Ligatt Security sues and others for discussing data leak

Earlier this week, we reported on Ligatt Security blasting CBS Atlanta over a report that painted the company and their CEO in a bad light. Today, The Tech Herald has learned that Ligatt recently filed a lawsuit against eight John Does, after they reported on leaked information found on the Web.

One of the John Does in the case is, a site that has reported on the Ligatt saga since the beginning.

On February 3, The Tech Herald reported the story that Ligatt Security had suffered a data breach. Due to this breach, more than 80,000 company emails were released to the public. [This article has been removed under court order.]

The most recent complaint from Ligatt, as well as the Temporary Restraining Order (TRO) related to it, was filed on the same day the scorned security firm sent a letter to CBS Atlanta blasting them for a story on their company and CEO, Gregory Evans. The complaint is under seal and lists eight John Does, so The Tech Herald was unable to recover it fully from PACER, but based on other documents related to the case, it looks as if it centers on the data breach incident.

[Non-PACER copies of the documents are here]

There are two publically confirmed reports of websites receiving notices from Ligatt’s lawyer about the lawsuit. One is, and the other is Ligatt Leaks. has maintained a list of Ligatt related information on their domain since 2001. Most of the information is commentary, backed by supporting facts or documentation, including links to court records and news items. Ligatt Leaks has covered the Ligatt data breach, and when able, offered comments and links related to information found on public websites.

On Thursday, Ligatt Leaks and Attrition received a notice from Ligatt’s current legal representation, Townsend, Lockett & Milfort LLC, that a hearing was set for Monday, February 28. The notice said that are each believed to be one of the eight John Does involved in the case.

The TRO and the hearing notification was sent to Attrition “...concerning the unauthorized use, access, display and misappropriation of LIGATT's confidential, proprietary, private and trade secret information and related matters.”

In short, it seems as if the TRO wants to prevent both sites from publically talking about Ligatt.

The Tech Herald has reached out to the attorney of record for Ligatt’s case. Among other things, we asked for better clarification of the legal move, as well as an explanation of the timing in the notice delivery.

It looks as if Ligatt Leaks is at the heart of the matter, as they are the ones commenting on the majority of the information taken during Ligatt's data breach and delivered to the Web. At the same time, Ligatt Leaks contains mostly outsourced content, as their posts link to information found on public domains or they quote it directly.

The notices delivered to Attrition and Ligatt Leaks do not mention names, instead they are delivered to domain contacts listed in their respective WHOIS reports. In response to their notice, Attrition questioned the method of notification, as well as the wording used by the notice itself.

“…it is clear that you have a good idea of who you intended this to reach. As such, your filing of Evans et al v. John Does 1-8 in the Georgia Northern District Court (Case# 1:2011cv00458) does not seem to be a good faith effort. You can clearly provide some form of identifying information about at least one of the eight John Doe defendants.”

In addition to issues with naming those who are to be served with the notice, opting instead with a blanket notification, Townsend, Lockett & Milfort LLC were questioned by Attrition about their motives to take legal action.

“To date, neither Mr. Evans, nor any of his current or previous attorneys… have contacted asking for material to be removed. This is a clear lack of good faith effort on the part of Mr. Evans to amicably resolve the matter without involving a court. Even in this [e-mail], you do not clearly identify the material that you believe is being used in an unauthorized manner.”

For their part, Ligatt Leaks responded in Russian that “your legal system is not applicable in Russia,” and that the TRO and other legal requests would be ignored until they are produced in Russia, under Russian law.

The timeline related to Ligatt’s court motions in the Northern District of Georgia raise some questions.

While filed on February 15, notices were not delivered until nine days later on February 24. Considering the hearing is set for February 28, this allows only four days to arrange, vet, and secure legal representation for those involved in the matter. Assuming those behind Attrition and Ligatt Leaks are not in Georgia, this can complicate things.

The Tech Herald spoke to a legal expert, and he said the timing issue seems to be an attempt to play hard ball. There are possible grounds for extensions and objections, given that the defendants have little time to respond and obtain reliable representation. However, they would need to file those objections in writing or have their attorneys raise the issue with the court. 

Other issues center on the motion of discovery filed by Ligatt’s lawyers.

In the Motion to Expedite Discovery and Request to Preserve Evidence, Ligatt’s legal team explains that the purpose of the motion is to “accurately identify all of the John Doe Defendants in this action, and to obtain information necessary to prevent further unlawful acts by Defendants.”

“As such, Plaintiffs respectfully seek leave to conduct discovery on an expedited basis due to the nature of the claims and the time-sensitive issues presented in this case. Specifically, Plaintiffs ask for an order that: (a) requires the Defendants to respond to written discovery requests within ten (10) days of service thereof, and (b) requires the Defendants or their corporate representatives to make themselves for deposition at a mutually convenient time within five (5) days after they have served responses to Plaintiffs first sets of written discovery.”

When we spoke to our legal consultant, he explained that the discovery process can be a long one, as it takes time to collect the data needed in some cases. In this case, because the data is online, it is hard to put the “cat back in the bag” and it is available to anyone looking for it.

The court is likely to order that the majority of the documents required in the discovery process be collected by the Plaintiff, as most of the information in this case is already in the public domain.

Ligatt Leaks and Attrition comment on, and when needed they will link to, documents posted publically on third-party sites. While following the Ligatt saga, The Tech Herald has come to understand that neither site controls, nor releases additional information themselves.

This, our legal expert says, means that Ligatt’s lawyers would need to do the same digging we do for our reporting. Using a recent case of his as an example, our expert explained that a court will often deny a Plaintiffs request to make the Defendant do their work for them.

That leaves the second part of the discovery process. Ligatt wants to learn the names and personal information of the John Does in order to seek further action. Such fishing trips have been used before by Ligatt, and they were dismissed by the court.

Another interesting aspect to the notice sent by Ligatt is that Attrition would be protected as journalists under Bartnicki v. Hopper (99-1687). Attrition mentioned this to Ligatt’s attorney, and after researching the facts in the case, The Tech Herald can see why they would be protected by the ruling on that case.

“As a group of journalists, has republished two e-mails that were already published as a result of the leak, and linked to / referenced dozens more that were published on external sites (i.e., not on In keeping with the Supreme Court, we feel that their conclusion adequately reflects that we have not broken any law or committed any civil offense…,” Attrition noted.

As mentioned, we’ve reached out to Ligatt’s lawyers for comment. We’ll update this story as the lawsuit moves forward. At this point, it doesn't seem like the case will go anywhere.

Like this article? Please share on Facebook and give The Tech Herald a Like too!