THE INCE GROUP PLC v PERSON(S) UNKNOWN

In an urgent without-notice ransomware case, the court granted prohibitory and mandatory interim injunctions to protect confidential information obtained through apparent criminal conduct. The American Cyanamid test applied. The claimant also had to satisfy the stringent requirement in section 12(3) of the Human Rights Act 1998, but the court was satisfied that publication was unlikely to be protected by Article 10 and that the claimant was likely to succeed at trial. A mandatory order requires a high degree of assurance that the claimant will obtain the same relief after trial. The court may modify model orders where service or disclosure of confidential evidence would risk misuse, and may permit alternative service through the communication channel used by the defendant.

The claimant, an international commercial law and business services firm, applied without notice for interim relief after an apparent cyber-attack. An unknown defendant obtained confidential data, demanded a ransom and threatened publication on the dark web.

The application sought prohibitory relief restraining disclosure, mandatory relief requiring delivery up, deletion or destruction of the information, and consequential modifications to service, document-access and confidentiality provisions. The central issues were whether the claimant had established the requirements for breach of confidence, whether interim relief affecting expression satisfied section 12(3) of the Human Rights Act 1998, and whether the proposed procedural modifications were justified.

1. Interim relief. The court applied the American Cyanamid test. The information had the necessary quality of confidence, the claimant had title to sue, the defendant owed a duty of confidence, disclosure was threatened, and damages would not be an adequate remedy. There was no sensible basis for asserting a public interest in publication of information obtained through apparent criminal and unlawful conduct.
2. Freedom of expression. Although section 12(3) of the Human Rights Act 1998 imposed a stringent test for interim relief which might affect expression, the claimant was likely to establish at trial that publication should not be permitted. On the evidence, the defendant sought commercial advantage through blackmail rather than publication for a legitimate reason, making it difficult to see how legitimate Article 10 rights were engaged.
3. Mandatory injunction. The court had a high degree of assurance that the claimant would obtain the mandatory relief at trial. Delivery up, deletion and destruction were therefore ordered, together with a witness statement confirming compliance.
4. Procedural safeguards. The court modified the model order so that the confidential witness statement need not be served until the defendant identified itself and provided an address for service. Third-party access to documents from the private hearing was limited to persons possessing or having access to the confidential information. The court also authorised alternative service through the website used for communications with the defendant.
5. The order was made in the draft form, with a return date and associated steps to be completed by agreed dates.