THE INCE GROUP PLC v PERSON(S) UNKNOWN

This is my open judgment in respect of an urgent application which was heard, in part, in private. The intended Claimant, The Ince Group Plc, is an international commercial law and business services firm. It makes an application without notice for an interim non-disclosure order.

At the start of the hearing in open court, I heard submissions from Adam Speker QC on behalf of the Claimant as to whether there should be a hearing in private of part of the application. For the reasons I gave following those submissions, I directed that part of the hearing would be in private and I explained in open court that I was satisfied that the Claimant had established appropriate grounds for a derogation from the principle of open justice.

This is a case where in several respects a public hearing would defeat the interests which the Claimant seeks to protect. This case concerns an ongoing incident of apparent blackmail and the submissions and evidence of the Claimant encompass more than the contents of the information stolen. They include what is known to date and the steps taken to deal with the incident. I consider there is a need not to hamper the efforts to trace the Defendant and/or encourage others to search for the information. I also concluded that what can legitimately come out now can be controlled better through a private hearing and provision of a public judgment restricted to the facts necessary to explain the reason for the Order. That would satisfy open justice requirements whilst having proper regard to the rights of the Claimant and others affected. The Claimant has also not sought anonymity.

As I have stated, the application is made without notice. For reasons which will become apparent, I am satisfied that it was appropriate not to give the Defendant notice. The application is made against a Person or Persons Unknown and, on the material before me, it is clear that the Defendant has demonstrated that it has information it knows it should not have and knows or suspects its actions are of a criminal nature. It is clear on the current evidence that the Defendant is motivated by money and has threatened to damage the Claimant by a form of blackmail, and there is a real risk that notice will trigger the Defendant to disseminate the confidential information which is the subject of the claim. Although the issue is always fact-sensitive, in ransomware injunction applications it is generally appropriate to proceed, in the first instance, without notifying the Defendant. I turn then to the substance of the application before me.

Following a cyber-attack on or around 13 March 2022, the Defendant, an unknown party, has obtained certain confidential data of the Claimant firm. It is not appropriate for me in a public judgment to go into the nature of that data, but as I will explain in due course, I am satisfied that the information has the necessary quality of confidence for the purposes of the law of confidentiality.

The Defendant is threatening to publish the stolen data on the dark web if the Claimant does not pay a substantial ransom demanded of it. By way of preliminary observation, it seems to me on the material before me that the Defendant has no basis for arguing that there is any just cause or excuse for publishing any information, so it is hard to see how Article 10 of the ECHR would be engaged. But I will return to that issue when considering s.12 of the Human Rights Act 1998.

The application is supported by a witness statement of Mr Adrian John Biles, Chief Executive Officer of the Claimant firm. Omitting confidential details, I can summarise the relevant background facts as follows. On 13 March 2022, through the Claimant firm’s internal security programme, it came to the knowledge of the firm that there may have been an intrusion into its computer systems. In due course, a communication emanating from the Defendant was received by the firm demanding a ransom in default of which there was threatened further disclosure of the information. This is a clear blackmail case.

As I have indicated, I am satisfied on the basis of the information provided to me in Mr Biles’ witness statement that the information stolen by the Defendant has the necessary quality of confidence, and it is not appropriate for me to enter into any further discussion of the nature of that information. I turn then to the nature of the relief sought before me. The appropriate test in an application such as this is the well-known American Cyanamid v Ethicon [1975] AC 396 test. However, before I turn to the application of the test, I need to address s.12(3) of the Human Rights Act 1998 which imposes a stringent test when the court is considering granting interim relief which might affect the exercise of the right to freedom of expression. Although I am sceptical (for the reasons I have given) as to whether any legitimate Article 10 ECHR rights are in play, I am satisfied on the information before me that the Claimant firm is likely to establish at trial that publication of the information in question should not be allowed.

The Defendant has come into the possession of the Claimant firm’s confidential information through what seem to be clear criminal and unlawful actions. The Defendant is not seeking to publicise the information for any legitimate reason, but merely seeks to obtain a commercial benefit by effectively holding the Claimant firm to ransom.

In those circumstances, it seems to me clear that the Claimant should be entitled to a prohibitory injunction. The basic elements of a classic breach of confidence claim have been established by the Claimant. The Claimant has title to sue, there is clearly a duty of confidence owed by the Defendant, and the underlying material is in my judgment clearly confidential. It is also clear that there are threats of disclosure. There does not seem to be any sensible basis to argue that there could be any public interest of the publication of the material; and this is a clear case where damages would not be adequate.

A less straightforward matter is the further relief sought at this without notice stage by the Claimant firm. In the draft order before me, the Claimant seeks relief of a mandatory nature requiring the Defendant to deliver up and/or delete and/or destroy the information it has stolen. My attention has been drawn to Nottingham Building Society v Eurodynamics Systems[1993] F.S.R. In that case Chadwick J considered the principles to be applied when a court was being asked to grant a mandatory injunction.

On the basis of the facts before me I consider that the Claimant firm has established that a mandatory injunction is necessary. I have a high degree of assurance that the Claimant firm will be able to establish at trial the relief which it seeks on a mandatory basis at this stage. I can see no basis for the Defendant to be able to resist relief requiring delivery up and/or deletion and/or destruction. I am accordingly satisfied that in addition to a prohibitory injunction, I should make a mandatory injunction. The Defendant should also be required to provide a witness statement confirming that it has complied with mandatory aspects of the relief.

I am also satisfied, having been taken through the draft order, that the modifications to the model order are justified on the facts before me. There are a number of particular aspects which I should identify in this regard.

The provisions at CPR 25A PD 5.1(2) require that an applicant on an application without notice must undertake to serve on the respondent the application notice, evidence in support and any order made. However, in the draft before me, the Claimant firm seeks an order on terms that it is not required to serve the confidential witness statement on the Defendant unless and until the Defendant identifies itself and provides an address for service. My attention was drawn to the decision of Warby J in Clarkson PLC v Persons Unknown (unreported, 14 December 2017) and an order made by Steyn J in 4 New Square v Persons Unknown (28 June 2021). The identity of the Defendant is unknown, and it is clear to me that the Defendant is seeking to blackmail and harm the Claimant firm. In these circumstances, to send the evidence relied upon to the Defendant may lead to its misuse; and to particularise the confidential information stolen could provide the Defendant with valuable information as to which documents or categories of documents are considered particularly sensitive. Accordingly, I will make an order permitting the Claimant not to serve the confidential witness statement on the Defendant until the Defendant identifies itself and provides an address for service.

There is also a modification in the draft order in relation to access to documents for third parties. The order itself will be accessible to anyone searching the court file and may be published on the judiciary website, and the model order drafting is premised upon protecting the rights of the media and would allow anyone with notice to read the documents read by the judge upon providing an irrevocable undertaking. It seems to me that such people may not have any legitimate interest, standing or justification. Accordingly, I agree with the Claimant firm that it is entitled to a modification to the wording so as to provide that any relevant third parties must have possession of or access to the information. If a party does not have knowledge of or access to the information and therefore existing interest in it, it should not be provided with the documents provided to the court in the private hearing, even with a written undertaking. I again note the wording was accepted by Collins Rice J in the 4 New Square case.

As regards the confidential schedule and the description of the confidential information itself, I was taken to the first instance decision of Teare J in Clarkson. I am satisfied, without going into the terms of the confidential schedule that the information is sufficiently described.

Finally, as regards the form of service, I am satisfied that I should authorise alternative service essentially on a similar basis to that described by Warby J in Linklaters LLP v Mellish[2019] EWHC 177 (QB) and Nicklin J in PML v Persons Unknown [2018] EWHC 838 (QB). Without going into any further confidential details, it seems to me that there is ample justification for the Claimant to be able to serve the Defendant via the website through which the Claimant has been communicating with the Defendant.

For these reasons, which are necessarily abbreviated given the underlying confidentiality of the material, I will make the order in the form of the draft put before me by Mr Speker QC with a provision for a return date and completion of various steps by the dates discussed with Mr Speker QC in court.