The majority of online defamation is posted anonymously or pseudonymously, and many cases require issuing subpoenas—including to internet service providers (ISPs)—to identify the unknown posters.

As discussed below, this process often involves obtaining internet protocol (IP) addresses from an entity, in response to a subpoena; determining the ISPs that own the respective IP addresses produced by the subpoenaed entity; and then issuing additional subpoenas to those ISPs.

Subpoena process generally

Individuals looking to attack others on the internet almost never use their real names or email addresses. In most cases, harmed parties cannot immediately identify the online posters with certainty, even if they have suspicions of the posters’ identities.

Therefore, to pursue legal claims against a presently unknown poster, it might be necessary for a defamed party to issue a subpoena to the relevant website (or its parent company) for documents containing certain identifying information like basic contact information and IP addresses – subject, of course, to the information that the posters actually provided to the website upon registering an account with the websites.

Many online posters are naïve in thinking that they can post harmful statements anonymously or pseudonymously and never have their identities discovered – especially if they provide fake contact information or create new email accounts, separate from their actual personal accounts, upon registering accounts with the websites.

Through the subpoena process, the identities of unknown posters can typically be determined, notwithstanding any information that is withheld or falsified (and barring the unknown parties successfully moving to quash the subpoenas).

For more on this process, including the standard (generally) that an issuing party must satisfy to subpoena an entity to unmask an anonymous online poster, download our “Subpoena Guide for Identifying Anonymous Internet Posters.”

Subpoenaing ISPs

Even if an initial subpoena does not produce information sufficient to identify an unknown poster, such as an actual name or a name discernible from a legitimate email address, there is typically value in any IP addresses produced.

For instance, a subpoena to Google Inc. relating to a Google review might not produce any information that allows the harmed party to immediately ascertain the poster’s identity. However, Google might produce the IP address from which the Google account was registered and IP logs related to the Google account.

From there, the harmed party can determine the ISPs that own the relevant IP addresses through a search on an IP lookup website, and the party can then prepare a subpoena to the respective ISPs for documents containing subscriber information.

It is important to note that Cable provider ISPs, such as Time Warner Cable (TWC) and Comcast, are subject to the Cable Privacy Act, 47 U.S.C. § 551. These entities are prohibited from releasing any personally identifying customer information, absent a court order.

Thus, a party attempting to subpoena a cable provider ISP for documents containing subscriber information must first file a motion with the relevant court requesting an order permitting the cable company to disclose the requested information.

This frequently necessary additional step in the process is essentially one that comes down to luck: sometimes defamatory content is published using (or from an account that was registered using) a cable provider ISP, while sometimes it is not.

Subpoenaing an ISP involves providing the IP address or addresses in question with the particular time and date listed in the initial subpoena production. Many IP addresses are considered “dynamic,” meaning the IP addresses assigned to certain customers change sporadically, so it is critical to provide timestamps.

It is important to note that many ISPs only keep subscriber information relating to IPs for just six or nine months – maybe even less. Thus, any party contemplating serving subpoenas should do so sooner rather than later (including being prompt in filing any potentially necessary motion(s) to authorize and ensuring that the court does not sit on the motion(s) for too long).

A valid subpoena to an ISP will often lead to the production of legitimate information that can help a harmed party confirm the identity of its detractor and pursue its claims against that person (including amending the complaint to name the identified party as the defendant or attempting to reach an out-of-court settlement).