AA v Persons unknown and three others revolved around anonymity applications to the court.
Background
The applicant, AA, was an English insurer who had insured a customer against computer hacking. The insured customer was targeted by the first respondent in a hacking sting where malware was installed in the insured customers IT system. The insured customer was then blackmailed for a ransom to decrypt the programs that the malware had affected.
The insurer paid £950,000 to the first respondent in order to obtain the tool which would allow decryption. The payment was made in bitcoins. The decryption was carried out, and took around 15 days.
Following the payment of the ransom and the decryption, investigations were carried out and a specialist company was employed by the insurer to track payment of the ransom monies. It was discovered that a substantial proportion of the ransom, namely 96 bitcoins, was transferred to an address operated by the third and fourth respondents in the matter.
An application was made for a proprietary injunction and a Norwich Pharmacal order. The applicant also applied to the court for the application against the defendants to be held in private. The Bryan J heard the application.
Application for a private hearing
Bryan J explained the relevant provisions in CPR 39.2, which provide:
“(1) The general rule is that a hearing is to be in public. A hearing may not be held in private, irrespective of the parties’ consent, unless and to the extent that the court decides that it must be held in private, applying the provisions of paragraph (3).
(2) In deciding whether to hold a hearing in private, the court must consider any duty to protect or have regard to a right to freedom of expression which may be affected.
…
(3) A hearing, or any part of it, must be held in private if, and only to the extent that, the court is satisfied of one or more of the matters set out in sub-paragraphs (a) to (g) and that it is necessary to sit in private to secure the proper administration of justice –
(a) publicity would defeat the object of the hearing;
(b) it involves matters relating to national security;
(c) it involves confidential information (including information relating to personal financial matters) and publicity would damage that confidentiality;
(d) a private hearing is necessary to protect the interests of any child or protected party;
(e) it is a hearing of an application made without notice and it would be unjust to any respondent for there to be a public hearing;
(f) it involves uncontentious matters arising in the administration of trusts or in the administration of a deceased person’s estate; or
(g) the court for any other reason considers this to be necessary to secure the proper administration of justice.”
As Bryan J stated, the test is one of necessity and not of discretion. The applicant submitted that publicity would defeat the object of the hearing. The applicant gave several reasons for the hearing to be held in private:
- The reason for the application was to assist the insurer to recover monies that had been extorted from them. If the hearing was made public, there would be a risk of tipping off the “persons unknown” to enable them to dissipate bitcoins.
- There was a possibility of reprisal or further cyber attacks made in revenge for the court action.
- There was a risk of copycat attacks on the insurer, and that confidential information would be revealed in regards to the insurer’s processes and the insurer’s customer systems.
- The final argument of the applicant was that he contended it was necessary for the court to sit in private to secure the proper administration of justice.
Bryan J looked at several of the previous cases relating to similar applications for hearings to be heard in private. He quoted Warby J in LJY v persons unknown:
“Generally, the Court has taken the view that blackmail represents the misuse of freedom of speech rights. Such conduct could considerably reduce the weight attached to free speech and correspondingly increase the weight of arguments in favour of restraint. The Court recognises the need to ensure that it does not encourage or help blackmailers or deter victims of blackmail from seeking justice before the Court, all these points are well recognised.”
Bryan J agreed with the applicant’s request. He stated:
“First of all, I am satisfied for the purpose of CPR 39(3) that publicity would defeat the object of the hearing. It would potentially tip off the persons unknown to enable them to dissipate the bitcoins; secondly, there would be the risk of further cyber or revenge attacks on both the insurer and the insured customer by persons unknown; there would be a risk of copycat attacks on the insurer and/or the insured customer. I am satisfied that in all the circumstances it is necessary to sit in private so as to secure the proper administration of justice.”
He also was satisfied that the application was properly made without notice to the first and second defendants; however, the judge did state that once the first and second defendants were served and the property was protected, he would lift the privacy in respect of the judgment so that it could be publicly reported.
Norwich Pharmacal and other injunctory applications
The second part of the insurer’s application was for injunctory relief, and a Norwich Pharmacal order. The application for a Norwich Pharmacal order required the third and fourth defendants to provide specified information in relation to the cryptocurrency account owned or controlled by the second defendant. A proprietary injunction was also applied for in respect of the bitcoin held at the account of the fourth defendant.
Although some of the officers of the third and fourth defendants were based in the English and Welsh jurisdiction, they were actually British Virgin Island (BVI) companies. They required to be served in the BVI. Accordingly, the insurer made an application for alternative service using the email addresses with which there had been previous communication.
There were also issues relating to Norwich Pharmacal orders where a respondent institution was out of the jurisdiction. Bryan J therefore concentrated on the proprietary injunction application.
Bryan J considered the relevant principles in relation to the granting of the proprietary injunction. The first issue was whether bitcoins could be considered property. As he explained prima facie, there is a difficulty in treating bitcoins and other cryptocurrencies as property: they are neither choses in possession nor are they choses in action.
After considering previous case law, Bryan J found that crypto assets such as bitcoin can be defined as property. He stated that they meet the full criteria set out in Lord Wilberforce’s classic definition of property in National Conventional Bank vs Ainsworth as being:
“… definable, identifiable by third parties, capable in their nature of assumption by third parties, and having some degree of permanence”.
Bryan J then went on to apply the principles in relation to a proprietary injunction. He listed these as:
- There must be a serious issue to be tried.
- The court must consider whether the balance of convenience lies in granting the relief sought.
- The balance of convenience involves the efficacy of damages as an adequate remedy, the efficacy of the costs undertakings as damages, and the overall balance of convenience including the merits of the proposed claim.
Bryan J stated that the test for a proprietary injunction against each of the four defendants was satisfied, that there was a serious issue to be tried. He therefore granted an interim injunction.
He also granted:
- Service out of the jurisdiction in relation to the claim form.
- Alternative service against the first and second defendants.
He also order that D3 and D4 had to provide pre-action disclosure.
Comment
Although this judgment does not raise any new points, it does consolidate the law in relation to hearings in private and the test that has to be complied with in order to obtain permission.
Bryan J also delivered a useful ruling that bitcoin is deemed as property for the purpose of legal proceedings.
