Facebook, Inc. v. John Does 1-10

Filing 4

Facebook, Inc. v. John Does 1-10

Doc. 4

Case 5:07-cv-03404-HRL

Document 4

Filed 07/03/2007

Page 1 of 5

1 2 3 4 5 6 7 8 9 10 11 12 13

Lisa D. Olle, Bar No. 228551 [e-mail] PERKINS COIE LLP Four Embarcadero Center, Suite 2400 San Francisco, CA 94111-4131 Telephone: [phone] Facsimile: 415.344.7050 Attorneys for Plaintiff FACEBOOK, INC.

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION

FACEBOOK, INC., a Delaware corporation, Plaintiff,

Case No. C-07-03404 HRL MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION FOR LEAVE TO TAKE DISCOVERY ON ACCRETIVE TECHNOLOGY GROUP, INC. AND FCI, INC. Date: Time: Dept.: Before: August 14, 2007 10:00 a.m. 2, 5th Floor Honorable Howard R. Lloyd

14 v. 15 16 17 18 19 20 21 22 23 24 25 26 27 28 I. JOHN DOES 1-10, individuals; and JOHN DOES 11-20, corporations, Defendants.

INTRODUCTION

Between or before June 1, 2007 and June 15, 2007, John Does 1-10 or John Does 11-20, used Internet Protocol Address ("IP address") 216.127.50.20, to access without authorization or in excess of authorization FACEBOOK, INC.'s ("Facebook") proprietary computer system more than 200,000 separate times. Facebook moves this Court for an order allowing it to obtain discovery from third-parties Accretive Technology Group, Inc. ("Accretive") and FCI, Inc. ("FCI") who are the Internet Service Providers that are responsible for the IP address

MEMORANDUM OF POINTS AND AUTHORITIES ISO MOTION FOR LEAVE TO TAKE DISCOVERY ON ACCRETIVE TECHNOLOGY GROUP, INC. AND FCI, INC.

CASE NO. C-07-03404 HRL

Dockets.Justia.com

Case 5:07-cv-03404-HRL

Document 4

Filed 07/03/2007

Page 2 of 5

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

216.127.50.20, in order to obtain information into the identity of the persons responsible for the unauthorized access of Facebook's computer system. Through its investigation Facebook determined that the computer server from which the unauthorized access on Facebook's computer system originated is located at the Accretive facility. Because there is likely to be information on this computer server that will assist in the identification of responsible persons, and that this information is ephemeral and likely to be destroyed, Facebook requests that it be permitted to obtain server logs in Accretive and FCI's possession, custody, or control related to IP address 216.127.50.20. In the event that Accretive or FCI are unwilling or unable to provide these records, Facebook requests authorization to permit a forensic expert (at Facebook's expense) to inspect and access the server handling IP address 216.127.50.20 in order to obtain an image thereof, and to analyze the image in order to extract the server logs for the purpose of assisting Facebook in learning the true identity of John Does 1-20. I. STATEMENT OF FACTS

On June 28, 2007, Facebook filed its complaint against John Does 1-10 and John Does 11-20 ("John Doe"). Facebook alleges that between or before June 1 and June 15, 2007, John Doe accessed without authorization, or in excess of their authorization, Facebook's proprietary computer system at http://www.facebook.com more than 200,000 times from a single IP address in violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 and the California Comprehensive Data Access and Fraud Act, Cal. Penal Code § 502(c). Each and every communication on the Internet is associated with a unique IP address that identifies the computer sending the communication as well as a unique IP address that identifies the intended recipient of the communication. Facebook used publicly available Internet resources and tools to determine the IP address from which the access emanated and the identities of the Internet service providers that are responsible for administering the IP addresses at issue. The IP address 216.127.50.20 is associated with all 200,000 requests targeting Facebook's proprietary computer system and is assigned to Accretive Networks Inc. Complaint ¶¶ 14-15; Declaration of James R. McCullagh (McCullagh Decl.) ¶ 2, Exh. A (ARIN WHOIS query results -2MEMORANDUM OF POINTS AND AUTHORITIES ISO MOTION FOR LEAVE TO TAKE DISCOVERY ON ACCRETIVE TECHNOLOGY GROUP, INC. AND FCI, INC. Case No. C-07-03404 HRL

Case 5:07-cv-03404-HRL

Document 4

Filed 07/03/2007

Page 3 of 5

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

for IP address 216.127.50.20). Facebook reported the unauthorized activity originating from IP address 216.127.50.20 to Accretive and was informed that Accretive blocked the offending IP address from accessing IP addresses associated with Facebook's proprietary computer system. Complaint ¶ 16. Thereafter, John Doe has continued to attempt to access the Facebook computer system without authorization. Id. On June 15, 2007, Facebook requested that Accretive and FCI preserve and produce to it all evidence related to the use of the offending IP address's unauthorized attempts to access Facebook. McCullagh Decl. ¶ 3, Exh. B (Preservation Letters sent to Accretive and FCI on June 15, 2007). Subsequent communications with Accretive indicate that the server responsible for handling IP address 216.127.50.20 is located on Accretive's premises and under its control, but may not belong to Accretive. McCullagh Decl. ¶ 5. Accretive representatives are not willing to voluntarily provide Facebook with a copy of the server log from the computer server handing IP Address 216.127.50.20. McCullagh Decl. ¶ 4. Accretive representatives identified the customer that controlled IP Address 216.127.50.20 during the period from March 15 through June 20 as "Dilyweb Limited," and provided Facebook with incomplete and circumspect contact information for Dilyweb Limited in either Cyprus or Ontario, Canada. McCullagh Decl. ¶ 5. Accretive provided no further information regarding the identity or contact information for "Dilyweb Limited." Id. Facebook believes that there is likely to be additional information residing on the subject server that will assist in the identification of John Doe and that this information is relevant to the allegations contained in its Complaint. Facebook has no reasonable means to obtain the information related to the identity of John Doe without access to the information in Accretive and FCI's possession as well as access to the information contained on the subject server. II. ARGUMENT

There is good cause for the Court to authorize discovery from both Accretive and FCI, including the release of the information described in Attachment A of the proposed subpoena attached to the McCullagh Decl.; or access to image and analyze the data from the server's hard drive as described in Attachment B of the same subpoena. McCullagh Decl. ¶ 8, Exh. C. -3MEMORANDUM OF POINTS AND AUTHORITIES ISO MOTION FOR LEAVE TO TAKE DISCOVERY ON ACCRETIVE TECHNOLOGY GROUP, INC. AND FCI, INC. Case No. C-07-03404 HRL

Case 5:07-cv-03404-HRL

Document 4

Filed 07/03/2007

Page 4 of 5

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Facebook has grounds to proceed with its suit against John Doe. To do so, Facebook must learn John Doe's identity. Facebook has no reasonable means available to identify John Doe other than from logs residing on the server or from information held by Accretive and FCI. To the extent leave of Court is needed under Federal Rule of Civil Procedure 26(d) to take immediate discovery, including serving the proposed subpoena, such leave should be granted. No parties have yet been named so it would be impossible to hold a conference of counsel under Rule 26(f). Furthermore, time is of the essence in order to ensure that Accretive, FCI, or the owner of the server do not delete relevant information. See McCullagh Decl. ¶ 7. Unless discovery is allowed to determine defendants' identities, this matter could never proceed. Facebook attempted to obtain this information as part of its pre-complaint investigation, but Accretive/FCI declined to voluntarily provide the requested information. In the event that Accretive/FCI continue to refuse to produce the server logs from the computer server that was associated with IP 216.127.50.20 during the subject time period, Facebook requests permission from the court to obtain an image of the hard drive for the sole purpose of extracting the server logs and any other information relevant to the true identity of John Doe. Facebook has no other way in which to reliably obtain this information. The computer server is physically located and under the control of Accretive, and the owner of the server has hidden his identity by providing incomplete registration information for its domain registration. McCullagh Decl. ¶ 5-6. Facebook is proposing a method of staged discovery that provides Facebook with a reasonable opportunity to discover the information on the computer server, while at the same time minimizing the inconvenience on Accretive/FCI, and protecting the privacy interests of the information that may be located on the subject computer server. Only if Accretive is unable to provide the information sought in the subpoena will Facebook's forensic expert image the server's hard drive in a relatively short amount of time. Then, Facebook's forensic expert will only disclose information to Facebook that is relevant to the allegations of the underlying complaint, without disclosing private communications or other unrelated data without further Court permission. Following such a procedure will delay Facebook's investigation slightly, but -4MEMORANDUM OF POINTS AND AUTHORITIES ISO MOTION FOR LEAVE TO TAKE DISCOVERY ON ACCRETIVE TECHNOLOGY GROUP, INC. AND FCI, INC. Case No. C-07-03404 HRL

Case 5:07-cv-03404-HRL

Document 4

Filed 07/03/2007

Page 5 of 5

1 2 3 4 5 6 7 8 9 10 11 12 13 14

will strike a proper balance between the privacy and rights, if any, of the information located on the subject server and Facebook's rights to discover evidence of wrongdoing against it on the other. Unless discovery on both Accretive/FCI and the server itself is allowed to determine the defendants' identities, this matter could not proceed. II. CONCLUSION

For the reasons set forth above, the Court should grant FACEBOOK's motion for leave to take immediate discovery on Accretive and FCI.

DATED: July 3, 2007

PERKINS COIE LLP By: /s/ Lisa D. Olle

Attorneys for Plaintiff FACEBOOK, INC.

60406-0005/LEGAL13348812.5

15 16 17 18 19 20 21 22 23 24 25 26 27 28 -5MEMORANDUM OF POINTS AND AUTHORITIES ISO MOTION FOR LEAVE TO TAKE DISCOVERY ON ACCRETIVE TECHNOLOGY GROUP, INC. AND FCI, INC. Case No. C-07-03404 HRL