What is the process for obtaining an anonymous internet poster&#39;s identity for a civil lawsuit? An anonymous person can, given some effort and a minimum of expertise, ruin a person's life on the internet through defamation. (The popular method currently is to forge authentic looking screenshots of a person posting insensitive or hateful statements, and setting them loose online) If a person is victimized by an anonymous person online in this way, what are the steps for them to exact damages in a civil court case? Not too interested in if it's practical, I'm wondering if it's even possible. How would a person compel Twitter/Reddit/etc. to disclose the ISP information on their account? How would a person compel an ISP to disclose the subscriber information (address, name) for the IP address? Is obtaining the ISP subscriber's information enough to bring a lawsuit against them? Would they able to argue they didn't post the messages and bear no liability, even if it originated from their network? If it originated from an open wifi hotspot, would the proprietor bear responsibility at this point? Can the extensive legal costs of pursuing the case to its conclusion be added to the damages sought easily?
First, read the definitions of defamation and libel be sure you understand them: Defamation | Wex Legal Dictionary | Cornell. Yes, posting to Twitter and Reddit is publishing, and people can post provably false facts on those services and defame someone in a civil law sense. But Section 230 of the Communications Decency Act (Electronic Frontier Foundation) mostly protects those services from defamation claims based on statements made by users of such a service. (Things are different if the case is criminal as a result of clear threats of violence, terrorism, etc.) ...what are the steps for them to exact damages in a civil court case? Find a lawyer, convince him/her to take the case, and file suit. if you don't know the person's real name, your lawyer will have to sue "John Doe" and point that out in the suit (and subpoenas) with the alleged Twitter handle or Reddit user name. How would a person compel Twitter/Reddit/etc to disclose the ISP information on their account? Read the various legal aspects of each service, i.e. Twitter Legal FAQs and User Agreement - Reddit and others. Your lawyer can explain that you can only try to compel them to disclose the IP and the ISP used with a subpoena during your lawsuit. How would a person compel an ISP to disclose the subscriber information (address, name) on the IP address? Since most ISPs protect their customer data, you will probably have to subpoena the ISP during your lawsuit. But your ability to do this can depend on if the ISP is a private company or a government entity, such as a university. State laws may come into play. Is obtaining the ISP subscriber's information enough to bring a lawsuit against them? Would they able to argue they didn't post the messages and bear no liability, even if it originated from their network? If it originated from an open wifi hotspot, would the proprietor bear responsibility at this point? Yes, you can sue an individual with such information; but there's no guarantee you'd win. Sure, because they can claim anything, such as someone else was using their computer or IP. No, owners of hotspots are generally not liable, and they protect themselves with TOS you agree to when you use the hotspot. Can the extensive legal costs of pursuing the case to it's conclusion be added to the damages sought easily? Legal costs can possibly be added, depending on jurisdiction. But seeking damages and actually winning them through a jury verdict are completely different things.
tl;dr- I don't see how you can &quot;leak&quot; a large organization's IP addresses given that they seem to be very public information. However, misusing an organization's network services or/and somehow being complicit in an attack could probably get someone into touble. Organization IP address allocations seem to be public information. I Google'd &quot;Colorado university IP address&quot;. The first search result was this official webpage for the University of Colorado, Boulder. It says: IP Ranges for Server Administrators All public IP space for CU Boulder can be described by the following notation: 128.138.0.0/16 198.11.16.0/20 But, say that that university didn't publish its IP addresses online. Then this website shows them anyway. Additionally, seems like anyone at your school can get an IP address by Google'ing &quot;what's my ip&quot;. Or you can use Bing. Or WolframAlpha. Or, heck, this website doesn't seem to do anything but show your IP address. Point being, I don't see how an organization's IP addresses could be considered information that could be &quot;leaked&quot;. There're other things that might get someone into trouble though. However, this sounds like a potentially different matter: well someone at our school got our IP address banned from editing on Wikipedia Ideally that &quot;someone&quot; isn't you or a friend since such activities can easily be against an organization's acceptable-use policy (example) or/and the law.
The warning notice is intended for viewers and participants, not for the court to make its own official record of the proceedings. Presumably, it was this court record that the judge released for educational purposes under his own Order via Twitter. In which case, there has been no contempt of court.
It may not be libel, but it may violate other statutes and may support a judgement against the person publishing this information as long as there is an injury-in-fact ("an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical"). A recent case, Spokeo, Inc. v. Robins 578 U.S. ___ (2016) considered the case where a company created a profile for a person. That profile stated "that he is married, has children, is in his 50’s, has a job, is relatively affluent, and holds a graduate degree". The plaintiff asserted that all of this was incorrect. The plaintiff made a claim under the Fair Credit Reporting Act because the information was false. However, mere violation of statute is not sufficient to meet the "injury-in-fact" requirement for standing. Congress can't create standing via statute. Injury-in-fact still requires a "concrete" injury. This does not need to be a physical, tangible injury. But, it does need to be concrete. On its own, publication of false information, even when statute prohibits it, does not create standing. There must be an injury-in-fact.
Facebook's local jurisdiction is the US. In the US, making false statements isn't generally illegal or tortious, as they are protected by the First Amendment to the US Constitution. So, Facebook isn't under any legal pressure to remove posts that are posting false information. It sounds like you've already asked them to remove the posts and they refused, so at this point you do not seem to have any procedural recourse with Facebook. It's possible your country or the country the person is posting from lacks free speech protections and would either prosecute or allow suits against someone posting false information, if that's the case you could try to get the local equivalent of a prosecutor to prosecute them. I realize that is unlikely to happen, the reality is that coordinated fake news on the Internet is still something that platforms are figuring out how to deal with fairly.
Earlier this year, the Internet lawyer Arnoud Engelfriet wrote a blog post about exactly this topic. As it is written in Dutch, I will summarize it here: As you also said, deleting posts breaks the flow of the archived conversation and it makes your archive incomplete. This is a problem for the freedom of expression and information. But Art. 17(3) GDPR includes an exception to the right of erasure for this situation. So posts do not need to be deleted. However, profiles are not included in this exception. So they must be removed, but they can be pseudonymized. For example replace the username with user89432, and remove all details from the profile. If other posts contain the nick of the author of an anonymized post, that is considered an journalistic, academic artistic or literary expression, so Art. 85 GDPR would apply, so the right of erasure does not apply to that. Bottom line: you only have to pseudonymize the account, if that person wants to be removed from the forum.
If you sue a person for a tort X, one of the things you have to prove is that the defendant did do X. A baseless belief that it must have been so-and-so will do you no good. You do not have to have iron-clad evidence of your allegations, for a civil suit, but you have to show with a preponderance of evidence that the claim is true. A combination of "hates me" and "provably did this a number of times in the past" could well suffice. As for damages, it depends on what harm you actually suffered. If you get fired and you show that it was because of a false allegation, you would probably have to take this to the big court, since small claims court handles amounts in the $5,000 range (jurisdiction-specific).
Probably not, because you should be in a position to rely on the Safe Harbor provision of the DMCA. Safe Harbor protects service providers who provide open, non-moderated spaces for users to directly contribute content. Safe Harbor means you do not need an army of moderators to inspect every message posted to the site or system. It is essential for sites like Twitter, Youtube or StackExchange to exist. You are not liable for that content if you provide a means for IP owners to report copyright violations, and promptly take down any content which an IP owner reports as violating. You don't need to get in the middle of whether that's really true; there's a mechanism for the user and IP owner to &quot;duke it out&quot; directly at no risk to you. However you must take the required steps. For instance you must register an agent, and respond timely to DMCA takedown notices, which means you must be reachable as per the law. Your designated agent address must be staffed 9-5. Note that the &quot;Designated Agent&quot; can be the same person as the &quot;Registered Agent&quot; that you already must have when you are an LLC or corporation. And you'll want to be an LLC or corporation by the time you get big enough to worry about copyright lawsuits.