In re Ex parte Application of Path Network, Inc.

Full title: In Re Ex Parte Application of Path Network, Inc., and Tempest Hosting…

Court: United States District Court, Northern District of California

Date published: Nov 22, 2023

23-mc-80148-PHK (N.D. Cal. Nov. 22, 2023)

Opinion

23-mc-80148-PHK

11-22-2023

In Re Ex Parte Application of Path Network, Inc., and Tempest Hosting, LLC, Applicants.

PETER H. KANG UNITED STATES MAGISTRATE JUDGE

ORDER GRANTING IN PART AND DENYING IN PART WITHOUT PREJUDICE PATH NETWORK, INC.'S AND TEMPEST HOSTING, LLC'S APPLICATION TO SERVE DISCOVERY ON DISCORD PURSUANT TO 28 U.S.C. § 1782 Re: Dkt. Nos. 1, 19, 20-22

PETER H. KANG UNITED STATES MAGISTRATE JUDGE

Path Network, Inc. (“Path”) and Tempest Hosting, LLC (“Tempest”) (collectively “Applicants”) have filed an ex parte application authorizing service of a subpoena for documents on Discord, Inc. (“Discord”) pursuant to 28 U.S.C. § 1782. [Dkt. 1]. This application is made in connection with an action pending in the Superior Court of Justice in Ontario, Canada (“Canadian Court”). After considering the instant application, conducting a hearing, and considering supplemental briefing, Applicants' request is GRANTED-IN-PART and DENIED-IN-PART WITHOUT PREJUDICE.

BACKGROUND

I. THE PARTIES AND UNDERLYING ALLEGATIONS

Path is an Arizona corporation providing data, hosting, and cyber services to subscribers. [Dkt. 1-2 at 2].¹Path's wholly owned subsidiary, Tempest, is an Arizona company providing virtual hosting services specializing in the leasing of services to customers. [Dkt. 1 at 4; Dkt. 1-2 at 2].

1 For ease of reference, all page numbers cited to docket entries herein refer to the electronic page number in CM-ECF rather than the document's internal page number.

Applicants aver that Curtis Michael Gervais (“Gervais”), a Canadian citizen, was a Path and Tempest customer in June 2020, and as such he became acquainted with the CEO of Path. [Dkt. 12 at 24]. Around approximately July 8, 2021, Path hired Gervais to work as an independent contractor for Tempest. Id. at 25. His work for Tempest continued through various employment roles until eventually Tempest promoted him to CEO in approximately February 2022. Id. at 2529. On or before June 2022, Gervais allegedly hacked into the internal network of an entity called Game Server Kings (“GSK”), a competitor of Applicants. Id. at 36. The investigation into this activity led Tempest to demote Gervais to COO and he eventually resigned on September 16, 2022. Id. at 37-39, 45-46.

Prior to his work for Tempest, in November 2020, Gervais apparently started his own company called Packet Rabbit, Inc. (“PR”), a Canadian corporation providing online virtual hosting services that operates and leases services to customers for a monthly fee. Id. at 24-25. Gervais is the sole director and officer of PR. Id.

Applicants allege that, as the relationship deteriorated between Tempest and Gervais, Gervais began undertaking actions adverse to Applicants through a variety of means. Id. at 46. Applicants allege that Gervais disclosed Applicants' confidential information to GSK and third parties, made defamatory comments concerning Applicants, and told third parties of his intentions to harm Applicants. [Dkt. 1-3 at 29]. Applicants allege that Gervais conspired with Rene Roosen, CEO and founder of GSK, to harm Applicants. [Dkt. 1-2 at 11 n.1]. Specifically, Applicants allege that Gervais provided Roosen with confidential and/or false information about Applicants, which Roosen used to convince third parties to terminate their user agreements with Applicants and instead start doing business with GSK. Id. at 42-44, 46-47.

Germane to the instant dispute, Gervais and Roosen allegedly utilized Discord's messaging platform to communicate with each other and further the alleged plans to harm Applicants' business. Id. at 11 n.1. Furthermore, Gervais and Roosen allegedly utilized various usernames or aliases for Discord accounts, such as “Archetype,” “1500,” “Renual,” and “cmg” as part of their efforts to communicate their plans to harm Applicants. [Dkt. 1-1 at ¶¶ 4-5; Dkt. 1-2 at 53, 56-57]. Specifically, the “Archetype” user account allegedly used Discord to communicate with an employee of Path to offer to ransom or sell back stolen copies of Applicants' confidential source code and other confidential information for approximately $800,000. [Dkt. 1-2 at 54-58]. Further, Applicants allege that Gervais used the alias or username “wdmg” for an account on an online forum called LowEndTalk. Id. at 53. Applicants similarly allege that Gervais used an email address deesnutiam@protonmail.com and submitted the username “Dees Nutiam” for a new user account on the Tempest platform after he had separated from the company. Id. at 52.

On January 5, 2023, Applicants acted on suspicions that Gervais acted to harm their business using the alias Archetype, resulting in both pre-litigation investigation and the filing of the underlying Canadian lawsuit germane to the instant dispute. Id. at 56.

II. PRE-LITIGATION DISCOVERY AND UNDERLYING CLAIMS

On December 21, 2022, Applicants allege they filed a Notice of Action, Motion Record, and Factum (a type of brief or memorandum of law under Canadian procedural rules, see https://courtofappealbc.ca/civil-family-law/guidebook-for-appellants/write-your-argument) in the Canadian Court seeking pre-litigation evidence preservation and a general injunction. [Dkt. 1-3 at 2]. Applicants allege that on January 9, 2023, the Canadian Court held an ex parte hearing on Applicants' filings and accepted ex parte briefing regarding issuing pre-litigation orders. Id. at 23. The Canadian Court granted Applicants' request and issued a pre-litigation evidence preservation order; so-called “Anton Piller” Orders; a Stand and Deliver Order; and a general injunctive order. Id. (the “Canadian Court Orders”). Under Canadian law, and in general terms, an Anton Piller Order is a civil case order roughly analogous to an order granting permission for entry to land and inspection (see Fed.R.Civ.P. 34(a)(2)) under which a party is allowed the right to enter a location and seize evidence without advance notice to the party being searched, as part of an effort to reduce the risk of destruction of evidence. [Dkt. 1-2 at 2]. Under Canadian law, and in general terms, a Stand and Deliver Order requires individuals subject to the order to turn over off-site evidence and assets. Id.

Applicants allege that the Anton Piller Orders name certain individuals who were allowed to enter Gervais's home including several lawyers for Applicants and a data forensics expert for the Applicants, specifically Tom Warren (“Warren”). [Dkt. 1-3 at 74]. Germane to the Section 1782 application at issue here, Warren submitted a declaration in support of Applicants here. [Dkt. 1-2]. The Anton Piller Orders require Gervais to “grant access and deliver up to the Authorized Persons” certain evidence set forth in Schedule A to that order. [Dkt. 1-2 at 87]. Schedule A to the Anton Piller Orders specifies that the evidence to be delivered includes “any and all communications, whether in hard copy or electronic form, involving Gervais (including by any alias of Gervais including but not limited to ‘cmg' . . . ‘Archetype'[])” and “any and all of the following information, electronic data and/or code of the Plaintiffs as advertised for sale or ransom online pursuant to the information of ‘Archetype' (refer to . . . the Discord message attached as Schedule ‘B' to this Order)[.]” Id. at 90.

Following the execution of the Canadian Court Orders, the persons conducting the searches for evidence delivered to their expert Warren three laptops, two cell phones, two iPads, and numerous credit cards in PR's name. [Dkt. 1-2 at 2]. Subsequently, Applicants allege Warren asked Gervais to “provide access to his devices” and “various local and cloud-based applications / websites within the scope of the Anton Piller Order.” Id. at 59. Applicants aver that “Gervais alleged that he did not know the passwords to the applications / websites because all his log-in credentials were stored on an encrypted password repository known as ‘LastPass.'” Id. Initially, Gervais provided Warren with access to LastPass; however, Gervais allegedly later implemented security measures to protect his computer from unauthorized access. Compare Dkt. 1-2 at 59, with Dkt. 1-2 at 62. Applicants allege that Gervais created risks of evidence tampering of the data and messages in Gervais's online accounts because the LastPass program restricted access based on the device's IP address. [Dkt. 1-2 at 62]. Applicants allege that Warren noticed “Gervais was still able to access his Discord account[,]” and when confronted about his ability to access that account, Gervais stated “he could still use Discord because the session had not stopped.” Id. at 65. Applicants aver that “Gervais['s] information was false - that Mr. Warren had Gervais'[s] computer previously and the Discord session was stopped when Mr. Warren shut down the laptop for [data collection].” Id.

On March 9, 2023, Applicants allegedly asserted several claims against Gervais and PR in connection with their alleged unlawful conduct. Id. at 18-79. After filing the Canadian lawsuit, on April 10, 2023, Applicants requested that Discord preserve all messaging data related to Gervais and Roosen. [Dkt. 1-1 at ¶ 3]. The following day Discord responded that it would not preserve the requested data unless legally obligated to do so. Id. Subsequently, on May 22, 2023, Applicants filed the instant application seeking to serve Discord a subpoena pursuant to Section 1782 in support of the Canadian litigation. [Dkt. 1]. On August 17, 2023, the Court heard arguments on several issues associated with the instant application. [Dkt. 16]. Afterwards, the parties met and conferred in an effort to reach a resolution on several issues with the instant application. [Dkt. 17]. The Parties reached agreement on one issue. [Dkt. 20]. Additionally, the Parties supplemented their briefing regarding several remaining issues with the instant application. [Dkts. 20-22].

III. PROPOSED SUBPOENA

Applicants submitted to the Court their proposed subpoena for documents directed to Discord, which is located in the geographic boundaries of the Northern District of California (as discussed further below). See Dkt. 1-5. With regard to logistics, the proposed subpoena requests that Discord produce documents in Los Angeles. Id. at 2. With regard to document categories sought, the proposed subpoena requests that Discord produce “documents, electronically stored information, or objects, and to permit inspection, copying, testing, or sampling of[:]”

(1) All passwords and account data associated with Curtis Gervais, including any aliases he used, such as cmg#8239;

(2) All passwords and account data associated with Rene Roosen, including any aliases he used, such as Renual#7394;

(3) All passwords and account data associated with Archetype#8484;

(4) Roosen, Gervais and Archetype#8484's login history for any and all Discord accounts, including but not limited to cmg#8239, Renual#7394, and Archetype#8484; and

(5) Any and all messaging data associated with any of Roosen, Gervais, or Archetype#8484's Discord account(s) including cmg#8239, Renual#7394 and Archetype#8484.

Id. at 5. The subpoena names Curtis Gervais and Rene Roosen, as well as the three Discord account usernames, but provides no other identifying information for these individuals or accounts. Id.

Following oral argument and supplemental briefing, Applicants and Discord filed a joint stipulation. [Dkt. 20]. In the stipulation, Discord states it would not object to the production of the following documents, electronically stored information, or tangible things, which includes documents, electronically stored information, or tangible things narrower than Applicants' proposed subpoena:

1) All account data, not including the contents of electronic communications, associated with Curtis Gervais, including any aliases he used, such as cmg#82391;

2) All account data, not including the contents of electronic communications, associated with Rene Roosen, including any aliases he used, such as Renual#7394;

3) All account data, not including the contents of electronic communications, associated with Archetype#8484;

4) Roosen, Gervais and Archetype#8484's login history for any and all Discord accounts, including but not limited to cmg#8239, Renual#7394, and Archetype#8484; and

5) Any and all headers of messaging data associated with any of Roosen, Gervais, or Archetype#8484's Discord account(s) including cmg#8239, Renual#7394 and Archetype#8484.

[Dkt. 20 at 2]. Discord further defined certain subpoena terms including:

“Account data” includes a user's first and last name, email address, birthdate, and any other non-content identifying information for a specific user.

“Header” includes the name and email addresses of the sender, recipient, and any copied or blind copied recipients in a particular Discord message, and the time that message was sent and/or received.

Id. In other words, Discord represents that it would not object to searching for and producing documents, electronically stored information, or tangible things sought as defined above. However, Discord does object to searching for and producing any documents, electronically stored information, or tangible things which fall outside the scope defined above but which would be within the broader scope of Applicants' initial subpoena as originally presented. Id.

DISCUSSION

I. JURISDICTION

As an initial matter, this Court has jurisdiction to hear and decide this matter because the Applicants and Discord have all consented to Magistrate Judge jurisdiction under 28 U.S.C. § 636(c). See CPC Pat. Techs. Pty Ltd. v. Apple, Inc., 34 F.4th 801, 808 (9th Cir. 2022); Williams v. King, 875 F.3d 500, 500 (9th Cir. 2017) (requiring both the Section 1782 applicant and the party from whom discovery is sought to consent to Magistrate Judge jurisdiction); Dkts. 3, 6 (Applicants and Discord consenting to Magistrate Judge jurisdiction). Additionally, this Court exercises federal question jurisdiction over the application for discovery pursuant to Section 1782. In re Application of Grupo Unidos Por El Canal S.A., No. 14-mc-80277-JST (DMR), 2015 WL 1815251, at *4 (N.D. Cal. Apr. 21, 2015).

II. APPLICABLE LEGAL STANDARDS

Evaluating an application for leave to serve a subpoena under Section 1782 requires a two-part analysis: (1) the statutory requirements and (2) the discretionary requirements. Intel Corp. v. Advanced Micro Devices, Inc., 542 U.S. 241, 264-65 (2004). First with regard to the statutory requirements, Section 1782 authorizes district courts to permit discovery if: (A) the person from whom the discovery is sought “resides or is found” in the district of the district court where the application is made; (B) the discovery is “for use in a proceeding in a foreign or international tribunal;” and (C) the application is made by a foreign or international tribunal or “any interested person.” Khrapunov v. Prosyankin, 931 F.3d 922, 925 (9th Cir. 2019).

Second with regard to the discretionary factors, the Court considers the following discretionary factors in determining whether to authorize discovery requested under Section 1782: (A) whether the “person from whom discovery is sought is a participant in the foreign proceeding;” (B) “the nature of the foreign tribunal, the character of the proceedings underway abroad, and the receptivity of the foreign government or the court or agency abroad to U.S. federal court judicial assistance;” (C) whether the request “conceals an attempt to circumvent foreign proof-gathering restrictions or other policies of a foreign country or the United States;” and (D) whether the request is “unduly intrusive or burdensome.” Intel, 542 U.S. at 264-65.

“A district court's discretion is to be exercised in view of the twin aims of [Section] 1782: providing efficient assistance to participants in international litigation, and encouraging foreign countries by example to provide similar assistance to our courts.” In re Nat'l Ct. Admin. of the Republic of Korea, No. 15-mc-80069-LB, 2015 WL 1064790, at *2 (N.D. Cal. Mar. 11, 2015). Unless the district court orders otherwise, the discovery authorized by the court must be obtained in accordance with the Federal Rules of Civil Procedure. See 28 U.S.C. § 1782(a); In re Tokyo Dist. Prosecutors Off., Tokyo, Japan, 16 F.3d 1016, 1020 (9th Cir. 1994). The party seeking discovery need not establish that the information sought would be discoverable under the foreign court's law or that the U.S. would permit the discovery in an analogous domestic proceeding. See Intel, 542 U.S. at 261-63.

A. Statutory Factors

i. The Residency of the Discovery Target.

Applicants must first demonstrate that the entity from which they seek discovery resides in the geographic boundaries of the court to whom the application is addressed, here the Northern District of California. Khrapunov, 931 F.3d at 925; In re Republic of Ecuador, No. 10-cv-80225, 2010 WL 3702427, at *2 (N.D. Cal. Sept. 15, 2010). A business entity's residency for the purpose of Section 1782 is “where the business is incorporated, is headquartered, or where it has a principal place of business.” In re Todo, 2022 WL 4775893, at *2 (N.D. Cal. Sept. 30, 2022) (collecting cases); In re Med. Inc. Ass'n Takeuchi Dental Clinic, 2022 WL 10177653, at *2 (N.D. Cal. Oct. 17, 2022) (Google met residency requirement under Section 1782(a) due to headquarters and principal location in Mountain View).

Here, Applicants request discovery from Discord. [Dkt. 1-5]. Although Applicants cite the statutory factors, their submissions have provided no factual evidence or material to establish Discord's residence. [Dkt. 1 at 8-9]. Rather, Applicants conclusorily state, without citation to evidence or any documents in the record, that Discord is headquartered in the Northern District of California. [Dkt. 1 at 9].

Nevertheless, the Court has the authority to take Judicial Notice of certain facts under the proper circumstances. See Fed.R.Evid. 201(b)(2) (“The court may judicially notice a fact that is not subject to reasonable dispute because it . . . can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.”); Minor v. FedEx Office & Print Servs., 78 F.Supp.3d 1021, 1028 (N.D. Cal. 2015) (taking Judicial Notice of record of administrative agencies and publicly accessible websites).

Publicly available records from the California Secretary of State and at least one website indicate that Discord has its principal place of business in San Francisco, California, which is located within the Northern District of California. See bizfile Online, Cal. Sec'y of State, https://bizfileonline.sos.ca.gov/search/business (search for “Discord Inc” or file no. 3472899) (last visited on Nov. 21, 2023) (Discord's “principal address” is in San Francisco); Discord Company Information - Impressum, https://discord.com/company-information (last visited on Nov. 21, 2023) (same). The Court finds that these online materials are mutually corroborative and sufficiently reliable, and that their accuracy cannot be reasonably questioned. Thus, the residency of Discord is not subject to reasonable dispute, and the Court exercises its authority to take judicial notice of Discord's principal office under Rule 201.

Accordingly, the Court finds that the first statutory requirement of residency is met because Discord's principal office is in San Francisco. See In re Hattori, No. 21-mc-80236-TSH, 2021 WL 4804375, at *3 (N.D. Cal. Oct. 14, 2021) (“Applicant's request satisfies the statutory requirements of [Section] 1782. First, Google can be found in this district because its principal office is located in Mountain View, California.”).

ii. Discovery Sought Is for Use in a Proceeding in a Foreign Tribunal.

Next, Applicants must show the discovery sought is for use in a proceeding before a foreign tribunal. Khrapunov, 931 F.3d at 925. To be “for use” in a foreign proceeding, the information sought must be relevant. Rainsy v. Facebook, Inc., 311 F.Supp.3d 1101, 1110 (N.D. Cal. 2018). “The party issuing the subpoena has the burden of demonstrating the relevance of the information sought.” Digital Shape Techs., Inc. v. Glassdoor, Inc., No. 16-mc-80150-JSC, 2016 WL 5930275, at *3 (N.D. Cal. Oct. 12, 2016).

The Canadian lawsuit is certainly a foreign proceeding. Here, Applicants seek information from Discord in connection with the complained-of activities allegedly committed by Gervais and Roosen, specifically their alleged use of Discord accounts to communicate allegedly harmful information about Applicants and their alleged attempt to ransom stolen proprietary source code. [Dkt. 1-2 at 18-79]. These alleged unlawful activities and communications using Discord form the basis of Applicants' Canadian lawsuit as summarized above. Id. The discovery sought from Discord includes information concerning the account logins and passwords for the accused Discord user accounts (i.e., Archetype, Renual, and cmg), as well as login histories and the messages themselves. [Dkt. 1-5]. The discovery is presumably sought in order to determine the connections between Gervais and Roosen to these accounts. This connection would presumably be relevant to the liability issues in the underlying Canadian litigation. If the discovery demonstrates such a connection, then such discovery would impact liability, and if the discovery demonstrates that no such connection exists (for example, if the user accounts were in fact owned and used by unrelated third party actors), then the absence of any such discovery materials also would be relevant to defenses in the Canadian litigation.

Further, as Applicants argue, the discovery sought is relevant to carrying out the Canadian Court's Anton Piller Orders. For example, as discussed above, the Anton Piller Order directed to Gervais requires the delivery of evidence including “any and all communications, whether in hard copy or electronic form, involving Gervais (including by any alias of Gervais including but not limited to ‘cmg' . . . ‘Archetype' . . .)” and “any and all of the following information, electronic data and/or code of the Plaintiffs as advertised for sale or ransom online pursuant to the information of ‘Archetype' (refer to . . . the Discord message attached as Schedule ‘B' to this Order)[.]” [Dkt. 1-2 at 90]. The Canadian Court thus specifically ordered the production of evidence of Discord messages from the user accounts identified by Applicants. Id.

Accordingly, the Court finds that the discovery sought from Discord is relevant, for the purposes of Section 1782, to the Canadian lawsuit. The second statutory requirement under Section 1782 is satisfied.

iii. Movants Are Interested Persons.

Next under Section 1782, Applicants must show they are interested “persons.” Khrapunov, 931 F.3d at 925. An interested person under Section 1782 “plainly reaches beyond the universe of persons designated ‘litigant,'” although there is “[n]o doubt [that] litigants are included among, and may be the most common example[.]” Intel, 542 U.S. at 256.

Here, Applicants are party litigants in the Canadian lawsuit. See Dkt. 1-2 at 18-79. As litigants in the foreign proceeding, Applicants are prototypical interested persons. Intel, 542 U.S. at 256. Accordingly, the Court finds that the third and final statutory factor under Section 1782 is satisfied.

In sum, because Applicants have satisfied all three statutory requirements, the Court determines that, as a matter of statutory requirements, discovery relating to the foreign proceeding is authorized under Section 1782. Because the Court has discretion to deny the application, even if the statutory requirements are satisfied, the Court next analyzes the discretionary Intel factors. Intel, 542 U.S. at 256.

B. The Court's Discretion To Authorize The Requested Discovery

As discussed above, the discretionary factors under Section 1782 are: (A) whether the “person from whom discovery is sought is a participant in the foreign proceeding;” (B) “the nature of the foreign tribunal, the character of the proceedings underway abroad, and the receptivity of the foreign government or the court or agency abroad to U.S. federal court judicial assistance;” (C) whether the request “conceals an attempt to circumvent foreign proof-gathering restrictions or other policies of a foreign country or the United States;” and (D) whether the request is “unduly intrusive or burdensome.” Id. at 264-65. The Court analyzes each discretionary factor in turn.

i. Whether the Person from Whom Discovery Is Sought Is a Party to the Foreign Proceeding.

The first discretionary factor is whether the discovery is appropriate where the target of discovery is a party to the foreign litigation. Id. at 265 “A foreign tribunal has jurisdiction over those appearing before it, and can itself order them to produce evidence.” Id. at 264. However, “nonparticipants in the foreign proceeding may be outside the foreign tribunal's jurisdictional reach; hence, their evidence, available in the United States, may be unobtainable absent [Section] 1782 aid.” Id. As such, the first discretionary factor favors discovery sought from non-parties to the foreign proceeding. Cf. In re Varian Med. Sys. Int'l AG, No. 16-mc-80048-MEJ, 2016 WL 1161568, at *4 (finding that the first Intel factor weighs heavily against seeking discovery from participants in foreign tribunals).

Here, Discord is not a party to the Canadian lawsuit and is only a third-party whose messaging platform was allegedly used by Gervais and Roosen to harm Applicants. [Dkt. 1-2 at 18-79]. Accordingly, it appears the Canadian Court lacks authority or jurisdiction to compel discovery from Discord. Further, efforts to secure voluntary disclosure were unavailing -apparently, Discord refused to preserve messaging data absent court order. [Dkt. 1-1 at ¶ 3]. Applicants argue that “[i]f the Court does not grant the instant Application, Path and Tempest will be unable to fully execute the Canadian Court's Orders and engage in discovery essential to their case[.]” [Dkt. 1 at 2]. The Court finds that this discretionary factor is satisfied, because Discord is not a party to the foreign litigation and the requested discovery has been shown to be unavailable otherwise. Intel, 542 U.S. 241.

ii. The Nature of the Foreign Tribunal, the Character of the Proceedings Underway Abroad, and the Receptivity of the Tribunal to U.S. Judicial Assistance.

The second Intel factor weighs in favor of discovery unless the foreign tribunal in question has expressly made it clear that it would not accept the evidence. In re Jt. Stock Co. Raiffeinsenbank, 2016 WL 6474224, at *5 (N.D. Cal. Nov. 2, 2016) (under this factor, “courts look for authoritative proof that a foreign tribunal would reject evidence obtained with the aid of [Section] 1782.”). A district court's ability to order discovery under Section 1782 is not predicated on the discoverability or admissibility of the evidence sought in that foreign tribunal. See Intel, 542 U.S. at 260. That is, courts need not explore nor determine whether the information applicants seek is admissible in the foreign jurisdiction. See In re Seoul Dist. Criminal Court, 555 F.2d 270, 723 (9th Cir. 1977). Rather, in the absence of authoritative proof that a foreign tribunal would reject evidence obtained with the aid of Section 1782, this discretionary factor tends to support authorizing the requested discovery. See, e.g., Palantir Techs., Inc. v. Abramowitz, 415 F.Supp.3d 907, 915 (N.D. Cal. 2019) (citation omitted); In re Med. Corp. H&S, No. 19-mc-80058-VKD, 2019 WL 1230440, at *3 (N.D. Cal. Mar. 15, 2019) (“In the absence of evidence that Japanese courts would object to MCHS's discovery of the information sought in the subpoena, or that they object more generally to the judicial assistance of U.S. federal courts, the Court concludes that this factor weighs in favor of authorizing service of the subpoena.”).

Here, the Canadian Court is the Superior Court of Justice in Ontario. This Court takes Judicial Notice that, in the Canadian legal system “Superior courts are the highest level of courts in a province or territory. They deal with the most serious criminal and civil cases and have the power to review the decisions of the provincial and territorial courts.” See Government of Canada, The Judicial Structure - How the Courts are Organized (Sept. 1, 2021), https://www.justice.gc.ca/eng/csj-sjc/just/07.html (last visited Nov. 21, 2023) (information published by the Canadian government). The Canadian Court is thus apparently analogous to a trial court of general jurisdiction, and is not a specialized agency or limited jurisdiction tribunal. Further, the proceeding abroad is a civil action by Applicants against Gervais and his co-defendants, and that proceeding appears to be on a schedule which is intended to afford Applicants time to seek the discovery herein. Accordingly, the Court concludes that the nature of the Canadian Court is such that it is unlikely to object to judicial assistance from a U.S. District Court, and that the nature of the proceedings abroad favors discretionary authorization of discovery here.

Further, the record of proceedings from the Canadian litigation indicates that the Canadian Court has taken steps and issued orders to seek, within its own jurisdiction, the type of discovery and information sought here. As noted, the Anton Pillar Orders expressly order the production of information and electronic files relating to the Discord messages and user accounts which are the subjects of the instant request. [Dkt. 1-2 at 90]. In addition, the Canadian Court has extended the Anton Pillar Order two separate times to allow Applicants to try to obtain cloud-related discovery. Id. at 117-122. From the orders and steps taken by the Canadian Court, this Court concludes that the Canadian Court would be receptive to information sought from Discord under Section 1782. There is nothing in the record to imply, much less expressly indicate, that the Canadian Court would reject any evidence produced by Discord in response to a properly issued subpoena under Section 1782. Accordingly, the Court finds that the third discretionary factor weighs in favor of discovery.

iii. Circumvention of the Foreign Court's Proof-Gathering Restrictions.

The third Intel factor considers whether the request “conceals an attempt to circumvent foreign proof-gathering restrictions or other policies of a foreign country or the United States.” Intel, 542 U.S. at 264-65. “A perception that an applicant has ‘side-stepped' less-than-favorable discovery rules by resorting immediately to [Section] 1782 can be a factor in a court's analysis.” In re Cathode Ray Tube Antitrust Litig., No. 07-cv-5944-SC, 2013 WL 183944, at *3 (N.D. Cal. Jan. 17, 2013) (citing In re Caratube Int'l Oil Co., 730 F.Supp.2d 101, 107-08 (D.D.C. 2010)). Additionally, the perception that an applicant has immediately resorted to Section 1782, bypassing the foreign court's proof-gathering, can weigh against discovery. Id. (citation omitted).

On the other hand, absence of evidence of attempted circumvention of the foreign tribunal's proof-gathering procedures weighs in favor of an application under Section 1782. See, e.g., In re Google, Inc., No. 14-mc-80333-DMR, 2014 WL 7146994, at *2 (N.D. Cal. Dec. 15, 2014); In re Eurasian Nat. Res. Corp. Ltd., No. 18-mc-80041-LB, 2018 WL 1557167, at *3 (N.D. Cal. Mar. 30, 2018); In re Honda, No. 21-mc-80167-VKD, 2021 WL 3173210, at *4 (N.D. Cal. July 27, 2021).

Here, the record of the proceedings in the Canadian lawsuit demonstrates that Applicants pursued proof-gathering procedures in Canada extensively before filing the instant Application. [Dkt. 1-2 at 18-79]. As summarized above, Applicants sought and were granted multiple Anton Pillar Orders, executed on those Orders, followed up with Gervais on the passwords for accounts, obtained extensions of the Anton Pillar Orders from the Canadian Court, and sought voluntary cooperation from Discord. Id. Applicants demonstrated diligence in using the Canadian Court system to try to obtain information about the Discord messages and accounts, both from Gervais and from Discord. Id. Indeed, there is indication in the records provided that Gervais may have taken steps to delay or hinder access to his Discord account by claiming lack of access to his passwords stored in a LastPass account and by claiming lack of access to the email account linked to this LastPass account. Id. at 62-63.

Accordingly, the Court concludes that Applicants' discovery request here is not an improper attempt to undermine the Canadian Court or its policies or proof-gathering restrictions. Therefore, the Court finds that this discretionary factor weighs in favor of discovery.

iv. Unduly Intrusive or Burdensome Discovery Requests.

The final Intel factor addresses the intrusiveness and burden of the proposed discovery requests. Discovery requests are unduly burdensome when they are “not narrowly tailored, request confidential information and appear to be a ‘broad fishing expedition for irrelevant information.'” In re Qualcomm Inc., 162 F.Supp.3d 1029, 1043 (N.D. Cal. 2016). The “proper scope” of requests under section 1782 is “generally determined by the Federal Rules of Civil Procedure.” In re Varian Med. Sys. Int'l AG, 2016 WL 1161568 at *5. Thus, under this final discretionary factor, any “unduly intrusive or burdensome requests may be rejected or trimmed.” Intel, 542 U.S. at 246.

While the Court finds that all the statutory and the other discretionary factors support authorizing discovery, here the focus is on the proposed discovery and, as noted, whether the proposed requests are impermissibly intrusive or burdensome using the discovery provisions of the Federal Rules of Civil Procedure as guidelines, particularly Rule 45 governing subpoenas.

Here, the proposed subpoena fails to comply with the applicable legal standards. First, as discussed above, Applicants' proposed subpoena, as written, purports to require Discord, headquartered in San Francisco, to produce documents in Los Angeles, California. [Dkt. 1-5]. Under Rule 45(c)(2), a subpoena may only command “production of documents, electronically stored information, or tangible things at a place within 100 miles of where the person resides, is employed, or regularly transacts business in person[.]” Applicants' proposed subpoena thus violates the 100-mile restriction on subpoenas duces tecum, because San Francisco is more than 100 miles from Los Angeles, California. Compare bizfile Online, Cal. Sec'y of State, https://bizfileonline.sos.ca.gov/search/business (search for “Discord Inc” or file no. 3472899) (last visited Nov. 21, 2023) (Discord's “principal address” is in San Francisco), with Dkt. 1-5 at 2. Instructive on the importance of the geographical limitation in Rule 45(c) is the Ninth Circuit's recent opinion finding trial subpoenas improper where those subpoenas required witnesses to testify remotely at trial because they were physically more than 100 miles from the location of the proceeding. In re Kirkland, No. 22-70092, -- F.4th --, 2023 WL 4777937, at *6-10 (9th Cir. July 27, 2023) (granting writ of mandamus and ordering trial court to quash subpoenas). The Applicants' proposed subpoena to Discord here is analogously improper for requiring production more than 100 miles from Discord's headquarters. See In re Portfolio Recovery Assocs., LLC Tel. Consumer Prot. ACT Litig., No. 11MD2295 JAH (BGS), 2021 WL 5920086, at *3 (S.D. Cal. Dec. 15, 2021).

Second, Applicants' proposed subpoena, particularly the descriptions of categories of documents sought, does not satisfy the applicable legal standards. Discovery requests are intrusive or burdensome where they are overbroad and “not narrowly tailored temporally, geographically or in their subject matter.” In re Qualcomm Inc., 162 F.Supp.3d at 1044. Here, as discussed above, the proposed subpoena refers to the names “Curtis Gervais” and “Rene Roosen” and asks for “all passwords and account data associated with” each of them, asks for their “login history for any and all Discord accounts,” and seeks “[a]ny and all messaging data associated with any of Roosen [or] Gervais[.]” [Dkt. 1-5 at 5]. While the requests provide examples of Discord accounts (“such as cmg#8329” or “such as Renual#7394” or “Archetype#8484”), all the requests are expressly not limited to those accounts and fail to provide Discord (the third-party which would be required to understand and search for documents) any other information on who these persons are, what other Discord accounts they may have, and what “any aliases” either of them used. Id.

Under Rule 26(b)(1) of the Federal Rules of Civil Procedure, discovery must be “proportional to the needs of the case, considering the importance of the issues at stake in the action, the amount in controversy, the parties' relative access to relevant information, the parties' resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit.” As discussed, the proposed subpoena seeks “[a]ll . . . account data associated with” both Gervais and Roosen. [Dkt. 1-5 at 5]. This includes “any aliases,” “login history for any and all Discord accounts,” and “[a]ny and all messaging data associated with any of Roosen [or] Gervais.” Id. Given the lack of reasonable measures to identify Gervais and Roosen with any particularity, the breadth of the proposed subpoena is not proportional to the needs of the case. See Winet v. Arthur J. Gallagher & Co., 2020 WL 6449230, at *2 (S.D. Cal. Nov. 3, 2020) (request for production which sought “all documents” concerning, evidencing, and reflecting sales is overbroad and not proportional to the needs of the case).

While Applicants may know who Gervais and Roosen are and how to identify them, that information is notable by its absence from the proposed subpoena. The proposed subpoena has no “definition” section and fails to provide any supplemental or explanatory information about Gervais or Roosen. For example, the proposed subpoena lacks any personally identifying information about these persons, such as their home or correspondence addresses, business addresses, business affiliations, telephone or cellphone numbers, email addresses, or any other collateral data already in Applicants' possession to substantiate their identities. See Dkt. 1-5 at 2. It is evident from the materials provided this Court from the Canadian lawsuit that Applicants possess, minimally, at least some ancillary set of information that could facilitate a more precise identification of Gervais and Roosen to avoid burdening Discord in its search for responsive documents.

Furthermore, this Court takes Judicial Notice that Discord's registration panel appears to require the following information to create a user account: an email address; a username; a password; and a date of birth. See Create an Account, https://discord.com/register (last visited Aug. 9, 2023). If Applicants have email addresses and/or birth dates for Gervais and Roosen, that information would appear to be helpful in reducing the burden on Discord in its attempts to comply with a subpoena (indeed, Applicants' application recites multiple email addresses which Applicants believe Gervais has used, and yet inexplicably fails to include those in the subpoena).

Additionally, it is unknown how many other persons among Discord's worldwide customer base have the same or similar names as Gervais and Roosen. Similarly, it is unknown how many other users have user account names that are the same as or closely similar to “Archetype,” “Renual,” or “cmg.” As drafted, the proposed subpoena would potentially implicate searching for and perhaps even producing information from innocent third parties unrelated to the Canadian lawsuit. The risk of misidentification of innocent parties and the disclosure of their personal messages or other information is thus exacerbated by the lack of definitional or narrowing information about Gervais and Roosen in the proposed subpoena. Thus, the proposed subpoena is not only unduly burdensome but also unduly intrusive, particularly with regard to the universe of innocent third parties whose information and data may be swept up by an overbroadly worded subpoena and resulting search.

As a consequence, the breadth of the subpoena as drafted risks compelling Discord to embark on a potentially complex task of discerning the specific “Curtis Gervais” or “Rene Roosen” contemplated by the subpoena in order to filter out any false hits or misidentified persons. Thus, the subpoena as drafted risks imposing further undue burden on Discord both in its search for responsive documents and in its attempts to reasonably filter out the truly irrelevant misidentified information from the information on the specific Messrs. Gervais and Roosen actually of interest.

Accordingly, the Court finds that application of this final Intel discretionary factor militates against approval of the proposed subpoena as presented to the Court. However, the Court finds that Applicants' failure to satisfy this discretionary factor does not require a negative finding on the threshold issue of whether any discovery should be authorized in the first instance; rather this factor requires the Court to find that the proposed discovery, in its present form, should be modified because, as literally drafted, the proposed subpoena to Discord is overbroad, not narrowly tailored, unduly intrusive, and burdensome under the applicable legal standards. Therefore, the Court GRANTS-IN-PART Applicants' application for leave to serve a document subpoena on Discord, and GRANTS Applicants leave to submit a revised subpoena as discussed further herein after appropriate meet and confer with Discord.

III. THE STORED COMMUNICATIONS ACT

Even if Applicants satisfy the Section 1782 requirements, the Court may not grant the application if granting the application would cause a violation of the Stored Communications Act (“SCA”). Xie v. Lai, 2019 WL 7020340, at *5 (N.D. Cal. Dec. 20, 2019) (“It is well-established that civil subpoenas, including those issued pursuant to [Section] 1782, are subject to the prohibitions of the Stored Communications Act.”). On August 17, 2023, the Parties briefly presented arguments on the applicability of the SCA as the initial application did not contain any arguments on the applicability of the SCA. See Dkt. 1. At the Court's request, the Parties submitted supplemental briefing on (A) whether passwords are afforded protections pursuant to the SCA and (B) whether Gervais has impliedly consented to the disclosure of his communications such that Discord may produce the communications pursuant to the issuance of the subpoena. [Dkts. 20-22].

The Court finds these arguments are fit for determination without a hearing pursuant to this Court's Civil Local Rule 7-1(b). For the reasons explained below, the Court finds passwords are afforded protection under the SCA and Gervais did not explicitly or implicitly consent to the release of the contents of his communications.

A. Whether Passwords are Afforded Protection Under the SCA.

The SCA “prohibits electronic communication service providers from ‘knowingly divulg[ing] to any person or entity the contents of a communication while in electronic storage by that service.'” Obodai v. Indeed, Inc., No. 13-mc-80027-EMC, 2013 WL 1191267, at *2 (N.D. Cal. Mar. 21, 2013) (citing 18 U.S.C. § 2702(a)(1); Optiver Australia Pty. Ltd. & Anor. v. Tibra Trading Pty. Ltd. & Ors., No. 12-cv-80242-EJD (PSG), 2013 WL 256771 (N.D. Cal. Jan. 23, 2013)). The SCA incorporates the definition of “contents” from the Wiretap Act. In re Zynga Priv. Litig., 750 F.3d 1098, 1105-06 (9th Cir. 2014) (citing 18 U.S.C. § 2711(1); 18 U.S.C. § 2510(8)). The SCA defines “contents” as “any information concerning the substance, purport, or meaning of [a] communication.” Id. The Zynga Court held the words “substance, purport, or meaning” carry their dictionary definitions which indicate that “Congress intended the word ‘contents' to mean a person's intended message to another.” Id. (the Zynga Court defines: “substance” as “the characteristic and essential part;” “purport” as “meaning conveyed, professed or implied;” and “meaning” as “the thing one intends to convey . . . by language[.]”) (citing Webster's Third New International Dictionary 1399, 1847, 2279 (1981))).

The issue of discovery of electronic communications can implicate Fourth Amendment concerns. S. REP. 99-541, 2-3, 1986 U.S.C.C.A.N. 3555, 3556-57. “The SCA was enacted because the advent of the Internet presented a host of potential privacy breaches that the Fourth Amendment does not address.” Sams v. Yahoo! Inc., 713 F.3d 1175, 1179 (9th Cir. 2013) (citation omitted). However, often times the “existing statutory framework is ill-suited to address modern forms of communication[.]” Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 874 (9th Cir. 2001). “Courts have struggled to analyze problems involving modern technology within the confines of this statutory framework, often with unsatisfying results.” Id. (citations omitted).

Applicants argue passwords are not afforded protection under the SCA because passwords should not be considered “content.” [Dkt. 21 at 5]. Discord argues passwords are implicitly included within the SCA's prohibitions because passwords implicate communications. [Dkt. 21 at 7; Dkt. 22 at 6-7]. In other words, Discord argues that passwords are “content “ under the SCA because they are “information concerning the substance, purport, or meaning” of a communication. For the reasons explained herein, the Court find passwords are content under SCA.

The Court is faced with an issue of first impression regarding the bounds of the scope of the meaning of the word “content” in the SCA. While the SCA defines “contents” as “any information concerning the substance, purport, or meaning of [a] communication,” and the Zynga Court held the “Congress intended the word ‘contents' to mean a person's intended message to another” no court has apparently determined the scope of the phrase “information concerning” within the statute. Zynga, 750 F.3d at 1105-06; 18 U.S.C. § 2711(1); 18 U.S.C. § 2510(8).

To determine the scope of what is considered “content” under the SCA, the Court must first determine Congress's intended meaning of the words “information concerning.” See Zynga, 750 F.3d at 1105-06. “In ascertaining the plain meaning of the statute, the court must look to the particular statutory language at issue, as well as the language and design of the statute as a whole.” Id. at 1105 (quoting K Mart Corp. v. Cartier, Inc., 486 U.S. 281, 291 (1988). “We start with the plain language of the statutes.” Zynga, 750 F.3d at 1105 (citing Gwaltney of Smithfield, Ltd. v. Chesapeake Bay Found., Inc., 484 U.S. 49, 56 (1987)). Because the term “information concerning” is not further defined within the statute, the Court considers the ordinary meaning of this term, including its dictionary definition. Zynga, 750 F.3d at 1105 (citing Wilderness Soc'y v. U.S. Fish & Wildlife Serv., 353 F.3d 1051, 1061 (9th Cir. 2003) (en banc), amended by 360 F.3d 1374 (9th Cir. 2004) (en banc)). The Electronic Communications Privacy Act, which is related to both the Wiretap Act and the SCA, was promulgated in 1986. Zynga, 750 F.3d at 1106; In re Yahoo Mail Litig., 7 F.Supp.3d 1016, 1026 (N.D. Cal. 2014) (discussing how the Wiretap Act and SCA are titles of the Electronic Communications Privacy Act). The Zynga Court utilized the 1981 edition of Webster's Third New International Dictionary when defining “substance, purport, or meaning” because the dictionary was “in wide circulation during the relevant time frame.” Zynga, 750 F.3d at 1106. The 1981 edition of Webster's defines: (1) “information” as “the communication or reception of knowledge or intelligence,” Webster's Third New International Dictionary 1160 (1981), and (2) “concerning” as “relating to,” Id. at 470. These definitions indicate that Congress intended “content” to be broad because “content of a communication” necessarily encompasses “the communication or reception of knowledge or intelligence.” In other words, the definition of “content” is not narrow; rather, the definition broadly includes “the communication or reception of knowledge or intelligence” that is “relating to” “a person's intended message to another (i.e., the ‘essential part' of the communication, the ‘meaning conveyed,' and the ‘thing one intends to convey').” Webster's Third New International Dictionary 470, 1160 (1981); Zynga, 750 F.3d at 1106.

The broad scope of “content” is further illuminated by the “language and design of the statute as a whole,” K Mart Corp., 486 U.S. at 291. The use of the word “any” modifying “information concerning” highlights Congress's intent to have a broad definition of “content.” Republic of Iraq v. Beaty, 556 U.S. 848, 856 (2009) (interpreting the word “any” to have an “expansive meaning” when analyzing the phrase “any other provision of law” “giving us no warrant to limit the class of [things referenced].”); accord Am. C.L. Union Immigrants' Rts. Project v. United States Immigr. & Customs Enf't, 58 F.4th 643, 657 (2d Cir. 2023) (quoting Cohen v. JP Morgan Chase & Co., 498 F.3d 111, 117 (2d Cir. 2007) (“[T]he statutory use of the word ‘any' has long signaled ‘Congress's intent to sweep broadly to reach all varieties of the item referenced.'”); Webster's Third New International Dictionary 97 (1981) (defining “any” as “one, some, or all indiscriminately of whatever quantity[.]”). The context of the definition of “content” thus indicates that there exists an indiscriminate number of classes or varieties of “information” that constitute “content” so long as that “information” “concerns” or “relates to” a “person's intended message to another.” Zynga, 750 F.3d at 1105-06.

The legislative history agrees with a broad interpretation of “content.” S. REP. 99-541, 23, 1986 U.S.C.C.A.N. 3555, 3556-57. Congress explained that the purpose of enacting the SCA was to protect individuals on the shortcomings of the Fourth Amendment. Id. Specifically, Congress enacted the SCA due to the “tremendous advances in telecommunications and computer technologies” with the “comparable technological advances in surveillance devices and techniques.” Id. The SCA was further meant to help “Americans [who] have lost the ability to lock away a great deal of personal and business information.” Id.

With this analysis of the scope of the term “content” under the SCA in mind, the Court now turns to determine if passwords are afforded protection under the SCA under that understanding of the definition of the term “content.” Passwords are undoubtedly a form of “information.” And passwords broadly “relate to” (or are “concerning”) the “substance, purport, or meaning of [a] communication” even if passwords are not themselves the content of a communication. Passwords further relate to a person's intended message to another; while a password is not the content of the intended message, a password controls a user's access to the content or services that require the user to prove their identity. As a matter of technological access to an electronic message, a password thus “relates to” the intended message because without a password, the author cannot access their account to draft and send the message (and the user cannot access their account to receive and read the message). When a person uses a password to access their account to draft and send a message, that author inherently communicates to the recipient at least one piece of information that is essential to complete the communication process: namely, that the author has completed the process of authentication. The password is information or knowledge which is intended to convey a person's claim of identity not just to the messaging system but also implicitly to the recipient. As such, within the context of electronic communication systems, passwords are a critical element because they convey an “essential part” of the communication with respect to access and security protocols. The dispute at issue here demonstrates the inherency of communicating about passwords when using a messaging platform such as Discord: when the user of the “Archetype” sent messages demanding ransom for the stolen source code, those messages conveyed to the recipients that the author is or was an authentic or authorized user of the “Archetype” account who used and had access to the password for that account. That password for that account thus is information concerning that communication, even if the password is not itself written out in the content directly.

This holding is consistent with the context and purpose of the SCA. The SCA was promulgated to protect the content of a communication maintained within an “electronic storage.” 18 U.S.C. § 2702. If this Court were to hold that passwords are not afforded SCA protections, such a ruling would otherwise create a perverse incentive which circumvents the protections of afforded by SCA. Contents of an electronic communication are stored as files within an electronic memory or storage device, which files are accessible because the person uses their password to access the account. There is no question that the contents of a communication stored within an electronic storage device are normally not accessible absent user consent. However, an opposing party in litigation could request production of a user's and thereafter circumvent necessary user consent, under the assertion that they are not subject to protections of the SCA. With this password in hand, a litigant (or their ediscovery consultants) would have unfettered access to all communications within the account holder's electronic storage, without regard to relevance, privilege, or other

appropriate bounds of permissible discovery. In other words, litigants could circumvent the very purpose of the SCA by simply requesting that a service provider disclose the password for a user account, ultimately vitiating the protections of the SCA.

This holding is consistent with the Ninth Circuit's interpretation of the SCA. Theofel, 359 F.3d at 1072. The Theofel Court explained:

Like the tort of trespass, the Stored Communications Act protects individuals' privacy and proprietary interests. The Act reflects Congress's judgment that users have a legitimate interest in the confidentiality of communications in electronic storage at a communications facility. Just as trespass protects those who rent space from a commercial storage facility to hold sensitive documents, [citation], the Act protects users whose electronic communications are in electronic storage with an ISP or other electronic communications facility.

Id. at 1072-73 (citing Prosser and Keeton on the Law of Torts § 13, at 78 (W. Page Keeton ed., 5th ed. 1984)). The Theofel Court thus explained that the SCA should be examined under the common law tort of trespass. Theofel, 359 F.3d at 1073. The Theofel Court further noted that “Congress surely did not intend to exempt” a hacker's use of a stolen password when breaking into a mail server by considering the use of a stolen password an “authorized” access of the mail server. Id. The Court looked to the “essential nature of the invasion.” Id. In this analytical context, Congress surely did not intent to create a law forbidding (by analogy) a bank from turning over the money in its vault but in the same stroke of its pen allowing the bank to turn over the vault key. Protecting passwords relates to the “essential nature of the invasion” here by protecting access to the contents of a communication within electronic storage. Accordingly, protecting passwords under the SCA promotes and relates to “the specific interests that the tort of trespass seeks to protect.” Id. (citing Desnick v. Am. Broad. Companies, Inc., 44 F.3d 1345, 1352 (7th Cir. 1995); Lewis v. United States, 385 U.S. 206, 211 (1966); Food Lion, Inc. v. Capital Cities/ABC, Inc., 194 F.3d 505, 517-18 (4th Cir. 1999)). Thus, finding that passwords are “information” subject to the protections of the SCA protects individuals' privacy and proprietary interests in their electronic communications, and furthers the legitimate interests that users have in the confidentiality of communications in electronic storage at a communications facility. Theofel, 359 F.3d at 1072.

In arguing passwords are not afforded protections under the SCA, Applicants primarily rely on the holding of In re Carrier IQ, Inc., 78 F.Supp.3d 1051, 1083-84 (N.D. Cal. 2015), which found passwords are not considered “content” in the context of a motion to dismiss for claims of violations of the Wiretap Act. [Dkt. 21 at 5]. However, Carrier is distinguishable and inapplicable to the instant application for a number of reasons explained below.

First, Carrier's holding is limited to the Wiretap Act. Carrier, 78 F.Supp.3d at 1083-84. Cases which rely on Carrier likewise limit and apply their holdings to only the Wiretap Act. See Brodsky v. Apple Inc., No. 19-cv-00712-LHK, 2019 WL 4141936 (N.D. Cal. Aug. 30, 2019); Brodsky v. Apple Inc., 445 F.Supp.3d 110 (N.D. Cal. 2020); Biesenbach v. Does 1-3, No. 21-cv-08091-DMR, 2022 WL 204358 (N.D. Cal. Jan. 24, 2022). While this Court acknowledges the Wiretap Act and the SCA utilize the same definition of “content,” this does not automatically indicate the definition is the same. “[A] statutory term may mean different things in different places[]” as “the presumption of consistent usage readily yields to context[.]” King v. Burwell, 576 U.S. 473, 493 n.3 (2015) (citing Util. Air Regul. Grp. v. E.P.A., 573 U.S. 302, 320 (2014).

Second, the context in which Carrier made its holding is materially different from the instant case. The Carrier opinion relied on the Ninth Circuit's Zynga opinion. Carrier, 78 F.Supp.3d at 1083. In turn, Zynga cited with approval the First Circuit's decision in Gilday v. Dubois, 124 F.3d 277 (1st Cir. 1997). Zynga, 750 F.3d at 1106. In Gilday, a prisoner-plaintiff brought suit against a prison-defendant for alleged Wiretap Act violations stemming from the prison's telephone monitoring system and “detailing” system. Gilday, 124 F.3d at 281. The “detailing” system recorded the prisoners' dialed numbers, call duration, and PIN. Id. at 281, 296 n.27. The PIN was assigned to the specific prisoner and used to facilitate the phone call. Id. The Plaintiff relied on the prison's interception of the PIN for the alleged Wiretap Act violation. Id. The First Circuit disagreed and found no Wiretap Act violation because the “detailing” procedure did not intercept content and “simply capture[d] electronic signals relating to the PIN of the caller, the number called, and the date, time and length of the call.” Id. at 296 n.27.

In Carrier, the Court held that “the PIN number in Gilday served the same function as traditional username and password” because the PIN was meant for authentication purposes of accessing the phone system. Carrier, 78 F.Supp.3d at 1084. Carrier further reasoned that “[j]ust as interception of the PIN number in [Gilday] was found to not implicate ‘content' information, neither does interception of a user name or password. While such credentials may be a prerequisite to engaging in communications (i.e., entering a user name and password in order to access one's email), the credentials themselves do not reveal the substance, purport, or meaning of any communication.” Id.

The context is clear that Carrier's limited holding does not extend to liability under the SCA. The Wiretap Act imposes liability based on the interception of the contents of a communication while in transit. Yahoo Mail Litig., 7 F.Supp.3d at 1026 (“Title I of the ECPA amended the federal Wiretap Act to impose liability for the interception of certain electronic communications while they are in transit.”). The Wiretap Act is meant to protect individuals from their communications being intercepted while in transit. The Wiretap Act protects real-time or near-real-time electronic communications that are in the process of being sent, delivered, or received. The key aspect of transient communication subject to Wiretap Act protection is its ephemeral nature; such communication exists only briefly in a human-accessible form as it travels from sender to recipient. The Wiretap Act is designed to protect these in-transit communications, acknowledging that individuals have a reasonable expectation of privacy in their conversations as they occur.

By contrast, the SCA imposes liability on service providers' knowingly divulging the contents of a communication in an electronic storage. Compare 18 U.S.C. § 2511 with 18 U.S.C. § 2702. Under the SCA, liability is thus imposed when the content of a communication, stored in an electronic storage, is knowingly divulged. 18 U.S.C. § 2702. The content of a communication subject to protections of the SCA are by definition not transient or ephemeral; because the SCA deals with storage, the content of a communication can later be accessed, potentially for an indefinite period. As such, these stored communications can be repeatedly and more readily accessed unlike transient communications under the Wiretap Act.

Finally, Gilday is materially different from the instant case. In Gilday, the prison did not obtain the content of a communication by intercepting prisoners' PIN. Gilday, 124 F.3d at 281, 296 n.27. Indeed, the contents of the communication in Gilday were the words spoken into or heard by the phone; the phone conversation was completely separate from the PIN. Id. Because the other party to the phone call need never be told that the prisoner must use a PIN to access the phone line, there is no inherent communication concerning the PIN in a phone call (again, unlike stored electronic communications, which inherently reveal information about the account user). Unlike under the SCA, in Gilday there existed no informational nexus or relation between the PIN and the phone conversation.

This issue exemplifies the second problem applying Carrier's holding to the SCA. The Wiretap Act's factual patterns are materially distinct from SCA fact patterns. In Gilday, the PIN functioned more as a username rather than a password. Gilday, 124 F.3d at 281, 296 n.27 (the call detailing system “captures electronic signals relating to the PIN of the caller, the number called, and the date, time and length of the call”). The PIN was a prisoners' specific identification number that allowed them access to the telephone. Id. The information yielded from the interception of the PIN would be the identification of the specific individual who was tied to that number, nothing more. Additionally, given the ephemeral nature of phone calls, there was no risk that the contents of the communication could be later accessed after the interception of the PIN.

If an electronic communication service provider discloses a users' username and password to a third party, the electronic communication service provider would know they are ultimately disclosing the contents of the communication because that third party could then access the full contents of the stored communication using the username and password. Functionally, by disclosing a password as requested here, Discord would divulge information which it knows will allow third parties to access the contents of all communications in the listed user accounts. The only conceivable use for the passwords here is for Applicants to access the requested accounts (such as “Archetype”) and view the contents of all electronically stored communications in those requested accounts. Indeed, as the discussion of the Anton Pillar Order proceedings above indicate, Applicants' consultant Warren asked for and use the usernames and passwords of Gervais's accounts to access the information therein.

Accordingly, this Court find that passwords are afforded protections under the SCA. However, this does not end the dispute. The Court next address whether Gervais consented to the disclosure of the content of his communications.

B. Whether Gervais Consented.

The SCA allows a provider of covered services to “divulge the contents of a communication” to “an addressee or intended recipient of such communication,” or “with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service.” Zynga, 750 F.3d at 1104 (quoting 18 U.S.C. § 2702). The SCA does not define “lawful consent” or describe how it may be established. In re JSC Com. Bank Privatbank, No. 21-mc-80216-VKD, 2021 WL 4355334, at *5 (N.D. Cal. Sept. 24, 2021). However, “exceptions to the SCA are to be construed narrowly.” Suraju v. Yahoo!, Inc., No. 22-mc-80072-SK, 2022 WL 3365086, at *4 (N.D. Cal. July 13, 2022), appeal dismissed, No. 22-16231, 2022 WL 18671555 (9th Cir. Dec. 14, 2022) (citing Suzlon Energy Ltd. V. Microsoft Corp., 671 F.3d 726, 730 (9th Cir. 2011)).

“Courts have cautioned that implied consent applies only in a narrow set of cases.” Calhoun v. Google LLC, 526 F.Supp.3d 605, 623 (N.D. Cal. 2021) (quoting In re Google, Inc., 2013 WL 5423918, at *12 (N.D. Cal. Sept. 26, 2013). “[W]hile consent may permit production by a provider, it may not require such a production.” In re Facebook, Inc., 923 F.Supp.2d 1204, 1206 (N.D. Cal. 2012) (citing United States v. Rodgers, 461 U.S. 677, 706 (1983) (“The word ‘may,' when used in a statute, usually implies some degree of discretion.”) (emphasis in original). The party seeking the benefit of the exception has the burden to prove consent. Calhoun, 526 F.Supp.3d at 620 (quoting Matera v. Google Inc., No. 15-cv-04062-LHK, 2016 WL 5339806, at *17 (N.D. Cal. Sept. 23, 2016).

The Northern District of California has found consent may be explicit or implied, but requires the consent be actual. Calhoun, 526 F.Supp.3d at 620 (quoting In re Google, 2013 WL 5423918, at *12). “Thus, ‘a reviewing court must inquire into the dimensions of the consent and then ascertain whether the interception exceeded those boundaries.'” Calhoun, 526 F.Supp.3d at 623 (quoting In re Pharmatrak, Inc., 329 F.3d 9, 19 (1st Cir. 2003)).

Both Parties agree Gervais did not explicitly consent to Discord knowingly “divulge the contents of a communication.” See Dkt 21. The Parties disagree on whether Gervais implicitly consented to the disclosure of the content of his communications. See id. Applicants cite circumstantial evidence that purportedly shows Gervais's consent. Specifically, Applicants rely on the fact that Gervais was on notice that his Discord communications were ordered to be collected by the Canadian Court; Gervais consented to the search of his devices which would provide access to his Discord communications in the Canadian Litigation; and Gervais actively participated in the collection of his data in the Canadian Litigation. Id. at 6.

Discord argues that any judicial decree stemming from the Canadian Litigation is inapplicable because the judicial decree does not indicate Gervais actually consented; rather, the judicial decree is an order from the court for which Gervais may still preserve objections and may not consent to. Additionally, Discord argues Applicants' support for Gervais's consent is flawed because the support comes from Mr. Warren's affidavit, a secondhand account, rather than Gervais himself. Further, Discord argues Gervais's actions indicate he does not consent. For example, Discord argues Mr. Warren's affidavit details “various instances of delay tactics, lack of cooperation, and outright obstruction.” [Dkt. 21 at 9 (citing Dkt. 1-2 at 3 (“Gervais ... ha[s] not rendered the ‘necessary assistance' required” under the Anton Piller order such that Warren “ha[s] been frustrated by Gervais in [Warren's] efforts to preserve data”), 5 (expressing concern that Gervais would delete or alter information though he allowed the search), 8 (Gervais failing to respond to Warren's attempts to access password repository and that “Gervais had booby-trapped his own . . . account”), 11 (finding Gervais's explanations “not credible” in part because Gervais continued to access Discord), 12 (Gervais used a hotkey in Warren's presence to delete email account data), 12-13 (recounting Gervais's misrepresentations concerning his access to Discord).)].

The Court finds that Gervais's actions, as presented on the current record, fail to show that he did implicitly consent to Discord disclosing the contents of his communications. First, the mere fact Gervais is on notice of his obligation under the Canadian Orders does not indicate his consent to the disclosure of the contents of his communications. Indeed, the fact that he was ordered by the Canadian court to allow searches and inspections of his electronic devices indicates he opposed such disclosures and would not allow them voluntarily (otherwise, there would be no need for an order from the Canadian court).

Secondly, a Court order to produce the communication subject to a judicial decree stemming from the Canadian Litigation does not amount to Gervais consenting to Discord disclosing the content of the communication. Instructive is the Ninth Circuit's analysis in Suzlon, 671 F.3d at 731, where the court explained that compliance with foreign civil litigation rules does not amount to implied consent. In that case, the party seeking a finding of implied consent, Suzlon, argued that “under Australian civil litigation rules, a litigant is obligated to list and disclose documents that would include the emails at issue,” but the Ninth Circuit indicated this obligation does not amount to implied consent. Id. Rather, the Court stated the Australian civil litigation rules required “Sridhar himself . . . be responsible for disclosing [the content of the communications,]” not the non-party Microsoft, Corp. Id.

Furthermore, Gervais's actions detailed in Mr. Warren's affidavit indicate that he does not implicitly consent to the production of the contents of his communications. The “various instances of delay tactics, lack of cooperation, and outright obstruction[]” highlighted by Discord indicate Gervais would not consent to the production of the content of the communications on Discord. See Dkt. 21 at 9 (citing Dkt. 1-2 at 3 (“Gervais ha[s] not rendered the ‘necessary assistance' required” under the Anton Piller order such that Warren “ha[s] been frustrated by Gervais in [Warren's] efforts to preserve data”), 5 (expressing concern that Gervais would delete or alter information though he allowed the search), 8 (Gervais failing to respond to Warren's attempts to access password repository and that “Gervais had booby-trapped his own . . . account”), 11 (finding Gervais's explanations “not credible” in part because Gervais continued to access Discord), 12 (Gervais used a hotkey in Warren's presence to delete email account data) 12-13 (recounting Gervais's misrepresentations concerning his access to Discord)). While such tactics by Gervais may be improper under Canadian law (and presumably will be addressed by the Canadian Court), for purposes of the implied consent analysis here, those actions support a conclusion that Applicants failed to satisfy their burden of showing that Gervais implicitly consented to disclosure of his communications. Therefore, in light of the above analysis, the Court finds that Gervais has not consented either expressly or impliedly to the disclosure of the contents of his communications, including in particular the passwords to his accounts.

IV. APPOINTMENT OF SECTION 1782 COMMISSIONER

The Court next addresses Applicants' ancillary request to appoint Mr. Warren as “Commissioner” for the purpose of issuing the subpoena and receiving the documents and materials in response thereto. [Dkt. 1 at 14]. Whether to appoint a Commissioner, and determining the qualifications of any potential Commissioner, is a multi-factor analysis. See United States v. Google LLC, -- F.Supp.3d --, 2023 WL 5725518 (N.D. Cal. Sept. 5, 2023). However, in subsequent briefing, Applicants and Discord have stipulated that a “commissioner does not need to be appointed in this matter.” [Dkt. 20 at 2]. Therefore, Applicants' initial request for appointment of a Commissioner is DENIED as moot.

V. PROTECTIVE ORDER

Courts have discretion to issue a protective order for “good cause” in order to “protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense[.]” Fed.R.Civ.P. 26(c). To establish “good cause,” there must be a demonstration of specific prejudice or harm that would result from the absence of a protective order. Phillips ex rel. Ests. of Byrd v. General Motors Corp., 307 F.3d 1206, 1210-11 (9th Cir. 2002). “[B]road allegations of harm, unsubstantiated by specific examples or articulated reasoning, do not satisfy the Rule 26(c) test [for good cause].” Beckman Indus. v. Int'l Ins. Co., 966 F.2d 470, 476 (9th Cir. 1992).

Here, good cause exists to protect the privacy and rights of the persons whose information, messages, and documents may be produced by Discord in response to an appropriate subpoena. As noted, the proposed subpoena is broadly drafted, and therefore documents, messages, and information produced in response to the requested subpoena may not lead to Gervais and Roosen. Accordingly, it is necessary to protect the rights of any potential and innocent third parties. See, e.g., Strike 3 Holdings, LLC v. Doe, No. 23-cv-01985-AMO, 2023 WL 3483288, at *2 (N.D. Cal. May 15, 2023). The Court takes Judicial Notice of the fact Discord is a messaging platform which allows minor children to utilize the service. See Discord's Terms of Service, (Feb. 24, 2023), https://discord.Com/terms#2 (last visited Aug. 14, 2023) (Section 2 indicating individuals must be thirteen years or older to utilize Discord's service.). Indeed, it appears that Discord is a messaging platform which is popular with young people playing online video games. See Kellen Browning, 5 Ways Young People Are Using Discord, New York Times (Dec. 29, 2021), https://www.nytimes.com/2021/12/29/business/discord-users-gen-z.html (last visited Aug. 15, 2023) (“Discord, the online messaging platform, has long been popular with gamers.... The site is particularly popular with young adults, teenagers and almost-teenagers.”). Because information, messages, and documents involving minors may be implicated (whether inadvertently or because the subpoena is broadly drafted) by the discovery sought, the Court finds that specific potential harm to minors should be addressed, as well as the annoyance, embarrassment, and undue burden suffered by any innocent third parties (whether minors or not) should their private messages be publicly produced by Discord with no confidentiality or other protections.

After reviewing Applicants' and Discord's stipulated protective order, [Dkt. 19], the Court finds that good cause exists to GRANT the stipulated protective order to handle the confidential treatment of confidential documents, information, messages, or data produced by Discord in response to an appropriately framed subpoena.

VI. MISCELLANEOUS

Following oral argument and subsequent supplemental briefing, two issues remain regarding the issuance of the subpoena. [Dkt. 20]. First, whether a litigation hold should be implemented pausing any of Discord's routine deletion procedures, notwithstanding Discord's preservation of all responsive accounts. Id.

Discord stated it “has preserved all accounts it could identify based on the information provided by Applicants, to the extent any exist.” [Dkt. 21 at 10]. Discord avers it created a “snapshot” of the accounts, and thereby preserved any information in those accounts. Id. Applicants imply, without explanation, Discord created one “snapshot” subject to the information Applicants gave Discord on August 17, 2023, and Discord will create another “snapshot” at the time of production. [Dkt. 22 at 8 n.4].

Applicants explain their concern that, “[i]f Gervais or Roosen engaged in further communications, create new aliases, or otherwise, between August 17, 2023 and the time of production, and Discord's routine deletion procedures are not halted, evidence of those communications and aliases could be lost forever.” Id.

Discord's only obligation is to preserve accounts that it is able to identify based on the information that it has been provided by Applicants. Other than speculation, Discord has failed to show what new aliases or accounts Gervais or Roosen would utilize because (as noted above) Applicants provided Discord with no identifiable information for Gervais and Roosen other than their names. Applicants' failure to provide insufficient information associated with potential other accounts Gervais and Roosen may be using is not a sufficient basis to require Discord to halt all routine deletion procedures for an unknown number of other accounts, particularly where Discord has taken reasonable steps to preserve data in the accounts which were adequately identified.

Accordingly, the Court GRANTS-IN-PART Applicant's request for a litigation hold. Discord is ORDERED to preserve the data and communications in all accounts relating to Gervais and Roosen which Discord previously identified based on the information provided by Applicants, to the extent any exist, until the production of the information subject to the subpoena. Further, Discord is ORDERED to exempt the preserved accounts from deletion policies or other routine retention policies.

The final remaining issue is whether Discord can be prevented from notifying Gervais of the instant subpoena. Applicants seek “a brief non-disclosure order preventing Discord from disclosing the collection of Gervais's communications[.]” [Dkt. 21 at 3]. Applicants acknowledge “nondisclosure orders, in the context of a civil subpoena, have not been addressed in the Ninth Circuit” nor in this Court. Id. (citing 18 U.S.C. § 2703). Applicants base their argument for the nondisclosure order on the risk of spoliation by Gervais. However, this risk is at best speculative and is mitigated because Discord has already taken snapshots of the accounts, and Discord going forward is required to abide by this Court's ORDER to preserve all accounts it could identify based on the information provided by Applicants, to the extent any exist, until the production of the information subject to the subpoena. As such, Applicants' request is DENIED WITHOUT PREJUDICE as moot.

CONCLUSION

In view of the foregoing, the Court GRANTS-IN-PART Applicant's application and grants leave for Applicants to serve an appropriate subpoena for documents on Discord but DENIES-IN-PART WITHOUT PREJUDICE the application to the extent that the proposed subpoena submitted to the Court requires modification for the reasons stated herein, including with regard to the Court's finding that passwords are subject to the protections of the SCA here. The Parties are hereby ORDERED to meet and confer promptly to prepare a mutually agreeable subpoena for documents which is consistent with the Court's rulings herein. If Applicants and Discord are able to reach agreement, they shall submit a Stipulation with Proposed Revised Subpoena to the Court within thirty (30) days of entry of this Order. If Applicants and Discord are unable to reach agreement on a revised subpoena, within thirty (30) days of entry of this Order they shall each file a brief no longer than three pages explaining their positions on areas of disagreement and attaching their respective proposed revised subpoenas.

The Court DENIES AS MOOT Applicants' request for appointment of a Commissioner. [Dkt. 1 at 14].

The Court further hereby GRANTS Applicants' and Discord's stipulated protective order. [Dkt. 19].

The Court GRANTS-IN-PART Applicants' request for a litigation hold as discussed above. [Dkt. 20].

The Court DENIES WITHOUT PREJUDICE Applicants' request for a brief nondisclosure order with regard to Gervais. [Dkt. 21].

IT IS SO ORDERED.