American Civil Liberties Union · Center for Democracy and Technology · Electronic Frontier Foundation · Electronic Privacy Information Center · Public Citizen

07/09/02

General Counsel
«Company»
«Address»
«City», «St» «Zip»

Dear General Counsel:

As you may be aware, Internet service providers and community hosts are increasingly the target of civil subpoenas aimed at learning the identity of Internet users who communicate anonymously. The purpose of this letter is to urge you to protect your users' privacy and free speech interests by instituting a policy under which you simply let users know when you receive a civil subpoena for their information.

Often these subpoenas are issued in meritless lawsuits the true purposes of which are to identify anonymous speakers and, at times, to intimidate individuals who have exercised their First Amendment right of free speech. If these tactics are allowed to continue, it will threaten the Internet’s prospects as a robust medium of communication. And that isn't good for your business, or for a democratic society.

While no individual should be able to defame others (or engage in other prohibited speech) with impunity, individuals should not be stripped of their online anonymity unless a subpoena or underlying lawsuit can withstand scrutiny by an objective person who is presented with both sides of the matter -- namely, a judge. But a judge cannot rule on a subpoena unless the target challenges it, and that cannot happen if the target does not know about the subpoena.

Many ISPs and community hosts are especially protective of their users' privacy, and will expend legal fees fighting illegitimate subpoenas. While we strongly applaud these efforts, we understand that not all service providers are able or willing to take such steps. Your users, however, can act to protect their own interests – provided they are notified. If you do not notify a user of a subpoena, there is no other reliable mechanism by which he or she will find out about it in time to mount a challenge.

We write to strongly encourage your company to adopt a general policy of providing notice to your customers who may be the target of or affected by a civil subpoena. We believe that such a policy both would promote the development of the Internet as a medium for robust speech, and would make clear your company’s commitment to protecting the rights of your customers. Moreover, such a policy of notification would plainly delineate your obligations in the event you receive a subpoena, and would reduce the risk that your company would get entangled in legal disputes with either third parties or your own customers. In order to assist your consideration of this policy, we ask that you review the attached documents:

• a sample provision to be inserted into your privacy policy;
• a sample notice to be sent by email and first class mail to customers who have become the target of a civil subpoena;
• a list of FAQ; and
• a list of civil liberties groups to which you can refer a user who believes that a subpoena is a violation of his rights.

We hope you will agree that a clearly articulated and enforced policy of notification provides the best legal protection to both your company and your customers. And we hope that you will act to protect the rights of your customers by adopting the proposed policy language. We would appreciate an opportunity to discuss this issue with you. At a minimum, we would appreciate learning what action, if any, you take on this concern. We look forward to hearing from you.

MODEL POLICY FOR PROTECTION OF USER RIGHTS WHEN CIVIL LEGAL PROCESS IS RECEIVED SEEKING INFORMATION CONCERNING AN IDENTIFIABLE USER (TO BE INCLUDED IN ISP OR SITE PRIVACY POLICY AND/OR TERMS OF SERVICE)

Introduction

Many Web sites and other services on the Internet allow you to communicate anonymously with others. However, our computers, as part of their normal operation, collect and record information about your Internet use that can be used to identify your online activities, even when carried out anonymously. That data is protected under our privacy policy [link]. However, we could be required to provide that information to others through a subpoena resulting from a lawsuit or a police investigation.

The purpose of this policy is to let you know that if we receive a subpoena for your personal information or usage records, we will send you notice of that subpoena (unless prohibited by doing so by a court order or applicable law) with sufficient time for you to decide whether you want to go into court to try to block the subpoena.

1. Information about you may be recorded by the service (site) each time you post a comment or other information on a public area of the service (site), such as a message board. The service (site) may therefore have the ability to link information about you together with information you may post for public review.
2. The service (site) may be required to disclose information about you (see above) in response to subpoenas, warrants, court orders or legal process.
3. If the service (site) receives a subpoena or other legal process requesting the disclosure of information about you, we will attempt to notify you before we respond, unless prohibited from doing so by a court order or applicable law. Specifically,
1. We will attempt to notify you 30 days in advance of our response to such a subpoena or other legal process, or within a deadline set by a court order or applicable law, if that deadline is shorter than 30 days.
2. We will attempt to notify you of such a subpoena or other legal process by sending a notice 1) by electronic mail to the e-mail address that you have provided to us, and 2) by first-class mail to the postal address you have provided to us, if any. The notice will include basic information concerning the subpoena, court order, or legal process (i.e., name of lawsuit, case number, place of filing, party issuing subpoena, the court where the subpoena was issued, contact information, deadline by which we plan to comply with the process, etc.). Where possible, we will also provide you with a copy of the subpoena or other legal process by first-class mail.
3. If we do not have either an e-mail address or a postal mailing address for you, and the subpoena or other legal process pertains to a posting on a particular online message board, we will attempt to post a notice on that message board requesting that you contact us.
4. If we receive a subpoena for your personal information (such as your usage patterns or your identity), you may have the legal right to resist or limit the release of that information in court by filing a motion to quash the subpoena. You may be able to argue, for example, that disclosure of the information would violate your rights to free speech and privacy under the 1^st and 4^th Amendments of the U.S. Constitution.
5. We cannot advise you regarding the law or an appropriate response to a subpoena. Should you wish to oppose a subpoena or other legal process, you should seek legal advice concerning applicable rights and procedures that might be available.
6. If we receive a court-filed motion to quash or otherwise limit the subpoena from you or your lawyer, we will not disclose the requested information until we receive an order from the court to do so.
7. For more information about this issue, see www.cyberslapp.org.

Dear Subscriber,

We have received a subpoena for information regarding your account with us. As we promised to do in our Privacy Policy, we are attempting to notify you of this subpoena by sending this email, which is going to the most current email address that you provided to us. We have also sent this notice and a copy of the subpoena by first-class mail to [subscriber’s info].

The subpoena is issued in [name of case, case number, name of court]. The subpoena was issued by [name of attorney, address, and phone number]. It requests information about [quick description of subpoena].

We cannot advise you regarding the law or an appropriate response to the subpoena. If you want to resist or otherwise seek to limit the subpoena, you should seek the advice of an attorney. For more information about responding to subpoenas like this, see www.cyberslapp.org. If we receive a motion to quash the subpoena from you or your lawyer, we will not release the requested information until we receive direction from a court.

Unless we receive such a motion from you or your lawyer, we must provide the information requested by this subpoena on [date].

Best regards,

powered by public citizen