Mobilisa, Inc. v. Doe

170 P.3d 712 (2007)

MOBILISA, INC., a Washington corporation, Plaintiff/Appellee,
v.
John DOE 1 and The Suggestion Box, Inc., Defendants/Appellants.

No. 1 CA-CV 06-0521.

Court of Appeals of Arizona, Division 1, Department B.

November 27, 2007.

Whitten Berry, PLLC by Christopher T. Whitten, Phoenix, Law Offices of Charles Lee Mudd, Jr. by Charles Lee Mudd, Jr., Chicago, Illinois, Attorneys for Appellants.

Lewis and Roca, LLP by Randy Papetti, Robert G. Schaffer, Phoenix, Preston Gates & Ellis, LLP by David A. Linehan, Michael K. Ryan, Seattle, Washington, Attorneys for Appellee.

Tiffany & Bosco, P.A. by John P. Flynn, Phoenix, Public Citizen Litigation Group, by Paul Alan Levy, Washington, D.C., Electronic Frontier Foundation by Corynne McSherry, San Francisco, California, Attorneys for Amicus Curiae.

OPINION

TIMMER, Judge.

¶ 1 This appeal presents our first opportunity to consider the First Amendment rights of internet users to engage in anonymous speech. In doing so, we decide whether the superior court erred by granting a request by appellee Mobilisa, Inc. ("Mobilisa") to discover from appellant The Suggestion Box, Inc. ("TSB"), an Arizona email service provider, the identity of appellant John Doe 1 ("Doe"), a TSB account holder. For the reasons that follow, we adopt a three-step test for use in evaluating such requests. Although the superior court properly applied the initial two steps of this test, it did not consider the third step. We therefore remand for application of that step.

BACKGROUND

¶ 2 Nelson Ludlow is the founder and chief executive officer of Mobilisa, a Washington company that provides wireless and mobile communication systems to customers that include government and military entities. In light of the confidential nature of its business, Mobilisa secures its computer and email systems.

¶ 3 On June 21, 2005, Ludlow used his Mobilisa email account to send an intimate message to Shara Smith, who was involved in a personal relationship with Ludlow and was not employed by Mobilisa. Ludlow also sent a copy of the message (the "Ludlow/Smith email") to his personal email address and to his mobile phone. Six days later, an unknown number of individuals, including members of Mobilisa's management team, received an email from an anonymous sender with an address from theanonymousemail.com, which is owned and maintained by TSB, an Arizona corporation. The anonymous email contained the contents of the Ludlow/Smith email and the subject line, "Is this a company you want to work for?"

¶ 4 Mobilisa subsequently filed suit in the State of Washington naming John Does 1-10 as defendants and alleging violations of two federal laws relating to electronic communications, 18 United States Code ("U.S.C.") sections 1030 & 2701 (2000),^[1] and asserting a common law claim of trespass to chattel. The central contention of Mobilisa's claims was that the defendants accessed Mobilisa's protected computer systems and email accounts without or in excess of authorization. Mobilisa sought damages and injunctive relief.

¶ 5 In August 2005, Mobilisa filed an application pursuant to Arizona Rule of Civil Procedure 30(h) in the Arizona Superior Court in Maricopa County requesting the court to issue a subpoena based on a commission for subpoena authorized by the Jefferson County Superior Court in Washington. Mobilisa sought to compel TSB to disclose the identity of the person who used its services to send the anonymous email. Upon a subsequently filed motion, the superior court granted Mobilisa's request and permitted it to engage in limited discovery.

¶ 6 TSB subsequently filed a motion to vacate the discovery order, which the court granted on December 28. In its ruling, the court adopted the two-step approach used in Doe v. Cahill, 884 A.2d 451 (Del.2005), to decide whether the identity of an anonymous internet speaker should be compelled in light of the speaker's First Amendment rights. Under Cahill, the speaker's identity can be divulged if: (1) the requesting party makes reasonable efforts to notify the anonymous speaker of the discovery request and that person is afforded a reasonable time to respond, and (2) the requesting party demonstrates its cause of action would survive a motion for summary judgment. Id. at 460-61. The court then found that although Mobilisa had not satisfied the Cahill standard, it would be allowed an opportunity to supplement its application in an attempt to do so. The court further ordered TSB to notify its email account holder of Mobilisa's subpoena request.

¶ 7 On February 23, 2006, TSB's counsel filed an affidavit stating counsel had agreed, with TSB's consent, to also represent Doe in this matter, and Doe had received notification on February 9 of Mobilisa's request for his identity. Through counsel, Doe objected to Mobilisa's request and asserted that he did not access or obtain the Ludlow/Smith email through Mobilisa's computers.

¶ 8 On February 27, the superior court ruled that Mobilisa had made a sufficient showing to meet the Cahill standard and granted Mobilisa leave to conduct discovery regarding Doe's identity. TSB and Doe (collectively "TSB-Doe") timely appealed.^[2]

¶ 9 We review the superior court's ruling on a discovery matter for an abuse of discretion. Brown v. Sup.Ct., 137 Ariz. 327, 331, 670 P.2d 725, 729 (1983). The court abused its discretion if it committed an error of law in formulating its ruling. Grant v. Ariz. Pub. Serv. Co., 133 Ariz. 434, 456, 652 P.2d 507, 529 (1982). Whether the superior court applied the correct legal standard in reaching its discretionary conclusion is a matter of law that we review de novo. State v. Sanchez, 200 Ariz. 163, 165, ¶ 5, 24 P.3d 610, 612 (App.2001).

DISCUSSION

I.

¶ 10 TSB-Doe argues that although the superior court correctly adopted Cahill, the court misapplied that standard. In contrast, Mobilisa contends the superior court applied the wrong standard, but reached the correct result.^[3] Before addressing TSB-Doe's arguments concerning the superior court's application of Cahill, therefore, we first determine the appropriate standard to apply in balancing an anonymous internet speaker's First Amendment right to engage in free speech against the need for discovery of the speaker's identity.

A.

¶ 11 The United States Supreme Court has held that the First Amendment to the United States Constitution protects a person's right to speak anonymously, Buckley v. Am. Constitutional Law Found., 525 U.S. 182, 199-200, 119 S.Ct. 636, 142 L.Ed.2d 599 (1999); McIntyre v. Ohio Elections Comm'n, 514 U.S. 334, 341-51, 357, 115 S.Ct. 1511, 131 L.Ed.2d 426 (1995); Talley v. California, 362 U.S. 60, 64-65, 80 S.Ct. 536, 4 L.Ed.2d 559 (1960), and that the protections of the First Amendment fully extend to speech on the internet, Reno v. Am. Civil Liberties Union, 521 U.S. 844, 870, 117 S.Ct. 2329, 138 L.Ed.2d 874 (1997).^[4] Because a court order is state action that is subject to constitutional restraint, courts have acknowledged that the issuance of discovery orders and subpoenas compelling disclosure of the identities of anonymous internet speakers raises First Amendment concerns. See, e.g., Sony Music Entm't, Inc. v. Does 1-40, 326 F.Supp.2d 556, 563 (S.D.N.Y.2004); 2TheMart.com, 140 F.Supp.2d at 1091-92; Dendrite Int'l, Inc. v. John Doe No. 3, 342 N.J.Super. 134, 775 A.2d 756, 760-61 (App.Div.2001); Cahill, 884 A.2d at 456. Recognizing the internet as a unique "democratic forum for communication," one court concluded, "the constitutional rights of Internet users, including the First Amendment right to speak anonymously, must be carefully safeguarded." 2TheMart.com, 140 F.Supp.2d at 1097.

¶ 12 The right to speak anonymously, however, is not absolute. For example, an anonymous speaker, like a known one, has no First Amendment right to engage in obscenity, Roth v. United States, 354 U.S. 476, 483, 77 S.Ct. 1304, 1 L.Ed.2d 1498 (1957), libel, Beauharnais v. Illinois, 343 U.S. 250, 266, 72 S.Ct. 725, 96 L.Ed. 919 (1952), copyright infringement, Harper & Row Publishers, Inc. v. Nation Enters., 471 U.S. 539, 555-56, 105 S.Ct. 2218, 85 L.Ed.2d 588 (1985), misleading or commercial speech, Cent. Hudson Gas & Elec. Corp. v. Pub. Serv. Comm'n of N.Y., 447 U.S. 557, 563-64, 100 S.Ct. 2343, 65 L.Ed.2d 341 (1980), or use of "fighting words," Chaplinsky v. New Hampshire, 315 U.S. 568, 573, 62 S.Ct. 766, 86 L.Ed. 1031 (1942). Thus, victims of wrongful internet communications should be able to seek legal redress unimpeded by wrongdoers' attempts to hide behind an unwarranted shield of First Amendment rights. To balance the competing rights of anonymous internet speakers and parties seeking redress for wrongful communications, courts in this emerging area have employed differing standards.

¶ 13 In Sony Music, the Southern District of New York afforded the Doe defendants, who had downloaded copyrighted music on the internet, a lesser degree of First Amendment protection than those speakers who engaged in pure expressive speech. It held that disclosure of the Doe defendants' identities was warranted after considering the following five factors: (1) plaintiff's ability to establish a prima facie claim, (2) the specificity of plaintiff's discovery request, (3) the availability of alternative means to obtain the subpoenaed information, (4) the central need for discovery to advance plaintiff's claim, and (5) defendants' expectation of privacy. 326 F.Supp.2d at 564-67.

¶ 14 In Columbia Insurance Co. v. Seescandy.com, 185 F.R.D. 573, 578 (N.D.Cal. 1999), the Northern District of California also expressed concerns about the possible chilling effect of allowing discovery of an internet user's identity in a trademark infringement case. The court held that limited discovery for the purpose of identifying defendants for service of process may be warranted if plaintiff can: (1) identify the defendant with sufficient specificity such that the court can determine if the defendant is a real person or entity, (2) show previous efforts taken to locate the defendant, (3) demonstrate to the court's satisfaction that its cause of action could withstand a motion to dismiss, and (4) justify the discovery request and identify persons who could reasonably and likely lead to identifying information about the defendant. Id. at 578-80.

¶ 15 Relying on Seescandy.com, a superior court in New Jersey denied plaintiff's request to compel an internet service provider ("ISP") to reveal the identity of the Doe defendants, who allegedly posted defamatory information about plaintiff on the ISP's bulletin board. Dendrite, 775 A.2d at 760, 766. On appeal, the court affirmed the superior court's ruling and announced the following five-part test: (1) plaintiff must take efforts to notify the anonymous posters about the discovery request and allow the posters a reasonable opportunity to respond, (2) plaintiff must specify the exact statements made by the posters, (3) the complaint must set forth a prima facie cause of action, (4) plaintiff must produce sufficient evidence to support each element of its claim on a prima facie basis, and (5) the court must balance the strength of plaintiff's prima facie case against the necessity for disclosure. Id. at 760-61.

¶ 16 Declining to follow Seescandy.com and Dendrite, the superior court in this case adopted Cahill, which was the only guidance from a state supreme court available at that time.^[5] As in Dendrite, plaintiffs in Cahill sought to compel an ISP to disclose the identity of the Doe defendant who allegedly posted defamatory information about plaintiffs on an internet blog site.^[6]Cahill, 884 A.2d at 454-55. Reversing the superior court's order granting discovery, the Delaware Supreme Court announced and applied the following modified Dendrite standard, requiring plaintiff to: (1) take efforts to notify the anonymous posters about the discovery request and allow the posters a reasonable opportunity to respond, and (2) show its cause of action can withstand a motion for summary judgment on elements within its control. Id. at 460-61, 464. The Cahill court essentially combined the steps in Dendrite, except for the notice requirement, into a single summary judgment test. Id. As the Cahill court explained:

The second [Dendrite] requirement, that the plaintiff set forth the exact defamatory statements, is subsumed in the summary judgment inquiry. To satisfy the summary judgment standard a plaintiff will necessarily quote the defamatory statements in his complaint. The fourth Dendrite requirement, that the trial court balance the defendants First Amendment rights against the strength of the plaintiffs prima facie case is also unnecessary. The summary judgment test is itself the balance. The fourth requirement adds no protection above and beyond that of the summary judgment test and needlessly complicates the analysis.

Id. at 461.

¶ 17 Mobilisa argues the superior court erred in adopting the Cahill standard because that decision, as well as Dendrite, concerned a claim for defamation and dealt with "purely expressive" conduct. Because the present case involves property-based claims for wrongful access to Mobilisa's email system and is not dependent on the nature of the speech involved, Mobilisa urges us to adopt a less-stringent standard than one requiring defeat of a fictional motion for summary judgment, such as those announced in Sony Music and Seescandy.com.

¶ 18 We reject the notion of adopting differing standards that depend on the manner in which a plaintiff has framed its claim. Whether the claim is one for defamation or a property-based claim, the potential for chilling anonymous speech remains the same. See 2TheMart.com, 140 F.Supp.2d at 1093 (recognizing fear of disclosure of internet speaker's anonymity "would have a significant chilling effect on Internet communications and thus on basic First Amendment rights"). Phrased in terms of this case, disclosure of Doe's identity would expose Doe to the same potential harm as disclosing the identity of a speaker in a defamation case; both engaged in expressive speech protected by the First Amendment.^[7]

¶ 19 Additionally, adopting differing standards could encourage assertion of non-defamation claims simply to reap the benefit of a less-stringent standard. For example, we can imagine a situation in which an employer would sue an anonymous internet poster for unauthorized access to its system or files or release of confidential information simply as a way to uncover the identity of a criticizing or whistle-blowing employee.

¶ 20 Finally, adopting a single standard would both permit ease of application in the superior court and better enable consistent decision making.

¶ 21 In summary, we conclude that courts should utilize a single test in deciding whether to grant or deny a request to discover the identity of an anonymous internet speaker. We now address the composition of that test.

¶ 22 Mobilisa does not challenge the requirement set forth in both Cahill and Dendrite that the requesting party show the anonymous speaker has been given adequate notice and a reasonable opportunity to respond to the discovery request. Cahill, 884 A.2d at 460-61; Dendrite, 775 A.2d at 760-61. We agree with this approach and adopt it. A court should not consider impacting a speaker's First Amendment rights without affording the speaker an opportunity to respond to the discovery request. Consequently, the requesting party should make reasonable efforts to inform the anonymous party of the pending discovery request, including the pertinent case information, and inform that party of the right to timely and anonymously file and serve a response to the request. The requesting party's efforts must include notifying the anonymous party via the same medium used by that party to send or post the contested message. Id. For example, if the message at issue was sent via email, the requesting party must make the notification via a response to the email or separate email to the anonymous sender's address. Similarly, if the message at issue was posted to an internet message board, the requesting party must make the notification via a posting to that same message board.

¶ 23 We reject Mobilisa's assertion that we should adopt the less-stringent standards set forth in Sony Music and Seescandy.com. We agree with the Cahill court that requiring a plaintiff to merely set forth a prima facie claim (Sony Music) or survive a motion to dismiss (Seescandy.com) would set the bar too low, chilling potential speakers from speaking anonymously on the internet. Cahill, 884 A.2d at 457-58. Arizona, like Delaware, is a notice-pleading state. Anserv Ins. Servs., Inc. v. Albrecht, 192 Ariz. 48, 49, ¶ 5, 960 P.2d 1159, 1160 (1998). Thus, a complaint need merely set forth a short and plain statement showing the plaintiff is entitled to relief in order to survive a motion to dismiss. Rowland v. Kellogg Brown & Root, Inc., 210 Ariz. 530, 534, ¶ 15, 115 P.3d 124, 128 (App.2005). We therefore adopt the second step from Cahill that requires the requesting party to demonstrate it would survive a motion for summary judgment filed by Doe on all of the elements within the requesting party's control—in other words, all elements not dependent upon knowing the identity of the anonymous speaker. Requiring the requesting party to satisfy this step furthers the goal of compelling identification of anonymous internet speakers only as a means to redress legitimate misuses of speech rather than as a means to retaliate against or chill legitimate uses of speech.

¶ 24 Although we agree with the Cahill court's adoption of the two steps discussed above, we disagree with that court's conclusion that a balancing step is unnecessary. 884 A.2d at 461. Cahill rejected the Dendrite step requiring a balancing of the strength of the requesting party's case against the need for disclosure of the anonymous poster's identity, as that consideration is subsumed in the summary judgment requirement. Id. The Cahill court did not consider, however, whether balancing a broader range of competing interests is warranted. In our view, requiring the court to balance the parties' competing interests is necessary to achieve appropriate rulings in the vast array of factually distinct cases likely to involve anonymous speech.

¶ 25 First, surviving a summary judgment on elements not dependent on the anonymous party's identity does not necessarily account for factors weighing against disclosure. For example, the anonymous speaker may be a non-party witness along with a number of known witnesses with the same information. The requesting party's ability to survive summary judgment would not account for the fact that in such a case it may have only a slight need for the anonymous party's identity. See 2TheMart.com, 140 F.Supp.2d at 1095 (concluding, "non-party disclosure is only appropriate in the exceptional case where the compelling need for the discovery sought outweighs the First Amendment rights of the anonymous speaker"). Additionally, without a balancing step, the superior court would not be able to consider factors such as the type of speech involved,^[8] the speaker's expectation of privacy, the potential consequence of a discovery order to the speaker and others similarly situated, the need for the identity of the speaker to advance the requesting party's position, and the availability of alternative discovery methods. Requiring the court to consider and weigh these factors, and a myriad of other potential factors, would provide the court with the flexibility needed to ensure a proper balance is reached between the parties' competing interests on a case-by-case basis. Dendrite, 775 A.2d at 761 (concluding consideration of requests to compel production of anonymous speaker's identity "must be undertaken and analyzed on a case-by-case basis").

¶ 26 Second, a balance of competing interests is consistent with the standard used for evaluating a preliminary injunction, which we find analogous. In order to obtain a preliminary injunction, the requesting party must show, among other things, that a balance of hardships favors it. Shoen v. Shoen, 167 Ariz. 58, 63, 804 P.2d 787, 792 (App. 1990).^[9] An order compelling disclosure of an anonymous party's identity is essentially a mandatory injunction; both such orders change the status quo. Unlike most parties subject to a preliminary mandatory injunction, however, an unmasked anonymous speaker cannot later obtain relief from the order should the party seeking the speaker's identity not prevail on the merits of the lawsuit. Given this consequence, it is even more appropriate to require the court to balance the parties' competing interests before permitting discovery on the identity issue.

¶ 27 Third, requiring a balancing of competing interests provides an additional safeguard that comports with Arizona's broad protection given to free speech and individual privacy. See Ariz. Const. art. 2, §§ 6 & 8;^[10]Mountain States Tel. & Tel. Co. v. Ariz. Corp. Comm'n, 160 Ariz. 350, 354-55, 357 n. 13, 773 P.2d 455, 459-60, 462 n. 13 (1989) (recognizing Arizona Constitution directly provides broad free speech rights).

¶ 28 In summary, we hold that in order to compel discovery of an anonymous internet speaker's identity, the requesting party must show: (1) the speaker has been given adequate notice and a reasonable opportunity to respond to the discovery request, (2) the requesting party's cause of action could survive a motion for summary judgment on elements not dependent on the speaker's identity, and (3) a balance of the parties' competing interests favors disclosure. Because the superior court did not engage in the third step, and the parties were not afforded an opportunity to address that step before that court, a remand for that consideration is required, at a minimum. If the court misapplied the initial two steps, however, a remand may be unnecessary. We therefore turn to the court's ruling on those steps.

B.

1.

¶ 29 TSB-Doe does not dispute that Doe received adequate notice and a reasonable opportunity to respond to Mobilisa's request. Rather, TSB-Doe argues the superior court erred by placing the burden on TSB to notify Doe of the pending discovery request and by ruling without awaiting Doe's response. We disagree.

¶ 30 Mobilisa was required to show that Doe had been given adequate notice and a reasonable opportunity to respond to Mobilisa's discovery request. The purpose of the notification requirement is to ensure that Doe knows his First Amendment rights may be in jeopardy. The record reflects that Ludlow replied to one of Doe's anonymous emails, but Ludlow never received a response. In light of Ludlow's failed attempt to contact Doe, the superior court did not err by exercising its inherent authority to place the burden on TSB to notify Doe of the pending proceedings. See Acker v. CSO Chevira, 188 Ariz. 252, 254, 934 P.2d 816, 818 (App.1997) (defining inherent authority "as such powers as are necessary to the ordinary and efficient exercise of jurisdiction") (citation omitted). TSB does not assert that it incurred any undue expense or hardship in making the notification and admitted to the court that it was in the best position to notify Doe. Assuming ISPs or email service providers like TSB would incur costs in notifying an anonymous customer of a pending discovery request, the superior court can require the requesting party to pay that cost. We do not discern error.

¶ 31 The superior court also did not err by ruling on Mobilisa's request prior to receiving Doe's response two days later. TSB sent Doe a notification to Doe's previously supplied email address on January 13, 2006, and Doe admitted knowing of Mobilisa's request by February 9. On February 13, Doe's counsel submitted an affidavit relating Doe's assertion that Doe did not obtain the Ludlow/Smith email through any of Mobilisa's computers. Counsel also communicated that Doe reserved the option to file a response to Mobilisa's request, although Doe might not do so. Doe additionally asked counsel to be given until March 1 to decide how to proceed. Despite Doe's awareness that the court had ordered Doe to file any opposition "within twenty days of being notified," Doe never sought clarification to determine whether the order meant twenty days from the date notification was sent or received and never filed a motion for extension of time to file a response. Consequently, the superior court did not err when it issued its ruling on February 27, more than twenty days after TSB sent the notification email to Doe. See Day v. Schenectady Disc. Corp., 125 Ariz. 564, 568, 611 P.2d 568, 572 (App.1980) (holding notice requirement for repossession sale not dependent on whether debtor actually received notification, but whether secured party took reasonable steps to notify).

¶ 32 Additionally, we do not discern prejudice to Doe from the timing of the court's ruling as: (1) TSB adequately represented Doe's position before the superior court, (2) the court was aware of Doe's position through counsel's affidavit, (3) Doe's subsequently filed opposition essentially adopted TSB's arguments, and (4) we have considered the entire record, including Doe's filed opposition, as part of our de novo review.

¶ 33 For these reasons, we decide the superior court correctly applied step one of the Cahill test.

2.

¶ 34 TSB-Doe next argues the superior court erred in deciding that Mobilisa could survive a motion for summary judgment filed by Doe. Specifically, TSB-Doe contends the court failed to consider an essential element of each of Mobilisa's three claims — unauthorized access to Mobilisa's computer system. Summary judgment is appropriate if no genuine issues of material fact exist and the moving party is entitled to judgment as a matter of law. Orme Sch. v. Reeves, 166 Ariz. 301, 309-10, 802 P.2d 1000, 1008-09 (1990). We view the evidence and any reasonable inferences therefrom in the light most favorable to Mobilisa, as the party opposing summary judgment. Phoenix Baptist Hosp. & Med. Ctr., Inc. v. Aiken, 179 Ariz. 289, 293, 877 P.2d 1345, 1349 (App. 1994). We make no distinction between direct and circumstantial evidence. Lohse v. Faultner, 176 Ariz. 253, 259, 860 P.2d 1306, 1312 (App.1992).

¶ 35 TSB-Doe first contends there is no indication Doe intruded on Mobilisa's computers and points out that Mobilisa itself admitted it could not find any security breach on its system. Mobilisa counters that the evidence supports a reasonable inference that Doe wrongfully obtained the Ludlow/Smith email from Mobilisa's computer system, and thus genuine issues of material fact exist sufficient to withstand a motion for summary judgment. We agree with Mobilisa.

¶ 36 Both Ludlow and Smith avowed they did not grant anyone access to their email accounts. According to Ludlow, he was the only person authorized to access his Mobilisa email account, and he sent the Ludlow/Smith email to no one other than himself and Smith. Likewise, Smith stated that she did not forward the email to anyone and that she deleted the email from her computer server shortly after receiving it. After Doe sent the email at issue, Smith conferred with her email service provider and was told the Ludlow/Smith email had been deleted from the email server at the time Smith deleted it from her inbox approximately eight hours after receipt. Ludlow and Smith both indicated they each printed out a single copy of the email, immediately retrieved it from the printer, kept it in their possession, and personally destroyed the printed copy a day later.

¶ 37 Ludlow also indicated that the email addresses of Mobilisa's management team were not publicly available and only an employee or someone closely associated with Mobilisa would know the identities of Mobilisa's management team. Ludlow stated that although Mobilisa's Information Technology ("IT") department could access Mobilisa's email system for maintenance and trouble-shooting purposes, IT personnel were not authorized to view, copy, or distribute emails not stored in their assigned accounts. Moreover, Ludlow indicated that Mobilisa's IT department had conducted a thorough investigation, but was unable to discover how the Ludlow/Smith email was obtained, locate a security breach on its network, or identify who had accessed its protected computer systems. According to Ludlow, Mobilisa's network administrator concluded that the most likely scenario was that someone had accessed Mobilisa's email system without authorization. Additionally, Ludlow stated that he had no reason to believe anyone had "hacked" into his personal email account or his mobile phone.

¶ 38 Although it is possible that Doe or an acquaintance intercepted the Ludlow/Smith email at a source other than a Mobilisa computer, the record before us, when viewed in the light most favorable to Mobilisa, reasonably supports an inference that Doe obtained the Ludlow/Smith email from Mobilisa's computer system without authorization. Mobilisa's inability to identify a security breach on its network, together with Doe's knowledge of Mobilisa's management team and their email addresses, and his interest in Mobilisa's affairs, supports a reasonable inference that Doe was affiliated with Mobilisa, perhaps as an employee, had access to Mobilisa's computers, and exceeded his authorized use by accessing the Ludlow/Smith email.^[11]See W. Techs., Inc. v. Neal, 159 Ariz. 433, 439-40, 768 P.2d 165, 171-72 (App.1988) (stating summary judgment appropriate only if no other reasonable inference could be drawn); Farm-Aero Serv., Inc. v. Henning Produce, Inc., 23 Ariz.App. 239, 241, 532 P.2d 181, 183 (1975) (holding circumstantial evidence of crop-duster plane in general area sufficient for jury to reasonably infer that defendant company caused damage to plaintiff's lettuce fields); State ex rel. Fox v. New Phoenix Auto Auction, Ltd., 185 Ariz. 302, 306, 916 P.2d 492, 496 (App.1996) (holding evidence of company hiring emission inspector, inspecting emission equipment on vehicles, and vehicles subsequently passing emission test sufficient to withstand summary judgment on issue of whether company performed the required emission inspection, even though there was no evidence of a certificate of completion).

¶ 39 TSB-Doe also argues the superior court erred by ignoring the lack of evidence as to Mobilisa's damages and Doe's intent to defraud. We reject this argument. Although Mobilisa's claims pursuant to 18 U.S.C. § 1030 and the common law of trespass to chattel require a showing of actual damages, Mobilisa's claim pursuant to 18 U.S.C. § 2701 does not require this showing. See supra n. 1. A claim under § 2701 also does not require a showing of fraudulent intent.^[12] Because Mobilisa may pursue discovery if its cause of action could survive summary judgment on at least one of its claims, the superior court did not err by failing to consider these elements.

II.

¶ 40 We hold that to obtain a court order compelling discovery of an anonymous internet speaker's identity, the requesting party must show that: (1) the speaker has been given adequate notice and a reasonable opportunity to respond to the discovery request, (2) the requesting party's cause of action could survive a motion for summary judgment on the elements of the claim not dependent on the identity of the anonymous speaker, and (3) a balance of the parties' competing interests favors disclosure. Although the superior court properly considered steps one and two, it did not reach step three in its analysis. We therefore remand for consideration of that step.

CONCURRING: SUSAN A. EHRLICH, Judge.

BARKER, Presiding Judge, dissenting.

¶ 41 I agree with much of what the majority has set forth. My disagreement is focused primarily on the majority's adoption of a balancing test that takes place after the plaintiff has already established a genuine issue of material fact on each element of the claim, other than identity. Supra ¶¶ 23-28. Because I disagree that this balancing should take place after a plaintiff has met this standard, and this difference is outcome determinative in this case, I respectfully dissent.

I.

¶ 42 Anonymous speech is entitled to First Amendment protection. Buckley v. Am. Constitutional Law Found., 525 U.S. 182, 199, 119 S.Ct. 636, 142 L.Ed.2d 599 (1999). These protections apply whether or not the speech occurs in an electronic form propelled by the internet. Reno v. American Civil Liberties Union, 521 U.S. 844, 870, 117 S.Ct. 2329, 138 L.Ed.2d 874 (1997). However, the fact that speech is entitled to protection does not necessarily mean that the First Amendment will preclude liability against the speaker for the particular speech at issue. Virginia v. Black, 538 U.S. 343, 358, 123 S.Ct. 1536, 155 L.Ed.2d 535 (2003) ("The protections afforded by the First Amendment, however, are not absolute. . . ."). As Justice Holmes famously observed, "[t]he most stringent protection of free speech would not protect a man in falsely shouting fire in a theatre and causing a panic." Schenck v. U.S., 249 U.S. 47, 52, 39 S.Ct. 247, 63 L.Ed. 470 (1919).

¶ 43 What Justice Holmes' analogy makes clear is that if a person has a cause of action based on speech, and the First Amendment does not prohibit the action, the party is free to pursue it. That same principle applies to anonymous speech on the internet. Those who are wronged by anonymous speech still have a right to seek legal redress, if the First Amendment does not prohibit the cause of action being pursued. The issue then becomes what standard should be employed to determine when there is enough evidence of a valid claim such that a John Doe defendant's identity should be revealed.

¶ 44 As the majority correctly points out, there is a decided lack of consensus among the jurisdictions that have considered this issue as to the proper standard that should be used to determine when an anonymous speaker — being sued as a defendant — should be unmasked. Supra ¶¶ 12-16. There are no Arizona cases that address this issue. Despite this lack of consensus and case law, however, most courts agree on at least two primary concerns, which almost every test addresses to some degree.

¶ 45 First, nearly all courts agree that the party seeking disclosure should have the burden of making all reasonable efforts to notify the anonymous speaker. E.g., Doe v. Cahill, 884 A.2d 451, 460 (Del.2005); Dendrite Int'l, Inc. v. Doe, 342 N.J.Super. 134, 775 A.2d 756, 760-61 (2001). This requirement is meant to approximate the "notice and opportunity to be heard" component of due process by giving the anonymous speaker the opportunity to defend his or her anonymity and present justifications for its preservation. I have no quarrel with this factor, which the majority adopts. Supra ¶ 22.

¶ 46 Second, nearly all courts agree that something more than the general standard of discoverability, or even a general relevance standard, is required before the veil of anonymity may be pierced.^[13] Since the unmasking itself may well be the "real" remedy sought, it is important to make this standard difficult enough that only those with legitimate claims may unmask the anonymous speaker. Otherwise, this process could easily be abused by individuals whose true goals are "extrajudicial self-help remedies" such as "revenge or retribution."^[14]Cahill, 884 A.2d at 457. Merely alleging facts that would state a claim based on speech not protected by the First Amendment does little to protect the rights of those speaking anonymously. The test must be difficult enough to protect and encourage useful anonymous speech, while still providing some form of redress for those who are truly harmed by it. Id. at 464 ("[A] plaintiff with a legitimate claim should be able to obtain the identity of an anonymous defendant and proceed with his lawsuit.") (emphasis added).

¶ 47 Some courts have found this balance by adopting a motion to dismiss standard. Lassa v. Rongstad, 294 Wis.2d 187, 718 N.W.2d 673 (2006), reconsideration denied, 297 Wis.2d 325, 724 N.W.2d 207 (2006), and cert. denied, ___ U.S. ___, 127 S.Ct. 2251, 167 L.Ed.2d 1090 (2007). Other courts have adopted variations on this theme by adopting other requirements beyond the summary judgment standard, in which "the court must balance the defendant's First Amendment right of anonymous free speech against the strength of the prima facie case presented and the necessity for the disclosure of the anonymous defendant's identity to allow the plaintiff to properly proceed." Dendrite, 775 A.2d at 760-61.

¶ 48 I agree with the majority that the motion to dismiss standard can prove too easy in notice pleading states like Arizona, where all that is required to survive a motion to dismiss is "a short and plain statement of the claim showing that the pleader is entitled to relief." Ariz. R. Civ. P. 8(a)(2); see Cahill, 884 A.2d at 458 (explaining that since Delaware is a notice-pleading state, "the threshold showing a plaintiff must make to survive a motion to dismiss is low."). Differing from the majority, I agree with the line of cases adopting the summary judgment standard, meaning that the plaintiff must put on a case that is sufficiently strong to withstand a motion for summary judgment before the unmasking may occur. Supra ¶ 23 (adopting the summary judgment standard set forth in Cahill, 884 A.2d at 460). As Cahill notes, this standard, with its heightened requirement, appropriately balances the First Amendment rights of an anonymous speaker against the need to preserve a remedy for those who are truly harmed by anonymous speech.

¶ 49 The majority adopts what I will refer to as the summary judgment-plus standard, promulgated in Dendrite. My disagreement with the majority opinion is narrow. Specifically, I have no disagreement with an additional balancing, in which the necessity for disclosure is weighed against any number of factors, when the anonymous speaker is someone other than the defendant. However, when the anonymous speaker is the party-defendant, and the party-plaintiff has (1) created a genuine issue of material fact on (2) a claim that survives the First Amendment, I do not believe the Constitution permits taking away the party-plaintiff's right to seek redress. The elimination of such a claim is the only purpose that a balancing test serves, if both these requirements have already been met.

¶ 50 As Cahill points out, a form of balancing has already taken place. Were it not for the weight given to First Amendment rights at issue, discovery is and would be permitted "regarding any matter, not privileged, which is relevant to the subject matter involved in the pending action." Ariz. R. Civ. P. 26(b)(1) (emphasis added). Even if the information sought is not admissible, it remains discoverable under this standard as long as it "appears reasonably calculated to lead to the discovery of admissible evidence." Id. Thus, substantial deference has already been given to the First Amendment right.

¶ 51 I know of no constitutional authority that would create protection for speech after a party-plaintiff has established a genuine issue of fact on the elements of a claim that is not protected by the First Amendment. The majority analogizes to preliminary injunctive relief. Respectfully, I do not think the analogy is apt for an anonymous speaker who is the defendant, as contrasted with an anonymous speaker who is only a third-party witness. As to an alleged defendant, there are dramatic differences between failing to satisfy a balancing test in a preliminary injunction setting as contrasted with seeking to obtain the speaker's identity to preserve a separate cause of action.

¶ 52 Specifically, in the preliminary injunction context, plaintiffs whose temporary injunctions are denied are not foreclosed from pursuing relief in a trial on the merits. See Ariz. R. Civ. P. 65. For example, an individual who is denied a preliminary injunction to prevent a defendant from trespassing may still have a trial on the merits to determine whether injunctive relief should be granted. See id. The balancing required for a preliminary injunction does not take away the prospect of any relief — only the timing of the relief. Shoen v. Shoen, 167 Ariz. 58, 63, 804 P.2d 787, 792 (App.1990) (preliminary injunctions are not favored as they affect the status quo "pending a trial on the merits") (emphasis added). Denial of a preliminary injunction only precludes pre-trial relief.

¶ 53 On the other hand, when an anonymous speaker is the defendant, if plaintiff is not allowed to learn the identity of the speaker, there is no other opportunity for relief. The party-plaintiff cannot proceed to a hearing or trial on the merits as there is no defendant to answer and (potentially) hold liable. The balancing effectively denies the relief; it does not just affect the timing as is the case with a preliminary injunction. There is no constitutional provision that permits this post-summary judgment balancing, after a party-plaintiff has created a triable issue of fact on each element of the claim,^[15] to deprive a party-plaintiff from seeking redress for its losses caused by the actionable speech.

¶ 54 The majority also asserts that balancing is required because we must consider a multitude of potential factors and balance "the parties' competing interests on a case-by-case basis." Supra ¶ 25. That is exactly how we decide motions for summary judgment: on a case-by-case basis, applying the facts and the law unique in each particular claim. Orme School v. Reeves, 166 Ariz. 301, 802 P.2d 1000 (1990). For instance, the majority references that "the superior court would not be able to consider factors such as the type of speech involved." Supra ¶ 25. I respectfully disagree. Some types of speech, such as political expression, are entitled to the "broadest protection" of the First Amendment. McIntyre v. Ohio Elections Comm'n, 514 U.S. 334, 346, 115 S.Ct. 1511, 131 L.Ed.2d 426 (1995). Others, such as commercial speech, receive less protection. Central Hudson Gas & Electric Corp. v. Public Serv. Comm'n of New York, 447 U.S. 557, 562-63, 100 S.Ct. 2343, 65 L.Ed.2d 341 (1980). The standard as to which types of speech will be protected by the First Amendment, and which will not, are issues that any court must decide in determining whether a party's claim can survive summary judgment. Thus, to the extent the standard differs for different types of speech — and it does differ — that will be appropriately considered as part of the required analysis in determining whether the summary judgment standard has been met.

¶ 55 To return to the analogy drawn by Justice Holmes, when there is a genuine issue of material fact that someone yelled fire in a crowded theater and caused a panic, an injured party-plaintiff is entitled to learn the identity of the speaker whether it was a live voice in the theater or came via an anonymous email message. See Schenck, 249 U.S. at 52, 39 S.Ct. 247. No further balancing is required.

¶ 56 Here, as the majority correctly points out, there is a genuine issue of fact on each element of the plaintiff's claim. The summary judgment standard is satisfied. Accordingly, the trial court's order requiring disclosure of the defendant's identity should be affirmed.

NOTES

[1] 18 U.S.C. § 1030 provides, in part, as follows: (a) Whoever—

. . . .

(4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period;

(5)(A)(i). . . .

(ii) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; [] shall be punished as provided in subsection (c) of this section.

Additionally, 18 U.S.C. § 2701 provides, in part, as follows:

(a) Offense.—Except as provided in subsection

(c) of this section whoever—

(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or

(2) intentionally exceeds an authorization to access that facility;

and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section.

A private right of action for 18 U.S.C. § 2701 is set forth in 18 U.S.C. § 2707.

[2] Mobilisa questions whether Doe is a party to this appeal, and if not, whether TSB has standing to assert Doe's First Amendment rights. Our review of the record reveals that counsel for Doe properly entered an appearance in this matter and TSB and Doe both joined in the notice of appeal. Doe's standing to assert his First Amendment rights is not at issue. See ARCAP 1 ("An appeal may be taken by any party aggrieved by the judgment."); In re Gubser, 126 Ariz. 303, 306, 614 P.2d 845, 848 (1980) (appellant is aggrieved party if the judgment "operate[s] to deny her some personal or property right or to impose a substantial burden upon her"); see also Doe v. 2TheMart.com.Inc., 140 F.Supp.2d 1088, 1091 n. 2 (W.D.Wash.2001) ("When an individual wishes to protect their First Amendment right to speak anonymously, he or she must be entitled to vindicate that right without disclosing their identity."). We need not decide, therefore, whether an email service provider has third-party standing to assert the First Amendment rights of its customers.

[3] We reject TSB-Doe's contention that whether the superior court appropriately adopted Cahill is not squarely before us because Mobilisa did not file a cross-appeal. Mobilisa may properly challenge the court's adoption of Cahill and urge an alternative legal standard as a cross-issue because it made that argument to the superior court. See Town of Miami v. City of Globe, 195 Ariz. 176, 177-78 n. 1, ¶ 1, 985 P.2d 1035, 1036-37 n. 1 (App.1998) ("When a successful party seeks only to uphold the judgment for reasons supported by the record, but different from those relied upon by the trial court, its arguments may not be raised by a cross-appeal, as it is not an `aggrieved' party, but are more properly designated as cross-issues."). Nevertheless, even if Mobilisa improperly raised whether the superior court employed the correct analytical framework, we are not bound by its decision and may consider the appropriateness of the chosen standard de novo as a matter of law. Tovrea Land & Cattle Co. v. Linsenmeyer, 100 Ariz. 107, 114, 412 P.2d 47, 52 (1966).

[4] For a thorough discussion of the First Amendment's application to anonymous and pseudonymous speech, see Lyrissa Barnett Lidsky & Thomas F. Cotter, Authorship, Audiences, and Anonymous Speech, 82 Notre Dame L.Rev. 1537 (2007).

[5] After the superior court issued its ruling, the Wisconsin Supreme Court became the second state supreme court to address this issue. Lassa v. Rongstad, 294 Wis.2d 187, 718 N.W.2d 673 (2006), reconsideration denied, 297 Wis.2d 325, 724 N.W.2d 207 (2006), cert. denied, ___ U.S. ___, 127 S.Ct. 2251, 167 L.Ed.2d 1090 (2007). Lassa acknowledged the need for a heightened standard as expressed in Cahill, but concluded that a motion to dismiss standard, rather than a summary judgment standard, would provide the necessary protection for anonymous speakers. Id. at 687. The court reasoned that unlike Delaware, Wisconsin requires pleadings with particularity in defamation cases so that surviving a motion to dismiss would provide adequate protection against undue infringement on First Amendment rights. Id.

[6] A "blog," a short-hand term for "web log," is a website that provides "commentary or news on a particular subject such as food, politics, or local news; others function as more personal online diaries. A typical blog combines text, images, and links to other blogs, web pages, and other media related to its topic. The ability for readers to leave comments in an interactive format is an important part of many blogs." See Wikipedia: The Free Encyclopedia, Blog, http://en.wikipedia. org/wiki/Blog (last visited Sept. 24, 2007).

[7] Similarly, the potential for chilling speech by unmasking the identity of an anonymous or pseudonymous internet speaker equally exists whether that party is a defendant or a witness. For that reason, we reject our dissenting colleague's view that courts should apply a different test when the identity of a witness is at issue. See infra ¶ 49. The considerations attendant to a witness' identity are best considered in the balancing step we adopt today. See infra ¶¶ 23-27.

[8] For example, political expression is entitled to the "broadest protection" of the First Amendment, McIntyre, 514 U.S. at 346, 115 S.Ct. 1511, while commercial speech receives less protection than do other constitutionally guaranteed expressions, Cent. Hudson Gas & Elec., 447 U.S. at 562-63, 100 S.Ct. 2343.

[9] The other factors are: (1) strong likelihood of success on the merits; (2) possibility of irreparable injury not remediable by damages if requested relief is not granted; and (3) public policy favors the injunction. Shoen, 167 Ariz. at 63, 804 P.2d at 792.

[10] Article 2, Section 6, of the Arizona Constitution, the corollary to the First Amendment, provides, "Every person may freely speak, write, and publish on all subjects, being responsible for the abuse of that right." The parties confined their arguments to the First Amendment. In our view, however, the test adopted to decide the pending discovery issue should also account for the protection afforded under our state constitution.

[11] Although Doe states through his counsel's affidavit that he did not access any of Mobilisa's computers, this representation merely creates a question of fact, which would not warrant an entry of summary judgment against Mobilisa.

[12] Regardless, because knowledge of Doe's intent depends on his identity, Mobilisa was not required to produce evidence of this element to demonstrate it would survive summary judgment. See supra ¶ 23.

[13] The general standard for discovery is lower than the relevance standard applied in the courtroom. "Parties may obtain discovery regarding any matter, not privileged, which is relevant to the subject matter involved in the pending action." Ariz. R. Civ. P. 26(b)(1). However, even if the information sought is not admissible and relevant according to that standard, it remains discoverable as long as it "appears reasonably calculated to lead to the discovery of admissible evidence." Id. The only limitations on this rule are that the methods must not be "unreasonably cumulative or duplicative, or obtainable from some other source that is either more convenient, less burdensome, or less expensive"; the party must not have already had ample opportunity to obtain the same information; and the discovery must not be "unduly burdensome or expensive, given the needs of the case, the amount in controversy, limitations on the parties' resources, and the importance of the issues at stake in the litigation." Id.

[14] See Jennifer O'Brien, Putting a Face to a (Screen) Name: The First Amendment Implications of Compelling ISPs to Reveal the Identities of Anonymous Internet Speakers in Online Defamation Cases, 70 Fordham L.Rev. 2745, 2772 (May 2002) ("[L]awsuits are being brought by both private individuals and corporations in an effort to determine the true identity of the anonymous speakers and enact their own extra-judicial remedies."); Lyrissa Barnett Lidsky, Authorship, Audiences, and Anonymous Speech, 82 Notre Dame L.Rev. 1537, 1595 (April 2007) ("If all it takes is an allegation of defamation to uncover a defendant's identity, the right to speak anonymously is very fragile indeed, because it is easy for a plaintiff to allege defamation any time he comes in for harsh criticism online.").

[15] In fact, if we are to be establishing a "single test," applicable to all cases, supra ¶ 21, Arizona's constitution expressly protects party-plaintiffs' causes of action. Ariz. Const. art. 18, § 6 ("The right of action to recover damages for injuries shall never be abrogated, and the amount recovered shall not be subject to any statutory limitation.").