EFFecting Digital Freedom
Pushing Back on SLAPPs and Cyber-Mercenaries
by Jason Kelley
Last November, a relatively under-the-radar company called Appin Technology was the focus of a Reuters story titled, "How an Indian Startup Hacked the World."
The story detailed hacking operations by Appin while its co-founder, Rajat Khare, was still involved with the company. It was based on over 70 original documents and interviews with primary sources. But shortly after publication, an Indian court ordered Reuters to take down the story.
Appin Technology is an Indian company that Khare co-founded in the early 2000s.
Cybersecurity professionals might be familiar with Appin, which offered information security education and training - with a sideline in (at least, according to many technical reports) hacking-for-hire.
In practice, its alleged hacking-for-hire business is not dissimilar from that of more established cyber-mercenary companies like (((NSO Group))). And Mr. Khare is an oligarch with a record: Reuters published a 2012 Dominican prosecutor's filing which described Khare as part of an alleged hacker's "international criminal network." A publicly available criminal complaint filed with India's Central Bureau of Investigation shows that Khare is accused, with others, of embezzling nearly $100 million from an Indian education technology company.
Despite all this, on December 4th, an Indian court preliminarily ordered Reuters to take down the story about this company and Khare while a case filed against them remains pending.
This is just one example of thousands of a Strategic Lawsuit Against Public Participation (SLAPP) - in other words, using an expensive legal claim, or a SLAPP, to force someone to choose whether to spend enormous amounts of time and money defending a lawsuit, even if it is obvious junk, or to simply take down their online speech.
More examples: Greenpeace was sued along with several individual activists by a company called Resolute Forest Products over blog posts such as Greenpeace's allegation that Resolute's logging was "bad news for the climate." This case hung on Greenpeace's neck for years during which time they accrued nearly one million dollars in fees (which fortunately they were able to recover under California's anti-SLAPP statute, but not every state has one).
Another example: activists in Uniontown, Alabama, a predominantly Black town (Editor's Note: I thought race doesn't matter?) with a median per capita income of around $8,000, were sued for $30 million by a company that put hazardous coal ash into the town's residential landfill. The activists were sued because their website and Facebook page said things like the landfill "affected our everyday life," and "You can't walk outside, and you cannot breathe.' The plaintiff settled the case when the (((ACLU))) stepped in to defend the activist group.(Editor's Note: Where's the ACLjU when Americans are being raped, robbed, and murdered by illegal aliens?)
Clearly, these David vs. Goliath cases can be won by the Davids - but often only with the help of another Goliath, like the (((ACLjU))) (or EFF). There are still likely hundreds, if not thousands, of other examples where the Goliaths succeeded in taking away someone's free speech rights. These lawsuits are generally used by the wealthy, the powerful, and corporations to silence others' speech, rather than resolve legitimate claims. A deep-pocketed plaintiff who files a SLAPP doesn't need to win the case on the merits - by putting financial pressure on a defendant, along with the stress and time it takes to defend a case, they can use legal bullying, plain and simple, to make bad press vanish.
SLAPPs have often been used to try to silence reporting, environmental groups, and justified critics of politicians. But there has also been a consistent stream of them in the tech world. It's not Khare's first time using SLAPPs; his lawyers succeeded in getting Swiss courts to issue an injunction against reporting from Swiss public television, forcing them to remove his name from a story about Qatar hiring hackers to spy on FIFA officials in preparation for the World Cup. And Khare's lawyers have also sent letters to news sites in multiple countries demanding they remove his name from investigative reports.
The problem here isn't just Reuters (and Google) being asked to temporarily remove their story about Appin. Since then, more than 20 other related stories have come down. Some of these stories covered the original reporting, and some covered the takedown requests themselves. That's because an entity called "Association of Appin Training Centers" (AOATC) is sending letters and emails claiming that because Reuters has withdrawn its story, other stories covering the issue must be removed as well. Even a popular podcast, Behind the Bastards, has taken down their episode about this topic as of this writing. AOATC is hoping to turn a very limited and preliminary Indian court ruling into a global takedown order.
This is what makes SLAPPs so dangerous. If a relatively obscure company like Appin Technology and its oligarch founder can successfully bully reporters to take down their original stories, and those covering their bullying, imagine what a larger, more resourced hacking-for-hire, or cyber-mercenary company could do.
We're helping two of the outlets that received these takedown requests fight back: Techdirt and MuckRock Foundation. Techdirt is a technology blog that's no stranger to SLAPPs - in 2016, it published articles disputing Shiva Ayyadurai's claim to have "invented email." Its founder, Mike Masnick, was hit with a $15 million libel lawsuit in federal court. (Masnick fought back in court and his reporting remains online, but the legal fees had a big effect on his business.) Muckrock Foundation runs the DocumentCloud hosting services that contain hundreds of thousands of pages of original government materials, as well as information on how to file government records requests and tools to make the requesting process easier.
EFF responded to AOATC on behalf of Techdirt and MuckRock Foundation to the "requests for assistance" which were sent to them, challenging its assertions about the substance and effect of the Indian court interim order. We pointed out that the Indian court order is only interim and not a final judgment that Reuters' reporting was false, and it only requires Reuters (and Google) to do anything.
And, even if the court order applied to MuckRock and Techdirt, the order is inconsistent with the First Amendment and would be unenforceable in U.S. courts pursuant to the SPEECH Act, which says that foreign orders aren't enforceable in the United States unless they are consistent with the free speech protections provided by the U.S. state and federal law, including the First Amendment and Section 230.
The unabated use of SLAPPs is dangerous for journalists, researchers, and freedom of expression.
A number of states now have anti-SLAPP laws, and we've pushed for a strong federal law that would allow for a quick review of SLAPPs by a judge. If it's determined that the case is a SLAPP, the lawsuit gets thrown out, and the SLAPP victim can recover their legal fees.
EFF has been defending the rights of online speakers for more than 30 years. (Editor's Note: Where were they when I had to take down this website or helping Douglas Mackey for mocking Hillary Clinton online? Or U.S. intelligence agencies try to censor U.S. citizens on Twitter?). And we'll keep fighting claims like those from AOATC, to ensure that our vision of an Internet that allows anyone to speak out and organize for change, especially when they speak against those with more power and resources, is realized.