XXX v Persons Unknown

Derogations from open justice, including anonymity, are exceptional and must be strictly necessary. The applicant bears the burden of proving necessity by clear and cogent evidence, and the court must consider whether a less restrictive measure would suffice.

Anonymity may nevertheless be justified where identifying a claimant would materially advance the unlawful purpose of blackmail or expose security-sensitive information to persons with malign intent. The substantive hearing should remain public where anonymity and suitable confidentiality provisions adequately protect the claimant.

Summary judgment may be granted where the defendant has no realistic prospect of defending the claim and there is no compelling reason for trial. In a ransomware case, the unauthorised taking and threatened disclosure of confidential data may justify a final injunction requiring non-use and return or destruction of the data.

The claimant sought summary judgment against unknown defendants following a ransomware attack in which data had been stolen and threatened with disclosure. Interim injunctions had previously restrained misuse of the information, and the claimant’s identity had been anonymised.

The defendants did not engage with the proceedings. The claimant sought a permanent injunction for breach of confidence, while deferring its damages claim because the defendants remained unidentified. The court had to determine whether anonymity should continue, whether the summary judgment hearing should be private, and whether summary judgment and final injunctive relief should be granted.

1. Anonymity and open justice. Derogations from open justice must be strictly necessary, supported by clear and cogent evidence, and no wider than required. Commercial embarrassment, reputational damage and financial consequences from a ransomware attack are not, without more, sufficient. The court must closely scrutinise the application and consider less restrictive alternatives.
2. Anonymity was justified on the particular evidence. The claimant carried out security-sensitive and highly classified work. Disclosure of its identity created a real risk that hostile states, criminal groups or terrorist organisations would seek to locate and exploit the stolen material on the Dark Web. Identifying the claimant would therefore advance the defendants’ unlawful purpose and make the court an instrument of the threatened harm. The claimant’s identity had not been disseminated so widely that anonymity had become futile.
3. The summary judgment hearing properly took place in public. The claimant’s interests were sufficiently protected by continued anonymity, non-publication of confidential schedules and restrictions on access to pleadings and evidence. A public judgment was also required, subject to the anonymity protections.
4. Under Civil Procedure Rules 1998, CPR r.24.2, summary judgment was appropriate because the defendants had no realistic prospect of defending the claim and there was no compelling reason for trial. The court did not conduct a mini-trial.
5. The breach of confidence claim satisfied the three elements identified in Attorney General v Guardian Newspapers Ltd (No.2): the information had the necessary quality of confidence, the circumstances imported an obligation of confidence, and the defendants’ use was unauthorised. The information had not become generally accessible merely because limited confidential disclosures had been made.
6. A final injunction prohibiting further misuse and requiring return or destruction of the information was granted. The damages and costs assessment issues were adjourned with liberty to restore. The claimant was entitled to the costs of the proceedings, and no cross-undertaking was required because the order was final.