Online Anonymity Is a Myth: How Civil Discovery Can Identify You
Online Anonymity Is a Myth: How Civil Discovery Can Identify You
Newsflash! The concept of internet anonymity is a myth. Posting under a username feels private. But a username is not a mask so much as a thin curtain. During the civil discovery stage of a lawsuit, the identity behind an anonymous account can be uncovered through a chain that runs from the post, to an Internet Protocol (IP) address, to the Internet Service Provider (ISP) that assigned it. It requires only an attorney, typically representing a plaintiff in these circumstances, a valid legal claim, and the ordinary tools courts hand litigants every day. The path from an anonymous post to a real name is far less complex than most users would ever guess.
What is civil discovery?
Civil discovery is the evidence gathering stage of litigation. During this stage of litigation, parties a lawsuit exchange relevant information to the case such as via depositions, interrogatories, and document production requests.
In federal court, the legal rules governing the scope of civil discovery are set forth in 26(b)(1-2), 33(a)(2), 34(a), (b), and 45(a)(1), (d) of the Federal Rules of Civil Procedure (FRCP). Together, these rules give an attorneys a toolbox for building their case. One such powerful tool is Rule 45, the power to subpoena.
Contrary to popular belief, a subpoena is not limited to criminal cases. Nor is it something only a judge can order. Rule 45 of the FRCP permits an attorney, as an officer of the court, to issue a subpoena commanding a nonparty to produce designated documents and electronically stored information.
To communicate on the internet, you need, at the very least, an Internet Protocol (IP) address. To receive an IP address, an Internet Service Provider (ISP), such as AT&T, Verizon, or Comcast, must assign you a unique IP. Think of an IP address as a mailing address and an ISP as the postal service that assigns it. Like a mailing address, an IP address reveals the location of your connection. And like the postal service, an ISP keeps records of which address it assigned to whom.
An individual's identity cannot be determined by an IP address alone. Instead, an IP address pinpoints the Internet Service Provider (ISP) that controls that specific block of addresses, and the ISP's internal records indicate the subscriber* account to which the address was allocated. The attorney, usually the plaintiff in such circumstances, may then issue a subpoena to the ISP, requesting that it link the IP address and corresponding timestamp to the appropriate subscriber account. When the ISP complies, its disclosure reveals the account holder's name, contact details, and billing address, thereby providing the plaintiff vital information to easily determine the identity of the account holder.
It is important to note that the "subscriber" is not by default the individual responsible for the online post. Multiple users can share a single IP address behind a public Wi-Fi network or a household router. The mechanics differ when using Tor or a VPN, which route traffic via an intermediary IP, yet the end result is the same. Highly technical cyber methods can still link an account back to a specific person and IP address, but such technical analysis falls outside the scope of this discussion.
Although these are the federal rules, the point is not limited to federal court. Most states have their own civil procedure subpoena rule comparable to FRCP 45. For example, Maryland has Rule 2-510, and Virginia has Rule 4:9A, both of which allow the discovery mechanism of subpoenas to ISPs to operate in state civil litigation.
How does a Rule 45 subpoena play out in real cases?
An ISP can reject a valid Rule 45 subpoena in only one of two ways: either (1) the information is privileged, such as a trade secret or material subject to attorney-client privilege, or (2) searching those records would be an undue burden. Typically, an ISP rarely has grounds to refuse, and producing subscriber records is not difficult. However, there is a third consideration that often comes into play when an attorney subpoenas an ISP to identify an anonymous internet user that the court must take into account.
The First Amendment includes anonymous speech which carries a privacy interest. The government generally cannot compel a speaker to identify themselves, and a court-enforced subpoena is government action. So what must a plaintiff demonstrate to compel an ISP to reveal a speaker's identity?
The answer comes from Doe I v. Individuals, a notable cyberlaw case from the internet's early days. In Doe, the district court set the standard for identifying an anonymous poster. Two students were cyberbullied by an anonymous poster on a school admissions forum. They sued for defamation, and their attorneys issued a Rule 45 subpoena to the ISP linked to the anonymous account, seeking the identity of the person behind the poster. The defendant, upon receiving notice of the subpoena from his ISP, moved to quash it on the grounds that disclosure of his identity would violate his First Amendment right to engage in anonymous speech.
The court had to decide whether the defendant's asserted First Amendment defense was sufficient to quash the subpoena. Under Rule 45, a subpoena must be quashed if it "requires disclosure of privileged or other protected matter and no exception or waiver applies."
Applying that standard, the district court held that the defendant's First Amendment interest in anonymous speech, while real, was not absolute, and had to be weighed against the plaintiff’s need for discovery to redress the alleged defamation. Because the plaintiff had made the required showing, the court denied the motion to quash and ordered the ISP to reveal the identity behind the anonymous account.
Moving forward, a plaintiff must offer some evidence supporting a legitimate legal claim and show that the identity is needed to pursue it, not to harass the speaker. In other words, the First Amendment right to anonymous speech does not trump a subpoena outright. It only raises the bar an plaintiff must clear.
Conclusion:
The bottom line is that online anonymity is not the shield people may assume it is. Civil discovery rules gives an attorney a way to reveal the identity of an anonymous poster, in federal or state court alike. Courts do protect anonymous speech, but only up to the point where a attorney can back a genuine legal claim with actual evidence and show a legitimate need for the identity. Once that showing is made, the First Amendment stops shielding the poster's identity.
About the Author: Max Abraham is a rising 3L student at American University who is currently participating in an Army JAG summer internship located in Pyeongtaek, South Korea. During his 2L year, he was awarded the CALI Award for achieving the highest grade in Professor Sylvia Lu's Privacy Law: Emerging Technology course. Additionally, Max has recently obtained his IAPP CIPP/US certification and is actively pursuing his AIGP (Artificial Intelligence Governance Professional) credential. Prior to entering law school, he completed four years of military service, during which he maintained a TS clearance and served as both an operator and a supervisor managing secure communications networks and cryptographic systems