California Lawyer Magazine: "Cybersmear"by nationally acclaimed author and writer Bill Blum. Published with permission from California Lawyer Magazine. This file cannot be downloaded from this page*

 Christopher Edgecomb, the CEO of Santa Barbara-based Star Telecommunications, Inc, has always been a hands-on kind of guy. To give shareholders a greater degree of accessibility and feedback he began posting comments about the company on its Yahoo Finance message board in early 1998, writing under the digital log-on of "CEO_Chris."

Edgecomb's bid for openness seemed like a good idea at the time. But some of his fellow "posters" reacted in negative and increasingly bizarre ways. During a three-month stretch from September through December 1998 the Star message board took on the dark qualities of a Stephen King Novel.

 Posters maligned Edgcomb's efforts to communicate with the company's investors, made thinly veiled personal threats against the CEO, disparaged his business relationships, and suggested that the Securities and Exchange Commission (SEC) had opened an investigation of the company. One poster advised on a related Yahoo board that investors "short" Star stock and suggested that Edgecomb, a newlywed, was having a homosexual affair. Wackiest of all was an October 9 message left on Star's board announcing Edgecomb's retirement, effective at noon that very day. The poster, who purported to be Edgecomb himself, used the screen name "CE0_Chris" instead of "CEO_Chris," substituting the number 0 for the letter O. The message caused a furor at the company.

 Edgecomb responded the old-fashioned way: He sued. "Chris called and said, 'We've got to stop this,' " says Peter A. Umoff, a partner in Santa Barbara's Seed, Mackall & Cole. "He had different reactions to different postings. Some postings were grotesque... and some appeared to attempt to manipulate the company's stock price. You see things in the news these days that make you realize you have to take threats seriously. We tried to pick out posts we though were actionable."

 Umoff quickly filed a multicount complaint in Santa Barbara County Superior Court that alleged fraud, trade libel, unfair trade practices, and violations of various federal and state statutes, including the Electronic Communications Privacy Act of 1986 (8 USC §§2701 et seq.). The complaint named Star, which trades on the Nasdaq exchange under the symbol STRX, as the sole plaintiff, and Does 1 through 75, inclusive, as defendants, Star Telecommunications, Inc. v Does 1 through 75, Civ No.227512.

 To win the lawsuit, however, Edgecomb had to solve a problem made obvious by the caption of the complaint: He had no idea whom to sue. Online boards such as those run by Yahoo Finance permit posters to use anonymous screen names, requiring them simply to choose aliases not already in use. Edgecomb knew his detractors only as "KillerBme," "donni_1," "star_bright_STRX_Not," and Coversil-" And the terrible things they were saying about him potentially had a global readership.

 Small wonder, then, that companies pay close attention to what is said about them and their managers online. More that 80 million Americans now have computers connected to the Internet. SEC Chairman Arthur Levitt said last year that by some estimates more that 7 million of them were used to trade stock online. And in a single month last year, according to Media Metrix, 8.8 percent of all Internet users accessed the Yahoo Finance Web site. Yahoo is just one of several online services featuring investor chat rooms for publicly traded companies. Other message boards are operated by Go2Net's Silicon Investor, the Motley Fool, and Raging Bull - all of them offering anonymous user postings.

 Like Star Telecom, many companies are using the courts to counteract what they contend is "cybersmear," a new form of defamation on Internet message boards. From Raytheon Corporation of Massachusetts and Lilly Industries of Indiana to Total Renal Care of California, they have filed Doe actions in federal and state courts, demanding injunctive relief and money damages.

 Although there is no precise count of pending cases, the number of such suits seems to increase each week. David L. Sobel, general counsel of the nonprofit Electronic Privacy Information Center (EPIC) in Washington, D.C., personally tracks more that 20 Doe cases. "All were filed within the last year," Sobel says, "which suggests that this is a very small percentage of the total number." Go2Net General Counsel Ethan Caldwell adds that he receives informal requests daily seeking to identify anonymous posters.

 As Sobel and other privacy advocates view matters, the Doe cases raise numerous troubling legal issues, ranging from procedural conundrums related to service of process and the conduct of discovery to questions of personal jurisdiction and substantive concerns over free speech, anonymity, and privacy. For starters, Sobel charges, in most cases, "the persons sued don't even know about the suit until after it's filed and they've been identified" by their internet service providers (ISPs). By that time, however, the defendants' anonymity has already been pierced.

 This is an enormous problem, Sobel explains, because anonymity isn't just a preference of Internet posters, it's a constitutional right. In McIntyre v Ohio Elections Comm'n (1995) 514 US 334, the Supreme Court struck down a state statute prohibiting distribution of campaign literature that did not contain the name and address of the issuer. Anonymous pamphleteering, the high court held, "is not a pernicious, fraudulent practice, but an honorable tradition of advocacy and of dissent," protected by the First Amendment 514 US at 357. Although McIntyre concerned political leaders, it's holding was extended in ACLU v Miller (ND Ga 1997) 977 F Supp 1228, in which a federal district court enjoined a Georgia statute that criminalized Internet transmissions that falsely identified the sender or that used trade names or logos that falsely stated or implied the sender was authorized to use them.

 Still, as Internet posters nationwide are learning , the right to speak anonymously is very different from the right to remain anonymous in the face of alleged tortious conduct. The Star case highlights how plaintiffs’ lawyers are trying to distinguish the two situations.

 The initial hurdle Umoff confronted was identifying the posters who defamed his client. To do that, however, he had to conduct discovery and find a way to comply with Code of Civil Procedure section 2025, which imposes a mandatory stay on certain kinds of discovery for 20 days following service of process.

 Typically, the stay presents little problem for a plaintiff because at least some of the defendants are known and can be served. Once discovery begins, subsequently identified Does can be included in an amended complaint. But if no one can be served, no discovery can proceed. And without discovery the defendants could remain anonymous permanently.

 Umoff sought to escape this catch-22 by petitioning the superior court for an order for expedited discovery, permitting him to serve Yahoo with subpoenas to disclose the identities of the Does prior to serving the complaint. Though the motion is rarely used and was made on an ex parte basis, Judge William Gordon granted it.

 After receiving the subpoenas, Umoff recalls, "Yahoo gave us documents that contained information that enabled us to identify the ISPs the Does used." Actually, what Yahoo turned over were the numeric Internet provider codes that accompanied the postings. With the help of a computer expert, Umoff was able to trace the codes to the posters' ISPs. A second round of subpoenas was then served on ISPs such as AOL, Earthlink, and Hotmail, ultimately leading to the names and addresses of two individuals and a San Francisco hedge fund, where another subsequently identified poster worked.

 Umoff amended his complaint in late January 1999 and served the Does. By August Umoff had negotiated settlements with all four defendants. Although each defendant retained counsel, not a single responsive pleading was filed. Once their identities were revealed, the defendants entered into stipulated judgments requiring them to cease and desist from any further Internet postings about Star. The settlement agreement required them to issue public apologies to Edgecomb and Star, and to make modest donations to local charities. One poster wrote a $500 check to Santa Barbara Legal Aid. The hedge fund, according to Umoff, was never shown to have knowledge of its employee's postings.

 The behind-the-scenes role of ISPs and Web portals in cases such as Star has sparked considerable controversy. "I have yet to see a written statement from an Internet service provider agreeing to give notice of a pending subpoena to its users," complains EPIC's Sobel. "One of the principal benefits of the Internet is that it gives people the ability to communicate and seek information anonymously. Some would not do so if they had to use their real names."

 According to Sobel, it's not just financial message-board posters whose rights may be affected. "You can come up with any number of scenarios where someone believes individuals should be identified and starts issuing subpoenas," he says, "The procedure could extend, for example, to online support groups for alcoholics or battered spouses. There are tons of reasons people want and need anonymity." Yet without notice of pending subpoena requests, he argues, Internet users have no opportunity to contest the subpoenas. The war is over before the battle is even joined.

 Although ISPs and portals set forth their privacy policies in written terms of service, those terms rarely address how a company will respond to subpoenas seeking user identification. Actual practices vary widely. AOL, for example, will notify subscribers of subpoenas and delay its compliance generally for two weeks to give subscribers time to lodge objections with the issuing court. On at least one occasion the company has queried a court to clarify the scope and authority of subpoenas sent to its Virginia headquarters.

 Yahoo, on the other hand, does not notify its users of subpoenas. According to Sobel, Yahoo doesn't evaluate the merits of subpoenas or "seek the complaint to verify that the named users have done anything actionable." Compounding the problem, in Sobel's view, is the fact that the Electronic Communications Privacy Act does not require service of a subpoena on an ISP before the identification of subscribers can be disclosed. Indeed, under the section as currently written, an ISP may disclose such information to any third party, except the government, simply on request. 18 USC §2703.

 In Yahoo's defense, Mike Riley, senior producer of Yahoo Finance, argues that the company has a strict privacy policy to withhold any identifying user information unless legally compelled to release it. But subpoenas are one form of legal compulsion.

 Riley, too, calls the Yahoo Finance message boards "an unmoderated public forum." He adds, "We believe in the Internet as a marketplace of ideas. The best response to bad information is more information." Nonetheless, Yahoo refuses to offer users notice of subpoenas, asserting that the subpoenas are often issued under seal, that it often doesn't know the user's identity, that its message board services are free of charge, and that the volume of posts - as many as 300 messages a day for publicly traded companies - makes compliance extremely difficult.

 To prevent ISPs from prematurely disclosing a user's identity, Sobel would like to see the Electronic Communications Privacy Act amended to require service of subpoenas and notice to subscribers in all cases seeking Internet user identification. Even some corporate plaintiffs attorneys see merit in his position.

 Bill Fenwick, a principal of Fenwick & West in its Palo Alto office, says some balance is needed on the question of discovery versus privacy rights. "Unfortunately, parties start out taking extreme positions," says Fenwick, whose firm had filed Doe suits and represents Internet giant Exite@Home. Eventually, Fenwick believes, courts will establish mandatory procedures for subjecting subpoenas for the names of posters to "some kind of minimal judicial scrutiny," similar to that given applications for search warrants.

 UCLA Law School professor Eugene Volokh, and expert in First Amendment law and "cyberlaw," concurs with the need for minimal judicial scrutiny. But Volokh also advocates bringing the pressure of the "informed market" on ISPs to force them to notify their subscribers of subpoenas. "Service providers," he argues, "should step in as a matter of sound business practice in order to maintain user loyalty. Those who refuse should be 'outed.' "

 To date no one has introduced a bill in Congress or in state legislatures to implement Sobel's or Fenwick's suggestions. Whether message-board users can force changes on uncooperative Web portals will depend on their ability to affect a company's bottom line. Nonetheless , a consensus is building in favor of notice to ensure that subpoenas sent to ISPs are properly issued and limited in scope. Such safeguards could encourage more Does to litigate attempts to reveal their identities, thereby furthering judicial dialogue on the constitutional issues.

 Already, some Does are fighting back. One such contest followed a suit filed this year in Ventura County Superior Court by Xircom, Inc., a Thousand Oaks-based computer networking company. In a series of Yahoo messages in April 1999 a poster names "A_View_From_Within" offered a technical critique of a new Xircom product and asserted the company had been concealing its defects. Describing himself as "one who has been within Xircom's Engineering Dept. for many years," the poster suggested the product's flaws had caused a recent plunge in the company's stock price

 Xircom's complaint alleged that A_View had logged onto the Internet from the company's headquarters and disclosed proprietary information in violation of his or her purported status as an employee. Xircom attorney David Jacobs, a partner in the Los Angeles office of Epstein Becker & Green, charged A_View with breach of contract and fiduciary duty, defamation, interference with prospective commercial advantage, and unfair competition. Xircom, Inc. v Doe, Civ No. 188724.

 Following a now-familiar procedure, Jacobs fired off a subpoena to Yahoo to identify the poster. But before Yahoo could comply, A_View learned of the lawsuit from a newspaper article.  He called the Los Angeles firm of Baker & Hostetler, which assigned his case to an Internet-savvy associate, Megan Gray. And she had no intention of throwing in the towel.

 Finally, a publicly traded company and a John Doe defendant appeared equally matched, each represented by a clue-chip law firm. Although neither Jacobs nor Gray can comment on the case as a result of a subsequent settlement and confidentiality agreement, the pleadings they left behind show that the Xircom case had the potential to raise all the hot-button issues.

 One of Gray's first moves was to file a motion to quash the Yahoo subpoena. She argued not only that the subpoena violated her client's rights to privacy and free speech but also that the action was a SLAPP suit (Strategic Litigation Against Public Participation) prohibited by statute. Under Code of Civil Procedure section 425.16 such actions must be dismissed if they are based on a defendant's exercise of free speech rights and the plaintiff cannot demonstrate a probability of prevailing on the claim. Xircom's business, Gray contended, was a matter of public interest, and the company could not, as a matter of law, meet the standards of defamation applicable to public figures. Nor could Xircom prove damages, because no showing could be made that A_View's posts hurt the company's stock price.

 Gray prevailed on her motion, making perhaps the first time an Internet Doe subpoena has been quashed. But the victory was a procedural one; superior court Judge John Hunter stated simply that the subpoena had been issued in violation of the mandatory discovery stay. Hunter granted Xircom permission to issue another subpoena to Yahoo, but the parties settled before new motions were filed. A joint press release provided scant details of the agreement, A_View_From_Within's identity "was revealed by his counsel to selected senior executives of Xircom"; A_View confirmed that he "is not now, nor was he at the time of his Yahoo postings, a Xircom employee"; A_View affirmed that he "believes that his postings were expressions of his opinion."

 Although Hunter declined to address the substantive claims, he declared in a June 1999 motion hearing, "There is no right of free speech to defame." His remark crystallized the central issue of the Doe cases: Just how far can a message-board poster go without committing defamation?

 "There are no special rules for the Internet," says Epstein Becker's Jacobs, speaking of Doe suits in general. "You couldn't take an ad out int the New York Times and defame someone. Why is it any different on the Internet? It shouldn't be, and it isn't."

 Doe defense attorney Gray counters, "Stifling legitimate criticism - no matter how puerile or vehement - is not a legitimate use of our court system. The mere fact that a company either believes or knows a statement is not true is not enough to support and action for defamation."

 Indeed, as Professor Volokh points out, publicly traded companies are nearly always regarded as public figures for defamation purposes. Under the standards of New York Times Co. v Sullivan (1964) 376 US 254 and it's progeny, a public figure plaintiff must show actual malice - that the defendant acted with knowledge that the statements were false or made with reckless disregard for the truth. 376 US 279. The case law also instructs that a statement must be provably false - and not mere opinion - before First Amendment protections can be overcome and liability assessed. Milkovich v Lorain Journal Co. (1990) 497 US 1, 19. "We've always had people manipulating other people's opinions," Gray reasons. "That's politics. There doesn't have to be a legal remedy for everything we don't like."

 Until appellate courts begin to rule in the Doe cases, many uncertainties will remain. One thing that is clear, however, is that the 1996 Communications Decency Act renders ISPs such as AOL and portals such as Yahoo immune from liability for defamatory third-party postings. 47 USC §230. A number of recent cases have followed section 230, holding ISPs immune both as publishers and as distributors or defamatory posts. Zenan v America Online, Inc. (4th Cir 1997) 129 F3d 327; Doe v America Online, Inc. (Fla 1998) 718 S2d 385 (obscenity); Lunney v Prodigy Services Co. (NY App 1998) 683 NYS2d 557.

 Faced with ISP immunity, complainants will be left to pursue individual message posters. Anyone who thinks however, that corporate plaintiffs will automatically win this game should examine the action filed by Itex Corp. of Portland, Oregon. Itex traded on the Nasdaq small cap market until December 1998, when it was delisted. Itex operates an online exchange that lets customers barter goods using "trade dollars" instead of actual money. The company then makes a commission on each trade.

 In September 1998 Itex filed suit in Multnomah County Circuit Court against 100 John Does for offensive statements made on the Yahoo message board dedicated to the company. The complaint alleged defamation, conspiracy, and various forms of business interference. Itex Corp v Does 1 through 100, Civ No. 98-09-06393. After identifying and serving four Does, Itex reached a quick settlement with one of them. But two other posters, one from California and the other from Colorado, filed pro se motions to dismiss the case for lack of personal jurisdiction. According to Itex attorney Stephen Pearson the trial court granted the motions after holding a telephone hearing with the pro se defendants.

 The court based its dismissal order on a recent opinion of the U.S. District Court for the Eastern District of Pennsylvania, Barrett v Catacombs Press (1999) 44 F Supp 2d 717. In Barrett a psychiatrist brought and action in Pennsylvania, claiming he had been defamed by an Oregon woman who had disparaged his writings and opinions in postings on her personal Web site. "The issue of personal jurisdiction based on Internet activity is a relatively new issue for the federal courts," District Judge F.S. Van Antwerpen wrote. Nevertheless, some general guidelines still apply. "Under the minimum contacts inquiry, the general focus is the nature and quality of activity that a defendant conducts over the Internet." 44 F Supp 2d at 724.

 Antwerpen explained that the extent case law, such as Zippo Mfg, Co. v Zippo Dot Com, Inc. (WD Pa 1997) 952 F Supp1119, clearly supports jurisdiction when Internet activity involves business transactions, or in cases such as Blumenthal v. Drudge (D DC 1998) 992 F Supp 44, where the defendant engaged in both Internet and non-Internet business activity in the forum state. However, Antwerpen stated that when the defendant maintains only a "passive Web site" aimed at providing information and not purposely aimed at a potential plaintiff in a forum state, the weight of authority holds that the "minimum contacts" test is not satisfied. 44 F Supp 2d at 727.

 The same conclusion, Antwerpen found, applied to postings on listserves and discussion groups, which are akin to passive Web sites. Even though such messages are accessible around the world, unless they are purposely directed at the forum state or the forum state is the focal point of resulting harm, jurisdiction should be denied.

 Some attorneys bristle at the implications of Barrett. Jacobs likens the result to allowing defendants "to lob bombs over state lines." Nevertheless, the reasoning in Zippo has been adopted in an increasing number of jurisdictions, including California. See Jewish Defense Org., Inc. v. Superior Court (1999) 72 CA4th 1045.

 Itex has declined to appeal on the jurisdictional question. The company also has its hands full with the fourth Doe defendant Oregon resident Les French, acting as his own lawyer, has filed an answer and a multicount counterclaim to the suit. French says he plans to hire counsel once he gets past the discovery stage.  He also has upped the ante, posting his responsive pleading on the Internet at http://www.lesfrench.com/legal and founding a Yahoo chat group where renegade posters can share war stories and find support. The John Does Club [ http://clubs.yahoo.com/clubs/johndoes ] meets every Wednesday evening at [8:00 P.M. Eastern time] [at www.johndoes.org].

 French, who says he held a vice president's position with Itex when the company was under different management, is determined to litigate the suit to the bitter end. He sees the case as a matter of principle, with the First Amendment squarely on the line. "These companies can't stand to be criticized in a forum that's comparable to the mass media," he says. "The miracle of the Internet is that it empowers the common citizen." Poised atop French's home page is an inset quotation from Ralph Waldo Emerson: "Speech is Power: speech is to persuade, to convert, to compel."

 French says Itex has offered him a mutual release of all claims, but he has little interest in an early resolution. "I will not walk away and pretend the whole thing never happened," he says. Trial is set for this month.

 Even if French changes his mind, Internet Doe suits are likely to continue. "Even financial analysts look at the Yahoo bulletin boards," Jacobs asserts. And publicly traded companies - the major plaintiffs - are increasingly concerned about chat room stock manipulation and short-selling. At least one recent Doe suit includes a federal Racketeering Influenced Corrupt Organizations (RICO) claim, alleging an organized campaign by short-sellers to bring down the share value of its stock. Zia Sun, Inc. v Doe (WD Wa) Civ No. C99-1025.

 "The traditional press knows not to publicize rumors without checking them for accuracy," says Bill Fenwick. "But with the Internet, everybody has the potential to be a publisher." In response, some corporations are hiring Web surveillance companies such as eWatch and Cyveillance, or investigators from the new Internet-crimes groups at more established firms such as Kroll Associates and Princeton, New Jersey - based International Business Research Inc. These firms will patrol the Internet in search of defamatory postings, as well as for trademark and copyright infringement.

 Private companies are not the only ones patrolling the Net. The SEC created a Cyberforce in 1996 that today uses 250 attorneys, accountants, and analysts nationwide. John Reed Stark, chief of the SEC's Office of Internet Enforcement, says his office receives 200 to 300 complaints of alleged Internet related investment fraud a day.

 The California Department of Corporations set up its own group, the Internet Compliance and Enforcement (ICE) unit, in March 1998 to look for violations of state securities laws that occur on the Internet. In its brief history the unit - which consists of two attorneys, a state investigator, and a financial examiner - has filed 80 desist-and-refrain orders against 230 individuals and entities and has brought two civil actions and five criminal actions. Unlike the SEC, the ICW team conducts undercover stings, posing as unwary investors on financial message boards. Lead counsel Marc Crandall says the ICE team hasn't fought with the SEC over turf. "There's more than enough work to go around, and we all have the same goal," Crandall says.

 The conflict over financial message boards pits corporate interests against free-speech advocates, and government regulators against alleged scam artists. The inevitable result will be more litigation and the possibility that well established legal rights will find new context and meaning. "When history passes judgment," says Bill Fenwick, "the Internet will be found to be of enormous benefit. The process, however, will be anything but painless. As with any historical process, there will be some roadkill along the way.

* California Lawyer's definition of reprint permission does not include the downloading, copying by third parties or any other type of transmission of any posted articles.