A recent doxxing case that resulted in Waterloo-based TextNow Inc. being ordered to name two of its subscribers accused of terrorizing employees of game company Bungie Inc. could result in further civil or criminal action being launched against the pair, says cybersecurity lawyer Imran Ahmad.
Cybersecurity vendor Fortinet defines doxxing as a “form of cyberbullying that uses sensitive or secret information, statements, or records for the harassment, exposure, financial harm, or other exploitation of targeted individuals.”
Last week, the Waterloo Region Record reported that Ontario Superior Court Justice Fred Myers ordered Waterloo-based TextNow, which, according to the article, “offers anonymous phone service,” to release any pertinent personal information including email address, phone number, IP address, credit card number and logs of calls and texts relating to the two individuals.”
Ahmad, the head of law firm Norton Rose Fulbright Canada LLP’s technology sector and co-head of its information governance, privacy and cybersecurity practice, was not surprised by the ruling.
“I looked at the case and the article that has been written on it and my personal view is that the judge’s analysis seemed to be appropriate,” he said this week in an interview with IT World Canada.
“Which is to say that individuals cannot hide under a pseudonym or cannot hide behind so-called privacy protection they would have with a platform or service provider, and do things that would otherwise be unacceptable or inappropriate.”
Privacy, added Ahmad, as a “general proposition is not absolute. There is a trade-off. if we look at our privacy laws and the fundamental principles behind it, there are limits to privacy of an individual, and you always have to balance out the interests of the many versus the individual’s rights as well.
“One thing to keep in mind is the gravity of the allegation – the death threat was significant. It’s not going to be the lifting of privacy just for the heck of it. It’s going to be when there was significant rationale to do so.”
The fact that lawyers representing both Bungie Inc., developer of a game called Destiny 2, which has a reported 40 million users, and the two employees, went the legal route to obtain the names does make sense, he said.
“If a company wants to know the identity of somebody using an alias, for example, or wants to know where an email is coming from, typically, if you go to an email service provider like a Google, or a Yahoo, or Hotmail, or whoever you wish, you as a company will typically be unsuccessful in getting their identity.”
The reason for that, he said, “is that there is an agreement between the platform or the email service provider and the individual user, where the platform provider says, ‘I’m going to keep your identity private, if you wish to do so.’”
In a case such as this, said Ahmad, the fact that obtaining a court order is an “expensive and lengthy process,” means that this is part of a “broader investigation that going to run its own course.”
Ahmad suggests any individual who thinks they will always remain anonymous is mistaken: “There is no such thing as absolute privacy, absolutely on the Internet. There are ways for that to be restricted or lifted depending on the circumstances, especially when using a third-party application or platform.”
