Lonestar Communications Corporation LLC v Daniel Kaye & Anor

Lonestar’s only factual witness was Mr Karl Toriola, the CEO of MTN Nigeria Communications Ltd, the indirect majority shareholder in Lonestar. In April 2015, he was appointed as a Group Operations Executive, and in December 2015 he became MTN’s Vice President for West and Central Africa, remaining in that role until December 2020. Between April 2015 and December 2020, Liberia was one of the markets over which Mr Toriola had oversight, and Lonestar’s CEO (Mr Babatunde Osho) reported to him.

It was Mr Toriola’s evidence that:

“As part of that oversight, I received documents produced by Lonestar and reporting on Lonestar’s performance …. Outside of those structured reporting mechanisms … I was also in frequent communication with Lonestar’s CEO, very often on a weekly, if not daily, basis”.

There is no doubt that Mr Toriola is a highly capable and experienced senior telecommunications executive, with good tactical awareness and great fluency of expression. It may be those qualities which led Lonestar to conclude that he should be its only fact witness at trial. However:

Lonestar’s decision to call Mr Toriola, rather than anyone working “in country” at the relevant time, meant that there was no witness before the court who was able to speak with the benefit of experience of working at Lonestar at the relevant time. No satisfactory explanation was offered for this evidential deficiency. In particular it is apparent that a number of the executives who held senior positions with Lonestar at the relevant time still work within the MTN group, including Mr Andrew Bugembe (who was Chief Financial Officer from October 2014 to August 2016) and Mr Kyomukama (Chief Technology and Independent Officer from September 2014 to September 2016). The explanations offered in Appendix A to Lonestar’s closing for the absence of these witnesses were not persuasive, and rather served to highlight the importance of the missing evidence. It was said that Mr Bugembe‘s work was “primarily focussed on finance” and that Mr Kyomukama’s evidence would not have added materially to Mr Toriola’s given that he was “a former Chief Technical Officer” (which I understand to be a reference to Mr Toriola’s role as Deputy Chief Technical Officer of Airtel Nigeria, working in Nigeria, up to 2006).

Orange Liberia adduced factual evidence from four witnesses.

The evidence of these witnesses was of very limited assistance in the resolution of the factual disputes which had to be determined at the trial. Only Mr Cardoza and, for part of the period, Mr Berte and Mr Kone were working for Cellcom/Orange Liberia during the relevant period. Their evidence as to their perceptions, from within Cellcom/Orange Liberia, of the significance of the DDOS Attacks for Lonestar was inevitably that of “outsiders”. It was also coloured by the parties’ competing narratives in the dispute, as became clear during the course of their cross-examination. For that reason, I do not feel able to place any reliance on their evidence as to the significance of the DDOS Attacks. In relation to all four witnesses, their evidence did not add materially to the contemporaneous documents, which provide the best, and most reliable, evidence of the impact of the DDOS Attacks on Lonestar.

The court heard expert evidence in three disciplines.

First, expert evidence in Liberian law:

Counsellor Musu-Scott is clearly able to speak authoritatively as to the likely outlook of the Liberian Supreme Court on broad issues of judicial policy. However, her evidence was less informative when seeking to address the issues of Liberian law at a more granular level, and she had a tendency to answer questions by referring Mr Kitchener KC to what she had said in her report (much as a judge might refer counsel to what they had said in a judgment, without wishing to enlarge on or debate its contents). While Lonestar was undoubtedly correct to observe in its closing submissions that “her evidence in cross-examination was consistent with her reports”, it was also co-extensive with it as well. The “conclusory” character of her evidence made it less helpful than it would otherwise have been, given the highly debateable nature of many of the issues of Liberian law.

Counsellor Padmore was an impressive witness, who was willing to engage in debate and to give ground, and whose answers were reflective. While he has practised from the U.S. for the last 40 years, I am satisfied that he is an expert in and knowledgeable of Liberian law, with considerable experience of litigation in the Liberian courts. He was willing in the course of his oral evidence to acknowledge a degree of “rough and readiness” in aspects of the decision-making of the Liberian court (something which, understandably, would have been difficult for Counsellor Musu-Scott). However, when tested against those realities, the analysis of certain issues in his reports did appear to present a rather idealised version of Liberian law.

Second, the court heard expert evidence in cyber security:

On the purely technical questions, the evidence of both witnesses was informed, helpful and only in dispute to a limited extent. As to their evidence in cross-examination:

Third, expert evidence in valuation/economic matters:

Both experts were very well-qualified, well-prepared and adept at holding their ground in the course of cross-examination. On the key issues in dispute, they had adopted very different approaches, which, I suspect, were to a large extent conditioned by the forensic circumstances of the parties calling them. As I explain below, the contemporaneous documents are not supportive of the scale and timing of loss for which Lonestar claims, and Mr Nicholson’s analysis was largely built on Mr Toriola’s evidence and a macro-economic analysis of the West African mobile telecommunications market. Mr Thomas’ analysis was largely grounded in the internal materials disclosed by Lonestar. There were occasions in his cross-examination in which Mr Thomas became a little combative, and unnecessarily acerbic. However, I am satisfied that this was not the result of any misplaced loyalty to the party calling him, but reflected the strength of his belief in the reliability and intellectual robustness of his own analysis, and the unfavourable view he had formed of Lonestar’s offering. Nor is it fair to suggest (as Lonestar did in closing) that “Mr Thomas took an extreme view, making every conceivable point against Lonestar (however immaterial) with a view to justifying his extreme assumptions”. As I explain below, on certain points Mr Thomas was willing to adopt what I suspect were assumptions which were favourable to Lonestar, in order to present a conservative and robust analysis. While Orange Liberia sought to row back from certain of those positions in closing, I have not allowed them to do so. However, the fact of the attempt belies Lonestar’s characterisation of Mr Thomas’ evidence in closing.

Liberia has a population of just over 5 million people, and a GDP per capita of $633. The vast majority of mobile communications business in Liberia is pre-paid voice business, by customers who top-up their SIMs on a very regular basis.

Lonestar was the first company to enter the Liberian cellular telecommunications market, in 1999 (the national carrier, Libtelco, only offered fixed wireless services and not cellular telecommunication services). For a period, Lonestar was the only operator in that market, and hence the incumbent. It was able to charge high prices both for SIM cards and to stay connected.

In 2005, Cellcom Liberia entered the market, and from that point, the telecommunications market in Liberia has effectively been a two-player market. In March 2014, an Information Memorandum produced by Standard Bank in relation to the potential sale of Cellcom BVI estimated that the combined share of the Liberian telecommunications market of Lonestar and Cellcom Liberia was 96%.

In June 2012, Cellcom Liberia launched 3G services, enabling it to be the first mobile operator to offer mobile data in Liberia, Lonestar’s offering being launched in December 2013.

Cellcom Liberia undertook a number of marketing campaigns. These included its “$1 for 3 days” campaign launched in March 2013, which offered three days of calls to other numbers on the Cellcom Liberia network for US$1.

It is clear that this offer, which remained in operation until September 2019, had a significant impact on the Liberian market. Having made a profit of $28.2m in 2013, Lonestar’s profit fell to $7.4m in 2014 and US$1.96m in 2015 (a year in which Mr Nicholson, Lonestar’s expert, suggests that there was only a US$0.1m impact from the DDOS Attacks). The figures for (combined voice/data) market share show Lonestar’s progressive loss of market share to Cellcom Liberia:

There was also a steady decline in Lonestar’s Average Revenue per User (ARPU) – once again the figures presented below are combined voice/data figures:

In April 2015, Lonestar was forced to introduce its own $1 for 3 days package, albeit one not available to High Value Customers (HVCs), known as DYO. Between April and October 2015, the combined (voice/data) ARPUs of Lonestar and Cellcom Liberia were running roughly in parallel, although there is a dispute between the parties as to whether Lonestar had steadied the ship, as it contends, or whether this was a brief pause in its irresistible downwards descent.

The mobile market in Liberia was, at the relevant time, dominated by voice rather than data:

A particular issue of controversy so far as the relative positions of Lonestar and Cellcom Liberia is concerned is who had a higher proportion of HVCs – those who spent appreciably more than the average user-spend. A key element in Lonestar’s quantum case is that Cellcom Liberia’s aggressive pricing had not won them many HVCs, who were more interested in quality of service and network coverage than price, and for that reason were attracted to Lonestar. Lonestar contends that it was the adverse effects of the DDOS Attacks on the quality of its service which led HVCs to move to Cellcom / Orange Liberia. As to this:

In July 2015, Orange CDI submitted a binding offer to Cellcom BVI to acquire 85-90% of the share capital of Cellcom Liberia. A stock purchase agreement for the sale was signed on 18 December 2015, and amended on 5 April 2016 (the SPA).

Under the final version of the SPA:

On 5 April 2016, Cellcom BVI, Cellcom Liberia and another Orange entity (Orange BVI) entered into a Transitional Services Agreement (the TSA) by which Cellcom BVI agreed to provide certain services to Orange Liberia during a period after the completion of the sale, in return for the payment of fees. These included “consulting services” to be provided by various named members of staff, including Mr Marziano and Mr Polani. In total, Cellcom BVI was paid $1,568,038 under the TSA.

A DDOS attack is a form of cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by flooding the target machine or resource from multiple different sources, in an effort to overwhelm it and prevent legitimate requests for connection being fulfilled.

The DDOS Attacks were attacks on Lonestar’s data work, and did not have a technical impact on the availability or quality of Lonestar’s voice network.

There are, broadly, three types of DDOS attack, all of which featured in the attacks on Lonestar:

It is common for these types of attack to be used in combination, in what is known as a “multi-vector attack”. They can be carried out by using so-called “Booters”, which are publicly available, on-demand, web-based “DDOS-for-hire” services offered for a fee by cybercriminals, who undertake external attacks on a network. They can also be undertaken using “Botnets”, which involves infecting a victim’s software with malware controlled by cybercriminals, such that it can then be used (along with other infected devices) to carry out a DDOS attack.

Lonestar was the victim of multi-vectored DDOS attacks, involving all three types of DDOS attacks, using both “Booters” (in particular the “vDOS” booter service) and Botnets (Lonestar’s system being attacked by devices infected by the “Mirai” or “Mirai#14” malware).

Lonestar had in place measures designed to protect it against the effects of DDOS attacks, and those systems were enhanced during the period of the DDOS Attacks:

It is common ground that Lonestar has had in its possession technical data which would substantially have identified the number, type and duration of the DDOS Attacks. In particular, Lonestar would have had data showing what network devices and services were affected by DDOS traffic, in what ways, and for how long. However, Lonestar did not retain that data. While I am satisfied that Lonestar’s failure to preserve this technical data was not the result of any deliberate decision to ensure that it was not available in the litigation, its failure to preserve this material is surprising. Lonestar knew it had been subjected to the DDOS Attacks from October 2015, on its own case they were having a very significant impact on its business and profitability, and it made an insurance notification on 2 November 2015. Mr Kaye’s activities came to light in early 2017. While there had been some suggestion that it would have been very onerous to retain the material because of its size, Mr Campbell accepted in cross-examination that the traffic-flow and log files could have been stored without retaining the underlying packets of information, and that this material could have been retained. I found Mr Campbell’s attempts to explain away the failure to retain this data unconvincing.

In terms of the material which is available:

Taking the Mitigation Reports first:

It will be apparent from this summary that:

Turning to the contemporaneous documents:

A document prepared by Mr Marziano commenting on Lonestar’s Particulars of Claim acknowledges that he knew Mr Kaye before the DDOS Attacks began, and claims that he first met Mr Kaye “sometime in 2015”. By August 2015, Mr Marziano and Mr Kaye were communicating about a proposed cyber-attack on Lonestar through an encrypted instant-messaging application called “Threema”. It is clear from their exchanges that the topic had been discussed before the first available communication, and that it was proposed that Mr Marziano pay Mr Kaye to carry out the attacks. Agreement was reached on the broad purpose of the attacks, including disrupting, damaging and sabotaging Lonestar’s business.

Mr Marziano provided Mr Kaye with Lonestar email addresses to assist him. Mr Kaye began constructing a “bot” to assist in the attacks. On 12 September 2015, Mr Kaye and Mr Marziano met in Nice, and Mr Marziano paid Mr Kaye $9,000 in cash.

On 12 October 2015, Mr Kaye provided a brief demonstration of DDOS attacks on Lonestar, and Mr Marziano identified certain times when he wanted Mr Kaye to take down Lonestar’s internet services. On 15 and 16 October, Mr Marziano reported back on the effect of the DDOS Attacks to date, and steps Lonestar was reportedly taking to deal with them. On 22 October, they discussed ways in which the DDOS Attacks might be made more powerful.

In early November, Mr Marziano provided Mr Kaye with Threema contact details for Mr Polani. Mr Polani then communicated with Mr Kaye directly, providing him with relevant information, and discussing how further DDOS Attacks could be undertaken, and how Mr Polani might help. Mr Polani also reported back on the effects of the DDOS Attacks as perceived in Liberia. Mr Marziano made a further payment to Mr Kaye on 5 November 2015, and they met in London on 14 November 2015.

Turning to the effect of the DDOS Attacks, there are 10 days in October in which traffic identified by the Huawei mitigation system exceeded the capacity of Lonestar’s network and cleaning system:

On all of those dates save for 27 October, Mr Campbell has identified documents referring to effects consistent with DDOS attacks. Mr Campbell identifies documents which he says evidence effective DDOS attacks on 7-9, 12, 17, 19-23 and 28-30 October.

It is clear from the contemporaneous documents that there was an attack lasting just over an hour on 3 October, and a shorter attack the following day, 4 October. I accept that the first of these would have caused noticeable latency for a period, and perhaps the second, but Mr Marziano’s Threema chat in the evening of 4 October makes it clear that all effects had ceased by that point. Mr Kaye was on holiday over the period from 7-9 October, and I am not persuaded that there were any attacks during that period. I accept that there were two brief attacks on 12 October, when Mr Kaye sought to demonstrate to Mr Marziano during a Threema chat that he could switch the attacks “on” and “off”.

There were further attacks between 13-16, and 24-27 October. The significance and scale of the October attacks is, in my view, best captured in the following documents:

Lonestar’s October 2015 review referred to the DDOS Attacks as a “key challenge”, with internal and external actions having improved matters in the last couple of days of the month. The review did not identify any adverse effects from the DDOS Attacks, and Mr Toriola did not suggest that there had been any.

The Mitigation Reports do not show any occasions when there were attacks exceeding the scrubbing capacity of Lonestar’s network in either November or December 2015. Mr Campbell has referred to two documents said to show effects on the system on three days in that period– 3 November, 29 November and 1 December. However, I am not persuaded that there were any appreciable effects of DDOS Attacks on Lonestar in those months:

It is important to consider Lonestar’s financial performance in Q4 2015, in view of the suggestion that it was the effects of the DDOS attacks which drove a key pricing decision in January 2016:

There is nothing, therefore, to suggest that the DDOS Attacks had had any significant impact on Lonestar’s data business by the end of 2015, still less that any impact on Lonestar’s data business had begun to have a knock-on impact on Lonestar’s voice business.

There is no real visibility as to any interactions between Mr Kaye and Mr Marziano over this period. There were no occasions in January 2016 when DDOS Attacks occurred at levels which exceeded Lonestar’s network or scrubbing capacities. While Mr Campbell suggests that there are documents which are consistent with the effects of DDOS Attacks on 6 and 29 January, neither document will bear the weight placed on it:

Consistent with that picture:

In January 2016, Lonestar decided to open up its DYO offering to HVCs – a hugely significant pricing decision which would inevitably have an adverse impact on its ARPU. There is no suggestion in any of the contemporaneous documents that this decision was a response to the DDOS Attacks. On the contrary, the available documentation attributes the decision (entirely understandably) to the need to compete with Cellcom Liberia’s $1-3 days offer:

As I have said, as part of the process of opening up DYO to HVCs, Lonestar made changes to DYO which made it less attractive than Cellcom/Orange Liberia’s $1-3 days offering: capping the number of minutes for each user, capping the total amount of voice traffic on the network for 6 hours a day and placing limits on the number of times a customer could re-charge the $1-3 days each month. Certainly, Lonestar disclosed some documents which suggest that it took these steps, which Mr Thomas interpreted in this sense, and no witness was called by Lonestar to explain the position.

Mr Toriola did not even mention the January 2016 price adjustment in his first witness statement, and did not suggest it was a response to the DDOS Attacks in his second witness statement. That suggestion emerged for the first time in cross-examination, but was thoroughly unconvincing, and wholly inconsistent with the documentation.

The consequences of allowing HVCs to access DYO, while retaining access to Lonestar’s superior voice network, were instant and entirely predictable:

There is evidence of two large attacks on the Lonestar network on 6 and (to a lesser extent) 7 February 2016, albeit the effect of the evidence is that these attacks had much less effect on the Lonestar network than the October 2015 attacks:

A Huawei report refers to a small and fully mitigated attack on 8 February 2016. While Mr Campbell refers to an email from Mr Bowier of that date linking an issue with network performance with the DDOS attack, Huawei’s investigation showed that this was not in fact the case, and the broad effect of communications at this time is that the network was running normally on this date (e.g. Huawei stated that they were “not finding any abnormality” and that traffic was following “its normal trend”). The Threema messages relied upon by Mr Campbell to support an attack on 20 February do not support that conclusion (the IP address in question not being Lonestar’s). Nor is there anything to suggest that Lonestar perceived, from a business perspective, that its data offering faced a threat from the DDOS Attacks which could reduce usage or cause it to lose customers. In February 2016, Lonestar removed the (small) data component of its DYO offering, effectively increasing its data pricing. It is difficult to see why these steps would have been taken if the DDOS Attacks had been perceived as presenting a material threat to the data business at this time. There is no evidence, however, of the DDOS Attacks even being discussed in this context.

The technical evidence suggests that there were a number of small, and mitigated, DDOS attacks in March and the first four days of April, with the cleaning capacity of the Huawei system not being exceeded on any day during those two months (and indeed on the figures used by Mr Campbell, Lonestar’s network capacity was not exceeded at all during those two months). Mr Campbell does not identify any document said to be supportive of data attacks during this period. The Q1 and Q2 CEO Reports do not refer to any DDOS attacks between March and June, nor do the Ops Reviews for March and April.

It is necessary to interrupt the narrative relating to the DDOS Attacks at this point to address two significant market developments in April 2016.

The first is that Orange Liberia launched 4G data services (also known as LTE). The attraction of a 4G data offering to HVC customers is obvious, and the introduction of 4G had an immediate impact on Orange Liberia’s data traffic (as did Lonestar’s introduction of its 4G data offering, 9 months later):

While Mr Toriola sought to suggest that the challenges of dealing with the DDOS Attacks had delayed the introduction of Lonestar’s 4G offering, there were no contemporaneous documents supporting this assertion, and on the contrary it is clear from the 2016 Q1, Q2, Q3 and Q4 CEO Reports that there were delays in tendering for the project (which was not completed until June 2016) and in procuring the necessary equipment (because of the need to set up the letters of credit necessary to import it).

The second is that Lonestar reduced its PAYG voice and data prices by between 30% and 45%. Once again, contemporary documents do not suggest that this decision was taken in response to the effects of the DDOS Attacks (and, in fairness, Mr Toriola did not suggest that it was). The Q2 2016 CEO Report stated that “Attritional Price war and competition value destruction resulted to a review across Voice and Data PAYG tariff adjustments of up to -30% in voice and -45% in data”. The same document, when addressing the factors impacting “QoQ core Voice and Data revenue negatively”, referred to various factors, including “LTE network launch in April giving undue data advantage”, but said nothing about the DDOS Attacks. It also referred to HVC ARPU declining “as more HVC now migrating to $1 for 3 days”: another sign of the lure of low prices for HVCs customers.

Inevitably, the reduction in Lonestar’s prices had an immediate impact on its ARPU. The ARPU differential between Lonestar and Orange fell 39c between March and April 2016, and by 70c from March 2016 to June 2016.

The technical data does not reveal any effects of DDOS attacks on the system in May and June 2016, and, once again, there are no references to DDOS attacks in the Ops Reviews for those months, or in the Q2 CEO Report. Mr Campbell did not identify any documents said to evidence the effects of DDOS attacks in June 2016, but he does point to 5 documents said to evidence effects on six days in May. I accept that there is material suggestive of “a possible DDOS attack” on 11 May, which impacted Lonestar’s mobile money service for 2 hours. The material relied upon as evidence of the effect of attacks on 17 and 19 May concern a complaint by a customer located in South Africa which was investigated by Huawei, who thought that DDOS “should not be an issue”. In the event, the issue appears to have been the result of the customer attempting to use a port on a subnet which had been blacklisted by internet providers. On 18 May, Huawei noted traffic congestion on a particular VLAN, but there is nothing to suggest that this was the result of a DDOS attack, and no DDOS attack traffic was detected by the Huawei system on that date. The email exchange relied upon in relation to 26-27 May is inconclusive, and there is no record of a DDOS attack on 26 May.

Lonestar’s business performance at the end of Q2 2016 was disappointing – ARPU was 14% below budget on a YTD basis, revenue 23% below budget, and EBITDA 37% below budget. The executives tasked with presenting those unhappy figures to senior management would no doubt have welcomed the opportunity to blame them on a supervening and unpredictable event such as the DDOS Attacks. However, no such suggestion was made. The ARPU and EBITDA figures were attributed to the two pricing decisions, and Orange Liberia’s launch of 4G/LTE. The CEO’s report for Q2 2016 attributed the reduction in MOU to limits placed on Lonestar’s DYO package (“MOU declined by 10% against Q1, driven by $1 for 3 days availability throttling for 6 hours daily. The adjustment has now been lifted and MOU is now on the increase” – throttling being a limit on voice calling during peak hours). Nor did the July 2016 document, “Data Strategy and GTM Plan”, in a considered “SWOT” survey of Lonestar’s business, identify the DDOS Attacks as a weakness or a threat. This document included a detailed survey of changes in Lonestar’s data customers from Q3 2015 to Q2 2016, with a view to determining whether customers who had stopped using Lonestar’s data offering had changed their Lonestar voice spend to a greater extent than those who had not. There was no material reduction in the voice spend by those who had stopped using data and those who had not. That is very difficult to reconcile with Lonestar’s case theory that attacks whose technical effects were limited to its data network materially impacted its voice earnings, because unhappy customers voice spending “followed” their data spend.

In or around July 2016, Mr Kaye gained access to the “vDOS” booter platform, and in September 2016, to the Mirai botnet.

A new, and more serious, phase of the DDOS Attacks began in the second half of July. Significantly, on 24 July 2016, Mr Toriola received his first communication on the subject of DDOS since 7 February, and on 25 July, Mr Bowier sent an email referring to attacks the previous week, and comparing them with what happened “during our last DDOS attack in February”.

The technical data shows no attack traffic from 1 to 17 July, then a significant increase in DDOS attacks in the last 10 days of July and the first two weeks of August. The attacks were within the cleaning capacity of Lonestar’s cleaning system (which was further enhanced on 25 July when the Arbor Peakflow system became operational).

Mr Campbell has pointed to documents said to show the effects of DDOS attacks on Lonestar’s network on 12 days in July and 16 days in August (either directly, or as consequences of mitigating measures put in place to deal with DDOS attacks). While I am not satisfied that all of these documents establish the occurrence of effective DDOS attacks, I am persuaded that there were 8-10 days in the second half of July when DDOS attacks had noticeable effects on Lonestar’s system. An email from Mr Bowier of 25 July refers to Lonestar being “under serious DDOS UDP flooding for a week” which “caused all of our data services to run very slow”. A Huawei report also refers to attacks from 28-31 July.

From 29 July, the evidence suggests that a modification to the mitigation software proved effective in countering the new wave of attacks, albeit a network modification on 14 August provided a brief opportunity for the DDOS Attacks to penetrate Lonestar’s defences once again. There was an effective attack on 17 August, leading to the installation of another defensive measure, the Level 3 NPS service, on that date. Issues resulting from the implementation of anti-DDOS measures continued to have effects on the network to 21 August. An email from Mr Chingwena suggests that, by the evening of 21 August, the effects had been overcome. There are no documents which evidence DDOS attacks from 22-25 August.

On 26 August, Mr Kaye switched the form of the DDOS Attacks to TCP SYN attacks, which were able to bypass the defensive measures currently in place. It took Lonestar a few days to arrive at a satisfactory means of dealing with the new form of attack, without the defensive measures themselves impacting the user experience. This appears to have taken until 29 August, and Mr Campbell does not point to any documents suggestive of ongoing effects on 30 and 31 August.

The July and August Ops Reviews mentioned this next wave of effective DDOS attacks, as did the Q3 CEO Report. While the July report did not seek to link Lonestar’s financial performance with the attacks, as opposed to pricing decisions and dealer issues, the August report discussed a 45% decline in mobile data revenue and attributed it to the DDOS Attacks. The Q3 2016 CEO Report also referred to “DDOS attack on the network negatively impairing customers data experience with a correlated drop in Data revenue thereof”. There was no attempt to suggest that the DDOS Attacks had caused the reduction in voice revenues, which was attributed to the reduction in prices following the April 2016 review and the increasing use by HVCs of Lonestar’s DYO offering.

The technical data suggests that Lonestar’s defensive measures, supplemented from 7 September 2016 by the Arbor Cloud system, were largely effective in dealing with any DDOS attacks up to the last day of October. For by far the greater part of this period, very little traffic was detected, and attacks on 28 September and 4 and 5 October were well within the cleaning capacity of the systems. Mr Campbell points to documents which he suggests evidence effective attacks on 4 days in September and 7 days in October. As to these:

I accept that there was a perception by some within Lonestar of ongoing adverse effects either from the DDOS Attacks or the measures taken to address them. The September Ops Review referred to the Arbor software helping to ease the attacks, but also to “continuous DDOS attacks resulting in poor data experience” (albeit data revenue was 18% up on August, data subscribers 9% up and data revenue from HVCs 47% up). The October Ops Review referred to “Fluctuation in Data Experience”, and referred to the major attack on 31 October which I discuss below. However, data revenue growth was 7% up on a “month-on-month” basis.

I accept that the contemporaneous documents provide some support for Lonestar’s argument that, by September or October, the DDOS Attacks were having an impact on its data revenue. The September Ops Review refers to “revenue loss DUE to DDOS attack” and to putting in place “DD[O]S Attack Control” to “address poor data performance”. The October Ops Review refers to “fluctuation in Data Experience … affecting uptake of data bundles”. However, the Ops Reviews do not suggest that there was any impact on its voice revenue, the adverse state of which is attributed to other causes.

From 31 October 2016, Mr Kaye had access to the Mirai #14 botnet, and this led to a marked increase in the severity of DDOS attacks to which Lonestar was subjected. These attacks were particularly effective between 31 October and 2 November, when the attacks and the mitigating software caused internet slowness and loss of data traffic, and generated significant international press commentary between 3 and 7 November. That commentary inevitably presented a rather dramatic account of the attacks which, equally inevitably, featured prominently in Lonestar’s case at trial. Lonestar’s internal assessment on 3 November noted:

That is a more sober assessment than the press coverage, and Orange Liberia draws attention to the assessment of one cyber-security expert describing the “breathless” press coverage as exaggerated. However, even if the press coverage did “over-egg” the impact of the DDOS Attacks on Lonestar’s network, those public statements will have constituted another way in which the DDOS Attacks will have damaged perceptions of Lonestar’s data offering.

So far as the period between 3 and 20 November is concerned, there were periods on 4, 10 and 14 November when their scale appears to have overrun the cleaning capacity of the mitigation systems. Mr Campbell does not identify any documents said to evidence the effects of DDOS attacks for 5-6, 8, 12, 15-18 and 25-27 November.

Over the period from 20 to 23 November, the DDOS Attacks took advantage of a “direct peering” connection Lonestar had with Facebook, Google and YouTube’s websites, allowing “dirty” traffic to circumvent the mitigation software. There was an element of “cat and mouse”, with Lonestar taking steps to close one “back door”, by closing the direct peering with a particular site, only for Mr Kaye to try another “back door”. Lonestar worked hard with external contractors to come up with a solution, which was put in place in the course of 24 November, and appears to have solved the issue.

Nonetheless, it is clear that the cumulative effect of the DDOS Attacks had caused a customer backlash against Lonestar’s data offering. The November 2016 Ops Review identified as a key challenge “DDOS impact on Data quality creating negative experience and backlash from customer. MoM Data volume declined by 20million MB”. Further, one slide stated, “Top 20 MoM Data revenue significantly declined as a result of DDoS attacks and some subscribers that have moved their data to competition are also moving voice”. There is a dispute as to whether this is a reference to lost subscribers, or to reduced usage by those continuing to use Lonestar for some voice. As to this:

In these circumstances, I am not persuaded that, as at November 2016, Lonestar had formed the view that the DDOS Attacks had appreciably reduced usage by retained voice customers, as opposed to contributing to the churn of customers who left Lonestar altogether. I also note that Lonestar’s “Recovery Plan” prepared in November 2016 referred to four reasons why such a plan was required. Relevantly for present purposes, it referred to:

Turning to December, Mr Campbell points to documents said to evidence the effects of DDOS attacks on various dates. I accept that there is evidence of the DDOS Attacks impacting Lonestar’s internet services on various dates up to 15 December, whether the direct impact of DDOS Attacks or as results of adjustments to the Arbor Peakflow onsite APS system which Lonestar installed at the end of November. Once fully operational, this new system would ensure that not all attack traffic had to be routed to the Arbor Cloud to be dealt with, minimising the impact of Lonestar’s defensive systems on those using its network. However, it was only from 15 December that the new defensive systems were fully functioning. Those systems largely contained the DDOS Attacks from that date, save for what appear to have been relatively minor effects on 18 and 23 December.

The December Ops Review referred once again to “the continuous DDOS attacks”, and to a “fluctuation” but it noted a 34% increase in data revenue compared with the preceding month, while recognising the adverse effects which the DDOS Attacks had had on data revenues YTD. The Q4 CEO Report also referred to the growth in the number of data subscribers (14%) “despite consistent DDOS attacks since July 2016”, growth concentrated in September (9%) and December (9%). There is also evidence that Lonestar had adjusted its data pricing in response to the DDOS Attacks and Orange Liberia’s 4G/LTE offering, Mr Osho referring to a “300% bonus on data bundles to entice and retain Data Users in the mi[d]st of the DDoS attacks and to also mitigate the impact of the competition LTE expansion”. The is the first documented suggestion of any reduction in Lonestar’s data prices by reason of the DDOS Attacks. Mr Osho also noted the voice usage was up over Q3 (just as Q3 had been significantly up over Q2), but that voice revenues were down because “price war and competition value destruction remains a factor in the market as subscribers spend continue to decrease while traffic increases”. The loss in data revenue to the DDOS Attacks had not, therefore, contributed to a reduction in voice usage, and the reduction in voice revenue was the result of ongoing price competition. The Revised December Recovery Plan (prepared under Mr Toriola’s direction) is to similar effect, identifying DDOS and 4G/LTE as the reason for lost data revenue, and the DYO offer as the reason for lost voice revenue, both on an “all customer” basis, and for HVCs when considered separately. The report noted the “attacks easing out”, as a result of the mitigation measures taken, but that matters were “under observation” and subject to “further optimisation”.

Another document produced in December 2016, the “Top 20 Downgraded Subscribers Analysis”, recorded a drop of voice revenue (63% between October and November 2016) and MOU (by 58%). It observed that “this drop is a result of a high movement of subscribers to $1 for 3 day calls On-net Calls and $1 a day On-net calls + calls to USA and Canada”. However, it also states “as was shown in our previous analysis on the slide below, most of the Data Subscribers move their voice spend where their data spend is, and with the planned LTE Advanced launched, an aggressive data win back campaign is set to be targeted at thes[e] for revenue growth a[n]d upgrade back to the Top 20 segment”. The attached slide is headed “DDOS Impact on Data Users and Total Spend: Poor Data Experience Impacting Other Revenue”. It only analysed the position across three months – July, August and September 2016. The analysis indicated that of the data subscribers in July 2016 who stopped using data in August and September, 60% left the network altogether (i.e., became lost subscribers) and there was a slow MoM decrease in spend for the others “as they slowly moved their spend to where they are using data”. The figures on this chart are something of a curiosity, because the average voice spend of 86,000 subscribers in July 2016 is $3.04. The average voice spend of those still on the network in August but no longer using data is higher than that - $5. The position in September is $4.53, still above the July figure.

In January 2017, the technical data shows no or negligible attack traffic making it through the Arbor APS or Cloud systems, and reaching the final line of defence in the form of the Huawei system. Mr Campbell has pointed to documents which he suggests evidence the effects of DDOS Attacks on 13 days. I accept that there were some effects on 18-19 and 30 January, and brief effects while the Arbor filters were fine-tuned. Beyond that, I am not persuaded that there were any significant effects during this period. The January 2017 Ops Review refers to the success of the mitigation strategy, although it continues to refer to “data fluctuations” caused by the DDOS Attacks as a “key challenge”.

In January 2017, the Liberian government imposed a tax on mobile phone usage of 1c per minute. While Orange Liberia absorbed that tax themselves, Lonestar sought to pass it on. The results of that decision were instant and dramatic. The Ops Review referred to a “huge subscriber shift, with a 32% decline in MTN RGS 1 between 15th to 31st" (i.e., over a one-day period). There was an 18% drop in voice revenue within 2 weeks, and a 36% reduction in voice minutes of use. An RGS 30 comparison (looking at subscribers who had not used the Lonestar network for 30 days) showed voice subscribers leaving Lonestar for Orange Liberia in similar proportions across all value segments – further confirmation that price mattered to HVCs as well as other customers. By contrast, Lonestar’s data business reaped immediate benefits from the launch of 4G/LTE, just as Orange Liberia had (see the figure at [72] above).

The DDOS Attacks came to an end in early February 2017. Large attacks continued up to 8 February, when they were largely mitigated by the defensive systems, with smaller attacks thereafter (including after Mr Kaye had been arrested on 22 February). Mr Campbell points to documents which he says evidence the effects of DDOS attacks on 6 days in the period up to and including 8 February. I accept that the setting of the filters on the Arbor systems did cause issues affecting some websites during this period, and that this is fairly characterised as a consequence of the DDOS Attacks generally. It is not suggested that the DDOS Attacks had any effects after 8 February.

The February Ops Review highlighted the success of the DDOS containment programme, and did not refer to the DDOS Attacks causing loss of revenue. It did, however, note the ongoing effects of the decision to pass on the tax, with a 28% decline in voice revenue, and loss of customers in similar proportions across all value segments. The Q1 2017 CEO Report said that the decision had caused “a mass exit of over 200,000 subscribers” and a 45% reduction in minutes of use against the previous quarter.

In September 2017, Lonestar prepared its budget for 2018. One slide in this document identified “key events and market” shifts in the left-hand column, and “impact on MTN Liberia’s Current State” in the right-hand column. It included the following entries:

It is striking that this document attributes the fall in voice revenue solely to DYO, it identifies the effect of the DDOS Attacks as loss of HVCs “due to poor data quality”, and attributes the loss of HVCs to Orange Liberia’s “clear lead on data”. Slide 19 in the same deck also stated “DDOS Attacks took HV customers away from Data” (and “DYO unconditionally discounted voice”). While there is a reference to “lost customer preference as primary SIM”, this is linked to the fact that certain products “had been designed to auto-renew and deduct balance”, and that “’Fear of Losing Balance’ has driven customers away from Higher Denomination recharges”. There are a number of references in the documents to this issue having a negative impact on revenue. It has nothing to do with the DDOS Attacks, but reflected the fact that “all digital products were designed to auto-renew causing customer complaints on credit depletion”.

In June 2018, Lonestar produced a timeline of the DDOS Attacks as follows:

This analysis is not entirely consistent with the conclusions I have drawn from the technical data and contemporary documents – the attacks of 6 and 7 February are not mentioned, and the level of attacks in October 2016 is overstated in respect of the period prior to 31 October. But in broad terms, the summary correctly captures the sequence of events: initial impacts in October, and again from July 2016, with a new level of intensity in November 2016, and full stability by February 2017.

That broad pattern is consistent with numerous other pieces of evidence:

A funding request prepared by Lonestar in October 2017 conveys a broadly similar message, as does Lonestar’s YTD Business Review and 5-Year Plan of June 2018.

The DDOS attacks ended in February 2017. On 22 February 2017, Mr Kaye was arrested by the NCA at Luton airport pursuant to an international arrest warrant concerning a number of alleged cyber-attacks. He was extradited to Germany on 2 March 2017 and charged with offences relating to a cyber-attack on Deutsche Telekom. He was interviewed by the Cologne Prosecutor, in the course of which he admitted that he was the person responsible for carrying out the DDOS Attacks on Lonestar, that he had done so at the request and direction of Mr Marziano and that Mr Marziano had introduced him to Mr Polani who had provided technical support and assistance as necessary.

A report produced by the Cologne Prosecutor records that a mobile phone found on Mr Kaye when he was arrested contained Mr Marziano’s telephone number and email, Mr Polani’s email, numerous messages between Mr Kaye and Mr Marziano concerning the DDOS Attacks, sent via SMS, WhatsApp and Facebook Messenger, and messages between Mr Kaye and Mr Polani on Threema which showed that Mr Polani was “in contact with Kaye on several occasions in order to check whether the attacks had been successful or to report on the impact in Liberia”.

In March 2017, the Liberian government withdrew the 1 cent per minute tax it had imposed in January 2017 (see [98] above).

On 28 July 2017, Mr Kaye pleaded guilty to the charges made against him by the Cologne Prosecutor and received a suspended sentence of 20 months’ imprisonment. The judgment of the court records Mr Kaye making a “full confession” that “he had intended to create a botnet in order to ultimately cause harm to the Liberian company” (i.e., Lonestar), the purpose of that statement being to suggest that he had not acted to harm Deutsche Telekom.

In August 2017, Mr Kaye was extradited back to the United Kingdom where he was charged with offences under the Computer Misuse Act 1990, including in relation to the DDOS Attacks. Mr Kaye initially pleaded not guilty, but he changed his plea and entered guilty pleas to two offences under the Computer Misuse Act 1990 and one offence under the Proceeds of Crime Act 2002, in relation to the DDOS Attacks. On 11 January 2019, he was sentenced to 32 months’ imprisonment.

In September 2019, the Liberian government imposed a floor cap on both voice and data services that effectively outlawed unlimited calling promotions such as $1-3 days and DYO.

It is common ground that Lonestar’s claims are governed by Liberian law. Liberia has a common law system, in which decisions of the Liberian Supreme Court constitute a source of law, alongside legislation.

Section 40 of the Liberian “General Construction Law” provides:

“Except as modified by laws now in force and those which may hereafter be enacted by the Liberian common law, the following shall be, when applicable, considered Liberian law:

(a)

the rules adopted for chancery proceedings in England, and

(b)

the common law and usages of the courts of England and of the United States of America, as set forth in case law and in Blackstone’s and Kent’s Commentaries and in other authoritative treatises and digests”.

This statute was referred to by the parties as the Reception Statute, although in contrast to some reception statutes (e.g. s.3 of the (Singapore) Application of English Law Act 1993), it was common ground that it does not provide for the incorporation of a body of law at a particular date, but “the common law ... as it stands at the time when those laws are adopted and applied in a particular case, and thus not necessarily the law as it stood at the time when the Reception Statute was enacted”. It was also common ground that the Reception Statute did not “require the Liberian Supreme Court to prefer United States common law principles to English common law principles, or vice-versa”, but that in practice “the Liberian Supreme Court looks more often and primarily to United States treatises, digests and case law rather than to English law treatises, digests and case law”. The frequency of recourse to the Reception Statute was in issue.

There were a number of disagreements between the Liberian law experts as to how the Reception Statute operated, which it is convenient to address at this stage of the judgment. In particular, Counsellor Padmore and Professor Banks argued that the Reception Statute did not “accord automatic status” to the common law of England and the United States, even if there was no Liberian statute or common law in force. Rather, they contend that the effect of the words “if applicable” was that it was only when the Liberian Supreme Court (as the only court capable of generating decisions with the status of binding precedents) reviewed and accepted the relevant English or US common law that these provisions became part of Liberian common law. Counsellor Musu-Scott’s evidence was that the Reception Statute “confirms and maintains the common law of England and of the United States as part of the law of Liberia” on any issue not covered by Liberian statute or the case law of the Supreme Court of Liberia.

As is often the case, the debate between the experts assumed a form in which each criticised an extreme version of the other’s contention. Thus Counsellor Musu-Scott suggested that Counsellor Padmore and Professor Banks were arguing for the position that only the Liberian Supreme Court could decide whether or not a particular rule of US or English common law should form part of Liberian law, in circumstances in which the jurisdiction of the Supreme Court was only appellate rather than original, and the cases of the lower courts which reached the Supreme Court on appeal would, on this theory, never raise issues of this kind because this would not be a source of law open to them. For their part, Counsellor Padmore and Professor Banks suggested that it was the inevitable consequence of Counsellor Musu-Scott’s theory that all principles of common law of England and Wales, and of all fifty of the United States and the federal jurisdiction, the contents of Blackstone, Kent and other “authoritative treatises and digests” were all automatically binding on a first instance judge, even though they might well conflict inter se.

I am satisfied that, as the Reception Statute now falls to be applied, the normative force of the common law as it has developed in England and Wales in Liberian court decisions is much attenuated. I cannot accept that it is binding in the sense that a first instance judge would be obliged to follow English law on an issue which Liberian statutes or case law had yet to address, not least because of the possibility for conflict between the various legal sources identified in s.40. I accept that English common law is given a higher status than, say, the decisions of German or Italian courts, and indeed formally at least than the decisions of common law jurisdictions such as India or Canada. However, the constraint which s.40 of the Reception Statute places on the law-making power of the judge is, in my view, very limited indeed. I am satisfied that English case law, for example, would have less normative force before a Liberian court than decisions of the European Court of Human Rights would have before an English court by virtue of s.2 of the Human Rights Act 1998. To the extent that it has any impact on the freedom of action of a Liberian judge when deciding the content of Liberian law, the judge would retain a “strong” rather than “weak” discretion. The language of Liberian case law reflects that, for example Quelo v Providence Concrete Works [1981] LRSC 29, 301, in which the Liberian Supreme Court held that when determining whether or not to apply some principle of foreign law under the Reception Statute, “we should weigh all the benefits and choose the blessings”.

I am also satisfied that, to the extent that the Reception Statute influenced the decision of the Liberian judge, it is to U.S. rather than English sources that the judge would principally look. That is not because the Reception Statute creates any formal hierarchy as between the two – it clearly does not – but because of the very close links between Liberia and the U.S.A. since Liberia’s foundation, the heavy influence which U.S. statutes have had for Liberia’s lawmakers, and the extent to which Liberian legal education has exposed its lawyers to U.S. rather than English influences. That reflects the position of all the experts in the joint memorandum, and the cases I was referred to which, with one exception (Miller v Parker [1982] LRSC 73 dealing, of all things, with the presumption that a conveyance into two or more names creates a joint tenancy), involved the application of principles of U.S. law.

It might be wondered why it would matter so much whether, in the field of civil liability for wrongs, a Liberian court, faced with a gap in its own law, would look to U.S. or English sources to fill that gap. The answer to that question leads to what, for me at least, was one of the great forensic mysteries in this case. As it is relevant to both the ways in which Lonestar puts its case (an action of damages for wrong under existing Liberian law, or the application of the English torts of lawful or unlawful means conspiracy or unlawful interference under the Reception Statute), I should address the issue at this stage.

Whether there can be tortious liability where someone, whether acting alone or with others, has caused the claimant loss by unlawful acts without those acts themselves being actionable at the suit of the claimant has proved a controversial topic under English law:

In its opening, Lonestar referred to certain U.S. materials exhibited by Mr Padmore, and stated:

“It is apparent from the materials which he himself exhibits that there is nothing in US common law which is in fact inconsistent with Lonestar’s case under English law. In particular, it is plain that U.S. law recognises a form of secondary liability for conspiracy to commit a tort and to exercise unlawful means”.

However, as Mr Singla KC accepted in closing, such evidence as there was in relation to the position under U.S. law supported a (majority) requirement that the unlawful means be actionable at the suit or the claimant (such that two of more persons who agree that one of them will commit a tort actionable at the suit of the victim can both be sued by the victim).

In the Particulars of Claim, Lonestar has advanced the following claims against the Defendants:

In addition to:

It will be apparent that none of these issues would arise to the extent that the Liberian Telecommunications Act 2007 (the 2007 Act) itself gave a civil cause of action against anyone who had suffered loss as a result of a breach of its provisions. However, while a breach of s.76 of the 2007 Act was pleaded as an unlawful means for the purposes of the two English “unlawful means” torts, and, implicitly as one basis for the claim under the action of damages for wrong, no civil claim for damages was advanced under s.80 of the 2007 Act.

Section 76 of the 2007 Act provides:

“(1)

No person shall:

(a)

fraudulently, maliciously, or with dishonest intent, use any telecommunications facility or obtain any telecommunications service without payment of a lawful charge thereof;

(b)

intentionally, without right and with dishonest intent, access the whole or any part of a telecommunications network or computer system by infringing security measures, with the intent of obtaining telecommunications or computer data;

(c)

intentionally, without right and with dishonest intent, intercept by technical means a transmission not intended for public reception of telecommunications or computer data to, from or within a telecommunications network or computer system;

(d)

intentionally, without right and with dishonest intent, damage, delete, deteriorate, alter or suppress telecommunications or computer data without right, where this results in harm to any other person;

(e)

intentionally, without right and with dishonest intent, interfere with the functioning of a telecommunications network or computer system by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing telecommunications or computer data;

(f)

intentionally, without right and with dishonest intent, possess, produce, sell, procure for use, import, distribute or otherwise make available a device, including a computer program, designed or adapted primarily for the purpose of committing any of the offences established in subsections (1) (a), (b), (c), (d) or (e); or a computer password, access code, or similar data by which the whole or any part of a telecommunications network or computer system is capable of being accessed with intent that it be used for the purpose of committing any of the offences established in subsections (1) (a), (b), (c), (d) or (e);

(g)

use, or cause or suffer to be used, any telecommunications network or telecommunications service for the purpose of disturbing, annoying, irritating, offending or harassing any person, including by means of a call with or without speech or other sounds, data or video images; or

(h)

wilfully damage any telecommunications network or related telecommunications facility.

(2)

Every person who acts in contravention of this Section commits an offence and is liable to the penalties prescribed in Section 77.”

Section 77 clearly contemplates that the s.76 offence can be committed both by natural persons and corporations (who can only act through natural persons), and that the employees of corporations can be punished for a corporation’s breach. It provides:

“(1)

Every person who contravenes Section 76 of this Act, and is found guilty of the same after being accorded due process of the law, and is guilty of the offence and liable:

(a)

in the case of a natural person, to a fine not exceeding one hundred thousand Liberian Dollars for a first offence and two hundred and fifty thousand Liberian Dollars for a subsequent offence;

(b)

in the case of a company or any person other than a natural person, to a fine not exceeding one million Liberian Dollars for a first offence and five million Liberian Dollars for a subsequent offence; or

(c)

in the case of a natural person who is an officer, employee or agent of a company and who is responsible for the contravention, breach or failure by the company, imprisonment for a Term to be decided in accordance with the New Penal Code of the Republic of Liberia.”

Section 80, headed “Civil Liability” provides:

“(1)

Subject to any limitation of liability imposed in accordance with this Act or any other act, a person who has sustained loss or damage as a result of any act or omission that is contrary to this Act, or contrary to any regulation, rule or order made under this Act may bring a civil action against any person who engaged in, directed, authorized, consented to or participated in the act or omission.

(2)

Any action brought pursuant to this Section shall be subject to the practices and procedures of the applicable court in such matters.”

A “person” is defined by s.2(1) of the 2007 Act as “a natural or other legally recognized person or entity, and includes a joint stock company, a limited liability company, a partnership, a sole proprietorship, a joint venture, or other form of entity whether incorporated or unincorporated.”

I now turn to the evidence on ss.76 and 80 of the 2007 Act.

Professor Banks in his first report of 13 August 2021 expressed the following views:

In his second report, Professor Banks expressed the view (which is not readily reconcilable with the view expressed in his first report) that “because the Liberia Telecommunications Act 2007 is a statute and does not fall within or has not been declared, either by the statute or by the courts, as constituting or to be an ‘action of damages for wrong’, but has its own cause of action (criminal and civil), it cannot be deemed to constitute an “action of damages for wrong””.

In his third report, Professor Banks said that the 2007 Act only imposed a liability on those who had “engaged in, directed, authorized, consented to or participated in the act or omission”, and no common law tort could be brought which imposed a liability for a breach of s.76 in circumstances in which it would not have arisen under s.80.

In his first report, Counsellor Padmore said that s.80 did not impose liability for an agreement to commit the s.76 offence, although he was careful to note that a person who did enter into such an agreement “may be liable for engaging in, directing, authorizing, consenting to or participating in an offence.” He said that there was no room for a civil liability in conspiracy for breaches of s.76.

Counsellor Padmore referred to the 2007 Act in passing in his second report, saying that there was no action for damages for wrong under the Liberian law, with the result that the issue of whether a breach of s.76 of the 2007 Act could constitute such a wrong did not arise.

In his third report, Counsellor Padmore essentially repeated the views he had expressed in his first report.

In her first report, Counsellor Musu-Scott noted that s.77 imposed penalties against the agents or employees of corporations for breaches of s.76, as well as the corporations themselves.

In her second report, Counsellor Musu-Scott expressed the view that a breach of s.76 of the 2007 Act could provide the basis for an action of damages for wrong, pointing to various cases in which the breach of a statute had been held to ground such an action.

In her third report, Counsellor Musu-Scott stated that she did not accept that s.80 prevented the Liberian courts from recognising common law liability for conspiracy for breaches of s.76, or that a breach of s.76 could not form the basis of an action of damages for wrong, pointing to other cases in which she said that breaches of Liberian statutes had formed the basis for a claim of this type. She noted (fairly in my assessment) the change between Professor Banks’ view on this issue between his first and second reports.

The Joint Memorandum suggested that the experts were agreed as to what had to be proved to establish a breach of s.76 of the 2007 Act, on the basis that the Act was clear. As to s.80:

As I have explained, Professor Banks did not give evidence at trial. The 2007 Act received very little attention in cross-examination. Counsellor Musu-Scott was not asked about it. It was suggested to Counsellor Padmore that s.80 did not address liability on the basis of agreement (which he accepted) and that this showed s.80 was not an exhaustive code. In response to that last suggestion, he replied:

“Section 80. I don’t think that the entire issue relates to the Telecommunications Act. That is (inaudible) my point. The Telecommunications Act is a Liberian statute that says, here is the law in Liberia, and that is it”.

While that does not appear to be an answer to the question asked, Mr Singla KC was evidently happy with it, because he responded “exactly”.

I have been left with the distinct impression that both Lonestar and Orange Liberia were keen to say as little as possible about s.80. While I entirely understand Mr Kitchener KC’s forensic reluctance, both because s.80 has not been pleaded and because it does not appear helpful to this part of his case, I found the reasons for Mr Singla KC’s reluctance more difficult to discern. However, judges see only a very small part of the forensic landscape which the parties’ legal representatives must survey in full, and then plot how to navigate. The end result is:

I should record, however, that the position in which I find myself is, from the peculiarly personal perspective of the judgment writer, an uncomfortable and artificial one, in which there are debates as to whether particular forms of claim can be advanced against the background of s.80 and/or as to whether any requirement of direct actionability, if there is one, is met, without any exploration of that key provision.

The early Liberian legal sources provided to me referring to an action of damages for wrong were the Constitution and Laws of Maryland in Liberia (1837), published by the Maryland State Colonization Society, and “the Statute Laws of the Republic of Liberia, Carefully Compiled from the Laws of the Commonwealth with the Declaration of Independence” published “by Authority” in Monrovia in 1856. I am told that this last book is referred to by Liberian lawyers as the “Old Blue Book”. Title II (“Of Remedies”), Chapter 1 (“Of Actions”) of both works are to the following effect:

There is much here to ignite the interests of the legal historian, and no doubt to dull the senses of those fortunate enough to spend their salad days studying more glamorous fare. Professor David Ibbetson noted that these works appeared to have adopted the broad structure of the law of civil procedure in Maryland as detailed in Treatise on the Course of Proceedings in the Common Law Courts of the State of Maryland (1839). Chapter II (“of the Remedies used in Maryland”), 45-6 observes that there are five causes of action for wrongs in Maryland – replevin, ejectment, dower “and the remaining two, case, and trespass”. Trespass lay for direct interference with the person or with real or personal property (or the possession thereof), and case “whenever actual force is impossible”.

This division is consistent with the distinction which emerged in English (and was transplanted to American) tort law between trespass (which had at its core the idea of forcible wrongdoing or invasive interferences with the claimant or their property) and trespass on the case (which did not, and as a result “had an almost unlimited potential to expand into other areas”: David Ibbetson, A Historical Introduction to the Law of Obligations, 56: Ibbetson). However, as further transplanted into Liberia, the action of damages for wrong appears to have subsumed both trespass and case into a single broad category of tortious claims.

So far as the development of English tort law is concerned (and at the risk of it being suggested by Professor Ibbetson – not for the first time – that I have overly simplified a set of complex historical developments), the position appears to be as follows:

As I have indicated, from the creation of the Republic, Liberian tort law reflected the development at [148(iii)] trespass having been assumed within what became the even larger residuary category of case (the action of damages for wrong). The issue between the experts is whether, as it now falls to be applied:

It is Counsellor Musu-Scott’s opinion that there remains a claim of “action of damages for wrong” under Liberian law which does not require the claimant to satisfy the “particular rules” of causes of action such as negligence, nuisance, conversion etc. Her evidence is:

“As a matter of Liberian law, the action of damages for wrong is a well-known, common law-based cause of action for non-contractual wrongs … [A]n action of damages for wrong requires proof of two elements: wrongful conduct by a defendant, which results in injury or loss. No particular criteria are prescribed in the case law of the Liberian Supreme Court in relation to whether conduct is, or is not, ‘wrongful’ (and for the avoidance of doubt, it is not necessary for the relevant wrongful conduct to be in breach of a statute). Instead, when determining whether conduct qualifies as ‘wrongful’, the Liberian courts will … generally take a broad and fact-sensitive approach”.

On this account, the action would indeed embrace “a miscellaneous ragbag of situations in which plaintiffs had succeeded in convincing the courts that they had suffered loss for which they ought to be compensated”.

Counsellor Padmore, by contrast, says that from its inception, the action of damages for wrong was simply a form of action, and it was necessary for the claimant to plead one of a number of recognised causes of action. He refers to a specimen wording in an appendix to the Old Blue Book, giving a “form of a complaint” for an action against someone who had come onto the claimant’s land and cut down and carried away ten trees. Title II, Chapter IV of the Old Blue Book – “Of the Complaint” – does prescribe certain matters which a complaint must include in their pleading, including that “the complaint in an action of damages shall state the injury complained of, and the fact that the plaintiff has sustained damages thereby”. It also specifies certain requirements for complaints of damages to real property, personal property, personal injury or domestic relations. However, it says nothing about these being exhaustive and a chapter dealing with the contents of a complaint (where reference to the appendix first appears) would not be an obvious place to look for an exhaustive definition of the types of tort claim which can be brought. The Appendix itself says:

“The preceding forms of complaints are only models or specimens and may be changed or modified, or new ones invented on similar principles, to be used in cases not herein provided for.”

Further, the existence of a residuary category for tort claims in Liberia in the form of the action of damages for wrong is supported by s.165(c) of the Civil Procedure Law 1956, describing “[a]ctions to recover damages for wrong” as “an action which lies for every injury for which there is no other remedy” (and the Joint Memorandum quotes a similar statement by the Supreme Court of Liberia in King v Williams (1916) 2 LLLR 219, 221).

On that basis alone, therefore, I have concluded that Counsellor Padmore’s evidence that Liberian law only ever recognised specific torts dealing with a delineated set of wrongful acts is not correct. Having reached that conclusion on the basis of the cited terms of the Old Blue Book (the only source Counsellor Padmore relied upon), I would simply note the entirely general terms of other sections of the Old Blue Book which were not put in evidence, in Book I, “Of Legal Principles and Rules”, which are wholly inconsistent with there being an (unidentified and) exhaustive list of individual torts at that stage in Liberia’s legal history:

Those passages are in very similar terms to a document which was in evidence, an “Abstract of Legal Principles and Rules” dated January 1841 which describes the principles for liability for wrong in similarly general terms (Title I sections 1 to 6 and 54).

Counsellor Padmore was on surer ground when noting that claimants were frequently non-suited if they had pursued their claim using the wrong form of action. One of the cases he referred to, Cavalla River Company v ES Prince Pepple [1934] LRSC 5, involved a case in which the form of action - “action of damages to personal property” - had wrongly been used to bring a claim for breach of contract to recover an amount of money deposited with the defendant and repayable on demand. The claim was dismissed for that reason.

Difficulties of that kind were addressed by section 1.3 of the Liberian Civil Procedure Act 1972 (the 1972 Act) which provided as follows:

“1.1.

Application of Civil Procedure Law.

The Civil Procedure Law shall govern the procedure in all civil actions and special proceedings before all judges and in all courts in the judicial branch of the Government, except where the procedure is regulated by inconsistent statutes or rules adopted in conformity therewith. Acts required by provisions of this title to be done by clerks of court may be done by a justice of the peace or stipendiary magistrate in applying those provisions to courts not of record.

1.2.

Actions and special proceedings.

1.

Prosecution as action. Any independent application to a court for relief shall be prosecuted in the form of an action, except where prosecution in the form of a special proceeding is authorized. Except where otherwise required by statute or rule of court, procedure in special proceedings shall be the same as in actions.

…

1.3.

One form of civil action.

There is only one form of civil action. The distinction between actions at law and suits in equity, and the form of those actions and suits heretofore existing, are abolished.”

I accept that the 1972 Act made significant changes to the procedural law of Liberia, and reduced the risk of a complainant with a good claim finding that claim dismissed because of the particular document used to assert it. In Kamara v Wolloh [1981] LRSC 15, for example, an attempt to dismiss a claim because it had been issued as summary proceedings, when it was not, failed because of the 1972 Act. However, the suggestion that the 1972 Act amended the substantive tort law of Liberia, such that the principles which determined what matters could be the subject of a claim in tort were changed, is a much more challenging assertion. Counsellor Padmore’s opinion was as follows:

“In the place of the historical practice of pleading causes of action within the constraints of the various forms of action, the modern practice is to plead individual causes of action (e.g. negligence, libel, etc) using the ‘one form of civil action’ that became applicable in Liberia after 1972. The new procedure is confirmed, for example, in the sample pleadings in Appendix 1 to the Liberian Civil Procedure Law 1972, which include sample pleadings in an ‘action for breach of contract’ (Form 3), negligence (Form 8), an ‘action for damages for assault and battery …

Liberian law has thus never recognized a cause of action called the ‘action for damages for wrong’. It was historically a form of action which a plaintiff could use to bring causes of action recognized by Liberian law, but it was abolished in or before 1972. Although parties’ pleadings and decided cases after 1972 often continue to refer to the old ‘action for damages for wrong’, this is anachronistic and a holdover from past practice. As I have said, it would not even be correct as a matter of historical practice prior to 1972 to refer to the ‘action for damages for wrongs’ as a cause of action recognized by Liberian law because it never has been.”

On this issue of the effect of the 1972 Act, I prefer the evidence of Counsellor Musu-Scott for the following reasons.

First, as I have stated, the suggestion that there was a closed category of tort causes of action before 1972 is not supported by the passages in the Old Blue Book on which Counsellor Padmore relied, nor its 1837 predecessor, nor did he point to any other source from which I could identify what that closed category comprised.

Second, the 1972 Act was a procedural reform, but I have seen nothing to suggest that it limited the factual circumstances in which a tortious remedy would be available for loss caused by unlawful conduct. When I asked Counsellor Padmore whether, following the passing of the 1972 Act, there was any conduct which would previously have been actionable in tort which ceased to be so, he answered (very fairly) “that is a very good question … I’m afraid I can’t answer it right now”, although he did accept my suggestion that “it would be quite an odd thing for a procedural statute to do.” It is very difficult to see how the 1972 Act changed what sets of facts could be the subject of a claim in tort, as opposed to the means by which such a claim might be pursued. The 1972 Act does not purport to address anything other than matters of procedure (including, for that purpose, limitation which has a hybrid substantive and procedural character).

Nor did the specimen pleadings at the end of the 1972 Act have that effect (any more than their predecessors in the appendix to the Old Blue Book). Section 9.3, addressing “Form of pleadings”, provides that “pleading forms, contained in the appendix of forms, are sufficient under the requirements of this title and are illustrative of the degree of particularity required.”

Third, I found the reaction of Professor Banks – a former Associate Justice of the Supreme Court of Liberia – to this suggestion striking. He said that “an examination of cases decided by the Supreme Court clearly demonstrates overwhelmingly the existence in the Liberian jurisdiction of a cause of action denominated ‘action of damages for wrong’”. He denied that this was simply a form of pleading, suggesting that Counsellor Padmore’s view “would bring into question the legitimacy or legality of all of the cases of action of damages for wrong”. I am unable to accept Orange Liberia’s view that the difference between Counsellor Padmore and Professor Banks on this issue was essentially terminological. It is clear that Professor Banks saw the action of damages for wrong as specific to Liberia, and a distinct feature of the Liberian legal landscape in contrast to the position in England and Wales and the U.S.A.

Finally, the way in which Liberian courts have continued to reason in the cases to which I have been referred is inconsistent with Counsellor Padmore’s analysis. F.W. Maitland’s famous observation that “the forms of action we have buried, but they still rule us from the grave” (The Forms of Action at Common Law (1909), 1) has proved particularly true in Liberia. While it is possible to analyse the facts of many of these cases, and show that they include averments which would meet the requirements of particular torts, that is not how they are reasoned:

Having concluded that the current state of Liberian law does not comprise an exhaustive list of nominate or specific torts of the kind now recognised in US and English law, but that it retains, through the action of damages for wrong, scope for some kinds of residual claims outside of those categories, the question which then arises is whether the wrongs relied upon here – breaches of the UK statute and the 2007 Act – satisfy the requirement of a “wrongful act” for this purpose. I remain unclear as to the type of act or omission which can constitute a wrong for the purpose of the action of damages for wrong, perhaps because there is no definition, simply a series of case-by-case responses. Counsellor Musu-Scott said that “no particular criteria are prescribed in the case law of the Liberian Supreme Court” and the courts “generally take a broad and fact-sensitive approach”. Professor Banks, who shared Counsellor Musu-Scott’s analysis that an action of damages for wrong survived as a substantive claim under Liberian law, suggested that what was required was “the commission of an act (whether intentional or unintentional, the outcome of criminal or civil act, in contract or in tort, negligence or otherwise) which has violated the claimant’s right”.

I am not persuaded that the category of wrongful act is anything like as broad or open-ended as Counsellor Musu-Scott suggests. However, it is clear from the City Builders and Kollie cases that, in principle at least, breach of a duty imposed by a Liberian statute, or the interference with an interest legally protected by a statute, can provide the necessary wrongful act for the purposes of an action of damages for wrong. In this case, I am satisfied that, subject to the issue of whether s.80 of the 2007 Act precludes an alternative remedy, wrongful interference with Lonestar’s telecommunications network in breach of s.76 of the 2007 Act is sufficient. The clear terms of s.76 both identify a telecommunications network as a legally protected interest, and render unjustified interference with such a network unlawful. Indeed, Professor Banks’ first report accepted this in terms:

“The Telecommunications Act 2007 does not lay out a special procedure. However, in respect of damages suffered by a party on account of the violations, the court would deem the violations to be a wrong committed against the victim, and as such would allow the victim to bring an action of damages for wrong or to even characterize the action as simply one of damages …

Where the unlawful or wrongful act results in injury or damage to a third party … the Liberian courts could consider the act not only a violation of the statute but also a wrongful act perpetrated against the third party ...

The conduct complained of may be one in violation of a statute with resulting damage to the complainant …. All of these are deemed and treated as wrongful, and hence the Liberian court’s acceptance of the action of damages for wrong …

I am of the opinion, and as has been the practice in civil actions which have grown out of a statutory prohibition, a party may rely on the common law concept of damages for wrong or simply action of damages which is recognized under Liberian law. Under Liberian law, the Liberian courts would not treat or characterize the action as a breach of a statutory duty. Such characterization would only be given to the action if the Liberia Telecommunications Authority was the complainant and was seeking to hold the violator accountable for the violation of the statutory duty or to ensure compliance with the Act”.

These passages appeared in a report produced when Lonestar was only advancing claims under the English law torts of lawful and unlawful means conspiracy, and unlawful interference, their purpose being to show that, while Liberian law had a substantive claim (the action of damages for wrong) with elements of these English torts, the torts themselves were not and would not be recognised as part of Liberian law. It is right to acknowledge that in his subsequent reports, and his contribution to the Joint Memorandum, all produced after Lonestar had advanced a claim in reliance on the action of damages for wrong, Professor Banks provides an apparently different opinion:

“Because the Liberia Telecommunications Act 2007 is a statute and does not fall within or has not been declared, either by the statute or by the courts, as constituting or to be an ‘action of damages for wrong’ but has its own cause of action (criminal and civil) it cannot be deemed to constitute an action of damages for wrong’.

Where a complainant claims that a common law tort was committed against it and relies on the breach of a statute which vests in a complainant a right to civil action, but is restrictive as to elements which must be present for the complainant to claim damages against the defendant, liability will not attach if any one or more of the elements or conditions stated in Section 80 of the Telecommunications Act 2007 is not present.”

I deal with the specific issue about the position when an action of damages for wrong would be inconsistent with s.80 below. If Professor Banks was seeking to raise a wider issue in his second and subsequent reports, he neither acknowledged the change from his first report, nor offered any explanation for it, and the resultant position would be very difficult to reconcile with his general description of the action of damages for wrong in his first report, which he apparently stands by. I am satisfied that this is one of those many occasions when first thoughts were best thoughts, the opinion in the first report being particularly valuable because it was given at a time when the point had yet to crystallise as a dispute in the litigation.

By contrast, I was not persuaded on the evidence that breach of the (UK) Computer Misuse Act 1990 would suffice. Liberia has passed its own legislation addressing the “mischief” which the DDOS Attacks constituted. If, for any reason, the 2007 Act was not capable of supplying the wrongful act necessary for an action of damages for wrong, then I am not persuaded Liberia would look to legislation from a foreign legislature to fill this gap. In this regard, I found Counsellor Padmore’s evidence persuasive:

“Liberia is very jealous, perhaps like every - maybe not every, but certainly that one poor country, that has now existed for about 200 years in a sea of colonial [colonised] by very large and powerful European countries. Liberia has been very jealous to guard its sovereignty. It is a poor country and it is very proud of that sovereignty. I find it very difficult to think that Liberian courts would ever, under any circumstances, incorporate a foreign statute as a basis for liability in Liberia.”

That leaves over, however, the issue of whether the existence of s.80 precludes a claim for an action of damages for wrong based on an unlawful act constituted by a breach of s.76 of the 2007 Act.

I have little difficulty accepting, as a matter of principle, that if the Liberian legislature had stipulated certain limits on the right of civil recovery premised on a breach of a particular legislative obligation, then it is highly unlikely that a Liberian court would permit an action of damages in wider terms in respect of that same breach. However, leaving aside the issue of vicarious liability to which I will return, it remains wholly unclear to me why it is suggested that there would be any conflict between the 2007 Act and the action of damages for wrong in this case. I was left with the distinct impression that the issue of conflict with s.80 was a theoretical rather than practical obstacle to Lonestar’s claim.

The wording of the statute is particularly wide, providing for the civil liability of “any person who engaged in, directed, authorized, consented to or participated in” the relevant acts. The experts identified no special rule of construction of the 2007 Act, beyond the clear effect of the language used.

Counsellor Padmore expressed the view that “Section 80 does not include civil liability on the basis of an agreement to commit an offence”, but was always careful to qualify that language by stating “such a person” (viz someone who has entered into an agreement) “may be liable for engaging in, directing, authorizing, consenting to or participating in an offence”. Lonestar’s pleaded case (which, as I explain below, is substantiated on the facts) is that Mr Marziano commissioned Mr Kaye to carry out the attacks, paid him to do so, that Mr Marziano, Mr Polani and Mr Kaye planned and implemented them together and that Mr Marziano and Mr Polani provided reports on their effectiveness. There is simply no real world in which that conduct would fall outside the broad scope of s.80.

Nor is there anything to suggest that the “manner of enforcement” of s.76, from a civil perspective, would differ as between an action brought under s.80 and an action of damages for wrong. Indeed s.80 expressly refers to any claim under it being “subject to the practices and procedures of the applicable court in such matters”, and, as I have noted, Professor Banks’ initial and unvarnished view was that this could involve an action of damages for wrong.

In the absence of such a conflict being established, I am not persuaded that the existence of s.80 precludes an action of damages for wrong premised on a breach of s.76 of the 2007 Act. Both Counsellor Musu-Scott and Professor Banks (in his first report) were of the view that it did not. Indeed, it is not clear that Counsellor Padmore was saying anything more than that there could be no action of damages for wrong based on a pure agreement to commit the s.76 offence, and nothing more, because s.80 did not provide for liability on this basis. But that is not this case.

I was not persuaded that the Liberian courts would have adopted any of these three English torts under the Reception Statute. As I have indicated, to the extent that the Liberian courts do look to other common law jurisdictions, I am satisfied that it has become the overwhelming practice for them to look to U.S. rather than English jurisprudence. If there was no Liberian law to such effect, I was not persuaded that the Liberian courts would have been willing to embrace a tort of lawful means conspiracy (a distinct oddity in the modern world), or torts which gave causes of action for unlawful acts to those who did not acquire their own cause of action against the primary wrongdoer in respect of that unlawful act.

In any event, had it been necessary to reach this stage of the analysis, it would have followed that although Liberia had passed legislation specifically criminalising conduct of the type in issue in these proceedings through the 2007 Act, that conduct was only civilly actionable under s.80 (as to which no claim is pleaded) or in circumstances which were not satisfied in this case. To my mind, it is simply not realistic to imagine that the Liberian courts would “receive” a new common law tort or torts from other jurisdictions, simply for the purpose of providing a wider scope of civil liability for breach of the 2007 Act than the Liberian legislature had seen fit to provide.

The second principal dispute in relation to Liberian law concerned the circumstances in which an employer or principal could be vicariously liable for the acts of a servant or agent, a question which raised a number of sub-issues:

The suggestion that, as a matter of Liberian law, an employer or principal cannot be vicariously liable for intentional acts of wrongdoing by their servants or agents was traced by Counsellor Padmore to Woodin & Company v Gibson [1923] LRSC 1. The case involved an allegedly slanderous statement made by Cooper (who was alleged to be acting as Woodin’s agent) to the effect that Gibson (a postmaster) had been supressing the defendant’s letters in his official capacity, and an allegedly libellous statement made about Gibson on a subsequent occasion to the Postmaster General of the Republic of Liberia. In response to the slander claim, Woodin alleged that there was no claim “as the alleged false, scandalous and defamatory words were spoken … outside of [Cooper’s] authority and capacity as agent aforesaid, and can not legally be traced to the defendant, he was not acting at that particular time in the capacity of agent for the defendant”.

In addressing the slander claim, the Court held:

“Generally a principal is not liable for the wilful acts or misdeeds of his agent whereby damage is done to another unless he originally commanded, or subsequently assented to, the act. He is liable to third persons for the misfeasance or negligence of the agent, in the course of the agency; but the responsibility of the principal is limited to cases properly in the scope of the agency. (Story on Agency, 454.) The record clearly shows that the conversation during which Mathew Joseph Cooper, the defendants' former agent, is alleged to have uttered the libellous words set out in plaintiff's complaint, took place at the post office in Harper, but there was nothing to show whether the letters referred to were the letters of the said Mathew Joseph Cooper or those of his principal W. D. Woodin & Co., the defendant in this case. In any case it does not clearly appear that the said Mathew Joseph Cooper was acting in the scope of his agency at the time. To make a corporation or company responsible for every unauthorized act of its agent would work incalculable harm.”

There are a number of noteworthy features of this passage:

Woodin, therefore, is at best a rather uncertain foundation for a principle that there is no vicarious liability for acts of intentional wrongdoing under Liberian law. Orange Liberia also relies on the decision in Harris v Cavalla Rubber [2013] LRSC 9. That was another case of slander, the defendant’s security agents having stopped the claimant and accused him of stealing the defendant’s rubber. The Supreme Court cited Woodin, stating “it is generally held that the principal is not customarily held liable for the wilful acts of his agent which conduct results to the injury of another”, but said that the case before them “presented an exception” because the agent’s act had subsequently been assented to. It is right, therefore, that the Supreme Court accepted the existence of a general rule to the effect contended for by Orange Liberia, without re-visiting the issue, albeit that they did not need to because the case would not have fallen foul of such a rule.

However, there are a number of cases in which awards of compensatory damages have been made against companies in respect of intentional tortious conduct by their employees – for example Firestone v Kollie [2012] LRSC 14, In Re Honourable Prince Quaye Toe [1999] LRSC 45 and Inter-Con Security System Inc v Bartuah 6 July 2001 (all involving physical assaults). Given Orange Liberia’s reference to Woodin as a decision which has “stood for more than one hundred years”, it is important to note that it does not appear to have cast a particularly long shadow in the Liberian courts.

There were two further cases to which I was referred.

The first was In Re: Grievance and Ethics Committee Investigation Report on Complaint by Mr Augustin T Iriekpen against Counsellor Samuel Pearson 8 February 2021. The case involved professional misconduct proceedings against the lawyer for the Monrovia City Corporation. The claimant said that three of his vehicles had been towed away by the corporation’s contractor (of which the defendant was also a director). When he contacted the corporation’s lawyer to ask for their return, the defendant demanded as condition of ordering their release that two cars be given to him personally. The defendant sold one car, gave another away as a graduation gift, and used the third himself. When reported to his professional body, the defendant took the point that he had been acting as the corporation’s agent and suggested that they were the proper defendant. Not surprisingly, the committee had no truck with that answer (and it is impossible to see how this could have relieved the defendant of personal liability on the facts of the case). The committee said the defendant’s actions did not “fall within the scope of authority of a lawyer for which he should be shielded by the Monrovia City Council”. The link between the defendant’s conduct, and his role as the corporation’s legal adviser, was tenuous indeed. The decision appears to rest on the finding of the scope of the defendant’s authority, rather than any principle of law.

The second, and more important, case is Guaranty Trust Bank v Freeman 23 September 2022, a decision handed down after the experts reports had been exchanged (and resulting in brief fourth reports from Counsellors Musu-Scott and Padmore). An employee of a bank was summoned to the managing director’s office for their regular meeting, where he was assaulted (the managing director throwing a calculator at him). He sued the managing director and the bank, arguing that “the negligence of the employee is imputable to the employer if the relationship of princip[al]-agent exists at the time of and in respect of the transaction out of which the specific injury arose”. It is clear from the case that the bank argued that it could not be liable for “an unlawful action of any of its employees while acting totally outside of his legitimate scope of authority”, and it also quoted (without express attribution) the passage in Woodin set out at [179] above. The Supreme Court held that the wrongful act had been committed on the bank’s premises at a meeting arranged in accordance with the scope of duty and authority of the managing director, and that the bank was vicariously liable for the assault.

The decision in Guaranty Trust is important. The court clearly had Woodin (which was cited to it) in mind, but reached a decision which was inconsistent with the “general rule” for which I am asked to treat Woodin as authority. The court cited U.S. commentaries in support of its decision which do not themselves reflect the limitation in the doctrine of vicarious liability for which Orange Liberia contends. Counsellor Padmore sought to suggest that the decision made a limited in-road into Woodin – either because the assault took place on the bank’s premises or because it was an assault by a fellow employee. That latter justification, if correct, would involve Liberian law following the reverse trajectory from English and US law, in which there was initially no vicarious liability for employee-on-employee torts (the “common employment” rule). However, Counsellor Padmore accepted that neither point of distinction is relied upon by the Supreme Court in its judgment. The case provides a useful litmus test of Counsellors Musu-Scott’s and Padmore’s prior opinions on the scope of vicarious liability under Liberian law, and provides strong support for the views of the former on an issue on which judicial policy is particularly important. Taken with the wholly uncertain basis for Woodin and the cases which have ignored the supposed limitation for which Orange Liberia contends, Guaranty Trust establishes, to my satisfaction, that provided deliberate wrongdoing is undertaken by the employee within the scope of their employment, there is no rule of Liberian law which prevents the employer from being vicariously liable. The suggestion that it would have required an express reference to and overruling of Woodin for the Supreme Court to have formulated the law in these terms attributes too great a weight to Woodin, and assumes what I am satisfied is an over-idealised characterisation of the Liberian judicial system in practical operation.

The effect of this conclusion is that the law of Liberia on the issue of vicarious liability is, in this respect, broadly consistent with that of the two jurisdictions from which its common law heritage is derived. Counsellor Padmore suggested that what on his evidence was a different principle in Liberia reflected “Liberia’s domestic policy to encourage intern[ational] parties to incorporate offshore corporations under Liberian law”, and to “favor business interests and to avoid imposing broad liability on businesses, hence the adoption of Delaware corporations law as Liberian law in most respects”. Whether that policy is reflected in a 1922 decision about the Liberian postal service is, in my respectful view, debateable. It was not suggested that Delaware law recognised such a limitation on the doctrine of vicarious liability, and I suspect that the reality of the attitude of the Liberian courts is better caught by Counsellor Padmore’s observation that the bank in Guaranty Trust was always going to be found liable for the tort of its foreign national managing director against a local (“the Supreme Court of Liberia would never have failed to hold the bank responsible in those circumstances”), and that his advice to one of Liberia’s largest international corporations was “settle your cases and do your very best to come up with an arbitration”, that company never having prevailed in the Supreme Court or at any other level in Liberia, to his knowledge.

No separate issue in respect of vicarious liability under the 2007 Act was crystallised at trial. The issue was considered by Professor Banks. The effect of his opinion is that the same test of vicarious liability applies to s.76 and s.80 as applies at common law, noting the “all the violations for which the perpetrators are deemed to have committed a crime under section 76 are grounded in intentional misconduct”, but accepting nonetheless that “the agent must have been acting within the scope of his employment in order for the principal to be held vicariously liable”. In relation to s.80, he advised:

“Sub-section (2) of Section 80 … states that ‘any action brought pursuant to this Section shall be subject to the practices and procedures of the applicable court in such matters’. The practices and procedures include the measures for holding a person vicariously liable … which have been espoused by the Supreme Court and which are adhered to by the lower courts before whom the actions are instituted”.

I have concluded that there is no intentional tort exception to the vicarious liability doctrine at Liberian common law. However, I would note that there appears even less scope for such a limitation under the 2007 Act. Section s.76 of the 2007 Act creates various offences dependent on wrongful or dishonest intent. As Counsellor Musu-Scott pointed out in her first report, companies can commit these offences (and therefore, necessarily, have the dishonest intent of natural persons attributed to them for the purpose of criminal liability): see not simply the definition of “person” but also s.77(1)(b)), and the statute expressly provides for the independent criminal liability of natural persons who are officers, employees or agents of such a company and are responsible for the breach. Vicarious liability for the intentional acts of officers, employees or agents is “baked in” to the criminal offences created by the 2007 Act. There is nothing in s.80, dealing with the position where acts contrary to the 2007 Act have caused loss, to suggest it applies to a narrower class of persons than those who can commit the s.76 offences.

It is common ground that there is no fixed definition of the concept of “employee” under Liberian law, with the expression taking its meaning from the context in which it appears, and turning on “the facts and circumstances of a particular case” (Firestone Plantation Co v Burge [1985] LRSC 20). Many of the Liberian cases in which the issue has been considered are “inwards-looking” cases, concerning the rights of the putative employee and employer inter se, and in particular those which are intended to provide certain forms of statutory protection to employees. However, the issues arising in this case are essentially “outward-looking”, determining when the victims of the putative employee’s torts can recover from the putative employer. Legal questions of this type raise policy considerations of ensuring that enterprises bear the adverse consequences (and the costs of those consequences) which their activities bring about (factors referred to in the American Digest, Corpus Juris Secundum, ¶206 cited by the Liberian Supreme Court in Guaranty Trust Bank (Liberia) Ltd v Freeman 23 September 2022). That is a very different policy consideration from that animating statutes intended to protect the rights of those who are, generally, in a subordinate bargaining position, and who benefit from certain statutory protections both in relation to their conditions of work, their levels of remuneration and when and how the relevant relationship may be brought to an end.

The first legal issue which arises is the position of seconded employees – where someone under an employment contract with company X is seconded by company X to company Y to provide the services of an employee for company Y, and commits a tort in the context of providing those services. The only case dealing with seconded employees to which I was referred was International Bank of Monrovia v Ochoada [2013] LRSC 17. In that case, there was what appears to be a relatively common arrangement for expatriates working in Liberia, in which the claimant had an employment contract with an offshore company, ADCON, but acted as the general manager of IB/ITC, a Liberian bank. When he was dismissed from his position, he brought a claim for wrongful dismissal against IB/ITC. The Supreme Court held that the written contract of employment between the claimant and ADCON was the best evidence of who his employer was. This was also an “inwards-looking” case, and the decision of the Supreme Court was not reached on the basis of a legal ruling (that the written contract of employment was legally determinative) but on the basis of the balance of the evidence, on which the first-tier tribunal’s conclusions were determinative and, also, correct. However, the Supreme Court judgment did hold that the claimant could only have been employed by one of ADCON or IB/ITC.

Given its context (an “inwards-looking” dispute) and the basis on which it was reasoned (the limited right of the court below to review findings of fact and what the balance of the evidence established), I have not found Ochoada particularly enlightening on the issues before me. It is clear under Liberian law that there can be vicarious liability for the acts of natural persons even if they are not parties to contracts of employment with the defendant. In Kantara Malian Kamara v APM Terminals Ltd 29 September 2017, in which the terminal (APM) had hired a firm of stevedores (Camer), whose crane driver had negligently dropped cargo on the claimant’s trucks, APM was held vicariously liable for the negligent operation of the crane under the doctrine of respondeat superior on the basis that it had retained (or, as it was put, “employed”) Camer to discharge the cargo. Camer was also held liable.

This suggests that the question of whether the doctrine of vicarious liability is engaged under Liberian law does not depend upon the existence of a contract of employment alone. Indeed, were matters otherwise, it would be all to easy for corporations in Liberia to avoid any liability for tortious acts arising from their operations, particularly when these arose from the actions of senior management, by “off-shoring” the employment contract: something which appears to be a prevalent business practice there. The APM case also shows that two defendants can be vicariously liable for the same tortious act (in that case APM and Camer), something which Counsellor Padmore accepted was conceptually possible under Liberian law.

Finally, there is the question of when a tortious act will fall within the scope of an employee’s employment. Once again, I was not referred to any Liberian legal source expressly addressing this issue. Counsellor Musu-Scott suggested that “all that is usually required for the conduct to be within the scope of the employee’s employment is a connection between the wrongdoing and their employment or role”, and that the Liberian courts adopted “a broad (and generally inclusive) approach to the question of whether an individual has acted outside the scope of their employment or role”. Counsellor Padmore suggested that Liberian courts would look at section 7.07(2) of the Restatement (Third) of the Law of Agency¸ which provides that “an employee’s act is not within the scope of employment when it occurs within an independent course of conduct not intended by the employee to serve any purpose of the employer”.

I am sure that both of these elements – connection between the wrongdoing and the role, and the employee’s purpose – are relevant to the enquiry. On the basis of the authorities placed before me, I am satisfied that an extreme and criminal pursuit of the employee’s duties can nonetheless fall within the scope of employment (as seen in the cases where employers have been held liable for vicious criminal assaults by a bank executive, security guards or public officials). I am also satisfied that the mere fact that the employees are acting for their own nefarious purposes does not necessarily preclude vicarious liability in a case in which their position as employees provides the means and opportunity for them to advantage themselves. In NPA v Dougbah 5 February 2016, a container was held by the port authority for alleged non-payment of fees. Before selling the contents at what was meant to be a public auction, the National Port Authority was required to notify the owner. The claimant’s goods were alleged to have been sold by NPA staff who manipulated procedures and breached protocols “for their own personal aggrandizement”. NPA’s managing director admitted that some staff had manipulated the system, and had been dismissed. NPA was held liable. Finally, I note that in Guaranty Trust Bank (Liberia) Ltd v Freeman 23 September 2022, the Supreme Court emphasised that the managing director had “used his authority” to harm the claimant at a meeting occurring “in the regular course of business”, the tort being committed while performing an official duty in holding the meeting. Those matters were sufficient to render the bank liable.

In short, it is clear that the following factors are relevant without being determinative, but the issue of whether a particular act occurs within the scope of employment is a fact-dependent question:

In the alternative to its case on vicarious liability, Lonestar argued that the actions of Mr Marziano are legally attributable to Orange Liberia on the basis that Mr Marziano was the “directing mind and will” of the company. While Counsellor Musu-Scott suggested that Liberian courts would recognise a principle of attribution of this kind, she was unable to point to any supporting authority (the decision of In the Intestate of the late Shad Kaydea v The Turay Family [2015] LRSC 37, to which she referred, being addressed to different issues altogether).

I was not persuaded that there was such a principle of Liberian law, or that one would be recognised by the Liberian courts. I was not pointed to any principle of U.S. law to similar effect (which, as I have stated, would be the first “port of call” of a Liberian court looking at the position under other legal systems). I accept Counsellor Padmore’s evidence that Liberian law would look, in particular, to Delaware law on an issue of this kind, and that Delaware law does not recognise this basis for the liability of corporations.

It was agreed by the experts that Liberian law permits an award of exemplary damages in cases of malice, fraud or gross negligence (Itoka v Noelke [1939] LRSC 1). That case states that in order for punitive damages to be awarded, “there must enter into the injury some element of aggravation, or some coloring of insult or malice that will take the case outside of the ordinary rule of compensation”.

Counsellor Padmore (and Professor Banks) suggested that Liberian law would not award exemplary damages in circumstances in which an employer was held vicariously liable for an employee’s tort, but had not authorised or ratified the tort. The scepticism which the Supreme Court expressed about the award of punitive damages in the Guaranty Trust case lends some support for that view, as do statements in Story on Agency which is a text cited in some Liberian decisions on agency and authority issues. Counsellor Musu-Scott challenged that view, pointing to the award of punitive damages in Firestone Liberia v Kollie et al [2016] LRSC 33, a case which involved extreme facts, and personally reprehensible conduct by the employer. Whether or not there is an absolute rule of the kind for which Counsellor Padmore and Professor Banks contend, I accept that the fact that the liability of the employer is vicarious in nature, and that the acts in question were not authorised or ratified, are highly relevant factors when considering whether to exercise the discretion to award punitive damages.

It was common ground that punitive damages would not be awarded in a case in which compensatory damages were sufficient to achieve the purpose of punishment on their own, and, that where they are awarded, it is only to the extent that, together with any compensatory damages, they are sufficient to achieve that purpose (Firestone v Kollie). Counsellor Padmore (and Professor Banks) suggested that the amount of punitive damages awarded in Liberia was “generally quite modest”, although Counsellor Musu-Scott was able to point to figures ranging from 3% to 200% of the amount of general damages (the latter being in a case in which the defendant had also flagrantly defied a court order to cease the wrongful act). As such awards are generally made by juries in Liberia, it is difficult to draw any conclusions as to their “usual” level beyond noting that each case will depend on its particular facts. Awards of punitive damages have been made in cases of bodily injury (Kollie) and financial loss (City Builders).

I have made various findings as to the actions of the Individual Defendants in section D above. In addition to the contemporaneous documentary evidence, in interviews with the Cologne Prosecutor between 16 and 18 May 2017, Mr Kaye confirmed the following:

Mr Marziano’s and Mr Polani’s contact details, and messages between the two of them and Mr Kaye, were found in Mr Kaye’s mobile phone.

Against this background I am satisfied of the following:

Mr Marziano joined Cellcom BVI in 2009, and was appointed CEO of Cellcom Liberia that year. However, he never had an employment contract with Cellcom Liberia. In November 2013, he ceased to be CEO of Cellcom Liberia and became CEO of Cellcom Guinea. He was also CEO of Cellcom BVI.

Mr Polani joined Cellcom BVI in October 2010, and entered into an employment contract with Cellcom BVI at that stage. He was appointed as Internet Services Provider Business Unit Manager on joining Cellcom BVI.

Throughout the period when Mr Marziano and Mr Polani were working for Cellcom Liberia:

When considering whether Cellcom/Orange Liberia can be vicariously liable for the acts of Mr Marziano and Mr Polani, it is helpful to begin by considering the position before the DDOS Attacks began. During that period, it cannot, in my assessment, be seriously argued that the fact that Mr Marziano’s and Mr Polani’s employment contracts were with Cellcom BVI and not Cellcom Liberia had the legal effect that any torts committed within the scope of performing their roles at Cellcom Liberia could not engage the doctrine of vicarious liability under Liberian law. In functional terms, Mr Marziano and Mr Polani were Cellcom Liberia employees. Their services were performed exclusively for Cellcom Liberia. Mr Marziano’s central role was such that, when Mr Coulibaly took over from him, a 10-day handover period was required.

When, in the binding offer of 31 July 2015, Orange CDI stated that it was a condition of the offer that “key management continue to remain employed by the Company for the transitional period of 18 months post Closing”, it was the “off-shored” expatriates they were most concerned with, not those whose written contracts of employment were with Cellcom Liberia. I am satisfied that that reality would be reflected in the application of the doctrine of vicarious liability under Liberian law.

Turning to the subsequent period, it is important to note the DDOS Attacks, and the Individual Defendants’ involvement with them, all began before Cellcom BVI agreed to sell the shares to the Orange Group pursuant to the SPA of 18 December 2015 (albeit after the July 2015 binding offer to purchase). The actual transfer of those shares from Cellcom BVI occurred in April 2016. Looking at the position up until April 2016, I am not persuaded that the contractual arrangements between Cellcom BVI and Orange changed Mr Marziano and Mr Polani’s status as employees of Cellcom Liberia for vicarious liability purposes. However, I accept that the prospective transfer, given its implications for Mr Marziano’s and Mr Polani’s motivation, may well be relevant to the issue of whether their involvement in the DDOS Attacks fell within the scope of their employment with Cellcom Liberia.

The TSA of 5 April 2016 provided for Cellcom BVI to provide certain consultancy services to Orange Liberia for a transitional period, including through certain named individuals: Mr Marziano until 31 January 2017, and Mr Polani until 31 July 2017. This was a provision intended to maintain the status quo during the transition period, clause 3.3 providing that the services were to be provided “substantially on the same basis … and for the same purpose as they were provided … immediately prior to the date hereof and shall be used …. for the same purpose for which they were provided prior to the date hereof”. Term Sheet 2.3 provided that the services of the named 22 expatriate employees were to be provided “on the same level as currently provided to the Target Company” on a full-time basis. The TSA provided that:

Once again, I am not persuaded that these change in the legal structures by which Mr Marziano and Mr Polani came to be performing their roles with Orange Liberia affected their position as, in functional terms, employees of Orange Liberia. Both before and after 5 April 2016, their contracts of employment were with Cellcom BVI, and they were paid by Cellcom BVI, but they worked exclusively (or in the case of Mr Marziano, principally) for Orange Liberia. Indeed, once the TSA had been concluded, the salaries and benefits of Mr Marziano and Mr Polani were ultimately paid by Orange Liberia (who reimbursed Cellcom BVI). As Mr Coulibaly acknowledged, it was Mr Marziano to whom the day-to-day running of Orange Liberia was left. In the Orange Liberia employee handbook, as he had in the Cellcom Liberia employee handbook which preceded it, Mr Marziano acknowledged the reality of his position when addressing the handbook to his “fellow employees”. The handbooks also acknowledged his responsibility “for the overall management and operation of the company”. Mr Marziano attended the three meetings of the Orange Liberia board which took place between April 2016 and Mr Marziano’s departure in January 2017.

I am satisfied, therefore, that Mr Marziano and Mr Polani were employees of Orange Liberia throughout the period of the DDOS Attacks for the purpose of the doctrine of vicarious liability. I am satisfied that they were also employees of Cellcom BVI for the purposes of that doctrine (and for other purposes). They had entered into contracts of employment with Cellcom BVI, which had seconded them to Orange Liberia. I am satisfied that Liberian law accommodates the possibility of two principals being vicariously liable for the same act.

That leaves the separate and distinct issue of whether, in instigating, planning and assisting in the DDOS Attacks, Mr Marziano and Mr Polani were acting within the scope of their respective employments. I will first consider that issue by reference to the position of Orange Liberia, and then by reference to the position of Cellcom BVI, being conscious that the answer need not necessarily be the same in each case.

This is an important, and difficult issue, in relation to which the underlying facts are relatively straightforward, but their overall effect under Liberian law more challenging.

My findings of fact are as follows:

Taking the position of Mr Marziano first, I am satisfied that his involvement in the DDOS Attacks can fairly be characterised as a wholly impermissible (and I accept, so far as the Orange Group was concerned, wholly unauthorised) means of pursuing his responsibility and role of moving customers and usage from Lonestar to Orange Liberia, with the immediate object of benefiting Orange Liberia. That provides very strong support for the suggestion that the tortious means by which this aspect of his role was pursued fell within the scope of his employment. If, for example, Mr Marziano had pursued the same goal by planting false statements about the reliability of Lonestar’s data network in the press, rather than criminally creating a state of unreliability, I would have thought it obvious that the wrongful act fell within the scope of his employment. I am not persuaded that the fact that he acted in secret and used his own financial resources is sufficient to alter that conclusion (any more than if he had used his own financial resources to pay a bribe to secure a valuable contract for Orange Liberia). Employees who use dishonest means to secure a financial benefit for their employers (and thereby benefit themselves) frequently act secretly, and in ways which are less amenable to discovery, not least for fear of being stopped or sacked.

The issue which gives me pause for thought is the fact that Mr Marziano only wished to improve Orange Liberia’s financial position as a means of benefiting Cellcom BVI, through the earn out provisions in the SPA, and ultimately himself (I will assume for this purpose that this is true of the entire DDOS Attack period: cf. [216(ix)] above). However, I am not persuaded that this makes any difference. It will usually be the case that an employee who pursues his responsibilities or seeks to achieve a financial benefit for his employer through tortious means does so ultimately to benefit himself, through a bonus, promotion or simply greater prospects of job retention. Wholly altruistic employee torts must be a rarity. I am not persuaded that the interposition of Cellcom BVI changes the analysis (any more than a case in which the employee hoped to realise their personal benefit through a shareholding in the employer’s holding company, which might attract an indirect benefit from the financial benefit to the subsidiary). I am satisfied, therefore, that Mr Marziano’s involvement in the DDOS Attacks fell within the scope of his employment with Orange Liberia.

In these circumstances, it is not strictly necessary to consider the position of Mr Polani. It is more difficult, on the evidence before me, to characterise the personal scope of his employment as extending to winning business from Lonestar, although, at least in the B2B sphere, he had some business development responsibilities. There is a marginally stronger case for arguing that his employment with Orange Liberia assisted him in supporting Mr Kaye. What is ultimately decisive, in my view, is that his role at Orange Liberia clearly included supporting Mr Marziano, as CEO, in discharging his duties. In these circumstances, it would be wholly artificial in my view to distinguish between Mr Marziano and Mr Polani on the issue of whether their involvement in the DDOS Attacks fell within their scope of employment. I am satisfied that in Mr Polani’s case, as well, the answer is that it did.

Mr Marziano was Group CEO of Cellcom BVI from November 2013 to 22 January 2019, and he was held out as such to third parties, including in the “Information Memorandum” prepared in March 2014 in relation to a proposed sale of Cellcom BVI. I have found his contract of employment was with Cellcom BVI. On the evidence, he played an important role in the sale of Cellcom Liberia to the Orange Group. He prepared financial analyses for the beneficial owners of Cellcom BVI and attended due diligence meetings with the Orange Group. He provided input into the drafting of the SPA and the consulting services agreement.

The extent of his involvement can be seen in the $2.8m bonus he received on the closing of the sale (calculated at 3% of the sale price). Mr Adam Cohen, a director of Cellcom BVI, wrote to Mr Marziano in December 2015 saying:

“Avishai Fantastic performance today. Great outcome for Cellcom owners and for the employees who also deserve recognition. Your 3% is very well earned on the value you delivered and will continue to generate!”

Cellcom BVI paid Mr Marziano a bonus of US$170,000 in December 2016, when Cellcom BVI received the last Earn Out Payment, and a further bonus of US$90,000 in April 2017 when that part of the purchase price which had been paid into escrow was released. There is at least some evidence of Mr Marziano reporting on Orange Liberia’s performance to Cellcom BVI (his emails of 12 August 2016 and 31 January 2007, sent from a Cellcom BVI address). Neither Mr Marziano nor Cellcom BVI have chosen to offer any explanation for their interactions during the period from the TSA, and whether Mr Marziano continued to perform a role for Cellcom BVI in relation to the SPA during the period when he was acting as CEO of Orange Liberia. Finally, I have found that Mr Marziano instigated the DDOS Attacks in order to increase the amounts payable by the Orange Group to Cellcom BVI under the Earn Out provisions of the SPA. Cleary it was his employment by Cellcom BVI, and the opportunity for reward which that provided, which led him to instigate the DDOS Attacks.

In these circumstances, I am satisfied that the scope of Mr Marziano’s employment for Cellcom BVI throughout the DDOS Attack period included protecting its interests and maximising its return under the SpA, and that the DDOS Attacks fell within that scope of employment.

I do not propose, in the circumstances, to address the position of Mr Polani, or Lonestar’s attribution argument under the law of the British Virgin Islands.

Cellcom BVI, but not Orange Liberia, advances a limitation defence in the event (as I have held) that it is liable to Lonestar on the basis of the action of damages for wrong, but not otherwise. This is because the claim on the action of damages for wrong was only introduced into these proceedings by amendment on 29 September 2021, and the applicable limitation period under the Foreign Limitation Periods Act 1984 (FLPA 1984) is three years under the 1972 Act.

I am satisfied that there is nothing in this point:

Lonestar’s causation and quantum case was advanced (in broad terms) by calculating (i) how many subscribers Lonestar was alleged to have lost as a result of the DDOS Attacks and (ii) how far Lonestar’s ARPU fell as a result of the DDOS Attacks.

The issues between the parties are explored in the following sections.

In relation to the first element (lost subscribers), it is common ground that after a period of steady growth, the number of Lonestar’s subscribers (voice and data) began to decline from August 2016 to April 2017. Of the total subscriber loss of 220,000 over this period, Mr Nicholson says that 150,000 were lost as a result of the DDOS Attacks. Mr Thomas suggests that the correct figure is 90,000 subscribers. The difference between them turns on three issues.

The first issue is how many of those subscribers were lost as a result of integration with another mobile network acquired by Lonestar in July 2016, Novafone. While this was initially a source of additional subscribers, difficulties encountered with the integration process led to 50% of those “new” subscribers being lost.

Mr Thomas’ opinion is that 60,000 subscribers were lost through the Novafone integration process, a figure taken from a September 2017 Executive Committee Paper which refers to the Novafone acquisition adding a 4% market share. A four percent market share would equate to 120,000 subscribers. Mr Nicholson agrees with the broad mechanics of this calculation, but suggests that the starting point of 120,000 subscribers acquired from Novafone is too high. He relies on a spreadsheet referring to 70,000 2G and 3G voice subscribers (but not data subscribers).

This is a question on which it should have been possible for Lonestar to adduce clear evidence. However, the overall effect of the documents is that a figure of 70,000 additional subscribers is too low. Lonestar’s due diligence report on the Novafone acquisition refers to Novafone having 130,000 subscribers as at March 2015, 75,000 voice and 55,000 data. If 55,000 data subscribers are added to the voice subscribers identified in the document relied upon by Mr Nicholson, a total figure of in excess of 120,000 for voice and data subscribers is arrived at. Other documents would point to even higher figures. While a December 2015 operations review document prepared by Lonestar refers to Novafone having 45,000 subscribers, this must be viewed in the light of the fact that Lonestar was significantly overestimating its own market share at this point (and hence underestimating Novafone’s).

The second issue concerns the effect of Lonestar’s decision to pass on the 1c per minute excise tax in January 2017. Lonestar’s contemporaneous assessment was that this caused the loss of 70,000 customers. Mr Nicholson thinks that estimate was too high by a factor of two. However, there are other internal Lonestar documents supporting an impact at or even above the 70,000 level, and Lonestar called no witness to support a lower figure.

Finally, there is an issue of whether allowance should be made for other factors causing lost subscribers. Mr Nicholson originally allowed 10% for losses due to other factors. Mr Thomas has never sought to effect a further allowance, but has maintained his 90,000 figure. I accept that figure may well be conservative, but in circumstances in which Mr Thomas put that figure forward to the court as the figure it should find, and did not put forward or justify an alternative figure, I am satisfied that the figure for lost subscribers established on the evidence is 90,000.

So far as the second element (reduction in ARPU) is concerned, Lonestar’s case is as follows:

It will be apparent that Mr Nicholson’s ARPU analysis is performed on a combined voice/data basis, even though the DDOS Attacks only directly impacted users of Lonestar’s data offering. Mr Singla KC explained in closing that, on Lonestar’s case, “what was happening was customers from Lonestar, high value customers, were switching their data usage and then the voice usage was following the data usage”.

In my assessment, it is necessary to analyse data and voice ARPU separately. This approach is analytically sounder, accords with Lonestar’s internal approach and better reflects the different nature of the two markets, and the different factors impacting upon them.

Turning to the underlying data:

Once allowance has been made for Lonestar’s January 2017 decision to pass on the excise tax, the swing in combined voice/data ARPU largely occurred during the first half of 2016 (at a stage when there had been relatively few effective DDOS Attacks), not the period from July 2016 onwards, when the DDOS Attacks were most effective. Of a total swing of $1.90 after taking the January 2017 tax assessment out of the picture, $1.64 occurs before July 2016 and $0.25 afterwards. Looking at voice and data separately:

As Mr Kitchener KC put it, drawing on his own stripling studies, the narrative underlying Mr Nicholson’s report lacked the explanatory power to accommodate the chronology of events, particularly in the face of the much more compelling narrative which emerges from the contemporaneous documents. I am satisfied that the reduction in Lonestar’s ARPU occurred in January 2016 because that was when Lonestar opened up its DYO offering to HVCs and imposed capping and throttling, slashing its ARPU overnight, and this was the reason why it was voice ARPU rather than data ARPU which fell in early 2016, and why voice usage fell while data usage did not.

There are other problems with Lonestar’s approach. Mr Nicholson’s methodology is noticeably indirect, rather than looking at what Lonestar’s internal assessment was of the reasons why it was losing revenue per customer relative to Cellcom/Orange Liberia. As will be apparent from the chronological summary set out in Section D above, and as would be expected, there was extensive analysis within Lonestar of why its HVCs were reducing their average spend, which did not attribute the fall in voice spend to the DDOS Attacks, and only identified the DDOS Attacks as impacting data revenue when those attacks became much more intense in the second half of 2016. It is as if the court is being asked to find that an injured man was run over because there is a higher rate of traffic offences and a lower rate of violent acquisitive crime in the wider region, and to ignore the victim’s “res gestae” statement to a passer-by that he was robbed.

Further, Mr Nicholson’s decision to isolate one unilateral pricing decision by Lonestar (the decision to pass on the 1c excise tax in January 2017) when analysing the ARPU swing, but not the other significant unilateral decisions taken by Lonestar which impacted on pricing, or what was received in return from pricing, was never satisfactorily explained. The different responses by Lonestar and Orange Liberia to the excise tax (one absorbing it and therefore cutting its pre-tax price, the other passing it on) do not appear to be different in kind to any of the other occasions on which one party made a price move which was not matched by the other for a period of time (in March 2017 the excise tax was withdrawn). The January 2017 event does not appear to differ from any of the other unilateral price moves, yet it is treated differently by Mr Nicholson.

There are also very real difficulties with Lonestar’s case as to the causal mechanism by which the DDOS Attacks impacting the user experience of data subscribers would lead to a reduction in the ARPU from voice services. Two causal theories were advanced:

In addition, Lonestar’s case offers no credible account of the chronological intervals between the the limited periods of effective DDOS Attacks (as I have found them to be) and the impact on voice revenue. Mr Nicholson’s approach assumes that the DDOS Attacks rapidly caused a significant reduction in average voice/revenue spend in January and February 2016. However, the “data to voice” causation case advanced by Lonestar assumed a period of unhappiness by combined customers with Lonestar’s data services building up to a point when it began to impact the use of Lonestar’s voice network as well. It is noteworthy that the DDOS Attacks did not lead to any loss of subscribers until September 2016, once the more intense phase of DDOS Attacks had begun (indeed Lonestar added subscribers and took market share from Cellcom/Orange Liberia up to that point). The evidence of the impact on data ARPU suggests that it was really only in the second half of 2016 that the DDOS Attacks had sustained effects, such that any effect on voice revenue would, on Lonestar’s case, have followed that. Indeed it was Mr Toriola’s evidence that it was only after February 2017 that customers had become sufficiently frustrated with the DDOS Attacks to reduce their MOU.

The many difficulties in reconciling Lonestar’s theory that the movement in its relative combined voice/data ARPU over the period from October 2015 to February 2017 was the result of the DDOS Attacks with:

There was a swing in the data ARPU during the DDOS Attack period of $0.40. Mr Thomas’ loss calculation allocated 50% of this swing to the DDOS Attacks, which he said was a conservative figure. I am satisfied that it is the appropriate figure to use:

The allocation of the data ARPU swing across these various causes is inevitably rough and ready. Mr Thomas’ initial application of 1/3:1/3:1/3 for superior network/technology, price decisions and the DDOS Attacks does not disclose a reasoned basis for the assumed equivalence of these factors, and does not specifically account for the indirect effect of the DDOS Attacks on Lonestar’s data pricing. However, I am satisfied that the 50% attribution Mr Thomas uses in his final calculation does fairly allow for this, and that this is the appropriate figure to use.

For the reasons I have set out at [238] to [244] above, I am unable to accept Lonestar’s case as to the existence of an appreciable effect of the DDOS Attacks on its voice revenue beyond that already accounted for within the figure for lost subscribers addressed at I2(1) above. However, I accept that:

However, the overall tenor of Lonestar’s internal assessments is that the most significant consequence of the DDOS Attacks was lost data revenue. In my assessment, it is appropriate to remove the voice ARPU swing which happened in the first half of 2016, and the effect of the January 2017 decision to pass on the excise tax in order to arrive at the figure for voice ARPU swing which is unaccounted for. In the time-honoured phrase, doing the best that I can on the material available to me, I am satisfied that it would be appropriate to attribute 50% of that remaining voice ARPU swing to the DDOS Attacks. I asked the parties to agree the calculation of the loss of profit figure on that basis.

I received two very different figures:

The difference between the two figures turns on the following:

As to (i), I am satisfied that this would be inconsistent with my finding that the DDOS Attacks did not cause any impact on voice ARPU before the second half of 2016 and it is not therefore open to Lonestar to seek to revisit that issue.

As to (ii), the figure of 40c was put forward by Mr Nicholson before and at the trial, and agreed to by Mr Thomas. Mr Nicholson was cross-examined on that basis and agreed that if the combined ARPU swing before July 2016 was removed, and the swing due to the decision to pass on the excise tax was also removed, that left a combined voice/ARPU swing of 23c (of which voice makes up 4c). The figure now put forward reflects a change in Mr Nicholson’s model. This had proceeded on the basis of a comparison between the three months from September to November 2016 with the three months from March to May 2017. Mr Nicholson now suggests that the voice ARPU swing should be calculated solely from December 2016, which should be compared with the six months from March to August 2017.

In the course of closing arguments, the issue of how any voice ARPU swing due to the DDOS Attacks should be calculated was raised. Mr Singla KC referred to the fact that Mr Thomas has not produced his own calculation of lost voice ARPU, having reached the view that the DDOS Attacks had had no effect on voice ARPU. Addressing a scenario in which I concluded that there had been some effect on voice ARPU, but not that calculated by Mr Nicholson, I asked:

“What happens in that situation? It is not a baseball arbitration, where I have to choose one or other salary offering. I have to be satisfied -- if the situation is I end up saying there is some voice but I think it is less, do I ask for more submissions or ...?”

The exchanges which followed were as follows:

“Mr Singla: I think it can be dealt with through the model.

Foxton J: Okay, so you adjust inputs, do you?

Mr Singla: I think so.

Foxton J As long as I'm not asked to run the model myself.

Mr Singla: I think it is a case of once you know what percentage and what youconfine to that can be worked out, and that shouldn't controversial.”

I am not willing to allow Lonestar to depart from the case which was maintained through the trial, or change the model which was agreed to by Mr Thomas and which it was accepted would form the basis of any alternative calculation. Lonestar has accepted (in Freshfields Bruckhaus Deringer’s letter of 23 February 2023) that the 2c figure put forward by Orange Liberia is that which follows “from the approach adopted by the parties’ quantum experts”. It is not appropriate for Mr Nicholson, or Lonestar, to seek to revisit their methodology after the draft judgment was circulated (cf. Royal & Sun Alliance Insurance Limited v Tughans [2022] EWHC 2825 (Comm), [16]).

I have found that the DDOS Attacks caused:

That leaves the issue of how long these losses continued after the end of the DDOS Attack period.

Taking loss of subscribers first, it was common ground that subscriber loss would continue to April 2020, and I understand both sets of calculations proceed on this basis.

So far as the ARPU loss is concerned (which involved Lonestar data customers spending less than they would otherwise have done on data and voice), Mr Thomas’ calculation assumes that the effect would have been exhausted by September 2019, when the new price floor was introduced. I am not persuaded that the price floor itself would have been a factor in ending the significance of the DDOS Attacks on the market for Lonestar’s ARPUs. Its effect was to equalise the pricing between Lonestar and Orange Liberia, but there is no reason why that would, of itself, have reversed the prior effects of the DDOS Attacks on customer behaviour. However, I accept that, by September 2019, the effects of the DDOS Attacks on Lonestar were largely coming to an end (which was broadly the evidence of Mr Toriola in his witness statement: see in particular paragraphs 36(a), 38 and 47). I am satisfied that the April 2020 end-date for subscriber losses also represents the end date for these other losses (it would be surprising if it took more time for data and voice spending of retained Lonestar customers to recover to the level it would have had, but for DDOS Attacks, than for the position with respect to lost subscribers to reach the same position).

On the basis of the findings I have made, the loss of profit caused by the DDOS Attacks falls to be quantified at $3,602,349.

Lonestar’s argument at times appeared to suggest that a figure at or around this level was inherently too small to be a realistic assessment of the effect of the DDOS Attacks given their scale. However:

Orange Liberia argued that Lonestar’s network capacity and DDOS defences were not fit for purpose and that it should have increased cleaning capacity quicker than it did. I am not persuaded that there is anything in this argument. Indeed, to a significant extent, I suspect that Orange Liberia’s “failure to mitigate” argument was advanced only to address the possibility that the court accepted Lonestar’s case that the DDOS Attacks began having very serious effects on Lonestar’s network on a near-continuous basis from October 2015. I have rejected that contention. Viewed in the light of the actual effect of the DDOS Attacks, and the intermittent nature of those effects, I am not persuaded that Lonestar acted unreasonably in its response to the attacks. Nor am I persuaded that it is open to Orange Liberia to advance a mitigation argument premised on Lonestar’s failure to install a higher capacity DDOS defence system before the DDOS Attacks began. Seat-belts and crash helmets apart (and English law deals with those through the concept of contributory negligence: cf. Glanville Williams, Joint Torts and Contributory Negligence (1951), Ch.11), complaints about mitigation involve the steps taken (or not taken) after the tort, and I was taken to nothing which suggested that the law of Liberia was any different in this respect.

Finally, Lonestar claimed $878,170 in expenditure. This part of the claim was, for understandable reasons, only explored briefly at trial, but the absence of any witness able to speak to the expenses and a clear audit trail has allowed for some dispute as to whether, and if so why, these costs were incurred. Taking the individual elements in turn:

I will first consider the position of the Individual Defendants.

So far as Mr Kaye is concerned, he has served a sentence of imprisonment for his role in the DDOS Attacks. The criminal justice process has appropriately served the goal of punishing Mr Kaye for his actions, and I do not believe it would be appropriate for an award of punitive damages to be made against him in those circumstances.

So far as Mr Marziano is concerned, he was the principal mover in the DDOS Attacks. He lied to Cellcom BVI about his involvement when asked to comment on this claim, and has avoided participation in these proceedings. He has not, as yet, been subject to any form of criminal process in respect of his involvement, and the chances of this happening must be limited given the interval of time which has now elapsed. He was ultimately motivated by his own personal benefit, and clearly did benefit to some degree, although the extent to which the bonuses received by him were increased as a result of the DDOS Attacks is not clear on the evidence before me. I am satisfied that an order of punitive damages in the amount of US$170,000 (the amount of the bonus paid to him after Cellcom BVI received the final Earn Out Payment in December 2016) is appropriate.

I am not persuaded that it would be appropriate to award punitive damages against Mr Polani. He was significantly junior to Mr Marziano, had a much more limited role, and I have seen no evidence that he obtained a significant financial benefit from his involvement with the DDOS Attacks.

I am not persuaded that it would be appropriate to order punitive damages against Orange Liberia. The vicarious nature of its liability is a very relevant factor in this respect, as is the essentially commercial nature of the dispute and the financial nature of the harm inflicted on Lonestar. Having regard to the order for compensatory damages made against it, and the payments it made to Cellcom BVI the recovery of which now looks highly questionable, I am not persuaded that it has made any net benefit from the DDOS Attacks, particularly when regard is had to the management time which this litigation will have consumed, and the inevitability of uncompensated costs (whatever costs order might be made).

For essentially similar reasons, I do not believe an order for punitive damages is appropriate against Cellcom BVI. It will now face a claim from Orange Liberia under the warranties in the SPA, as well as the damages award made in this judgment. It is likely to face real difficulties in recovering the amounts it has paid to Mr Marziano.

Finally, Orange Liberia seeks orders for 100% contribution from Cellcom BVI and the Individual Defendants under the Civil Liability (Contribution) Act 1978. Section 2(1) of that Act provides that the amount of contribution shall be “such sum as may be found by the court to be just and equitable having regard to that person’s responsibility for the damage in question”. In determining that amount, the case law suggests that I should have regard to:

In relation to the Individual Defendants, I am satisfied that the appropriate level of contribution should be 100%. They were entirely responsible for the acts which caused the loss, and are the only parties who acted in a morally blameworthy way. I do not believe this order involves any risk of Orange Liberia retaining an ultimate benefit from the wrongful acts, given the factors identified in [262] above, and the fact that it has made the Earn Out Payments.

As regards Cellcom BVI, I am going to put Orange Liberia’s contractual rights against Cellcom BVI on one side. No claims under the SPA or TSA were pleaded, and I heard no argument upon them. However, it follows that this order for contribution is not in any way intended to limit Orange Liberia’s contractual rights against Cellcom BVI.

On that basis, and given the absence of any personal fault by Orange Liberia or Cellcom BVI, both of whom have been found liable on a vicarious basis for the acts of Mr Marziano, I am satisfied that the order for contribution should be 50%: Viasystems (Tyneside) Ltd v Thermal Transfer (Northern) Ltd [2005] EWCA 1151, [2006] QB 510, [84]-[85].

On the basis set out above, it follows that:

I would like to conclude by expressing my gratitude to the legal representatives for all their hard work, and in particular for their successful efforts to present a complex case using written opening and closing submissions of manageable proportions.