Anonymity. Although the personal privacy interest in controlling the disclosure of an individual's identity is evident, often overlooked is the significance of anonymity in fostering individuality through free expression. The protection afforded by anonymity is magnified in the context of the Internet, because of the non-quantifiable number of opportunities to both publish and to receive information (Sobel, 2000). As has been noted by many, the expressive power of the Internet, although long appreciated by its users, has only recently attained constitutional status when the USSupreme Court handed down its decision in Reno v. ACLU, defining the scope of the Internet’s First Amendment protection and finding:
‘no basis for qualifying the level of First Amendment scrutiny that should be applied to this medium’ (521 US844, 870 (1997), aff'd, 929 F. Supp. 824 (E.D. Pa. 1996).
Despite the invocation of the First Amendment, anonymity cannot be considered an absolute guarantee of free expression when that expression serves to advocate damaging, illegal, or indefensible conduct. The nondisclosure of identity is often times critical for Internet message posters, particularly when engaged in discussions or postings that include topics concerning corporate financial shenanigans, marketplace deception, employment discrimination, and questionable business practices. When such messages stray into the area of criminal activity, the Electronic Communications Privacy Act (‘EPCA’)5 is available to federal law enforcement authorities seeking the actual content of a communication, such as the actual text of an email message or posting. With the oversight provided by judicial scrutiny, law enforcement authorities can request the issuance of a warrant and a subpoena, if necessary, to compel ISPs to disclose information that identifies a particular Internet user or subscriber. Heretofore, law enforcement use of the ECPA has occasionally raised Constitutional concerns regarding privacy and unlawful seizures, but such concerns have largely been muted by the impact of the September 11th terrorist attacks in the United States.
What remains, however, is serious concern regarding non-governmental, non-law enforcement access to user identity information and whether the language of the ECPA fosters such access where it provides that an ISP:
‘may disclose a record or information pertaining to a subscriber...to any person other than a governmental entity’(emphasis added) (18 U.S.C.S. 2703(c)(1)(A)).
The extent to which such disclosure threatens First Amendment privacy rights is the focus of legislative discussion in the US Congress where the Consumer Internet Privacy Protection Act of 1999 has been introduced in the US House of Representatives in an attempt to limit the distribution of personal information by an ISP (1999 H.R. 313; 106 H.R. 313).
Nevertheless, the growth of the Internet and its ubiquitous nature combined with the perceived urgency of those other than criminal investigators seeking to unmask online anonymity poses serious challenges to issues involving personal privacy and the lack of statutory protection afforded by the ECPA. Increasingly, civil lawsuits are being filed by corporations that have been the targets of critical information posted to online message boards, hosted at websites such as The Motley Fool, Yahoo! Finance, and others, seeking the identity of, and information about, anonymous Internet users. Often times financially-related websites provide readily accessible forums for the exchange of misleading, damaging, or self-serving information on publicly traded companies. Companies concerned about the dissemination of information that is considered damaging and the effects of such dissemination in the marketplace, particularly on stock prices (Keaveney, 2001), are going to court and filing lawsuits against unnamed, or ‘John Doe’ defendants, seeking to unmask their anonymity in order to assert damage claims allegedly resulting from anonymous postings. Disgruntled employees, dissatisfied investors, critical financial commentators, and others are potentially exposed to civil causes of action ranging from defamation and breach of contract to misappropriation of proprietary information.
The principal concerns that emerge from these corporate civil suits are the degree to which due process and matters of fundamental fairness and privacy can be compromised. Routinely, when a corporation files a civil complaint, a subpoena is served on an ISP or message board owner/ operator by plaintiff's counsel seeking the identity and related information about the anonymous online poster. The ISP may, or may not, notify their user that a subpoena has been received. When notice is provided, the user is presumably provided an opportunity to challenge the process in an attempt to quash the subpoena. The legal costs and expenses associated with such challenges, the time constraints posed by the judicial process, and the degree of success anticipated are all issues and matters that have to be carefully considered by users seeking to preserve their anonymity.
More often than not, ISPs receiving a court subpoena will simply comply as a matter of course, without any form of notice to the affected user. As a result, the user has no opportunity to quash the subpoena and the courts have no role in evaluating the propriety of the request for the identifying information sought. It is this precise absence of judicial involvement and adversarial opportunity that exposes the process of discovering the identity of anonymous users to abuse. The delicate balance between the legitimate interests and concerns of corporations seeking identifying information and the instances of potentially abusive discovery is not easily maintained; nevertheless, the risk from current legal standards that allow for lawsuits of questionable merit to be filed simply to obtain the identify of anonymous users can easily fall into the gap of unintended consequences that can stifle, deter, or eventually silence even justifiable corporate criticism.
Emerging from the hundreds of lawsuits being filed by corporate plaintiffs eager to discover the identity of anonymous Internet users is a core of legal theories that center on arguments in support of defamation, and the unauthorized use of proprietary information. This latter theory is often supplemented by claims of breach of an employment contract, whether oral or written. In defense, users have asserted arguments premised on First Amendment claims of free expression and invasion of privacy, and on notions of fundamental due process, particularly when the discovery of their identity results in an employment termination. Of equal concern is the degree to which the allegedly wrongful statements actually pose a viable cause of action. This latter is most often posed in the context of a defense to a defamation claim and the need for the plaintiff to show actual harm in order to proceed. The degree to which courts will invoke a requirement of actual harm before permitting a plaintiff to proceed on a discovery claim is currently under debate, but seems to be an evolving decisional theory that is gaining support as the result of the Dendrite International holding discussed later in this paper.