DOMAIN NAME COMMISSION LIMITED Vs DomainTools

CORPORATE DISCLOSURE STATEMENT indicating no Corporate Parents

and/or Affiliates. Filed pursuant to Fed.R.Civ.P 7.1. Filed by DomainTools, LLC
(Swaminathan, Aravind) (Entered: 06/28/2018)

Printed By: TPRESTON5 on Monday, July 2, 2018 - 2:34 AM

Case 2:18-cv-00874-JCC Document 8 Filed 06/28/18 Page 1 of 3
1 THE HONORABLE JOHN C. COUGHENOUR
8 UNITED STATES DISTRICT COURT
9 WESTERN DISTRICT OF WASHINGTON

10
11 DOMAIN NAME COMMISSION LIMITED

12 Plaintiff,
Case No. 2:18-cv-874
13 v.
RULE 7.1 CORPORATE
14 DOMAINTOOLS, LLC, DISCLOSURE STATEMENT OF
DOMAINTOOLS, LLC
15 Defendant.
16
17
18
19
20
21
22
23
24
25
26
27
28
RULE 7.1 CORPORATE DISCLOSURE ORRICK, HERRINGTON & SUTCLIFFE LLP
STATEMENT OF DOMAINTOOLS, LLC 701 Fifth Avenue, Suite 5600
Seattle, Washington 98104-7097
Case No. 2:18-CV-874 +1-206-839-4300
1 Pursuant to Federal Rule of Civil Procedure 7.1 and Local Civil Rule 7.1, defendant
2 DomainTools, LLC states that it is a limited liability company and has a single member,
3 DomainTools SARL.
4
Dated: June 28, 2018 ORRICK, HERRINGTON & SUTCLIFFE LLP
5
6
By: s/Aravind Swaminathan
7 s/Melanie D. Phillips
Aravind Swaminathan (State Bar No. 33883)
8 aravind@orrick.com
Melanie D. Phillips (State Bar No. 48945)
9 mphillips@orrick.com
Orrick, Herrington & Sutcliffe, LLP
10 701 Fifth Avenue, Suite 5600
Seattle, WA 98104
11 Telephone: 206-839-4300
Facsimile: 206-839-4301
12
Jacob M. Heath (pro hac vice to be filed)
13 jheath@orrick.com
1000 Marsh Road
14 Menlo Park, CA 94025-1015
Telephone: 650-614-7400
15 Facsimile: 650-614-7401
16 Attorneys for Defendant DomainTools, LLC
17
18
19
20
21
22
23
24
25
26
27
28
-1- 701 Fifth Avenue, Suite 5600
STATEMENT OF DOMAINTOOLS, LLC Seattle, Washington 98104-7097
Case No. 2:18-CV-874 +1-206-839-4300
1 CERTIFICATE OF SERVICE
2
I hereby certify that on the date below, I caused the foregoing document to be
3
electronically filed with the Clerk of the Court using the CM/ECF system which will send
4
notification of the filing to all counsel of record.
5
6
DATED: June 28, 2018 ORRICK, HERRINGTON & SUTCLIFFE LLP
7
8 Aravind Swaminathan (WSBA No. 33883)
9 aswaminathan@orrick.com

Seattle, WA 98104-7097
11 Telephone: 206-839-4300
Facsimile: 206-839-4301
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
STATEMENT OF DOMAINTOOLS, LLC Seattle, Washington 98104-7097
Case No. 2:18-CV-874 +1-206-839-4300
This page has been intentionally left blank
MOTION to Expedite Discovery, filed by Defendant DomainTools, LLC.

(Attachments: # 1 Proposed Order) Noting Date 7/6/2018, (Swaminathan,
Aravind) (Entered: 06/28/2018)


MOTION to Expedite Discovery, filed by Defendant DomainTools, LLC. (Attachments: #
Multiple Documents
Part Description
1 16 pages
2 Proposed Order
© 2018 The Bureau of National Affairs, Inc. All Rights Reserved. Terms of Service
// PAGE 1

10 AT SEATTLE

Case No. 2:18-CV-874
12 Plaintiff,
DEFENDANT DOMAINTOOLS’
13 v. MOTION FOR EXPEDITED
DISCOVERY
14 DOMAINTOOLS, LLC,
NOTE ON MOTION CALENDAR:
15 Defendant. July 6, 2018
16
17
18
19
20
21
22
23
24
25
26
27
28
DEFENDANT’S MOTION FOR EXPEDITED ORRICK, HERRINGTON & SUTCLIFFE LLP
DISCOVERY: Case No. 2:18-CV-874 701 Fifth Avenue, Suite 5600
Seattle, Washington 98104-7097
+1-206-839-4300
1 I. INTRODUCTION ........................................................................................................... 1
II. STATEMENT OF FACTS.............................................................................................. 2
2
A. Historically, Domain Registrant Information Has Been Public 3
3 B. DomainTools’ Cybersecurity Products Play a Crucial Role in Cybersecurity
Threat Intelligence and Attribution 3
4
C. DNCL Historically Made .nz Domain Registrant Information Publicly
5 Available 4
D. Since November 2018, DNCL and DomainTools Have Been Discussing Use of
6 Publicly Available .nz Domain Data 5
7 E. Expedited Discovery is Critical to Issues Raised in DNCL’s PI Motion 7
III. LEGAL ARGUMENT .................................................................................................... 8
8
A. A Preliminary Injunction is Pending 8
9 B. The Breadth of the Discovery Requested is Proper 9
10 C. DomainTools Has a Compelling Need for the Expedited Discovery 11
D. DNCL Will Not Suffer Any Undue Prejudice By Limited Expedited
11 Discovery 11
12 E. The Typical Discovery Timeline is Not Appropriate 12
IV. CONCLUSION ............................................................................................................. 12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
-i- 701 Fifth Avenue, Suite 5600
DISCOVERY: Case No. 2:18-CV-874 Seattle, Washington 98104-7097
+1-206-839-4300
1 Defendant DomainTools, LLC (“DomainTools”) respectfully requests that this Court
2 grant narrowly tailored, expedited discovery in the form attached as Exhibits 7 to 10 to the
3 Declaration of Jacob M. Heath in Support of DomainTools’ Motion for Expedited Discovery
4 (“Heath Decl.”) to permit DomainTools to obtain information necessary for it to oppose
5 Plaintiff Domain Name Commission Limited’s (“DNCL”) motion for a preliminary injunction
6 (“PI Motion”). DomainTools also requests that the Court extend the time for DomainTools to
7 respond to DNCL’s PI Motion from July 9 to August 13 and re-note DNCL’s PI Motion on
8 the Court’s motion calendar for August 17 to allow the parties to complete discovery and
9 incorporate any additional facts into their respective briefs.

10 I. INTRODUCTION
11 DomainTools plays a crucial role in developing cybersecurity threat intelligence for
12 researchers, companies, and law enforcement. It does so by obtaining publicly-available
13 information regarding Internet domain registrations, contextualizing that data with other
14 publicly-available cybersecurity threat data, and integrating the transformed information into
15 cybersecurity products and services that provide actionable cyber threat intelligence.
16 For more than a decade, DNCL, the New Zealand-based organization that purports to
17 regulate the .nz domain name space, has made the basic contact information for .nz domain
18 registrants publicly available—i.e., the name, physical address, telephone number, and email
19 address of entities and individuals who register .nz domains. DNCL has known that
20 DomainTools, along with many others, has been collecting this .nz domain registrant
21 information, and making it available to others for use in combatting cybercrime. However, in
22 November 2017, DNCL changed course: it implemented the Individual Registrant Privacy
23 Option (“IRPO”), giving a small number of .nz domain registrants the option of limiting the
24 information DNCL publicly discloses to just name and email address.
25 And now, via its PI Motion, DNCL seeks to rewrite Internet history, asking this Court
26 to retroactively apply DNCL’s new policy to all .nz domain data that it previously made
27 publicly available. DNCL demands that DomainTools not only stop collecting any publicly
28 available information about all .nz domain registrants (not just those who have opted into the
+1-206-839-4300
1 IRPO), but that DomainTools erase all traces of historic .nz domain registrant information
2 collected prior to IRPO. DNCL argues that DomainTools’ collection and storage of publicly-
3 available .nz domain registrant information has irreparably harmed DNCL’s reputation and
4 goodwill by depriving .nz domain registrants of “implicitly” promised “privacy protections.”
5 There are serious factual questions, however, about DNCL’s claims it will suffer
6 irreparable harm, its standing to sue, and the likelihood of success on the merits. For example,
7 has any .nz registrant complained to DNCL that it will not register a .nz domain because
8 DomainTools collects this information? Or, can DNCL mitigate the alleged harm by
9 technically shutting off the type of collection it alleges? The answers to these, and more
10 questions, are not addressed in DNCL’s Complaint or PI Motion.
11 Accordingly, to defend itself against DNCL’s PI Motion, DomainTools requests
12 limited expedited discovery, narrowly targeted at key issues raised in DNCL’s PI Motion:
13 DNCL’s claims of irreparable harm; its purported standing to sue under two of its three claims;
14 and its likelihood of success. Good cause exists for this expedited discovery, as it is necessary
15 for the administration of justice—i.e., to assess whether DNCL is entitled to the extraordinary
16 relief that it demands and whether the Court even has the jurisdiction to award such relief.
17 DomainTools’ need for expedited discovery is heightened here because the relief
18 DNCL requests is not just a preliminary injunction that will maintain the status quo, but rather
19 a mandatory injunction that orders DomainTools to purge all historical, publicly available .nz
20 domain registrant information that it has collected openly for the last decade and to reconfigure
21 its products and services to omit this historical information until this litigation is resolved.
22 This would require DomainTools to take affirmative and potentially irreversible steps. DNCL
23 should not be granted this extraordinary relief without offering DomainTools the reasonable
24 opportunity to obtain evidence of whether there is actual irreparable harm, standing, and on the
25 merits of DNCL’s claims.
26 II. STATEMENT OF FACTS
27 With an estimated 9.7 billion records compromised thus far in 2018
28 (https://breachlevelindex.com/), cybersecurity threats are ranked as one of the most impactful

+1-206-839-4300
1 global risks. See World Economic Forum, The Global Risks Report 2018.1 Internet domains
2 are critical to cybercriminals’ ability to develop and operate a command and control
3 infrastructure that can be used to host malware, ransomware, or other tools to exploit
4 unsuspecting individuals and companies. See Anti-Phishing Working Group, Global Phishing
5 Survey: Trends and Domain Name Use in 2016.2 DomainTools plays a crucial role in
6 cybersecurity threat intelligence for individuals, companies, and law enforcement by, among
7 other things, collecting publicly-available information regarding the owners of Internet
8 domains, transforming that data by contextualizing it with other publicly-available
9 cybersecurity threat data, and integrating it into security products and services.
10 A. Historically, Domain Registrant Information Has Been Public
11 Every year, millions of individuals, businesses, organizations, and governments
12 register domain names. For each domain, a registrant must provide basic identifying and
13 contact information that may include: the registrant’s name, physical address, email address,
14 phone number, and administrative and technical contacts—commonly referred to as “WHOIS
15 data.” See https://whois.icann.org/en/about-whois.
16 WHOIS data is not available in a single, centrally-operated database. Rather, it is
17 maintained and published by various top level domain (TLD) registries. See
18 https://whois.icann.org/en/glossary-whois-terms. The TLD is commonly thought of as the
19 portion of the domain address after the “dot.” Country code Top Level Domains (“ccTLDs”)
20 are comprised of two letters, such as “.us” or “.nz,” and are generally used by or reserved for a
21 country, sovereign state, or dependent territory. Id. Each ccTLD registry publishes WHOIS
22 data via a “WHOIS server”, which can be queried to provide WHOIS data. Id.
23 B. DomainTools’ Cybersecurity Products Play a Crucial Role in Cybersecurity

Threat Intelligence and Attribution
24
25 DomainTools was founded in Seattle, Washington sixteen years ago. Declaration of
26 Michael Klatt in Support of DomainTools’ Motion for Expedited Discovery (“Klatt Decl.”)
27
1
Available at http://www3.weforum.org/docs/WEF_GRR18_Report.pdf.
28 2
Available at https://docs.apwg.org/reports/APWG_Global_Phishing_Report_2015-2016.pdf.

+1-206-839-4300
1 ¶ 4. Early on, DomainTools aggregated publicly-available WHOIS data from various TLDs to
2 create a fulsome picture of the ownership records of a domain name. Id. at ¶ 5. That
3 information was valuable in battling cybersquatting, managing buying and selling domain
4 names, and tracking renewal and content of registrations. As the cybersecurity landscape
5 evolved, DomainTools’ products and services also matured. DomainTools responded by
6 developing a suite of products that today provides Internet infrastructure maps that can be used
7 to support threat intelligence research, strengthen IT infrastructure defense, prevent IP theft,
8 proactively block bad actors from networks, and assist law enforcement with attribution of
9 behavior to specific bad actors as part of criminal investigations. Id. at ¶ 6. DomainTools

10 products and services have been used, for example, to analyze the threat actor infrastructure
11 that targeted the 2018 Winter Olympic Games in South Korea and to assist law enforcement’s
12 investigation, takedown, and prosecution of illegal internet pharmacies. Id. at ¶ 7.
13 C. DNCL Historically Made .nz Domain Registrant Information Publicly Available

14 InternetNZ is a non-profit entity that ICANN3 recognizes as the sole authority for the
15 administration and management of .nz domain names. See Heath Decl., Ex. 1; see also Dkt.
16 No. 4 (“Carey Decl.”) ¶ 2. InternetNZ appointed DNCL “to develop and monitor a
17 competitive registrar market.” Compl. ¶ 2.
18 InternetNZ and DNCL recognize the need for WHOIS data to be public, having
19 explicitly adopted the principle that “Registrant data should be public,” and acknowledging
20 that “[a] free and publicly available register lookup service (such as WHOIS) should be
21 maintained, with relevant authoritative information about the registrant, registrar and DNS
22 servers for the domain.” See id., Ex. 1. From a procedural perspective, they recognize that
23 “[t]he public is entitled to access information about a .nz domain name through a domain name
24 registration data query . . . .” See id., Ex. 2.
25 Until “very recently,” DNCL has made .nz domain registrants’ names, telephone
26
3
ICANN oversees the huge and complex interconnected network of unique identifiers that allow computers on
27 the Internet to find one another, as is generally responsible for Internet Protocol (“IP”) address space allocation,
protocol identifier assignment, and ccTLD and gTLD domain name system management. See
28 https://whois.icann.org/en/glossary-whois-terms.

+1-206-839-4300
1 numbers, physical addresses, and email addresses publicly available through a variety of
2 WHOIS query services that include: (i) the DNCL website; (ii) the .nz Port 43 Services that
3 allows for automated processes and queries of .nz domains; and (iii) third-party registrars with
4 special access to .nz registry systems. See Carey Decl., ¶¶ 14-16, 19. On April 20, 2018,
5 DNCL restricted .nz domain registrant information publicly available through Port 43 to just a
6 registrant’s name and email address. See id. at ¶ 19. DomainTools ceased collecting any
7 WHOIS data from DNCL on June 14, 2018. Klatt Decl., ¶ 3.
8 D. Since November 2018, DNCL and DomainTools Have Been Discussing Use of
Publicly Available .nz Domain Data
9
10 On November 2, 2017—just weeks before it would launch the IRPO4 program that
11 affords certain qualifying .nz domain registrants the option to restrict the amount of publicly-
12 available registrant information (Carey Decl. ¶ 34)—DNCL sent DomainTools a cease-and-
13 desist letter, alleging that it had accessed the .nz WHOIS servers, downloaded .nz domain
14 registrant information, and republished that data through its “Whois History” and “Reverse
15 Whois” products in violation of DNCL’s Terms of Use (“TOUs”). See Heath Decl., Ex. 1.
16 DNCL also alleged that by violating the TOUs, DomainTools “may violate” the Computer
17 Fraud and Abuse Act (“CFAA”) and the Washington Consumer Protection Act (“WCPA”).
18 Id. On December 1, 2017, DomainTools responded, denying DNCL’s accusations, seeking
19 further clarification and information, and inviting a further discussion with DNCL.
20 The parties then discussed the substance of DNCL’s cease-and-desist letter on January
21 2, 2018, and DomainTools followed-up with a letter on February 7, 2018, seeking clarification
22 of DNCL’s interpretation of its TOUs. See id., Exs. 2 & 3. On February 21, 2018, DNCL
23 proposed an in-person meeting in March 2018 between representatives for DNCL and
24 DomainTools, specifying that if resolution could not be reached, DNCL would file suit by the
25 end of March. Heath Decl. ¶ 5. Accordingly, on March 22, 2018, DomainTools met with
26 representatives from DNCL (including Mr. Carey) to discuss their respective positions. Id. at
27
4
DNCL claims that approximately 2 percent of .nz domains have opted into the IRPO program. Carey Decl.,
28 ¶ 53.

+1-206-839-4300
1 ¶ 5, Ex. 4. DomainTools followed up with a detailed letter on March 30th to DNCL refuting its
2 allegations and raising several concerns, including DNCL’s indication that it had intentionally
3 drafted its TOUs to be vague and ambiguous in order to give DNCL leeway to prohibit any
4 conduct it subjectively believed violated its TOUs.5 Id., Ex. 4.
5 On May 2, 2018, DNCL made clear that further discussions would not be constructive
6 and that it was prepared to file litigation. See Heath Decl., Ex. 5. Six weeks later on June 15,
7 2018—nearly seven months after first sending DomainTools a cease-and-desist letter—DNCL
8 sued DomainTools asserting claims for: (i) breach of the TOUs; (ii) violations of the CFAA
9 arising from DomainTools’ purported unauthorized access of the .nz WHOIS servers; and (iii)
10 violations of the WCPA. See generally, Compl. Specifically, DNCL alleges that
11 DomainTools’ methods of collection and storage of publicly available .nz domain registrant
12 violates DNCL’s TOUs. See id. at ¶¶ 72-77. DNCL also alleges that by storing “historical”
13 .nz domain registrant information, DomainTools interferes with DNCL’s newly implemented
14 measures to keep .nz domain registrant information private (see id. at ¶¶ 80-83), and that its
15 “integrity and reputation” have been injured because DNCL represents and assures certain
16 qualifying individual .nz domain registrants that if they successfully apply for the IRPO, their
17 detailed contact information will be withheld from public view, available only to entities
18 showing a legitimate need for that information after a rigorous process. See id. at ¶ 80.
19 DNCL simultaneously filed its PI Motion, seeking an order that inter alia, requires
20 DomainTools to (i) stop accessing DNCL’s WHOIS query services (which DomainTools has
21 already done); (ii) stop using the publicly available .nz domain registrant data in its
22 cybersecurity products; and (iii) delete all historical .nz domain registrant data pending
23 resolution of the litigation. See Dkt. No. 2. Driving its PI Motion is DNCL’s assertion that its
24 “reputation and goodwill” will suffer irreparable harm if DomainTools is allowed to continue
25 to store and use historical .nz domain data. DNCL argues that the historical versions of the
26 publicly available .nz domain data may contain .nz domain registrant information that DNCL
27
5
Although DomainTools repeatedly sought clarity on DNCL’s interpretation of its TOUs, DNCL has never
28 provided any.

+1-206-839-4300
1 had just recently decided to give particular .nz registrants the option of restricting from the
2 public and that DomainTools’ possession of the historical .nz domain data prevents DNCL
3 from implementing its IRPO policy, making DNCL “unable to deliver on the promises it made
4 to IRPO registrants.” See id. at 22.
5 E. Expedited Discovery is Critical to Issues Raised in DNCL’s PI Motion

6 Expedited discovery is appropriate in this case for three reasons. First, DNCL’s
7 purported irreparable harm to its goodwill and reputation is at best, speculative and at worst,
8 nonexistent. DomainTools, therefore, is seeking information about DNCL’s “implicit”
9 promise to .nz domain registrants and their expectations of privacy, as well as concrete
10 information regarding how DomainTools’ alleged activity has had any impact on .nz domain
11 registrants’ perception of DNCL, registration of .nz domains, or its reputation and goodwill.
12 This information will directly address DNCL’s assertions of irreparable harm.
13 Second, there is a fundamental question regarding DNCL’s standing to sue. DNCL
14 purports to administer the .nz domain register, but Internet NZ “manages the technical
15 functions associated with the .nz domain name space, including the Domain Name System
16 infrastructure and the Shared Registry for the .nz domain names.” Carey Decl., ¶ 4. In other
17 words, InternetNZ—not DNCL—appears to operate the .nz registry and the computer servers
18 that allow the .nz domains to function, including the .nz registry, the .nz domain name server
19 (DNS), and the .nz Port 43 WHOIS.” See https://www.dnc.org.nz/whois/port-43. Information

20 regarding the ownership of the WHOIS servers, what entity has the relationship with the .nz
21 domain registrants, and the purported Washington residents who registered a .nz domain is
22 pivotal in determining what entity could truly claim “harm”, and thus establish standing sue,
23 for DomainTools’ alleged conduct.
24 Third, beyond these threshold issues, there are discrete factual issues regarding
25 DNCL’s ability to establish likelihood of success. For example, whether the TOUs that form
26 the basis of DNCL’s breach of contract claim, and attendant CFAA claim, are intentionally
27 vague and ambiguous to afford DNCL substantial leeway in proscribing prohibited conduct.
28 Each of these concerns are fundamental to determining whether DNCL is entitled to

+1-206-839-4300
1 any preliminary relief. Yet, the information—which is undoubtedly within DNCL’s
2 possession, custody, or control—is absent from DNCL’s papers. Accordingly, the expedited
3 discovery DomainTools seeks regarding DNCL’s claimed irreparable harm, its lack of
4 standing to sue, and its inability to establish a likelihood of success, are critical for
5 DomainTools to show and the Court to conclude that injunctive relief is not appropriate.
6 III. LEGAL ARGUMENT
7 “[A] party may not seek discovery from any source before the parties have conferred as
8 required by Rule 26(f),” unless otherwise authorized by the rules, stipulation of the parties, or
9 court order. Fed. R. Civ. P. 26(d)(1). A court may grant a request for early discovery prior to
10 a Rule 26(f) conference where the requesting party demonstrates good cause. Fluke Elecs.
11 Corp. v. Cordex Instruments, Inc., No. C12-2082JLR, 2013 WL 566949 (W.D. Wash. Feb. 13,
12 2013); Semitool, Inc. v. Tokyo Electron Am., Inc., 208 F.R.D. 273, 276 (N.D. Cal. 2002).
13 Although the “good cause” standard may be satisfied where a party seeks a preliminary
14 injunction, it is not automatically granted merely because a party seeks this type of relief. Am.
15 Legalnet, Inc. v. Davis, 673 F. Supp. 2d 1063, 1066 (C.D. Cal. 2009). In considering whether
16 good cause exists, factors courts may consider include: “(1) whether a preliminary injunction
17 is pending; (2) the breadth of the discovery requests; (3) the purpose for requesting the
18 expedited discovery; (4) the burden on the defendants to comply with the requests; and (5)
19 how far in advance of the typical discovery process the request was made.” Id. at 1067; Exari
20 Sys. Inc. v. Amazon Corp., No. C15-356 MJP, 2015 WL 12025325 (W.D. Wash. May 4,
21 2015).
22 Here, expedited discovery is necessary to determine (a) the factual/evidentiary basis for
23 DNCL’s claims of irreparable harm, including showing that it is not irreparable and is within
24 DNCL’s control; (b) whether DNCL even has standing to assert claims under the WCPA and
25 CFAA; and (c) whether DNCL has a substantial likelihood of success on its claims. All
26 factors tip sharply in favor of DomainTools.
27 A. A Preliminary Injunction is Pending

28 The first factor, whether a preliminary injunction is pending, favors DomainTools.
+1-206-839-4300
1 Whether DNCL has in fact suffered irreparable harm, is likely to succeed on the merits, and
2 has standing to sue for relief under the CFAA and WCPA are all issues that are critical to the
3 ruling on the preliminary injunction. Expedited discovery will help DomainTools and the
4 Court determine, among other things (a) the extent of the purported irreparable harm, whether
5 it results from DomainTools’ alleged activity, and the extent to which DNCL can (or has)
6 mitigated the purported irreparable harm; (b) whether any Washington consumers have
7 decided to sign on to DNCL’s IRPO service; and (c) which entity (if any) has standing to
8 assert the alleged irreparable harm DNCL purports to have suffered. Probative information on
9 these issues is within DNCL’s control.

10 B. The Breadth of the Discovery Requested is Proper
11 DomainTools is asking for narrowly tailored discovery that addresses the key issues
12 outlined above, relating to irreparable harm, the likelihood of success on the merits, and
13 standing. Interrogatories Nos. 4 through 7; RFPs Nos. 5-7 & 10-12; the requested half-day
14 deposition; and RFAs Nos. 1 and 2 seek information regarding (a) whether the proposed
15 mandatory injunction would actually remediate DNCL’s privacy concerns; (b) whether a
16 preliminary injunction is even necessary given DNCL’s ability to limit what .nz domain
17 registrant information is made available to the public; (c) DNCL’s delay in seeking
18 preliminary injunctive relief, notwithstanding the purported harm and concerns; and (d) the
19 purported extent to which DNCL’s reputation and goodwill have and will continue to be
20 harmed by DomainTools’ specific activity, as opposed to general data privacy concerns. See
21 Heath Decl., Exs. 7-10.
22 Interrogatories Nos. 1 and 2 and RFPs Nos. 1 and 2 seek information regarding the
23 purported Washington consumers that form the basis of DNCL’s claims for unfair business
24 practices. See id. Interrogatory No. 3 and RFPs Nos. 3 and 4 seek information regarding the
25 interpretation of DNCL’s Terms of Use, which is a critical first step in determining whether
26 DNCL can establish that a valid contract existed between itself and DomainTools and whether
27 such contract had any bearing on the scope of DomainTools’ authorization to access DNCL
28 systems. See, e.g., Tompkins v. 23andMe, Inc., No. 5:13-CV-05682-LHK, et al, WL 2903752,
+1-206-839-4300
1 at *6-7 (N.D. Cal. June 25, 2014) (holding that the terms of service were unenforceable
2 because where it was unclear whether the website provided notice sufficient to establish
3 mutual manifestation of assent); United States v. Drew, 259 F.R.D. 449, 465 (C.D. Cal. 2009)
4 (holding that the plaintiff failed to state a claim for a CFAA violation because the plaintiff
5 failed to establish “which precise terms of service, when breached,” revoked access to the
6 website); Be In, Inc. v. Google Inc., 2013 U.S. Dist. LEXIS 147047, No. 12-CV-03373-LHK,
7 at *24-26 (N.D. Cal. Oct. 9, 2013) (acknowledging that it is necessary to evaluate the meaning
8 of terms of use to determine whether a website’s terms of service are enforceable). As for
9 DNCL’s standing to sue, RFPs Nos. 8 and 9 seek information regarding DNCL and
10 InternetNZ’s relationship and their respective responsibilities as they relate to the .nz domains.
11 See Heath Decl., Ex. 7-10.
12 Each request is tied directly to assertions or allegations at issue in DNCL’s preliminary
13 injunction motion and does not seek all facts or evidence relevant to DNCL’s allegations in its
14 Complaint. Further, the requests themselves are narrowly tailored to avoid burdening DNCL
15 when responding. For example, where appropriate, the requests do not seek “all documents”
16 but rather “documents sufficient to show…” relevant information. Nor has DomainTools
17 sought a full 7-hour deposition; instead, it seeks only a half-day of testimony on limited topics
18 (which it is happy to accommodate by video). This scope undoubtedly falls well within the
19 boundaries of expedited discovery as it relates only to issues necessary for determining the
20 preliminary injunction. See Suja Life, LLC v. Pines Int'l, Inc., No. 16CV985-GPC(WVG),
21 2016 WL 4142337, at *3 (S.D. Cal. Aug. 4, 2016) (granting expedited discovery, in part, and
22 continuing the preliminary injunction hearing where the discovery was aimed at the likelihood
23 of success on the merits and irreparable harm “to oppose the motion for preliminary
24 injunction”); Quia Corp. v. Mattel, Inc., No. C10-01902-JF (HRL), 2010 WL 2179149, at *2
25 (N.D. Cal. May 27, 2010) (granting defendants’ motion for expedited discovery relating to
26 plaintiff’s preliminary injunction motion); see also Kremen v. Cohen, No. 5:11-CV-05411-
27 LHK, 2011 WL 6113198, at *10 (N.D. Cal. Dec. 7, 2011) (granting motion for expedited
28 discovery where the discovery was “all related to [the] motion for a preliminary injunction”
- 10 - 701 Fifth Avenue, Suite 5600
+1-206-839-4300
1 and “narrowly tailored to discover evidence necessary to prove” the party’s position).
2 C. DomainTools Has a Compelling Need for the Expedited Discovery

3 The third factor favors DomainTools because the purpose of requesting the expedited
4 discovery is tied closely to issues critical in deciding DNCL’s preliminary injunction, which if
5 granted would be tantamount to granting DNCL a permanent injunction. As set forth above
6 (see Section III.B supra), the discovery sought is information only DNCL possesses and that
7 only DNCL can provide: the reputational ramifications that DNCL may suffer, whether
8 DNCL can mitigate the purported harm it suffered, its construction of the Terms of Use, the
9 identities of the Washington State consumers with .nz domains, the ownership of the .nz
10 WHOIS servers and other technical details related to how, and to what extent, DNCL allows
11 its servers to be queried. Without this information DomainTools cannot adequately respond to
12 DNCL’s motion for preliminary injunction. Rather, DomainTools would need to combat the
13 speculative injury DNCL describes to its goodwill and reputation with more speculation, rather
14 than evidence and facts. And although, DNCL may argue that the purported evidence it has
15 provided is sufficient, DomainTools is entitled to seek factual basis for what are otherwise
16 merely speculative and self-serving allegations that DNCL offers. See Suja Life, 2016 WL
17 4142337, at *3; Quia Corp., 2010 WL 2179149, at *2.
18 D. DNCL Will Not Suffer Any Undue Prejudice By Limited Expedited Discovery
19 DNCL will not be unduly burdened by limited expedited discovery. In fact, during the
20 parties’ meet-and-confer, DNCL said that it may agree to respond to limited interrogatories
21 and might reciprocate with its own discovery requests to DomainTools.6 Moreover, although
22 narrow, the discovery requested on an expedited basis would be among the broader discovery
23 DNCL would have to produce later in this litigation. See Renaud v. Gillick, No. C06-
24
6
On June 22, 2018, the parties met and conferred regarding potential expedited discovery. See Heath Decl. ¶ 8.
25 DNCL said that it may be willing to stipulate to reciprocal limited expedited discovery in the form of
Interrogatories so long as it did not delay the July 13, 2018 preliminary injunction hearing. Id. After
26 DomainTools provided detail regarding its desired discovery and a proposed timeline for production and briefing,
DNCL declined to agree to any discovery. Id. Even after learning that the Court’s schedule precludes a ruling on
27 DomainTools’ motion for expedited discovery prior to the deadline for DomainTools’ response to the preliminary
injunction motion, DNCL refused to stipulate to a one-week extension of the preliminary injunction motion. Id.
28 at ¶ 9, Ex. 6.

+1-206-839-4300
1 1304RSL, 2007 WL 98465, at *2 (W.D. Wash. Jan. 8, 2007) (finding no prejudice where the
2 requested documents already existed and would surface during the normal course of
3 discovery). Nor is this discovery burdensome in comparison to what courts have ordered
4 elsewhere. See Pyro Spectaculars N., Inc. v. Souza, No. CIV S-12-0299 GGH, 2012 U.S. Dist.
5 LEXIS 15801, at *9-13 (E.D. Cal. Feb. 8, 2012) (finding no prejudice from request for
6 forensic examination of computers and other electronic storage media and sufficiently-narrow
7 depositions and documents requests).
8 Finally, the short time delay (approximately 35 days) will also not prejudice DNCL
9 where it, of its own accord, took more than six weeks to sue after negotiations broke down,
10 and more than seven months after initially demanding DomainTools cease and desist. Given
11 what is at stake for DomainTools and DNCL, a brief extension of time to allow the parties to
12 complete discovery and incorporate the responsive information into their respective briefings
13 is fair and appropriate, especially given that DomainTools ceased accessing DNCL’s query
14 services, substantially mitigating the alleged risk of ongoing harm in the interim 35 days.
15 E. The Typical Discovery Timeline is Not Appropriate

16 Considering how far in advance of the typical discovery process DomainTools makes
17 this request, the final factor favors granting expedited discovery. Currently, there is no
18 discovery timeline or case management scheduling order. Discovery cannot commence until
19 after the parties conduct their Federal Rule Civil Procedure 26(f) conference, which would not
20 be held prior to the preliminary injunction hearing. If discovery is conducted on the normal
21 schedule, DomainTools would be denied access to facts that address the DNCL’s dubious
22 claim of irreparable harm, its ability to establish likelihood of success, and standing.
23 IV. CONCLUSION
24 DomainTools tailored its proposed expedited discovery narrowly to obtain evidence
25 necessary to evaluate DNCL’s preliminary injunction motion. DomainTools respectfully
26 requests the Court grant its motion for expedited discovery.
27
28
+1-206-839-4300
1 Dated: June 28, 2018 ORRICK, HERRINGTON & SUTCLIFFE LLP
3 By: s/Aravind Swaminathan

s/Melanie D. Phillips
4 Aravind Swaminathan (State Bar No. 33883)
aswaminathan@orrick.com
5 Melanie D. Phillips (State Bar No. 48945)
mphillips@orrick.com
6 Orrick, Herrington & Sutcliffe, LLP
701 Fifth Avenue, Suite 5600
7 Seattle, WA 98104
Telephone: 206-839-4300
8 Facsimile: 206-839-4301
9 Jacob M. Heath (pro hac vice to be filed)
jheath@orrick.com
10 1000 Marsh Road
Menlo Park, CA 94025-1015
11 Telephone: 650-614-7400
Facsimile: 650-614-7401
12
Attorneys for Defendant DomainTools, LLC
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
+1-206-839-4300
2
3
4
5
6
7

11 Telephone: 206-839-4300
Facsimile: 206-839-4301
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
+1-206-839-4300
Case 2:18-cv-00874-JCC Document 9-1 Filed 06/28/18 Page 1 of 4

10 AT SEATTLE

12 Plaintiff,
[PROPOSED] ORDER GRANTING
13 v. DEFENDANT DOMAINTOOLS’
MOTION FOR EXPEDITED
14 DOMAINTOOLS, LLC, DISCOVERY
15 Defendant.
16
17
18
19
20
21
22
23
24
25
26
27
28
[PROPOSED] ORDER GRANTING ORRICK, HERRINGTON & SUTCLIFFE LLP
DEFENDANT’S MOTION FOR EXPEDITED 701 Fifth Avenue, Suite 5600
DISCOVERY Seattle, Washington 98104-7097
Case No. 2:18-CV-874 +1-206-839-4300
1 THIS MATTER comes before the Court on Defendant DomainTools, LLC’s Motion
2 for Expedited Discovery.
3 The Court has considered Defendant’s Motion, Plaintiff’s response, and Defendant’s
4 Reply, along with the other pleadings and papers filed in this action. Based on the foregoing,
5 the Court orders as follows:
6 1. DNCL shall respond to DomainTools First Set of Expedited Interrogatories on or
7 before July 30, 2018;
8 2. DNCL shall respond to DomainTools First Set of Expedited Requests for
9 Production of Documents on or before July 30, 2018;

10 3. DNCL shall respond to DomainTools First Set of Expedited Requests for
11 Admission on or before July 30, 2018;
12 4. A 30(b)(6) witness shall be made available for a half-day deposition, with time on
13 the record not to exceed three and a half hours, which may proceed via video conference, on or
14 before August 3, 2018;
15 5. DNCL’s Motion for Preliminary Injunction is re-noted on the Court’s motion to
16 calendar for August 17, 2018;
17 6. DomainTools shall file its response to DNCL’s Motion for Preliminary Injunction
18 on or before August 13, 2018.
19 This discovery shall not preclude Defendant DomainTools from any and all discovery
20 permissible under the Federal Rules and shall not be counted against any limited thereunder.
21 IT IS SO ORDERED.
22 Dated this ___ day of __________, 2018.
23
24 By:
Hon. John C. Coughenour
25 United States District Judge
26
27
28
DEFENDANT’S MOTION FOR EXPEDITED -1- 701 Fifth Avenue, Suite 5600
+1-206-839-4300
1 Dated: June 28, 2018
2 PRESENTED BY
3 ORRICK, HERRINGTON & SUTCLIFFE LLP
5 By: s/Aravind Swaminathan

s/Melanie D. Phillips
6 Aravind Swaminathan (State Bar No. 33883)
aravind@orrick.com
7 Melanie D. Phillips (State Bar No. 48945)
mphillips@orrick.com
8 Orrick, Herrington & Sutcliffe, LLP
9 Seattle, WA 98104
Telephone: 206-839-4300
10 Facsimile: 206-839-4301
11 Jacob M. Heath (pro hac vice to be filed)
jheath@orrick.com
12 1000 Marsh Road
Menlo Park, CA 94025-1015
13 Telephone: 650-614-7400
Facsimile: 650-614-7401
14
Attorneys for Defendant DomainTools, LLC
15
16
17
18
19
20
21
22
23
24
25
26
27
28
+1-206-839-4300
2
3
4
5
6
7
By: s/ Aravind Swaminathan

11 Telephone: 206-839-4300
Facsimile: 206-839-4301
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
+1-206-839-4300
This page has been intentionally left blank
DECLARATION of Michael Klatt filed by Defendant DomainTools, LLC re 9

MOTION to Expedite Discovery (Swaminathan, Aravind) (Entered: 06/28/2018)


2
3
4
5
6
7

11 Telephone: 206-839-4300
Facsimile: 206-839-4301
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
KLATT DECLARATION IN SUPPORT OF ORRICK, HERRINGTON & SUTCLIFFE LLP
MOTION FOR EXPEDITED DISCOVERY -2- Seattle, Washington 98104-7097
Case No. 2:18-CV-874 +1-206-839-4300

DOMAIN NAME COMMISSION LIMITED Vs DomainTools

Diunggah oleh

Informasi Dokumen

Judul Asli

Hak Cipta

Format Tersedia

Bagikan dokumen Ini

Bagikan atau Tanam Dokumen

Opsi Berbagi

Apakah menurut Anda dokumen ini bermanfaat?

Apakah konten ini tidak pantas?

Hak Cipta:

Format Tersedia

DOMAIN NAME COMMISSION LIMITED Vs DomainTools

Diunggah oleh

Hak Cipta:

Format Tersedia

CORPORATE DISCLOSURE STATEMENT indicating no Corporate Parents

1 THE HONORABLE JOHN C. COUGHENOUR

8 UNITED STATES DISTRICT COURT

9 WESTERN DISTRICT OF WASHINGTON

11 DOMAIN NAME COMMISSION LIMITED

10 701 Fifth Avenue, Suite 5600

1 THE HONORABLE JOHN C. COUGHENOUR

8 UNITED STATES DISTRICT COURT

9 WESTERN DISTRICT OF WASHINGTON

11 DOMAIN NAME COMMISSION LIMITED

1 Defendant DomainTools, LLC (“DomainTools”) respectfully requests that this Court

3 Declaration of Jacob M. Heath in Support of DomainTools’ Motion for Expedited Discovery

4 (“Heath Decl.”) to permit DomainTools to obtain information necessary for it to oppose

9 incorporate any additional facts into their respective briefs.

11 DomainTools plays a crucial role in developing cybersecurity threat intelligence for

12 researchers, companies, and law enforcement. It does so by obtaining publicly-available

24 information DNCL publicly discloses to just name and email address.

4 goodwill by depriving .nz domain registrants of “implicitly” promised “privacy protections.”

11 Accordingly, to defend itself against DNCL’s PI Motion, DomainTools requests

25 merits of DNCL’s claims.

26 II. STATEMENT OF FACTS

27 With an estimated 9.7 billion records compromised thus far in 2018

28 (https://breachlevelindex.com/), cybersecurity threats are ranked as one of the most impactful

7 other things, collecting publicly-available information regarding the owners of Internet

8 domains, transforming that data by contextualizing it with other publicly-available

11 Every year, millions of individuals, businesses, organizations, and governments

14 phone number, and administrative and technical contacts—commonly referred to as “WHOIS

15 data.” See https://whois.icann.org/en/about-whois.

16 WHOIS data is not available in a single, centrally-operated database. Rather, it is

18 https://whois.icann.org/en/glossary-whois-terms. The TLD is commonly thought of as the

23 B. DomainTools’ Cybersecurity Products Play a Crucial Role in Cybersecurity

25 DomainTools was founded in Seattle, Washington sixteen years ago. Declaration of

DEFENDANT’S MOTION FOR EXPEDITED ORRICK, HERRINGTON & SUTCLIFFE LLP

5 evolved, DomainTools’ products and services also matured. DomainTools responded by

7 to support threat intelligence research, strengthen IT infrastructure defense, prevent IP theft,

9 behavior to specific bad actors as part of criminal investigations. Id. at ¶ 6. DomainTools

12 investigation, takedown, and prosecution of illegal internet pharmacies. Id. at ¶ 7.

13 C. DNCL Historically Made .nz Domain Registrant Information Publicly Available

17 competitive registrar market.” Compl. ¶ 2.

24 registration data query . . . .” See id., Ex. 2.

DEFENDANT’S MOTION FOR EXPEDITED ORRICK, HERRINGTON & SUTCLIFFE LLP

7 WHOIS data from DNCL on June 14, 2018. Klatt Decl., ¶ 3.

12 available registrant information (Carey Decl. ¶ 34)—DNCL sent DomainTools a cease-and-

18 Id. On December 1, 2017, DomainTools responded, denying DNCL’s accusations, seeking

DEFENDANT’S MOTION FOR EXPEDITED ORRICK, HERRINGTON & SUTCLIFFE LLP

4 conduct it subjectively believed violated its TOUs.5 Id., Ex. 4.

7 2018—nearly seven months after first sending DomainTools a cease-and-desist letter—DNCL

DEFENDANT’S MOTION FOR EXPEDITED ORRICK, HERRINGTON & SUTCLIFFE LLP

4 to IRPO registrants.” See id. at 22.

5 E. Expedited Discovery is Critical to Issues Raised in DNCL’s PI Motion

8 nonexistent. DomainTools, therefore, is seeking information about DNCL’s “implicit”

12 This information will directly address DNCL’s assertions of irreparable harm.

13 Second, there is a fundamental question regarding DNCL’s standing to sue. DNCL

19 (DNS), and the .nz Port 43 WHOIS.” See https://www.dnc.org.nz/whois/port-43. Information

23 for DomainTools’ alleged conduct.

28 Each of these concerns are fundamental to determining whether DNCL is entitled to

1 any preliminary relief. Yet, the information—which is undoubtedly within DNCL’s

6 III. LEGAL ARGUMENT

26 factors tip sharply in favor of DomainTools.

27 A. A Preliminary Injunction is Pending

9 these issues is within DNCL’s control.

21 Heath Decl., Exs. 7-10.

11 See Heath Decl., Ex. 7-10.

17 4142337, at 3; Quia Corp., 2010 WL 2179149, at 2.

22 Dated this _ day of ________, 2018.