Covid-19 Protocol: This judgment was handed down by the judge remotely by circulation to the parties' representatives by email and release to BAILII. The date and time for hand-down is deemed to be 15 July 2020 at 2:00 pm.
Peter MacDonald Eggers QC
Introduction
- Over three days, the Court administered a case management conference which led to the making of directions for trial in this action. The greater part of the hearing was concerned with disclosure under the Pilot Scheme for Disclosure in the Business and Property Courts, regulated by CPR Practice Direction 51U - Disclosure Pilot for the Business and Property Courts ("CPR PD 51U"). This judgment is concerned with a number of issues which arose in connection with disclosure under CPR PD 51U.
- In UTB LLC v Sheffield United Ltd [2019] EWHC 914 (Ch); [2019] 3 All ER 698, at paragraph 75, the Chancellor said the Pilot Scheme for Disclosure was not a re-serving of CPR Part 31, exemplified by standard disclosure (equivalent to Model D Extended Disclosure under CPR PD 51U), dressed in another garnish. Rather, the Pilot Scheme represents a "culture change" to the management of disclosure in the Business and Property Courts. The Pilot Scheme for Disclosure acts on a recognition that the exponential increase of the creation, storage and dissemination of information and documents and the development of diverse forms of instantaneous communications give rise to real practical difficulties in undertaking an exhaustive disclosure exercise. This means that in many cases a "leave no stone unturned" approach to disclosure is no longer appropriate, having regard to the overriding objective concerns of reasonableness and proportionality (Digicel (St Lucia) Ltd v Cable & Wireless plc [2008] EWHC 2522 (Ch); [2009] 2 All ER 1094, paragraph 46; cf. Smailes v McNally [2014] EWCA Civ 1299, paragraph 42).
Factual background
- The Claimant ("Lonestar") is a telecommunications company providing cellular communication and internet services to its customers in Liberia. It alleges that it was the victim of a large number of distributed denial of service ("DDOS") cyber-attacks between around October 2015 and around February 2017 ("the Alleged DDOS Attacks"). A DDOS attack is a form of cyber-attack in which the perpetrator, often using a network of private computers infected with malicious software known as a "botnet", floods a targeted web server or network with superfluous requests so that the system in question becomes overloaded and temporarily unavailable, with the result that legitimate requests cannot be fulfilled and the services provided by the host of the relevant server or network are disrupted.
- Lonestar alleges that the Alleged DDOS Attacks were deliberately perpetrated by the First Defendant ("Mr Kaye") so as to injure and/or cause loss to Lonestar and that, in carrying out the Alleged DDOS Attacks on Lonestar, Mr Kaye was acting at the instigation of the Second Defendant ("Mr Marziano") and/or pursuant to a combination entered into and/or understanding reached between Mr Kaye, Mr Marziano, and the Fourth Defendant ("Mr Polani").
- At all times material to Lonestar's Claim, Lonestar alleges that Mr Marziano was a director and/or the Chief Executive Officer and/or a senior employee of the Third Defendant ("Cellcom") and/or the Fifth Defendant ("Orange Liberia"), and that Mr Polani was employed by Cellcom and/or Orange Liberia as an ISP (Internet Service Provider) Business Unit Manager. Cellcom had owned what is now Orange Liberia but sold it to the Orange Group on 5th April 2016.
- Cellcom admits that Mr Marziano was its employee and was given the title of "Group CEO" from November 2013 to January 2019 as a courtesy to reflect his time at the Cellcom group, but denies that he was otherwise a director, senior employee or chief executive officer of Cellcom or otherwise its directing mind and will. Cellcom also denies that Mr Polani was its employee at any time, alleging that he was employed by Orange Liberia until at least 5th April 2016.
- Orange Liberia denies that Mr Marziano was its director (save for a temporary appointment of convenience for a few hours on 5th April 2016 in connection with the completion of the sale of Orange Liberia to the Orange group). Orange Liberia further denies that Mr Marziano and Mr Polani were ever its employees; it alleges that they were employed by Cellcom and seconded to Orange Liberia at all material times, with Mr Marziano having been appointed by Cellcom to act as Orange Liberia's CEO prior to the sale of Orange Liberia on 5th April 2016 under the Transitional Services Agreement between Cellcom and Orange Liberia dated 5th April 2016.
- Lonestar alleges that the knowledge and conduct of Mr Marziano are to be attributed to Cellcom and/or Orange Liberia and that Cellcom and/or Orange Liberia are vicariously liable for the conduct of Mr Marziano and/or Mr Polani. Cellcom denies that there was any connection between his limited role at Cellcom and his alleged tortious conduct sufficient to establish any vicarious liability on the part of Cellcom, and that as Mr Polani was never its employee, there is no basis for Cellcom's alleged vicarious liability for the conduct of Mr Polani.
- Orange Liberia is a competitor of Lonestar, and was owned by Cellcom for part of the period during which Lonestar claims that the Alleged DDOS Attacks took place (prior to Cellcom's sale of Orange Liberia to the Orange group on 5th April 2016). Lonestar alleges that Cellcom had a continuing financial interest in the business of Orange Liberia even after it was sold to the Orange group.
- Lonestar claims that, as an intended consequence of the Alleged DDOS Attacks, it has suffered loss in the value of its business and/or loss of profits and it claims damages against the Defendants for lawful means conspiracy and/or unlawful means conspiracy and/or unlawful interference with its business. Lonestar also claims damages against the Defendants in respect of the expenses which it has allegedly incurred in resisting the Alleged DDOS Attacks and/or investigating the Defendants' alleged wrongdoing. Lonestar alleges that its loss of profits claim amounts to at least US$30 million.
- Further and in any event, Lonestar claims exemplary damages.
- Lonestar alleges that the DDOS attacks were planned and implemented in secret, and that its understanding of the Defendants' conduct is limited. Lonestar says that its understanding of Mr Kaye's, Mr Marziano's, and Mr Polani's conduct is based largely on evidence that Lonestar has obtained from certain criminal proceedings in Germany and in the United Kingdom.
- Cellcom and Orange Liberia are the only Defendants to have participated in the proceedings. They make no admissions as to the allegations of tortious conduct made by Lonestar against Mr Kaye, Mr Marziano, and Mr Polani, but they deny liability for the alleged conduct of Mr Marziano and Mr Polani on the basis of either attribution (in respect of Mr Marziano) or vicarious liability (in respect of Mr Marziano and/or Mr Polani).
- Cellcom and Orange Liberia make no admissions as to Lonestar's case as to causation and loss. Cellcom and Orange Liberia also deny the claim for exemplary damages.
- It is common ground as between Lonestar, Cellcom, and Orange Liberia that Lonestar's causes of action, in particular the law governing vicarious liability, are governed by Liberian law, which will be the subject of expert evidence at trial. It is common ground as between Lonestar and Cellcom that the issue of the attribution of Mr Marziano's conduct to Cellcom is governed by the laws of the British Virgin Islands, which the parties have agreed will be deemed to be the same as English law at trial.
Disclosure
- Prior to the hearing, the parties followed the procedure for Extended Disclosure under CPR PD 51U in that, after the exchange of the parties' statements of case, Extended Disclosure was requested, and Lonestar as the Claimant formulated a draft List of Issues for Disclosure in accordance with paragraph 7 of CPR PD 51U. By the time of the hearing, the parties were agreed on the List of Issues for Disclosure save in respect of one issue (to which I turn below).
- The parties were also agreed that Model C Extended Disclosure was required in respect of each of the Issues for Disclosure.
- For this purpose, the parties each prepared a Disclosure Review Document which was the platform for the parties' identification and discussion and, in many cases, agreement of the scope of Model C Extended Disclosure. Paragraph 10.3 of CPR PD 51U requires the parties to engage co-operatively and constructively in this process. Although during the hearing, the parties' submissions were sometimes spirited, I have little doubt that the parties engaged in this exercise in the manner required by CPR PD 51U.
- Nevertheless, division remained. And the battle lines were drawn by reference to the requests made in Section 1B of the Disclosure Review Documents, where the Model C requests and the other parties' responses to those requests were set out (as required by paragraph 10.5 of CPR PD 51U). As I said, many of the disclosure requests that had been in dispute were discussed and resolved by the parties. However, a number of requests remained in dispute. In addition to the disputed Issue for Disclosure, the disclosure hearing was concerned with these disputed requests (which the Court is required to determine in accordance with paragraph 10.7 of CPR PD 51U).
Issues for Disclosure
The parties' submissions
- The parties have identified and agreed the Issues for Disclosure. I shall refer to them when considering the parties' proposals as to the disclosure requests.
- One Issue for Disclosure, however, was not agreed, namely Issue 5(a), as formulated by Lonestar:
"Prior to service of these proceedings, to what extent were Cellcom and Orange Liberia aware of the DDOS attacks on Lonestar (through Mr Marziano and/or Mr Polani and/or otherwise)?"
- Mr Tony Singla, on behalf of Lonestar, submitted that Issue 5(a) should be included as an Issue for Disclosure because the question of whether Cellcom and Orange Liberia had contemporaneous knowledge of the Alleged DDOS Attacks (a term defined by Issue 1 of the Issues for Disclosure) arises directly out of the parties' pleaded cases, and in any event Lonestar is entitled to such disclosure in order properly to understand the Defendants' conduct and fully to particularise its case.
- Both Cellcom and Orange Liberia disputed the inclusion of Issue 5(a) as an Issue for Disclosure, because Lonestar has not pleaded that Cellcom and/or Orange Liberia had knowledge of the Alleged DDOS Attacks, other than through the attribution of the knowledge of Mr Marziano to the corporate defendants.
- In answer to this argument, Lonestar submitted that:
(1) The question whether Cellcom and Orange Liberia had knowledge of the Alleged DDOS Attacks arises directly out of Lonestar's pleaded case in the Amended Particulars of Claim in that (a) Lonestar alleges that Cellcom and/or Orange Liberia are vicariously liable for the conduct of Mr Marziano and/or Mr Polani, (b) Lonestar claims exemplary damages on the grounds that the Alleged DDOS Attacks were calculated by the Defendants (which include Cellcom and Orange Liberia) and Lonestar was deliberately targeted by the Defendants with the objective of causing Lonestar's customers to switch to its competitors, including Orange Liberia, and (c) Lonestar alleges that Orange Liberia carried out marketing initiatives during the period of the Alleged DDOS Attacks which were intended to increase the extent to which Alleged DDOS Attacks caused Lonestar's customers to switch to its competitors, including Orange Liberia.
(2) Cellcom has expressly pleaded a denial that it had any knowledge of the Alleged DDOS Attacks in paragraph 1A of its Amended Defence. Similarly, Cellcom has pleaded at paragraph 9(1)(b) of its Amended Defence that Mr Marziano was not generally authorised to act on behalf of Cellcom and was not instructed by Cellcom to carry out the Alleged DDOS Attacks.
(3) Orange Liberia has also pleaded denials of knowledge of the Alleged DDOS Attacks in paragraphs 5, 24 and 24B of its Amended Defence.
(4) There is no doubt that the Alleged DDOS Attacks took place, as Mr Kaye has pleaded guilty to criminal offences in relation to those attacks, and based on the evidence obtained by Lonestar, Mr Kaye was acting in concert with Mr Marziano and Mr Polani. Nevertheless, given that the Alleged DDOS Attacks were planned and implemented in secret, Lonestar has limited knowledge of the Alleged DDOS Attacks. If any documents exist which evidence Cellcom's and Orange Liberia's knowledge of the Alleged DDOS Attacks other than through the conduct of Mr Marziano and Mr Polani, such documents would be likely to support Lonestar's claim and adversely affect Cellcom's and Orange Liberia's defences, and denying Lonestar disclosure of such documents would prejudice Lonestar's ability to plead and pursue its claims. On the other hand, if no such documents exist, Cellcom and Orange Liberia should have no difficulty in carrying out the necessary searches.
(5) Even if the Court were of the view that Issue 5(a) should not be included as an Issue for Disclosure, this is an exceptional case where an order for disclosure of the type described by the Court of Appeal in The Compagnie Financiere et Commerciale Du Pacifique v The Peruvian Guano Company (1882) 11 QBD 55 is justified as this is a case involving an allegation of serious wrongdoing, because a wider scope of disclosure may be ordered where the knowledge or state of mind of one party is in issue. In this respect, Mr Singla relied on the judgment of Master Kaye in Kings Security Systems Ltd v King [2019] EWHC 3620 (Ch), paragraphs 30-37.
- Ms Sonia Tolaney QC and Mr Tim Goldfarb on behalf of Cellcom submitted that Issue 5(a) is not a proper Issue for Disclosure, because it refers to the knowledge of the corporate defendants, namely Cellcom and Orange Liberia, of the Alleged DDOS Attacks, as distinct from any knowledge of Mr Marziano and Mr Polani, and there is no pleaded allegation of any such knowledge. In particular, Cellcom submitted that:
(1) Lonestar's only pleaded case as to Cellcom's knowledge of the Alleged DDOS Attacks is that Mr Marziano knew of the Alleged DDOS Attacks and that his knowledge falls to be attributed to Cellcom (paragraph 24 of the Amended Particulars of Claim), but there is no pleaded case that any other individual whose knowledge is to be attributed to Cellcom was aware of the Alleged DDOS Attacks.
(2) Mr Marziano's knowledge of the Alleged DDOS Attacks is the subject of Issue 2(a), which states "What was the involvement (if any) of Mr Marziano and Mr Polani in the Alleged DDOS Attacks?" and his role at Cellcom is embraced by Issue 3 which states "What was the role of Mr Marziano at Cellcom and Orange Liberia at all times material to the claim?". Accordingly, any disclosure concerned with Mr Marziano's knowledge will be catered for by Issue 2(a) and, if relevant to the issue of attribution of knowledge, Issue 3. Insofar as there is an issue concerning Mr Marziano's authority granted by Cellcom, that is dealt with by a separate disclosure request (request 35).
(3) It is not alleged by Lonestar that Mr Polani's knowledge is attributable to Cellcom, but even if it were, his knowledge is also covered by Issue 2(a).
(4) Lonestar's case on the vicarious liability of Cellcom is based on the scope of Mr Marziano's and Mr Polani's employment and their role within Cellcom. It is not based on any allegation of independent knowledge.
(5) Lonestar relies on Issue 5(a) to justify a large number of requests for documents, but Lonestar has not advanced a case that anyone at Cellcom other than Mr Marziano knew of the Alleged DDOS Attacks and it cannot be allowed to conduct a fishing expedition. Even a Peruvian Guano disclosure order must take its lead from the pleaded issues in dispute. In any event, all Extended Disclosure models, except Model E, do not include so wide a disclosure order as a Peruvian Guano order.
(6) The claim for exemplary damages is not based on the identification of any individual whose knowledge would be attributed to the corporate defendants, other than Mr Marziano and Mr Polani.
- Mr Neil Kitchener QC and Mr Andrew Lodder on behalf of Orange Liberia also objected to the inclusion of Issue 5(a) because the only pleaded issue as to Orange Liberia's knowledge is the knowledge of Mr Marziano, whose knowledge is identified as an Issue for Disclosure as Issue 2 and whose role is encompassed by Issue 3. Mr Kitchener QC largely adopted Ms Tolaney QC's submissions and added that Mr Polani's knowledge is not pleaded as being attributable to Cellcom and Orange Liberia, but in any event Mr Polani's knowledge is an Issue for Disclosure as Issue 2 and his role is encompassed by Issue 4. The inclusion of Issue 5(a) is an unjustifiable attempt to cast a wider net for disclosure in "the speculative hope of finding something to support a case that is not pleaded". Importantly, it is said, the knowledge of Cellcom and Orange Liberia, other than by attribution of Mr Marziano's knowledge, is not in issue on the statements of case. As a result, Issue 5(a) does not pass the first hurdle of being a pleaded issue to be included as an Issue for Disclosure. Thus, Orange Liberia argued, disclosure based on Issue 5(a) is not necessary, reasonable or proportionate or practicable for Orange Liberia and that Lonestar is not entitled to embark on a fishing expedition for documents in relation to an allegation which has not been made and which would require a wide-ranging, unfocussed and expensive disclosure exercise.
- In answer to this last submission, Mr Singla on behalf of Lonestar argued that in fact the disclosure requests are Model C requests and are narrowly formulated.
- Mr Kitchener QC also submitted that it is likely that, if there are any documents that reveal that anyone besides Mr Marziano and Mr Polani was aware of the Alleged DDOS Attacks and of Mr Marziano's and Mr Polani's involvement in the Alleged DDOS Attacks, those documents will be relevant to one or more of the other Issues for Disclosure and will be disclosable in any event. In addition, the Defendants are subject to a continuing obligation to disclose known adverse documents, including documents of which they become actually aware during the course of searches carried out under Model C (CPR PD 51U, paragraph 3.1(2)). However, Mr Singla countered that searches need to be undertaken before such documents will become known to the Defendants.
Identifying the Issues for Disclosure
- CPR PD 51U, paragraph 7.3 defines the Issues for Disclosure to mean "for the purposes of disclosure only those key issues in dispute, which the parties consider will need to be determined by the court with some reference to contemporaneous documents in order for there to be a fair resolution of the proceedings. It does not extend to every issue which is disputed in the statements of case by denial or non-admission". Paragraph 7.4 requires that the draft List of Issues for Disclosure provide "a fair and balanced summary of the key areas of dispute identified by the parties' statements of case and in respect of which it is likely that one or other of the parties will be seeking Extended Disclosure".
- In McParland & Partners Ltd v Whitehead [2020] EWHC 298 (Ch); [2020] Bus LR 699, the Chancellor explained the intended operation of the Pilot Scheme for Disclosure. In particular, the Pilot Scheme is intended to apply across a wide range of cases, from the most complex and high value to the simpler and low value cases. The particular approach to disclosure, and in particular the type of Extended Disclosure, are governed by notions of reasonableness and proportionality as understood by the overriding objective. For this purpose, having regard to paragraph 6.4 of CPR PD 51U and paragraph 3 of the Chancellor's judgment, the Court should take into account the particular features of the case, including the nature and complexity of the issues, the importance of the case, the likelihood that probative documents exist and are accessible, the number of documents which would be involved in a search (if relevant), review and disclosure, the ease and expense of carrying out any search and retrieving documents, the financial position of the parties, and the manner in which the case should be managed and tried (for example, whether costs should be limited or the trial should take place expeditiously).
- At paragraphs 44-47, the Chancellor considered the identification of Issues for Disclosure:
"44. The starting point for the identification of the issues for disclosure will in every case be driven by the documentation that is or is likely to be in each party's possession. It should not be a mechanical exercise of going through the pleadings to identify issues that will arise at trial for determination. Rather it is the relevance of the categories of documents in the parties' possession to the contested issues before the court that should drive the identification of the issues for disclosure
46. It can be seen, therefore, that issues for disclosure are very different from issues for trial. Issues for disclosure are issues to which undisclosed documentation in the hands of one or more of the parties is likely to be relevant and important for the fair resolution of the claim. That is why paragraph 7.3 of PD51U provides that issues for disclosure are "only those key issues in dispute, which the parties consider will need to be determined by the court with some reference to contemporaneous documents in order for there to be a fair resolution of the proceedings" (emphasis added). Paragraph 7.3 goes on to explain, as I just have, that issues for disclosure do "not extend to every issue which is disputed in the statements of case by denial or non-admission".
47. This explanation demonstrates that, in many cases, the issues for disclosure need not be numerous. They will almost never be legal issues, and they will not include factual issues that are already capable of being fairly resolved from the documents available on initial disclosure."
- It follows from this that the Issues for Disclosure must also be issues crystallised in the statements of case. It is not every pleaded issue which should become an Issue for Disclosure; only a key issue in dispute should be identified as an Issue for Disclosure. The identification of the Issue for Disclosure must not become tangled in a complex distillation of issues, both great and small, thrown up by the statements of case (in McParland & Partners Ltd v Whitehead [2020] EWHC 298 (Ch); [2020] Bus LR 699, at paragraph 57, the Chancellor said that "Unduly granular or complex lists of issues for disclosure should be avoided. Likewise, the models chosen should simplify the process rather than complicate it"). That said, if the relevant issue is not a pleaded issue, an issue which emerges from the parties' contrary cases in the pleadings, it cannot be formulated as an Issue for Disclosure.
The parties' statements of case
- For the purposes of determining whether Issue 5(a) should be retained as an Issue for Disclosure, it is therefore necessary to examine the issues as pleaded. Lonestar's Amended Particulars of Claim included the following allegations:
"9. Lonestar's case in summary is that
9.1 The DDOS attacks were deliberately perpetrated by Mr Kaye so as to injure and/or cause loss to Lonestar and that in carrying out the DDOS attacks Mr Kaye was acting at the instigation of Mr Marziano and/or pursuant to a combination entered into and/or understanding reached between himself, Mr Marziano, and Mr Polani.
9.2 Lonestar further alleges that Mr Marziano's knowledge and conduct is to be attributed to Cellcom and/or Orange Liberia and in any event Cellcom and/or Orange Liberia are vicariously liable for the conduct of Mr Marziano and/or Mr Polani
10. The DDOS attacks on Lonestar were planned and implemented in secret and accordingly at present Lonestar's understanding of the Defendants' conduct is limited. The particulars set out below and in the Annex to these Particulars of Claim are the best particulars of the Defendants' conduct which Lonestar is presently able to provide. However, Lonestar reserves the right to amend these Particulars of Claim and plead further in due course, in particular in light of the Defendants' disclosure
22. Lonestar's case is that:
22.11. In return for carrying out the DDOS attacks on Lonestar Mr Kaye received payment from Mr Marziano in the amount of at least US$20,000. Mr Marziano also reimbursed Mr Kaye for certain out-of-pocket expenses incurred by him in connection with his perpetration of the DDOS attacks on Lonestar. Lonestar does not presently know the ultimate source of the funds used by Mr Marziano to pay Mr Kaye (for example if Mr Marziano used his personal funds or the funds of Cellcom or Orange Liberia) and Lonestar reserves the right to plead further in this regard in due course, in particular in the light of the Defendants' disclosure.
22.12. During the period of the DDOS attacks, Mr Marziano arranged for Orange Liberia to take various marketing initiatives (including promotional offers specifically targeted at or communicated to Lonestar's customers) which were intended to increase the extent to which the DDOS attacks caused Lonestar's customers to switch to Lonestar's competitors in Liberia, in particular Orange Liberia
24. Given Mr Marziano's role as a director and/or the Chief Executive Officer and/or a senior employee of Cellcom and/or Orange Liberia at all times material to the present claim, Lonestar will say that he was the directing mind and will of Cellcom and/or Orange Liberia and/or is to be identified with Cellcom and/or Orange Liberia with the result that his knowledge of and participation in the lawful means and unlawful means conspiracies pleaded above (as well as his other tortious conduct) is to be attributed to Cellcom and/or Orange Liberia and Cellcom and/or Orange Liberia in its own right for that conduct
25. Further and in any event, Lonestar will say that Cellcom and/or Orange Liberia is vicariously liable for the tortious conduct of Mr Marziano as pleaded above and Cellcom and/or Orange Liberia is vicariously liable for the tortious conduct of Mr Polani as pleaded above on the basis that their tortious conduct was carried out in the course of their employment and/or there was a sufficiently close connection between the tortious conduct of Mr Marziano and Mr Polani and their respective roles at Cellcom and/or Orange Liberia
29. Further and in any event, Lonestar claims exemplary damages against the Defendants. In support of the foregoing Lonestar will say (amongst other things) that:
29.1. The DDOS attacks were calculated by the Defendants to make a profit for themselves which might exceed the compensation payable to Lonestar
29.2. Lonestar was deliberately targeted by the Defendants and the specific objective of the DDOS attacks was to disrupt Lonestar's provision of cellular communication and internet services to such an extent that this would cause Lonestar's customers to switch to Lonestar's competitors in Liberia, in particular Orange Liberia; and/or
30. An award of exemplary damages would be just in order to punish and deter the type of deliberate wrongdoing committed by the Defendants
"
- Cellcom's case in its Amended Defence is pleaded as follows:
"1A. Cellcom is a corporate defendant and the claims against it are asserted only on the basis that it is vicariously liable for the conduct of the Second and Fourth Defendants, who are individuals, and on the basis that the conduct of the Second Defendant falls to be attributed to it. Cellcom has no knowledge of the tortious conduct alleged against the First, Second and Fourth Defendants and denies that it is liable for any such conduct. In the circumstances, and as further pleaded below, Cellcom is not in a position to admit or deny the detail of the factual allegations made against the individual Defendants
9. As to the summary of Lonestar's claim at paragraphs 7 to 10:
(1) The case against Cellcom is advanced on the basis that the alleged tortious conduct of Mr Marziano (which is not admitted) is to be attributed to Cellcom or, alternatively, that Cellcom is vicariously liable for Mr Marziano's alleged conduct. This case is not sustainable for the following reasons:
(a) First, as pleaded at sub-paragraph 5(2)(a) above, Mr Marziano is not and has never been a director of Cellcom and it is in any event denied that Mr Marziano was at any time Cellcom's directing mind and will. The directing mind and will of Cellcom is and was at all material times its board of directors acting as such.
(b) Second, Mr Marziano's role at Cellcom was limited and sub-paragraph 5(2)(f) above is repeated in this regard. Mr Marziano had no general authority to act on behalf of Cellcom, and was not instructed or authorised by Cellcom to carry out any cyber-attack on Lonestar, or enter into any combination with Mr Polani or Mr Kaye to injure Lonestar or interfere with its business.
(c) Third, the alleged conduct of Mr Marziano (which is not admitted), had nothing to do with his limited role at Cellcom both before and after the sale of the Transferred Company. In any event, Mr Marziano's alleged conduct was entirely outside of Cellcom's control or oversight following the sale of the Transferred Company. Sub-paragraph 5(2)(l) above is repeated.
10. As to paragraphs 11 to 19:
(1) Cellcom has no direct knowledge of the matters pleaded in these paragraphs
12. As to paragraph 22:
(2) Cellcom is a corporate defendant and the facts and matters pleaded in subparagraphs 22.1 to 22.10 concern alleged conduct of the three individual Defendants. It is denied that the alleged conduct or knowledge of the three individual Defendants (if it occurred) falls to be attributed to Cellcom or that Cellcom is vicariously liable for such conduct
(3) Sub-paragraph 22.11 is not admitted save that it is denied that Cellcom was the source of any funds used to pay Mr Kaye (if any such funds were paid as alleged or at all, which is not admitted)
14. Paragraph 24 is denied:
(1) Mr Marziano is not and has never been the directing mind and will of Cellcom and was not authorised to act on behalf of Cellcom generally or in relation to any cyberattack on Lonestar. Sub-paragraphs 5(2) and 9(1) above are repeated
(2) In the premises, it is denied that the alleged conduct of Mr Marziano (which is not admitted) is to be attributed to Cellcom
15. Paragraph 25 is denied in so far as it pertains to Cellcom, and is not admitted in so far as it pertains to the Transferred Company:
(1) Cellcom is not vicariously liable for the alleged tortious conduct of Mr Marziano as there is no sufficient connection between Mr Marziano's position at Cellcom and his alleged conduct. Further or alternatively, Cellcom is not vicariously liable for the alleged tortious conduct of Mr Marziano after the sale of the Transferred Company on 5 April 2016. Sub-paragraphs 5(2) and 9(1) above are repeated.
(2) No admission is made as to whether the Transferred Company is vicariously liable for the alleged tortious conduct of Mr Polani. Cellcom is not vicariously liable for the alleged tortious conduct of Mr Polani. Mr Polani has never been an employee of Cellcom or otherwise in a position which could give rise to vicarious liability for Cellcom
(3) As to sub-paragraph 29.1:
(a) It is denied that Cellcom calculated to make a profit from any attacks on Lonestar
(4) As to sub-paragraph 29.2, it is denied that Cellcom deliberately targeted Lonestar or had any objective to disrupt Lonestar's business. Cellcom had no possible interest in the disruption of Lonestar's business after (at the latest) 5 April 2016
(5) As to paragraph 30, it is denied that it would be just to make an award of exemplary damages against Cellcom in circumstances where (a) Cellcom did not and could not profit from the alleged cyber-attacks; (b) Cellcom had no control at the relevant time over the individuals said to have been involved in the tortious conduct; and / or, in any event, (c) if Cellcom were to be found liable only on the basis of vicarious liability."
- In Orange Liberia's Amended Defence, it is pleaded that:
"5. In the circumstances set out above, Orange Liberia has responded to the Amended Particulars of Claim to the best of its knowledge and ability at this time. However, the Amended Particulars of Claim contain many unparticularised, vague and embarrassing allegations to which Orange Liberia cannot plead without proper particulars of the relevant allegations being provided by Lonestar. Further, many of the factual matters addressed in the Amended Particulars of Claim are outside Orange Liberia's knowledge and it is consequently unable to admit or deny such allegations
24. It is noted that Lonestar's case comprises the allegations in paragraph 22. In respect of each of the individual allegations in sub-paragraphs 22.1-22.11, Orange Liberia does not know the true position and therefore does not admit the allegation, except insofar as expressly admitted in paragraphs 24A-24C below. Save for these limited admissions, Lonestar is put to strict proof of each of the allegations therein
24B. As to the further particulars of the alleged DDoS attacks referred to in paragraph 22.4A and pleaded in paragraphs 1-9 of the Annex to the Amended Particulars of Claim (references to paragraphs in the rest of this paragraph are to paragraphs of the Annex unless otherwise stated):
24B.1 Save as specifically admitted below, Orange Liberia has no direct knowledge of the facts and matters pleaded in paragraphs 1-9 of the Annex and is unable to admit or deny the allegations therein, which are therefore not admitted
24D. As regards paragraph 22.12:
24D.1 It is admitted that Orange Liberia carried out various marketing initiatives, including promotional offers, in between October 2015 and February 2017 in the ordinary course of its business.
24D.2 It is denied that these marketing initiatives and promotional offers were specifically targeted at or communicated to Lonestar's customers. They were targeted at and communicated to Liberian telecommunications users generally.
24D.3 Save as aforesaid, paragraph 22.12 is not admitted.
30. As to paragraph 29:
30.2. It is denied that Orange Liberia had any prior knowledge of the DDoS attacks or intended to make a profit for itself that might exceed the compensation payable to Lonestar. The allegation is so vague as to be embarrassing
31B. As to paragraph 30B:
31B.3
(b) As a matter of Liberian law, Orange Liberia is not vicariously liable for the conduct of Mr Marziano and/or Mr Polani, who were not its employees at any relevant time.
(c) As a matter of Liberian law, an employer or principal is not liable for (i) acts outside the scope of the employment or agency or (ii) wilfully wrongful, illegal or tortious acts within the scope of the employment or agency, except in either case where the acts in question were done with the employer or principal's authorisation or ratification."
- In its Reply, Lonestar joined issue with the Amended Defences of Cellcom and Orange Liberia.
Decision on Issue 5(a)
- Lonestar's claim is based on serious allegations of intentional tortious conduct. The evidence in support of the Alleged DDOS Attacks, said Mr Singla, is overwhelming. The thrust of Lonestar's claim against Cellcom and Orange Liberia is based on their responsibility for these alleged attacks by reason of the conduct of Mr Marziano and Mr Polani, who Lonestar alleges held roles and authority within the corporate defendants.
- As corporate defendants, any knowledge or intention which Cellcom and/or Orange Liberia had must reside in an individual or individuals whose knowledge or intention can be attributed to the relevant company so that it can be said, as a matter of law, that the company had that knowledge or intention. The circumstances in which such attribution can take place depends on a number of factors depending on the causes of action relied on, the nature and seriousness of the conduct, and the position, seniority, role and authority of the individuals within the company.
- Lonestar has pleaded that Mr Marziano's knowledge is to be attributed to each of Cellcom and Orange Liberia.
- Lonestar has also pleaded a case based on vicarious liability, based on a close connection between the Alleged DDOS Attacks allegedly carried out by Mr Marziano and Mr Polani and their alleged employment within Cellcom and Orange Liberia. Ms Tolaney QC said that that case was not based on the knowledge of any individual within the corporate defendants other than Mr Marziano and Mr Polani.
- Lonestar has carefully pleaded its case so that the question of any liability of Cellcom and Orange Liberia is to be determined by reference to these two individuals.
- There is no plea in the Particulars of Claim or the Reply that any other individual within Cellcom or Orange Liberia had relevant knowledge which could be attributed to those companies in respect of the Alleged DDOS Attacks or which could be relevant to the plea of vicarious liability. Indeed, insofar as the issue of Cellcom's authority has been raised by Cellcom's Amended Defence, it is limited to Mr Marziano's role.
- In those circumstances, the inclusion of Issue 5(a) - which asks "to what extent were Cellcom and Orange Liberia aware of the DDOS attacks on Lonestar (through Mr Marziano and/or Mr Polani and/or otherwise)?" - goes beyond the pleaded issues at least insofar as the words "and/or otherwise" are concerned. Both Ms Tolaney QC and Mr Kitchener QC submitted that the knowledge of Mr Marziano and Mr Polani, and their roles within Cellcom and Orange Liberia, are addressed as Issues for Disclosure within Issues 2, 3 and 4. Accordingly, if the words "and/or otherwise" were deleted, the remaining part of Issue 5(a) would add nothing to the remaining Issues for Disclosure. If it were otherwise, I would have been inclined to retain Issue 5(a) and amend it to remove the words "and/or otherwise". However, there is no purpose to be served in including that amended issue, if it is encapsulated by Issues 2, 3 and 4.
- The absence of a pleaded issue of any knowledge on the part of any individual other than Mr Marziano or Mr Polani renders it impossible to include a wider Issue for Disclosure to encompass the knowledge of other individuals who are not identified or even described (insofar as they could not be identified) within the statements of case. As the Chancellor has said, and paragraphs 7.3 and 7.4 of CPR PD 51U make clear, an Issue for Disclosure must be an issue which is identified as an issue in dispute in the statements of case. If any identified issue is not a pleaded issue, it cannot be an Issue for Disclosure.
- Mr Singla's candid answer to this, as reflected in Lonestar's statement of case, is that there is much within the walls of Cellcom and Orange Liberia which is unknown to Lonestar and the existence of any disclosure will facilitate Lonestar in advancing a particularised case by reference to any other individuals. However, no matter how attractively this consideration was presented, the fact remains that it inverts the usual order in which Issues for Disclosure should be formulated and documents should be disclosed. The ambit of any disclosure must follow the pleaded issues; such disclosure should not go beyond the pleaded issues merely to allow further articulation of a pleaded case.
- I should make it clear that if the knowledge of any individual other than Mr Marziano or Mr Polani was a pleaded issue, Issue 5(a) would plainly have been a "key" issue for inclusion within the Issues for Disclosure. However, as matters stand, it is not eligible as an Issue for Disclosure.
- That brings me to Mr Singla's reliance on two additional considerations. First, the fact that both Cellcom and Orange Liberia have pleaded that they have no knowledge of the tortious conduct alleged (in particular, paragraph 1A of Cellcom's Amended Defence and paragraph 5 of Orange Liberia's Amended Defence), to which Lonestar has joined issue in its Reply. Accordingly, Mr Singla argued, the question of the knowledge of natural persons within Cellcom and Orange Liberia, other than Mr Marziano and Mr Polani, have been put in issue in the statements of case. However, in both instances, Cellcom and Orange Liberia have pleaded this lack of knowledge as an explanation for their non-admission or their inability to admit or deny certain facts. This is plain from a simple reading of paragraph 1A of Cellcom's Amended Defence and paragraph 5 of Orange Liberia's Amended Defence. CPR rule 16.5(1) contemplates that a party responding to a statement of case must admit, deny or not admit an allegation and that a non-admission is appropriate where the responding party is unable to admit or deny the allegation. I do not read these pleas by Cellcom and Orange Liberia as a means to raise a positive allegation of a lack of knowledge on the part of any natural person other than Mr Marziano and Mr Polani in answer to Lonestar's case: there is no identification by the corporate defendants of any such individual and it does not make sense in the context of the plea. Of course, I would anticipate that Cellcom and Orange Liberia may well adduce factual evidence on the part of certain of their officers explaining that they lacked knowledge of the Alleged DDOS Attacks, but that does not mean that there is a specifically raised issue in the statements of case that any persons other than those identified by Lonestar have any relevant knowledge. Accordingly, I do not consider that the issue of knowledge of any individual other than Mr Marziano and Mr Polani is introduced by the Amended Defences.
- The second consideration is the claim for exemplary damages made by Lonestar as set out in paragraph 29 of the Amended Particulars of Claim. In that paragraph, Lonestar pleads that the Alleged DDOS Attacks were calculated by the Defendants (including Cellcom and Orange Liberia) to make a profit for themselves and that Lonestar was deliberately targeted by the Defendants, whose specific objective of the Alleged DDOS Attacks was to disrupt Lonestar's provision of cellular communication and internet services to its customers.
- The claim for exemplary damages is plainly dependent on the pleaded allegations as to Cellcom's and Orange Liberia's alleged liability for the tortious conduct of Mr Marziano and Mr Polani. If the pleaded causes of action are not based on the knowledge of any natural person other than these two individuals, it is difficult to see how the claim for a remedy, such as exemplary damages, could be said to broaden the pleaded issues as to the knowledge and intention of relevant individuals. Accordingly, this second consideration does not assist Lonestar in its argument that Issue 5(a) must be included within the Issues for Disclosure.
- Therefore, in my judgment, Issue 5(a) should be removed from the Issues for Disclosure. This is on the understanding that the issues of Mr Marziano's and Mr Polani's knowledge are embraced by Issues 2, 3 and 4. It should be remembered, as Mr Kitchener QC observed, that the disclosing parties remain under an obligation to disclose known adverse documents (paragraphs 3.1(2) and 8.3, Model C, sub- paragraph (3) of CPR PD 51U).
The Model C requests for disclosure
Model C Extended Disclosure
- I now move on to the specific Model C requests for disclosure which are still the subject of dispute.
- Lonestar has requested some 55 categories of disclosure from Cellcom and/or Orange Liberia. Cellcom and Orange Liberia have requested some 40 categories of disclosure from Lonestar. Many of these categories can be sub-divided into more than one category. Cognisant of the duty of co-operation upon the parties and their legal representatives (at paragraphs 2.3, 3.2(3), 7.6 and 10.7 of the CPR PD 51U), the parties have agreed the terms of many of these requests. This measure of constructive co-operation is a necessary and central tenet of the Pilot Scheme for Disclosure (McParland & Partners Ltd v Whitehead [2020] EWHC 298 (Ch); [2020] Bus LR 699, paragraphs 53, 58).
- There remain, however, certain requests for disclosure which are in dispute and which the Court is required to resolve. All of these requests are made in connection with Model C Extended Disclosure, which the parties have agreed is the appropriate model for these categories of disclosure. In this respect, the Court sees no reason why Model C is not appropriate.
- Model C in one sense occupies an implicitly preferred position within the choices available amongst the Extended Disclosure models in that the more expansive models of Extended Disclosure, Models D and E, should be selected by the parties and approved by the Court where Model C is not appropriate or sufficient (paragraph 6.5 of CPR PD 51U). Indeed, the wider Models D and E are not to be presumed as the appropriate Models for Extended Disclosure (paragraph 8.2 of CPR PD 51U).
- In considering the scope of the requests in respect of each of the disputed categories for Model C disclosure, the objective is to identify the minimum level of documentation which must be searched for, reviewed and disclosed in order to allow the fair resolution of the particular Issue or Issues for Disclosure to which the category of documentary request relates (paragraph 6.6 of the CPR PD 51U).
- Paragraph 6.4 of CPR PD 51U provides that in all cases, including Model C, the resulting order for Extended Disclosure, which in the case of Model C is defined in part by the permitted requests, must be reasonable and proportionate having regard to the overriding objective including the following factors (1) the nature and complexity of the issues in the proceedings; (2) the importance of the case, including any non-monetary relief sought; (3) the likelihood of documents existing that will have probative value in supporting or undermining a party's claim or defence; (4) the number of documents involved; (5) the ease and expense of searching for and retrieval of any particular document (taking into account any limitations on the information available and on the likely accuracy of any costs estimates); (6) the financial position of each party; and (7) the need to ensure the case is dealt with expeditiously, fairly and at a proportionate cost.
- CPR PD 51U describes Model C in the following terms:
"Model C: Request-led search-based disclosure
(1) The court may order a party to give disclosure of particular documents or narrow classes of documents relating to a particular Issue for Disclosure, by reference to requests set out in or to be set out in Section 1B of the Disclosure Review Document or otherwise defined by the court.
(2) If the parties cannot agree that disclosure should be given, or the disclosure to be given, pursuant to a request, then the requesting party must raise the request at the case management conference. The court will determine whether the request is reasonable and proportionate and may either order the disclosing party to search for the documents requested, refuse the request, or order the disclosing party to search for a narrower class of documents than that requested. Any appropriate limits to the scope of the searches to be undertaken will be determined by the court using the information provided in the Disclosure Review Document.
(3) For the avoidance of doubt, a party giving Model C Disclosure must still comply with the duty under paragraph 3.1(2) above to disclose known adverse documents; these will include any arising from the search directed by the court."
- Thus, in dealing with each of the proposed requests for Model C disclosure, the Court can allow the request to stand, refuse the request, or modify the request to a narrower scope. In deciding the scope of Model C disclosure, the Court must be able to relate the request to a particular Issue or particular Issues for Disclosure, to ensure that the request concerns the disclosure of particular documents (i.e. individual documents which can be identified or described) or a narrow class of documents. Model C does not contemplate an unduly expansive or ill-defined category of documents requiring disclosure. Furthermore, the documents requested must be capable of precise description, whether individually or by class, to ensure and allow that the disclosing party is in a position to understand what must be disclosed such that when the relevant category of document is searched for, it can be recognised, without too much difficulty, as requiring disclosure. This consideration is reflected in the explanatory notes relating to Section 1B of the Disclosure Review Document set out in Appendix 2 to CPR PD 51U, which provides at paragraph 3
"The parties' requests should be focused and concise in order that the responding party may be clear as to the particular document(s) or narrow classes of documents relating to a particular Issue for Disclosure for which it is being asked to undertake searches. Broad and wide-ranging formulations such as "any or all documents relating to
" should not be used."
- The overarching consideration is that of reasonableness and proportionality.
- In considering the relevant factors to be considered as enumerated in paragraph 6.4 of CPR PD 51U, the Court should be in a position to form a view, even a preliminary view, as to how the action measures up to these factors. In this case, the statements of case reveal the nature of the issues and that they are issues which may well be complex; the case raises important issues in the context of cyber risks and, of course, the value of the claim is substantial; the likelihood of documents existing having a probative value depends in many respects on the outcome of the issues in dispute, although I take Lonestar's point that one of the perpetrators has pleaded guilty to offences relating to the Alleged DDOS Attacks. However, as to the number of documents involved, the ease and expense of searching for and retrieving any particular document, and the financial position of each party, there was little, if any, evidence before the Court which was of meaningful assistance to guide the exercise of the Court's judgment or discretion in these respects. During the hearing, the Court was informed that the number of relevant documents involved in the disclosure exercise might count into the tens or hundreds of thousands. Thus, in this respect, other than the number being sufficiently large, there is no concrete information for the Court to consider.
- With these introductory remarks, I now turn to each of the disputed requests for Model C Extended Disclosure.
- Issue 5(a) was also relied upon in support of a number of Lonestar's requests, but as that issue has now been omitted, it is no longer a factor in the equation. Accordingly, any submissions made by Lonestar in support of its requests by reference to that issue alone are not relevant and I will not consider them.
Lonestar's requests 1(b), 2 and 3
- Lonestar's request 1(b) requests disclosure of:
"(b) To the extent not covered by Request 1(a), documents (including any communications) created by any senior human resources, finance, information technology or marketing personnel (or their equivalents) within Cellcom and/or Orange Liberia (or to which any of them were party) between July 2015 to 3 October 2018 referring to:
i. the Alleged DDOS Attacks on Lonestar; and/or
ii. the extent, duration and effect of those attacks on Lonestar."
- Lonestar's request 2 relates to disclosure of:
"To the extent not covered by Requests 1, 16, 17, 21, 22 or 41, communications (and documents recording or evidencing any communications) created by or sent to Cellcom's board of directors (including any individual directors) and/or any of its shareholders between July 2015 to 22 January 2019 referring to:
(a) the Alleged DDOS Attacks on Lonestar; and/or
(b) the extent, duration and effect of those attacks on Lonestar;
(c) Mr Marziano and/or Mr Polani's role and responsibilities in Cellcom and/or Orange Liberia."
- Lonestar's request 3 relates to disclosure of:
"To the extent not covered by Requests 1, 16, 17, 21, 22 or 42, communications (and documents recording or evidencing any communications) created by or sent to Orange Liberia's board of directors (including any individual directors) and/or any of its shareholders between July 2015 to 3 October 2018 referring to:
(a) the Alleged DDOS Attacks on Lonestar; and/or
(b) the extent, duration and effect of those attacks on Lonestar;
(c) Mr Marziano and/or Mr Polani's role and responsibilities in Cellcom and/or Orange Liberia."
- Lonestar contended that requests 1(b), 2 and 3 are justified because they are relevant to Issues for Disclosure 1(b)-(d), 2, 5 and 7(b). Issue 1 is concerned with the carrying out and timing of the Alleged DDOS Attacks; Issues 2 and 5(b) are concerned with Mr Marziano's, Mr Polani's and Mr Kaye's roles in the Alleged DDOS Attacks; Issue 7(b) is concerned with the extent to which any benefits received by the Defendants by reason of the Alleged DDOS Attacks were intended, being an issue relevant to the claim for exemplary damages.
- In addition, requests 2 and 3 are relevant to Issues 3 and 4, which are concerned with the roles of Mr Marziano and Mr Polani at Cellcom and/or Orange Liberia.
- Mr Singla, on behalf of Lonestar, submitted that these requests go to the heart of the issues in dispute, given that the question whether the Alleged DDOS Attacks, involving Mr Marziano, Mr Polani and Mr Kaye, occurred is in dispute; and that the documents requested relate to the disclosure of a "narrow pool of documents that refer to the DDOS Attacks and to which senior employees in relevant areas within Cellcom and Orange Liberia were party". These documents are relevant, it is argued, in order to determine whether and the extent to which documentation relating to the Alleged DDOS Attacks were copied or communicated to senior personnel at Cellcom and/or Orange Liberia in key areas of their business, being relevant to whether the Alleged DDOS Attacks occurred and their impact. The request is said to be narrow as it is limited only to senior employees and the date range of July 2015 to October 2018 is narrower than the date range which the parties have agreed in respect of request 1(a).
- Ms Tolaney QC on behalf of Cellcom objected to this request on the grounds that it is irrelevant to the pleaded issues and is unreasonable and disproportionate, and insofar as it is relevant, other requests for disclosure are adequate to the task (in particular, request 44 is relevant to the plea at paragraph 22.12 of the Amended Particulars of Claim, quoted above). Further, Cellcom has agreed to requests in respect of documents created by Mr Marziano and Mr Polani and to their alleged participation in the Alleged DDOS Attacks. Finally, it is said that these requests are an obvious fishing expedition. Cellcom objected to requests 2(a) and (b), but not request 2(c), for the same reasons as Issue 5(a) was opposed by Cellcom.
- Mr Kitchener QC on behalf of Orange Liberia, objected to these requests on the grounds that they were too broad and wide-ranging and contravene the intention of Model C disclosure to give rise to narrowly focussed requests which can be acted upon by the disclosing party with a clear sense of what must be searched for and disclosed. In addition, the request would require a search across the "document universe identified in Orange Liberia's Section 2". Accordingly, it is argued, request 1(b) is in effect a request for Model D (or standard) disclosure. Like Cellcom, Orange Liberia agrees to request 1(a) relating to documents created by Mr Marziano, Mr Polani and Mr Kaye and objected to requests 2 and 3 for the reasons that they opposed Issue 5(a). In addition, Mr Kitchener QC argued that requests 2 and 3 are standard disclosure requests requiring Orange Liberia to expand the pool of custodians to include every director and shareholder (although at the relevant time Cellcom was Orange Liberia's only shareholder) and these requests would result in duplication and unnecessarily expensive and unfocussed disclosure. Although Orange Liberia formally objected to request 3(c), I think Mr Kitchener QC accepted that the documents falling within that request would be embraced by request 1(a).
- Mr Singla responded to the Defendants' submissions by pointing out that the requests are limited to defined senior officers, directors and shareholders, and the senior officers are only those relating to certain departments, namely human resources, finance, information technology or marketing. The parties have not yet embarked on discussions concerning the identity of custodians and the keyword searches to be undertaken.
- Request 1(b) is concerned with documents created by senior officers within specified corporate departments (or documents to which such senior officers were a party) which refer to the Alleged DDOS Attacks on Lonestar, the extent, duration and effect of those attacks on Lonestar. Requests 2 and 3 are similar but are concerned with documents created by or sent to directors and shareholders of Cellcom and Orange Liberia referring to the same matters, and, in addition to Mr Marziano and/or Mr Polani's roles and responsibilities in Cellcom and/or Orange Liberia.
- The existence, timing and effect of the Alleged DDOS Attacks are directly in issue on the statements of case and they are plainly key issues. The requests for documents in the custody of senior officers, directors and shareholders of Cellcom and/or Orange Liberia are, in my judgment, legitimate requests for disclosure. Had the parties not agreed to a Model C request, I would consider that a Model D request would have been justified. Nevertheless, as Model C is the Extended Disclosure model the parties have agreed upon, the fact remains that the requests must be narrowly focussed and the disclosing parties must be in a position to understand those requests so that they can be implemented with a clear idea of what is to be searched, reviewed and disclosed. Accordingly, these are legitimate Model C requests, but they do require further limitation in identifying the individual custodians whose files are to be searched and the repositories to be searched. With this in mind, if there are numerous senior officers within a particular department, such as the marketing department, those custodians who are more likely to hold relevant documents should be identified, rather than merely requiring a search to be undertaken of all senior officers' files. In many cases, I imagine, it will be the most senior officer or officers or those officers wielding the most authority or influence who should be custodians. That is a matter for discussion between the parties.
- Mr Kitchener QC questioned why the specified departments (i.e. human resources, finance, information technology or marketing) could be said to hold documents relevant to this request. I can conceive that there might well be documents within each of these departments concerning the Alleged DDOS Attacks, if such attacks did in fact take place involving Mr Marziano and Mr Polani. However, as discussed above, any burden associated with searching across these four departments can be mitigated by identifying a limited number of senior officers within those departments.
- The same considerations about limiting the search by reference to the identity of the custodian apply equally to the directors and shareholders. As to Mr Kitchener's point about Cellcom being Orange Liberia's shareholder, if there is an individual or individuals who represented Cellcom's interests as a shareholder, it is that individual(s)' files which must be searched.
- As to the date range of the requests, given that the parties have agreed that a similar date range is appropriate for request 1(a), I do not see that the date range for requests 1(b), 2 and 3 is unreasonable.
- I do not consider that objections to reasonableness and proportionality are valid when one considers the importance of these issues and the value of the claims.
Lonestar's request 7
- Lonestar's request 7 requests disclosure of:
"Documents recording or evidencing any flights made by Mr Marziano to London between January 2015 to March 2017 (including any documents recording or evidencing the reason for any such travel)."
- Originally, this request included a request for documents concerning flights made by Mr Polani, as well as by Mr Marziano, but Lonestar agreed to narrow this request,
- Lonestar justifies this request as being relevant to issues 2 and 5(b), which are concerned with the roles of Mr Marziano, Mr Polani and Mr Kaye in the Alleged DDOS Attacks, and the relationship between Mr Marziano's and Mr Polani's roles within Cellcom and/or Orange Liberia with those attacks. In particular, Lonestar maintained that it is alleged that there were meetings between Mr Marziano and Mr Kaye in London on at least three occasions, during which Mr Marziano may have paid Mr Kaye in connection with the Alleged DDOS Attacks.
- Mr Singla submitted that there is a pleaded reference to meetings between Mr Marziano and Mr Kaye in London, at which payments were made, drawn from transcripts of interview of Mr Kaye undertaken by the Cologne Public Prosecutor in May 2017 (paragraph 14, in particular sub-paragraphs 14.5 and 14.9, of the Amended Particulars of Claim). Mr Singla also relied on additional evidence in the form of material obtained from the National Crime Agency which indicates that Mr Marziano (who was not then based in London) met Mr Kaye in London on at least four occasions, starting from as early as 2014, during the Alleged DDOS Attacks, and ending in 2017.
- Ms Tolaney QC and Mr Kitchener QC did not strenuously object to this request in substance but chiefly in respect of the date range in that the only pleaded allegation relates to a meeting between Mr Marziano and Mr Kaye in January 2017. They did submit that the request was too broad and Mr Kitchener QC said it bore the stamp of Peruvian Guano.
- In my judgment, this is a legitimate Model C request because there is a pleaded issue of more than one meeting taking place between Mr Marziano and Mr Kaye in London, perhaps as early as 2014 and ending with a meeting in early 2017, and the request is formulated in sufficiently narrow terms.
Lonestar's requests 11, 12 and 13
- Lonestar requests disclosure of:
"11. Bank statements or internal records of any cash withdrawals of USD 2,000 or more made from any bank accounts used by or related to Cellcom and/or Orange Liberia between July 2015 and May 2017 that were authorised or requested by or on behalf of Mr Marziano and/or Mr Polani.
12. Bank statements or internal records of any electronic funds transfer of USD 2,000 or more made from any bank accounts used by or related to Cellcom and/or Orange Liberia between July 2015 and May 2017 to any bank accounts used by or related to Mr Kaye and/or any bank accounts in the United Kingdom or Hong Kong including, in particular, any transfers authorised or requested by or on behalf of Mr Marziano and/or Mr Polani, or any transfers (irrespective of the amount) with the reference "hk travel expenses".
13. Documents recording any electronic funds transfer of USD 2,000 or more made from any bank accounts used by or related to Mr Marziano and/or Mr Polani between July 2015 and May 2017 to any bank accounts used by or related to Mr Kaye and/or any bank accounts in the United Kingdom or Hong Kong."
- Lonestar submitted that each of these requests related to Issues 2 and 5(b), which are concerned with Mr Marziano's, Mr Polani's and Mr Kaye's roles in the Alleged DDOS Attacks and the connection between Mr Marziano's and Mr Polani's roles within Cellcom and/or Orange Liberia to the Alleged DDOS Attacks.
- Cellcom is prepared to agree to request 11 insofar as it concerns its own bank accounts. Cellcom is also prepared to agree to requests 12 and 13 with the omission of the words "and/or any bank accounts in the United Kingdom or Hong Kong", because such disclosure would inevitably embrace transfers which are irrelevant to the pleaded issues, and is therefore unreasonable and disproportionate. Orange Liberia objected to the full breadth of these requests, but is prepared to carry out a search insofar as it is defined and reasonable. Orange Liberia observed that it is not alleged and there is no evidence that any payments to Mr Kaye were made from bank accounts related to Cellcom and/or Orange Liberia.
- Mr Singla, on behalf of Lonestar, sought to justify the inclusion of the words "and/or any bank accounts in the United Kingdom or Hong Kong" in the request because Lonestar has no confidence in the ability of Cellcom and/or Orange Liberia to identify accounts used by or related to Mr Kaye. Mr Singla supported these requests by referring to documentation obtained from the National Crime Agency, including a Police Report which made reference to such bank accounts. For example, in the Police Report, it was stated that "On 19th October 2015 KAYE and MARZIANO discuss further payment to KAYE using a "normal bank account in Hong Kong". They continue to carry out attacks on Lonestar". In addition, there were Instant Messenger chats which included the following statements:
"Im running a little low since all the purchases and this trip.. any chance you can initiate a wire to my uk account? Or only when you are in liberia?"
I can do wire today. Let me know much you want to get in your account
Let me check some things and see how much I can state as 'travel expenses' so they dont tax me :)
Yes, you have xtra. Let me know so I can initiate it this morning
5k usd would be great, and if you can then add reference "hk travel expenses" please
Do I have your bank information?
I think so
Is Daniel Kaye the account name?
"
- Mr Singla also said that if the searches undertaken in accordance with its requests produce a disproportionately large selection of documents, the parties can discuss means by which the documentation to be searched for and reviewed can be reduced.
- I am satisfied that requests 11, 12 and 13 are justified Model C requests, generally for the reasons given by Mr Singla, but taking on board the valid objections made on behalf of Cellcom and Orange Liberia, I direct that the requests be modified as follows:
(1) Request 11 should be limited to Cellcom and Orange Liberia undertaking searches in respect of their own bank accounts.
(2) The words "and/or any bank accounts in the United Kingdom or Hong Kong" should be omitted from requests 12 and 13.
Request 15
- Lonestar requests disclosure of "Documents recording or evidencing Mr Marziano's arrest by UK authorities in 2017". This request is justified by reference to Issues 2 and 5(b), which are concerned with the role of Mr Marziano, Mr Polani and Mr Kaye in the Alleged DDOS Attacks and the relationship of Mr Marziano's and Mr Polani's role within Cellcom and/or Orange Liberia to the Alleged DDOS Attacks.
- Cellcom and Orange Liberia objected to this request because there is no pleaded issue in respect of Mr Marziano's arrest. Indeed, Orange Liberia submitted that there is no dispute as to the circumstances of Mr Marziano's arrest by the UK authorities in 2017 and there is no reason to suppose that Orange Liberia would have any such documents given that Mr Marziano's arrest occurred after Mr Marziano's secondment to Orange Liberia.
- Lonestar responded by referring to the disparity of the corporate defendants' respective cases as to the date until which Mr Marziano was seconded as Orange Liberia's CEO, Cellcom alleging it continued until the end of February 2017, but Orange Liberia contending that it continued until the end of January 2017 (see paragraph 5(2)(l)(v) of Cellcom's Amended Defence and paragraph 9.6 of Orange Liberia's Amended Defence).
- I accept that whether or not Mr Marziano was arrested is probably irrelevant to the issues in the action, but the discovery by Cellcom and Orange Liberia of and their reaction to Mr Marziano's (alleged) arrest might well be relevant to the relationship of the role of Mr Marziano to the Alleged DDOS Attacks (Issue 5(b)). In those circumstances, I allow the request. However, the parties will have to consider what files should be searched for and reviewed to comply with this request in order to avoid an unnecessarily expansive and disproportionate disclosure exercise.
Requests 36 and 37
- Lonestar requests disclosure of
"36. Communications (and documents recording or evidencing communications) to which Cellcom and/or Orange Liberia were party in relation to the Alleged DDOS attacks on Lonestar in relation to:
(a) the criminal investigation and proceedings against Mr Kaye in both Germany and the UK; and
(b) any inquiries made by the NCA.
37. Communications (and documents recording or evidencing any communications) between the Liberia Telecommunications Authority and Cellcom and/or Orange Liberia in relation to the Alleged DDOS Attacks."
- The parties were agreed that these requests would not stand if Issue 5(a) were disallowed as an Issue for Disclosure. As I have removed Issue 5(a) from the Issues for Disclosure, requests 36 and 37 also fall away.
Requests 38, 39, 40, 41 and 42
- Lonestar requests disclosure of:
"38. Documents recording or evidencing any internal analysis by Cellcom and/or Orange Liberia of Lonestar's revenue, market share and financial performance from July 2015 to May 2017.
39. Documents recording or evidencing due diligence or related information provided by Cellcom to the Orange group in relation to cyber security risks in Liberia in connection with the Orange group's acquisition of Orange Liberia in April 2016, including any relevant information regarding cyber security risks in Liberia provided by Orange Liberia to Cellcom specifically in relation to any due diligence requests from the Orange group.
40. Documents recording or evidencing Cellcom's presentation of Orange Liberia's revenue, market share, financial performance, and business strategy to the Orange group in connection with the Orange group's acquisition of Orange Liberia in April 2016, including any related information provided by Orange Liberia to Cellcom for that purpose.
41. Board minutes, resolutions and/or papers created by or for the board of directors of Cellcom from July 2015 to date referring to Lonestar and/or MTN and/or the Alleged DDOS attacks and/or cyber security related matters.
42. To the extent not covered by request 1, board minutes, resolutions and/or papers created by or for the board of directors of Orange Liberia from July 2015 to 3 October 2018 referring to Lonestar and/or MTN and/or the Alleged DDOS attacks and/or cyber security related matters."
- Requests 38 and 39 were submitted by Lonestar to be relevant to Issues 5(a) and 7(b), but as Issue 5(a) is no longer an Issue for Disclosure, these requests are justified by reference to Issue 7(b), which is concerned with whether any benefits received by the corporate defendants by reason of the Alleged DDOS Attacks were intended by those defendants.
- Request 40 is based on Issues 5 and 6(b). Issue 5(b) is concerned with the relationship of Mr Marziano's and Mr Polani's roles within Cellcom and/or Orange Liberia to the Alleged DDOS Attacks. Issue 6(b) is concerned with the question what other factors impacted Lonestar's business at the time of the Alleged DDOS Attacks.
- Requests 41 and 42 are based on Issues 5 and 7(b). Request 41 is addressed only to Cellcom, not Orange Liberia, and request 42 has been agreed by Orange Liberia, but not by Cellcom. Accordingly, for the purposes of this judgment, requests 41 and 42 are concerned only with Cellcom, not Orange Liberia.
- Both Cellcom and Orange Liberia objected to request 38 because it is unreasonably wide in that it will capture many documents which are irrelevant to the dispute. In addition, Orange Liberia submitted that the relevance of these requested documents are concerned only with the claim for exemplary damages, which are unlikely to be significant, and that many of the documents contain "highly confidential commercial information" and there is no justification for their disclosure.
- I have sympathy with each of the parties on this request. I can see that any internal analysis conducted by Cellcom and Orange Liberia on Lonestar's revenue, market share and financial performance may well have a bearing on the corporate defendants' alleged intention to be benefit from the Alleged DDOS Attacks. I take Mr Kitchener QC's point that the claim for exemplary damages, to which this issue of the corporate defendants' alleged intention is relevant, might not be significant. That said, I would not want to prejudice any of the parties' positions with respect to the claim for exemplary damages by commenting on its likely significance. The claim for exemplary damages gives rise to Issues for Disclosure, which are the key issues for this purpose. On the other hand, I also see that the production of all the documentation falling within request 38 could be very wide-ranging and much of it might well be irrelevant to the dispute.
- In these circumstances, in my judgment, a modified request is appropriate, namely "Documents recording or evidencing any internal analysis by Cellcom and/or Orange Liberia of Lonestar's revenue, market share and financial performance from July 2015 to May 2017 taking into account the Alleged DDOS Attacks either prior to their occurrence or not".
- As regards requests 39 and 40, Mr Kitchener QC objected to these requests because they are disproportionately wide and because such documentation would contain commercially sensitive information. Mr Kitchener QC also questioned whether such documentation emanating from Orange Liberia could be relevant to the calculation of Lonestar's own losses. Ms Tolaney QC adopted Mr Kitchener QC's submissions in this respect.
- In my judgment, requests 39 and 40 should not be permitted. They are concerned with documentation relating to cyber risks and Orange Liberia's financial performance generally and are not in any way limited to the issues in the action or the Issues for Disclosure. They are disproportionately wide. Although it is possible that some such documentation might be relevant to the quantification of Lonestar's losses (as far as request 40 is concerned), I do not consider that they are a necessary part of that exercise and in any event there will be very substantial amounts of documentation which go beyond the issues at hand. This is precisely the type of request which is not contemplated as a Model C request for a particular document or a narrow class of documents.
- As regards requests 41 and 42, Ms Tolaney QC objected to them because of their wide-ranging scope and, as far as request 42 is concerned, it is concerned with documents created by or for Orange Liberia's board of directors, and if Orange Liberia is undertaking the search in compliance with that request, there is no reason for Cellcom to do the same.
- In my judgment, request 41 is justified insofar as it concerns relevant documents created for or by Cellcom's board of directors referring to Lonestar and/or MTN (the corporate group to which Lonestar belongs) and/or the Alleged DDOS Attacks. However, the inclusion of the words "and/or cyber security related matters" makes this request far too broad and should be omitted.
- As to request 42, if this request is going to be dealt with by Orange Liberia, given that it concerns Orange Liberia's board of directors, I do not consider that this request should also be addressed to Cellcom. I appreciate that Cellcom was the former owner of Orange Liberia, but I do not see any immediate benefit in Cellcom in undertaking this search. I would add however that if there are obvious deficiencies in Orange Liberia's disclosure in this respect (although, I would add, there is no immediate reason to suppose that there might be such deficiencies), it would be appropriate for Lonestar to apply to the Court for specific disclosure in connection with request 42. I do not say that such an application would be successful, but the opportunity for Lonestar exists.
Requests 43, 45, 46, 47, 49, 50 and 51
- Lonestar requests disclosure of:
"43. Documents recording or evidencing Orange Liberia's proposed business strategy and/or revenue and/or market share targets for the period from July 2015 to May 2017
45. Documents (including communications) created between July 2015 [and] May 2017 by Cellcom and/or Orange Liberia's internal marketing and/or business strategy teams which refer to Lonestar and/or MTN and/or the Alleged DDOS Attacks on Lonestar.
46. Documents recording or evidencing the pricing of Orange Liberia's services between July 2015 and May 2017 for both individual and corporate customers.
47. (a) Submissions made and/or other documents provided by Cellcom and/or Orange Liberia to the Liberia Telecommunications Authority containing data or otherwise relating to Orange Liberia's performance and revenue from January 2015;
(b) Quarterly and yearly financial reports and/or management accounts of Cellcom and/or Orange Liberia, or other documents detailing revenues, EBITDA, marketing and promotional expenses, and capital expenditure for Orange Liberia from January 2015; and
(c) Documents recording or analysing Orange Liberia's key operating statistics (including Average Revenue Per User and Minutes of Use), either monthly or quarterly, from January 2015
49. Documents recording or evidencing Orange Liberia's pricing strategy, including the details of any pricing initiatives from January 2015.
50. Internal or third party reports in the control of Cellcom and/or Orange Liberia assessing the reliability and/or performance of Orange Liberia's network created between January 2015 and May 2017.
51. Documents recording or evidencing any business plans, forecasts or annual budgets prepared by Cellcom and/or Orange Liberia from January 2015 to May 2017."
- Request 43 is justified by reference to Issue 5(b) (the relationship between Mr Marziano's and Mr Polani's roles at Cellcom and/or Orange Liberia and the Alleged DDOS Attacks), Issue 6(b) (the factors impacting Lonestar's business other than the Alleged DDOS Attacks) and Issue 7 (the benefits to Cellcom and/or Orange Liberia by reason of the Alleged DDOS Attacks and whether those benefits were intended by Cellcom and/or Orange Liberia).
- The other requests - requests 45, 46, 47, 49, 50 and 51 - relate to Issues 6(b) and 7.
- Both Cellcom and Orange Liberia disputed requests 43, 45, 46, 49, 50 and 51 and Orange Liberia, but not Cellcom, disputed request 47.
- These issues all are said to relate to the losses allegedly suffered by Lonestar as a result of the Alleged DDOS Attacks. In particular, Lonestar alleges that there was a reduction in the pricing of its services to a greater extent than would have happened but for the Alleged DDOS Attacks as part of a longer "price war" between Lonestar and Orange Liberia and that, based on documents obtained from the National Crime Agency, Mr Marziano arranged for Orange Liberia to take various marketing initiatives intended to increase the extent to which the Alleged DDOS Attacks caused Lonestar's customers to switch to Orange Liberia. Orange Liberia denies these allegations.
- Ms Tolaney QC on behalf of Cellcom objected to these requests because the documents held by Cellcom are likely to be, at best, of only marginal and indirect relevance to assessing the performance of Lonestar's business, which is independent of Cellcom. Accordingly, it is said, it is neither reasonable nor proportionate for Cellcom to search for the requested documents. Ms Tolaney QC submitted that the documentation and information relating to Lonestar's alleged losses all reside in Lonestar's control. Ms Tolaney QC further argued that this is a situation where Lonestar has sought to get a tactical advantage in a case where it has not particularised its alleged losses based on matters within its own knowledge and will not do so until after the provision of Extended Disclosure, but nevertheless advances "these fishing requests in the widest possible terms that wouldn't be Model C requests anyway are put forward".
- Mr Kitchener QC on behalf of Orange Liberia objected to these requests because they are unreasonable and disproportionate, especially insofar as they concern Lonestar's claim for exemplary damages and involve risks of Orange Liberia disclosing confidential information with no reasonable justification. Furthermore, Mr Kitchener QC argued, it is not evident how the requested documents, including those relating to Orange Liberia's proposed business strategy, are relevant to Lonestar's claim for compensation for its alleged losses. Furthermore, Orange Liberia's objection was based on the fact that the disclosure exercise generally in response to these requests would be expensive involving voluminous documentation, adding that "Lonestar is asking essentially for every single piece of paper there is regarding our business and our financial and commercial performance and strategy. It's not limited in any way to the DDOS attacks, it's not directed to the issues of the case, it's not at all narrow, there is no pretence of these being compliant Model C requests, and as I say, these are all requests for our most commercially sensitive information. It's a deeply intrusive request by a competitor".
- Part of the background to the parties' disputed positions on these requests was the fact that Lonestar had not yet fully particularised its case on its losses. As matters stand, the parties have agreed, and the Court has ordered, that such further particulars will be provided by Lonestar four weeks after the provision of Extended Disclosure by the parties. Lonestar's currently pleaded case as to its losses is set out in paragraph 26 of the Amended Particulars of Claim, which states:
"26. As an intended consequence of the DDOS attacks, Lonestar has suffered and continues to suffer a substantial loss in the value of its business and/or loss of profits and accordingly Lonestar is entitled to and claims damages against the Defendants
Without prejudice thereto, Lonestar will say that has suffered and is continuing to suffer a loss in the value of its business and/or loss of profits because for example:
26.1. Lonestar's customers were unable to use its services during the DDOS attacks.
26.2. Further, following the DDOS attacks, which commenced in around October 2015, and as a result of the DDOS attacks:
26.2.1. A substantial number of Lonestar's customers switched to Lonestar's competitors, in particular Orange Liberia; and/or
26.2.2. There was substantially less usage of Lonestar's cellular communication and internet services by those customers who have remained with Lonestar; and/or
26.2.3. Lonestar had a substantially lower level of new subscriptions to its cellular communication and internet services than it would have but for the DDOS attacks; and/or
26.2.4. Lonestar reduced the prices for its services to a greater extent than it would have but for the DDOS attacks. In particular, this took place as part of a lengthy "price war" between Lonestar and Orange Liberia in which Lonestar, by reducing its prices, sought to mitigate the loss of market share that it suffered as a result of the disruption to Lonestar's services caused by the DDOS attacks and the consequent reduction in customer numbers."
- This claim is obviously put in issue by Cellcom and Orange Liberia. At paragraph 28A of its Amended Defence, Orange Liberia denied that there was any "price war" related to the Alleged DDOS Attacks, but there had been price competition between (inter alia) Lonestar and Orange Liberia since Cellcom's entry into the Liberian telecommunications market in 2004. During the period of the Alleged DDOS Attacks, it is further pleaded by Orange Liberia, there was price competition in the Liberian market led by a newer market entrant, Novafone, which offered cut-price plans to customers with which other market participants, including Orange Liberia and Lonestar, were required to compete.
- It is worth also noting paragraph 22.12 of the Amended Particulars of Claim, where Lonestar pleads that during the period of the Alleged DDOS Attacks, Mr Marziano arranged for Orange Liberia to take various marketing initiatives which were intended to increase the extent to which the Alleged DDOS Attacks caused Lonestar's customers to switch to Lonestar's competitors, in particular Orange Liberia. In answer to that plea, Cellcom pleads at paragraph 12(4)(a) that it is denied that in the period prior to the sale of Orange Liberia on 5th April 2016, Mr Marziano arranged for Orange Liberia to take any marketing initiatives outside the ordinary course of its business or with the intention of increasing the extent to which the Alleged DDOS Attacks caused Lonestar's customers to switch to Lonestar's competitors. At paragraph 24D of its Amended Defence, Orange Liberia pleads that, although Orange Liberia carried out various marketing initiatives between October 2015 and February 2017 in the ordinary course of business, it is denied that they were specifically targeted at or communicated to Lonestar's customers, as they were targeted at or communicated to Liberian telecommunications users generally.
- Mr Singla, on behalf of Lonestar, contended that the absence of further particulars should not cause any difficulties to Cellcom and Orange Liberia in searching for the relevant documents, not least because the nature of the general allegation concerning the nature of the losses sustained by Lonestar is evident from its currently pleaded case. In support of this contention, Mr Singla pointed out that Cellcom and Orange Liberia have made their own requests for disclosure relating to the Lonestar's claim for damages as pleaded, which requests are formulated as requests 17 to 40 of the corporate defendants' requests. Mr Singla also argued that the requests are narrowly formulated and not unreasonable nor disproportionate, as is evident that they reflect the requests made by the corporate defendants of Lonestar. Mr Singla also said that the documents are required to assist Lonestar to formulate its particularised case on damages. Mr Kitchener QC said that this is not a permitted basis on which to order disclosure.
- Mr Singla concluded by submitting that the questions at trial would be (a) was there a price war, (b) was that caused by the DDOS attacks, (c) what would the position have been in the counter- factual in any event, and disclosure of these matters is required by Lonestar.
- With these submissions in mind, I turn to each of Lonestar's requests. In my judgment, requests 43, 46, 47(b), 47(c), 50 and 51 are not sustainable as Model C requests and should be refused for the following reasons:
(1) They are broadly formulated, too broadly formulated for a Model C request, which in its most expansive form can relate only to a narrow class or classes of documents. Documents generally relating to Orange Liberia's proposed business strategy, revenue, market share targets, pricing, internal financial reports and management accounts, analyses of Orange Liberia's key operating statistics, business plans, forecasts and annual budgets, would be very substantial in number and the disclosure exercise involved, in searching for and reviewing these documents for the purposes of disclosure, would be both costly and burdensome. These are not valid Model C requests.
(2) It is not immediately clear to me how these documents would assist Lonestar in formulating its damages claims or how they would be relevant to that claim. Much of the material concerned with Lonestar's alleged losses must be in Lonestar's control, rather than in the control of Cellcom or Orange Liberia. The damages claimed, whether compensatory or exemplary damages, are not based directly on the quantum of any benefit to Orange Liberia, although it is fair to say that the claim for exemplary damages does turn on the question whether the corporate defendants intended to benefit from the Alleged DDOS Attacks.
(3) One of the points made by Mr Singla was that it is necessary for Lonestar to see whether customers switching from Lonestar to Orange Liberia were doing so because of the Alleged DDOS Attacks or by reason of other extraneous matters. There is a certain logic to this submission. Nevertheless, I do not understand how all of the documents requested in very broad terms by Lonestar will directly address this issue. Nor do I consider it likely that the documents requested will be relevant in this respect. That said, as I am about to explain, I am prepared to allow certain requests which should deal with that issue, at least in part.
(4) The fact that Cellcom and Orange Liberia have made requests for disclosure as to Lonestar's own losses, to which Lonestar has agreed to respond, does not mean that they should provide reciprocal disclosure, because the subject of the disclosure sought is Lonestar's losses, not Cellcom's or Orange Liberia's losses (or profits).
- As to the remaining requests, I decide as follows:
(1) Request 45 - documents (including communications) created between July 2015 and May 2017 by Cellcom and/or Orange Liberia's internal marketing and/or business strategy teams which refer to Lonestar and/or MTN and/or the Alleged DDOS Attacks on Lonestar - in principle is a permissible request. It is concerned with documentation generated in the relevant period which specifically is concerned with Lonestar and the Alleged DDOS Attacks. In this respect, they mirror request 41 as amended. That said, given the potential size of the corporate defendants' internal marketing and/or business strategy teams, I envisage that the parties will have to agree on a few selected senior officers within each department as relevant custodians.
(2) As to request 47, I am conscious that Cellcom has not objected to this request, but nevertheless maintained that it was irrelevant. As formulated, I consider that request 47 is too broad and potentially disproportionate. Nevertheless, in my judgment, any documents submitted by Orange Liberia to the Liberia Telecommunications Authority concerning Orange Liberia's performance and revenue from January 2015 (request 47(a)) would be of some relevance and they should constitute a relatively narrow class.
(3) As to request 49, I am prepared to allow this request - documents recording or evidencing Orange Liberia's pricing strategy, including the details of any pricing initiatives from January 2015 - on a modified basis, namely this request is permitted to the extent that such documents record or evidence a "price war" between Orange Liberia and Lonestar in relation to the Alleged DDOS Attacks.
Requests 52 and 53
- Lonestar requests disclosure of:
"52. Documents recording or evidencing the number of subscribers for Orange Liberia on a monthly basis from January 2015.
53. Documents recording the mean baseline average and range of traffic on Orange Liberia's network from January 2015."
- Request 52 is addressed only to Orange Liberia and is said to be justified by reference to Issue 7(a) (which is concerned with the extent to which the corporate defendants benefited and stood to benefit from the Alleged DDOS Attacks). Request 53 is addressed to both corporate defendants and is concerned with Issue 7(a) and also Issue 7(b) (which is concerned with the corporate defendants' intention to benefit from the Alleged DDOS Attacks). These Issues for Disclosure are concerned with Lonestar's claim for exemplary damages.
- Mr Singla argued in support of these requests by relying on the same matters he advanced in support of earlier requests concerning exemplary damages. Mr Singla also submitted that, though Lonestar has material in its possession, one also needs information in Orange Liberia's possession to have a complete picture.
- Mr Kitchener QC resisted this request because Orange Liberia's network performance is not in issue in this case and because Lonestar will have relevant data and documents relating to the performance and reliability of its own network. Ms Tolaney QC also disputed request 53.
- I am not convinced that requests 52 and 53 are sufficiently relevant to the Issues for Disclosure. It is possible that if request 52 were modified it might be sufficiently relevant to Issue 7, but as matters stand, I am not certain how best to modify that request. Moreover, it seems to me that documents which will be produced in answer to other requests may touch on this issue.
Request 55
- Lonestar requests disclosure of:
"(a) Documents recording or evidencing any payments made by Orange Liberia or the Orange group to Cellcom and/or its shareholders from 5 April 2016 to date, including in connection with Cellcom's sale of Orange Liberia to the Orange group.
(b) Documents recording or evidencing any shares or options in Orange Liberia acquired by Cellcom or any of Cellcom's shareholders (including YCF Investors LLC).
(c) Documents recording or evidencing the exercise of any option rights acquired by Cellcom or any Cellcom directors or shareholders (including YCF Investors LLC) in connection with Cellcom's sale of Orange Liberia to the Orange group, after 5 April 2016.
(d) Documents recording or evidencing any financial benefits received by Cellcom or any of its directors via YCF Investors LLC (and/or any of YCF Investor's beneficial owners) in connection with its shares and/or option rights in relation to Orange Liberia."
- Lonestar justifies this request by reference to Issue 7, which is concerned with Lonestar's claim for exemplary damages and the benefit to Cellcom and/or Orange Liberia associated with the Alleged DDOS Attacks.
- Cellcom agreed to the documents within this request insofar as they concern Cellcom, but not insofar as they concern its shareholders or directors. Orange Liberia objected to this request generally on the ground that they are irrelevant to the issues in the action and, in any event, it is aimed at Cellcom, not Orange Liberia.
- Mr Singla, on behalf of Lonestar, referred to Lonestar's case pleaded at paragraph 6A of the Amended Particulars of Claim, namely that Cellcom continued to have a financial interest in the business of Orange Liberia after the sale of Orange Liberia to the Orange group in April 2016. In support of this case, Lonestar relies on the terms of the Stock Purchase Agreement, under which Cellcom was to receive funds for the sale of Orange Liberia, and the Transitional Services Agreement, by which Cellcom agreed to provide specified services to Orange Liberia for a specified period after 5th April 2016, including consulting services through Mr Marziano and Mr Polani. In response to this pleaded case, Cellcom pleaded at paragraph 8A of its Amended Defence that whilst it had a limited financial interest in Orange Liberia up to 30th June 2016, Cellcom had no financial interest in any increased performance of Orange Liberia that resulted from any alleged cyber-attacks on Lonestar after it signed the Stock Purchase Agreement and after it sold Orange Liberia. Orange Liberia responds to this case with a combination of admissions and non-admissions (paragraph 12A of its Amended Defence).
- Given that the question of Cellcom's alleged financial interest in Orange Liberia is plainly an issue in the action, I agree that these requests should be maintained, but should be limited to documents relating to payments to Cellcom in connection with the sale of Orange Liberia, the transfer of shares and options to Cellcom in Orange Liberia, the exercise of option rights by Cellcom in connection with the sale of Orange Liberia, and the receipt of any financial benefits by Cellcom in connection with shares and option rights relating to Orange Liberia.
- However, the question is whether the documents should extend to Cellcom's directors and shareholders. Mr Singla referred to (a) the terms of the Stock Purchase Agreement by which, upon Closing, Mr Yoram Cohen (or an entity designated by him reasonably acceptable to the Buyer (described as "the New Stockholder")) shall acquire from the Buyer a number of shares of Common Stock in Orange Liberia; (b) the terms of a shareholders' agreement between the Orange group, Orange Liberia and YCF Investors LLC (a company owned by Mr Cohen and others) by which upon Closing, YCF Investors LLC (the New Stockholder), would acquire 52 of 1,000 shares in Orange Liberia (described as "Incentive Shares"); and (c) the terms of an option agreement between the Orange group and YCF Investors LLC by which YCF Investors LLC granted an option to purchase shares in Orange Liberia to the Orange group.
- In my judgment, this request should be permitted as far as Cellcom is concerned and should extend to YCF Investors LLC as a shareholder in Cellcom, because Cellcom's continued interest in Orange Liberia might be directly held or enjoyed by the new shareholder in Orange Liberia. I am not willing to extend this particular request to other unidentified shareholders or to Cellcom's directors, because that request has the potential to extend the request beyond the requisite narrow class of documents required of Model C requests. Further, I see no reason why this request should not also be addressed to Orange Liberia insofar as the request concerns Orange Liberia, but similarly it should not extend to its shareholders and directors.
Cellcom's and Orange Liberia's requests 2 and 5
- Cellcom and Orange Liberia request disclosure of:
"2. Technical reports or other documents (both contemporaneous and retrospective, whether automatically or manually generated) showing the structure and components of the Claimant's Network in the period between 1 July 2015 and 31 May 2017 (the "Relevant Period"), including:
2.1. The specification, ordinary baseline application, and location of load balancers in the Claimant's Network and their configuration, together with a reasonable and proportionate search for any logs generated, to be carried out pursuant to the Device Identification and Search Procedure set out below;
2.2. The specification, ordinary baseline application, ownership, and location of routers in the Claimant's Network, together with a reasonable and proportionate search for (a) their startup and running configuration files, and (b) a command dump of their running cores, including any captured traffic, metadata and associated logging, in each case to be carried out pursuant to the Device Identification and Search Procedure set out below;
2.3. Regarding firewalls:
2.4. Regarding scrubbing centres utilised by the Claimant:
5. Documents (both contemporaneous and retrospective, whether automatically or manually generated) containing the underlying technical data for a reasonable and proportionate sample of the reports evidencing DDOS attacks on the Claimant during the Relevant Period identified in request 4 above, such sample to be discussed and agreed between the parties, including as to a reasonable and proportionate search pursuant to the Device Identification and Search Procedure for any logs generated by the relevant Network Systems and devices insofar as relevant to the sample, in a structured, numerical format where possible."
- Request 2 is justified by Cellcom and Orange Liberia by reference to Issue 1(a), which is concerned with the utilisation (including mean average baseline and upper and lower range of traffic) of Lonestar's network between July 2015 and May 2017 (inclusive).
- Request 5 is justified by reference to Issues 1(b)-(d), which are concerned with the carrying out of the Alleged DDOS Attacks. Lonestar has agreed to provide disclosure in answer to request 4, which is referred to in request 5 and which concerns "Technical reports or other documents evidencing any DDOS attacks carried out on the Claimant during the Relevant Period, including reports generated by the following systems and services", including Huawei and Arbor.
- Lonestar has agreed to request 2, but there remains a dispute as to the searches for which Orange Liberia proposes in connection with the "Device Identification and Search Procedure" set out in the Disclosure Review Document. Mr Lodder, on behalf of Orange Liberia (whose submissions Ms Tolaney QC adopted), submitted that the load balancers, routers and firewalls referred to in the request will contain easily accessible information relating to the Relevant Period that can be obtained by running a simple "Command Line Interface" checks and that such information is invaluable in understanding and assessing the impact of the Alleged DDOS Attacks. The corporate defendants' position is that Lonestar will carry out a reasonable and proportionate search to identify the load balancers, routers and firewalls used in its network during the Relevant Period, and provide a list of relevant devices which remain in Lonestar's control or had been, but are no longer, in Lonestar's control; the corporate defendants will then provide a list of searches they request to be carried out on these devices insofar as they are still in Lonestar's control; if the parties cannot agree on the requests, they will liaise with a view to resolving any dispute, with liberty to any of the parties to apply to the Court.
- Mr Singla on behalf of Lonestar argued that this would be a disproportionate request and instead proposed Lonestar provide disclosure in answer to the corporate defendants' other requests (including requests 1 and 4), to be followed by a sequential exchange of cyber experts' reports, at which point the parties will be in a better position to judge whether request 2 (and request 5) should be pursued. Mr Singla pointed to the fact that many of the documents sought in the request are plainly onerously wide-ranging, given the reference to "any logs generated" (request 2.1), "start-up and running configuration files" (request 2.2), "a command dump of their running cores, including any captured traffic, metadata and associated logging" (request 2.2) and "reports showing the traffic handled by the firewall" (request 2.3.7).
- Mr Singla on behalf of Lonestar objected to request 5 as being unreasonable and disproportionate in that the request appears to require production of all of the packets of traffic that passed through Lonestar's network during the relevant period. The number of documents which would be produced, it is argued, would be disproportionately large and, it is further argued, insofar as there is no relevant existing data, the exercise involved in seeking to retrieve it would be difficult and expensive. Moreover, Mr Singla argued that it is an unnecessary request, because given the reports referred to in request 4, Cellcom and Orange Liberia can use those reports as a platform for further requests for disclosure.
- Mr Lodder on behalf of Orange Liberia submitted that the documents sought by request 5, which he emphasised represent only a reasonable and proportionate sample, are relevant because the reports referred to in request 4 - and in paragraph 4 of the Annex to the Amended Particulars of Claim - do not include the workings in support of the conclusions in the reports or the data underpinning them. Moreover, Mr Lodder said, the corporate defendants cannot understand the case put forward by Lonestar without this documentation.
- In my judgment, the technical data underpinning the Alleged DDOS Attacks is an inevitable part of the disclosure exercise and given that the Alleged DDOS Attacks were inflicted on Lonestar and form the basis of Lonestar's claim, it is important that a fair and practical means of adequate disclosure is provided. Having regard to the fact that the corporate defendants are seeking in the case of request 2 a process to obtain, in the first instance, a list of devices and applications for the purposes of identifying a reasonable and proportionate sample for performance, and in the case of request 5, a reasonable and proportionate sample for the workings underpinning the reports which Lonestar have agreed to disclose, the nature of the exercise is by its terms reasonable and proportionate. If of course the exercise proves to be unreasonable and/or disproportionate, Lonestar should have liberty to apply. In these circumstances, the requests should be permitted.
Conclusion
- For the reasons explained above, I direct as follows:
(1) Issue 5(a) should be removed from the Issues for Disclosure. This is on the understanding that the issues of Mr Marziano's and Mr Polani's knowledge are embraced by Issues 2, 3 and 4.
(2) As to Lonestar's Model C requests for disclosure, subject to my modifications and comments above,
(a) Requests 1(b), 2 and 3 are permitted, but subject to the limitation of identifying a limited number of individual custodians whose files are to be searched and the repositories to be searched (as explained above).
(b) Request 7 is permitted.
(c) Request 11 is permitted, subject to the modification that it should be limited to Cellcom and Orange Liberia each undertaking searches in respect of their own bank accounts.
(d) Requests 12 and 13 are permitted, subject to the modification that the words "and/or any bank accounts in the United Kingdom or Hong Kong" should be omitted.
(e) Request 15 is permitted.
(f) Requests 36 and 37 are refused.
(g) Request 38 is permitted but subject to a modification so that it provides: "Documents recording or evidencing any internal analysis by Cellcom and/or Orange Liberia of Lonestar's revenue, market share and financial performance from July 2015 to May 2017 taking into account the Alleged DDOS Attacks either prior to their occurrence or not".
(h) Requests 39 and 40 are refused.
(i) Request 41 is permitted but subject to the modification that the words "and/or cyber security related matters" should be omitted.
(j) Request 42 insofar as it is addressed to Cellcom is refused.
(k) Request 43 is refused.
(l) Request 45 is permitted but subject to the modification that the parties will agree on a few selected senior officers within each of marketing and/or business strategy teams as relevant custodians.
(m) Request 46 is refused.
(n) Request 47(a) is permitted, but requests, 47(b) and 47(c) are refused.
(o) Request 49 is permitted, but subject to the modification that this request is permitted only to the extent that such documents record or evidence a "price war" between Orange Liberia and Lonestar in relation to the Alleged DDOS Attacks.
(p) Requests 50 and 51 are refused.
(q) Requests 52 and 53 are refused.
(r) Request 55 insofar as it is concerned with Cellcom and its shareholder YCF Investors LLC is permitted, but it is refused in respect of Cellcom's other shareholders and directors. The request is also permitted insofar as it is concerned with Orange Liberia, but it is refused insofar as it is concerned with Orange Liberia's shareholders and directors.
(3) Cellcom's and Orange Liberia's requests 2 and 5 are permitted, but if the exercise proves to be unreasonable and/or disproportionate, Lonestar should have liberty to apply.
- The disclosure exercise contemplated by the above orders and the parties' agreement is plainly a complex exercise and the parties should have liberty to apply to the Court.
- I am very grateful to all counsel for their helpful submissions and I commend the parties on reaching the agreement they have reached in respect of the majority of the Model C requests. The exercise of constructive co-operation between the parties is plainly essential having regard to the parties' own costs but also the resources of the Court, given that even though only a minority of disclosure requests were disputed in this case, it has taken a substantial period of time to deal with these requests.
