University and College Union v Person(s) Unknown [2024] EWHC 2998 (KB)

[2024] EWHC 2998 (KB)

Case No KB-2024-003440

IN THE HIGH COURT OF JUSTICE

KING’S BENCH DIVISION

MEDIA AND COMMUNICATIONS LIST

Venue Royal Courts of Justice, Strand, London, WC2A 2LL

Date 22/11/2024

Before

MRS JUSTICE HILL DBE

Between

UNIVERSITY AND COLLEGE UNIONClaimant

PERSON(S) UNKNOWNDefendant

responsible for obtaining data from the Applicant’s IT systems on or about 12 August 2024 to 16 August 2024 and/or who has disclosed or is intending or threatening to disclose the information thereby obtainedDefendant

Adam Speker KC and Ben Gallop (instructed by DAC Beachcroft LLP) for Claimant

for The Defendant was not represented

Approved Judgment

This judgment was handed down remotely at 10.30am on 22 nd November 2024 by circulation to the parties or their representatives by e-mail and by release to the National Archives.

.............................

MRS JUSTICE HILL

Introduction

[1]On 17 October 2024, at a private hearing without notice, Richard Spearman KC, sitting as a Deputy Judge of the High Court (“the Deputy Judge”), made an interim injunction in this case and various other orders. On 14 November 2024 I extended the injunction to trial or further order and made other related orders. These are my reasons for doing so.

The factual background and procedural history

[2]The Claimant is a trade union and professional association for staff working in higher education.

[3]The Defendant is a Person or Persons Unknown responsible for wrongly obtaining data from the Claimant’s IT systems on or about 12 August 2024 to 16 August 2024; and/or who has disclosed or is intending or threatening to disclose the information thereby obtained.

[4]By an application noticed dated 16 October 2024 the Claimant sought an urgent, pre-action interim injunction which(i) restrained the Defendant from further publication of the information in question; and

(ii) required (a) the delivery up, deletion or destruction of the information; (b) the provision of an email address for service; and (c) a statement confirming these steps and various other matters.

[5]On 17 October 2024 after a hearing partly in private, the Deputy Judge made the order sought. His reasons for the order were given in a short judgment in open court. This was not published but a note of it was prepared by the Claimant’s legal representatives. Having summarised the facts in accordance with [2]-[3] above, the Deputy Judge said as follows:

“The application began as a hearing in private which I acceded [to] because it is clear in my view, given the reasoning in the skeleton and what was ordered in similar cyber-attack cases, it should be heard in private. The form of relief sought is detailed and extensive but I am satisfied all aspects of the draft order in front of me are appropriate in a case of this sort and as Counsel has explained to me the provisions of…the order have been considered and ordered by the court in similar in other cases, Mr J Ritchie in Armstrong Watson LLP v Person(s) Unknown [2023] EWHC 762 (KB). I have ordered a Return Date longer than other injunctions in many orders served without notice as this one was appropriate because it is sensible to allow time in cases of this sort to see what will happen once the order is served. In my view there is nothing further that needs to be said about the application or the fact that it was heard in private. It follows a well-established pattern by other judges in this sort of case where people who were subject to criminal activity that infringes on their right to confidentiality.”

[6]On 23 October 2024 the Deputy Judge’s order was modified in one minor respect under the slip rule. The order was published on the Courts and Tribunals Judiciary website. The injunction expired on the return date of 14 November 2024.

The 8 November 2024 application

[7]By an application notice dated 8 November 2024 the Claimant sought an extension of the injunction to trial, directions, a continuation of the derogations from open justice imposed by the Deputy Judge and an order for alternative service pursuant to CPR 6.15(2) and 6.27.

[8]Adam Speker KC submitted a skeleton argument, dated 11 November 2024, in support of the Claimant’s application. The application was also supported by confidential witness statements from one witness dated 8 and 13 November 2024 and from another witness dated 8 November 2024.

Service on the Defendant

[9]The evidence showed that the Defendant had been served with the 16 October 2024 application notice, the Deputy Judge’s order, a redacted, sealed version of the Claim Form and Response Pack in accordance with the terms of the Deputy Judge’s order which made provision for alternative means of service.

[10]There were concerns that service had not been effective. Accordingly, the Claimant identified a further alternative method of service. This was adopted for all the documents referred to in the preceding paragraph.

[11]The Particulars of Claim and the 8 November 2024 application notice were served on the Defendant by these methods on, respectively, 6 and 11 November 2024.

[12]In light of this procedural history, the Defendant has been aware of the return date for some time. The Defendant has not engaged with the process in any way.

Method of determining the application

[13]The Claimant invited me to consider the application on the papers rather than holding a hearing and to proceed in the Defendant’s absence.

[14]I concluded that it was appropriate to do so, on the basis of the authorities cited and for reasons similar to those given by Linden J in Armstrong Watson LLP v Persons Unknown (No 2)

[2023] EWHC 921 (KB)

at [5]-[6]: see, in particular, the guidance given by Warby J (as he then was) in Clarkson plc v Person(s) Unknown

[2018] EWHC 417 (QB)

at [7]-[8] and Pirtek (UK) Limited v Robert Jackson

[2017] EWHC 2834 (QB)

at [19]-[24].

[15]As in Armstrong, the Defendant has not engaged with these proceedings. Given that the Defendant is an unidentified perpetrator of a cyber-attack, the clear inference is that this is deliberate and that there is no intention of doing so. Indeed, the Claimant does not realistically anticipate that the Defendant will meaningfully participate in the proceedings at all. If the Defendant decides to do so and/or seek a discharge or variation of my order, [13] of the order provides for that to happen.

[16]The open justice principle is sufficiently satisfied by the fact that the public can read this judgment, which includes a record of the Deputy Judge’s judgment, as well as the non-confidential aspects of both our orders. Further, given the nature of the claim, as in Armstrong, it is likely that certain aspects of the application would have to be dealt with in private, as they were before the Deputy Judge. Accordingly, a member of the public would elicit no further details of the case by attending a hearing than they can from reading this judgment.

The provisions of the order

[17]There was no reason on the information before me to depart from the Deputy Judge’s decision that England and Wales is the proper forum for this claim, as recorded in the recital to the order.

[18]The directions in respect of service at [1] of my order are appropriate and in accordance with the overriding objective for the reasons given by the Deputy Judge. Further, because of the issues referred to at [10] above, it was appropriate to grant the Claimant an order retrospectively validating service by this further method and permitting it as a method of alternative service going forward, under CPR 6.15(2).

[19]The Claimant’s confidential information remains in the possession of a Defendant who should not have it and is aware of that fact. The Defendant has not returned the information, despite service of the Deputy Judge’s order. The Defendant has not complied with the mandatory orders to deliver up the documents. A continuation of the interim injunctions at [2] of the order is therefore necessary, just and convenient.

[20]The directions for the future conduct of the proceedings at [3]-[6] are appropriate and in accordance with the overriding objective. They contemplate that if the Defendants continue to decline to engage with the proceedings, the Claimant will make an application for default judgment and/or summary judgment in the near future. They are intended to bring the claim to a conclusion as is appropriate: see, for example, Brett Wilson v Persons Unknown

[2016] 4 WLR 69

at [11] and LJY v Persons Unknown responsible for the demand for money contained in a letter received by the claimant’s representatives on 5 December 2017 at [48]-[56].

[21]The orders for the protection of hearing papers and relating to the provision of documents and information to third parties at [7]-[10] continue to be necessary and appropriate, as they were in the Deputy Judge’s order.

Conclusion

[22]For these reasons I granted the order sought by the Claimant.