From Casetext: Smarter Legal Research

United States v. Collins

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION
Mar 15, 2013
Case No.: 11-CR-00471-DLJ (PSG) (N.D. Cal. Mar. 15, 2013)

Opinion

Case No.: 11-CR-00471-DLJ (PSG)

03-15-2013

UNITED STATES OF AMERICA, Plaintiff, v. DENNIS COLLINS, et. al., Defendants.


CORRECTED ORDER RE MOTION

TO QUASH AND/OR MODIFY

SUBPOENA AND FOR PROTECTIVE

ORDER


(Re: Docket No. 404)

In any federal criminal case a defendant may subpoena witnesses and documents to appear or be produced at trial. This right is guaranteed by the Sixth Amendment's compulsory process clause and given effect by Federal Rule of Criminal Procedure 17(a). In fact, the Federal Rules go one step further by recognizing that in some and perhaps many cases, a defendant needs documents well before trial in order to adequately defend himself against the government's charges. Federal Rule of Criminal Procedure 17(c) explicitly provides that "[a] subpoena may order the witness to produce any books, papers, documents, data, or other objects the subpoena designates. The court may direct the witness to produce the designated items in court before trial or before they are to be offered in evidence." What is less explicit is the extent to which such documents, data and the rest may be compelled, consistent with the court's authority under this very rule to "quash or modify the subpoena if compliance would be unreasonable or oppressive." The dispute now before the court requires an answer to this deceptively simply question.

In this case, the government charges Defendants Joshua Covelli ("Covelli"), Ethan Miles ("Miles") and others with conspiring to take down PayPal, Inc.'s ("PayPal") website with a Distributed Denial of Service ("DDoS") attack. Before the court is third parties eBay Inc. ("eBay") and PayPal's (collectively, "eBay") motion to quash or modify the identical subpoenas duces tecum served by Covelli and Miles. On February 7, 2013, the parties appeared for an extended hearing. Having considered the papers and arguments of counsel, eBay's motion is GRANTED-IN-PART.

I. BACKGROUND

In November 2010, WikiLeaks released classified United States State Department cables on its website, prompting PayPal to suspend WikiLeaks' donation accounts. On July 13, 2011, Covelli, Miles, Dennis Collins, Christopher Wayne Cooper, Keith Wilson Downey, Mercedes Renee Haefer, Donald Husband, Vincent Charles Kershaw, Drew Alan Phillips, Jeffrey Puglisi, Daniel Sullivan, Tracy Ann Valenzuela, and Christopher Quang Vo were indicted for conspiracy, intentional damage to a protected computer and aiding and abetting. Defendants are alleged to be members of Anonymous, an online collective of computer hackers motivated by political and social goals, who "avenged" PayPal's suspension of the WikiLeaks donation account by coordinating and executing a weeks-long DDoS attack on PayPal. A DDoS attack is an overload of external communications requests sent to the target network designed to slow down legitimate traffic.

See id.

See id.

See Docket No. 1.

See id.

See id.

In pretrial motions, Miles and Covelli asked permission to serve subpoenas on eBay pursuant to Rule 17(c). The proposed subpoenas included some 13 requests. The court granted permission as requested but without prejudice to any motion eBay might wish to file.

As anticipated, on January 17, 2013, eBay moved to quash and/or modify the subpoena and for a protective order on all information eBay is required to produce.

II. LEGAL STANDARDS

Because the two subpoenas at issue are identical for present purposes, the inquiry regarding each of the subpoenas under Rule 17(c) is the same.

In contrast to its broader cousin in civil procedure— Federal Rule of Civil Procedure 45—Rule 17(c) is narrow in scope. As the Supreme Court explained in Bowman Dairy Co. v. United States, "Rule 17(c) was not intended to provide an additional means of discovery," but rather "to expedite the trial" by giving a defendant the right to inspect items possessed by the government, including items provided by to the government by third parties. The result in Bowman Dairy was that the defendant was permitted to use Rule 17(c) to secure various documents withheld by the government but was not permitted to use a broad "catch-all" provision in the subpoena that was "not intended to produce evidentiary materials" and instead pursued "a fishing expedition to see what may turn up."

341 U.S. 214 (1951).

Id. at 221. See also United States v. MacKey, 647 F.2d 898, 901 (9th Cir. 1981); 2 Charles Alan Wright, Nancy J. King, Susan R. Klein, and Andrew D. Leipold, Federal Practice & Procedure S 274, at 242, 250 (explaining that Rule 17(c) "was not intended as a discovery device" and characterizing any such interpretation of the rule as a "distortion").

In United States v. Nixon, the only other Supreme Court case to consider Rule 17(c), the Court held that for the defendant to require production prior to trial, he must "clear three hurdles: (1) relevancy, (2) admissibility, and (3) specificity." Even then, a trial court must consider whether the materials are "otherwise procurable reasonably in advance of trial by exercise of due diligence," whether the defendant can "properly prepare for trial without such production and inspection in advance of trial," and whether "the failure to obtain such inspection may tend unreasonably to delay the trial."

United States v. Nixon, 418 U.S. 683, 699-700 (1974).

Id. at 699.

While other courts have suggested that the Supreme Court's evidentiary restrictions on Rule 17(c) subpoenas apply only to subpoenas on the government, the Ninth Circuit has specifically rejected this view and applied its teachings where, as here, the subpoena target is a third party.

See, e.g., United States v. Tomison, 969 F. Supp. 587 (E.D. Cal. 1997).

See United States v. Fields, 663 F. 2d 880, 881 (9th Cir. 1981) ("[W]e see no basis for using a lesser evidentiary standard merely because production is sought from a third party rather than from the United States."); United States v. Reyes, 239 F.R.D. 591, 597 n. 1 (N.D. Cal. 2006) (citing Fields and characterizing the Tomison discussion as dicta).

A Rule 17(c) subpoena may be quashed or modified if it calls for privileged material.

See Reyes, 239 F.R.D. at 598.

"Enforcing or quashing Rule 17(c) subpoenas is within the discretion of the trial judge and will not be disturbed unless arbitrary or without support in the record."

United States v. Reed, 726 F.2d 570, 577 (9th Cir. 1984) (citing Nixon, 418 U.S. at 702).

III. DISCUSSION

A. The Sufficiency of the Subpoenas

The subpoenas seek a wide array of information in eBay's possession about the attack it is alleged to have suffered. eBay is commanded to produce each of the following items:

1. All documents as defined in Federal Rules of Evidence 1001(1) including written and electronic mail maintained by eBay/PayPal mentioning or relating to distributed denial of service attacks ("DDOS") on PayPal sites and systems occurring from November 20, 2010 to December 30, 2010.
2. All documents, including written and electronic mail, and including notes or memoranda of meetings or conversations relating to evaluation of loss or damage caused by DDOS attacks referenced above, including but not limited to investigation and communication related to the preparation of the SEC Form 8-K report dated 1/19/11 and SEC Form 10-K report for the fiscal year ending 12/31/2010.
3. All documents as defined in Federal Rules of Evidence 1001(1) including written and electronic mail and notes or memoranda of meetings or conversations reflecting PayPal/eBay investigations of the above referenced DDOS attacks, including but not limited to investigation by PayPal/eBay employees, consultants and contractors.
4. All chat room logs or recordings relating to the above referenced DDOS attacks gathered by PayPal/eBay employees, consultants or contractors or provided to PayPal/eBay by any third parties.
5. All summaries of chat room conversations prepared by PayPal employees, contractors or consultants.
6. All communications between PayPal employees, consultants or contractors and law enforcement relating to the above referenced DDOS attacks.
7. All public communications, including but not limited to press releases, relating to the above referenced DDOS attacks.
8. Documentation of PayPal's network architecture as it existed in November and December of 2010, including but not limited to network maps, CPU load sharing hardware and software, network traffic load sharing hardware and software, and security hardware and software.
9. Documentation of the public and private IP addresses of all servers and network hardware that received traffic as a result of the above referenced DDOS attacks.
10. The model information and hardware specification of all servers that received traffic as a result of the DDOS attacks referenced above.
11. Individual and aggregate CPU load logs and reports of all servers and other hardware claimed to have received traffic from the above referenced DDOS attacks.
12. Individual and aggregate network load and traffic logs and reports of the routers, switches, and network cards or other network hardware claimed to have received traffic from the above referenced DDOS attacks.
13. All information, whether in the form of logs or reports, collected by the Radware security device between November 1, 2010 and December 31, 2010.
The documents requested thus fall into five broad categories: documents discussing the DDOS attacks originating within eBay/PayPal; chat logs gathered by eBay/PayPal; PayPal financial loss information; information relating to Paypal's network architecture, servers, and hardware; CPU load logs, network load logs, and logs of the Radware security device.

As an initial matter, Covelli and Miles suggest that the court's approval of the issuance of the subpoenas ends the Bowman Dairy and Nixon inquiry. But nothing in any case the court has uncovered suggests this, such that a court may avoid the inquiry in evaluating any motion to quash or modify that follows.

Having considered the sufficiency of each of the categories of requested documents, the court must conclude that, for all but a few discrete categories, Covelli and Miles fall short of the standards imposed by Rule 17(c). As an initial matter, as proponents of the subpoenas at issue, Covelli and Miles bear the burden of providing a "rationale inference" that the information sought is relevant, admissible and specific. There are undoubtedly relevant, and perhaps highly relevant, materials among those called for in the subpoenas—Covelli and Miles target the very DDOS attack that are at the heart of the federal indictment confronting them. Not even eBay seriously questions that, for example, communications internal to eBay and financial records concerning eBay's losses from the attack are material to their criminal prosecution. But where Covelli and Miles fall short is with respect to the second and third hurdles under Nixon: admissibility and specificity.

See Nixon, 418 U.S. at 700; Reed, 726 F.2d at 577; United States v. Eden, 659 F.2d 1376, 1381 (9th Cir. 1981).

Consider admissibility. Many of the requested categories of documents explicitly call for inadmissible hearsay. Statements are inadmissible hearsay if they are offered in evidence to prove the truth of the matter asserted. For example, requests three, four, five and six are only relevant to the elements of the charged offenses for hearsay purposes - to prove the effects of the DDOS attacks or the harm suffered. To the extent certain requests ask for summaries of such communications, they are double-hearsay. While one could imagine these materials might qualify for one or more of the many exceptions to the hearsay rule, such as present sense impressions or business records, Covelli and Miles offer no such justification anywhere in their papers or oral argument. And certain materials plainly do not qualify. For example, any one-time financial evaluation of the loss or damage caused by what this unusual and perhaps unprecedented event at eBay "lack[s] the hallmarks of reliability that justify the admission of run-of-the-mill business records."

Next consider specificity. The subpoenas are under any reasonable view enormous in scope. For example, requests one, three, six, and seven ask for "all" "documents" and "communications" relating to DDOS attacks that took place over several weeks at company with thousands of employees in dozens if not hundreds of locations. As another example, in requests eight, nine, and ten Covelli and Miles seek documentation of the entirety of PayPal's network architecture, servers, and hardware, right down the model number and specification of each and every server that received even one packet of data as a result of the DDOS attack. While the court is sympathetic that the defense may have no other means of accessing such information, this would appear to be exactly the type of fishing expedition that Bowman Dairy, Nixon and their progeny in the Ninth Circuit require this court to prevent. As Judge Breyer noted in Reyes, such "any and all" requests are particularly suspect in any Rule 17(c) analysis.

See id. at 606 ("A demand for 'any and all documents relating to several categories of subject matter... rather than specific evidentiary items,' suggests the subpoena's proponent 'seeks to obtain information helpful to the defense by examining large quantities of documents, rather than to use Rule 17 for its intended purpose—to secure the production for a court proceeding of specific admissible evidence.'") (quoting United States v. Louis, Case No. 04-CR-203 (LTS), 2005 WL 180885, at *5 (S.D.N.Y. Jan. 27, 2005)); see also United States v. Jackson, 155 F.R.D. 664, 668 (D. Kan. 1994).

Finally, among their requests, Covelli and Miles demand any eBay/PayPal press releases regarding the DDOS attacks. These documents are publicly available and thus plainly not proper subjects of a subpoena request.

See Nixon, 418 U.S. at 699.

The only requests that avoid these fatal flaws are requests eleven, twelve and thirteen, at least to the extent they seek log and reports of the attack between November 20 and December 30, 2010. Their relevance is self-evident. The logs are admissible because such computer-generated logs are long-recognized to avoid the rule against hearsay under the business records exception. And the limitation to the period of the attack is specific. By eBay's own admission, this information is complex, which weighs in favor of compelling production at a time before trial in order to give Defendants' adequate time to process and analyze the logs. If produced right before trial, Defendants would likely be harmed because they would not have time to process the information and adequately prepare for trial.

See, e.g., United States v. Bonallo, 858 F.2d 1427, 1435 (9th Cir. 1988).

See Nixon, 418 U.S. at 699.

See id.

Ultimately, and except as noted, the subpoenas cast too wide a net rather than naming specific, admissible fish. Rightly or wrongly, Rule 17(c) as interpreted by the appellate courts does not permit such a practice. eBay's motion is granted; the subpoena shall be treated as modified consistent with the discussion above.

B. The Request for a General Protective Order

Having ordered eBay to make a production, albeit a limited one, the court must next consider eBay's request for a general protective order governing its production. As the party requesting the order, eBay bears the burden to establish good cause for the restrictions it requests. The scope of this eBay's proposed protective order is somewhat unclear - while eBay's motion and the preamble of the protective order refer only to the subpoenas served by Miles and Covelli, the order defines and binds "Counsel" as all counsel on record for each defendant, and "Defendants" as all defendants named in this action. It therefore appears that the proposed order would affect the rights of all defendants in this case.

See Docket No. 405, Ex. C.

United States v. Wecht, 484 F.3d 194, 211 (3d Cir. 2007).

See id.

Unfortunately, at least as of January 23, 2013, the deadline for any written response, twelve of the defendants other than Miles and Covelli were not properly served with eBay's motion for a protective order. This infringement of the remaining defendants' due process right to respond meaningfully to eBay's motion gives the court, to put it mildly, pause.

See Docket No. 413.

But even putting aside these procedural deficiencies, eBay's proposed protective order fails for a more fundamental reason: it is unduly burdensome. The proposed protective order allows eBay to label any subpoenaed documents as "Highly Confidential" or "Highly Confidential -Attorney's Eyes Only" without prior review by the court. The defendants and their attorneys would then be severely restricted in using not only the documents themselves, but also "any testimony, conversations, or presentations by Parties or their Counsel that might reveal Protected Material." If the defendants wish to submit any designated materials to the court, they would first have to seek eBay's written approval, and then if that is unsuccessful move to compel eBay to do so.

See Docket No. 405, Ex. C at ¶ 2.1.

See id. at ¶ 9.

While such an approach may be acceptable and even common in civil cases, eBay has not made particularized showings of injury to justify such restrictions on the defendants in this criminal case. Regarding the documents in this case, eBay states broadly that "there can be no legitimate dispute that many of the documents... are extremely sensitive in nature." But broad, unsubstantiated allegations of harm will not meet the good cause standard. Especially in light of the narrow production now required, a blanket protective order allowing eBay to prevent the disclosure of any documents produced in this litigation is unjustified.

See United States v. Lee, 374 F.3d 637, 652 (8th Cir. 2004) ("As a general rule counsel cannot be prevented from assisting the accused during a critical stage of the proceeding or be banned from all communications with the defendant for any period of time.") (citing Geders v. United States, 425 U.S. 80, 91 (1976)).

Docket No. 404 at 20.

See id.
--------

IV. CONCLUSION

eBay's motion to quash or modify the subpoenas is GRANTED. Production consistent with this order shall be completed by March 31, 2013.

eBay's motion for a general protective order is DENIED.

IT IS SO ORDERED.

____________________

PAUL S. GREWAL

United States Magistrate Judge


Summaries of

United States v. Collins

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION
Mar 15, 2013
Case No.: 11-CR-00471-DLJ (PSG) (N.D. Cal. Mar. 15, 2013)
Case details for

United States v. Collins

Case Details

Full title:UNITED STATES OF AMERICA, Plaintiff, v. DENNIS COLLINS, et. al.…

Court:UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION

Date published: Mar 15, 2013

Citations

Case No.: 11-CR-00471-DLJ (PSG) (N.D. Cal. Mar. 15, 2013)