The case of the day is Bodyguard Productions, Inc. v. Musante (D. Hawaii 2020). Bodyguard owned the copyright for a movie called The Hitman’s Bodyguard. It alleged that Alex Musante had infringed the copyright. The claim was that Musante had streamed the movie using a BitTorrent client. In an amended complaint, filed apparently after having secured Musante’s cooperation, Bodyguard alleged that several unknown defendants had induced the infringement by making a BitTorrent client called Popcorn Time available on their websites. It moved for leave to transmit letters of requests to the central authorities in the Netherlands, Australia, the UK, and Iceland directed at several internet companies and apparently aimed at uncovering the identity of the registrant of the domain names used by the infringers or of the operators of the servers associated with the relevant IP addresses. The judge denied the request on the grounds that Bodyguard had not sufficiently shown that the Doe defendants were persons who were subject to suit or that they were subject to personal jurisdiction in Hawaii.

The judge cited an unpublished District of Hawaii decision setting out a multifactor test for when to authorize discovery to discovery the identity of unknown internet defendants, so this decision doesn’t come out of left field. But decisions like this are, in my view, wrong and should not be followed. Especially in light of the GPDR, which has led to the concealment of WHOIS information that used to be public, it can now be impossible to determine the true registrant of a domain name without legal process. And it has always been difficult to determine the identity of the customer of a server company who runs a server associated with a particular IP address without the server company’s cooperation or legal process. We see this in today’s case: a Dutch server company indicated that it knew who the John Doe in question was but that it could not provide information without a court order. Given the amount of business online, and the amount of wrongful conduct online, a court should not erect significant burdens to discovery of the identity of website operators—except perhaps in defamation cases or other discrete areas of the law where First Amendment or other independent values are at stake.