Flynn et al v. FCA U.S., LLC et al

Filing 30

ORDER GRANTING 1 Motion to Quash. Signed by Magistrate Judge Donald G. Wilkerson on 11/30/16. (sgp)

IN THE UNITED STATES DISTRICT COURT
FOR THE SOUTHERN DISTRICT OF ILLINOIS
BRIAN FLYNN et al.,
Plaintiffs,
v.
FCA U.S. LLC and HARMAN
INTERNATIONAL INDUSTRIES, INC.,
Defendants,
v.
AUTO-ISAC, INC.,
Interested Party.

)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)

Case No. 16-mc-00078 DGW

ORDER
WILKERSON, Magistrate Judge:
Now pending before the Court is the Non-Party Auto-ISAC Inc.’s Motion to Quash Third
Party Subpoena and the Memorandum of Law in support (Doc. 1). Plaintiffs responded with a
Memorandum in Opposition (Doc. 10). Auto-ISAC, Inc. then filed a Reply in Support of its
Motion (Doc. 13).1 This matter is fully briefed and before the Court.
BACKGROUND
In 2015, Plaintiffs, all owners or lessees of Chrysler vehicles, brought suit against
Chrysler and Harmon International Industries, seeking to sue on their own behalf and on behalf
of a number of other vehicle owners similar to them. Their suit concerns an alleged design flaw
in some of Chrysler’s 2013-2015 vehicles that received public attention in a 2015 WIRED
magazine article. The vehicles in question are equipped with a uConnect system, manufactured
1

This matter was originally filed in the United States District Court for the District of Columbia
on September 27, 2016; however, on November 2, 2016, that court transferred the matter to the
Southern District of Illinois.
Page 1 of 6

by Harmon International, that allows integrated control over the phone, navigation, and
entertainment functions throughout the vehicle. Per the Plaintiffs, the uConnect system turns the
affected vehicles into rolling deathtraps: the uConnect system has design vulnerabilities that
allow hackers to take remote control of the vehicle’s functions, including the vehicle’s steering
and brakes, to comical or disastrous effect. The WIRED article contributed to a voluntary recall
by Chrysler, depending on how one sees things. Despite the recall, however, the Plaintiffs
maintain that the affected vehicles still have a number of vulnerabilities that would allow hackers
to access the vehicles’ critical and non-critical systems. Those ongoing vulnerabilities led the
Plaintiffs to file a class complaint (15-cv-855 MJR/DGW) in this Court, seeking monetary
damages and injunctive relief.
Auto-ISAC is a non-profit organization that was incorporated on August 17, 2015 and is
headquartered in Washington, D.C. Doc. 1-1, p. 3; Doc. 13, p. 19. The automotive industry
created Auto-ISAC “to play an important role in promoting cybersecurity throughout the
automotive industry.” Doc. 1-1, p. 5. In August, 2016, Plaintiffs served a subpoena seeking
certain documents and communications on Auto-ISAC’s registered agent in Delaware. Id. at 6.
After a back-and-forth conversation between Plaintiffs’ counsel and Auto-ISAC’s counsel, the
parties agreed that the subpoena would be served on Auto-ISAC’s counsel in Washington, D.C.
and that it would be limited to (1) “Documents reviewed, considered, published or otherwise
related to Auto-ISAC’s creation of the automotive cybersecurity ‘Best Practices’ which was
published in the summer of 2016” and (2) Communications with FCA from June, 2010 to the
present.” Id. at 6-7; App. L, Doc. 3. Auto-ISAC subsequently moved this Court to quash the
subpoena, arguing that it seeks irrelevant information, that Auto-ISAC’s compliance with the
subpoena would subject it to an undue burden, and that the subpoena calls for the improper

Page 2 of 6

disclosure of its confidential and proprietary information. See generally Doc. 1. Plaintiffs, in
turn, request that this Court deny the motion to quash.2
LEGAL STANDARD
Rule 45 of the Federal Rules of Civil Procedure, states in pertinent part:
(d) Protecting a Person Subject to a Subpoena; Enforcement.
***
(3) Quashing or Modifying a Subpoena.
(A) When Required. On timely motion, the court for the district
where compliance is required must quash or modify a
subpoena that:
(i) fails to allow a reasonable time to comply;
(ii) requires a person to comply beyond the geographical
limits specified in Rule 45(c);
(iii) requires disclosure of privileged or other protected matter,
if no exception or waiver applies; or
(iv) subjects a person to undue burden.
ANALYSIS
Non-Party Auto-ISAC asks the Court to quash the subpoena served on it because (1) the
material sought is not relevant to the underlying claims in 15-cv-855 MJR/DGW and (2) the
subpoena imposes an undue burden on it. It is without question that a party has a general right to
subpoena any person to appear at a deposition or to produce documents for inspection and
copying. FED.R.CIV.P. 45. However, this right is not limitless: Rule 45(d) provides protections
for individuals subject to subpoena. Under Rule 45(d)(3)(A)(iv), upon timely motion, the issuing
Court must quash or modify a subpoena that “subjects a person to undue burden.”

In

determining what constitutes an undue burden, courts have used a reasonableness standard. See,
McKevitt v. Pallasch, 339 F.3d 530, 533 (7th Cir. 2003) (“rather than speaking of privilege,
2

The response, originally filed in the District of Columbia, asked for alternative relief of transfer
to this Court, which was done; therefore, that issue is moot and will not be addressed.
Page 3 of 6

courts should simply make sure that a subpoena duces tecum directed to the media, like any
other subpoena duces tecum, is reasonable in the circumstances, which is the general criterion for
judicial review of subpoenas”); CSC Holdings, Inc. v. Redisi, 309 F.3d 988, 993 (7th Cir. 2002);
EEOC v. Sidley Austin Brown & Wood, 315 F.3d 696, 700 (7th Cir. 2002).
The question of what is reasonable, of course, depends upon the particular circumstances
of the case. Auto ISAC is a non-party and entitled to “somewhat greater protection” than would
a party be in these circumstances. See Patterson v. Burge, No. 03 C 4433, 2005 WL 43240, *1
(N.D .Ill. 2005).

“Ultimately, the Court must balance the burden of compliance against the

benefits of the requested production, and the benefits of the requested production must outweigh
the burden of compliance with the subpoena.” Thayer v. Chiczewski, 257 F.R.D. 466, 469–70
(N.D. Ill. 2009) (editing and quotation marks omitted), quoting Northwestern Memorial Hospital
v. Ashcroft, 362 F.3d 923, 930–31 (7th Cir. 2004) and Patterson, 2005 WL 43240 at *1.
Plaintiffs seek documents reviewed, considered, published or otherwise related to AutoISAC’s creation of the automotive cybersecurity ‘Best Practices’ which was published in the
summer of 2016 and communications with FCA from June, 2010 to the present. They argue that
Auto-ISAC is “likely” to be one of the best sources for information about automotive
cybersecurity. The Court is not persuaded. Alternatively, Plaintiffs ask that the requested
documents be produced subject to the standing protective order in place in the underlying case or
a new protective order be fashioned by the Court. Neither solution is necessary.
Plaintiffs request appears to the Court to be nothing more than a fishing expedition where
the fish are complaining and the fisherman provides no convincing explanation.

As stated in

their brief “. . . [t]hese documents are potentially crucial pieces of the puzzle in the Underlying
Action regarding the state of cybersecurity in the automotive industry and the industry’s

Page 4 of 6

knowledge of and responses to perceived or known threats.” Doc. 10, pp. 10-11. While that
may be Plaintiffs’ theme in the case, what remains before the Court are discreet claims for
breach of warranty under the Magnuson-Moss Warranty Act, fraud (concealment/omission),
unjust enrichment and violations of state consumer protection laws. Non-party Auto-ISAC
should not be required to act as an expert for Plaintiffs on the state of cybersecurity in the
automotive industry. Indeed, Plaintiffs acknowledge that some, if not most, of the material
sought from Auto-ISAC is publicly available. Plaintiffs assert, without any basis that the Court
can determine, that Auto-ISAC’s research is relevant to their action because Auto-ISAC is a
“key player in the quickly growing world of automotive cybersecurity.” Plaintiffs’ argument
seems to be that because “Auto-ISAC aspires to play an important role in promoting
cybersecurity throughout the automotive industry,” it is somehow obligated to serve as Plaintiffs’
expert and clearinghouse of general information. The Court, in weighing the relevance of the
evidence sought against the burden on non-party Auto-ISAC, comes down squarely on the side
of the non-party.
As to the subpoena as it relates to communication between FCA and Auto-ISAC, it is
without question that Plaintiffs have issued a subpoena to Defendant FCA for the very same
communications sought from non-party Auto-ISAC. The parties make several arguments about
what is the relevant time frame or if any communications between Auto-ISAC and FCA before
the filing of the lawsuit, after FCA’s voluntary safety recall, or ongoing communications, could
even be relevant to the action at bar. Such arguments miss the mark. The relevant inquiry is
why a non-party should be put to the burden of producing communication that Plaintiff
previously subpoenaed from a party to the action without some showing of necessity. Plaintiffs
have made no showing that FCA is unable or unwilling to provide the requested communication.

Page 5 of 6

As such, seeking production of those very same documents from a non-party constitutes an
undue burden as contemplated by the Rules of Civil Procedure.
Non-Party Auto-ISAC makes other arguments urging this Court to quash the subpoena.
The Court will not reach those arguments because it finds that the subpoenaed documents are
irrelevant to the underlying action. For that reason also, the Court declines to issue a protective
order. Plaintiffs appear to be on an expedition and may be better served with expert help on how
to navigate the murky waters of “automotive cybersecurity.” The Court is mindful that this
issue may arise again if circumstances change.
CONCLUSION
For the reasons stated above, Non-Party Auto-ISAC Inc.’s Motion to Quash Third Party
Subpoena (Doc. 1) is GRANTED. The subpoena issued to Non-Party Auto-ISAC is hereby
QUASHED.
DATED: November 30, 2016

DONALD G. WILKERSON
United States Magistrate Judge

Page 6 of 6