What price must web hosts pay for discarding data that identifies their users?

A Superior Court judge in Los Angeles has made a decision with chilling implications for journalists and, indeed, for anybody who hosts speech by others."Paul Alan Levy"

I have blogged previously about a case in which we represent a journalist who reports on the digital music industry, on the blog called Digital Music News.  Back in October, an anonymous person posted a critical comment to one of the blogger’s news stories about another company called Escape Media Group; the anonymous comment accused Escape of deliberately infringing the copyright in various sound recordings.  Escape  subpoenaed Digital to produce any identifying information about the poster of this comment.    In papers filed last week, we argued that enforcement of the subpoena would contravene both the First Amendment and California’s Shield Law.  After we filed our papers, Escape Media submitted an affidavit showing that the anonymous comment contained false statements.

Despite this showing, we felt that the standards for identifying anonymous speakers was not met in other respects, so we argued the motion on Tuesday.  Superior Court Judge Richard Stone ordered the identity produced; he indicated that he was troubled in several respects, and considered it a close case, but in the end ruled against Digital.   We disagree with the judge’s analysis because he appears to have applied the wrong legal standard, but until there is a transcript of the oral ruling, I am reluctant to discuss his reasoning. Digital plans to seek appellate review, and in the meantime the judge indicated that the identification order will be stayed but that he expects any identifying information be preserved pending appellate review.

This raises complications of its own.  Digital puts identifying information (that is, the IP address of each poster) in a temporary log file, that is kept only for a few days, and then overwritten with other data.  Digital looked for the log file when Escape Media first complained about the comment, several weeks after the fact, and confirmed that it no longer existed.  Although Digital told Escape about this overwriting practice as soon as it received a subpoena (in January), Escape has pursued enforcement of the subpoena on the theory that the overwritten data may still exist in some form on Digital’s servers.  Given the extent of the over-writing that had occurred from October until the judge’s ruling, Digital is very skeptical that the data still exists in any retrievable form, but of course it needs to comply with the data-preservation requirement.

The imposition of data preservation requirements on a journalist who is not a party to the litigation raises questions apart from the merits of the order. Journalists need to be able to discard data when they no longer have any of their own use for it.  Yes, “the public has a claim to every man’s evidence,” but don’t members of the public who are not involved in litigation have the right to discard information despite the fact that it might turn out to be useful evidence for somebody else’s case?  Does the public have a claim to heroic efforts on every man’s part?  Shouldn’t there be higher standards for subpoenas demanding intrusive searches for discarded data in the hands of third parties?The problem is compounded when it is a journalist that has been subpoenaed.  To what extent does society have any entitlement to make journalists in particular take heroic measures, such as searching the nooks and crannies of their computer equipment for fragments of discarded data?  The judge was sensitive to the fact that our client here is a journalist, telling Escape Media that he was not prepared to allow it to make any general search of Digital Music News’ computers.  But an issue that we may have to pursue on appeal is whether a journalist should ever have to undertake such drastic preservation efforts in aid of a lawsuit in which he is not involved, particularly given the relative unlikelihood that fragments of identifying data remain on his computers somewhere.Indeed, the problem is broader than just journalists.  Companies often keep log files with respect to server visits (and hosted comments), but there is little business justification for keeping those logs forever; so generally speaking they are discarded after a period of time (EFF’s best practices recommendations are worth a look in this regard).  Does the mere act of discarding log files set a company up for the possibility of a demand for forensic examination of the underlying servers, in the hope that some fragment of the data might be recovered?  In this regard, the trial court’s order has chilling implications for other California companies, even beyond the issue of journalists.

Issues of how to preserve the data remain to be decided.  This is not like just leaving one of your file cabinets untouched for a period of time; it is not even as easy as making sure you don’t delete any of your email.  Preserving the web site while creating a copy of the underlying servers is a complicated process, requiring the services of a forensic specialist, and the cost could be substantial.  The estimates that we have been given are well into the five figures; but even the cost of several thousand dollars would be an enormous imposition on this small company.

By chance, on my flight home I was sitting next to a computer forensics specialist with a large consulting company; he told me about his experience seeing small companies driven out of business by trying to cope with the expense of data preservation.  We are also struggling with the question whether, given the manner in which the blog is hosted, it might have to be taken offline for the copying of the physical machines to be done, or whether the process of copying poses a significant risk of degrading the performance of the site at times of heavy traffic.

It remains to be seen on what heroic methods Escape Media plans to insist, whether it is prepared to foot the bills for preservation, and what the judge will ultimately order.

We will be back in court on June 1 to address the remaining issues that need to be decided before we go to the Court of Appeal.  Stay tuned.

Paul Alan Levy is a litigator with Public Citizen’s Litigation group. You can follow him at @PaulAlanLevy on Twitter.