because the facts and legal arguments are adequately presented in the briefs and record, and the Court's decisional process would not be aided by oral argument.
IL JURISDICTION AND STANDARD OF REVIEW
The parties dispute whether the First Extension Order is a final order. Under the collateral order doctrine, orders that are “too important to be denied review and too independent of the cause itself to require that appellate consideration be deferred until the whole case is adjudicated” are appealable as final orders. Cohen v. Beneficial Indus. Loan Corp., 337 U.S. 541, 546 (1949). To qualify, an order “must conclusively determine the disputed question, resolve an important issue completely separate from the merits of the action, and be effectively unreviewable on appeal from a final judgment.” Coopers & Lybrand v. Livesay, 437 U.S. 463, 468 (1978).
Under Third Circuit law, it is well settled that “[o]rders either granting or, as in this case, denying access to court proceedings or records are appealable as final orders” under the collateral order doctrine. United States v. Smith, 123 F.3d 140, 145 (3d Cir. 1997) (orders denying access to court proceedings/records were final orders under 28 U.S.C. § 1292); United States v. Cianfrani, 573 F.2d 835, 845 (3d Cir. 1978) (order closing courtroom and sealing record was final appealable order under collateral order doctrine); United States v. Wecht, 537 F.3d 222, 230 (3d Cir. 2008) (order denying public access to prospective juror names and voir dire subject to immediate appeal under collateral order doctrine).
Here, Appellants seek review of an order conclusively denying them contemporaneous access to the names of Debtors' customer-creditors in all filings made with the Bankruptcy Court. A702. The First Extension Order is independent from the resolution of the claims in the underlying bankruptcy proceedings, and has “a substantial, continuing effect on important rights.” Wecht, 537 F.3d at 231. Because the First Extension Order “den[ies]” Appellants “access to court... records,” it is “appealable as [a] final order[]” under the collateral order doctrine. Smith, 123 F.3d at 145.
Appellees contend that the First Extension Order is not appealable because it authorized the redaction of the names of those customer-creditors that are entities under § 107(b)(1) only for an additional 90 days, and that the Bankruptcy Court will “soon consider an extension of [that] limited 90-day relief[.]” D.I. 19 at 18. That argument misses the mark for several reasons.
First, the First Extension Order authorizes the “permanent redaction” of the names of Debtors' customer-creditors that are natural persons under § 107(c)(1); nothing about that “relief' is time “limited.” Second, Appellees' argument ignores the contemporaneous nature of the public's right of access to judicial records, and Appellants' contemporaneous right to inspect judicial records filed with the Bankruptcy Court. See, e.g., Wecht, 537 F.3d at 229 (noting that “the value of the right of access would be seriously undermined if it could not be contemporaneous.”) Finally, nothing in the Supreme Court's decisions in Bullard v. Blue Hills Bank, 575 U.S. 496 (2015), or Ritzen Group, Inc. v. Jackson Masonry, LLC, 140 S.Ct. 582 (2020), supports Appellees' claim that this Court lacks jurisdiction over this appeal. See D.I. 19 at 15-16. Neither decision interprets the collateral order doctrine or involved a denial of access to records. Appellees' jurisdictional argument fails.
In reviewing a decision of the Bankruptcy Court, this Court reviews its “legal determinations de novo, its factual findings for clear error, and its exercise of discretion for abuse thereof.” In re O'Brien Env't Energy, Inc., 188 F.3d 116, 122 (3d Cir. 1999). The decision to seal or restrict access to judicial records is reviewed for abuse of discretion. See, e.g., In re Orion Pictures Corp., 21 F.3d 24, 26 (2d Cir. 1994) (reliefunder § 107(b)); In re AC & Sine., 775 Fed.Appx. 78, 80 (3d Cir. 2019) (relief under § 107(c)); In re Avandia Mktg, Sales Pracs. & Prods. Liab. Litig, 924 F.3d 662, 674 n.8 (3d Cir. 2019) (relief under common law). A lower court abuses its discretion if it fails to apply the proper legal standard, fails to follow proper procedures in making a decision, or bases a decision upon findings of fact that are clearly erroneous. Zolfo, Cooper & Co. v. Sunbeam-Oster Co., 50 F.3d 253, 257 (3d Cir. 1995). “Clear error exists only if a finding is completely devoid of a credible evidentiary basis or bears no rational relationship to the supporting data.” Interfaith Cmty. Org. v. Honeywell Inti, Inc., 399 F.3d 248, 254 (3d Cir. 2005) (internal quotations omitted).
III. DISCUSSION
A. Presumption of Public Access
Under the common law, there is a presumption of public access to judicial records. See Nixon v. Warner Comm'cns, Inc., 435 U.S. 589, 597 (1978). As the Third Circuit has explained, public access “promotes public confidence in the judicial system by enhancing testimonial trustworthiness and the quality of justice dispensed by the court;” “diminishes possibilities for injustice, incompetence, perjury, and fraud;” “provide[s] the public with a more complete understanding of the judicial system and a better perception of its fairness;” and “helps assure that judges perform their duties in an honest and informed manner.” In re Cendant Corp., 260 F.3d 183, 192 (3d Cir. 2001) (citations omitted). Despite the important interests advanced by public access to judicial records, the right of access is “not absolute.” Nixon, 435 U.S. at 598. “Every court has supervisory power over its own records and files, and access has been denied where court files might have become a vehicle for improper purposes.” Id.
“The common law presumption of access to judicial records is codified in § 107 of the Bankruptcy Code.” In re A C & S, 775 Fed.Appx. at 79 (quoting In re Motions Seeking Access to 2019 Statements, 585 B.R. 733, 746 (D. Del. 2018)). “That provision established a broad right of public access to all papers filed in a bankruptcy case, subject to certain limited exceptions.” Id. Section 107(b) provides in relevant part that, “on request of a party in interest, the Bankruptcy Court shall... protect an entity with respect to” ... “a trade secret or confidential research, development, or commercial information ...” 11 U.S.C § 107(b). In 2005, Congress enacted the Bankruptcy Abuse Prevention and Consumer Protection Act of 2005 (“BAPCPA”), adding subsection (c), which provides, in relevant part:
(c)(1) The bankruptcy court, for cause, may protect an individual, with respect to the following types of information to the extent the court finds that disclosure of such information would create undue risk of identity theft or other unlawful injury to the individual or the individual's property:
(A) Any means of identification (as defined in section 1028(d) of title 18) contained in a paper filed, or to be filed, in a case under this title.
(B) Other information contained in a paper described in subparagraph (A).11 U.S.C. § 107(c)(1). Commentators have observed that BAPCPA amended § 107 to address privacy concerns, and that the addition of subsection (c) “broadened the situations in which the court could protect individuals from disclosure of sensitive information in light of the emerging problem of identity theft and also the possible need to protect individuals from domestic violence or other injury.” 2 COLLIER ON BANKRUPTCY ¶ 107.LH[2] (Alan N. Resnick & Henry J. Sommer eds., 16th ed.).
The Third Circuit has said that § 107, which codified the common law, “evidenced Congress's strong desire to preserve the public's right of access to judicial records in bankruptcy proceedings.” In re A C & S, 775 Fed.Appx. at 79. “Nevertheless,” the Third Circuit has observed, “Congress specifically circumscribed that broad right by codifying the common law principle that the public's right of access to judicial records is not absolute.” Id. “In doing so, Congress specifically authorized courts to protect “any means of identification.” Id. (citing 11 U.S.C. § 107(c)(1)(A)).
B. 90-Day Redaction of the Names of all of Debtors' Customer-Creditors Pursuant to § 107(b)(1)
“The party asserting the right to protection under § 107(b) has the burden of proof to show that one of the listed grounds exists.” In re Purdue Pharma L.P., 632 B.R. 34, 39 (Bankr. S.D.N.Y. 2021). Appellees had the burden to show that the information they sought to protect was “a trade secret or confidential research, development, or commercial information.” 11 U.S.C. § 107(b)(1).
Debtors submitted evidence in support of their argument, in the Original Motion, that their “customer list, and related customer data, is an important and valuable asset of the Debtors and the Debtors maintain their customer list in strict confidence.” A0035-A0036, ¶ 12. At the January 11, 2023 hearing on the Original Motion, Mr. Cofsky of PWP, Debtors' investment banker, testified to his view that there is value in the Debtors' customer lists, and that whether the exchanges are sold or reorganized, value is maximized by ensuring that competitors are not able to solicit customers and prematurely move them to other platforms. A0147:4-A0148:15. He testified further that third parties will place significant value on Debtors' customer lists in a sale process, and that maintaining the identity of the customers without disclosure will give buyers confidence that what they are buying is actually of value. A0152:21-A0153:5. According to Mr. Cofsky, the same reasoning applies to a reorganized debtor entity, which will retain more value if Debtors' customers have not been poached and are not transacting on another exchange. A0153:6-11. In granting the relief on a final basis, the Bankruptcy Court noted that “it goes without saying that a customer list in any bankruptcy case is something that is protected by 107(b) as a trade secret. Companies hold those things very closely and don't want them disclosed.” A0160:1-5.
Mr. Cofsky offered similar testimony in support of the First Extension Motion, repeating his view that the customer list “is extraordinarily valuable” and that “releasing that information would impair the debtors' ability to maximize the value that it currently possesses.” A0509:10-19; A0512:4-6. He testified that PWP was undertaking “an evaluation of the potential to monetize or reorganize the assets of the estate, including the exchange” (A0509:10-13); that Debtors were engaged in a process of “significant outreach ... with respect to solicitation of third-party interests in participating in a process to either acquire, invest into, or reorganize the FTX Exchange (A0509:20-23); and that any disclosure of customer lists would have a negative impact on that process (A0514:5-9). In light of the uncontroverted evidence, the Bankruptcy Court authorized the continued redaction of customer-creditors' names for another 90 days.
According to Appellants, the Bankruptcy Court (1) erred in concluding that the customer-creditor names are a trade secret without making any finding that Debtors took reasonable measures to keep that information secret (D.I. 17 at 27-31), and (2) further erred in determining that the customer-creditor names have value, as Appellees did not prove that customer-creditors would remain Debtor customers in the event of a reorganization, did not prove that their customer list could be sold, and did offer evidence of the list's value (id. at 31-40).
Whether Debtors' customers lists are confidential commercial information within the meaning § 107(b)(1) “presents a factual question reviewed for clear error.” In re Neal, 461 F.3d 1048, 1052 (8th Cir. 2006) (discussing § 107(b)(2)). Even where Appellants' arguments are “phrased as legal issues, [they] are really challenges to the Bankruptcy Court's factual findings and to that court's discretionary power.” In re Orion Pictures Corp., 1993 WL 330065, at *1 (S.D.N.Y. Aug. 25, 1993), aff'd 21 F.3d 24 (2d Cir. 1994) (discussing § 107(b)(1)).
To meet the requirements of § 107(b)(1), the moving party must only show “that the information it sought to seal [is] ‘confidential' and ‘commercial' in nature.” In re Orion Pictures, 21 F.3d at 27. The information need not rise to the level of trade secret to be protected. Id. at 28 (noting “§ 107(b) is carefully drafted to avoid merging “trade secrets” with “confidential commercial information”).“Commercial information [under § 107(b)(1)] has been defined as information which would cause an unfair advantage to competitors by providing them information as to the commercial operations of the debtor.” Id. (quoting Ad Hoc Protective Comm. For 10 ½% Debenture Holders v. Itel Corp., 17 B.R. 942, 944 (9th Cir. 1982)). It also includes “situations where a bankruptcy court may reasonably determine that allowing such disclosure would have a ‘chilling effect on [business] negotiations, ultimately affecting the viability of Debtors,”' In re Borders Grp., Inc., 462 B.R. 42, 47 (Bankr. S.D.N.Y. 2011) (alteration in original), or could “reasonably be expected to cause the entity commercial injury,” In re Alterra Healthcare Corporation, 353 B.R. 66, 75 (Bankr. D. Del. 2006) (quotations omitted). The record, including Mr. Cofsky's testimony, supports such findings.
Similarly, Bankruptcy Rule 9018, the procedural rule related to § 107, provides in relevant part that the “court may make any order which justice requires ... to protect the estate or any entity in respect of a trade secret or other confidential research, development, or commercial information.” Fed.R.Bankr.P. 9018.
Appellants argue that a customer list must be the “primary asset” of a debtor in order to qualify as confidential commercial information under § 107(b)(1). D.I. 17 at 27. Courts regularly hold, however, that customer lists constitute confidential commercial information, irrespective of whether there are allegations that they are a primary asset. A recent decision by Judge Lane of the United States Bankruptcy Court for the Southern District of New York is instructive. In re Genesis Global Holdco, LLC, 652 B.R. 618, 631-36 (Bankr. S.D.N.Y. 2023). There, Judge Lane concluded that the customer list of Genesis, a cryptocurrency firm, was confidential commercial information pursuant to § 107(b)(1). Id. at 635. The court further determined that the debtors established that the list “is a valuable asset of the estate that is currently being marketed for sale and that its release would decrease the amount that would be realized from the sale process and have a negative impact on the value of the Debtor's estate.” Id.; see also In re Cred Inc., No. 20-12836 (JTD) (Bankr. D. Del. Dec. 18, 2020) [D.I. 277], Hr'g Tr. 113:20-25; 114:1-16 (A0779-A0780) (same); In re Faucett, 438 B.R. 564, 568 (Bankr.W.D.Tex. 2010) (holding that computer screen shots revealing identity of debtor's customers were confidential commercial information); In re Altegrity, Inc., 2015 WL 10963572, at *3-4 (Bankr. D. Del. July 6, 2015) (holding that debtor's list of independent contractors was a “primary asset” that debtor had spent “considerable effort and money to develop” and was “highly susceptible to solicitation” and that such information was therefore confidential commercial information); In re Nunn, 49 B.R. 963, 965 (Bankr. E.D. Va. 1985) (holding that customer list was creditor's only “real asset” and was subject to protection under § 107(b) because allowing creditor's competitor access to the list would have adverse effect on that creditor).
The same is true here. At the hearing on the First Extension Motion, Appellees presented evidence that the customer lists are a valuable asset of the estates and that disclosure would have a negative impact on the chapter 11 cases. Mr. Cofsky, on behalf of the Debtors' investment banker, testified that “the existing customer base is extraordinarily valuable.” A0509:10-19. He testified that the list of customers has value in both reorganization and sale scenarios. A0510:7-18. He testified that the customer lists would be “valuable if [Debtors] were unable to sell or chose not to sell and/or were unable or chose not to reorganize, but to simply sell the customer lists.” A511:10-15. He further testified that “releasing the [customer lists] would impair the debtors' ability to maximize the value that it currently possesses.” A512:4-7. Release of the customer names, according to Mr. Cofsky, would negatively impact Debtors' current process to monetize the asset, “potentially significantly.” A514:8-9. Based on this testimony, the Bankruptcy Court determined that the Debtors' customer lists may be redacted on a temporary basis pursuant to § 107(b)(1).
Appellants assert that the Bankruptcy Court erred in its determination that the customers lists have value to the Debtors. Appellants insist that “[t]o qualify as confidential commercial information, disclosure must provide an ‘unfair advantage to competitors.'” D.I. 17 at 31. But Mr. Cofsky's unrebutted testimony clearly demonstrates that it would. As in Genesis, “[t]he unrebutted evidence shows that release of this information would allow competitors to determine the identity of the Debtors' [customers] and take steps to poach the [customers], undermining the value of the Debtors' ongoing business.” Genesis, 652 B.R. at 635.
Appellants assert that the record does not “even suggest” that customers would stay on the Debtors' exchange if they reopened. D.I. 17 at 32. While such a finding was not required, Appellants ignore Mr. Cofsky's testimony that customers may be incentivized to utilize the reorganized Debtors' exchange because they would likely be owners of it. See A5103-14 (explaining that, in the context of reorganization, customers would likely receive equity interest in reorganized debtor); A0523:15-A0524 (addressing incentivization).
Appellants further assert that the Bankruptcy Court committed clear error because it made “no findings” that the customer names have “actual” or “specific” value. D.I. 17 at 31. This misstates the legal standard, as Appellants cite no law or case requiring any such findings, and the Court is aware of none. Notwithstanding, Appellants assert that Appellees “did not prove” Debtors could sell the customer names or “offer any evidence of the ‘value' of those names in any such sale.” Id. at 35. Appellants further posit that Debtors' customers may also be customers of other cryptocurrency platforms. D.I. 17 at 38-40.
I agree that these assertions are meritless and irrelevant. Mr. Cofsky, an investment banker with 20 years' experience, testified repeatedly, based on feedback from third parties and his own professional assessment, that the customer list is valuable (A0510-A0512) and that it has value even if customers use other platforms as well (A0530-A0531). The Bankruptcy Court credited his testimony on these issues, and Appellants have not shown that this was clear error.
Section 107(b)(1) also requires a showing that the information at issue has been kept “confidential.” 11 U.S.C. § 107(b)(1). According to Appellants, Debtors' prepetition practices show that the information is not confidential. Appellants quote a sentence from the declaration in support of first day relief submitted by John J. Ray III, Debtors' CEO, which states that Debtors “did not keep appropriate books and records, or security controls, with respect to [FTX's] digital assets.” D.I. 17 at 30 (quoting A0022-A0023, ¶ 65). But a lack of security controls “with respect to [Debtors'] digital assets” does not speak to the security of customer information, and the declaration discusses steps to secure customer data. A0025-A0026, ¶ 75. According to Appellants, FTX's Privacy Policy contemplates disclosure of “personal information” with certain “categories of third parties.” Appellees argue those provisions apply only “in the event of a sale, merger or reorganization,” or “if required to comply with law enforcement.” D.I. 19 at 27. Appellants disagree, and even assuming disclosure was so limited, they argue, “[t]here is no evidence that Debtors required those third parties to keep that information secret.” D.I. 17 at 2930 (citing A0103-A0104); D.I. 21 at 16. There is also no evidence to the contrary.
I agree that Appellants' rehash of the record falls short of showing that the Bankruptcy Court's decision “bears no rational relationship to the supporting data.” Interfaith Cmty. Org, 399 F.3d at 254. The Bankruptcy Court's determination that the Debtors' customer list fell within the ambit of § 107(b)(1) was not clear error, and its determination to protect the customer list was not an abuse of discretion.
Appellants argue that the Final Extension Order is based on the conclusion that Debtors' customer-creditor names are a “trade secret,” not confidential commercial information. (A0160). A customer list need not rise to the level of trade secret to mandate protection pursuant to § 107(b)(1). In re Orion, 21 F.3d at 28. As the record supports a finding that customer list is confidential commercial information under § 107(b)(1), the Court need not address Appellants' argument that the customer names are not also a “trade secret” under that section. The issue of whether the customer list warrants relief under § 107(b)(1) was raised below, and affirmance is warranted on any basis that finds support in the record. In re LMI Legacy Holdings, Inc., 625 B.R. 268, 289-90 (D. Del. 2020) (citing Geness v. Cox, 902 F.3d 344, 356 (3d Cir. 2018)).
C. Permanent Redaction of Customer-Creditor Names Who Are Natural Persons Pursuant to § 107(c)(1)
Under § 107(c)(1), a bankruptcy court may, for cause, permit the redaction of “[a]ny means of identification (as defined in § 1028(d) of title 18) contained in a paper filed, or to be filed,” in order to “protect an individual... to the extent the court finds that disclosure of such information would create undue risk of identity theft or other unlawful injury to the individual or the individual's property.” 11 U.S.C. § 107(c)(1). As expressly incorporated into § 107(c)(1), “means of identification” is defined in 18 U.S.C. § 1028(d) as: “any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual f including any “name, social security number, date of birth, official State or government issued driver's license or identification number, alien registration number, government passport number, employer or taxpayer identification number.” 18 U.S.C. § 1028(d)(7) (emphasis added). Thus, § 107 (c) “specifically allows the bankruptcy court to protect individuals from disclosure of certain ‘types of information to the extent the court finds that disclosure ... would create undue risk of identity theft or other unlawful injury to the individual or the individual's property,' ” In re AC & S, 775 Fed.Appx. at 79, and the disclosures that may be protected include “any name ... that may be used, alone or in conjunction with any other information, to identify a specific individual”-the precise relief afforded here. 18 U.S.C. § 1028(d).
Relying on this provision, the Bankruptcy Court found that cause existed to authorize the permanent redaction of the names of Debtors' customer-creditors who are natural persons and made the following factual findings in its bench ruling:
The 107(c) issue, Mr. Sheridan introduced very compelling testimony; again, uncontroverted testimony, about how customers can be identified just by a name. It's something that happens all the time in our society today, given the access to, not just the types of information we all have access to - Google, Twitter, et cetera - but the dark web, where there's all kinds of information about individuals that can be found with just a name.
And he testified, again, very compellingly, that if they have a name and they are an FTX customer, they can be targeted, and that is what we need to protect here. It's the customers that are the most important issue here. I want to make sure that they are protected and they don't fall victim to any types of scams that might be happening out there.A0694:8-21 (emphasis added); A0702 ¶ 4.
Appellants assert that an order redacting information pursuant to § 107(c) required evidence that disclosing such information “would,” rather than could, create harm. D.I. 17 at 42. There was no requirement that Appellees show certainty of undue risk for relief under § 107(c). Indeed, this Court held in In re Motions Seeking Access to 2019 Statements that “[s]ection 107(c) references ‘risk,' and assessment of risk is forward-looking. While a specific potential harm must be identified, the standard does not require evidence of injury having occurred in the past or under similar circumstances.” 585 B.R. at 751 (internal citations omitted). The record below supports the Bankruptcy Court's finding that the Debtors' individual customers are subject to undue future risk. (A0693-A0694 (Bench Ruling); A0246-A0255 (declaration of Mr. Sheridan describing the various methods malefactors use to target cryptocurrency holders using their personal information); A0554-A0565; A0585-A0621 (testimony of Mr. Sheridan that disclosure of customer names in the FTX bankruptcy cases subjects customers to significant risk of harm). Moreover, the decision is in line with similar cryptocurrency-related bankruptcy cases.
See In re Genesis, 652 B.R. at 643-44 (order granting motion to redact personally identifiable customer information for individuals under § 107(c)); In re BlockFi, Inc., No. 22-19361 (MBK) (Bankr. D.N.J. Nov. 30, 2022), D.I. 53 (A0788-A0789) (interim order granting motion to redact personally identifiable information of individual creditors, clients, equity holders, and current and former employees); In re Voyager Digital Holdings, Inc., No. 22-10943 (MEW) (Bankr. S.D.N.Y. July 8, 2022), D.I. 54 (A0782) (order granting motion to seal names of any natural persons subject to UK GDPR and EU GDPR regulations); In re Cred Inc., No. 20-12836 (JTD) (Bankr. D. Del. Dec. 21, 2020), D.I. 264 (A0760-A0763) (order granting motion to seal individual customer names).
Appellants rely upon a single out-of-Circuit case in which a bankruptcy court denied a request to seal individual customer names in a cryptocurrency bankruptcy case. In re Celsius Network LLC, 644 B.R. 276 (Bankr. S.D.N.Y. 2022). But, as Mr. Sheridan testified below, there were multiple reported incidents of cyberattacks that followed the disclosure of customers' names in Celsius, including phishing scams that went so far as a malefactor criminally falsifying an order of the bankruptcy court, which purported to require Celsius customers to submit personal information, including their cryptocurrency wallet address and contact information, and to pay a “filing fee” and “tax fee.” A0376-A0378; A0390-A0392; A0432-A0435; A0562:7-A0563:14 (testimony of Mr. Sheridan describing phishing, business email compromise, and other types of criminal schemes that occurred in the Celsius chapter 11 cases). Appellants attempt to dismiss the harm resulting from Celsius, asserting that “there is no evidence in the record, at all, that any of those phishing attempts were successful.” D.I. 17 at 50. Appellants' purported standard is not the law and would improperly require actual harm to have occurred before redacting would be appropriate, contrary to the “undue risk” of harm standard set forth in § 107(c). Indeed, as Appellees correctly point out, it would be an absurd and improper reading of the statute to ignore the word “risk” and require a showing that the particular harm had already occurred.
The undue risk to Debtors' customers has proven to be more than hypothetical. As noted, following the August 25, 2023 Kroll data breach, whereby an unauthorized party using a SIM swapping attack obtained names, addresses, email addresses and account balances of FTX account holders, customers have been under attack by a malefactor attempting to gain access to their accounts. This is precisely the risk to which Mr. Sheridan testified, and the “cause” under § 107(c) that justified protection of customer names here.
I must similarly reject Appellants' contention that the Debtors' customers are voluntarily identifying themselves without ramification. D.I. 17 at 43. Such disclosures were required by order of the Bankruptcy Court, which held that creditors who voluntarily participate in the chapter 11 cases should identify themselves. A0716:17-23. Most customers, of course, did not voluntarily decide to participate in these chapter 11 cases, but are compelled to participate in order to protect their rights and pursue their respective claims. These millions of customers would, absent the relief granted by the Bankruptcy Court, have their identities revealed without their consent (and, in many cases, without their knowledge).
The Ad Hoc Committee of Non- U.S. Customers filed a motion seeking to seal its members' personal identifying information (AO 169), which was denied on the basis that such members had voluntarily determined to participate in the cases. According to the Fed.R.Bankr.P. 2019 statement filed by the Ad Hoc Committee, members holding in the aggregate of over $1.7 billion in alleged claims subsequently left the Ad Hoc Committee “to protect the confidentiality of personal information.” A0740.
Appellants further contend that Mr. Sheridan did not review any data or research about how often known cryptocurrency holders are targets of the various scams, relative to non-cryptocurrency holders. D.I. 17 at 47-49. To the contrary, he testified that an individual is more likely to be the victim of a phishing attack if they are a known holder of cryptocurrency because:
it's a more effective way to generate criminal proceeds because of the circumstances of and nature of the asset, as I described earlier; it's instantaneous, near-instantaneous, it's global, it's valuable, it's pseudoanonymous, it's irreversible. And so it is both the method and the means in which the majority of criminal schemes in an online sense are conducted in our - in the bulk of our investigations. ... the schemes are carried out using cryptocurrency in an overwhelming number of cases because that's how the criminals are paid and that's how the proceeds are transferred. Whether or not the criminal knows the individual is a known holder or not, we don't make that distinction...A0601:19-A0602:16. While it is, of course, true that that phishing and other similar scams can be used to target anyone, the record reflects that the very nature of cryptocurrency places holders at high risk of such scams and attacks. Appellants offered no evidence below that customers are not at risk or that those who have had to identify themselves to participate in the cases have not been targeted or harmed.
D. The Bankruptcy Court Did Not Err by Reversing the Presumption in Favor of Public Access or Refusing to Consider Less Restrictive Alternatives
Appellants assert that the Bankruptcy Court erred as a matter of law by reversing the presumption in favor of public access and by failing to require a specific, particularized showing before authorizing broad redaction. See D.I. 17 at 20-21 (excerpting Debtor and Committee counsel's arguments that Appellees had presented no evidence, and inferring that the Bankruptcy Court was “[p]ersuaded by those arguments” alone). But with respect to confidential commercial information, the Bankruptcy Court found and the record shows that “the evidence presented was uncontroverted that customer identification has value” (A0693:16-17). And once Appellees met their burden, the Bankruptcy Code mandated protection. 11 U.S.C. § 107(b)(1) (“On request of a party in interest, the bankruptcy court shall ... protect an entity with respect to a trade secret” or “confidential ... commercial information.”); In re Orion, 21 F.3d at 27 (“[I]f the information fits any of the specified categories [under § 107(b)(1)], the court is required to protect a requesting interested party and has no discretion to deny the application.”) (emphasis in original). Likewise, Appellees offered no evidence to rebut the “very compelling” and “uncontroverted testimony” with respect to § 107(c). A0694:8-9.
Appellants further argue that the Bankruptcy Court's “all-or-nothing approach ... was itself error,” and that it erred in “refus[ing] to make any distinctions between any of Debtors' approximately 9 million customer-creditors.” D.I. 17 at 40, 53. Mr. Cofsky, however, testified that there is value to all customer names, individual and institutional, irrespective of whether the customer has an account on another exchange or not. A530:9-A533:2. There was therefore no reason to distinguish between one customer or another for the purposes of § 107(b)(1). With respect to § 107(c), the Bankruptcy Court credited Mr. Sheridan's “compelling” testimony that “customers can be identified by just a name.” A694:8-10. This is true regardless of whether or not such customer is one of the Debtors' largest customers, or any other distinction Appellants might seek to draw. Moreover, the Court finds no support for Appellants' assertion that “it is likely those [largest] customer-creditors ... are the least susceptible to any scams.” D.I. 17 at 54.
Appellants argue that “[n]arrow tailoring is also supported by the policy favoring public access in bankruptcy proceedings; accordingly, “[r]edacting documents to remove only protectable information is preferable to wholesale sealing.” Id. at 53 (quoting In re Borders Grp., Inc., 462 B.R. at 47. But that is exactly what the Bankruptcy Court did here: the First Extension Order authorized the Appellees to redact customer names, not to “wholesale seal” documents. A700.
V. CONCLUSION
There is sufficient support in the record below for the Bankruptcy Court's findings, and entry of the First Extension Order was clearly within the Bankruptcy Court's discretion. The Court will issue a separate Order consistent with this Opinion.