Summary
In Music Grp. Macao, the plaintiff sought to seal contracts between the plaintiff and a third-party client on the grounds that the contract included trade secrets.
Summary of this case from Green v. W. L. Gore & Assocs.Opinion
Case No. 14-cv-03078-JSC
06-30-2015
MUSIC GROUP MACAO COMMERCIAL OFFSHORE LIMITED, Plaintiff, v. DAVID FOOTE, Defendant.
ORDER RE: ADMINISTRATIVE MOTIONS TO FILE UNDER SEAL
Re: Dkt. Nos. 49, 57, 70, 77, 95
This case arises out of a cyber attack on the global computer network and communication systems of Plaintiff Music Group Macao Commercial Offshore Limited ("Music Group" or "Plaintiff"). Plaintiff asserts that the cyber attack occurred due to the failures of Defendant David Foote ("Defendant"). The Court recently issued an Order denying Defendant's motion for summary judgment, granting Defendant's motion for leave to file supplemental evidence in support of summary judgment, denying Plaintiff's motion for a Rule 56(d) continuance, and denying Plaintiff's motion for leave to file a Second Amended Complaint. (Dkt. No. 123.) Now pending before the Court are the parties' administrative motions to file under seal documents submitted in connection with the briefing on those motions. (Dkt. Nos. 49, 57, 70, 77, 95.) After carefully considering the parties' submissions, the Court rules as follows.
LEGAL STANDARD
There is a presumption of public access to judicial records and documents. Nixon v. Warner Commc'ns, Inc., 435 U.S. 589, 597 (1978). A party must demonstrate "compelling reasons" to seal judicial records attached to a dispositive motion. Kamakana v. City & Cnty. of Honolulu, 447 F.3d 1172, 1179 (9th Cir. 2006). Examples of compelling reasons include "the use of court records for improper purposes," such as "to gratify private spite, promote public scandal, circulate libelous statements, or release trade secrets." Id. "[S]ources of business information that might harm a litigant's competitive strategy" may also give rise to a compelling reason to seal," Nixon v. Warner Comm'cns, Inc., 435 U.S. 589, 597 (1978), as may pricing, profit, and customer usage information kept confidential by a company that could be used to the company's competitive disadvantage, see Apple Inc. v. Samsung Elecs. Co., 727 F.3d 1214 (Fed. Cir. 2013). The "compelling reasons" standard is a strict one, and "[s]imply mentioning a general category of privilege, without any further elaboration or any specific linkage with the documents, does not satisfy the burden." Kamakana, 447 F.3d at 1184. The court must "balance the competing interests of the public and the party who seeks to keep certain judicial records secret. After considering these interests, if the court decides to seal certain judicial records, it must base its decision on a compelling reason and articulate the factual basis for its ruling, without relying on hypothesis or conjecture." Id. at 1179; see also Apple Inc. v. Psystar Corp., 658 F.3d 1150, 1162 (9th Cir. 2011), cert. denied, 132 S. Ct. 2374 (2012).
In light of a weaker public interest in nondispositive motions—i.e., because the documents may well be unrelated or only tangentially related to the underlying cause of action, the "good cause" standard from Federal Rule of Civil Procedure 26(c) applies when parties wish to keep them under seal. Pintos v. Pac. Creditors Ass'n, 605 F.3d 665, 678 (9th Cir. 2010). "[T]he party seeking protection bears the burden of showing specific prejudice or harm will result," Phillips ex rel. Estates of Byrd v. Gen. Motors Co., 307 F.3d 1206, 1210-11 (9th Cir. 2006), and must make a "particularized showing . . . with respect to any individual document," San Jose Mercury News, Inc. v. U.S. Dist. Ct., 187 F.3d 1096, 1103 (9th Cir. 1999). "Broad allegations of harm, unsubstantiated by specific examples or articulated reasoning" are insufficient. Beckman Indus., Inc. v. Int'l Ins. Co., 966 F.2d 470, 476 (9th Cir. 1992).
In addition, parties moving to seal documents must comply with the procedures set forth in Civil Local Rule 79-5. The rule permits sealing only where the parties have "establishe[d] that the document or portions thereof is privileged or protectable as a trade secret or otherwise entitled to protection under the law." Civ. L.R. 79-5(b). It requires the parties to "narrowly tailor" their requests only to the sealable material. Id. at 79-5(d). Thus, although sometimes it may be appropriate to seal a document in its entirety, whenever possible a party must redact. See Kamakana, 447 F.3d at 1183 (noting a preference for redactions so long as they "have the virtue of being limited and clear"); Murphy v. Kavo Am. Corp., 11-cv-00410-YGR, 2012 WL 1497489, at *2-3 (N.D. Cal. Apr. 27, 2012) (denying motion to seal exhibits but directing parties to redact confidential information). Whatever the basis, the court "must articulate [the] reasoning or findings underlying its decision to seal." Apple Inc., 658 F.3d at 1162.
DISCUSSION
There are five administrative motions to file under seal pending in this matter associated with Defendant's motion for summary judgment. (Dkt. Nos. 49, 57, 70, 77, 95.) As a threshold matter, Plaintiff incorrectly filed a number of them: some of the administrative motions are filed under seal themselves in their entirety, which is improper. (See, e.g., Dkt. Nos. 57, 70, 84.) See Civ. L.R. 79-5(b), (d). Plaintiff is therefore directed to file a copy of the administrative motions themselves on the public docket.
Other administrative motions to file under seal are pending in connection with Plaintiff's Motion to Retain Confidentiality. (Dkt. Nos. 104, 112.) The Court does not address those motions here.
A. Motion to File Under Seal Documents Related to Defendant's Motion for Summary Judgment (Dkt. No. 49)
Defendant seeks to file under seal portions of its motion for summary judgment, portions of the Declaration of Jared M. Ahern in support of that motion, Exhibits 6 and 7 thereto in their entirety, and portions of Exhibits 1, 3, and 4. (Dkt. No. 49.) Because this motion is for summary judgment, the Court applies the "compelling reasons" standard to this administrative motion to seal. See Kamakana, 447 F.3d at 1179 (describing summary judgment motions and related attachments as dispositive pleadings). Defendant moves to file this information under seal because it pertains to material that Plaintiff designed as "CONFIDENTIAL" under the terms of the parties' protective order. Consistent with the Local Rules, Defendant identified the documents that contain the designated confidential material and served a copy on Plaintiff. (Dkt. No. 49-18.) The Local Rules then require the designating party—here, Plaintiff—to file a declaration within 4 days establishing grounds for sealing all of the designated material. See Civ. L.R. 79-5(e)(1). Plaintiff has, indeed, filed a declaration in response setting forth the confidential basis of the designated information. (Dkt. No. 70.) The Court will address each sealing request in turn.
1. Exhibit 1 to Ahern Declaration
The motion to seal portions of Exhibit 1 (Dkt. No. 49-9), excerpts of the transcript from the deposition of Music Group CEO Uli Behringer, is GRANTED. The Court is satisfied that the requested redactions are narrowly tailored to remove only the identities of two of Plaintiff's former employees that the company suspected of perpetrating the cyber attack. Disclosure of this information would infringe the privacy rights of those two individuals, which constitutes a compelling reason for sealing. See Icon-IP Ltd. v. Specialized Bicycle Components, Inc., No. 12-cv-03844-JST, 2015 WL 984121, at *3 (N.D. Cal. Mar. 4, 2015) (noting that "invasion of [a] third party's privacy" constitutes a compelling reason to file an exhibit under seal); see, e.g., Barnes v. Hershey Co., No. 3:12-cv-01334-CRB, 2015 WL 1814293, at * 2-3 (N.D. Cal. Apr. 21, 2015). Moreover, the public interest in this information is minimal. The public will have access to information regarding the actions Plaintiff took against two employees and why Plaintiff suspected these two employees of perpetrating the attack, which is relevant to whether those individuals, and not Defendant, are response for the cyber attack; the names of those employees is not important. This requests meets the narrow tailoring requirement because only the individuals' identities has been redacted form the transcript; the relevant information about what disciplinary action, if any, Plaintiff took against those individuals remains on the public docket. See Civ. L.R. 79-5(b). Thus, the request to redact these limited portions of Exhibit 1 is GRANTED.
Notably, attached to the Behringer deposition testimony is a document titled "IS and IT strategy document," which the Court understands to be Defendant's report identifying problems with Plaintiff's systems and making recommendations for improvements. (Dkt. No. 49-9 at 38-40.) According to the Bates stamp at the bottom of the page, the document was marked confidential during discovery. However, Defendant did not move to file the document under seal or redact it, and Plaintiff did not request that the report be removed from the public docket or redacted in any manner. (See Dkt. No. 57 at 5-6.)
2. Exhibit 3 to Ahern Declaration
The request to seal portions of Exhibit 3 (Dkt. No. 49-11), excerpts of the transcript from the deposition of Music Group IT executive Tim Driggers, is GRANTED for the same reasons as above. Only the names of the two employees suspected of perpetrating the cyber attack have been redacted. See Icon-IP Ltd., 2015 WL 984121, at *3;Barnes, 2015 WL 1814293, at * 2-3. As above, these minimal redactions protect the individuals' compelling interest in their privacy, outweigh the public's interest in knowing this particular information, are narrowly tailored in compliance with Local Rule 79-5(b), and outweigh the public's interest in disclosure.
3. Exhibit 4 to Ahern Declaration
The request to seal portions of Exhibit 4 (Dkt. No. 49-13), Plaintiff's supplemental responses to Defendant's first set of discovery requests, is GRANTED IN PART. The proposal is to make redactions to either questions, answers, or both associated with 9 of Defendant's discovery requests. Plaintiff does not attempt to parse out which rationale applies to which redaction, nor does it specifically address the redactions separately. Instead, in its required Rule 79-5(e) response, Plaintiff states generally that the redactions "conceal information pertaining to law enforcement proceedings and personal information of individuals not a party to this lawsuit protected by national and international privacy laws." (Dkt. No. 70 at 5.) Although Plaintiffs could have and should have offered more particularized showing, the Court will nonetheless address the merits of the redactions to each discovery request separately here.
The request to seal Plaintiff's response to Interrogatory No. 15 is GRANTED IN PART. The interrogatory requests a description of "any disciplinary action [Plaintiff] took towards any of [its] personnel in response to the cyber attack[.]" (Dkt. No. 49-13.) The response plainly does not pertain to law enforcement proceedings, so the only question is whether the response merits redaction due to the harm that would flow from disclosing personal information of an individual not a party to this lawsuit. The proposed redaction is overbroad. The response largely pertains to Plaintiff's disciplinary actions towards Defendant—plainly a party to this lawsuit. The only information that need be redacted to protect a third party's compelling interest in privacy is the name of the other individual. The remaining portion of the response must be filed on the public docket.
Next, to Plaintiff's response to Request for Admission No. 2, which asks Plaintiff to admit whether the cyber attack was intentional. (Id. at 4-5.) The response does not contain any sealable information and must be un-redacted.
The next set of redactions pertain to Interrogatory Nos. 18 and 19 and Request for Admission Nos. 15, 16, 17, 18, and Request for Production of Documents No. 25. (Id. at 9-10.) For the reasons discussed in Exhibit 1 and other discovery responses, these redactions are overbroad and should be limited only to the name of the referenced employees who are not a party to this lawsuit. The other information pertaining to Plaintiff's response about the employee shall be filed on the public docket, as this information is relevant to the determination on summary judgment regarding whether Plaintiff admitted that its employees perpetrated the cyber attack such that Defendant is either not liable or less liable.
Next, Plaintiff's response to Defendant's Interrogatory No. 21, which asks Plaintiff to describe in detail the conclusion of any Federal Bureau of Investigations investigation into the cyber attack, is redacted in its entirety purportedly on the grounds that it pertains to law enforcement proceedings. (Id. at 11.) In certain circumstances, courts have allowed the government to file under seal material that contains confidential and sensitive government information that might endanger or undermine law enforcement's activities, but only where the government identifies the particular harm that may result from the specific disclosure. See, e.g., Hesterberg v. United States, No. C-13-01265 JSC, 2013 WL 6057068, at *2 (N.D. Cal. Nov. 15, 2013). Plaintiff has not done so here, and instead generally asserts that all information pertaining to law enforcement proceedings must remain under seal. Such is not the case.
The authorities on which Plaintiff relies— the Freedom of Information Act, 5 U.S.C. § 552(b)(7) and California's state law privilege for nondisclosure of official information, Cal. Evid. Code § 1040—are unpersuasive. (See Dkt. No. 57 at 6.) Section 552(b)(7) of the FOIA exempts the government from mandatory statutory disclosure records or other information compiled for law enforcement purposes only to the extent that production could reasonably be expected to cause one of a certain enumerated harms. But this is not a FOIA action, and Plaintiff is not a governmental entity. Rather, as a private entity apparently privy to the status of an investigation, it is clear that the government has already deemed it appropriate to disclose the information, so the FOIA exemption is inapt. Indeed, even documents typically subject to this FOIA exemption are not privileged from public discovery outside of the FOIA context. See Kamakana, 447 F.3d at 1184-85. Indeed, in the context of other privileges, courts have emphasized that "assertion of privilege, without more, is effective only to justify the withholding of documents or other evidence in discovery[,]" but "[o]nce the evidence has been produced to the opposing party or parties, the privilege has been waived." Chao v. Mazzola, No. C 04-4949 PJH, 2007 WL 163685, at *2 (N.D. Cal. Jan. 19, 2007) (citing Gomez v. Vernon, 255 F.3d 1118, 1131-32 (9th Cir. 2001)). Thus, that parties produced documents during discovery as "protected information" is "irrelevant if the party seeking to have the material filed under seal cannot satisfy the 'compelling reasons' test articulated in Kamakana." Id. Tellingly, with respect to the law enforcement privilege in particular, Plaintiff has not cited a single case in which a court found the FOIA exemption to constitute a blanket compelling reason to seal all information "pertaining to law enforcement."
Specifically, Exemption 7 of the FOIA allows the government to withhold
records or other information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information (A) could reasonably be expected to interfere with enforcement proceedings, (B) would deprive a person of a right to a fair trial or an impartial adjudication, (C) could reasonably be expected to constitute an unwarranted invasion of personal privacy, (D) could reasonably be expected to disclose the identity of a confidential source . . . or . . . information furnished by a confidential source, (E) would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law, or (F) could reasonably be expected to endanger the life or physical safety of any individual[.]5 U.S.C. § 552(b)(7).
Plaintiff's reliance on California Evidence Code § 1040, which creates a privilege for "information acquired in confidence by a public employee in the course of his or her duty and not open, or officially disclosed, to the public prior to the time the claim of privilege is made" fares no better. As the state equivalent of the FOIA, only the government entity holds the privilege. Cal. Evid. Code § 1040(b). Moreover, the privilege is not absolute, but rather subject to a balancing test at the court's discretion. See Sander v. State Bar of Cal., 58 Cal. 4th 300, 314 (2013). In any event, as with the FOIA citation, for this law enforcement privilege in particular, Plaintiff cites no case in which the Court found this evidence code a compelling reason to seal all information pertaining to law enforcement proceedings.
Aside from general and vague citations to these laws, Plaintiff does not identify any particular harm that would arise from disclosing the information, and the Court sees none—provided that the names of the individuals are redacted so as to foreclose any privacy concerns. Indeed, it appears that the investigation is over, so there is no fear of interfering with an ongoing investigation. Thus, unlike Hesterberg, no threat to law enforcement activities has been identified that constitutes a compelling reason to keep law enforcement material under seal. Cf. Hesterberg, 2013 WL 6057068, at *2. Accordingly, the redactions to Plaintiff's response to Interrogatory 21 are overbroad. The only information that must be redacted is the name of the individual subject of the investigation, whose privacy rights would be violated if the information were disclosed, as discussed above.
4. Exhibit 6 to Ahern Declaration
The request to seal Exhibit 6 (Dkt. No. 49-15), the Music Group report from the internal investigation, is GRANTED. A substantial portion of the document pertains to information describing personal encounters with the two individuals suspected of perpetrating the cyber attack; this information should remain under seal to protect these individuals' privacy for the reasons discussed above. See Icon-IP Ltd., 2015 WL 984121, at *3; Barnes, 2015 WL 1814293, at * 2-3.
A substantial portion of the report includes significant detail about Plaintiff's general technology infrastructure, server systems, and security and recommends improvements thereto. Plaintiff states that this information is proprietary information and trade secrets about "the method, technique and process of implementing improvements to Music Group's network infrastructure and IT." (Dkt. No. 70 at 5-6.) Plaintiff further contends that release of information regarding improvements to the security system and measures taken after the cyber attack would pose a risk because the perpetrators of the cyber attack remain unknown. (Id.) Plaintiff's initial Rule 79-5(e) response is entirely inadequate, stating as much only in a conclusory manner without providing any explanation about how the release of the contents of this document would harm Music Group in any particular way. However, Plaintiff has since provided further support for sealing this document in the context of its Motion to Retain Confidentiality. (Dkt. No. 104.) While the Court does not now address that motion, it will consider the declaration of Plaintiff's expert, Eric Westbrook, as it relates to the documents at issue in these administrative motions.
The Court considers the Westbrook Declaration over Defendant's objection. Defendant argues that the Westbrook Declaration does not qualify as expert testimony under Federal Rule of Evidence 703 because it does not demonstrate that his opinion is the result of "reliable methods reliably applied." (Dkt. No. 112-4 at 8.) Because Westbrook has provided sufficient explanation supporting how he reached his conclusion based on his significant experience in the cyber security field, the Court considers and credits his opinion. However, Plaintiff redacted Paragraphs 10 through 13 of the Westbrook Declaration without filing an administrative motion to file under seal and without filing an unredacted version on the docket. (See Dkt. No. 104.) Plaintiff lodged a copy of the unredacted declaration with the Court. The redacted paragraphs of the Westbrook Declaration describe the type of confidential information that certain documents contain, but it does not disclose what the actual confidential information is. For example, in Paragraph 13Westbrook avers that Exhibit 6 contains "information about how the Cyber Attack occurred" and identifies "the current and former employees who were initially suspected or perpetrating" it, but it neither discloses details about how the cyber attack concerns nor the identities or even job descriptions of those employees. (Id. ¶ 13.) The Court therefore ORDERS Plaintiff to file an unredacted version of the declaration on the public docket.
In his declaration, Westbrook identifies categories of information that an individual may use to perpetrate a cyber attack, including: (1) identification of a particular vulnerability in a company's systems or software; (2) knowledge of the software or vendor of security software used; and (3) "social engineering"—i.e., gaining the trust of a company insider to, in turn, gain access to the company's software. (Dkt. No. 104 ¶¶ 4-7.) With regard to Exhibit 6 (referenced as the document Bates stamped MG-0000097-104 in the Westbrook Declaration), Westbrook avers that the report "includes information about Music Group's investigation of how the Cyber Attack occurred and who might have been the perpetrators[,]" which "could provide a roadmap for an attacker to try again in case there are any remaining vulnerabilities." (Dkt. No. 104 ¶ 13.) Westbrook further attests that a would-be cyber attacker could use the report for its valuable "social engineering" content to reach out to the current and former employees identified as having some involvement with the cyber attack or knowledge and access to the cyber security systems at issue. (Id.) Public release of this information could therefore cause Music Group harm by contributing to another cyber attack.
Indeed, courts have found a party's tangible concern about future cyber attacks or hacking is a compelling reason to seal materials. See, e.g., In re Google Inc. Gmail Litig., No. 13-MD-02430-LHK, 2013 WL 5366963, at *3 (N.D. Cal. Sept. 25, 2013) (sealing information about how users' interactions with the Gmail system affect how its messages are transmitted based on Google's assertions that "hackers and spammers could use this information to circumvent Google's anti-virus and anti-spam mechanisms" and in light of the absence of a "strong public interest in disclosure of the material . . . since this material is unlikely to be critical to the substantive issue of liability."); cf. Dugan v. Lloyds TSB Bank, PLC, No. 12-cv-02549-WHA (NJV), 2013 WL 1283435, at *7-8 (N.D. Cal. Mar. 26, 2013) (noting that the moving party had not submitted sufficient information to justify sealing based on an abstract threat of cyber attacks). But neither In re Google Inc. Gmail Litigation nor Dugan arose out of a cyber attack. Rather, the Google Inc. Gmail case was a class action challenge under state and federal anti-wiretapping laws, while Dugan challenged defendant's sale of risky and complex loans as fraudulent, breach of contract, and in violation of securities laws. It follows that the public interest in accessing this potentially harmful information was low because it was not at the heart of those cases and was only tangential to the courts' decisions.
So it is here, despite the fact that this case indisputably arises out of a cyber attack, placing the state of Plaintiff's systems and servers at issue. Weighing the public interest in understanding the judicial process against Plaintiff's allegation that disclosing server data may harm it by encouraging another cyber attack, or at least making it feasible, the Court finds a compelling reason to seal the portions of this exhibit that discuss Plaintiff's network infrastructure and security systems. The public interest is limited where, as here, the content sought to be sealed is irrelevant to the Court's decision. See Kamakana, 447 F.3d at 1179 (finding that the reason for the higher standard for sealing documents related to dispositive motions is because "resolution of a dispute on the merits . . . is at the heart of" the public interest so the public has less of a need to access documents that are "unrelated or only tangentially related" to the merits of the motion); Network Appliance v. Sun Microsysts. Inc., No. C-07-06053 EDL, 2010 WL 841274, at *2 (N.D. Cal. Mar. 10, 2010) ("Here, although the documents in question are attached to a dispositive motion, they had no bearing on the resolution of the dispute on the merits and are therefore more akin to the 'unrelated,' non-dispositive motion documents the Ninth Circuit contemplated in Kamakana."). Although Plaintiff's technology systems and internet communications infrastructure is relevant to this case, the contours of these networks was not at issue in Defendant's motion for summary judgment. To the contrary, instead of reaching the question of whether Defendant left the system exposed, whether he could have done more to protect it, and how the cyber attack affected it, the Court's Order on summary judgment only addressed whether there were grounds even to task Defendant with responsibilities for the systems. In light of the Westbrook Declaration, and given that the Court did not rely on the confidential content regarding Plaintiff's systems in reaching its conclusion on summary judgment, Plaintiff has met its burden of setting forth compelling reasons to seal Exhibit 6. Accordingly, the request to file Exhibit 6 under seal is GRANTED.
It may well be that, as this case progresses the balance shifts in favor of disclosure. In particular, if evidence of Plaintiff's systems and servers is offered at trial to support Plaintiff's claims that Defendant failed to protect those systems or could have done more to mitigate the effects of a cyber attack, the public's interest in disclosure may outweigh Plaintiff's concerns about preventing future attacks.
5. Exhibit 7 to Ahern Declaration
The request to seal in its entirety Exhibit 7 (Dkt. No. 49-17) is GRANTED IN PART. The exhibit reflects emails between Music Group CEO Uli Behringer and investigators from a United Kingdom police department regarding investigation into the perpetrators of the cyber attack. Portions of the exhibit have been redacted to protect privileged attorney-client communications. (See id. at 2, 11.) These redactions have not been challenged. Plaintiff seeks to seal the non-privileged portions of the exhibit in its entirety on the grounds that it contains information pertaining to law enforcement proceedings. (See Dkt. No. 70 at 6.) As with Exhibit 4, here Plaintiff has failed to describe precisely what "sensitive law enforcement information" is at issue and how it might cause harm, and therefore has failed to meet its burden of demonstrating compelling reasons for sealing Exhibit 7 in its entirety. See Hesterberg, 2013 WL 6057068, at *2.
However, for the reasons discussed above, there are compelling reasons to redact identifying information of the suspects and other involved employees, due to privacy concerns as well as the "social engineering" concern identified in the Westbrook Declaration. Likewise, there are compelling reasons to redact any questions from the police or answers from Behringer that disclose details about how the Cyber Attack occurred, the software technology or server layout that Music Group uses that might contribute to another cyber attack. But this can be accomplished through limited, narrowly tailored redactions. That that there was an investigation into two employees, that there were suspects, that Behringer was in touch with the police about them—none of this is sealable information, and the Court relied on these facts in the summary judgment order.
6. Memorandum in Support of Motion for Summary Judgment
The request to redact the names of the suspected perpetrators in the memorandum in support of Defendant's motion for summary judgment (Dkt. No. 49-5) is GRANTED IN PART. The redactions to Defendant's summary judgment motion to remove identifying information of the suspected perpetrators are appropriate for the reasons set forth above. However, the redaction of the entire quoted portion of Exhibit 7 on page 16 of the memorandum is overbroad. Plaintiff has only offered compelling reasons to redact the names and identifying information of the systems and the references to the particular systems. Behringer's admission that the attack required knowledge about IT infrastructure and server passwords is not sealable, as the quoted portion of Exhibit 7 does not explain what that infrastructure was, how passwords were set, or what the passwords were.
B. Motion to File Under Seal Documents Related to Plaintiff's Opposition to Defendant's Motion for Summary Judgment (Docket No. 57)
In Docket No. 57, Plaintiff seeks to file portions of its opposition to Defendant's motion for summary judgment and declarations and exhibits submitted in support thereof under seal. However, Plaintiff subsequently filed Docket No. 70 as a corrected version of Docket No. 57. Docket No. 57 shall therefore be terminated.
C. Motion to File Under Seal Documents Related to Plaintiff's Opposition to Defendant's Motion for Summary Judgment (Docket No. 70)
Plaintiff seeks to file under seal portions of its opposition to Defendant's motion for summary judgment; portions of the Behringer Declaration, Exhibits B, C, E, and F in their entirety, and portions of Exhibit D attached thereto; portions of the Cruz Declaration and Exhibit A attached thereto; portions of the Jerome Declaration and Exhibit 1 attached thereto; portions of the Dibley Declaration, Exhibits 3, 4 and 6 thereto in their entirety, and portions of Exhibit 5. Because this motion is for summary judgment, the Court applies the "compelling reasons" standard to this administrative motion to seal. See Kamakana, 447 F.3d at 1179. Plaintiff designated most of the exhibits referenced as confidential pursuant to the parties' protective order, while others were so designated by Defendant.
1. Portions of Behringer Declaration and Exhibits B-F
First, Plaintiff seeks to seal portions of the Declaration of Uli Behringer (Dkt. No. 59 & 70-3 at 64) and Exhibits attached thereto.
a. Exhibits B & C
Plaintiff seeks to seal Exhibits B and C (Dkt. No. 70-4 at 2-41) in their entirety on the grounds that each is a contract between Plaintiff and a third-party client, including trade secrets of the non-party, such as details about the process of implementing the third party's technology services and the prices of those services. (See Dkt. No. 70 at 3.)
Although the Ninth Circuit generally allows parties to seal pricing terms, rates, and payment terms in agreements because it could "harm a litigant's competitive standing," the litigant is still required to show specific compelling reasons why the harm will occur. See Open Text S.A. v. Box, Inc., No. 13-cv-04910-JD, 2014 WL 7368594, at *3 (N.D. Cal. Dec. 26, 2014); see, e.g., Stout v. Hartford Life & Acc. Ins. Co., No. CV 11-6186 CW, 2012 WL 6025770, at *2 (N.D. Cal. Dec. 4, 2012) (finding that the moving party established compelling reasons for sealing by filing a declaration indicating how competitors could use the information to adjust their own contracts with vendors and physicians thereby undermining the party's ability to compete); Power Tech., Inc. v. Tessera, Inc., No. C 11-6121 CW, 2012 WL 328421, at *1 (N.D. Cal. Aug. 10, 2012). Courts have rejected similar requests to seal contracts with third-parties in the absence of specific facts showing why public release would cause them harm and where none of the other entities that are party to the contract have filed declarations in support of the motion to seal. See, e.g., id.; U.S. Ethernet Innovations, LLC v. Acer, Inc., No. C 10-3724 CW, 2013 WL 4426507, at *5 (N.D. Cal. Aug. 4, 2013). At the very least, it appears that the moving party must aver that release of the confidential and proprietary information would cause it harm. See Powertech Tech. Inc., 2012 WL 328421, at *1.
Here, the third parties have not submitted declarations in support of keeping the contracts under seal, and Plaintiff offers only general averments that the contract includes trade secrets of a third party. (See Dkt. No. 70 at 3.). Plaintiff nowhere avers that disclosure of the information would harm it or the third parties. However, the content of the contracts are not at issue in this litigation: neither the identity of the third party nor the pricing terms contained therein are even tangentially relevant. Rather, the very fact that Defendant executed contracts with third parties on Plaintiff's behalf is the salient point that the Court referenced in its summary judgment order. The public's interest in disclosure of the agreements themselves is therefore minimal, and the Court concludes it is outweighed by the third-party company's interest in keeping its contract terms confidential. Indeed, it appears that Defendant has since stipulated to the confidential nature of these documents. (See Dkt. No. 106-9 at 2.) Thus, because the Court did not rely on the content of the contracts, they are properly sealable. The minimal redactions to Paragraph 8 of the Behringer Declaration are narrowly tailored to remove only the name of the third-party customers, and this narrow tailoring comports with Local Rule 79-5. Accordingly, Exhibits B and C may be filed under seal, and the requested redactions to Paragraph 8 of the Behringer Declaration are GRANTED.
b. Exhibit D
Plaintiff next requests to seal portions of Exhibit D. (Dkt. No. 70-3 at 69-71.) Exhibit D is an email from Defendant to all Music Group employees that "describes certain vulnerabilities with Music Group's IT infrastructure[.]" (Dkt. No. 12- at 13.) The redacted portion describe in detail a network outage in that Plaintiff suffered in July of 2013 and the particular measures taken to respond to that outage. (See Dkt. No. 70-3 at 70.) Plaintiff asserts that the description contains confidential proprietary information and trade secrets about the company's operations and internal IT and IS systems, and measures taken to improve those things, which if made publicly available could pose a threat to Plaintiff's network security for the reasons set forth in the Westbrook Declaration. The Court is satisfied that these compelling reasons to maintain the confidentiality of the seven sentences of this email outweighs the public's interest in disclosure, especially where, as here, the redacted content is does not factor into to the Court's determination of the motion for summary judgment, and the redactions are minimal to allow the remaining portion of the document to be filed on the public docket. Thus, the request to seal portions of Exhibit D is GRANTED.
The Court was unable to find a copy of Exhibits E and F on the docket, redacted or not. Plaintiff lodged a hard copy of the exhibits with the Court. However, Plaintiff is reminded of its obligation to comply with Civil Local Rule 79-5(c) by filing copies of all documents on the docket.
Next, Plaintiff's request to seal Exhibits E and F in their entirety and Paragraphs 13 and 14 of the Behringer Declaration, which discusses those exhibits, is GRANTED IN PART. Exhibits E and F are the same email chain as Exhibit 7 to the Ahern Declaration. (Dkt. No. 49-17.) The same analysis applies here.
The redactions to Paragraphs 13 and 14 of the Behringer Declaration regarding Exhibit E are likewise overbroad. Only the information that discloses the identities of the suspected employees (including their names, roles, and office locations) is sealable, as discussed above. But other information is not. As just one example, the Court relied on Behringer's statement that he does not know who perpetrated the cyber attack. (Dkt. No. 70-3 ¶ 14:8-9.) Plaintiff has not given any reason, let alone a compelling one, for keeping this information under seal. Plaintiff must limit its redactions solely to the sealable information consistent with this Order and refile the Behringer Declaration with these limited redactions.
2. Portions of Cruz Declaration and Exhibit 1
Plaintiff next seeks to file under seal Exhibit A to the Cruz Declaration, and the portion of the Cruz Declaration referencing that Exhibit. Exhibit A is a compilation of all invoices that Defendant submitted for payment for services rendered pursuant to the Consultancy Agreement from 2010 through 2013. (Dkt. No. 60 ¶ 4.) Plaintiff filed Exhibit A under seal because Defendant designated the document as confidential pursuant to the parties' Protective Order. (Dkt. No. 70 at 4.) The Local Rules require the designating party to submit a declaration establishing grounds for sealing material it designated as confidential. See Civ. L.R. 79-5(e)(1). "Where a party fails to support sealing with the required declaration, the motion to file under seal should be denied." Marsh v. First Bank of Del., No. 11-cv-05226-WHO, at *1 (N.D. Cal. Jan. 13, 2014) (citation omitted); see also Wells Fargo & Co. v. ABD Ins. & Fin. Servs., No. 12-cv-3856-PJH, 2013 WL 897914, at *2-3 (N.D. Cal. Mar. 8, 2013) (same). Defendant did not provide such declaration, nor did he otherwise respond to the request to keep his income information under seal. Defendant therefore has failed to provide compelling reasons for sealing this information. Accordingly, the request to seal Exhibit A and Paragraph 6 of the Cruz Declaration is DENIED.
3. Portions of Jerome Declaration and Exhibit 1
Plaintiff next seeks to file under seal Exhibit 1 to the Jerome Declaration and portions of Paragraph 6 of that declaration that reference the exhibit. (Dkt. No. 70-5; Dkt. No. 63 ¶ 6.) Exhibit 1 is a PowerPoint presentation explaining Music Group's IT infrastructure, including detailed pictures of the company's servers, and suggesting plans for proposed changes. More specifically, as Westbrook avers, Exhibit 1(referenced as the document Bates stamped MG-0000032-58 in the Westbrook Declaration) "describes Music Group's internal network, external network entry points, wireless network SSIDs, backup strategies, equipment and software, and computing, network, and data capacities . . . together with recommendations for making changes." (Dkt. No. 104 ¶ 11.) Westbrook further attests that this is "the type of information a future attacker might find useful, especially to the extent Music Group implemented any of the suggested changes." (Id.) For the reasons described above in the context of Exhibit 6 to the Ahern Declaration, Plaintiff has offered compelling reasons to file this information under seal, and these reasons outweigh the public's interest in viewing this document because it was not relevant to the Court's resolution of the motion for summary judgment. Thus, the request to seal Exhibit 1 is granted. Likewise, for the "social engineering" concerns identified in the Westbrook Declaration, the request to seal portions of the Jerome Declaration is GRANTED as it references a third party not a party to this lawsuit.
4. Portions of Dibley Declaration and Exhibits 3-6
Next, Plaintiff seeks to seal four exhibits attached to the declaration of Alison Dibley ("Dibley Declaration") filed in support of its opposition to Defendant's motion for summary judgment, and portions of the Dibley Declaration that disclose information contained in those exhibits. As a threshold matter, the Dibley Declaration itself does not disclose any confidential information or any of the content of the exhibits it cites; instead, it only describes what the exhibit is and its Bates stamp, if applicable. (See Dkt. No. 61.) Indeed, Plaintiff filed the Dibley Declaration on the public docket. (Id.) Thus, there is no compelling reason to file any portion of the Dibley Declaration itself under seal.
a. Exhibit 3
Turning to the exhibits, Plaintiff seeks to file Exhibit 3 under seal in its entirety. Exhibit 3 is a document titled "IS and IT strategy document," which the Court understands to be Defendant's report identifying problems with Plaintiff's systems and making recommendations for improvements. (Dkt. No. 70-5 at 55-57.) Plaintiff contends that this exhibit "contains confidential proprietary information and trade secrets about Music Group's business operations and internal IT and IS systems; specifically . . . describ[ing] the method, technique and process of implementing improvements to Music Group's network infrastructure and IT." (Dkt. No. 70 at 4.) Plaintiff later added that this exhibit "should be filed under seal for the reasons articulated in . . . the Westbrook Declaration." (Dkt. No. 120.) The Court disagrees.
First, this is the same report that was filed on the public docket. (Dkt. No. 49-8 at 38-40; Dkt. No. 51-1 at 38-39.) Although Defendant clearly erred by failing to file the document under seal in the first instance because Plaintiff had designated it as confidential, see Civ. L.R. 79-5, Plaintiff's failure to alert either Defendant or the Court to this error indicates a lack of genuine concern over the public disclosure of the information, and therefore no legitimate particularized harm from its disclosure. This alone compels the conclusion that there is no compelling reason to seal this document in its entirety. Moreover, much of the information in Exhibit 3 describes Music Group's networks and systems in only the most general terms, without naming particular software or systems and without providing particular "network topology" or configurations that Westbrook warns would be useful to a hacker. Further, the Westbrook Declaration does not specifically address Exhibit 3 or identify it as the type of document that a hacker might find useful in perpetrating a cyber attack. And although Plaintiff avers generally that the information describes Music Group's IT information, Plaintiff has failed to establish that the information contained in the exhibit is kept confidential at Music Group; the document itself did not indicate that it was confidential, and Plaintiff does not attest that it was kept from disclosure outside Music Group, let alone disclosed only in a limited manner within the company.
On the other hand, the public has a significant interest in viewing the content of the document. The Court referenced the document in analyzing the scope of Defendant's job duties, which is relevant to whether Defendant was responsible for Music Group's cyber security. However, the Court did not explicitly rely on the content of the report in resolving the motion for summary judgment; there was no question that Defendant issued the report, the genuine issue of material fact remained whether Defendant had responsibilities beyond it. Thus, the public's interest in viewing the document at this time is not strong.
At bottom, on the present record, the Court cannot conclude that there are compelling reasons to seal Exhibit 3 in its entirety that outweigh the public's interest in its disclosure. The request to file Exhibit 3 is therefore DENIED without prejudice. Plaintiff shall have leave to file a supplemental declaration by July 10, 2015 setting forth why particular portions of Exhibit 3 must be filed under seal, including the extent to which the information contained in Exhibit 3 was kept confidential within Music Group, and why it has not waived its interest in maintaining the confidentiality of this document given that it has been filed on the public docket since April.
b. Exhibit 4
Exhibit 4 is a report prepared by Presidio Networked Solutions ("Presidio"), the company that Plaintiff hired to assist it in data and systems recovery in the wake of the cyber attack. (Dkt. No. 70-5 at 59-68.) Plaintiff produced the report as confidential during discovery. In addition, all pages of the report are marked "proprietary and confidential" and reference a statement titled "Restrictions on Disclosure and Use of Data" on the first page of the document, which states that the content of the document "shall not be disclosed outside the corporate entities name" in the document. (Id.) The report describes in detail the configuration of Music Group's networks and security systems, identifies particular vulnerabilities, describes its opinion of how the cyber attack was perpetrated, and offers specific recommendations to improve security, including particular configuration recommendations. (Id.) Plaintiff seeks to seal Exhibit 4 for the same reasons as Exhibit 3—because it contains confidential proprietary information and trade secrets about Music Group's IT and IS systems, including the method, technique and process of implementing improvements to Music Group's network infrastructure and IT." (Dkt. No. 70 at 4.) Westbrook did not specifically aver that Exhibit 4 is the type of document that a would-be cyber attacker would find useful. But in light of Defendant's objection, the Court did not consider Exhibit 4 in deciding Defendant's motion for summary judgment. (Dkt. No. 123 at 13.) Because the Court did not consider Exhibit 4 in connection with Defendant's dispositive motion, the Court will apply the "good cause" standard. See G&C Auto Body Inc. v. Geico Gen. Ins. Co., No. C06-04898 MJJ, 2008 WL 687372, at *3 (N.D. Cal. Mar. 11, 2008) (applying the good cause standard where documents submitted in connection with a dispositive motion were not actually considered); see also ASUS Comp. Int'l v. Round Rock Research, LLC, No. 12-cv-02099-JST, 2013 WL 5545276, at *3 (N.D. Cal. Oct. 8, 2013) (terminating as moot administrative motions to file under seal documents submitted in connection with motion for summary judgment where the court did not consider or rely upon the documents in resolving the dispositive motion). As the document contains sensitive information about Music Group's IT information, and there is very little public interest in disclosing the document, so the Court finds good cause to file the exhibit under seal. See id. (sealing document that was not "directly relevant to the legal issues that were raised by [defendant's] summary judgment motion[ ] or that were resolved by the Court" in part finding "no reason related to this litigation to place the document in the public record"). c. Exhibit 5
Exhibit 5 to the Dibley Declaration (Dkt. No. 68-3), is a portion of the deposition testimony of Music Group CEO Uli Behringer, which Plaintiff designated as confidential pursuant to the parties' Protective Order, and is largely the same portion that Defendant submitted as Exhibit 1 to the Ahern Declaration, discussed above. The redactions are limited to the names of the two employees suspected of perpetrating the cyber attack. These narrowly tailored redactions are appropriate to protect these individuals' compelling interest in protecting these individuals' privacy rights, as discussed above. See Icon-IP Ltd., 2015 WL 984121, at *3; Barnes, 2015 WL 1814293, at * 2-3. The request to keep these limited redactions under seal is therefore GRANTED.
d. Exhibit 6
Plaintiff seeks to file Exhibit 6 to the Dibley Declaration under seal in its entirety. Exhibit 6 is an email from a Presidio employee to Music Group discussing the cyber attack. (Dkt. No. 705 at 70-71.) Plaintiff failed to provide any explanation whatsoever for sealing this document in its administrative motion. (See Dkt. No. 70.) In the context of its motion to retain confidentiality designation, Plaintiff avers that this document "describes how the Cyber Attack was perpetrated by describing what remedial steps were critical" to system recovery. (Dkt. No. 120 at 13.) The Court did not rely on Exhibit 6 in resolving the motion for summary judgment, and therefore applies the good cause standard. See G&C Auto Body Inc., 2008 WL 687372, at *3. In doing so, given that the document contains significant information of the type the Westbrook Declaration identifies as useful to would-be hackers—i.e., specific details of Music Groups' networks, specific steps taken to render the network more secure after the cyber attack, and names of employees with access to those networks—the Court GRANTS the request to file this exhibit under seal in its entirety.
5. Portions of Rosell Declaration
Lastly, Plaintiff seeks to file under seal portions of the Rosell Declaration. (Dkt. No. 64.) The Court disregarded the Rosell Declaration. (See Dkt. No. 123 at 11.) Because the Court did not consider the Rosell Declaration in connection with Defendant's dispositive motion, there is no public interest in disclosing the document, so the Court GRANTS the motion to file under seal. See G&C Auto Body Inc., 2008 WL 687372, at *3.
D. Motion to File Under Seal Documents Related to Defendant's Reply in Support of his Motion for Summary Judgment (Docket No. 77)
Defendant seeks to file portions of his reply in support of his motion for summary judgment, as well as Exhibit 1 to the supporting Declaration of Jared Ahern, under seal. (Dkt. No. 77.) Exhibit 1 is the deposition testimony of Behringer on Music Group's behalf, which Plaintiff designated as confidential pursuant to the parties' Protective Order. (See Dkt. No. 77-1 ¶ 7.) It contains many of the same pages as Exhibit 1 to the Ahern Declaration filed in support of Defendant's motion for summary judgment, and Exhibit 5 to the Dibley Declaration filed in support of Plaintiff's opposition. Here, as with those other exhibits, the redactions are limited to the names of the two employees suspected of perpetrating the cyber attack. For the same reasons, these narrowly tailored redactions are appropriate to protect these individuals' compelling interest in protecting these individuals' privacy rights, as discussed above. See Icon-IP Ltd., 2015 WL 984121, at *3; Barnes, 2015 WL 1814293, at * 2-3. The request to file Exhibit 1 under seal is therefore GRANTED.
Defendant also seeks to file under seal portions of its reply that reference Exhibit 1 and "written discovery requests" that Plaintiff designated as confidential. (Dkt. No. 77 at 4.) The request is GRANTED with respect to the names of the two employees suspected of perpetrating the cyber attack. However, the request is DENIED with respect to information about a law enforcement investigation into the cyber attack. Similar to its arguments about Exhibit 4 to the Ahern Declaration, discussed above, besides generally referencing law enforcement, Plaintiff has not demonstrated the particularized harm that disclosing information about the investigation will cause, which is not enough to establish compelling reasons to seal this information. See Hesterberg, 2013 WL 6057068, at *2. As the names have been redacted, there is no privacy issue associated with revealing information about an individual's record.
The Local Rules require the submitting party to file the unredacted version indicating "by highlighting or other clear method" the material it seeks to file under seal. Civ. L.R. 79-5(1)(D). Defendant did not do so here, adding an extra step to the Court's analysis: comparing the redacted and unredacted versions to determine the information at issue. Once again, the Court directs both parties to comply with all requirements of the Local Rules, including those related to sealing.
E. Motion to File Under Seal Documents Related to Defendant's Motion to File Recently Produced Documents in Support of Motion for Summary Judgment (Docket No. 95)
Lastly, Defendant has moved to file under seal portions of his motion to file recently produced documents to supplement the summary judgment record along with six exhibits attached thereto—i.e., the six documents that Defendant sought to add to the record for the Court's determination of summary judgment. (Dkt. No. 95.) The exhibits are all employment agreements and job descriptions for other employees in Music Group's IT and IS Departments. Although the Court found the documents "relevant to whether Defendant was contractually responsible to prevent cyber attacks, and thus, to the questions of liability in this action" (Dkt. No. 123 at15), it did not rely on these documents in resolving Defendant's motion for summary judgment; instead it focused solely on the language in Defendant's own employment agreement. (See id. at 17-20.) Thus, the lower "good cause" standard for sealing applies. See G&C Auto Body Inc., 2008 WL 687372, at *3.
Plaintiff has since conceded that Exhibit 1—the job description for the position of "VP, Technology Operations"—is not confidential. (Dkt. No. 110 ¶ 4.) Thus, Defendant's motion to file Exhibit 1 under seal is DENIED.
Exhibits 2 through 6 are employment agreements. The Court has already held that "[e]mployment agreements are properly considered to be the type of 'personnel files' that are subject to the right of privacy in California." (Dkt. No. 79 at 4.) Thus, in the context of an earlier discovery dispute about production of these documents, the Court directed Plaintiff to produce the documents as confidential with the employee's personal information, compensation, and other financial information redacted. (Id. at 5-6.) Plaintiff reads that Order as rendering the entire document confidential and therefore sealable. Not so. Rather, as discussed in that Order, only personal information (name, date of birth, social security number, address, work history, telephone number) triggers a privacy right that creates good cause for sealing.
The exception is Exhibit 5, which is the job description document that was attached to Exhibit 6, an employment agreement. (See Dkt. No. 110 ¶ 5.)
Lastly, Defendant redacted four lines of his motion to file recently produced documents because the lines referenced information that Plaintiff designated as confidential. (Dkt. No. 95 at 2; Dkt. No. 95-4 at 5-6.) These redactions are overbroad. As discussed throughout this Order, only the names of the individuals at Music Group suspected of perpetrating the cyber attack need to be redacted—not the fact that Music Group took certain disciplinary action against its employees.
CONCLUSION
For the reasons discussed above, the Court GRANTS IN PART and DENIES IN PART the parties' administrative motions to file under seal.
1. On or before July 10, 2015, Defendant shall file Exhibit 4 to the Ahern Declaration on the public docket with redactions consistent with this Order. The only information that may be redacted is the name of the individuals.
2. On or before July 8, 2015, Plaintiff shall provide Defendant with Exhibit 7 to the Ahern Declaration which is narrowly redacted in accordance with this Order. Defendant shall file this new version of Exhibit 7 to the Ahern Declaration on the public docket on or before July 10, 2015.
3. On or before July 10, 2015, Defendant shall file on the public docket a new version of its Memorandum in Support of its Motion for Summary Judgment which is narrowly redacted consistent with this Order, that is, redacted to remove identifying information of the individuals.
4. On or before July 10, 2015, Plaintiff shall file on the public docket Exhibits E and F to the Behringer Declaration, and the Declaration itself (specifically paragraphs 13 and 14) narrowly redacted consistent with this Order.
5. On or before July 10, 2015, Plaintiff shall file on the public docket Exhibit A to the Cruz declaration and the Cruz declaration without paragraph six redacted.
6. If Plaintiff believes there are compelling reasons to seal portions of Exhibit 3 to the Dibley Declaration submitted in support of its Opposition to Defendant's Motion for Summary Judgment, on or before July 10, 2015, Plaintiff shall file a supplemental declaration consistent with this Order identifying specific portions of Exhibit 3 that it believes should be sealed, along with the compelling reasons for doing so.
7. On or before July 10, 2015, Defendant shall file on the public docket its Reply Memorandum in Support of Summary Judgment narrowly redacted consistent with this Order; that is, only redacted to seal the names of the two employees suspected of perpetrating the cyber attack.
8. On or before July 10, 2015, Defendant shall file on the public docket Exhibit 1 to its Motion to File Recently Produced Documents.
9. On or before July 10, 2015, Defendant shall file on the public docket Exhibits 2 through 6 to its Motion to File Recently Produced Documents narrowly redacted consistent with this Order; that is, only personal information may be redacted.
10. On or before July 10, 2015, Defendant shall file on the public docket its Motion to File Recently Produced Documents, narrowly redacted consistent with this Order; that is, all that shall be redacted is the names of the individuals suspected of involvement in the cyber attack.
This Order disposes of Docket Nos. 49, 57, 70, 77, 95.
IT IS SO ORDERED. Dated: June 30, 2015
/s/_________
JACQUELINE SCOTT CORLEY
United States Magistrate Judge