XXX v Persons Unknown

Interim non-disclosure relief may be continued where the evidence establishes a serious arguable case, or an overwhelming case, and no discretionary factor weighs against relief. A hearing may be held in private and the claimant anonymised where publicity would further the object of a cyberattack or blackmail attempt. The court must have a cogent evidential basis and be satisfied that privacy is strictly necessary. Orders may require unidentified defendants to disclose their identities, permit limited service and access to documents, and postpone further disclosure where defendants do not engage. Where final relief is more likely than not to be obtained, Human Rights Act 1998, section 12 is satisfied. Any engaged freedom of expression rights may be outweighed by the claimant’s confidentiality interests.

The claimant, a commercial entity, sought continuation and modification of a without-notice injunction granted by Stacey J after a ransomware attack. The attackers had allegedly taken and encrypted data, demanded a ransom, and threatened publication. The order was served by email, but the defendants did not participate in the proceedings or attend the return hearing.

The application raised issues concerning continuation of interim injunctive relief, private hearings, anonymisation, alternative service, redactions, restricted access to court documents, and the defendants’ identification. The court also considered whether the requirements of Human Rights Act 1998, section 12 were met.

1. Application granted. The injunction was continued in substantially the terms sought, subject to the stated modifications. Costs were reserved.
2. The court was satisfied that the evidence established not merely a serious arguable case under [1975] AC 396, but an overwhelming case for injunctive relief. The defendants had received notice and had been given an opportunity to respond, but had not engaged with the proceedings. No discretionary factor weighed against continuation.
3. The hearing was properly conducted in private under CPR r.39.2. A cogent evidential basis existed because a public hearing would disclose information capable of furthering the apparent criminal cyberattack. The approach in PML v Person(s) Unknown [2018] EWHC 838 (QB) supported the conclusion that privacy was strictly necessary. The claimant was also properly anonymised for the same reason, subject to any later application by an affected third party.
4. The order could require the defendants to identify themselves to the claimant and the court, reflecting the approach in PML v Persons Unknown [2018] EWHC 838 (QB). It could also restrict the circulation of skeleton arguments and other filings, permit retrospective redactions, limit further service unless the defendants identified themselves and showed interest, and restrict third-party access to the papers.
5. The provision dispensing with further service was appropriate at that stage, following The Ince Group PLC v Person(s) Unknown [2022] EWHC 808 (QB). Further consideration of the redacted material could occur if the defendants later participated.
6. The claimant was likely, meaning more likely than not, to obtain final relief in the same or substantially the same form. Section 12 of the Human Rights Act 1998 was therefore satisfied if applicable. The court doubted that disclosure, whose apparent purpose was to further criminal blackmail, engaged freedom of expression rights at all. If such rights were engaged, they were wholly outweighed at this stage by the claimant’s confidentiality interests.

The judgment describes a without-notice order granted by Stacey J on 30 March 2022. The present court continued and modified that order. No appeal is stated.