Armstrong Watson LLP v Person(s) Unknown responsible for obtaining data from the Applicant's IT systems on or about 28 February to 6 March 2023 and/or who has disclosed or is intending or threatening to disclose the information thereby obtained
| Jurisdiction | England & Wales |
| Judge | Mr Justice Ritchie |
| Judgment Date | 31 March 2023 |
| Neutral Citation | [2023] EWHC 762 (KB) |
| Docket Number | Claim No: KB-2023-001440 |
| Court | King's Bench Division |
[2023] EWHC 762 (KB)
Claim No: KB-2023-001440
IN THE HIGH COURT OF JUSTICE
KING'S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
Royal Courts of Justice
Strand, London, WC2A 2LL
Adam Speker KC (instructed by DAC Beachcroft LLP) for the Claimants
No one appeared for the Defendant/s
Hearing dates: 28 March 2023
APPROVED JUDGMENT
(Sitting as the urgent applications judge)
The Parties
The Claimant is limited liability partnership who have 18 offices around the UK and are accountants, tax and business advisers.
The Defendants are persons unknown (“PUs”).
Bundles
For the hearing I was provided with a digital bundle containing the notice of application, Claim Form, a witness statement and exhibits and a draft order. A hard copy bundle of authorities was handed up during the hearing with a skeleton argument.
Summary
These are the reasons why I granted an interim injunction at a private hearing.
The Claimant sought an urgent ex-parte injunction because, as is apparent from the witness statement of Paul Dickson sworn on 27.3.2023 (“Dickson”), PUs have very recently hacked the Claimant's IT system and stolen the information therein relating to their staff, their customers and their business. The information is confidential and commercially sensitive.
The hack became apparent when on 9.3.2023 an email was received from the PUs by a senior employee. The PUs were seeking to blackmail the Claimant company and threatening to release the information to buyers on the dark web or the world at large unless a blackmail payment was made in Bitcoin. This state of affairs is current and ongoing.
The PUs then sent similar emails to 499 of the Claimant's staff.
I will not set out in the judgment the subsequent facts because doing so would or might enfranchise or enable the PUs to further their nefarious activities.
There are two channels of communication open to the Claimant created by the PUs, one at an email address provided and another using a specialised browser to a website which is “off grid” so not available using normal internet browsers.
The Issues
There were several issues to be determined:
a) Should the ex-parte application be permitted without notice?
b) Should the hearing be held in private?
c) Should the injunctions requested be granted?
d) How should service be carried out?
e) Should service out of the jurisdiction be permitted?
f) The terms of the Order.
g) The return date.
h) The documents to be provided to the PUs and others.
The applications
Without notice and in private hearing
An interim remedy may be granted without notice if it appears that there are good reasons for not giving notice: CPR 25.3(1). An application must be supported by evidence, unless the Court orders otherwise, stating why the application is made without notice: CPR 25.3(2) and (3). If the application engages section 12 of the Human Rights Act 1998 (“ HRA”) then by section 12(2), no relief which might affect the exercise of the Convention right to freedom of expression is to be granted unless the Court is satisfied: (a) that the applicant has taken all practicable steps to notify the respondent; or (b) that there are compelling reasons why the respondent should not be notified.
This application was made ex-parte so the PUs are not on notice (Dickson, paras. 29–33). The PUs have demonstrated through their communications that they have information that they know they should not have. They know that their actions are criminal, they are motivated by money and are threatening to damage the Claimant and its clients. On the evidence before me there is a real risk that notice will trigger the PUs to misuse or disseminate the confidential information before an Order is made, in an attempt to deprive this application of any substantive or practical effect. On the evidence before me I do not consider that the HRA is engaged.
The Courts have accepted in similar blackmail cases that it is appropriate to proceed, in the first instance, without notifying the defendant: see, for instance: PML v Persons Unknown [2018] EWHC 838 (QB) (‘ PML’), at para. 5; and The Ince Group plc v Person(s) Unknown [2022] EWHC 808 (QB) (‘ Ince’), at para. 4.
In addition providing notice would have given the PUs the opportunity to read what the Claimant has been doing in relation to the negotiations and investigations.
At the hearing I was satisfied that these were good reasons under CPR r.25.3(1) for the application to be ex-parte.
In private
The Claimant did not seek anonymity. It did seek a private hearing pursuant to CPR r. 39.2(3)(a), (c), (e) and (g) and S.11 of the Contempt of Court Act 1981.
The Practice Guidance on Non-Disclosure Orders [2012] 1 W.L.R. 1003, at paras. 9 to 15 covers exceptions to the principle of open justice. The general rule is that hearings are carried out, and judgments and orders are made, in public. This applies to applications for interim non-disclosure orders. Derogations can only be justified in exceptional circumstances when they are strictly necessary as measures to secure the proper administration of justice. Where justified, they should be no more than strictly necessary to achieve their purpose. This Court should carefully scrutinise any application for such derogations. They should be reviewed on the return date. The leading case is JIH v News Group Newspapers [2011] 1 WLR 1645, CA, see paras. 19 to 25.
There is ample support for a private hearing on an application relating to theft of confidential information and blackmail, see: PML, at para. 14; Ince at para. 4. See also XXX v Persons Unknown (no1) [2022] EWHC 1578 (QB), per Chamberlain J at para. 6; and Pendragon v Persons Unknown [2022] EWHC 2985 (QB), per Collins Rice J, at para. 3.
The PUs could have raised an argument against a private hearing on the basis that it is not necessary to explore the underlying information because it was obtained through theft. The application could have been made without making reference to the content of the stolen documents, see Imerman v Tchenguiz [2011] Fam 116 at paras. 68–69 and 78. However, from the Dickson evidence it is clear that this is still an ongoing incident and the submissions and evidence of the Claimant encompass more than the contents of the information stolen. They include what is known to date and the steps taken to deal with the incident, so in my judgment there is a weighty need not to hamper efforts to deal with and trace the PUs or to encourage others to search for or store the information. What can legitimately come out now can be controlled better through a private hearing and the provision of this public judgment restricted to the facts necessary to explain the reasons for the Order. I consider that this route satisfies the principle of open justice whilst having proper regard to the rights of the Claimant and its clients.
Service and territorial jurisdiction
The Claimant sought a form of alternative service on the PUs, as explained in paras 24–8 of Dickson and the Order. Given that the Claimant does not know the location of the PUs, the Claimant also seeks, permission to serve the Claim Form and other documents out of the jurisdiction.
The Claimant does not know the identity the PUs. The Claimant knows that they exist, that they are real people and that they have provided two means of contact.
The Court can order alternative service of the Claim Form, Particulars of Claim and other documents under CPR rs. 6.6, 6.15, 6.27, 6.37(5)(b)(i) and (ii) and 6.38. CPR r. 6.27 explains that CPR 6.15 applies to any other document as it applies to the Claim Form.
The Court has the power to authorise alternative service out of the jurisdiction where there is good reason to do so, see Abela v Baadarani [2013] 1 WLR 2043. Under CPR r. 6.37 the Court must also be satisfied that one of the gateways contained in PD6B paragraphs 3.1(1) – (21) apply. Those require that the claim has a reasonable prospect of success, and that England and Wales is the proper place in which to bring the claim. Gateway (21) is relied on by the Claimant. That provides:
“(21) A claim is made for breach of confidence or misuse of private information where–
(a) detriment was suffered, or will be suffered, within the jurisdiction; or
(b) detriment which has been, or will be, suffered results from an act committed, or likely to be committed, within the jurisdiction.”
In Linklaters LLP v Mellish [2019] EWHC 177 (QB), Warby J granted an interim injunction to restrain a former employee of a large law firm from breaching his contractual duty of confidence after he threatened to disclose details of internal complaints made by women working for the firm. Although the identity of the defendant was known, his location was unknown. Warby J dealt with the issue of alternative methods of service out of the jurisdiction, for example by email, as follows:
“20. I was satisfied that, if [the Defendant] was in France, another EU jurisdiction, service could be effected without the Court's permission, on the basis of the exclusive jurisdiction clause, pursuant to the Judgments Regulation and CPR 6.33(2)(b)(v). If, by chance, the defendant was in Australia or another non-EU country, and permission was required for service abroad, that could be granted because the claims pass through the gateways in 6BPD 3.1(6)(a), (c) and (d) (claims in relation to contracts) and, if necessary, 3.1(21)(a) and/or (b) (claims for breach of confidence or misuse of private information). The...
To continue reading
Request your trial
-
Armstrong Watson LLP v Persons Unknown responsible for obtaining data from the Claimant's IT systems on or about 28 February to 6 March 2023 and/or who have disclosed or is intending or threatening to disclose the information thereby obtained
...out his reasons for making the Order in a clear and comprehensive judgment dated 31 March 2023 which has the neutral citation number [2023] EWHC 762 (KB). 2 Mr Adam Speker KC represented the Claimant and submitted a skeleton argument, dated 19 April 2023, in support of the Claimant's appli......