Federal judge: Justice Department "Kafkaesque" in Attkisson v. DOJ and FBI for government computer intrusions

Not only should we disapprove of the tactics the government used to run out the clock on Attkisson’s claims, but we should also reject the troubling “game plan” it provided for the government and private parties to prevent disclosure of—and, therefore, responsibility for—their potentially unconstitutional or illegal electronic surveillance activities.

Judge James Wynn, U.S. Court of Appeals

Today, the attorneys representing Sharyl Attkisson in Attkisson v. DOJ and FBI for the government computer intrusions filed a new petition for en banc hearing (by a full panel of appellate judges).

More info including links to AUDIO of oral arguments here.

Federal appellate judge James Wynn sided with Attkisson in a dissenting opinion in March, calling the government's position "Kafkaesque."

Given the government’s longstanding opposition to affording Attkisson any discovery—including its initial Kafkaesque position that Attkisson was not entitled to obtain discovery regarding the identity of the Doe Defendants until Attkisson conducted a Rule 26(d) discovery conference with the unidentified Doe Defendants and the government’s later, equally unsupported position, which the magistrate judge rightly rejected, that Attkisson was entitled to discover only whatever information the government deemed “readily available”—and the court’s fast approaching substitution deadline, it was incumbent on the district court to ensure that the government did not use its ongoing discovery negotiations with Attkisson to run out the clock on her claims. Put simply, the district court needed to either (1) toll its deadline until Attkisson and the government reached an agreement as to a discovery plan that would allow Attkisson to meaningfully pursue the identity of the Doe Defendants or (2) compel the government to comply with Attkisson’s reasonable discovery requests in advance of the deadline. It did neither; instead, it enforced its deadline even though Attkisson never obtained meaningful discovery, effectively rewarding the government for its intransigence.

Judge Andrew Wynn, U.S. Court of Appeals

Judge Wynn also likened the Justice Department strategy against Attkisson to an old Tar Heels play.

Read Attkisson's Petition for Rehearing filed May 6, 2019 here.

Beginning in the late 1960s, when the University of North Carolina Tar Heels seized the lead in the second half of a basketball game, Hall of Fame head coach Dean Smith would raise his arm and put up four fingers. Requiring no further instruction, two post players would run to the two corners of the court formed by the baseline and the sidelines, and two wing players would move to the corners formed by the mid-court line and the sidelines. The point guard—most famously, Phil Ford—would then dribble the ball at the top of the key as the clock ticked down, occasionally exchanging the ball with one of the wing or post players if the defense applied too much pressure. In this offense—commonly referred to as the “Four Corners”—the clock was the Tar Heels’ best friend. The longer the Tar Heels held the ball on offense, the less time their opponent had to try to score and cut into the Tar Heels’ lead. The Four Corners proved so successful that college basketball’s powers-that-be effectively outlawed it through the adoption of the shot clock in 1985. In this case, the government—not unlike Dean Smith’s Tar Heels—put up the “fours” when Plaintiff-Appellant Sharyl Attkisson,3 a journalist formerly employed by CBS News, filed suit against unnamed employees and agents of the federal government (the “Doe Defendants”). Attkisson alleged that the Doe Defendants conspired to violate her constitutional and statutory rights by accessing and commandeering her home and work internet-connected devices for surveillance purposes. But Attkisson never got a meaningful opportunity to pursue her claims because the government did everything in its power to run out the clock on Attkisson’s action—it filed motions challenging venue and jurisdiction, motions challenging the sufficiency of service, motions for extension of time, motions to dismiss, and motions for protective orders. And just as the Tar Heels had great success running the Four Corners, the government’s strategy worked. Although Attkisson diligently sought to identify the Doe Defendants for nearly four years—including by repeatedly serving discovery on the government and third-parties directed at identifying the Doe Defendants—the district court dismissed her case with prejudice against the Doe Defendants for failing to comply with a court order to identify the names of the Doe Defendants by a date certain. The district court did so even though the government’s delaying tactics deprived Attkisson of any meaningful opportunity to engage in the discovery necessary to identify the Doe Defendants.

--Judge Andrew Wynn, U.S. Court of Appeals

Fight improper government surveillance. Support Attkisson v. DOJ and FBI over the government computer intrusions of Attkisson's work while she was a CBS News investigative correspondent. Visit the Attkisson Fourth Amendment Litigation Fund. Click here.

Judge Wynn also explained why Attkisson's landmark case will impact future cases of unwarranted government surveillance and government privacy invasions.

The most troubling aspect of the district court’s decision to dismiss Attkisson’s claims against the Doe Defendants is that it rewards the government’s concerted effort to deprive Attkisson any opportunity to pursue her claims and, by doing so, creates a game plan for the government and private parties to follow in future cases in which plaintiffs seek to challenge governmental or private electronic surveillance activities...As the government’s and private entities’ capacity to hoover up data increases—and as we move beyond accessing the Internet through a limited universe of devices to the Internet of things—the potential intrusion on privacy only increases. Under the government’s playbook—which the district court effectively endorsed—plaintiffs would be deprived all opportunity to challenge the legality of most, if not all, these government surveillance efforts.

Judge Andrew Wynn, U.S. Court of Appeals

Below is the full dissenting opinion by Judge Wynn in the appeal of Attkisson v. DOJ and FBI for the government computer intrusions. A petition for en bank rehearing was filed by Attkisson's attorneys on May 6, 2019.

WYNN, Circuit Judge, concurring in part1 and dissenting in part:

“When we saw the fours go up, game’s over.” 2—David Chadwick, Forward, University of North Carolina, 1967–71

Beginning in the late 1960s, when the University of North Carolina Tar Heels seized the lead in the second half of a basketball game, Hall of Fame head coach Dean Smith would raise his arm and put up four fingers. Requiring no further instruction, two post players would run to the two corners of the court formed by the baseline and the sidelines, and two wing players would move to the corners formed by the mid-court line and the sidelines. The point guard—most famously, Phil Ford—would then dribble the ball at the top of the key as the clock ticked down, occasionally exchanging the ball with one of the wing or post players if the defense applied too much pressure. In this offense—commonly referred to as the “Four Corners”—the clock was the Tar Heels’ best friend. The longer the Tar Heels held the ball on offense, the less time their opponent had to try to score and cut into the Tar Heels’ lead. The Four Corners proved so successful that college basketball’s powers-that-be effectively outlawed it through the adoption of the shot clock in 1985.

1 I concur in the majority opinion’s judgment that the district court properly dismissed Attkisson’s claims against the former Attorney General and former Postmaster General. I believe that Attkisson failed to plausibly allege that the former Attorney General and former Postmaster General were involved in any potential violation of Attkisson’s constitutional or statutory rights.

2 Brendan Marks, With Four Corners Offense, Dean Smith Changed Basketball, Daily Tar Heel (Feb. 9, 2015), https://www.dailytarheel.com/article/2015/02/with-four- corners-offense-dean-smith-changed-basketball.

42

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 43 of 72

In this case, the government—not unlike Dean Smith’s Tar Heels—put up the “fours” when Plaintiff-Appellant Sharyl Attkisson,3 a journalist formerly employed by CBS News, filed suit against unnamed employees and agents of the federal government (the “Doe Defendants”). Attkisson alleged that the Doe Defendants conspired to violate her constitutional and statutory rights by accessing and commandeering her home and work internet-connected devices for surveillance purposes. But Attkisson never got a meaningful opportunity to pursue her claims because the government did everything in its power to run out the clock on Attkisson’s action—it filed motions challenging venue and jurisdiction, motions challenging the sufficiency of service, motions for extension of time, motions to dismiss, and motions for protective orders.

And just as the Tar Heels had great success running the Four Corners, the government’s strategy worked. Although Attkisson diligently sought to identify the Doe Defendants for nearly four years—including by repeatedly serving discovery on the government and third-parties directed at identifying the Doe Defendants—the district court dismissed her case with prejudice against the Doe Defendants for failing to comply with a court order to identify the names of the Doe Defendants by a date certain. The district court did so even though the government’s delaying tactics deprived Attkisson of any meaningful opportunity to engage in the discovery necessary to identify the Doe Defendants.

3 Attkisson’s husband, James, and daughter, Judith, are also named plaintiffs because the alleged intrusions and commandeering of the Attkissons’ home computers and devices allegedly violated their statutory and constitutional rights as well.

43

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 44 of 72

The majority opinion affirms the district court’s dismissal of Attkisson’s claims against the Doe Defendants on grounds that the dismissal constituted a permissible exercise of the court’s discretion to oversee discovery and sanction a party for failing to comply with a court order. But this Court long has held that plaintiffs—like Attkisson— who state a plausible claim that unnamed defendants violated their constitutional or statutory rights are entitled to a meaningful opportunity to engage in discovery aimed at identifying the “true identity of an unnamed party.” Schiff v. Kennedy, 691 F.2d 196, 197–98 (4th Cir. 1982). And this Court has held that dismissal of an action for failure to comply with a court order is a “drastic” sanction, Hillig v. C.I.R., 916 F.2d 171, 174 (4th Cir. 1990), that courts should impose only in “extreme circumstances,” Reizakis v. Loy, 490 F.2d 1132, 1135 (4th Cir. 1974).

Because the government deprived Attkisson of a meaningful opportunity to identify the Doe Defendants and the district court never determined that the requisite “extreme circumstances” were present to warrant dismissal for failure to comply with a court order, I disagree with the majority opinion’s determination that the district court permissibly exercised its discretion in dismissing Attkisson’s claims against the Doe Defendants. Not only should we disapprove of the tactics the government used to run out the clock on Attkisson’s claims, but we should also reject the troubling “game plan” it provided for the government and private parties to prevent disclosure of—and, therefore, responsibility for—their potentially unconstitutional or illegal electronic surveillance activities. Accordingly, I respectfully dissent as to the dismissal of Attkisson’s claims against the Doe Defendants.

44

Fight improper government surveillance. Support Attkisson v. DOJ and FBI over the government computer intrusions of Attkisson's work while she was a CBS News investigative correspondent. Visit the Attkisson Fourth Amendment Litigation Fund. Click here.

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 45 of 72

I. A.

Because the district court dismissed Attkisson’s action prior to meaningful discovery, the relevant allegations, which this Court must accept as true, are set forth in Attkisson’s complaint. At the time of the events giving rise to her claim, Attkisson had been working as an investigative reporter for CBS News for 20 years. In early 2011, Attkisson began reporting on the “Fast & Furious” initiative, under which the Bureau of Alcohol, Tobacco, and Firearms (“ATF”) purposely allowed firearms dealers to sell marked weapons to straw buyers, in anticipation that the weapons would later be sold to Mexican drug cartels, thereby facilitating the identification and apprehension of key figures in the cartels. CBS aired a report on the Fast & Furious program on February 22, 2011. That report quoted and relied on confidential sources procured by Attkisson. Attkisson continued to report the story, which the Department of Justice initially denied, over the next several months. According to the complaint, Attkisson’s sources within ATF told Attkisson “that the [a]gency was actively seeking to identify government insiders who were providing information or ‘leaking’ to her and CBS.” J.A. 123.

In October 2011, the government’s Fast & Furious program came under renewed scrutiny when law enforcement officers found weapons distributed through the Fast & Furious program at several crime scenes, including the scene of the murder of an ATF agent. That fall, Attkisson “began to notice anomalies in numerous electronic devices at their home in Virginia.” J.A. 124. According to the complaint, Attkisson’s home and work computers would turn on and off at random, her house’s alarm would “chirp[] daily 45

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 46 of 72

at different times,” and her phone and television experienced problems. J.A. 124. All the affected devices were connected to the Internet via Verizon’s fiber optic service, FiOS. Verizon failed to cure the problems, despite making multiple attempts over a period of more than a year, including through installation of a new router. J.A. 124.

During 2012, Attkisson continued to experience “anomalies” with her internet- connected devices, which anomalies Attkisson repeatedly reported to Verizon, friends, and business associates. In December 2012, one of Attkisson’s “contact[s] with U.S. government intelligence experience” inspected Attkisson’s home and found an “extra” fiber optic cable “dangling” from Attkisson’s exterior Verizon box. J.A. 129. After Attkisson contacted Verizon regarding the “extra” cable, “a person represented to be a Verizon technician” visited Attkisson’s home on January 1, 2013 and removed the cable. J.A. 129. According to the complaint, notwithstanding that Attkisson told the technician to leave the cable, it disappeared. Over the next week, the Attkissons continued to experience problems with their internet service, which Verizon repeatedly, but unsuccessfully, tried to resolve.

On January 8, 2013, “an individual with special expertise in computer forensics” conducted a forensic examination of Attkisson’s laptop. J.A. 130. The expert reported that the “laptop showed clear evidence of outside and unauthorized ‘intrusion,’ that the sources of the intrusion were state-supported due to the sophisticated nature of the technology used,” and that “the software fingerprint indicated that the software was proprietary to the federal government.” J.A. 130. According to the forensic analysis

report, “[t]he intrusion included, among other surveillance, keystroke monitoring, 46

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 47 of 72

exfiltration of data, audio surveillance of [Attkisson’s] conversations and activities at home by activating Skype, mining personal passwords, monitoring work and personal email, and probable compromise of [Attkisson’s] work and personal smartphones.” J.A. 130. “The report also stated the intruders had accessed CBS network systems . . . and that the perpetrator had also place three (3) classified documents deep in the computer’s operating system.” J.A. 130. The forensic analysis determined that the intrusion began as early as June 2011 and traced the intrusion to an Internet Protocol (“IP”) “address owned, controlled, and operated by the United States Postal Service,” which “has been publicly reported, including in [Inspector General] internal audits, to have a working relationship with the FBI, Department of Homeland Security, and [the Department of Justice] for domestic surveillance projects.” J.A. 125, 134.

Several days later, Attkisson notified CBS, which hired an “independent forensic computer analyst” to inspect Attkisson’s home and internet-connected devices. J.A. 131. That forensic investigation, conducted on February 2, 2013, found that Attkisson’s work and home computers had been subjected to a “coordinated, highly-skilled series of actions and attacks directed at the operation of the computers and the storage of data thereon.” J.A. 131. Several days after that second investigation, Attkisson’s desktop computer began to malfunction, shut down, emitted a “burning odor,” and was rendered permanently inoperable. J.A. 131. The complaint further alleges that Attkisson’s BlackBerry, which was connected to the Verizon network, also was compromised.

On June 11, 2013, CBS issued a public statement, reporting that Attkisson’s

computer had been accessed using “sophisticated methods” by an unauthorized party on 47

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 48 of 72

multiple occasions. J.A. 132. The independent security firm hired by CBS to analyze Attkisson’s computer publicly confirmed that report. The government issued a statement, stating that to its “knowledge, the Justice Department has never compromised Ms. Attkisson’s computers, or otherwise sought any information from or concerning any telephone, computer or other media device she may own or use.” J.A. 131.

B.
On December 30, 2014, Attkisson brought a Bivens action under the First and

Fourth Amendments against named and unnamed federal defendants in the Superior Court for the District of Columbia. The government removed the case to the U.S. District Court of the District of Columbia. Within two months of first filing suit, Attkisson sought leave of the court “to serve limited, immediate discovery . . . to determine the true [identities] of the Doe Defendants.” J.A. 8. Attkisson argued that “good cause” existed to afford such discovery because she could not further prosecute her action until she identified the Doe Defendants.

The government opposed Attkisson’s discovery request for two reasons: (1) none of the defendants—named or unnamed—had been served and therefore the parties could not, according to the government, conduct a Rule 26 discovery conference and (2) because the case “implicate[d] qualified immunity issues, . . . the Court should resolve those issues and similar preliminary issues before any discovery occurs.” Defs.’ Opp. To Pls.’ Mot. to Expedited Disc., Attkisson v. Holder, No. 15-238 (March 3, 2015), ECF No. 11 (emphasis added). The government’s position, therefore, was tantamount to asserting

that early discovery should never be available in a Bivens case against unnamed 48

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 49 of 72

defendants. The government opposed Attkisson’s requested discovery pertaining to the identity of the Doe Defendants, even as it simultaneously denied—and continues to deny—that it represents the Doe Defendants. The district court denied without prejudice Attkisson’s request for expedited discovery on grounds that Attkisson had not yet completed service of the named defendants and that the discovery request was “overbroad” because Attkisson had not provided an “explanation of precisely what discovery [she] seeks to take.” J.A. 8.

On March 20, 2015, having completed service of the named defendants, Attkisson again moved for expedited discovery. To respond to the district court’s concern regarding the scope of the discovery she sought, Attkisson attached twenty-one interrogatories and three requests for production. The interrogatories sought “[t]he identity of any person” who had knowledge as to the various specific types of electronic incursions allegedly perpetrated between 2011 and 2013 “on computers owned or operated by Ms. Attkisson”—including “remotely altering computer VPN settings,” “smbclient,” “kcpassword,” “kickstart,” and “use of Intel AMT software.” Pls.’ Renewed Mot. for Expedited Disc. 3–5, Attkisson v. Holder, No. 15-238 (March 20, 2015), ECF No. 21-1. The interrogatories also sought the “identity and contact information of all persons” who had “access to,” “us[ed],” and were “responsible for maintaining, monitoring, securing, and otherwise controlling” the Postal Service-owned IP address the forensic analysis connected to the incursions. Id. at 5–6.

Less than a month later, the government moved to dismiss and again opposed

Attkisson’s request for expedited discovery, asserting that her discovery requests were 49

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 50 of 72

both too numerous and not “narrowly tailored” to identifying the Doe Defendants. Attkisson filed an amended complaint on April 30, 2015. On July 6, 2015, the district court denied Attkisson’s second request for expedited discovery. The next day, the government again moved to dismiss. Concurrently, Attkisson served notices of depositions and subpoenas on several third parties, including the United States Postal Service, seeking testimony and documents pertaining to the IP address identified in the forensic analysis so as to identify the Doe Defendants.

In October 2015—after Attkisson repeatedly and unsuccessfully sought the government’s voluntary compliance with her discovery requests—Attkisson moved the district court to compel compliance with those requests. The government successfully sought several extensions of time, eventually filing on December 7, 2015, a brief in opposition to the motion to compel and a motion for protective order. Conceding that Attkisson’s discovery sought “to uncover the identities of the ‘Unknown Federal Agents’ or ‘Doe defendants’”—i.e., that the discovery requests were tailored to the appropriate issue—the government argued that Attkisson could not obtain such discovery because, in part, “there [wa]s no evidence that Plaintiffs have conferred with the remaining ‘Doe’ defendants in this case for purposes of discovery,” which, according to the government, Federal Rule of Civil Procedure 26 required. Third-Party U.S. Postal Serv.’s Opp. To Pls.’ Mot. to Compel And Mot. to Quash Subpoena and/or for Protective Order 13,Attkisson v. Holder, No. 15-238 (Dec. 7, 2015), ECF No. 47. Put differently, the government took the position that Attkisson could not obtain discovery to identify the

50

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 51 of 72

Doe Defendants because she had not engaged in a Rule 26 conference with the unidentified Doe Defendants.

The parties engaged in additional briefing regarding Attkisson’s motion to compel during the first half of 2016, with the government successfully obtaining several deadline extensions. On July 28, 2016—and still without Attkisson having had an opportunity to conduct any discovery—the district court consolidated Attkisson’s Bivens action with a separate action under the Federal Tort Claims Act that Attkisson had brought against several parties, including the United States, related to the same alleged conduct. When it consolidated the two actions, the district court dismissed Attkisson’s pending discovery motions in the Bivens action as moot. Attkisson moved the district court to reconsider its dismissal of her motion to compel, which the government again opposed. Around the same time, the government filed a third motion to dismiss. On March 19, 2017, the District of Columbia district court denied, without prejudice, the government’s motion to dismiss and transferred the case to the U.S. District for the Eastern District of Virginia, again denying Attkisson’s motion to compel as moot.

On July 26, 2017—after waiting nearly four months for the court to assign a judge to her case and only eight days after that assignment4—Attkisson again sought to compel compliance with her previously served discovery requests. In early August 2017—and after obtaining several more deadline extensions—the government filed a brief in

4 Because the parties had to wait several months for the appointment of a judge, Attkisson bears no responsibility for the inaction in the case between March and July 2017 highlighted in the majority opinion. Ante at 13–14.

51

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 52 of 72

opposition to Attkisson’s renewed motion to compel and a fourth motion to dismiss, this time for failure to state a claim and for lack of jurisdiction. On September 1, 2017, a magistrate judge denied Attkisson’s motion to compel without prejudice.

The district court directed Attkisson to file a consolidated complaint, which she filed on September 18, 2017. That eight-count complaint, which names the Doe Defendants as defendants, asserted Bivens claims under the First and Fourth Amendments and violations of the Electronic Communications Privacy Act (“ECPA”), the Stored Communications Act, the Computer Fraud and Abuse Act, the Foreign Intelligence Surveillance Act, and the Virginia Computer Crimes Act, as well common law trespass to chattel and land claims. On September 22, 2017, the parties filed a joint discovery plan. Notwithstanding that the discovery plan purported to establish a January 12, 2018, deadline for completion of discovery, the government made clear in a footnote its position that “discovery—including discovery not specifically directed at the individually sued government officials—may not proceed in this action” until the district court ruled on the government’s motion to dismiss. Joint Proposed Disc. Plan, Attkisson v. Holder, No. 1:17-cv-00364 (Sept. 22, 2017), ECF No. 123 (emphasis added).

Within two weeks of the filing of the consolidated complaint, the district court issued an opinion and order dismissing most, but not all, of Attkisson’s claims. Attkisson v. Holder, No. 1:17-CV-364, 2017 WL 5013230 (E.D. Va. Nov. 1, 2017). Of particular relevance to this dissent, the district court did not dismiss Attkisson’s Bivens and ECPA claims against the Doe Defendants. Id. at *1.

52

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 53 of 72

Following the district court’s motion-to-dismiss order, Attkisson sought testimonial and documentary discovery from numerous federal agencies as well as Verizon’s Virginia subsidiary. For example, Attkisson noticed a deposition of the Postal Service pursuant to Rule 30(b)(6), requesting that the Postal Service make available for deposition “one or more persons” to testify as to the “ownership and control” of two specific IP version 4 (“IPv4”) addresses that Attkisson’s forensic analyses identified were used in the alleged intrusions. In particular, Attkisson sought testimony regarding “[w]ho was responsible for managing, tracking, and monitoring these IPv4 addresses within the Postal Service”; “[w]hat persons or organizations were permitted access to or use of the IPv4 address in the designated time frame”; “[a]ny and all records, logs, or other form of identification material that will or may assist in identifying what person or persons provided for each such use of these IPv4 addresses during the referenced time frame”; and “[a]ny and all records, logs, or other form of identification material that will or may assist in identifying the operational use of these IPv4 addresses.” J.A. 209–10.

The government consented to a limited deposition of a United States Postal Service employee regarding the IPv4 addresses identified in the forensic analysis, which deposition revealed that Verizon contracted with the Postal Service to provide network services and identified twelve other IP addresses connected to the alleged incursion. But otherwise the government and Verizon successfully moved for a protective order on overbreadth grounds. Thereafter—and in accordance with the position it took in the Joint Discovery Plan—the government sought a stay of all discovery pending resolution of its anticipated (renewed) motion to dismiss.

53

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 54 of 72

On December 1, 2017, a magistrate judge entered a revised scheduling order directing Attkisson “to substitute named parties for the Doe Defendants no later than January 5, 2018 at 10:00 a.m.” J.A. 259. In an order entered December 29, 2017, the district court extended that deadline until February 5, 2018, emphasizing that “[t]his extension is the final extension that plaintiffs will receive because the interests of judicial economy and fairness to third parties and potential future defendants dictate that plaintiffs move forward with this litigation in as timely a fashion as possible.” J.A. 274–75.

Thereafter, Attkisson reserved discovery against the federal agencies and Verizon, and moved to compel. Verizon again moved for a protective order. J.A. 276. The magistrate granted in part the motion for protective order, allowing Attkisson to conduct a 30(b)(6) deposition of Verizon employee as to the twelve Verizon-linked IP addresses identified in the Postal Service deposition. The magistrate rendered that determination because he concluded that, at that stage of the litigation, discovery should be “limited to trying to identify the Doe [D]efendants,” with liability discovery “com[ing] later.” J.A. 512. The government also continued to resist Attkisson’s discovery requests on overbreadth grounds, maintaining that it was obliged to permit discovery only of “readily available” information pertaining to the identities of the Doe Defendants. J.A. 521. At a January 12, 2018 hearing—less than a month before the district court’s deadline for Attkisson to identify the Doe Defendants—the magistrate denied without prejudice Attkisson’s motion to compel on grounds that it appeared that the parties were moving towards an agreed-on discovery plan related to identifying the Doe Defendants. J.A. 524.

54

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 55 of 72

On February 5, 2018, Attkisson filed a proposed amended complaint that continued to list John Doe federal employee and agent defendants, but also added new causes of action and several Verizon-affiliated entities, the United States of America, and the Federal Bureau of Investigation as defendants. In an order entered May 15, 2018, the district court denied Attkisson leave to amend and dismissed Attkisson’s pending action against the Doe Defendants with prejudice. The Court held that dismissal was warranted because Attkisson’s proposed complaint failed to offer substitutes for the Doe Defendants, as its December 29, 2017 order required, and, also in contravention of that order, added new defendants without seeking the court’s leave. As to the Doe Defendants, in particular, the court stated:

Since 2014 when the plaintiffs’ first complaint was filed, none of the John Doe defendants has been identified or served and plaintiffs have made no substantial progress in identifying them. As such, the time has come to end this litigation against them as well and for this reason, the claims against them are also dismissed by this Order.

J.A. 669. Attkisson timely appealed.
II.

Attkisson argues that the district court erred in dismissing her claims against the Doe Defendants. Although its order is not a model of clarity, the district court appears to have dismissed those claims for two related reasons: (A) Attkisson failed to make “substantial progress” in identifying the Doe Defendants and (B) Attkisson failed to comply with the court’s order to substitute named parties for the Doe Defendants by February 5, 2018. I do not believe that either purported failure justified the district

court’s decision to dismiss Attkisson’s claims against the Doe Defendants. 55

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 56 of 72

A.
“Ordinarily a tort victim”—like Attkisson—“who does not know who the

tortfeasor is cannot sue.” Billman v. Ind. Dep’t of Corrs., 56 F.3d 785, 789 (7th Cir. 1995). But this Court and other courts long have recognized that if a tort complaint plausibly alleges that an unnamed defendant is an “actual” person or entity, then an action may “proceed against real, but unidentified, defendants.” Schiff, 691 F.2d at 197 (citing Bivens v. Six Unknown Agents of Fed. Bureau of Narcotics, 403 U.S. 388 (1971)). In such cases, a district court should dismiss the action on grounds that the plaintiff failed to allege the defendant’s true identity only “if it does not appear that the true identity of an unnamed party can be discovered through discovery or through intervention by the court.” Id. at 198; see also Davis v. Kelly, 160 F.3d 917, 921 (2d Cir. 1998) (collecting cases); Billman, 56 F.3d at 789 (holding that a plaintiff’s “initial inability to identify the injurers is not by itself a proper ground for the dismissal of the suit”); Munz v. Parr, 758 F.2d 1254, 1257 (8th Cir. 1985) (“Dismissal is proper only when it appears that the true identity of the defendant cannot be learned through discovery or the court’s intervention.” (emphasis added)).

Courts allow plaintiffs to sue unnamed tortfeasors—and, in appropriate circumstances, engage in early discovery to identify the true identity of those alleged tortfeasors—when, as here, a plaintiff lacks the capacity to identify the names of the tortfeasors absent the power of the courts. For example, courts allow an injured party to sue an unnamed tortfeasor when circumstances outside the injured party’s control posed

obstacles to the injured party identifying the tortfeasor prior to filing suit. See, e.g., 56

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 57 of 72

Billman, 56 F.3d at 789 (holding that a prison inmate was entitled to discovery when his conditions of confinement rendered it difficult, if not impossible, for him to identify the alleged tortfeasor prior to suit). Likewise, courts allow an injured party to sue an unnamed tortfeasor when the allegedly tortious conduct, by its nature, conceals the identity of the tortfeasor. See, e.g., id. (noting that when “the plaintiff has been injured as the consequence of the actions of an unknown member of a collective body, identification of the responsible party may be impossible without pretrial discovery”); Columbia Ins. Co. v. seescandy.com, 185 F.R.D. 573, 578 (N.D. Cal. 1999) (noting that when a plaintiff is injured by a tortious act allegedly committed via the internet by a “pseudonymous[] or anonymous[]” party, the plaintiff is “likely to find [her]self chasing the tortfeasor from Internet Service Provider (ISP) to ISP, with little hope of actually discovering the identity of the tortfeasor” absent compulsory judicial discovery).

Considering this precedent, the district court abused its discretion in dismissing Attkisson’s action against the Doe Defendants without providing Attkisson with a meaningful opportunity to engage in discovery to determine their true identity. To begin, Attkisson’s operative complaint—which we must accept as true—includes sufficient non- conclusory allegations against the Doe Defendants to state a Fourth Amendment Bivensclaim and a claim under the ECPA. The complaint recites at length, and with factual specificity, the technical “anomalies” Attkisson experienced with her internet connected devices. The complaint also discusses with factual specificity the various forensic analyses of Attkisson’s devices conducted by security consultants—including a security

consultant hired by CBS—revealing that those devices had been compromised and 57

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 58 of 72

commandeered. The forensic analyses further revealed that those incursions included searching records stored on Attkisson’s devices, monitoring Attkisson’s electronic communications, and using Attkisson’s internet connected devices to listen to her conversations at home. According to the complaint, those forensic analyses concluded that the intrusions were “sophisticated”—and therefore “state-sponsored”—and derived from IPv4 addresses owned, controlled, and operated by the government, and the Postal Service, in particular.

Based on those allegations, it is “plausible” that the government—and/or a private entity operating on the government’s behalf—searched and commandeered Attkisson’s devices and infringed on her right to privacy, in violation of the Fourth Amendment. See Buonocore v. Harris, 65 F.3d 347, 356 (4th Cir. 1995) (“[T]he special protection to be afforded a person’s right to privacy within his own home has also been continuously and consistently recognized by the Court. The right to ‘sanctity of private dwellings,’ has been held to be the right ‘ordinarily afforded the most stringent Fourth Amendment protection.’”). Likewise, the complaint adequately alleges that these same government actors “intercepted” Attkisson’s electronic communications in violation of the ECPA. 18 U.S.C. § 2520.

Second, the allegations in the complaint render it plausible that “actual” persons—i.e., the Doe Defendants—violated Attkisson’s constitutional and statutory rights. Schiff, 691 F.2d at 197. Put simply, the “sophisticated” nature of the intrusions; the broad variety of alleged surveillance, including “keystroke monitoring, exfiltration of data,

audio surveillance of [Attkisson’s] conversations and activities at home by activating 58

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 59 of 72

Skype, mining personal passwords, monitoring work and personal email, and probable compromise of [Attkisson’s] work and personal smartphones,” J.A. 130; the years-long duration of the anomalies and incursions, despite repeated efforts to resolve them; and the efforts to hide evidence of the incursions provide factual support for the allegations that “actual” persons perpetrated the alleged constitutional and statutory violations.

Additionally, in criminal proceedings, the government routinely argues—and courts often agree—that when a specific IP address is used to perpetrate alleged wrongdoing online there is a “fair probability”—i.e., probable cause—that the individual or entity that owns or controls the IP address engaged in, or possesses evidence of, the wrongdoing. See, e.g., United States v. Vosburgh, 602 F.3d 512, 526 & n.13 (3d Cir. 2010) (noting that “several Courts of Appeals have held that evidence that the user of a computer employing a particular IP address possessed or transmitted child pornography can support a search warrant for the physical premises linked to that IP address”); United States v. Perrine, 518 F.3d 1196, 1201–04 (10th Cir. 2008). Attkisson’s complaint identified two specific IPv4 addresses owned and controlled by the government that were used to perpetrate the alleged unlawful surveillance. Accordingly, the complaint established that it is plausible that the individuals employed by, or acting on behalf of, the government who used and maintained those IPv4 addresses perpetrated the allegedly unlawful surveillance or have information that will facilitate identification of the individuals responsible for perpetrating the wrongdoing.

Third, there was no basis for the district court to determine that “the true identity

of [the Doe Defendants could not] be discovered through discovery or through 59

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 60 of 72

intervention by the court.” Schiff, 691 F.2d at 198. Indeed, the government itself routinely uses IP addresses to identify unknown wrongdoers. For example, the government uses IP addresses as the starting point to identify unknown individuals who possess or share child pornography. See, e.g., Vosburgh, 602 F.3d at 526 & n.13 (collecting cases); United States v. Bynum, 604 F.3d 161, 162–63 (4th Cir. 2010). Likewise, private parties such as copyright holders frequently use IP addresses to identify unknown defendants who allegedly engage in online copyright infringement. See, e.g.,Purzel Video GmbH v. St. Pierre, 10 F. Supp. 3d 1158, 1164 (D. Colo. 2014); Malibu Media, LLC v. Roldan, No. 8:13-cv-3007, 2014 WL 3805494, at *1 (M.D. Fla. Aug. 1, 2014); Loud Records LLC v. Minervini, 621 F. Supp. 2d 672, 676 (W.D. Wisc. 2009). Given that the government as well as private parties successfully use IP addresses to identify wrongdoers in other contexts, there is no reason to believe that pre-trial discovery would not allow Attkisson to use the IPv4 addresses to identify the true identity of the Doe Defendants.

To be sure, the government is a “collective body,” rather than a single user, which may somewhat complicate the process for identifying which, if any, government employees perpetrated the allegedly unlawful surveillance of Attkisson’s devices.Billman, 56 F.3d at 789. But the difficulty a plaintiff faces in identifying pre-filing a particular wrongdoer that works for a multi-member organization, like the government, is one of the reasons courts allow a plaintiff to sue unnamed wrongdoers and to use pre-trial discovery to identify the wrongdoers’ identities. Id.; see also Palmer v. Bd. of Educ. of

Cmty. Unit Sch. Dist. 201-U, Will Cnty., Ill., 46 F.2d 682, 688 (7th Cir. 1995) (holding 60

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 61 of 72

that the district court erred in dismissing plausible claim against unnamed governmental employees because “[w]hen a collective body . . . takes a complex series of actions over a span of years, it may be difficult to pin down individual responsibility without discovery”). That is particularly true when, as here, members of a collective body allegedly perpetrate a wrong using the Internet, which allows wrongdoers to “act pseudonymously and anonymously,” and thereby evade legal liability absent an injured party’s use of discovery to determine the wrongdoers’ identity. Columbia Ins., 185 F.R.D. at 578.

Finally, the district court failed to afford Attkisson a meaningful opportunity to engage in discovery to determine the true identity of the Doe Defendants. Notwithstanding that Attkisson repeatedly served discovery on the government and repeatedly moved the district court to compel the government to comply with the discovery requests, the sum of the discovery Attkisson obtained from the government during the four years her case was pending was a limited deposition of a single Postal Service employee. The government never turned over any documents in response to Attkisson’s subpoenas, nor did it answer any interrogatories. In such circumstances, Attkisson should not be faulted for failing to identify the Doe Defendants.

The district court refused to compel the government to comply with Attkisson’s discovery requests because it believed that some of the requests were unrelated to the identification of the Doe Defendants. But most of Attkisson’s requests sought information directly related to the identities of the Doe Defendants, including “[w]ho was

responsible for managing, tracking, and monitoring these IPv4 addresses within the 61

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 62 of 72

Postal Service”; “[w]hat persons or organizations were permitted access to or use of the IPv4 address in the designated time frame”; “[a]ny and all records, logs, or other form of identification material that will or may assist in identifying what person or persons provided for each such use of these IPv4 addresses during the referenced time frame”; and “[a]ny and all records, logs, or other form of identification material that will or may assist in identifying the operational use of these IPv4 addresses.” J.A. 209–10. And Attkisson’s request for “[t]he identity of any person” who had knowledge regarding the various specific types of electronic incursions allegedly perpetrated against Attkisson’s devices—including “remotely altering computer VPN settings,” “smbclient,” “kcpassword,” “kickstart,” and “use of Intel AMT software”—also specifically related to the identity of the Doe Defendants. Pls.’ Renewed Mot. for Expedited Disc., Attkisson v. Holder, No. 15-238 (March 20, 2015), ECF No. 21-1. To the extent the district court believed any of Attkisson’s other requests swept too broadly, it could have granted Attkisson’s motion to compel only as to those requests bearing on the identity of the Doe Defendants.

The district court also denied Attkisson’s final motion to compel because it believed that the parties were working towards a consensual discovery plan. I do not question the district court’s judgment that a consensual discovery plan is preferable to court-ordered discovery. But at the time it denied Attkisson’s final motion to compel, the court’s deadline for Attkisson to substitute names for the Doe Defendants was less than a month away. Given the government’s longstanding opposition to affording Attkisson anydiscovery—including its initial Kafkaesque position that Attkisson was not entitled to 6

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 63 of 72

obtain discovery regarding the identity of the Doe Defendants until Attkisson conducted a Rule 26(d) discovery conference with the unidentified Doe Defendants and the government’s later, equally unsupported position, which the magistrate judge rightly rejected, that Attkisson was entitled to discover only whatever information the government deemed “readily available”—and the court’s fast approaching substitution deadline, it was incumbent on the district court to ensure that the government did not use its ongoing discovery negotiations with Attkisson to run out the clock on her claims. Put simply, the district court needed to either (1) toll its deadline until Attkisson and the government reached an agreement as to a discovery plan that would allow Attkisson to meaningfully pursue the identity of the Doe Defendants or (2) compel the government to comply with Attkisson’s reasonable discovery requests in advance of the deadline. It did neither; instead, it enforced its deadline even though Attkisson never obtained meaningful discovery, effectively rewarding the government for its intransigence.

In sum, the district court reversibly erred when it dismissed Attkisson’s action against the Doe Defendants for failing to identify their names. That conclusion accords with the approach taken by our sister circuits, which have held that a district court abused its discretion when—as here—it dismissed a plausible claim against an unnamed defendant without allowing the plaintiff a meaningful opportunity to engage in discovery to determine the defendant’s identity. See, e.g., Vohra v. Cnty. of Orange, 288 Fed. App’x 395, 396 (9th Cir. 2008); Green v. Doe, 260 Fed. App’x 717, 719 (5th Cir. 2007);Valentin v. Dinkins, 121 F.3d 72, 75–76 (2d Cir. 1997); Billman, 56 F.3d at 787–89.

63

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 64 of 72

And there is more. The district court compounded its error in dismissing Attkisson’s action against the Doe Defendants by failing to grant, at least in part, Attkisson’s repeated motions to compel. In the context of allegedly tortious acts committed over the Internet, in particular—like the Doe Defendants’ alleged unlawful surveillance of Attkisson—courts have adopted several multi-factorial tests to guide a district court’s analysis in determining whether to allow the plaintiff early or expedited discovery to facilitate identification of an unnamed defendant.

For example, the Second Circuit has directed district courts to weigh “(1) the concreteness of the plaintiff’s showing of a prima facie claim of actionable harm, (2) the specificity of the discovery request, (3) the absence of alternative means to obtain the subpoenaed information, (4) the need for the subpoenaed information to advance the claim, and (5) the objecting party’s expectation of privacy.” See Arista Records, LLC v. Doe 3, 604 F.3d 110, 119 (2d Cir. 2010) (internal alterations omitted) (citing Sony Music Entm’t Inc. v. Does 1–40, 326 F. Supp. 2d 556, 564–65 (S.D.N.Y. 2004)). Other courts apply similar tests. See, e.g., Columbia Ins., 185 F.R.D. at 578–80 (holding that a plaintiff is entitled to early discovery targeted at identifying an unnamed defendant if the plaintiff (1) “identif[ies] the missing party with sufficient specificity such that the Court can determine that defendant is a real person or entity who could be sued in federal court; (2) “identif[ies] all previous steps taken to locate the elusive defendant”; (3) “establish[es] to the Court’s satisfaction that plaintiff’s suit against defendant could withstand a motion to dismiss”; and (4) “file[s] a request for discovery with the Court,

along with a statement of reasons justifying the specific discovery requested as well as 64

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 65 of 72

identification of a limited number of persons on whom discovery process might be served and for which there is a reasonable likelihood that the discovery process will lead to identifying information about the defendant that would make service of process possible.”).

Here, the considerations other courts have deemed relevant supported awarding Attkisson early discovery targeted at identifying the Doe Defendants. As explained above, Attkisson plausibly alleged that unnamed defendants violated her constitutional and statutory rights and that those defendants were “actual” individuals capable of identification through discovery. The complaint also set forth several steps Attkisson had taken to identify the perpetrators of the alleged violations, including obtaining multiple forensic analyses of her devices, filing a complaint with the Department of Justice Inspector General, allowing the government to inspect her laptop computer, and submitting Freedom of Information Act requests. And even if a few requests were somewhat overbroad, Attkisson served numerous discovery requests directly bearing on the identity of the Doe Defendants. Finally, because information potentially relevant to the identity of the Doe Defendants lies exclusively in the hands of the government—and because her other efforts to identify the Doe Defendants had proven unsuccessful— Attkisson established that she lacked alternative means to identify the Doe Defendants.

B.
The district court also dismissed Attkisson’s action against the Doe Defendants for

failure to comply with the court’s December 29, 2017, order that Attkisson substitute

names for the Doe Defendants on or before February 5, 2018. Federal Rule of Civil 65

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 66 of 72

Procedure 41(b) permits a district court to involuntarily dismiss an action if a plaintiff fails to comply with a court order. We review for abuse of discretion a district court’s dismissal of an action for failure to comply with a court order. See Ballard v. Carlson, 882 F.2d 93, 96 (4th Cir. 1989).

This Court, like our sister circuits, has recognized that dismissal under Rule 41(b) is a “drastic” penalty, Hillig, 916 F.2d at 174, that should be limited to “extreme circumstances,” Reizakis, 490 F.2d at 1135; see also, e.g., Dahl v. City of Huntington Beach, 84 F.3d 363, 366 (9th Cir. 1996) (holding that dismissal under Rule 41(b) “is so harsh a penalty it should be imposed as a sanction only in extreme circumstances”);Jackson v. City of New York, 22 F.3d 71, 75 (2d Cir. 1994) (“Although dismissal pursuant to Rule 41(b) is a matter committed to the discretion of a district court . . . dismissal is a harsh remedy to be utilized only in extreme situations.” (internal quotation marks omitted)); Flaksa v. Little River Marine Const. Co., 389 F.2d 885, 888 (5th Cir. 1968) (dismissal under Rule 41(b) warranted only in “extreme circumstances”).

In deciding whether to dismiss a case under Rule 41(b), “[a]gainst the power to prevent delays must be weighed the sound public policy of deciding cases on the merits.”Hillig, 916 F.2d at 173–74. In making that determination, “[t]his Circuit requires that the trial court consider four factors before dismissing a case for failure to prosecute: (1) the plaintiff’s degree of personal responsibility; (2) the amount of prejudice caused the defendant; (3) the presence of a drawn out history of deliberately proceeding in a dilatory

66

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 67 of 72

fashion; and (4) the effectiveness of sanctions less drastic than dismissal.” Id. at 174 (emphasis added).5

Considering this precedent, the district court abused its discretion in dismissing Attkisson’s claims against the Doe Defendants based on Attkisson’s failure to comply with the court’s order. The district court never expressly considered this Court’s mandatory four-factor test for dismissing an action for failure to comply with a court order. That legal error, by itself, amounts to an abuse of discretion. See Verisign, Inc. v. XYZ.COM LLC, 891 F.3d 481, 484–86 (4th Cir. 2018) (holding that district court abuses its discretion when it applies the wrong legal test); United States v. Cargill, 134 F.3d 364 (4th Cir. 1998) (table) (same); see also Koon v. United States, 518 U.S. 81, 100 (1996) (“A district court by definition abuses its discretion when it makes an error of law.”).

And although the district court adverted, in a conclusory fashion, to some aspects of those four considerations—referencing “prejudic[e]” to defendants and “judicial economy,” J.A. 668—it never considered, much less ruled out, “less drastic” sanctions, as this Court requires. Notably, this Court and other courts have held that a district court abused its discretion in dismissing an action under Rule 41(b) when it failed to consider

5 The majority opinion states that the factors identified in Hillig should “guide” the district court’s analysis in determining whether to dismiss a case under Rule 41(b), and therefore that the district court did not reversibly err in failing to consider those factors.Ante at 34. The majority opinion nowhere reconciles its reasoning with Hillig’s controlling holding that district courts are “required” to consider those four factors. 916 F.2d at 174. The majority opinion also nowhere reconciles its conclusion with the unanimous conclusion of the Courts of Appeal that dismissals under Rule 41(b) should be limited to “extreme circumstances.”

67

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 68 of 72

lesser sanctions. See Reizakis, 490 F.2d at 1135; In re Se. Banking Corp., 204 F.3d 1322, 1335 (11th Cir. 2000).

Additionally, had the district court considered the mandatory factors set forth inHillig, it should have rendered a different judgment. First, there is no evidence that Attkisson had any degree of personal responsibility in her attorney’s purported failure to comply with the court’s order. Second, although the passage of time may somewhat prejudice the Doe Defendants, Attkisson correctly notes that any such prejudice is attributable to the government’s repeated efforts to delay and resist any discovery. Appellant’s Br. at 48. Third, the record belies any finding that Attkisson engaged in “a drawn-out history of deliberately proceeding in a dilatory fashion.” Hillig, 916 F.2d at 74. On the contrary, since the filing of the original complaint, Attkisson has repeatedly sought to engage in discovery to identify the Doe Defendants and faced largely successful resistance from the government and third-parties at every turn. Finally, any number of less drastic remedies, such as denying further leave to amend the complaint to add new defendants or causes of action, were available.6

6 I agree with the majority opinion that the district court did not abuse its discretion in denying Attkisson leave to amend her complaint to rename the United States as a defendant, add several Verizon-affiliated entities as defendants, and resurrect several previously dismissed claims. Ante at 34–36. The court’s order did not authorize Attkisson to make such amendments, and Attkisson never sought the court’s leave to do so. But the majority opinion improperly conflates the district court’s (correct) disposition of Attkisson’s proposed amended complaint with the district court’s (incorrect) dismissal of Attkisson’s claims against the Doe Defendants, who had been listed as defendants since the case’s inception. Whether Attkisson’s proposed amended complaint was proper had no bearing on whether Attkisson’s long-standing claims against the Doe Defendants, as set forth in her operative complaint, warranted dismissal.

68

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 69 of 72

Additionally, the district court’s Rule 41(b) dismissal runs contrary to this Court’s stated preference to resolve cases on the merits. Put simply, this case did not present the “extreme circumstances” warranting dismissal under Rule 41(b). Accordingly, I disagree with the majority opinion’s conclusion that the district court did not reversibly err in dismissing Attkisson’s claim against the Doe Defendants.7

III.
The most troubling aspect of the district court’s decision to dismiss Attkisson’s

claims against the Doe Defendants is that it rewards the government’s concerted effort to deprive Attkisson any opportunity to pursue her claims and, by doing so, creates a game plan for the government and private parties to follow in future cases in which plaintiffs seek to challenge governmental or private electronic surveillance activities.

At the outset of cases challenging alleged electronic surveillance, the defendants nearly always have exclusive control over virtually all information necessary to identify the individuals responsible for engaging in allegedly unconstitutional or unlawful electronic surveillance. In cases involving governmental surveillance programs, for example, the individuals and entities responsible for the challenged surveillance programs generally will be protected by statutes and regulations preventing the disclosure

7 The majority opinion further concludes that the district court “implicitly relied” on Federal Rule of Civil Procedure 4(m) in dismissing Attkisson’s claims against the Doe Defendants because Attkisson failed to establish “good cause” for her failure to timely serve the Doe Defendants. Ante at 38 n.13. But the district court’s terse footnote dismissing the Doe Defendants nowhere mentions Rule 4(m). And Attkisson did have “good cause” for failing to serve the Doe Defendants—she never obtained the discovery from the government necessary for her to identify the Defendants.

69

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 70 of 72

of classified documents and programs as well as judicial orders sealing records related to warrants issued in criminal and national security investigations. The nature of the Internet, which allows wrongdoers to conceal their identity in a variety of ways, poses further obstacles to identifying individuals responsible for electronic surveillance without the benefit of pre-trial discovery.

This profound information asymmetry sets electronic surveillance cases apart from earlier cases involving tort claims against unnamed defendants. Whereas the plaintiff inBivens, for example, could point to a specific number of officers employed by a specific agency who were in a specific place at a specific time, a plaintiff challenging electronic surveillance faces fatally greater obstacles to narrowing the universe of wrongdoers absent court-supervised discovery.

If a district court creates a deadline for identifying unnamed defendants accused of unlawful electronic surveillance and that deadline is not tethered to whether the defendant affords the plaintiff a meaningful opportunity to discover the identity of the wrongdoers—as was the case here—the defendant has a strong incentive to resist all discovery of information bearing on the identity of wrongdoer. Put simply, when the defendant is not compelled to provide discovery, the plaintiff will be unable to meet the court’s deadline to substitute names for the unnamed defendants and the case will be dismissed, just as occurred here.

But “the children’s game of pin the tail on the donkey is [not] a proper model for

constitutional tort law,” nor is the time-limited game of pin-the-tail-on-the-donkey that

the district court imposed here. Billman, 56 F.3d at 789. That is particularly true in cases 70

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 71 of 72

involving electronic surveillance in which the complexity of modern telecommunications systems—coupled with the numerous avenues such systems afford users to conceal their identities—may require more extensive discovery to identify an unnamed defendant. In such instances, artificial time constraints on identifying an unnamed defendant are all the more inappropriate.

In recent years, newspapers have been rife with reports of actual or alleged undisclosed electronic surveillance by the government and private entities. See, e.g., Carole Cadwalladr & Emma Graham-Harrison, Facebook Accused of Conducting Mass Surveillance Through Its Apps, Guardian (May 24, 2018), https://www.theguardian.com/technology/2018/may/24/facebook-accused-of-conducting- mass-surveillance-through-its-apps; Charlie Savage, N.S.A. Halts Collection of Americans’ Emails About Foreign Targets, N.Y. Times, Apr. 29, 2017, at A1. Such surveillance has the potential to reveal to the government and private entities broad swaths of highly sensitive personal and commercial information. This case is illustrative—according to the complaint, the incursion not only entailed the searching of Attkisson’s computers and the monitoring of her electronic communications, but also involved using her devices to eavesdrop on her oral conversations and interactions with her family in her home. As the government’s and private entities’ capacity to hoover up data increases—and as we move beyond accessing the Internet through a limited universe of devices to the Internet of things—the potential intrusion on privacy only increases.

Under the government’s playbook—which the district court effectively endorsed—plaintiffs would be deprived all opportunity to challenge the legality of most, 71

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 72 of 72

if not all, these electronic surveillance efforts, notwithstanding the significant intrusion on individual rights posed by such surveillance. To be sure, it can be difficult to apply analog law in the digital age, and courts must tread carefully in so doing. But courts must not avoid the difficult legal issues raised by new technology by erecting procedural barriers that ensure they never will be addressed. The district court’s disposition of Attkisson’s claims against the Doe Defendants, which the majority opinion affirms, does precisely that.

Accordingly, I respectfully dissent.

72

The following is the full decision

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 1 of 7

PUBLISHED

UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT

No. 18-1677

SHARYL THOMPSON ATTKISSON; JAMES HOWARD ATTKISSON; SARAH JUDITH STARR ATTKISSON,

Plaintiffs – Appellants, v.

ERIC HIMPTON HOLDER, JR., Individually; PATRICK R. DONAHOE, Individually; UNKNOWN NAMED AGENTS OF THE DEPARTMENT OF JUSTICE, In their individual capacities; UNKNOWN NAMED AGENTS OF THE UNITED STATES POSTAL SERVICE, In their individual capacities; UNKNOWN NAMED AGENTS OF THE UNITED STATES, In their individual capacities; VERIZON VIRGINIA LLC; FEDERAL BUREAU OF INVESTIGATION; MCI COMMUNICATIONS SERVICES, INC., d/b/a Verizon Business Services; CELLCO PARTNERSHIP, d/b/a Verizon Wireless,

Defendants – Appellees.

Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Leonie M. Brinkema, District Judge. (1:17-cv-00364-LMB-JFA)

Argued: January 29, 2019 Decided: March 21, 2019 Before MOTZ, KING, and WYNN, Circuit Judges.

Affirmed by published opinion. Judge King wrote the opinion, in which Judge Motz joined. Judge Wynn wrote an opinion concurring in part and dissenting in part.

ARGUED: Paul Schiff Berman, Chevy Chase, Maryland, for Appellants. H. Thomas Byron, III, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C.; Reid

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 2 of 72

Mason Figel, KELLOGG, HANSEN, TODD, FIGEL & FREDERICK, P.L.L.C., Washington, D.C., for Appellees. ON BRIEF: Clyde T. Turner, TURNER & ASSOCIATES, Little Rock, Arkansas, for Appellants. Joseph H. Hunt, Assistant Attorney General, Catherine H. Dorsey, Civil Division, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C.; G. Zachary Terwilliger, United States Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Federal Appellees. David L. Schwarz, Kylie Chiseul Kim, Albert Y. Pak, KELLOGG, HANSEN, TODD, FIGEL & FREDERICK, P.L.L.C., Washington, D.C., for Appellees MCI Communications Services Incorporated, Cellco Partnership, and Verizon, Virginia, LLC.

2

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 3 of 72

KING, Circuit Judge:
Plaintiffs Sharyl Thompson Attkisson, James Howard Attkisson, and Sarah Judith

Starr Attkisson appeal from the dismissal with prejudice of their claims in the Eastern District of Virginia. The plaintiffs sued a number of named and unnamed government officials for alleged illegal intrusions into the plaintiffs’ electronic devices to conduct unlawful surveillance, and also sued certain corporate entities for allegedly facilitating those intrusions. After three-and-a-half years of protracted preliminary litigation — including multiple amendments to the complaint — the district court dismissed the plaintiffs’ claims. As explained below, we are satisfied to affirm the judgment.

I. A.

The district court dismissed the majority of the plaintiffs’ claims pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure. That ruling addressed the claims raised in the plaintiffs’ consolidated complaint. See Attkisson v. Holder, No. 1:17-cv-00364 (E.D. Va. Sept. 15, 2017), ECF No. 117 (the “Consolidated Complaint”). In reviewing that dismissal we accept and recite the facts alleged in the Consolidated Complaint in the light most favorable to the plaintiffs. See Lucero v. Early, 873 F.3d 466, 469 (4th Cir. 2017).

The district court then disposed of the balance of the plaintiffs’ claims as presented in their amended consolidated complaint. See Attkisson v. Holder, No. 1:17- cv-00364 (E.D. Va. Feb. 5, 2018), ECF No. 174 (the “Amended Complaint”). The court

3

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 4 of 72

based that ruling partly on Rule 12(b)(6), and otherwise on various procedural defects relating to the Amended Complaint. To properly review that final decision, we recite the pertinent facts alleged in the Amended Complaint as well as the procedural history of this litigation. See, e.g., Ballard v. Carlson, 882 F.2d 93, 94 (4th Cir. 1989) (providing “full statement of the facts,” including procedural history, to review dismissal for procedural defects).

1.

a.
At all relevant times, plaintiff Sharyl Thompson Attkisson (“Attkisson”) was an

investigative reporter for CBS News. Plaintiffs James Howard Attkisson and Sarah Judith Starr Attkisson are Attkisson’s husband and daughter, respectively. In early 2011, as alleged in the Consolidated Complaint, Attkisson worked on the CBS News investigation into “Operation Fast and Furious,” an ill-fated sting operation of the Bureau of Alcohol, Tobacco, and Firearms (the “ATF”). Intended as a means to sweep up gun traffickers and drug cartel members at the southern border, Operation Fast and Furious involved the circulation of thousands of firearms by the ATF that were to be traced and recaptured along with their purchasers. The ATF, however, lost track of a large number of those weapons, one of which was used to kill a Border Patrol Agent in 2010. Attkisson’s highly critical report of the Operation aired on CBS on February 22, 2011. Over the course of that year, Attkisson continued reporting on Operation Fast and Furious, in the face of efforts by the ATF, the Federal Bureau of Investigation (the

4

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 5 of 72

“FBI”), and the Department of Justice (the “DOJ”) to stymie her reporting.1 The story surrounding the Operation grew to include alleged problems with then-Attorney General Eric Holder’s testimony (apparently before Congress), as well as the DOJ’s retraction of a letter to Congress that contained misinformation about the Operation.

In “mid-to-late 2011,” the plaintiffs noticed “anomalies” in several electronic devices at their home in Leesburg, Virginia. See Consolidated Complaint ¶23. Specifically, a laptop and desktop computer began “turning on and off at night,” the house alarm went off without provocation, and the plaintiffs experienced phone and television interference. Id. The plaintiffs’ devices relied on a Verizon FiOS line that provided phone, internet, and television services to their home. The problems with those devices continued through 2012, despite Verizon’s attempts to cure them.

Meanwhile, Attkisson continued her work for CBS. In October 2012, Attkisson reported on the September 2012 attacks on our Embassy in Benghazi, Libya. Her reporting on those attacks criticized the actions of the Obama administration, drawing on confidential sources in the federal government.

In December 2012, the plaintiffs asked an acquaintance “with U.S. government intelligence experience” to examine their home. See Consolidated Complaint ¶ 43. That acquaintance found an extra fiber optics cable dangling from the plaintiffs’ Verizon FiOS

1 Although Attkisson asserts that the ATF, FBI, and DOJ mobilized against her reporting, the specific facts underlying that claim amount to nothing more than the DOJ’s denials in response to Attkisson’s reporting; the DOJ’s attempt to identify the sources of internal leaks; and the ATF’s goal of “proactively push[ing] positive stories” to repair the agency’s public image. See Consolidated Complaint ¶¶ 16-17 & n.2.

5

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 6 of 72

box. When Attkisson called Verizon to ask about the cable, a Verizon representative denied any knowledge of it and suggested that Attkisson contact law enforcement. Soon thereafter, an individual identifying herself as a Verizon employee called Attkisson and said she would send a technician to the plaintiffs’ home. The next day — January 1, 2013 — a person “represented to be a Verizon technician” removed the cable. Id. ¶ 44. Attkisson later attempted to contact that technician but was unsuccessful. Through January and February 2013, the plaintiffs continued to experience phone and internet problems that Verizon could not solve.

On January 8, 2013, Attkisson gave her Toshiba laptop (used for her work for CBS) to an expert to conduct a forensic analysis of the machine. That expert found evidence of an unauthorized intrusion, possibly using software belonging to a government actor. Attkisson reported the expert’s findings to CBS, which retained another expert to examine Attkisson’s work laptop and home desktop computers. Based on the forensic analysis conducted by the CBS-retained expert, the plaintiffs allege that their desktop, smart phone, and Attkisson’s work laptop were the “targets of unauthorized surveillance efforts,” beginning around June 2011. See Consolidated Complaint ¶¶ 27, 48-49. That analysis also showed that someone had installed “surveillance spyware” on Attkisson’s work laptop around February 2012 and “executed remote actions” to remove evidence of the surveillance around December 2012. Id. ¶¶ 27, 42.

In March 2013, the plaintiffs’ desktop began malfunctioning and finally shut down for good. In September 2013, Attkisson “observed” that her personal laptop, a MacBook Air, was “accessed remotely, controlled, and [unspecified] data deleted.” See6

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 7 of 72

Consolidated Complaint ¶ 57. The plaintiffs did not obtain any expert analysis of the MacBook, but they allege that some of the intrusions described heretofore were executed “via an IP address owned, controlled, and operated by” the United States Postal Service (the “USPS”). Id. ¶ 27.

In mid-2013, Attkisson and CBS announced publicly that her personal devices had been accessed and compromised. Attkisson also filed a complaint with the Inspector General for the DOJ. In response, the FBI and DOJ privately and publicly affirmed that they had no knowledge of any intrusions into the plaintiffs’ devices. The DOJ Inspector General asked to examine the affected computers. CBS declined to release Attkisson’s work laptop, but Attkisson provided her home desktop to the Inspector General. In early 2015, the Inspector General released a report that “noted a great deal of advanced mode computer activity not attributable” to the plaintiffs, but concluded that there was “no evidence of intrusion” into the desktop. See Consolidated Complaint ¶ 60.

b.
The Consolidated Complaint, filed in September 2017, named as defendants Eric

Holder, the Attorney General at all relevant times; Patrick R. Donahoe, the Postmaster General during the relevant period; and “unknown named agents” of the DOJ, the USPS, and “the United States.” See Consolidated Complaint 1. In addition to describing the events recited above, the Consolidated Complaint offers a variety of allegations to link those events to the defendants listed therein.

Regarding the defendant “unknown named agents,” or “John Doe agents,” the

Consolidated Complaint provides almost no direct allegations concerning those agents’ 7

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 8 of 72

actions. Instead, it asserts that unnamed agents “are in some manner responsible and liable for” the acts alleged by the plaintiffs, that is, the intrusions into their personal electronic devices. See Consolidated Complaint ¶ 11.

The Consolidated Complaint also points to a number of policy-level initiatives undertaken by the FBI and DOJ concerning electronic surveillance, presumably to support the claim that employees of those agencies carried out the alleged intrusions. For example, in 2012, the FBI and DOJ jointly announced a “new effort” to address “national security-related cyber issues,” while simultaneously seizing “personal and phone records belonging to journalists from the Associated Press.” See Consolidated Complaint ¶ 30. The Consolidated Complaint does not allege, however, that those seizures were unlawful, and later references the DOJ’s use of search warrants to investigate internal leaks to the media. Id. ¶¶ 30, 72(Z), 72(AA). Later in 2012, the DOJ provided training for the National Security Cyber Specialists Network, as well as the computer crime unit in the DOJ’s Criminal Division. Regarding the role of the USPS, the plaintiffs allege that the USPS has a “working relationship with the FBI, Department of Homeland Security, and DOJ for domestic surveillance projects.” Id. ¶ 63.

The Consolidated Complaint also references emails released by Wikileaks (no longer available online), in which members of a “global intelligence company doing business with government agencies” discussed a perceived White House “witch hunt[] of investigative journalists.” See Consolidated Complaint ¶ 33. Finally, that Complaint alleges that in November 2012, the FBI “initiated a body of cyber security case

investigations that would later relate to the illegal intrusions” into the plaintiffs’ devices. 8

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 9 of 72

Id. ¶ 39. It is unclear what those investigations entailed, what relationship they had to the plaintiffs or the intrusions into their devices, and who or what was the focus of the FBI’s inquiry. The Consolidated Complaint also alleges that the “FBI investigation involving Ms. Attkisson’s computer intrusions was circulated to the DOJ’s national cyber security group” in late 2012. Id. ¶ 59.

With respect to Attorney General Holder’s personal involvement, the Consolidated Complaint identifies a number of public statements that purportedly show that Holder knew of (unrelated) illegal surveillance conducted by the National Security Agency (the “NSA”). It references a DOJ report regarding revisions to DOJ policies, including changes that restricted the circumstances in which the DOJ would seek to seize a journalist’s work product. The Consolidated Complaint asserts that Holder was personally involved in what it characterizes as illegal surveillance of a reporter named James Rosen in 2010, though it also alleges that Holder signed off on search warrants concerning individuals in the media at that time. Lastly, the Consolidated Complaint alleges that Holder discussed Attkisson’s reporting on Operation Fast and Furious; that he directed an aide to call a CBS News anchor and tell him to “get a ‘handle’ on [Attkisson’s] reporting”; and that Holder used “DOJ assets” to work with “smear machines like Media Matters to attack reporters,” including Attkisson. See Consolidated Complaint ¶ 72(Q)-(T), (W).2

2 The Consolidated Complaint also makes various speculative and conclusory assertions against Holder, such as stating, without any supporting factual allegation or indication of personal knowledge, that Holder “promulgated a policy that required or (Continued)

9

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 10 of 72

With regard to Postmaster Donahoe’s involvement in the foregoing events, the Consolidated Complaint alleges that he was ultimately responsible for any use of the USPS network, including the use of its IP addresses. That Complaint also generally alleges that USPS has cooperated with the DOJ and FBI in their investigations, including by unconstitutionally monitoring mail.

2.
The Amended Complaint, filed in February 2018, added as defendants, inter alia,

MCI Communications Services, Inc., d/b/a Verizon Business Services; Cellco Partnership d/b/a Verizon Wireless; and Verizon Virginia LLC (collectively, the “Verizon defendants,” or “Verizon”). The central factual allegations in the Amended Complaint mirror those provided in the Consolidated Complaint. With respect to the Verizon defendants and their involvement in the intrusions into the plaintiffs’ personal devices, the Amended Complaint offers the following allegations:

• That Verizon provided the plaintiffs’ phone, internet, and television services through the Verizon FiOS cable installed in their home;
• That Verizon made various attempts to resolve the anomalies with the plaintiffs’ electronic devices and failed, as discussed above;
• That someone purporting to be a Verizon technician removed an extra FiOS cable from the plaintiffs’ home, as discussed above;encouraged the violation of Plaintiffs’ rights.” See Consolidated Complaint ¶ 72(G). Like the district court, we disregard such bare speculation. See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (emphasizing that allegations in complaint must “raise a right to relief above the speculative level”).

10

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 11 of 72

• That the FBI’s Telephone Telecommunications Intercept and Collection Technology Unit has the capacity to interface with Verizon’s network infrastructure; and
• That government agents used Verizon’s network to unlawfully access Attkisson’s work laptop.See Amended Complaint ¶¶ 31, 33, 38-39, 54-57, 81-82, 84. B.1.
  These proceedings began in December 2014, when the plaintiffs sued AttorneyGeneral Holder, Postmaster Donahoe, and the John Doe agents in the Superior Court of the District of Columbia. The plaintiffs’ Superior Court complaint included First and Fourth Amendment claims based on the electronic intrusions described above. In February 2015, Holder and Donahoe removed the lawsuit to the district court for the District of Columbia.On February 23, 2015, the plaintiffs sought expedited discovery in the District of Columbia, requesting “limited, immediate discovery” to “determine the true identifies [sic] of the Doe Defendants.” See Attkisson v. Holder, No. 1:15-cv-00238 at 1 (D.D.C. Feb. 23, 2015), ECF No. 5. Because the plaintiffs failed to provide a more detailed explanation of such discovery, the district court denied their motion without prejudice.The plaintiffs renewed their expedited discovery motion on March 20, 2015. The renewed motion contained twenty-one interrogatories to be served on Holder, Donahoe, the USPS, and DOJ. The interrogatories contained broad requests, including for “[t]he identity of any person who has knowledge of existence and use of technology capable of

11

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 12 of 72

remotely using a ‘kickstart’ program between 2011-2013” to remove surveillance software from a personal computer. See Attkisson v. Holder, No. 1:15-cv-00238 at 4 (D.D.C. Mar. 20, 2015), ECF No. 21-1. The defendants opposed the plaintiffs’ renewed discovery motion on April 6, 2015, and at the same time moved to dismiss the complaint. In response, the plaintiffs amended their complaint. The district court thus denied the motion to dismiss as moot.

On July 3, 2015, the district court denied the plaintiffs’ renewed motion to expedite discovery. First, the court observed that the plaintiffs had failed to comply with that court’s Local Rule requiring the parties to meet and confer before seeking court intervention. The court also determined that the plaintiffs failed to meet the “good cause” standard for expedited discovery, primarily because their requests were “not narrowly tailored to discovering the identity of Doe defendants.” See Attkisson v. Holder, No. 1:15-cv-00238 at 11 (D.D.C. July 3, 2015), ECF No. 34.

Soon thereafter, the defendants renewed their motion to dismiss the then-operative complaint in the District of Columbia. In response, the plaintiffs voluntarily dismissed their claims against Holder and Donahoe without prejudice in August 2015. Because Holder and Donahoe had been the only named defendants in that complaint, the district court requested a “recommendation for future proceedings.” See Attkisson v. Holder, No. 1:15-cv-00238 (D.D.C. Aug. 27, 2015). The plaintiffs responded by asserting that they intended to file a separate claim “against the named defendants and others” under the Federal Tort Claims Act (the “FTCA”). See Attkisson v. Holder, No. 1:15-cv-00238 at 1

(D.D.C. Aug. 27, 2015), ECF No. 39. They also represented to the court that they were 12

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 13 of 72

“in the process of serving” subpoenas on the USPS in an effort to identify the John Doe agents. Id. at 2. The plaintiffs thus requested “that no action be taken in this case” pending that discovery and the filing of their FTCA suit. Id. No further action occurred in the original District of Columbia lawsuit until October 2015, when the plaintiffs moved to compel the USPS to comply with their discovery efforts.

Over the next several months, the plaintiffs and the Government litigated the plaintiffs’ motion to compel, which was fully briefed by March 2016. No party took any action thereafter until July 28, 2016, when the district court consolidated the plaintiff’s initial lawsuit with the FTCA complaint, pursuant to Federal Rule of Civil Procedure 42(a). The FTCA case — which the plaintiffs had filed in September 2015 — arose from the same facts as the initial lawsuit, and identified as defendants Holder, Donahoe, the John Doe agents, and the United States. In light of the change in named parties that was occasioned by consolidation, the court denied the plaintiffs’ pending motion to compel as moot. On March 29, 2017, the consolidated lawsuit was transferred from the District of Columbia to the Eastern District of Virginia because the FTCA claims lacked venue in the District of Columbia. We thus turn to a review of the post-transfer events in the Eastern District of Virginia.

2.

a.
After their consolidated lawsuit was transferred to the Eastern District of Virginia

in March 2017, the plaintiffs’ lawyers failed to notice their appearances there until April 13

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 14 of 72

21, 2017 — nearly a month later. The plaintiffs then took no action at all for three more months.

On July 18, 2017, the case was reassigned from Judge Cacheris to Judge Brinkema, and the court ordered that any motion to dismiss the plaintiffs’ claims be filed by early August 2017. The plaintiffs filed their first motion in the Eastern District of Virginia on July 26, 2017, moving for reconsideration of their most recent motion to compel discovery, which the District of Columbia court had denied as moot upon consolidating the two lawsuits. The plaintiffs’ motion sought USPS records and a taped deposition of a USPS representative, to cover topics including, inter alia, “[a]ny and all records, logs, or other form of identification material that will or may assist in identifying” any persons with access to the IP address identified by the plaintiffs’ forensic analysis. See Attkisson v. Holder, No. 1:17-cv-00364 at 5 (E.D. Va. July 26, 2017), ECF No. 91-1. On July 28, 2017, the plaintiffs amended their discovery request to cover information relating to a second IP address.

On August 9, 2017, the defendants moved to dismiss the plaintiffs’ claims for failure to state a claim. Defendants Holder and Donahoe also invoked a qualified immunity defense. On August 14, 2017, the defendants filed a joint opposition to the plaintiffs’ motion for reconsideration, emphasizing the breadth of the plaintiffs’ discovery requests, the high bar for granting motions for reconsideration, and reasserting the individual defendants’ right to immunity.

On September 1, 2017, the magistrate judge heard argument on the plaintiffs’

motion to reconsider. After the hearing, the magistrate judge denied the reconsideration 14

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 15 of 72

motion without prejudice “as to the subject matter of the discovery sought by plaintiffs,” for reasons “stated from the bench.” Attkisson v. Holder, No. 1:17-cv-00364 (E.D. Va. Sept. 1, 2017), ECF No. 107.

On September 5, 2017, the district court entered a scheduling order, which established a discovery deadline of January 12, 2018. That same day, the plaintiffs responded to the motion to dismiss. A week later, in light of confusion among the parties concerning what constituted the operative complaint after the transfer to the Eastern District of Virginia, the court ordered the plaintiffs to file the Consolidated Complaint. It was filed on September 15, 2017.

b.
The Consolidated Complaint named as defendants Holder, Donahoe, and the John

Doe agents. Notably, it did not name the United States as a defendant. It alleged the following claims: a First Amendment claim pursuant to Bivens v. Six Unknown Federal Narcotics Agents, 403 U.S. 388 (1971) (Count 1); a Fourth Amendment Bivens claim (Count 2); violations of the Electronic Communications Privacy Act (the “ECPA”) (Count 3), the Stored Communications Act (the “SCA”) (Count 4), the Computer Fraud and Abuse Act (the “CFAA”) (Count 5), the Foreign Intelligence Surveillance Act (“FISA”) (Count 6), and the Virginia Computer Crimes Act (Count 7); plus common law trespass (Count 8).

The pending motion to dismiss the Consolidated Complaint was fully briefed by September 18, 2017, and the district court conducted a hearing on the dismissal motion

15

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 16 of 72

on September 22, 2017. During the hearing, the lawyers thoroughly argued the motion to dismiss. The court also inquired about discovery issues:

THE COURT: [T]here still are these John Does out there, and you still, I believe, have matters pending, or do you not, before [the magistrate judge] in terms of discovery requests?

PLAINTIFFS’ COUNSEL: I don’t believe we do. I think he denied with permission for us to re-raise any issues if there was a problem.

See Attkisson v. Holder, No. 1:17-cv-00364 at 20-21 (E.D. Va. Oct. 16, 2017), ECF No. 127 (transcript of September 22 hearing). The court “strongly suggest[ed]” that the plaintiffs’ lawyers “start pursuing your discovery about that [USPS] IP address.” Id. at 21. The court then entered an order dismissing Counts 7 and 8 of the Consolidated Complaint with prejudice, but held the remainder of the dismissal motion in abeyance. Notably, the order observed that, although the United States had previously been named as a defendant, “it was not named as a defendant in the Consolidated Complaint.” See Attkisson v. Holder, No. 1:17-cv-00364 at 1 (E.D. Va. Sept. 22, 2017), ECF No. 122. The plaintiffs did not seek reconsideration of that order.

c.
Meanwhile, the parties filed a joint discovery plan (for which they had jointly

obtained a brief extension), which the magistrate judge approved on September 25, 2017. That plan retained the final discovery deadline of January 12, 2018. On September 27, 2017, the plaintiffs noticed their first deposition in the Eastern District of Virginia — six months after the litigation was transferred there. That notice again sought to depose a USPS representative and requested various records from that agency. The topics

16

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 17 of 72

specified in the notice were similar to those identified in the plaintiffs’ previous discovery motion, litigated in August 2017. It retained a request for “any and all records, logs, or other form of identification material” that “will or may assist in identifying” any person who had access to the listed IP addresses. See Attkisson v. Holder, No. 1:17-cv- 00364 at 3 (E.D. Va. Sept. 27, 2017), ECF No. 125. According to the briefs, the plaintiffs deposed a USPS representative in mid-October 2017.

On October 27, 2017, Holder and Donahoe — the two remaining named defendants — moved to stay discovery until the district court resolved the balance of their motion to dismiss the Consolidated Complaint. Holder and Donahoe emphasized that, if they prevailed on qualified immunity, they were entitled to immunity from suit, including discovery. They also represented to the court that the plaintiffs had recently served wide-ranging document subpoenas on nine federal agencies and departments, including the FBI, the ATF, the Central Intelligence Agency (the “CIA”), and the NSA. The defendants submitted as support the plaintiffs’ subpoena to the NSA, which included, inter alia, a request for all records relating to “Sharyl Attkisson’s and/or CBS reporting on Benghazi” between 2004 and 2017. See Attkisson v. Holder, No. 1:17-cv-00364 at 12 (E.D. Va. Oct. 27, 2017), ECF No. 130-1. As an alternative to their motion to stay discovery, the defendants sought a protective order.

d.
Shortly thereafter, on November 1, 2017, the district court dismissed with

prejudice Counts 1 through 6 of the Consolidated Complaint as to Holder and Donahoe.

See Attkisson v. Holder, 1:17-cv-00364 (E.D. Va. Nov. 1, 2017), ECF No. 133 (the “First 17

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 18 of 72

Dismissal”). The court also dismissed with prejudice Count 4 of the Consolidated Complaint as to all parties. With the filing of the First Dismissal, the only pending aspects of the litigation were Counts 1, 2, 3, 5, and 6, as to the John Doe agents. In the circumstances, the First Dismissal also denied as moot Holder and Donahoe’s motion to stay discovery.

On the very day the district court filed the First Dismissal, the plaintiffs moved to again name the United States as a defendant, asserting that they had inadvertently omitted to name the United States in the Consolidated Complaint. The court denied that motion two weeks later, on November 16, 2017, ruling that the plaintiffs had failed to show good cause and that “[a]llowing plaintiffs to add a defendant back into the litigation at this stage would lead to a regression of the litigation and impair judicial economy.” See Attkisson v. Holder, No. 1:17-cv-00364, at 4 (E.D. Va. Nov. 16, 2017), ECF No. 140. The court emphasized that the plaintiffs had not sought relief when the court’s September 22, 2017 order referenced the omission of the United States as a defendant. The court observed, however, that the plaintiffs were entitled to pursue their remaining claims against the John Doe agents.3

3 More than a month later, on December 26, 2017, the plaintiffs filed another complaint against the United States in the Eastern District of Virginia. See Attkisson v. United States, No. 1:17-cv-01474 (E.D. Va. Dec. 26, 2017). In April 2018, the district court dismissed that complaint for lack of service, pursuant to Federal Rule of Civil Procedure 4(m) (requiring dismissal of any defendant not served within ninety days after complaint is filed, absent good cause).

18

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 19 of 72

Accordingly, the plaintiffs continued to pursue discovery, including seeking information from non-party Verizon entities. On December 1, 2017, the magistrate judge granted the plaintiffs’ request to vacate the existing scheduling order and authorized the plaintiffs to “substitute new parties for the John Doe defendants by no later than January 5, 2018, at 10:00 a.m.” See Attkisson v. Holder, No. 1:17-cv-00364, at 1 (E.D. Va. Dec. 1, 2017), ECF No. 145. The judge explained: “Once the substituted parties have been served and make an appearance in this case, a new scheduling order will be entered.” Id.

Two weeks later, the plaintiffs sought to extend the substitution deadline. That motion was granted and the deadline for naming the John Doe agents was extended to February 5, 2018. In its order, the district court emphasized that the John Doe agents were “the only defendants remaining in this civil action,” and explicitly advised that this order constituted the plaintiffs’ final extension “because the interests of judicial economy and fairness to third parties and potential future defendants dictate that plaintiffs move forward with this litigation in as timely a fashion as possible.” See Attkisson v. Holder, No. 1:17-cv-00364, at 1-2 (E.D. Va. Dec. 29, 2017), ECF No. 151.

e.
On January 5, 2018, Verizon Virginia LLC (“Verizon”) sought a protective order

against the plaintiffs’ pending discovery requests. Verizon represented to the court that the plaintiffs had first sought third-party discovery from Verizon on October 16, 2017, requesting records related to purported surveillance of the Attkissons. Verizon had responded that it possessed no documents responsive to that request. During the next two

months, the plaintiffs served five additional discovery requests on Verizon, some of 19

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 20 of 72

which did not match the notices the plaintiffs filed with the court, and most of which were broader in scope than the October 16 request. For example, a discovery request of December 7, 2017, sought to depose a Verizon representative regarding “Verizon’s cyber security operations between 2010 and 2014,” including “the relationship between Verizon and the U.S. Intelligence Community.” See Attkisson v. Holder, No. 1:17-cv- 00364 at 2 (E.D. Va. Dec. 7, 2017), ECF No. 147.

On the very day that Verizon sought the protective order — January 5, 2018 — the plaintiffs filed a motion to compel discovery from the various third-party government entities they had served with document subpoenas, including the FBI, the CIA, and the NSA. Importantly, the January 5 motion to compel was the first — and only — effort to compel discovery that the plaintiffs pursued in the Eastern District of Virginia.4

A week later, on January 12, 2018, the magistrate judge conducted a hearing on Verizon’s protective order request and the plaintiffs’ motion to compel. The judge first addressed Verizon’s motion, which it granted in part and denied in part, addressing each disputed request individually. As part of the approved requests, the judge authorized the deposition of Todd Haskell, the Verizon technician who made a service call to the Attkissons’ home on January 1, 2013. See Attkisson v. Holder, No. 1:17-cv-00364 at 6, 17 (E.D. Va. Jan. 24, 2018), ECF No. 173 (transcript of January 12 hearing). The judge

4 The plaintiffs filed another motion to compel in February 2018, after their Amended Complaint was filed. They soon withdrew that motion to compel.

20

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 21 of 72

also approved a deposition of a Verizon corporate representative, either Haskell or some other designated employee.

Turning to the plaintiffs’ motion to compel, the magistrate judge expressed skepticism concerning the plaintiffs’ need for documents dating back to 2004, and criticized the requested discovery as overly broad. The judge emphasized to the lawyers that they should focus on “identification discovery” rather than “liability discovery,” and advised that “a new scheduling order” would be issued if “Doe defendants” were successfully named. See Attkisson v. Holder, No. 1:17-cv-00364 at 24 (E.D. Va. Jan. 24, 2018), ECF No. 173. The judge explained that, with the Does being the only remaining defendants, identification discovery had to come first, because “the party involved in the lawsuit . . . needs to be involved in that discovery.” Id. at 25. The plaintiffs answered that they had “tried to focus [their] discovery” on “attribution.” Id. In response, the judge advised that their requests did not reflect such a focus and, in fact, were so “generic” and of such “astounding” scope that it was difficult to rule on them. Id. at 26- 27.

Nevertheless, the magistrate judge instructed the parties to proceed with discovery for the purpose of “identify[ing] the Doe defendants.” Id. at 35. No discovery outside the identification purpose was permitted. That said, the judge required “more specific information” before he could grant a motion to compel. Id. at 36. The judge thus denied the motion to compel without prejudice. As the hearing concluded, the judge instructed the plaintiffs’ lawyers “to focus on this and get it done as quickly as possible” to

“hopefully meet the February 5 deadline” for naming the John Doe defendants. Id. at 37. 21

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 22 of 72

f.
Despite those warnings, the plaintiffs made no motions or requests of the district

court between the January 12, 2018 hearing and the February 5, 2018 deadline for naming the John Doe defendants. That is, for twenty-three days the plaintiffs neither sought the court’s aid with discovery nor requested an extension of the deadline. And the plaintiffs’ lawyers later admitted to the court that they had not submitted any revised discovery requests to the government agencies until January 28, 2018 — just one week before the deadline. See Attkisson v. Holder, No. 1:17-cv-00364 at 2 (E.D. Va. Feb. 13, 2018), ECF No. 176. Verizon has since represented to this Court that the plaintiffs did not take the depositions of the two Verizon employees that the magistrate judge authorized at the January 12 hearing. See Br. of Verizon Defendants-Appellees 3.5

Instead, on February 5, 2018, the plaintiffs purported to file their Amended Complaint. The plaintiffs were only authorized to amend their complaint by substitution of named parties for the John Doe defendants, as ordered by the district court. Nevertheless, the Amended Complaint failed to substitute any named parties for the John Doe agents. It again identified as defendants the United States and unknown named agents of the DOJ, the USPS, and the United States. The Amended Complaint also added

5 In the proceedings below and on appeal, the plaintiffs have maintained that they were “permitted only to conduct a grand total of one deposition,” which is false. See Br. of Appellants 48. It appears, however, that the plaintiffs never deposed a Verizon representative, despite receiving the magistrate judge’s authorization. See Attkisson v. Holder, No. 1:17-cv-00364 at 2 (E.D. Va. Apr. 23, 2018), ECF No. 207 (plaintiffs’ representation that “there has been exactly one deposition in this case” of a USPS representative).

22

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 23 of 72

as new defendants the FBI and the Verizon defendants. Additionally, it realleged Counts 4, 7, and 8, which the court had already dismissed with prejudice. The named defendants — that is, the United States, the FBI, and the Verizon defendants — promptly moved in March 2018 to dismiss the Amended Complaint.

On May 15, 2018, the district court granted the motions of the named defendants to dismiss the Amended Complaint and disposed of the plaintiffs’ claims. See Attkisson v. Holder, No. 1:17-cv-00364 (E.D. Va. May 15, 2018), ECF No. 213 (the “Second Dismissal”). The Second Dismissal ruled that the plaintiffs had violated several of the court’s earlier orders with regard to amending the complaint. By way of example, the Amended Complaint added defendants who were not appropriate substitutes for the John Doe agents and simply ignored the court’s prior order denying leave to name the United States as a defendant.

Although the plaintiffs’ procedural violations sufficed to dismiss the Amended Complaint, the court provided additional explanations for its rulings. First, the court dismissed the resurrected claims against the United States because it had already denied leave to rename the United States as a defendant. Next, the court dismissed the claims against the FBI because no such lawsuit was authorized by any of the statutory provisions under which the plaintiffs sought to sue the Bureau. See Second Dismissal 5 (citingBlackmar v. Guerre, 342 U.S. 512 (1952)). The court dismissed the claims against the Verizon defendants as procedurally barred and for failure to state a plausible claim to relief. Finally, the court dismissed the claims against the John Doe agents because, after

23

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 24 of 72

more than three years of litigation, those unnamed agents had never been identified or served, and the plaintiffs had “made no substantial progress” in that regard. Id. at 6 n.3.

Because of the plaintiffs’ multitude of procedural violations, and because the district court decided that further amendments “would be futile,” the court declined to authorize the plaintiffs to again amend their complaint. See Second Dismissal 5-6. Accordingly, the court entered final judgment in favor of the defendants.

The plaintiffs have timely noted this appeal. They challenge only the dismissal of their Fourth Amendment Bivens claim with respect to Holder and Donahoe, the dismissal of their ECPA claim with respect to those defendants, and the district court’s dismissal of the Amended Complaint — including the claims against the John Doe agents and the Verizon defendants — with its concomitant denial of leave to further amend their complaint. We possess appellate jurisdiction pursuant to 28 U.S.C. § 1291.

II.
This Court reviews de novo a dismissal under Federal Rule of Civil Procedure

12(b)(6). See Nemet Chevrolet, Ltd. v. Consumeraffairs.com, Inc., 591 F.3d 250, 253 (4th Cir. 2009). In so doing, we accept all well-pleaded facts as true and draw all reasonable inferences in favor of the plaintiffs. Id. That said, we “need not accept legal conclusions couched as facts or unwarranted inferences, unreasonable conclusions, or arguments.” Wag More Dogs, LLC v. Cozart, 680 F.3d 359, 365 (4th Cir. 2012) (internal quotation marks omitted). Viewing the complaint in that light, it must provide “sufficient

factual matter, accepted as true, to state a claim to relief that is plausible on its face.’” 24

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 25 of 72

Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)).

By contrast, we review the dismissal of a complaint for violation of court orders for abuse of discretion. See Simpson v. Welch, 900 F.2d 33, 35-36 (4th Cir. 1990). We likewise review for abuse of discretion a district court’s denial of leave to amend a complaint, see Scott v. Family Dollar Stores, Inc., 733 F.3d 105, 112 (4th Cir. 2013), and the dismissal of a defendant for lack of service, see Shao v. Link Cargo (Taiwan) Ltd., 986 F.2d 700, 708 (4th Cir. 1993).

III.
The plaintiffs present three challenges to the district court’s rulings. First, they

contend that the court erred in dismissing their Fourth Amendment Bivens claim against Attorney General Holder and Postmaster Donahoe as a matter of law. Second, they dispute the court’s dismissal of their ECPA claim against Holder and Donahoe. Third, the plaintiffs contest the court’s dismissal of the John Doe agents and Verizon defendants on procedural grounds, along with its simultaneous denial of leave to further amend their complaint. We address these contentions in turn.

A.
The plaintiffs first contest the district court’s dismissal of their Fourth Amendment

Bivens claim against Attorney General Holder and Postmaster Donahoe for failure to present a cognizable claim under the Supreme Court’s controlling precedent. In the Consolidated Complaint, the plaintiffs allege that Holder, Donahoe, and the John Doe

25

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 26 of 72

agents violated their Fourth Amendment rights by unlawfully surveilling the plaintiffs through their electronic devices. They seek damages for that alleged injury pursuant to the Court’s ruling in Bivens v. Six Unknown Federal Narcotics Agents, which authorized damages for certain constitutional violations by federal officials. See 403 U.S. 388, 395 (1971). In its First Dismissal, the district court rejected that claim as to Holder and Donahoe because, under more recent precedent, the plaintiffs failed to state a viableBivens claim against those named defendants. We agree.

The Supreme Court’s 2017 decision in Ziglar v. Abbasi narrowed the circumstances in which a plaintiff may successfully state a claim under the principles established in Bivens. See 137 S. Ct. 1843, 1857-58 (2017). As the Court explained inAbbasi, the Bivens decision created an implied cause of action, permitting civil suits for damages for constitutional violations by federal officials where Congress had not indicated that such a remedy was foreclosed. Id. at 1854. Bivens itself authorized damages in a situation involving an unlawful search and arrest in the plaintiff’s home.See 403 U.S. at 389. In the years since Bivens, the Court has recognized implied causes of action in two additional situations: for the violation of a prisoner’s Eighth Amendment right to adequate medical care, and for a federal employee’s Fifth Amendment due process right against gender discrimination. See Abbasi, 137 S. Ct. at 1854-55 (citingCarlson v. Green, 446 U.S. 14 (1980); Davis v. Passman, 442 U.S. 228 (1979)).6 In

6 The Supreme Court may have recognized a fourth Bivens context in Farmer v. Brennan, which sustained a prisoner’s Eighth Amendment claim for damages against federal prison officials for failure to protect. See 511 U.S. 825, 823-49 (1994). Although (Continued)

26

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 27 of 72

Abbasi, the Court clarified the inquiry as to whether a cognizable Bivens remedy exists with regard to a specific type of alleged official misconduct. First, a court must determine whether the claim “presents a new Bivens context.” Id. at 1859. If it does, the court must assess whether any “special factors counsel[] hesitation” in recognizing a new remedy “in the absence of affirmative action by Congress.” Id. at 1857.

A Bivens claim arises in a “new context” if the case differs “in a meaningful way from previous Bivens cases decided by” the Supreme Court. See Abbasi, 137 S. Ct. at 1859. Examples of such meaningful differences include:

the rank of the officers involved; the constitutional right at issue; the generality or specificity of the official action; the extent of judicial guidance as to how an officer should respond to the problem or emergency to be confronted; the statutory or other legal mandate under which the officer was operating; the risk of disruptive intrusion by the Judiciary into the function of other branches; or the presence of potential special factors that previous Bivens cases did not consider.

Id. at 1860. Although Bivens itself approved a remedy for an alleged Fourth Amendment violation, we agree with the district court that the claim asserted by the plaintiffs here presents a “new Bivens context.”

The plaintiffs’ Fourth Amendment Bivens claim against Holder and Donahoe differs meaningfully from the claim raised in Bivens in numerous ways that are material

the Abbasi Court did not include Farmer in its list of recognized Bivens contexts, the Third Circuit recently held that a prisoner’s failure-to-protect claim did not present a newBivens context in light of Farmer. See Bistrian v. Levi, 912 F.3d 79, 90-92 (3d Cir. 2018). Because the plaintiffs’ claim here is entirely distinct from that raised in Farmer, we need not and do not decide whether such a claim would present a new Bivens context.

27

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 28 of 72

under Abbasi. First, Holder and Donahoe held much higher ranks than the line-level FBI agents sued in Bivens. Second, a claim based on unlawful electronic surveillance presents wildly different facts and a vastly different statutory framework from a warrantless search and arrest. Finally, the plaintiffs seek to hold high-level officials accountable for what they themselves frame as policy-level decisions to target internal leaks to the media. In these circumstances, the plaintiffs’ claim against Holder and Donahoe assuredly presents a “new Bivens context.”

Moreover, the plaintiffs’ Fourth Amendment Bivens claim fails at the second step described in Abbasi. Various “special factors” identified in the Abbasi decision counsel hesitation against recognizing a Bivens claim here. See 137 S. Ct. at 1857. It is sufficient, however, to note that Congress has legislated extensively in the area of electronic surveillance and intrusions into electronic devices without authorizing damages for a Fourth Amendment violation in such circumstances. Indeed, Congress has created several private causes of actions under various statutes governing the surveillance and the integrity of personal computing devices, including the SCA, FISA, and the CFAA. That legislation suggests that Congress’s “failure to provide a damages remedy” for Fourth Amendment violations in similar factual circumstances is “more than inadvertent,” and strongly counsels hesitation before creating such a remedy ourselves.See Abbasi, 137 S. Ct. at 1862. Indeed, “if there is an alternative remedial structure present in a certain case, that alone may limit the power of the Judiciary to infer a newBivens cause of action.” Id. at 1858; see also Schweiker v. Chilicky, 487 U.S. 412, 423 (1988) (same).

28

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 29 of 72

In these circumstances, we discern “sound reasons to think Congress might doubt the efficacy or necessity of a damages remedy as part of the system for enforcing the law and correcting a wrong,” and we are therefore obliged to “refrain from creating the remedy.” See Abbasi, 137 S. Ct. at 1858. Accordingly, we are satisfied to affirm the district court’s dismissal of the plaintiffs’ Fourth Amendment Bivens claim with respect to Holder and Donahoe.

B.
By way of their second appellate contention, the plaintiffs maintain that the district

court erred in rejecting their ECPA claim as part of the First Dismissal. The plaintiffs assert that Holder and Donahoe violated the ECPA’s prohibition on the unauthorized interception and disclosure of wire, oral, or electronic communications, codified at 18 U.S.C. § 2511. Section 2511 provides that

any person who — (a) intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral or electronic communication; (b) intentionally uses, endeavors to use, or procures any other person to use or endeavor to use any electronic, mechanical, or other device to intercept any oral communication when [certain undisputed elements are met]; (c) intentionally discloses, or endeavors to disclose, to any other person the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication in violation of this subsection [has violated the ECPA, unless authorized by law as detailed elsewhere in the statute].

Specifically, the Consolidated Complaint alleges that Holder and Donahoe procured government agents to intercept the plaintiffs’ electronic communications. The plaintiffs pursued that claim under the ECPA’s private right of action, which provides that

29

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 30 of 72

any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in a violation of this chapter may in a civil action recover from the person or entity, other than the United States, which engaged in that violation such relief as may be appropriate.

See 18 U.S.C. § 2520. Comparing § 2511 and § 2520, the district court determined that the cause of action authorized by § 2520 does not extend to persons who procuredanother to intercept, disclose, or intentionally use a covered communication. Rather, the court concluded that a suit under § 2520 may only target an individual who directlyintercepted, disclosed, or used such a communication in violation of § 2511.

On appeal, the plaintiffs challenge the district court’s interpretation and argue that § 2520 is better read to permit civil suits with regard to any violation of § 2511. We decline to address that interpretive issue, however, because we agree with the Government that, even if § 2520 supports a civil ECPA claim for procurement, Holder and Donahoe are entitled to qualified immunity.7

Qualified immunity protects government officials from civil liability and suit “insofar as their conduct does not violate clearly established statutory or constitutional rights of which a reasonable person would have known.” See Harlow v. Fitzgerald, 457 U.S. 800, 818 (1982). To overcome an official’s claim of qualified immunity, the plaintiff must show: “(1) that the official violated a statutory or constitutional right, and

7 The district court did not premise its dismissal ruling on qualified immunity, but Holder and Donahoe raised that defense below and we are entitled to affirm on any ground fairly presented in the record. See Attkisson v. Holder, No. 1:17-cv-00364, at 19 (E.D. Va. Aug. 9, 2017), ECF No. 100 (defendants invoking qualified immunity); see also United States v. Smith, 395 F.3d 516, 519 (4th Cir. 2005) (confirming that we may affirm “on any grounds apparent from the record”).

30

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 31 of 72

(2) that the right was clearly established at the time of the challenged conduct.” See Ashcroft v. al-Kidd, 563 U.S. 731, 735 (2011) (internal quotation marks omitted). A court need not address those inquiries in sequence, but instead may exercise its “sound discretion” in deciding which issue to first address. See Pearson v. Callahan, 555 U.S. 223, 236 (2009). The official is entitled to qualified immunity if either prong is not satisfied. Id. at 244-45.

Assessing the plaintiffs’ ECPA claim, we conclude that, to the extent Holder and Donahoe procured any wrongful interception, use, or disclosure of the plaintiffs’ electronic communications, they did not violate a clearly established right. To show a clearly established right, a plaintiff must identify existing precedent that “placed the statutory or constitutional question beyond debate.” See al-Kidd, 563 U.S. at 741. This the plaintiffs have failed to do. Compare Peavy v. WFAA-TV, Inc., 221 F.3d 158, 169 (5th Cir. 2000) (ruling that § 2520 only authorizes suits based on “illegal interception, disclosure, or use, and not to procuring interception by another”), with Lonegan v. Hasty, 436 F. Supp. 2d 419, 427-28 (E.D.N.Y. 2006) (concluding that § 2520 permits suits based on procurement).

Whatever our view of the procurement issue, the lack of settled precedent supporting the plaintiffs’ ECPA claim demonstrates that Holder and Donahoe are now entitled to qualified immunity. See Abbasi, 137 S. Ct. at 1868 (“When the courts are divided on an issue so central to the cause of action alleged, a reasonable official lacks

31

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 32 of 72

the notice required before imposing liability.”). Consequently, we affirm the district court’s dismissal of the ECPA claim with regard to Holder and Donahoe.8

C.
The plaintiffs’ third and final appellate contention challenges the district court’s

Second Dismissal. More specifically, the plaintiffs object to the dismissal of their claims against the Verizon defendants and the John Doe agents — which they argue should survive the dismissal of their claims against Holder and Donahoe — as well as the court’s denial of leave to further amend their complaint.

The district court dismissed the remaining defendants and denied the plaintiffs leave to further amend their complaint based on similar reasoning. Put simply, the court was dissatisfied with the plaintiffs’ lack of progress in pursuing their claims after more than three years of litigation, and their lack of respect for court orders. The court observed that the plaintiffs had failed to identify or serve any of the John Doe agents, even after receiving multiple extensions to the court’s deadline. Indeed, the plaintiffs had made little or no progress in that regard, despite filing five complaints (not counting two complaints that were replaced with corrected versions).

Moreover, the Amended Complaint contravened the court’s prior orders and the Federal Rules of Civil Procedure in multiple ways:

8 In their appellate brief, the plaintiffs suggest — apparently for the first time — that Holder and Donahoe “might” have directly intercepted, used, or disclosed the plaintiffs’ electronic communications. See Br. of Appellants 33 n.6. The Consolidated Complaint, however, fails to support that idle speculation or reflect such a claim.

32

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 33 of 72

• •

• •

•

The Amended Complaint failed to comply with the court’s order to substitute named parties for the John Doe agents and instead retained the Doe defendants while adding new defendants;

The plaintiffs had leave of court to amend their complaint solely to name the John Doe agents and violated that leave by adding new defendants;

The plaintiffs never sought additional leave to amend their complaint nor challenged the leave they were granted;

The new defendants included the United States, despite the court’s prior order denying leave to rename the United States as a defendant; and

The Amended Complaint attempted to resurrect several claims that the court had already dismissed with prejudice.

In discussing
that the February 5, 2018 deadline was necessary to avoid prejudicing the defendants (or potential future defendants), and to protect the interests of judicial economy. Those concerns, as the court explained, also motivated the Second Dismissal.

The court concluded that further amendment to the complaint would, in any event, be futile, because the claims against the FBI had no statutory basis and the claims against the Verizon defendants failed to state any plausible claim to relief. With regard to the John Doe agents, the court ruled that, given the lack of “substantial progress in identifying them,” the time had come “to end this litigation against them as well, and for this reason, the claims against them are also dismissed.” See Second Dismissal 6 n.3.

On appeal, the plaintiffs contest only the dismissal of the Verizon defendants and the John Doe agents, as well as the district court’s denial of leave to further amend their complaint. Despite its detailed discussion in the Second Dismissal of the procedural

those procedural defects, the court emphasized its warnings to the plaintiffs

33

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 34 of 72

defects of the Amended Complaint, the court did not specify the rules of procedure that provided the bases for its rulings. Nevertheless, we are entitled to affirm “on any grounds supported by the record.” See Kerr v. Marshall Univ. Bd. of Governors, 824 F.3d 62, 75 n.13 (4th Cir. 2016). And we are entirely satisfied that the Amended Complaint was properly subject to dismissal pursuant to Rule 41(b). With respect to the John Does, the claims against those unknown defendants were subject to dismissal under Rule 4(m), which requires the dismissal of a defendant who remains unserved ninety days after a complaint is filed, absent good cause. Accordingly, the court did not abuse its discretion in dismissing the Amended Complaint and denying the plaintiffs leave to further amend their complaint. We will expand on those rulings.

1.
As the Supreme Court has recognized, a court has the “inherent power” to dismiss

an action for want of prosecution. See Link v. Wabash R. Co., 370 U.S. 626, 630 (1962). Although Rule 41(b) of the Federal Rules of Civil Procedure provides an “explicit basis for this sanction,” it is not the source of that inherent power. See Doyle v. Murray, 938 F.2d 33, 34 (4th Cir. 1991). Rather, that judicial power derives from “the control necessarily vested in courts to manage their own affairs so as to achieve the orderly and expeditious disposition of cases.” See Link, 370 U.S. at 630-31. As provided by Rule 41(b), such involuntary dismissals are appropriate when “the plaintiff fails to prosecute or to comply with [the Federal Rules of Civil Procedure] or a court order.” Given the inherent judicial authority to make such dismissals, a court may, in appropriate

34

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 35 of 72

circumstances, enter such a dismissal sua sponte, even absent advance notice of “the possibility of dismissal.” See Link, 370 U.S. at 632-33.

That said, recognizing the severity of dismissal as a sanction, we have identified four criteria that guide a district court’s discretion in dismissing a case under Rule 41(b). Such an exercise should weigh: “(1) the plaintiff’s degree of personal responsibility; (2) the amount of prejudice caused the defendant; (3) the presence of a drawn out history of deliberately proceeding in a dilatory fashion; and (4) the effectiveness of sanctions less drastic than dismissal.” See Hillig v. C.I.R., 916 F.2d 171, 174 (4th Cir. 1990). Those criteria, however, “are not a rigid four-prong test.” See Ballard v. Carlson, 882 F.2d 93, 95 (4th Cir. 1989) (Powell, J.). Rather, the propriety of an involuntary dismissal ultimately depends on “the facts of each case,” which we review to determine “whether the trial court exercised sound discretion.” See Reizakis v. Loy, 490 F.2d 1132, 1135 (4th Cir. 1974); see also Link, 370 U.S. at 633.9

9 Contrary to the assertion of our dissenting friend, we have never ruled that a district court’s failure to expressly analyze the four factors guiding involuntary dismissals is itself an abuse of discretion. See post at 67. Rather, we have consistently reviewed the full circumstances of each such dismissal. See Reizakis, 490 F.2d at 1135 (evaluating “the circumstances of this case,” including, inter alia, whether trial court had “consider[ed] measures less drastic than dismissal”). Our approach accords with the Supreme Court’s decision in Link, which emphasized the context-dependent nature of such dismissals and affirmed the lower court’s involuntary dismissal based on its implicit consideration of “all the circumstances” before it. See 370 U.S. at 634-35. In any event, we are entitled to affirm a judgment where “the outcome is not in doubt.” See Garnett v. Remedi Seniorcare of Va., LLC, 892 F.3d 140, 142 (4th Cir.), cert. denied, 139 S.Ct. 605 (2018) (citing Singleton v. Wulff, 428 U.S. 106, 120 (1976)).

35

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 36 of 72

In the circumstances of these proceedings, we are satisfied that the district court did not abuse its discretion in dismissing the Amended Complaint. This Court has previously upheld an involuntary dismissal under Rule 41(b) where the plaintiff “failed to respond to a specific directive from the [trial] court.” See Ballard, 882 F.2d at 95. Our reasoning in Ballard applies directly to the Amended Complaint’s multiple violations of the Federal Rules and the applicable court orders. To start, the plaintiffs amended their complaint beyond the leave authorized, in violation of Rule 15(a)(2) and the court’s order of December 29, 2017.10 Nor did the plaintiffs even attempt to show good cause for those additional amendments, which Rule 16(b) requires after the entry of a scheduling order. See Nourison Rug Corp. v. Parvizian, 535 F.3d 295, 298 (4th Cir. 2008) (ruling that “after the deadlines provided by a scheduling order have passed, the good cause standard must be satisfied to justify leave to amend the pleadings”).11 The plaintiffs failed to substitute named parties for the John Doe agents and retained the John Doe defendants in the Amended Complaint, in violation of the court’s December 29, 2017 order. The plaintiffs also renamed the United States as a defendant, in direct violation of the court’s order of November 16, 2017. Lastly, the Amended Complaint improperly

10 Indeed, because the plaintiffs failed to obtain leave for their various amendments, the Amended Complaint was also “without legal effect” and thus “rightly disallowed” by the district court. See Schmidt v. United States, 749 F.3d 1064, 1069 (D.C. Cir. 2014); acc. Angles v. Dollar Tree Stores, 494 F. App’x 326, 329 (4th Cir. 2012).

11 The only argument pursued by the plaintiffs in the district court to defend their addition of the Verizon defendants in the Amended Complaint was that those entities were proper substitutes for the John Doe agents. That position was not supported by the plaintiffs’ allegations and was justifiably rejected.

36

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 37 of 72

sought to resurrect Counts 4, 7, and 8 of the Consolidated Complaint, which the court had dismissed with prejudice months earlier.

Providing further context for the Second Dismissal, the district court and the magistrate judge had both repeatedly warned the plaintiffs to focus on identifying the John Doe agents prior to the February 5, 2018 deadline. See Ballard, 882 F.2d at 95 (considering warning issued by magistrate judge in assessing 41(b) dismissal). Contrary to the view of our dissenting colleague, the record simply fails to show that the plaintiffs acted “diligently” in pursuing that discovery. See post at 43. Rather, they filed a single motion to compel, which the magistrate judge promptly ruled on. And the magistrate judge then authorized depositions of Verizon employees which the plaintiffs never took. Prior to that motion to compel, there were significant periods of inactivity by the plaintiffs, compounded by (unopposed) extensions sought by the defendants. See Davis v. Williams, 588 F.2d 69, 70-71 (4th Cir. 1978) (sustaining 41(b) dismissal where two- year litigation reflected “long history of delay” and plaintiff’s counsel “refused to take the initiative”).

This is not a situation where a plaintiff’s lawyer has briefly failed to comply with a court’s order without any participation of or blame on his client. Cf. Hillig, 916 F.2d at 174 (reversing 41(b) dismissal in part because counsel’s noncompliance spanned only three months, resulted from miscommunication, and was not known to client); Reizakis, 490 F.2d at 1134-35 (reversing 41(b) dismissal because lack of trial preparation resulted from miscommunication between retained counsel and local counsel despite plaintiff’s

steps in anticipation of trial). Nor does this litigation involve a pro se or incarcerated 37

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 38 of 72

inmate who had limited opportunities to “follow the progress of his case.” Cf. Doyle, 938 F.2d at 35. Courts should — and regularly do — take such realities into account. These plaintiffs were well represented and free to fully prosecute their case.

In sum, the plaintiffs contravened multiple rules and court orders while failing to alert the district court to any problems justifying their actions. And they acted in the face of explicit instructions from the court and the magistrate judge. Those circumstances support the dismissal with prejudice of their claims under Rule 41(b). See Ballard, 882 F.2d at 94-95; acc. Thomas v. Arn, 474 U.S. 140, 147 (1985) (observing that if petitioner “failed to comply with a scheduling order” court “could certainly dismiss the appeal”).12On this record, we cannot rule that the court abused its discretion in dismissing the Amended Complaint.

2.
The foregoing analysis applies equally to the plaintiffs’ claims against the John

Doe agents and suffices to affirm the district court’s dismissal thereof. That said, the dismissal of the Doe defendants is also supported by Rule 4(m) of the Federal Rules of Civil Procedure.13 Rule 4(m) requires the dismissal of defendants who remain unserved ninety days after the filing of a complaint unless “the plaintiff shows good cause.” The

12 The dismissal of the plaintiffs’ claims is with prejudice except as to the John Doe agents, as explained further herein.

13 We are satisfied that the district court implicitly relied on Rule 4(m) in dismissing the John Doe defendants. The Second Dismissal emphasized the plaintiffs’ failure to identify or serve those defendants, and their lack of progress in that regard.

38

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 39 of 72

plaintiffs failed to show good cause in the district court, nor do we discern any on this record. As with other procedural dismissals, we review a dismissal under Rule 4(m) for abuse of discretion. See Shao v. Link Cargo (Taiwan) Ltd., 986 F.2d 700, 708 (4th Cir. 1993) (reviewing Rule 4(m)’s predecessor — Rule 4(j) — for abuse of discretion).

Generally, for purposes of Rule 4(m), “good cause” requires some showing of diligence on the part of the plaintiffs. Put conversely, good cause generally exists when the failure of service is due to external factors, such as the defendant’s intentional evasion of service. See Mann v. Castiel, 681 F.3d 368, 374 (D.C. Cir. 2012) (collecting cases and commentary). While “good cause” is a flexible standard, diligence provides a touchstone for an appellate court that is reviewing a dismissal under Rule 4(m). See, e.g., Cardenas v. City of Chicago, 646 F.3d 1001, 1007 (7th Cir. 2011) (emphasizing that “the district court retained its discretion to hold the Plaintiffs accountable” for their “inaction” by “dismissing the case”); McCurdy v. Am. Bd. of Plastic Surgery, 157 F.3d 191, 196-97 (3d Cir. 1998) (affirming Rule 4(m) dismissal where plaintiff did not show diligence in timely serving defendants and failed to seek extension of time before deadline lapsed).

Whatever the minimum requirement for good cause may be, the plaintiffs have failed to show it. The facts that support the dismissal of the Amended Complaint under Rule 41(b) also show the plaintiffs’ lack of diligence for purposes of Rule 4(m). The plaintiffs’ significant periods of inactivity during three full years of litigation, their persistence in unjustifiably broad discovery requests despite repeated admonishments of the district court and the magistrate judge, and their decisions not to present additional

difficulties with discovery to the court, show a lack of diligence in pursuit of their claims. 39

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 40 of 72

See Scott v. Hern, 216 F.3d 897, 912 (10th Cir. 2000) (affirming dismissal under Rule 4(m) where plaintiffs failed to pursue authorized discovery against unnamed defendants);Figueroa v. Rivera, 147 F.3d 77, 82-83 (1st Cir. 1998) (affirming Rule 4(m) dismissal of John Doe defendants after seventeen months during which plaintiffs made no effort to identify them); Shao, 986 F.2d at 708 (affirming dismissal under Rule 4(m)’s predecessor where, after two extensions to service deadline, plaintiff showed no progress).

Our good dissenting colleague overstates our precedent by contending that a court may dismiss a suit for failure to name a John Doe defendant “only ‘if it does not appear that the true identity of an unnamed party can be discovered through discovery or through intervention by the court.’” See post at 56 (quoting Schiff v. Kennedy, 691 F.2d 196, 198 (4th Cir. 1982)). Our decision in Schiff merely explained that “if it does not appear” that the unnamed party could be identified, then “the court could dismiss the action without prejudice.” See 691 F.2d at 198 (emphasis added). In fact, the Schiff decision repeatedly emphasized that, as to John Doe defendants, the “district court is in a better position than we now are to ascertain what treatment should be given, and when.” Id. Judge Widener’s fine opinion for the Schiff panel thus deferred to the district court as to “whether the case against Doe should be now permitted to proceed or whether the case at this stage should be terminated.” Id. We will adhere to that good example and defer to the wisdom of the district judge in dismissing the John Doe defendants.

That said, pursuant to Rule 4(m), and consistent with this Court’s prior treatment of Doe defendants, the dismissal of the John Doe agents must be without prejudice. SeeFed. R. Civ. P. 4(m) (“If a defendant is not served within 90 days after the complaint is

40

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 41 of 72

filed, the court . . . must dismiss the action without prejudice against that defendant[.]”);see also Schiff, 691 F.2d at 198 (“Should the district court persist in its dismissal of Doe without further proceedings, the dismissal will be without prejudice.”). That rule flows from the principle that a court generally lacks personal jurisdiction over unserved parties.See, e.g., Koehler v. Dodwell, 152 F.3d 304, 306 (4th Cir. 1998) (“Absent waiver or consent, a failure to obtain proper service on the defendant deprives the court of personal jurisdiction over the defendant.”). With that clarification, we are satisfied to affirm without prejudice the John Doe dismissals.

IV.
Pursuant to the foregoing, we affirm the dismissals of Holder and Donahoe with

prejudice; we affirm the dismissal of the Amended Complaint and the parties named therein with prejudice; and we affirm the dismissal of the unnamed John Doe agents without prejudice.

AFFIRMED

41

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 42 of 72

WYNN, Circuit Judge, concurring in part1 and dissenting in part:

“When we saw the fours go up, game’s over.” 2—David Chadwick, Forward, University of North Carolina, 1967–71

Beginning in the late 1960s, when the University of North Carolina Tar Heels seized the lead in the second half of a basketball game, Hall of Fame head coach Dean Smith would raise his arm and put up four fingers. Requiring no further instruction, two post players would run to the two corners of the court formed by the baseline and the sidelines, and two wing players would move to the corners formed by the mid-court line and the sidelines. The point guard—most famously, Phil Ford—would then dribble the ball at the top of the key as the clock ticked down, occasionally exchanging the ball with one of the wing or post players if the defense applied too much pressure. In this offense—commonly referred to as the “Four Corners”—the clock was the Tar Heels’ best friend. The longer the Tar Heels held the ball on offense, the less time their opponent had to try to score and cut into the Tar Heels’ lead. The Four Corners proved so successful that college basketball’s powers-that-be effectively outlawed it through the adoption of the shot clock in 1985.

1 I concur in the majority opinion’s judgment that the district court properly dismissed Attkisson’s claims against the former Attorney General and former Postmaster General. I believe that Attkisson failed to plausibly allege that the former Attorney General and former Postmaster General were involved in any potential violation of Attkisson’s constitutional or statutory rights.

2 Brendan Marks, With Four Corners Offense, Dean Smith Changed Basketball, Daily Tar Heel (Feb. 9, 2015), https://www.dailytarheel.com/article/2015/02/with-four- corners-offense-dean-smith-changed-basketball.

42

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 43 of 72

In this case, the government—not unlike Dean Smith’s Tar Heels—put up the “fours” when Plaintiff-Appellant Sharyl Attkisson,3 a journalist formerly employed by CBS News, filed suit against unnamed employees and agents of the federal government (the “Doe Defendants”). Attkisson alleged that the Doe Defendants conspired to violate her constitutional and statutory rights by accessing and commandeering her home and work internet-connected devices for surveillance purposes. But Attkisson never got a meaningful opportunity to pursue her claims because the government did everything in its power to run out the clock on Attkisson’s action—it filed motions challenging venue and jurisdiction, motions challenging the sufficiency of service, motions for extension of time, motions to dismiss, and motions for protective orders.

And just as the Tar Heels had great success running the Four Corners, the government’s strategy worked. Although Attkisson diligently sought to identify the Doe Defendants for nearly four years—including by repeatedly serving discovery on the government and third-parties directed at identifying the Doe Defendants—the district court dismissed her case with prejudice against the Doe Defendants for failing to comply with a court order to identify the names of the Doe Defendants by a date certain. The district court did so even though the government’s delaying tactics deprived Attkisson of any meaningful opportunity to engage in the discovery necessary to identify the Doe Defendants.

3 Attkisson’s husband, James, and daughter, Judith, are also named plaintiffs because the alleged intrusions and commandeering of the Attkissons’ home computers and devices allegedly violated their statutory and constitutional rights as well.

43

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 44 of 72

The majority opinion affirms the district court’s dismissal of Attkisson’s claims against the Doe Defendants on grounds that the dismissal constituted a permissible exercise of the court’s discretion to oversee discovery and sanction a party for failing to comply with a court order. But this Court long has held that plaintiffs—like Attkisson— who state a plausible claim that unnamed defendants violated their constitutional or statutory rights are entitled to a meaningful opportunity to engage in discovery aimed at identifying the “true identity of an unnamed party.” Schiff v. Kennedy, 691 F.2d 196, 197–98 (4th Cir. 1982). And this Court has held that dismissal of an action for failure to comply with a court order is a “drastic” sanction, Hillig v. C.I.R., 916 F.2d 171, 174 (4th Cir. 1990), that courts should impose only in “extreme circumstances,” Reizakis v. Loy, 490 F.2d 1132, 1135 (4th Cir. 1974).

Because the government deprived Attkisson of a meaningful opportunity to identify the Doe Defendants and the district court never determined that the requisite “extreme circumstances” were present to warrant dismissal for failure to comply with a court order, I disagree with the majority opinion’s determination that the district court permissibly exercised its discretion in dismissing Attkisson’s claims against the Doe Defendants. Not only should we disapprove of the tactics the government used to run out the clock on Attkisson’s claims, but we should also reject the troubling “game plan” it provided for the government and private parties to prevent disclosure of—and, therefore, responsibility for—their potentially unconstitutional or illegal electronic surveillance activities. Accordingly, I respectfully dissent as to the dismissal of Attkisson’s claims against the Doe Defendants.

44

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 45 of 72

I. A.

Because the district court dismissed Attkisson’s action prior to meaningful discovery, the relevant allegations, which this Court must accept as true, are set forth in Attkisson’s complaint. At the time of the events giving rise to her claim, Attkisson had been working as an investigative reporter for CBS News for 20 years. In early 2011, Attkisson began reporting on the “Fast & Furious” initiative, under which the Bureau of Alcohol, Tobacco, and Firearms (“ATF”) purposely allowed firearms dealers to sell marked weapons to straw buyers, in anticipation that the weapons would later be sold to Mexican drug cartels, thereby facilitating the identification and apprehension of key figures in the cartels. CBS aired a report on the Fast & Furious program on February 22, 2011. That report quoted and relied on confidential sources procured by Attkisson. Attkisson continued to report the story, which the Department of Justice initially denied, over the next several months. According to the complaint, Attkisson’s sources within ATF told Attkisson “that the [a]gency was actively seeking to identify government insiders who were providing information or ‘leaking’ to her and CBS.” J.A. 123.

In October 2011, the government’s Fast & Furious program came under renewed scrutiny when law enforcement officers found weapons distributed through the Fast & Furious program at several crime scenes, including the scene of the murder of an ATF agent. That fall, Attkisson “began to notice anomalies in numerous electronic devices at their home in Virginia.” J.A. 124. According to the complaint, Attkisson’s home and

work computers would turn on and off at random, her house’s alarm would “chirp[] daily 45

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 46 of 72

at different times,” and her phone and television experienced problems. J.A. 124. All the affected devices were connected to the Internet via Verizon’s fiber optic service, FiOS. Verizon failed to cure the problems, despite making multiple attempts over a period of more than a year, including through installation of a new router. J.A. 124.

During 2012, Attkisson continued to experience “anomalies” with her internet- connected devices, which anomalies Attkisson repeatedly reported to Verizon, friends, and business associates. In December 2012, one of Attkisson’s “contact[s] with U.S. government intelligence experience” inspected Attkisson’s home and found an “extra” fiber optic cable “dangling” from Attkisson’s exterior Verizon box. J.A. 129. After Attkisson contacted Verizon regarding the “extra” cable, “a person represented to be a Verizon technician” visited Attkisson’s home on January 1, 2013 and removed the cable. J.A. 129. According to the complaint, notwithstanding that Attkisson told the technician to leave the cable, it disappeared. Over the next week, the Attkissons continued to experience problems with their internet service, which Verizon repeatedly, but unsuccessfully, tried to resolve.

On January 8, 2013, “an individual with special expertise in computer forensics” conducted a forensic examination of Attkisson’s laptop. J.A. 130. The expert reported that the “laptop showed clear evidence of outside and unauthorized ‘intrusion,’ that the sources of the intrusion were state-supported due to the sophisticated nature of the technology used,” and that “the software fingerprint indicated that the software was proprietary to the federal government.” J.A. 130. According to the forensic analysis

report, “[t]he intrusion included, among other surveillance, keystroke monitoring, 46

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 47 of 72

exfiltration of data, audio surveillance of [Attkisson’s] conversations and activities at home by activating Skype, mining personal passwords, monitoring work and personal email, and probable compromise of [Attkisson’s] work and personal smartphones.” J.A. 130. “The report also stated the intruders had accessed CBS network systems . . . and that the perpetrator had also place three (3) classified documents deep in the computer’s operating system.” J.A. 130. The forensic analysis determined that the intrusion began as early as June 2011 and traced the intrusion to an Internet Protocol (“IP”) “address owned, controlled, and operated by the United States Postal Service,” which “has been publicly reported, including in [Inspector General] internal audits, to have a working relationship with the FBI, Department of Homeland Security, and [the Department of Justice] for domestic surveillance projects.” J.A. 125, 134.

Several days later, Attkisson notified CBS, which hired an “independent forensic computer analyst” to inspect Attkisson’s home and internet-connected devices. J.A. 131. That forensic investigation, conducted on February 2, 2013, found that Attkisson’s work and home computers had been subjected to a “coordinated, highly-skilled series of actions and attacks directed at the operation of the computers and the storage of data thereon.” J.A. 131. Several days after that second investigation, Attkisson’s desktop computer began to malfunction, shut down, emitted a “burning odor,” and was rendered permanently inoperable. J.A. 131. The complaint further alleges that Attkisson’s BlackBerry, which was connected to the Verizon network, also was compromised.

On June 11, 2013, CBS issued a public statement, reporting that Attkisson’s

computer had been accessed using “sophisticated methods” by an unauthorized party on 47

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 48 of 72

multiple occasions. J.A. 132. The independent security firm hired by CBS to analyze Attkisson’s computer publicly confirmed that report. The government issued a statement, stating that to its “knowledge, the Justice Department has never compromised Ms. Attkisson’s computers, or otherwise sought any information from or concerning any telephone, computer or other media device she may own or use.” J.A. 131.

B.
On December 30, 2014, Attkisson brought a Bivens action under the First and

Fourth Amendments against named and unnamed federal defendants in the Superior Court for the District of Columbia. The government removed the case to the U.S. District Court of the District of Columbia. Within two months of first filing suit, Attkisson sought leave of the court “to serve limited, immediate discovery . . . to determine the true [identities] of the Doe Defendants.” J.A. 8. Attkisson argued that “good cause” existed to afford such discovery because she could not further prosecute her action until she identified the Doe Defendants.

The government opposed Attkisson’s discovery request for two reasons: (1) none of the defendants—named or unnamed—had been served and therefore the parties could not, according to the government, conduct a Rule 26 discovery conference and (2) because the case “implicate[d] qualified immunity issues, . . . the Court should resolve those issues and similar preliminary issues before any discovery occurs.” Defs.’ Opp. To Pls.’ Mot. to Expedited Disc., Attkisson v. Holder, No. 15-238 (March 3, 2015), ECF No. 11 (emphasis added). The government’s position, therefore, was tantamount to asserting

that early discovery should never be available in a Bivens case against unnamed 48

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 49 of 72

defendants. The government opposed Attkisson’s requested discovery pertaining to the identity of the Doe Defendants, even as it simultaneously denied—and continues to deny—that it represents the Doe Defendants. The district court denied without prejudice Attkisson’s request for expedited discovery on grounds that Attkisson had not yet completed service of the named defendants and that the discovery request was “overbroad” because Attkisson had not provided an “explanation of precisely what discovery [she] seeks to take.” J.A. 8.

On March 20, 2015, having completed service of the named defendants, Attkisson again moved for expedited discovery. To respond to the district court’s concern regarding the scope of the discovery she sought, Attkisson attached twenty-one interrogatories and three requests for production. The interrogatories sought “[t]he identity of any person” who had knowledge as to the various specific types of electronic incursions allegedly perpetrated between 2011 and 2013 “on computers owned or operated by Ms. Attkisson”—including “remotely altering computer VPN settings,” “smbclient,” “kcpassword,” “kickstart,” and “use of Intel AMT software.” Pls.’ Renewed Mot. for Expedited Disc. 3–5, Attkisson v. Holder, No. 15-238 (March 20, 2015), ECF No. 21-1. The interrogatories also sought the “identity and contact information of all persons” who had “access to,” “us[ed],” and were “responsible for maintaining, monitoring, securing, and otherwise controlling” the Postal Service-owned IP address the forensic analysis connected to the incursions. Id. at 5–6.

Less than a month later, the government moved to dismiss and again opposed

Attkisson’s request for expedited discovery, asserting that her discovery requests were 49

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 50 of 72

both too numerous and not “narrowly tailored” to identifying the Doe Defendants. Attkisson filed an amended complaint on April 30, 2015. On July 6, 2015, the district court denied Attkisson’s second request for expedited discovery. The next day, the government again moved to dismiss. Concurrently, Attkisson served notices of depositions and subpoenas on several third parties, including the United States Postal Service, seeking testimony and documents pertaining to the IP address identified in the forensic analysis so as to identify the Doe Defendants.

In October 2015—after Attkisson repeatedly and unsuccessfully sought the government’s voluntary compliance with her discovery requests—Attkisson moved the district court to compel compliance with those requests. The government successfully sought several extensions of time, eventually filing on December 7, 2015, a brief in opposition to the motion to compel and a motion for protective order. Conceding that Attkisson’s discovery sought “to uncover the identities of the ‘Unknown Federal Agents’ or ‘Doe defendants’”—i.e., that the discovery requests were tailored to the appropriate issue—the government argued that Attkisson could not obtain such discovery because, in part, “there [wa]s no evidence that Plaintiffs have conferred with the remaining ‘Doe’ defendants in this case for purposes of discovery,” which, according to the government, Federal Rule of Civil Procedure 26 required. Third-Party U.S. Postal Serv.’s Opp. To Pls.’ Mot. to Compel And Mot. to Quash Subpoena and/or for Protective Order 13,Attkisson v. Holder, No. 15-238 (Dec. 7, 2015), ECF No. 47. Put differently, the government took the position that Attkisson could not obtain discovery to identify the

50

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 51 of 72

Doe Defendants because she had not engaged in a Rule 26 conference with the unidentified Doe Defendants.

The parties engaged in additional briefing regarding Attkisson’s motion to compel during the first half of 2016, with the government successfully obtaining several deadline extensions. On July 28, 2016—and still without Attkisson having had an opportunity to conduct any discovery—the district court consolidated Attkisson’s Bivens action with a separate action under the Federal Tort Claims Act that Attkisson had brought against several parties, including the United States, related to the same alleged conduct. When it consolidated the two actions, the district court dismissed Attkisson’s pending discovery motions in the Bivens action as moot. Attkisson moved the district court to reconsider its dismissal of her motion to compel, which the government again opposed. Around the same time, the government filed a third motion to dismiss. On March 19, 2017, the District of Columbia district court denied, without prejudice, the government’s motion to dismiss and transferred the case to the U.S. District for the Eastern District of Virginia, again denying Attkisson’s motion to compel as moot.

On July 26, 2017—after waiting nearly four months for the court to assign a judge to her case and only eight days after that assignment4—Attkisson again sought to compel compliance with her previously served discovery requests. In early August 2017—and after obtaining several more deadline extensions—the government filed a brief in

4 Because the parties had to wait several months for the appointment of a judge, Attkisson bears no responsibility for the inaction in the case between March and July 2017 highlighted in the majority opinion. Ante at 13–14.

51

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 52 of 72

opposition to Attkisson’s renewed motion to compel and a fourth motion to dismiss, this time for failure to state a claim and for lack of jurisdiction. On September 1, 2017, a magistrate judge denied Attkisson’s motion to compel without prejudice.

The district court directed Attkisson to file a consolidated complaint, which she filed on September 18, 2017. That eight-count complaint, which names the Doe Defendants as defendants, asserted Bivens claims under the First and Fourth Amendments and violations of the Electronic Communications Privacy Act (“ECPA”), the Stored Communications Act, the Computer Fraud and Abuse Act, the Foreign Intelligence Surveillance Act, and the Virginia Computer Crimes Act, as well common law trespass to chattel and land claims. On September 22, 2017, the parties filed a joint discovery plan. Notwithstanding that the discovery plan purported to establish a January 12, 2018, deadline for completion of discovery, the government made clear in a footnote its position that “discovery—including discovery not specifically directed at the individually sued government officials—may not proceed in this action” until the district court ruled on the government’s motion to dismiss. Joint Proposed Disc. Plan, Attkisson v. Holder, No. 1:17-cv-00364 (Sept. 22, 2017), ECF No. 123 (emphasis added).

Within two weeks of the filing of the consolidated complaint, the district court issued an opinion and order dismissing most, but not all, of Attkisson’s claims. Attkisson v. Holder, No. 1:17-CV-364, 2017 WL 5013230 (E.D. Va. Nov. 1, 2017). Of particular relevance to this dissent, the district court did not dismiss Attkisson’s Bivens and ECPA claims against the Doe Defendants. Id. at *1.

52

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 53 of 72

Following the district court’s motion-to-dismiss order, Attkisson sought testimonial and documentary discovery from numerous federal agencies as well as Verizon’s Virginia subsidiary. For example, Attkisson noticed a deposition of the Postal Service pursuant to Rule 30(b)(6), requesting that the Postal Service make available for deposition “one or more persons” to testify as to the “ownership and control” of two specific IP version 4 (“IPv4”) addresses that Attkisson’s forensic analyses identified were used in the alleged intrusions. In particular, Attkisson sought testimony regarding “[w]ho was responsible for managing, tracking, and monitoring these IPv4 addresses within the Postal Service”; “[w]hat persons or organizations were permitted access to or use of the IPv4 address in the designated time frame”; “[a]ny and all records, logs, or other form of identification material that will or may assist in identifying what person or persons provided for each such use of these IPv4 addresses during the referenced time frame”; and “[a]ny and all records, logs, or other form of identification material that will or may assist in identifying the operational use of these IPv4 addresses.” J.A. 209–10.

The government consented to a limited deposition of a United States Postal Service employee regarding the IPv4 addresses identified in the forensic analysis, which deposition revealed that Verizon contracted with the Postal Service to provide network services and identified twelve other IP addresses connected to the alleged incursion. But otherwise the government and Verizon successfully moved for a protective order on overbreadth grounds. Thereafter—and in accordance with the position it took in the Joint Discovery Plan—the government sought a stay of all discovery pending resolution of its anticipated (renewed) motion to dismiss.

53

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 54 of 72

On December 1, 2017, a magistrate judge entered a revised scheduling order directing Attkisson “to substitute named parties for the Doe Defendants no later than January 5, 2018 at 10:00 a.m.” J.A. 259. In an order entered December 29, 2017, the district court extended that deadline until February 5, 2018, emphasizing that “[t]his extension is the final extension that plaintiffs will receive because the interests of judicial economy and fairness to third parties and potential future defendants dictate that plaintiffs move forward with this litigation in as timely a fashion as possible.” J.A. 274–75.

Thereafter, Attkisson reserved discovery against the federal agencies and Verizon, and moved to compel. Verizon again moved for a protective order. J.A. 276. The magistrate granted in part the motion for protective order, allowing Attkisson to conduct a 30(b)(6) deposition of Verizon employee as to the twelve Verizon-linked IP addresses identified in the Postal Service deposition. The magistrate rendered that determination because he concluded that, at that stage of the litigation, discovery should be “limited to trying to identify the Doe [D]efendants,” with liability discovery “com[ing] later.” J.A. 512. The government also continued to resist Attkisson’s discovery requests on overbreadth grounds, maintaining that it was obliged to permit discovery only of “readily available” information pertaining to the identities of the Doe Defendants. J.A. 521. At a January 12, 2018 hearing—less than a month before the district court’s deadline for Attkisson to identify the Doe Defendants—the magistrate denied without prejudice Attkisson’s motion to compel on grounds that it appeared that the parties were moving towards an agreed-on discovery plan related to identifying the Doe Defendants. J.A. 524.

54

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 55 of 72

On February 5, 2018, Attkisson filed a proposed amended complaint that continued to list John Doe federal employee and agent defendants, but also added new causes of action and several Verizon-affiliated entities, the United States of America, and the Federal Bureau of Investigation as defendants. In an order entered May 15, 2018, the district court denied Attkisson leave to amend and dismissed Attkisson’s pending action against the Doe Defendants with prejudice. The Court held that dismissal was warranted because Attkisson’s proposed complaint failed to offer substitutes for the Doe Defendants, as its December 29, 2017 order required, and, also in contravention of that order, added new defendants without seeking the court’s leave. As to the Doe Defendants, in particular, the court stated:

Since 2014 when the plaintiffs’ first complaint was filed, none of the John Doe defendants has been identified or served and plaintiffs have made no substantial progress in identifying them. As such, the time has come to end this litigation against them as well and for this reason, the claims against them are also dismissed by this Order.

J.A. 669. Attkisson timely appealed.
II.

Attkisson argues that the district court erred in dismissing her claims against the Doe Defendants. Although its order is not a model of clarity, the district court appears to have dismissed those claims for two related reasons: (A) Attkisson failed to make “substantial progress” in identifying the Doe Defendants and (B) Attkisson failed to comply with the court’s order to substitute named parties for the Doe Defendants by February 5, 2018. I do not believe that either purported failure justified the district

court’s decision to dismiss Attkisson’s claims against the Doe Defendants. 55

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 56 of 72

A.
“Ordinarily a tort victim”—like Attkisson—“who does not know who the

tortfeasor is cannot sue.” Billman v. Ind. Dep’t of Corrs., 56 F.3d 785, 789 (7th Cir. 1995). But this Court and other courts long have recognized that if a tort complaint plausibly alleges that an unnamed defendant is an “actual” person or entity, then an action may “proceed against real, but unidentified, defendants.” Schiff, 691 F.2d at 197 (citing Bivens v. Six Unknown Agents of Fed. Bureau of Narcotics, 403 U.S. 388 (1971)). In such cases, a district court should dismiss the action on grounds that the plaintiff failed to allege the defendant’s true identity only “if it does not appear that the true identity of an unnamed party can be discovered through discovery or through intervention by the court.” Id. at 198; see also Davis v. Kelly, 160 F.3d 917, 921 (2d Cir. 1998) (collecting cases); Billman, 56 F.3d at 789 (holding that a plaintiff’s “initial inability to identify the injurers is not by itself a proper ground for the dismissal of the suit”); Munz v. Parr, 758 F.2d 1254, 1257 (8th Cir. 1985) (“Dismissal is proper only when it appears that the true identity of the defendant cannot be learned through discovery or the court’s intervention.” (emphasis added)).

Courts allow plaintiffs to sue unnamed tortfeasors—and, in appropriate circumstances, engage in early discovery to identify the true identity of those alleged tortfeasors—when, as here, a plaintiff lacks the capacity to identify the names of the tortfeasors absent the power of the courts. For example, courts allow an injured party to sue an unnamed tortfeasor when circumstances outside the injured party’s control posed

obstacles to the injured party identifying the tortfeasor prior to filing suit. See, e.g., 56

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 57 of 72

Billman, 56 F.3d at 789 (holding that a prison inmate was entitled to discovery when his conditions of confinement rendered it difficult, if not impossible, for him to identify the alleged tortfeasor prior to suit). Likewise, courts allow an injured party to sue an unnamed tortfeasor when the allegedly tortious conduct, by its nature, conceals the identity of the tortfeasor. See, e.g., id. (noting that when “the plaintiff has been injured as the consequence of the actions of an unknown member of a collective body, identification of the responsible party may be impossible without pretrial discovery”); Columbia Ins. Co. v. seescandy.com, 185 F.R.D. 573, 578 (N.D. Cal. 1999) (noting that when a plaintiff is injured by a tortious act allegedly committed via the internet by a “pseudonymous[] or anonymous[]” party, the plaintiff is “likely to find [her]self chasing the tortfeasor from Internet Service Provider (ISP) to ISP, with little hope of actually discovering the identity of the tortfeasor” absent compulsory judicial discovery).

Considering this precedent, the district court abused its discretion in dismissing Attkisson’s action against the Doe Defendants without providing Attkisson with a meaningful opportunity to engage in discovery to determine their true identity. To begin, Attkisson’s operative complaint—which we must accept as true—includes sufficient non- conclusory allegations against the Doe Defendants to state a Fourth Amendment Bivensclaim and a claim under the ECPA. The complaint recites at length, and with factual specificity, the technical “anomalies” Attkisson experienced with her internet connected devices. The complaint also discusses with factual specificity the various forensic analyses of Attkisson’s devices conducted by security consultants—including a security

consultant hired by CBS—revealing that those devices had been compromised and 57

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 58 of 72

commandeered. The forensic analyses further revealed that those incursions included searching records stored on Attkisson’s devices, monitoring Attkisson’s electronic communications, and using Attkisson’s internet connected devices to listen to her conversations at home. According to the complaint, those forensic analyses concluded that the intrusions were “sophisticated”—and therefore “state-sponsored”—and derived from IPv4 addresses owned, controlled, and operated by the government, and the Postal Service, in particular.

Based on those allegations, it is “plausible” that the government—and/or a private entity operating on the government’s behalf—searched and commandeered Attkisson’s devices and infringed on her right to privacy, in violation of the Fourth Amendment. See Buonocore v. Harris, 65 F.3d 347, 356 (4th Cir. 1995) (“[T]he special protection to be afforded a person’s right to privacy within his own home has also been continuously and consistently recognized by the Court. The right to ‘sanctity of private dwellings,’ has been held to be the right ‘ordinarily afforded the most stringent Fourth Amendment protection.’”). Likewise, the complaint adequately alleges that these same government actors “intercepted” Attkisson’s electronic communications in violation of the ECPA. 18 U.S.C. § 2520.

Second, the allegations in the complaint render it plausible that “actual” persons—i.e., the Doe Defendants—violated Attkisson’s constitutional and statutory rights. Schiff, 691 F.2d at 197. Put simply, the “sophisticated” nature of the intrusions; the broad variety of alleged surveillance, including “keystroke monitoring, exfiltration of data,

audio surveillance of [Attkisson’s] conversations and activities at home by activating 58

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 59 of 72

Skype, mining personal passwords, monitoring work and personal email, and probable compromise of [Attkisson’s] work and personal smartphones,” J.A. 130; the years-long duration of the anomalies and incursions, despite repeated efforts to resolve them; and the efforts to hide evidence of the incursions provide factual support for the allegations that “actual” persons perpetrated the alleged constitutional and statutory violations.

Additionally, in criminal proceedings, the government routinely argues—and courts often agree—that when a specific IP address is used to perpetrate alleged wrongdoing online there is a “fair probability”—i.e., probable cause—that the individual or entity that owns or controls the IP address engaged in, or possesses evidence of, the wrongdoing. See, e.g., United States v. Vosburgh, 602 F.3d 512, 526 & n.13 (3d Cir. 2010) (noting that “several Courts of Appeals have held that evidence that the user of a computer employing a particular IP address possessed or transmitted child pornography can support a search warrant for the physical premises linked to that IP address”); United States v. Perrine, 518 F.3d 1196, 1201–04 (10th Cir. 2008). Attkisson’s complaint identified two specific IPv4 addresses owned and controlled by the government that were used to perpetrate the alleged unlawful surveillance. Accordingly, the complaint established that it is plausible that the individuals employed by, or acting on behalf of, the government who used and maintained those IPv4 addresses perpetrated the allegedly unlawful surveillance or have information that will facilitate identification of the individuals responsible for perpetrating the wrongdoing.

Third, there was no basis for the district court to determine that “the true identity

of [the Doe Defendants could not] be discovered through discovery or through 59

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 60 of 72

intervention by the court.” Schiff, 691 F.2d at 198. Indeed, the government itself routinely uses IP addresses to identify unknown wrongdoers. For example, the government uses IP addresses as the starting point to identify unknown individuals who possess or share child pornography. See, e.g., Vosburgh, 602 F.3d at 526 & n.13 (collecting cases); United States v. Bynum, 604 F.3d 161, 162–63 (4th Cir. 2010). Likewise, private parties such as copyright holders frequently use IP addresses to identify unknown defendants who allegedly engage in online copyright infringement. See, e.g.,Purzel Video GmbH v. St. Pierre, 10 F. Supp. 3d 1158, 1164 (D. Colo. 2014); Malibu Media, LLC v. Roldan, No. 8:13-cv-3007, 2014 WL 3805494, at *1 (M.D. Fla. Aug. 1, 2014); Loud Records LLC v. Minervini, 621 F. Supp. 2d 672, 676 (W.D. Wisc. 2009). Given that the government as well as private parties successfully use IP addresses to identify wrongdoers in other contexts, there is no reason to believe that pre-trial discovery would not allow Attkisson to use the IPv4 addresses to identify the true identity of the Doe Defendants.

To be sure, the government is a “collective body,” rather than a single user, which may somewhat complicate the process for identifying which, if any, government employees perpetrated the allegedly unlawful surveillance of Attkisson’s devices.Billman, 56 F.3d at 789. But the difficulty a plaintiff faces in identifying pre-filing a particular wrongdoer that works for a multi-member organization, like the government, is one of the reasons courts allow a plaintiff to sue unnamed wrongdoers and to use pre-trial discovery to identify the wrongdoers’ identities. Id.; see also Palmer v. Bd. of Educ. of

Cmty. Unit Sch. Dist. 201-U, Will Cnty., Ill., 46 F.2d 682, 688 (7th Cir. 1995) (holding 60

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 61 of 72

that the district court erred in dismissing plausible claim against unnamed governmental employees because “[w]hen a collective body . . . takes a complex series of actions over a span of years, it may be difficult to pin down individual responsibility without discovery”). That is particularly true when, as here, members of a collective body allegedly perpetrate a wrong using the Internet, which allows wrongdoers to “act pseudonymously and anonymously,” and thereby evade legal liability absent an injured party’s use of discovery to determine the wrongdoers’ identity. Columbia Ins., 185 F.R.D. at 578.

Finally, the district court failed to afford Attkisson a meaningful opportunity to engage in discovery to determine the true identity of the Doe Defendants. Notwithstanding that Attkisson repeatedly served discovery on the government and repeatedly moved the district court to compel the government to comply with the discovery requests, the sum of the discovery Attkisson obtained from the government during the four years her case was pending was a limited deposition of a single Postal Service employee. The government never turned over any documents in response to Attkisson’s subpoenas, nor did it answer any interrogatories. In such circumstances, Attkisson should not be faulted for failing to identify the Doe Defendants.

The district court refused to compel the government to comply with Attkisson’s discovery requests because it believed that some of the requests were unrelated to the identification of the Doe Defendants. But most of Attkisson’s requests sought information directly related to the identities of the Doe Defendants, including “[w]ho was

responsible for managing, tracking, and monitoring these IPv4 addresses within the 61

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 62 of 72

Postal Service”; “[w]hat persons or organizations were permitted access to or use of the IPv4 address in the designated time frame”; “[a]ny and all records, logs, or other form of identification material that will or may assist in identifying what person or persons provided for each such use of these IPv4 addresses during the referenced time frame”; and “[a]ny and all records, logs, or other form of identification material that will or may assist in identifying the operational use of these IPv4 addresses.” J.A. 209–10. And Attkisson’s request for “[t]he identity of any person” who had knowledge regarding the various specific types of electronic incursions allegedly perpetrated against Attkisson’s devices—including “remotely altering computer VPN settings,” “smbclient,” “kcpassword,” “kickstart,” and “use of Intel AMT software”—also specifically related to the identity of the Doe Defendants. Pls.’ Renewed Mot. for Expedited Disc., Attkisson v. Holder, No. 15-238 (March 20, 2015), ECF No. 21-1. To the extent the district court believed any of Attkisson’s other requests swept too broadly, it could have granted Attkisson’s motion to compel only as to those requests bearing on the identity of the Doe Defendants.

The district court also denied Attkisson’s final motion to compel because it believed that the parties were working towards a consensual discovery plan. I do not question the district court’s judgment that a consensual discovery plan is preferable to court-ordered discovery. But at the time it denied Attkisson’s final motion to compel, the court’s deadline for Attkisson to substitute names for the Doe Defendants was less than a month away. Given the government’s longstanding opposition to affording Attkisson anydiscovery—including its initial Kafkaesque position that Attkisson was not entitled to 62

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 63 of 72

obtain discovery regarding the identity of the Doe Defendants until Attkisson conducted a Rule 26(d) discovery conference with the unidentified Doe Defendants and the government’s later, equally unsupported position, which the magistrate judge rightly rejected, that Attkisson was entitled to discover only whatever information the government deemed “readily available”—and the court’s fast approaching substitution deadline, it was incumbent on the district court to ensure that the government did not use its ongoing discovery negotiations with Attkisson to run out the clock on her claims. Put simply, the district court needed to either (1) toll its deadline until Attkisson and the government reached an agreement as to a discovery plan that would allow Attkisson to meaningfully pursue the identity of the Doe Defendants or (2) compel the government to comply with Attkisson’s reasonable discovery requests in advance of the deadline. It did neither; instead, it enforced its deadline even though Attkisson never obtained meaningful discovery, effectively rewarding the government for its intransigence.

In sum, the district court reversibly erred when it dismissed Attkisson’s action against the Doe Defendants for failing to identify their names. That conclusion accords with the approach taken by our sister circuits, which have held that a district court abused its discretion when—as here—it dismissed a plausible claim against an unnamed defendant without allowing the plaintiff a meaningful opportunity to engage in discovery to determine the defendant’s identity. See, e.g., Vohra v. Cnty. of Orange, 288 Fed. App’x 395, 396 (9th Cir. 2008); Green v. Doe, 260 Fed. App’x 717, 719 (5th Cir. 2007);Valentin v. Dinkins, 121 F.3d 72, 75–76 (2d Cir. 1997); Billman, 56 F.3d at 787–89.

63

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 64 of 72

And there is more. The district court compounded its error in dismissing Attkisson’s action against the Doe Defendants by failing to grant, at least in part, Attkisson’s repeated motions to compel. In the context of allegedly tortious acts committed over the Internet, in particular—like the Doe Defendants’ alleged unlawful surveillance of Attkisson—courts have adopted several multi-factorial tests to guide a district court’s analysis in determining whether to allow the plaintiff early or expedited discovery to facilitate identification of an unnamed defendant.

For example, the Second Circuit has directed district courts to weigh “(1) the concreteness of the plaintiff’s showing of a prima facie claim of actionable harm, (2) the specificity of the discovery request, (3) the absence of alternative means to obtain the subpoenaed information, (4) the need for the subpoenaed information to advance the claim, and (5) the objecting party’s expectation of privacy.” See Arista Records, LLC v. Doe 3, 604 F.3d 110, 119 (2d Cir. 2010) (internal alterations omitted) (citing Sony Music Entm’t Inc. v. Does 1–40, 326 F. Supp. 2d 556, 564–65 (S.D.N.Y. 2004)). Other courts apply similar tests. See, e.g., Columbia Ins., 185 F.R.D. at 578–80 (holding that a plaintiff is entitled to early discovery targeted at identifying an unnamed defendant if the plaintiff (1) “identif[ies] the missing party with sufficient specificity such that the Court can determine that defendant is a real person or entity who could be sued in federal court; (2) “identif[ies] all previous steps taken to locate the elusive defendant”; (3) “establish[es] to the Court’s satisfaction that plaintiff’s suit against defendant could withstand a motion to dismiss”; and (4) “file[s] a request for discovery with the Court,

along with a statement of reasons justifying the specific discovery requested as well as 64

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 65 of 72

identification of a limited number of persons on whom discovery process might be served and for which there is a reasonable likelihood that the discovery process will lead to identifying information about the defendant that would make service of process possible.”).

Here, the considerations other courts have deemed relevant supported awarding Attkisson early discovery targeted at identifying the Doe Defendants. As explained above, Attkisson plausibly alleged that unnamed defendants violated her constitutional and statutory rights and that those defendants were “actual” individuals capable of identification through discovery. The complaint also set forth several steps Attkisson had taken to identify the perpetrators of the alleged violations, including obtaining multiple forensic analyses of her devices, filing a complaint with the Department of Justice Inspector General, allowing the government to inspect her laptop computer, and submitting Freedom of Information Act requests. And even if a few requests were somewhat overbroad, Attkisson served numerous discovery requests directly bearing on the identity of the Doe Defendants. Finally, because information potentially relevant to the identity of the Doe Defendants lies exclusively in the hands of the government—and because her other efforts to identify the Doe Defendants had proven unsuccessful— Attkisson established that she lacked alternative means to identify the Doe Defendants.

B.
The district court also dismissed Attkisson’s action against the Doe Defendants for failure to comply with the court’s December 29, 2017, order that Attkisson substitute names for the Doe Defendants on or before February 5, 2018. Federal Rule of Civil 65

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 66 of 72

Procedure 41(b) permits a district court to involuntarily dismiss an action if a plaintiff fails to comply with a court order. We review for abuse of discretion a district court’s dismissal of an action for failure to comply with a court order. See Ballard v. Carlson, 882 F.2d 93, 96 (4th Cir. 1989).

This Court, like our sister circuits, has recognized that dismissal under Rule 41(b) is a “drastic” penalty, Hillig, 916 F.2d at 174, that should be limited to “extreme circumstances,” Reizakis, 490 F.2d at 1135; see also, e.g., Dahl v. City of Huntington Beach, 84 F.3d 363, 366 (9th Cir. 1996) (holding that dismissal under Rule 41(b) “is so harsh a penalty it should be imposed as a sanction only in extreme circumstances”);Jackson v. City of New York, 22 F.3d 71, 75 (2d Cir. 1994) (“Although dismissal pursuant to Rule 41(b) is a matter committed to the discretion of a district court . . . dismissal is a harsh remedy to be utilized only in extreme situations.” (internal quotation marks omitted)); Flaksa v. Little River Marine Const. Co., 389 F.2d 885, 888 (5th Cir. 1968) (dismissal under Rule 41(b) warranted only in “extreme circumstances”).

In deciding whether to dismiss a case under Rule 41(b), “[a]gainst the power to prevent delays must be weighed the sound public policy of deciding cases on the merits.”Hillig, 916 F.2d at 173–74. In making that determination, “[t]his Circuit requires that the trial court consider four factors before dismissing a case for failure to prosecute: (1) the plaintiff’s degree of personal responsibility; (2) the amount of prejudice caused the defendant; (3) the presence of a drawn out history of deliberately proceeding in a dilatory

66

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 67 of 72

fashion; and (4) the effectiveness of sanctions less drastic than dismissal.” Id. at 174 (emphasis added).5

Considering this precedent, the district court abused its discretion in dismissing Attkisson’s claims against the Doe Defendants based on Attkisson’s failure to comply with the court’s order. The district court never expressly considered this Court’s mandatory four-factor test for dismissing an action for failure to comply with a court order. That legal error, by itself, amounts to an abuse of discretion. See Verisign, Inc. v. XYZ.COM LLC, 891 F.3d 481, 484–86 (4th Cir. 2018) (holding that district court abuses its discretion when it applies the wrong legal test); United States v. Cargill, 134 F.3d 364 (4th Cir. 1998) (table) (same); see also Koon v. United States, 518 U.S. 81, 100 (1996) (“A district court by definition abuses its discretion when it makes an error of law.”).

And although the district court adverted, in a conclusory fashion, to some aspects of those four considerations—referencing “prejudic[e]” to defendants and “judicial economy,” J.A. 668—it never considered, much less ruled out, “less drastic” sanctions, as this Court requires. Notably, this Court and other courts have held that a district court abused its discretion in dismissing an action under Rule 41(b) when it failed to consider

5 The majority opinion states that the factors identified in Hillig should “guide” the district court’s analysis in determining whether to dismiss a case under Rule 41(b), and therefore that the district court did not reversibly err in failing to consider those factors.Ante at 34. The majority opinion nowhere reconciles its reasoning with Hillig’s controlling holding that district courts are “required” to consider those four factors. 916 F.2d at 174. The majority opinion also nowhere reconciles its conclusion with the unanimous conclusion of the Courts of Appeal that dismissals under Rule 41(b) should be limited to “extreme circumstances.”

67

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 68 of 72

lesser sanctions. See Reizakis, 490 F.2d at 1135; In re Se. Banking Corp., 204 F.3d 1322, 1335 (11th Cir. 2000).

Additionally, had the district court considered the mandatory factors set forth inHillig, it should have rendered a different judgment. First, there is no evidence that Attkisson had any degree of personal responsibility in her attorney’s purported failure to comply with the court’s order. Second, although the passage of time may somewhat prejudice the Doe Defendants, Attkisson correctly notes that any such prejudice is attributable to the government’s repeated efforts to delay and resist any discovery. Appellant’s Br. at 48. Third, the record belies any finding that Attkisson engaged in “a drawn-out history of deliberately proceeding in a dilatory fashion.” Hillig, 916 F.2d at 74. On the contrary, since the filing of the original complaint, Attkisson has repeatedly sought to engage in discovery to identify the Doe Defendants and faced largely successful resistance from the government and third-parties at every turn. Finally, any number of less drastic remedies, such as denying further leave to amend the complaint to add new defendants or causes of action, were available.6

6 I agree with the majority opinion that the district court did not abuse its discretion in denying Attkisson leave to amend her complaint to rename the United States as a defendant, add several Verizon-affiliated entities as defendants, and resurrect several previously dismissed claims. Ante at 34–36. The court’s order did not authorize Attkisson to make such amendments, and Attkisson never sought the court’s leave to do so. But the majority opinion improperly conflates the district court’s (correct) disposition of Attkisson’s proposed amended complaint with the district court’s (incorrect) dismissal of Attkisson’s claims against the Doe Defendants, who had been listed as defendants since the case’s inception. Whether Attkisson’s proposed amended complaint was proper had no bearing on whether Attkisson’s long-standing claims against the Doe Defendants, as set forth in her operative complaint, warranted dismissal.

68

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 69 of 72

Additionally, the district court’s Rule 41(b) dismissal runs contrary to this Court’s stated preference to resolve cases on the merits. Put simply, this case did not present the “extreme circumstances” warranting dismissal under Rule 41(b). Accordingly, I disagree with the majority opinion’s conclusion that the district court did not reversibly err in dismissing Attkisson’s claim against the Doe Defendants.7

III.
The most troubling aspect of the district court’s decision to dismiss Attkisson’s

claims against the Doe Defendants is that it rewards the government’s concerted effort to deprive Attkisson any opportunity to pursue her claims and, by doing so, creates a game plan for the government and private parties to follow in future cases in which plaintiffs seek to challenge governmental or private electronic surveillance activities.

At the outset of cases challenging alleged electronic surveillance, the defendants nearly always have exclusive control over virtually all information necessary to identify the individuals responsible for engaging in allegedly unconstitutional or unlawful electronic surveillance. In cases involving governmental surveillance programs, for example, the individuals and entities responsible for the challenged surveillance programs generally will be protected by statutes and regulations preventing the disclosure

7 The majority opinion further concludes that the district court “implicitly relied” on Federal Rule of Civil Procedure 4(m) in dismissing Attkisson’s claims against the Doe Defendants because Attkisson failed to establish “good cause” for her failure to timely serve the Doe Defendants. Ante at 38 n.13. But the district court’s terse footnote dismissing the Doe Defendants nowhere mentions Rule 4(m). And Attkisson did have “good cause” for failing to serve the Doe Defendants—she never obtained the discovery from the government necessary for her to identify the Defendants.

69

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 70 of 72

of classified documents and programs as well as judicial orders sealing records related to warrants issued in criminal and national security investigations. The nature of the Internet, which allows wrongdoers to conceal their identity in a variety of ways, poses further obstacles to identifying individuals responsible for electronic surveillance without the benefit of pre-trial discovery.

This profound information asymmetry sets electronic surveillance cases apart from earlier cases involving tort claims against unnamed defendants. Whereas the plaintiff inBivens, for example, could point to a specific number of officers employed by a specific agency who were in a specific place at a specific time, a plaintiff challenging electronic surveillance faces fatally greater obstacles to narrowing the universe of wrongdoers absent court-supervised discovery.

If a district court creates a deadline for identifying unnamed defendants accused of unlawful electronic surveillance and that deadline is not tethered to whether the defendant affords the plaintiff a meaningful opportunity to discover the identity of the wrongdoers—as was the case here—the defendant has a strong incentive to resist all discovery of information bearing on the identity of wrongdoer. Put simply, when the defendant is not compelled to provide discovery, the plaintiff will be unable to meet the court’s deadline to substitute names for the unnamed defendants and the case will be dismissed, just as occurred here.

But “the children’s game of pin the tail on the donkey is [not] a proper model for

constitutional tort law,” nor is the time-limited game of pin-the-tail-on-the-donkey that

the district court imposed here. Billman, 56 F.3d at 789. That is particularly true in cases 70

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 71 of 72

involving electronic surveillance in which the complexity of modern telecommunications systems—coupled with the numerous avenues such systems afford users to conceal their identities—may require more extensive discovery to identify an unnamed defendant. In such instances, artificial time constraints on identifying an unnamed defendant are all the more inappropriate.

In recent years, newspapers have been rife with reports of actual or alleged undisclosed electronic surveillance by the government and private entities. See, e.g., Carole Cadwalladr & Emma Graham-Harrison, Facebook Accused of Conducting Mass Surveillance Through Its Apps, Guardian (May 24, 2018), https://www.theguardian.com/technology/2018/may/24/facebook-accused-of-conducting- mass-surveillance-through-its-apps; Charlie Savage, N.S.A. Halts Collection of Americans’ Emails About Foreign Targets, N.Y. Times, Apr. 29, 2017, at A1. Such surveillance has the potential to reveal to the government and private entities broad swaths of highly sensitive personal and commercial information. This case is illustrative—according to the complaint, the incursion not only entailed the searching of Attkisson’s computers and the monitoring of her electronic communications, but also involved using her devices to eavesdrop on her oral conversations and interactions with her family in her home. As the government’s and private entities’ capacity to hoover up data increases—and as we move beyond accessing the Internet through a limited universe of devices to the Internet of things—the potential intrusion on privacy only increases.

Under the government’s playbook—which the district court effectively

endorsed—plaintiffs would be deprived all opportunity to challenge the legality of most, 71

USCA4 Appeal: 18-1677 Doc: 50 Filed: 03/21/2019 Pg: 72 of 72

if not all, these electronic surveillance efforts, notwithstanding the significant intrusion on individual rights posed by such surveillance. To be sure, it can be difficult to apply analog law in the digital age, and courts must tread carefully in so doing. But courts must not avoid the difficult legal issues raised by new technology by erecting procedural barriers that ensure they never will be addressed. The district court’s disposition of Attkisson’s claims against the Doe Defendants, which the majority opinion affirms, does precisely that.

Accordingly, I respectfully dissent.

72