Case 1:12-cr-00003-LO Document 39 Filed 03/20/12 Page 1 of 12 PageID# 386 IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA ALEXANDRIA DIVISION UNITED STATES OF AMERICA, ) ) Plaintiff, ) ) The Honorable Liam O’Grady ) v. ) ) 12 CR 3 ) KIM DOTCOM, et al., ) ) Defendants. ) MEMORANDUM OF LAW IN SUPPORT OF EMERGENCY MOTION FOR PROTECTIVE ORDER BY NON-PARTY CARPATHIA HOSTING, INC. Pursuant to Fed. R. Crim. P. 16(d)(1), non-party Carpathia Hosting, Inc. (“Carpathia”) moves for an order to protect it from undue expense and burden resulting from the continued storage of 1,103 computer servers containing 25 petabytes (25 million gigabytes) of data,1 which were used to provide services to Megaupload Limited (“Mega”), one of the Defendants in this action.2 PRELIMINARY STATEMENT Non-party Carpathia is a web hosting company that ultimately provided 1,103 computer servers to Mega from March 2007 until shortly after the original indictment in this case was unsealed, when Carpathia terminated Mega’s contract (the “lease”). Those servers (the “Mega 1 Each petabyte is equal to approximately 1,000,000 (one million) gigabytes, or the storage capacity required to store “…about 13.3 years of HD-TV video. About 50 Libraries of Congress.” (http://www.nasa.gov/centers/langley/news/researchernews/rn_datacenter_prt.htm). 2 There is a discrepancy between the amount of data alleged in the indictment to have been hosted by Carpathia for Mega (“approximately 25 petabytes”) and Carpathia’s own calculations (approximately 28 petabytes). While the gross amount of data associated with this discrepancy is very large, because of the staggering size of the data at issue in either event, the difference is immaterial for purposes of this motion. 1 Case 1:12-cr-00003-LO Document 39 Filed 03/20/12 Page 2 of 12 PageID# 387 Servers”) contain approximately 25 petabytes of data that form the basis of some of the allegations in the indictment filed against Mega. (Superceding Indictment, filed February 16, 2012 (the “Indictment”) ¶39). Although Carpathia owns and has remained in physical possession of the Mega Servers, Carpathia does not own and cannot access the data, nor does it have any interest in the data stored on the Mega Servers; its interests are solely in the physical hardware itself. In the ordinary course of Carpathia’s business, when a customer such as Mega becomes unable to pay its service fees or is otherwise terminated as a customer, Carpathia would delete any data from the servers and then reprovision the servers for use by other customers or sell them on the secondary market. In this case, because several parties have expressed an interest — legal or otherwise — in the preservation of the data residing on the Mega Servers, Carpathia has refrained from reprovisioning them. Instead, Carpathia has paid approximately $9,000 a day since late January to maintain the Mega Servers and their data while consulting with various parties to find an acceptable disposition for them. (See Ex. A, Declaration of Theresa Pittinger, dated March 20, 2012 (“Pittinger Decl.”) at ¶9). The parties who have so far claimed some interest in the data on the Mega Servers include: (1) Mega, which claims to need the data preserved for its defense and so that it may be returned to its customers (see, e.g., Ex. B)3; (2) the United States government, which has disclaimed a need for the data (Ex. C, Dkt. 32)4 but objects to the transfer of ownership of the Mega Servers from Carpathia to Mega (Ex. D)5; (3) the Electronic Frontier Foundation (the “EFF”), which claims to represent the interests of end users who have non-infringing content 3 February 19, 2012 Email from I. Rothken to B. Wiechering and M. Zwillinger (“Rothken Email”). 4 January 27, 2012 Letter from J. Prabhu to P. Davison, I. Rothken, G. Foley (“Prabhu Letter”). 5 March 2, 2012 Email from J. Prabhu to E. McNicholas (“Prabhu Email”). 2 Case 1:12-cr-00003-LO Document 39 Filed 03/20/12 Page 3 of 12 PageID# 388 stored on the Mega Servers and has requested that the data be preserved in order to facilitate its return to Mega users who have not engaged in copyright infringement (Ex. E, Dkt. 33)6; and (4) the Motion Picture Association of America (the “MPAA”), which, on behalf of its member studios, asserts a copyright interest in certain data purportedly located on the Mega Servers, has requested that Carpathia preserve the data in order to facilitate potential civil claims against Mega and the other Defendants in this action, and has indicated that it objects to any transfer of the data to third-parties (Ex. F).7 The options that the parties have considered include: (a) transferring the ownership of the Mega Servers to Mega, pursuant to its promises and representations to access the data only for defense in litigation and to maintain the Mega Servers for the duration of the litigation; (b) transferring the Mega Servers to the United States government; or (c) allowing Mega to copy the servers it needs to preserve for this litigation. The United States and the MPAA have objected to the transfer of ownership of the Mega Servers to Mega,8 and the Government is not willing to take possession of the Mega Servers. In addition, Mega has not copied (and may not be in a position to copy) all relevant server data, although, as described in Exhibit D, the Prabhu Email, Mega has been provided with access to certain Mega Servers so that its consultant could copy some of the data. 6 February 1, 2012 Letter from C. Cohn to J. Prabhu, P. Davidson, I. Rothken, and G. Foley (“Cohn Letter”). 7 January 31, 2012 Letter from S. Fabrizio to P. Weber (“Fabrizio Letter”). Carpathia does not have any legal obligation to preserve evidence on the Mega Servers. Carpathia has not been served with any valid discovery request, nor is any litigation against it currently pending or reasonably foreseeable. Moreover, it cannot produce data from the servers. Furthermore, to the extent any such litigation does develop, any party seeking discovery from Carpathia may be able to obtain all of the necessary evidence directly from the U.S. Government, which forensically imaged some portion of the data pursuant to the execution of a search warrant. See Ex. C, Prabhu Letter. 8 The United States has not yet fully articulated its objections for the transfer. Nevertheless, Carpathia does not want to act over any objection by the Government except as ordered by the Court. 3 Case 1:12-cr-00003-LO Document 39 Filed 03/20/12 Page 4 of 12 PageID# 389 Absent court intervention, Carpathia would thus be left in the untenable position of having to choose between (a) continuing to pay for preserving data over which it has no interest, and foregoing revenue that it could receive by reprovisioning or selling the Mega Servers, (b) reprovisioning the Mega Servers and risk a claim by a party with an interest in the data, or (c) transferring the Mega Servers to Mega over the objection of the Government and other third parties. If the Court does not grant a protective order, Carpathia, a nonparty to these proceedings, will incur substantial costs related to the moving, storage, and consumption of physical hardware, and would possibly incur future costs related to providing third-party access to the Mega Servers and third-party discovery because of access requests made by Defendants, the Government, the MPAA, and the EFF, all of whom claim some interest in accessing the data, but none of whom are willing to take possession of the Mega Servers (except for Mega, to which the Government and the MPAA have objected). Accordingly, by this motion, Carpathia seeks to obtain judicial relief from the physical and financial burden of storing and maintaining the data residing on the Mega Servers. This Court should, therefore, exercise its broad powers under Fed. R. Crim. P. 16 and enter a protective order either: (1) allowing Carpathia to reprovision the Mega Servers after a brief period of access has elapsed; (2) requiring one or more of the parties to this action to take possession of the Mega Servers in exchange for reasonable compensation to Carpathia; or (3) requiring any and all interested parties to compensate Carpathia for the substantial costs of transporting and continuing to maintain the Mega Servers until the conclusion of this action. See United States v. Salad, 779 F. Supp. 2d 503, 507-08 (E.D. Va. 2011) (collecting cases supporting a court’s inherent power to manage discovery disputes); see also Fed. R. Crim. P. 17(c)(2) 4 Case 1:12-cr-00003-LO Document 39 Filed 03/20/12 Page 5 of 12 PageID# 390 (permitting courts broad power to quash subpoenas if compliance would be unreasonable or oppressive). FACTS As alleged in the Indictment, Defendants leased servers that included approximately 25 petabytes of data storage from Carpathia to store content associated with the “Mega Sites.” (Indictment ¶39). Some of the content stored on those servers forms the basis for the allegations in the Indictment. Id. The 25 petabytes of data are stored among 1,103 computer servers leased by Mega across the United States and Canada, including nearly 570 servers located at an Equinix datacenter in Ashburn, Virginia leased by Carpathia. Id.; see Pittinger Decl., Ex. A at ¶¶4, 8. On January 19, 2012, the Government executed a search warrant on Carpathia and seized the Mega Servers located in Ashburn, VA and caused the Royal Canadian Mounted Police to seize servers in Toronto, Canada identified in the Indictment. (Ex. C, Prabhu Letter.) The Government did not, however, remove the Mega Servers located in Ashburn and instead “copied selected Mega Servers and copied selected data from some of the other Mega Servers.” 9 Id. Eight days later, on January 27, 2012, the Government sent a letter to counsel for Defendants, copying outside counsel for Carpathia, stating that “the United States has completed executing of its search warrants…[and] has no continuing right to access the Mega Servers. The Mega Servers are not in the actual or constructive custody or control of the United States, but remain … under the control of Carpathia…” Id. The Government’s relinquishment of control and responsibility for bearing the costs of continued preservation of this evidence is no small matter. As Carpathia made clear to the Government during the execution of its search warrant, and has made clear to the other interested 9 By contrast, with regard to certain servers located in Toronto, the RCMP seized the physical servers and has not yet returned them. 5 Case 1:12-cr-00003-LO Document 39 Filed 03/20/12 Page 6 of 12 PageID# 391 parties since then, the daily costs of maintaining the Mega Servers in powered and networked Equinix facilities is over $9,000 per day, a cost that Carpathia has borne in its entirety (See Pittinger Decl., Ex. A at ¶9). The Mega Servers cannot remain in the Equinix facilities because Carpathia’s contracts have been terminated and the Mega Servers must be removed prior to April 6, 2012. Id. Carpathia has started the process of moving the Mega Servers to a Carpathia-owned climate-controlled datacenter, at a transportation cost of $65,000, and an ongoing allocated lease cost of over $37,000 per month. Id. None of these expenses in any way redound to Carpathia’s benefit, which is not a party to this action and has no interest in the data residing on these Mega Servers. In addition, the physical hardware on which the data resides has a current book value of approximately one million, two hundred fifty thousand dollars ($1,250,000) and could be repurposed to generate revenue for Carpathia if they were not being used to store data for this litigation. Id. ARGUMENT The Court’s power to issue a protective order in criminal discovery matters is recognized in Fed. R. Crim. P. 16(d)(1), which provides that “[a]t any time the court may, for good cause, deny, restrict, or defer discovery or inspection, or grant other appropriate relief.” Additionally, in the event that a party were to serve a subpoena on Carpathia requesting production of or access to the data, Fed. R. Crim. P. 17 provides that a court “may quash or modify the subpoena if compliance would be unreasonable or oppressive.” This Court has recognized that a court’s inherent powers to control discovery and issue protective orders are broadly defined. Salad, 779 F. Supp. 2d at 508. In Salad, this Court required the Government to re-establish control over a yacht it had seized pursuant to a warrant and then relinquished back into the control of a third-party in order to preserve evidence and 6 Case 1:12-cr-00003-LO Document 39 Filed 03/20/12 Page 7 of 12 PageID# 392 facilitate a defendant’s access to that vessel. While in Salad the Court’s primary concern was the defendant’s access to evidence in order to prepare its defense, here the concern is not only access to the extent it impacts Defendants’ ability to prepare their defense,10 but the parties that must bear the costs of providing that access, and what precautions must be taken in order to prevent data loss. As Salad makes clear, the Government or the parties seeking access to the data should bear the costs of storage — not a third-party like Carpathia. Such relief is further supported by the fact that had Defendants, or any interested party, requested that Carpathia produce or provide access to the Mega Servers via a Rule 17 subpoena, compliance would be the very definition of unduly burdensome or oppressive. “Rule 17(c), is not couched in absolutist terms, it is based on reasonableness.” United States v. Doe, 434 F. Supp. 2d 377, 382 (E.D. Va. 2006). A subpoena is unreasonable or oppressive if it is “excessively broad” or “overly vague.” United States v. Richardson, 607 F.3d 357, 368 (4th Cir. 2010) cert. denied 131 S. Ct. 427 (2010). A subpoena that would require Carpathia to preserve, or produce (which it cannot do because it cannot access the data on the Mega Servers), 25 petabytes of data (a single petabyte is sufficient to store 13.3 years of HD-TV video content) would be the very definition of “excessively broad”11 as there is simply no basis for the contention that every single document on every single Mega Server is relevant to Defendants’ defense, the MPAA’s claims, or the EFF’s concerns. Even if every single petabyte were relevant, requiring a third-party like Carpathia to bear 10 While, as stated above, Mega has claimed that the servers contain exculpatory evidence necessary to their defense, Carpathia takes no position on whether Defendants require access to the Mega Servers to prepare their defense. It may be that the Government has preserved all of the relevant data and Defendants may access that data in discovery from the Government. 11 Indeed, the world’s largest storage array as of August 2011 was IBM’s 120 petabyte data center. See Tom Simonite, IBM Builds Biggest Data Drive Ever, technology review, August 25, 2011 (available at http://www.technologyreview.com/computing/38440/). 7 Case 1:12-cr-00003-LO Document 39 Filed 03/20/12 Page 8 of 12 PageID# 393 the costs of preservation of 25 petabytes — a historically and mind-bogglingly large amount of data12 — is unduly burdensome pursuant to Fed. R. Crim. P. 16 and exceeds any reasonable discovery obligation Carpathia could ever have in the event it is later served with a subpoena under Fed. R. Crim. P. 17.13 Moreover, even if such a subpoena were served, Carpathia could not log in to the Mega Servers to access the data for production because it only has access to the computer hardware, and no ability to access, search and produce relevant data. The only action Carpathia can take with regard to the data on the servers is to delete it entirely. Even in the civil context, a non-party in Carpathia’s position would be protected from bearing the burden of preserving the data. In the case of discovery taken of a nonparty, the court must “take reasonable steps to avoid imposing undue burden or expense on a person subject to the subpoena.” Fed. R. Civ. P. 45(c)(1); see also Fed. R. Civ. P. 45(c)(2)(B)(ii) (court’s order compelling production “must protect a person who is neither a party nor a party’s officer from significant expense resulting from compliance”). “Nonparty witnesses are powerless to control the scope of litigation and discovery, and should not be forced to subsidize an unreasonable share of the costs of litigation to which they are not a party.... [A] witness’s nonparty status is an important factor to be considered in determining whether to allocate discovery costs on the demanding or producing party.” United States v. C.B.S., 666 F.2d 364, 371-72 (9th Cir. 1982). Courts have repeatedly held that third-parties, like Carpathia, need not bear the expense of 12 Carpathia is aware of no other case that even approaches requiring a non-party to preserve or produce 25 petabytes of data. Twenty-five petabytes is equal to approximately half of all the entire written works of mankind, from the beginning of recorded history, in all languages (source: http://articles.mercola.com/sites/articles/archive/2009/08/01/How-Large-Is-a-Petabyte.aspx) 13 See, e.g., Hock Foods, Inc. v. William Blair & Co., LLC, No. 09-2588-KHV, 2011 WL 884446, at *9 (D. Kan. Mar. 11, 2011) (Sebelius, M.J.) (denying in part a motion to compel in a civil case in light of costs estimated between $1.2 and $3.6 million to search a mere 12,000 gigabytes (12 terabytes) of data in order to answer an overbroad interrogatory). The 12 terabytes of data involved in that case is much less than one percent of the server capacity in this case. 8 Case 1:12-cr-00003-LO Document 39 Filed 03/20/12 Page 9 of 12 PageID# 394 discovery. See, e.g., Last Atlantis Capital, LLC v. AGS Specialist Partners, 04 C 0397, 2011 WL 6097769 (N.D. Ill. Dec. 5, 2011) (finding that defendant need not bear any costs of production where it “is neither producing nor requesting, and has no independent need for the data. Moreover, not one case that Plaintiffs cite to requires the defendant to share the costs of obtaining discovery from third parties.”); Cantaline v. Raymark Ind., 103 F.R.D. 447 (S.D. Fla. 1984) (“the court should require the discovering party to advance costs to the non-party unless the discovering party can demonstrate that the sum sought ... is unreasonable”); see also Universal Del., Inc. v. Comdata Corp., Civ. No. 07–1078, 2010 WL 1381225, at *7–8 (E.D. Pa. Mar. 31, 2010) (Perkin, M.J.) (discussing sharing the costs of electronic production under Rule 45). As such, this Court should use its broad powers to allow Carpathia to put its assets to use by reprovisioning the Mega Servers or shift the costs of preserving this data to whichever party or parties insist on continued access (i.e., Defendants, the MPAA, and/or the EFF) or to the party that may be obligated to maintain evidence in order for the Defendants to prepare their defense (i.e., the Government). The burdens associated with preserving the data should not, however, continue to be borne by non-party Carpathia. CONCLUSION Pursuant to its authority under Federal Rule of Criminal Procedure 16(d), this Court should, enter a protective order that either: (1) requires the parties to the criminal case to take possession of the Mega Servers until the completion of the case, in exchange for reasonable compensation to Carpathia; (2) requires the parties to reimburse Carpathia for the cost of transport and storage of the Mega Servers; or (3) allows Carpathia to delete the data and 9 Case 1:12-cr-00003-LO Document 39 Filed 03/20/12 Page 10 of 12 PageID# 395 reprovision the Mega Servers after a brief, but reasonable, period of access for selective copying under an approved procedure. Dated: March 20, 2012 Respectfully submitted, SNR Denton US LLP /s/ Christopher L. Harlow _____________ By: Christopher L. Harlow 1301 K Street, NW Suite 600, East Tower Washington, DC 20005 (202) 408-6400 Attorneys for Carpathia Hosting, Inc. Of Counsel: Marc J. Zwillinger Robert F. Huff Jr. ZwillGen PLLC 1705 N Street, NW Washington, DC 20036 (202) 296-3585 Attorneys for Carpathia Hosting, Pro Hac Vice Applications Pending 10