Armstrong Watson LLP v Person(s) Unknown

A court may restrain persons unknown from using or disclosing confidential information obtained by hacking for the purpose of blackmail. It may proceed without notice and in private where notification or publicity would create a real risk of dissemination or frustrate protective and investigative measures.

Alternative electronic service, including service outside the jurisdiction, may be authorised where it is the only realistic means of bringing proceedings to the defendants’ attention. Prohibitory, delivery-up, destruction and self-identification orders may be made where the claimant has a strong case and refusal would create the greater risk of injustice. Blackmail attracts no material freedom of expression weight, and damages will generally be inadequate where disclosure could cause irreparable harm.

The claimant accountancy and business advisory firm alleged that unidentified hackers had stolen confidential and commercially sensitive information concerning the firm, its staff and its clients. The defendants demanded payment in Bitcoin and threatened to sell or publish the information through the dark web or more widely.

At an urgent private hearing, without notice to the defendants, the claimant sought interim prohibitory and mandatory injunctions, permission for alternative electronic service and service outside the jurisdiction, a self-identification order, and restrictions on access to evidence and hearing papers. The central issues were whether those procedural derogations and remedies were justified and whether the breach of confidence claim had sufficient merit.

1. The application was granted. There were good reasons to proceed without notice under the Civil Procedure Rules 1998. Notification created a real risk that the unidentified hackers would disseminate or misuse the information before an effective order could be made. On the evidence, freedom of expression was not engaged; if it had been, the compelling-reasons requirement was satisfied.

2. A private hearing was strictly necessary. Open justice remained the general rule, but publicity could hamper the continuing response and investigation, assist the defendants, or encourage others to seek or retain the stolen information. A limited public judgment preserved as much openness as the circumstances allowed.

3. The court permitted alternative service through the defendants’ communication website or email address and authorised service outside the jurisdiction. Those were the only realistic methods available. The breach of confidence gateway applied because the claimant was based in England and the threatened loss would be suffered here. The claim had a reasonable prospect of success, and England and Wales was the proper place for it.

4. The claimant could sue both to protect its own confidential information and to protect information held under contractual or other duties for clients and other third parties. A duty of confidence extended to persons who intentionally obtained information without authority and knew its confidential character. The improper acquisition, ransom demand and threatened sale supported that knowledge.

5. The prohibitory injunction satisfied the balance-of-convenience test in American Cyanamid v Ethicon [1975] AC 396. If section 12(3) of the Human Rights Act 1998 applied, the claimant also comfortably established that publication was more likely than not to be prohibited at trial. Blackmail was a misuse, rather than a legitimate exercise, of freedom of expression.

6. Mandatory delivery-up, deletion and destruction orders were justified. The court had a high degree of assurance that such relief would be ordered at trial, and the risk of injustice from refusal outweighed any foreseeable risk from granting it. A self-identification order was also necessary to make eventual remedies effective.

7. Damages were inadequate because disclosure could cause irreparable or serious financial and other harm. Temporary restrictions on serving the confidential evidence and on third-party access were appropriate. Persons already possessing or believed to possess the information could receive relevant documents upon giving an irrevocable undertaking and remaining amenable to the contempt jurisdiction.