University and College Union v Person(s) Unknown

Where an unidentified perpetrator of a cyber-attack does not engage with proceedings, the court may determine an application on the papers if the defendant has been served and retains a right to seek discharge or variation. Open justice may be sufficiently maintained by publication of the judgment and non-confidential orders where attendance would disclose no further information.

The court may retrospectively validate and permit alternative service under CPR 6.15(2) where ordinary service is ineffective and the further method is appropriate under the overriding objective. Interim confidentiality injunctions and mandatory delivery-up orders may be continued where confidential information remains with a defendant who has not complied. Procedural directions may properly facilitate default or summary judgment and bring the claim to conclusion.

The claimant, a trade union and professional association, alleged that person(s) unknown had obtained data from its information systems and had disclosed, or threatened to disclose, it. At a private without-notice hearing on 17 October 2024, a Deputy Judge granted an interim injunction and related orders.

The claimant applied on 8 November 2024 for an extension to trial, continuation of derogations from open justice, alternative service, and further case-management directions. The defendant had been served by several methods but had not engaged with the proceedings. Mrs Justice Hill determined the application on the papers and considered whether the injunction, service arrangements, confidentiality protections and future procedural directions should continue.

1. Determination on the papers. The application was appropriately determined without a hearing and in the defendant’s absence. The defendant had been aware of the return date, had not engaged with the proceedings, and could apply under paragraph 13 of the order for discharge or variation. The open justice principle was sufficiently respected because the public could read the judgment and the non-confidential parts of the orders; attendance would disclose no further details.
2. Forum and service. There was no reason to depart from the Deputy Judge’s conclusion that England and Wales was the proper forum. The directions for service were consistent with the overriding objective. Because there were concerns about the effectiveness of earlier service, service by the further identified method was retrospectively validated and permitted prospectively under CPR 6.15(2).
3. Continuation of the injunction. The claimant’s confidential information remained in the possession of a defendant who should not have it and knew that fact. The defendant had not returned the information or complied with the mandatory delivery-up orders. Continuation of the interim injunctions was therefore necessary, just and convenient.
4. Future conduct and protective orders. Directions for the future conduct of the proceedings were appropriate and consistent with the overriding objective. They properly contemplated applications for default judgment and/or summary judgment where the defendant continued not to engage, and were intended to bring the claim to an appropriate conclusion. Orders protecting hearing papers and regulating the provision of documents and information to third parties remained necessary and appropriate.
5. The order sought by the claimant was granted.

The claim was commenced by an urgent pre-action application. On 17 October 2024, a Deputy Judge granted an interim injunction and related orders without notice. On 14 November 2024, Mrs Justice Hill extended the injunction to trial or further order and made related directions, giving these reasons in the present judgment.