Internet Lawyer Blog
A threatening message or damaging anonymous post can leave its target with an urgent question: who is responsible? A subpoena may help obtain records identifying an account user, but the process requires more than suspicion. Courts consider the legal claim, supporting evidence, privacy interests, and whether the requested records are likely to identify someone who can properly be sued.
For individuals and businesses experiencing anonymous online harassment, careful evidence preservation is often the first useful step. The goal is to connect specific conduct to a viable claim and a focused request for information. A lawsuit should not be used merely to discover the identity of a critic whose statements are legally protected.
Identify the Conduct and the Potential Claim
Online harassment describes many different situations, but it is not a substitute for identifying an applicable legal theory. Threats, impersonation, disclosure of private information, and allegedly false statements may raise different issues. For a defamation claim, counsel should examine the exact statement, its context, whether it asserts a provably false fact, publication to others, and the other required elements and defenses.
In Krinsky v. Doe 6 (2008) 159 Cal.App.4th 1154, the court required a preliminary evidentiary showing supporting a libel claim when evaluating a subpoena seeking an anonymous speaker’s identity. It concluded that the challenged comments were not actionable factual assertions and directed that the subpoena be quashed. As such, offensive language alone does not establish a right to unmask its author.
Preserve Complete Communications and Their Context
Save the full exchange, including messages before and after the disputed statement. Capture account names, profile addresses, post identifiers, dates, and displayed times. Preserve original email files with headers when available. Keep original attachments and recordings already lawfully possessed. A cropped image may omit context that changes the meaning of a statement or prevents reliable identification of the account.
Create an incident log explaining when the material was received or discovered and who preserved it. Keep the original files separate from copies used for highlighting or annotation. If a platform offers an account export, preserve the export without altering it. Record any difference between the time displayed on the screen and the time reported in exported data.
Document Falsity and Harm With Specific Evidence
Where a claim depends on falsity, identify the records or witnesses showing why the particular assertion is false. A general denial may be less useful than documents addressing the event described. Preserve messages from people who saw the publication and can explain their reaction. If the claim concerns lost business, identify the relevant transaction and evidence connecting the loss to the challenged conduct.
A declaration should distinguish personal knowledge from information supplied by others. Explain what each exhibit shows and avoid presenting assumptions as established facts. For example, a customer’s cancellation email may support an inference about lost business, while an unexplained drop in monthly revenue may have several causes. Counsel should evaluate the evidence required for the particular claim and procedural stage.
Record Efforts to Identify the Responsible Person
Document lawful steps already taken, including review of public account information, communications with the platform, and analysis by a qualified investigator. Explain what each step revealed and what remains unknown. A report is more useful when it separates direct observations, technical inferences, and unresolved possibilities. Similar writing styles or posting times can provide leads without conclusively identifying an author.
In Columbia Insurance Co. v. Seescandy.com (N.D.Cal. 1999) 185 F.R.D. 573, the court described safeguards for discovery identifying unknown defendants, including specificity, prior identification efforts, viable claims, and a reasoned connection between the proposed discovery and identification. The decision provides a useful federal framework; it does not replace the procedural rules governing a California state-court case.
Explain Why the Selected Provider Has Useful Records
Identify the particular account and the provider expected to hold responsive information. Explain whether the request seeks subscriber information, account registration details, or relevant access records. Tie the requested period to the events being investigated. A provider may be unable to locate an account using a display name that changed or that several users share.
Technical precision matters when requesting connection records. An IP address usually needs an associated date, time, and time zone to be useful. Shared connections and network configurations may require additional identifiers, if available. Ask an appropriate expert to explain what the records could establish and what they could not. An internet subscription associated with a connection does not necessarily identify the person who wrote a message.
Use the Correct Procedure for Early Discovery
A properly supported action against unidentified defendants may provide a setting for targeted discovery, but filing a complaint does not authorize every proposed subpoena immediately. California Code of Civil Procedure section 2025.210(b) addresses the timing of a plaintiff’s deposition notice and permits earlier service for good cause. Counsel must determine how the governing discovery provisions apply to the requested records and procedure.
In federal court, Rule 26(d) generally restricts discovery before the required discovery conference unless an exception, stipulation, or court order applies. The application should explain the need for early discovery, the evidence supporting the claim, and the proposed limits. Court-specific requirements and orders matter. A procedure accepted in another case should not be copied without checking its legal and factual fit.
Respect Notice Requirements and Privacy Objections
Anonymous speakers may have a right to notice and an opportunity to challenge disclosure. The appropriate method depends on the governing law, the provider’s procedures, and any court order. In some situations, a provider can notify the account holder. Counsel should address notice directly, including any practical difficulty, rather than assume that anonymity removes the need for procedural protection.
California Code of Civil Procedure section 1987.1 permits courts to quash or modify subpoenas and protect against unreasonable demands or privacy intrusions. Limit requests to information relevant to identification and the claim. Where appropriate, propose confidentiality restrictions. An unsupported or excessive request can delay the investigation and expose the requesting party to avoidable litigation over the subpoena.
Understand Limits on Private Message Content
The Stored Communications Act, including 18 U.S.C. section 2702, restricts provider disclosure of certain communications. A private civil subpoena generally cannot compel a covered provider to disclose protected message content simply because the content is relevant. Subscriber and other noncontent records present a different analysis. Applicable exceptions, consent, the service involved, and other legal restrictions must be considered.
Preserve communications already available from the recipient’s own account or device. Counsel can evaluate other lawful sources and whether a targeted preservation request is appropriate. A private preservation letter does not automatically carry the statutory force of a government request under section 2703(f), and it does not guarantee that old records still exist. Act promptly without assuming a provider retains everything.
Evaluate the Evidence After Records Arrive
Returned records are investigative evidence rather than an automatic finding of responsibility. Accounts may contain false registration information, be shared, or have been compromised. Compare the production with the original incidents and explain inconsistencies before naming a person publicly or amending allegations. If there is an immediate threat of physical harm, seek appropriate emergency assistance while preserving available evidence.
Our law firm assists with online harassment, internet defamation, and discovery involving unidentified defendants. We can assess the available evidence, relevant legal claims, and whether targeted subpoenas are appropriate. Contact our law firm for a free initial consultation about investigating anonymous online misconduct and selecting the next legal step.