Opinion

1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 11 STRIKE 3 HOLDINGS, LLC, Case No.: 3:26-cv-01120-LL-VET 12 Plaintiff, ORDER GRANTING EX PARTE 13 v. APPLICATION FOR LEAVE TO SERVE A THIRD-PARTY 14 JOHN DOE subscriber assigned IP SUBPOENA PRIOR TO A RULE address 104.177.118.15, 15 26(f) CONFERENCE Defendant. 16 [ECF No. 4] 17 18 19 Before the Court is Plaintiff Strike 3 Holdings, LLC’s (“Plaintiff”) Ex Parte 20 Application for Leave to Serve a Third-Party Subpoena Prior to a Rule 26(f) Conference 21 (“Application”). ECF No. 4. No defendant has been named or served. For the reasons 22 discussed below, the Court GRANTS Plaintiff’s Application. 23 I. BACKGROUND 24 On February 20, 2026, Plaintiff filed a Complaint against Defendant “John Doe,” an 25 alleged subscriber of AT&T Inc. and assigned Internet Protocol (“IP”) address 26 104.177.118.15. ECF No. 1 at ¶ 5. Plaintiff is the owner of numerous adult motion pictures, 27 which Plaintiff distributes through adult websites and DVDs. Id. at ¶¶ 2–3. Plaintiff asserts 28 that Defendant is committing “rampant and wholesale copyright infringement” by 1 downloading and distributing copies of Plaintiff’s copyrighted motion pictures without 2 authorization, using the BitTorrent file distribution network. Id. at ¶¶ 4, 18–29. 3 In the Application, Plaintiff seeks leave to conduct early discovery prior to the 4 mandated Rule 26(f) conference to learn the Doe defendant’s identity. ECF No. 4-1. 5 Specifically, Plaintiff seeks leave to serve a Rule 45 third-party subpoena on AT&T Inc., 6 the Internet Service Provider (“ISP”) who leased the IP address belonging to Defendant 7 John Doe. Id. at 7–8.1 The proposed subpoena would require AT&T Inc. to supply only 8 “the true name and address of Defendant.” Id. at 8. Additionally, Plaintiff represents to the 9 Court that it will only use this information to prosecute the claims in its Complaint. Id. 10 II. LEGAL STANDARD 11 A party is generally not permitted to obtain discovery without a court order before 12 the parties have conferred pursuant to Rule 26(f). Fed. R. Civ. P. 26(d)(1). “However, 13 situations arise, such as the present, where the identity of alleged defendants will not be 14 known prior to the filing of a complaint.” Gillespie v. Civiletti, 629 F.2d 637, 642 (9th Cir. 15 1980). In those circumstances, the Ninth Circuit recognizes that “the plaintiff should be 16 given an opportunity through discovery to identify the unknown defendants, unless it is 17 clear that discovery would not uncover the identities, or that the complaint would be 18 dismissed on other grounds.” Id.; see also Wakefield v. Thompson, 177 F.3d 1160, 1163 19 (9th Cir. 1999) (same). For this reason, courts allow limited discovery after a complaint is 20 filed to permit a plaintiff to learn the identifying information necessary to serve a 21 defendant. See, e.g., Columbia Ins. Co. v. Seescandy.com, 185 F.R.D. 573, 577 (N.D. Cal. 22 1999); UMG Recordings, Inc. v. Doe, No. C-08-3999-RMW, 2008 WL 4104207, at *2 23 (N.D. Cal. Aug. 29, 2008) (noting, in an infringement case, that “a plaintiff cannot have a 24 discovery planning conference with an anonymous defendant[,]” thus, limited expedited 25 26 27 1 Page numbers for docketed materials cited in this Order refer to those imprinted by the Court’s electronic case filing system or the PDF pagination, not the document’s internal 28 1 discovery would “permit the [plaintiff] to identify John Doe and serve the defendant, 2 permitting this case to go forward”). Further, courts “permit expedited discovery before 3 the Rule 26(f) conference upon a showing of good cause.” Am. LegalNet, Inc. v. Davis, 4 673 F. Supp. 2d 1063, 1066 (C.D. Cal. 2009). “Good cause exists where the need for 5 expedited discovery, in consideration of the administration of justice, outweighs the 6 prejudice to the responding party.” Id. (internal quotations omitted). 7 When considering a request for expedited discovery to uncover the identity of a 8 defendant, the Court applies the following “limiting principles:” (1) “the plaintiff should 9 identify the missing party with sufficient specificity such that the Court can determine that 10 defendant is a real person or entity who could be sued in federal court;” (2) the plaintiff 11 “should identify all previous steps taken to locate the elusive defendant,” confirming that 12 plaintiff made a good faith effort to identify and serve the defendant; and (3) the “plaintiff 13 should establish to the Court’s satisfaction that plaintiff’s suit against defendant could 14 withstand a motion to dismiss.” Columbia Ins., 185 F.R.D. at 578–80. These factors ensure 15 this unusual discovery procedure is employed only “in cases where the plaintiff has in good 16 faith exhausted traditional avenues for identifying a civil defendant pre-service” and 17 “prevent use of this method to harass or intimidate.” Id. 18 III. DISCUSSION 19 Plaintiff contends there is good cause for this Court to allow expedited discovery. 20 ECF No. 4-1 at 11–17. For the reasons stated below, the Court agrees. 21 A. Identification of Doe Defendant with Sufficient Specificity 22 Courts in this circuit agree that “a plaintiff identifies Doe defendants with sufficient 23 specificity by providing the unique IP addresses assigned to an individual defendant on the 24 day of the allegedly infringing conduct, and by using ‘geolocation technology’ to trace the 25 IP addresses to a physical point of origin.” See 808 Holdings, LLC v. Collective of 26 December 29, 2011 Sharing Hash, No. 12-cv-186-MMA (RBB), 2012 WL 12884688, at 27 *4 (S.D. Cal. May 4, 2012); OpenMind Solutions, Inc. v. Does 1-39, No. C-11-3311-MEJ, 28 2011 WL 4715200, at *2 (N.D. Cal. Oct. 7, 2011) (concluding that plaintiff satisfied the 1 first factor by identifying the defendants’ IP addresses and by tracing the IP addresses to a 2 point of origin within the State of California); Pink Lotus Entm’t, LLC v. Does 1–46, No. 3 C-11-02263, 2011 WL 2470986, at *3 (N.D. Cal. June 21, 2011) (same). Other courts 4 conclude that merely identifying the IP addresses on the day of the alleged infringement 5 satisfies this factor. 808 Holdings, 2012 WL 12884688, at *4 (collecting cases). 6 Here, Plaintiff identified the Doe defendant with sufficient specificity. First, Plaintiff 7 provides a Declaration by Jorge Arco, an independent contractor hired by Plaintiff as an 8 “Enterprise Architect.” ECF No. 4-2, Ex. A (“Ex. A”) at ¶ 12. Mr. Arco “was part of a team 9 that developed the infringement detection system VXN Scan” (“VXN Scan”), which 10 Plaintiff “owns and uses to identify the IP addresses used” to infringe Plaintiff’s movies 11 via the BitTorrent protocol. Ex. A at ¶ 41. Mr. Arco currently participates in “the 12 maintenance and evolution of VXN and Cross Reference Tool components.” Id. Mr. Arco 13 explains VXN Scan in detail, which involves, in part, the development of a proprietary 14 BitTorrent client that emulates the behavior of a standard BitTorrent client by repeatedly 15 downloading data pieces from peers within the BitTorrent network that are distributing 16 Plaintiff’s movies. Id. at ¶¶ 53–56. 17 Per Mr. Arco, a separate component of VXN Scan is the PCAP2 Recorder / Capture 18 Card, which allows Plaintiff to “record numerous infringing BitTorrent computer 19 transactions in the form of PCAPs.” Id. at ¶¶ 61–63; see also Declaration of Patrick Paige, 20 ECF No. 4-2, Ex. B (“Ex. B”) at ¶ 14 (explaining that “PCAP is a computer file containing 21 captured or recorded data transmitted between network devices;” “it is a recording of 22 network traffic”). The PCAPs show “particular IP addresses connecting to the Proprietary 23 Client and sending pieces of a computer file (which contains an infringing copy of 24 Plaintiff’s works) to the Proprietary Client.” Ex. A at ¶ 63; see Ex. B at ¶ 15. Not only does 25 a PCAP contain the IP addresses used in the network transaction, it also records the port 26 27 2 PCAP stands for “Packet Capture,” a computer file containing captured or recorded data 28 1 number and BitTorrent client used to accomplish each transaction, and the “Info Hash 2 value that was used to obtain the transacted piece,” which in turn, “identifies the data that 3 was shared in the recorded transaction.” Ex. A at ¶¶ 65–66. The PCAP Capture Card 4 records perfect copies of every network packet received by the Proprietary Client. Id. at ¶ 5 69. Although this Order touches only on two of the components of VXN Scan, Mr. Arco’s 6 92-paragraph Declaration sets forth additional in-depth details of all six components of the 7 system and the Cross Reference Tool, providing a thorough explanation of how the system 8 reliably pinpoints the IP addresses used by individuals infringing Plaintiff’s movies and 9 verifies the infringement. 10 Second, Plaintiff also provides a declaration by Patrick Paige, a computer forensics 11 expert retained by Plaintiff to analyze and retain forensic evidence captured by VXN Scan. 12 Ex. B at ¶¶ 3, 12. Mr. Paige “received a PCAP from Strike 3 containing information relating 13 to a transaction initiated on 02/01/2026 00:24:03 UTC involving IP address 14 104.177.118.15.” Id. at ¶ 16. Based on his review, Mr. Paige confirms that the “PCAP is 15 evidence of a recorded transaction with IP address 104.177.118.15 initiated at 02/01/2026 16 00:24:03 UTC” and “shows that within that transaction, IP address 104.177.118.15 17 uploaded a piece or pieces of a file corresponding to hash value 18 ED50E33FA026B5C523EBF23A005E4E1304778A49 to VXN Scan,” i.e., a hash value 19 that is unique to one of Plaintiff’s movies. Id. at ¶¶ 13–19; see also ECF No. 1-2 (Exhibit 20 A to the Complaint, listing the hash values of the 36 torrent files received by the Proprietary 21 Client from the IP address 104.177.118.15). 22 Third, Plaintiff provides a declaration by Susan B. Stalzer, Plaintiff’s employee. 23 ECF No. 4-2 at Ex. C (“Ex. C”). Based on a side-by-side comparison with Plaintiff’s 24 original movies, Ms. Stalzer verifies that each digital file that the Proprietary Client 25 received through its transactions with IP address 104.177118.15 is a copy of one of 26 Plaintiff’s copyrighted works that is identical, strikingly similar, or substantially similar to 27 the original work. Id. at ¶¶ 8–11; see also ECF No. 1-2. 28 1 Finally, Plaintiff provides a declaration by Emilie Kennedy, Plaintiff’s in-house 2 General Counsel. ECF No. 4-2 at Ex. D (“Ex. D”). Ms. Kennedy explains that after Plaintiff 3 received infringement data from VXN Scan, identifying IP address 104.117.118.15 as 4 infringing its works, the IP address was automatically input into Maxmind’s Geolocation 5 Database, which first traced the IP address to a location in San Diego, California. Id. at ¶¶ 6 4–5. Per Ms. Kennedy, Plaintiff subsequently repeated the trace through the Geolocation 7 Database (prior to filing the Complaint and prior to filing her declaration), which again 8 traced the IP address to San Diego, California, a location within this Court’s jurisdiction. 9 Id. at ¶¶ 6–7; see ECF No. 4-2 at 36. The Court is satisfied that these multiple geolocation 10 traces are reliably accurate and support a finding that the Doe defendant is located in this 11 District. 12 Based on the foregoing, the Court finds that Plaintiff identified the Doe defendant 13 with sufficient specificity and seeks to sue a real person subject to the Court’s jurisdiction. 14 Moreover, by obtaining the identifying information for the IP address at issue, the 15 discovery sought would likely enable Plaintiff to serve the Doe defendant. 16 B. Previous Attempts to Locate the Doe Defendant 17 The Application also describes Plaintiff’s efforts to identify, locate, and serve the 18 Doe defendant. Plaintiff attempted to locate the Doe defendant by searching for the IP 19 address using online search engines and other web search tools. ECF No. 4-1 at 14. Plaintiff 20 also reviewed numerous sources of authority such as legislative reports, agency websites, 21 informational technology guides, etc. regarding whether it is possible to identify such a 22 defendant by other means, and extensively discussed this issue with its computer 23 investigators and cyber security consultants. Id. Despite these diligent efforts, Plaintiff was 24 unable to identify any means of obtaining the identity of Doe defendant other than through 25 subpoenaing the information from the ISP. Id.; see also Ex. B at ¶ 28. Thus, the Court finds 26 Plaintiff has shown it has made a good faith effort to identify and locate the Doe defendant 27 before resorting to filing the instant Application. 28 1 C. Whether Plaintiff’s Complaint Can Withstand a Motion to Dismiss 2 Lastly, to establish that the Complaint could survive a motion to dismiss, Plaintiff 3 must “make some showing that an act giving rise to civil liability actually occurred and 4 that the discovery is aimed at revealing specific identifying features of the person or entity 5 who committed that act.” Columbia Ins., 185 F.R.D. at 580; see also Fed. R. Civ. P. 12(b). 6 To present a prima facie case of copyright infringement, Plaintiff must show: (1) ownership 7 of a valid copyright; and (2) that Defendant violated the copyright owner’s exclusive rights 8 under the Copyright Act. Bell v. Wilmott Storage Servs., LLC, 12 F.4th 1065, 1071 (9th 9 Cir. 2021). A prima facie case of direct copyright infringement must also show causation 10 by the Defendant. Id. at 1080. 11 Here, the Complaint alleges that Plaintiff owns a valid copyright in the works at 12 issue, which are registered with the United States Copyright Office. See ECF No. 1 at ¶¶ 43, 13 44, 46.3 Ms. Stalzer attests that she reviewed the files correlating to the hashes identified 14 in Exhibit A to the Complaint and confirmed that they are “identical, strikingly similar or 15 substantially similar” to Strike 3’s original copyrighted Works. Ex. C at ¶¶ 7–11; see ECF 16 No. 1 at ¶¶ 34–35. Plaintiff’s Complaint also alleges Doe defendant used BitTorrent to 17 copy and distribute the copyrighted works without authorization, and that the infringement 18 was continuous and ongoing. ECF No. 1 at ¶¶ 4, 19–30, 33–36, 45–46. Thus, Plaintiff’s 19 Complaint has stated a claim for copyright infringement against the Doe defendant. 20 Additionally, Plaintiff has alleged sufficient facts to show it could withstand a motion to 21 dismiss for lack of personal jurisdiction or a motion for improper venue because Plaintiff 22 traced the IP address at issue to this District. Further, Mr. Paige declares that based on his 23 experience in similar cases, the ISP, AT&T Inc., is the only entity that can correlate the IP 24 25 26 3 Exhibit A to the Complaint, which shows the hash values of the purportedly infringing 27 movies downloaded from IP address 104.177.118.15, also contains the United States Copyright Office registration information of the works that correspond with those hash 28 1 address 104.177.118.15 to its subscriber to pinpoint the Doe defendant’s identity. Ex. B at 2 ¶ 28. 3 Accordingly, coupled with the information provided by Mr. Arco and Mr. Paige in 4 their respective declarations, the Court is satisfied that Plaintiff’s Complaint would survive 5 a motion to dismiss. 6 IV. CONCLUSION 7 For the reasons set forth above, and for good cause shown, the Court GRANTS 8 Plaintiff’s Application. ECF No. 4. However, the Court is cognizant of the potential 9 embarrassment of being identified in this type of case and “shares the growing concern 10 about unscrupulous tactics used by certain plaintiffs, especially in the adult film industry, 11 to shake down the owners of IP addresses.” Malibu Media, LLC v. Does 1-5, No. 12-Civ- 12 2950-JPO, 2012 WL 2001968, at *1 (S.D.N.Y. June 1, 2012). Anticipating and sharing 13 these concerns, Plaintiff invites the Court to issue a protective order establishing procedural 14 safeguards if the Court finds such procedures appropriate. ECF No. 4-1 at 18. Accordingly, 15 the Court ORDERS as follows: 16 1. Plaintiff SHALL attach a copy of this Order to any Rule 45 subpoena. 17 2. Plaintiff may serve the ISP with a Rule 45 subpoena commanding the ISP to 18 provide Plaintiff with only the true name and address of the subscriber to whom the ISP 19 assigned IP address 104.177.118.15, as set forth on Exhibit A to the Complaint. The ISP is 20 not to release the subscriber’s telephone number or email address. 21 3. Within fourteen (14) calendar days after service of the subpoena, the ISP 22 SHALL notify the subscriber that his or her identity has been subpoenaed by Plaintiff. The 23 ISP must also provide a copy of this Order along with the required notice to the subscriber 24 whose identity is sought pursuant to this Order. 25 4. The subscriber whose identity has been subpoenaed shall have thirty (30) 26 calendar days from the date of such notice to challenge the disclosure of his or her name 27 and address by filing an appropriate pleading with this Court contesting the subpoena. A 28 subscriber who moves to quash or modify the subpoena may proceed anonymously as 1 || “John Doe” or “Jane Doe,” and shall remain anonymous until the Court orders that the 2 ||identifying information may be released. 3 5. If the ISP wishes to move to quash the subpoena, it shall do so before the 4 ||return date of the subpoena. The return date of the subpoena must allow for at least forty- 5 || five (45) days from service to production. If a motion to quash or other challenge is brought, 6 ||the ISP shall preserve the information sought by Plaintiff in the subpoena pending 7 resolution of such motion or challenge. 8 6. Plaintiff may only use the information disclosed in response to a Rule 45 9 ||subpoena served on the ISP for the purpose of protecting and enforcing Plaintiffs rights 10 set forth in its Complaint. If the subscriber wishes to proceed anonymously, Plaintiff 11 not release any identifying information without a court order allowing the release of 12 || the information. 13 IT IS SO ORDERED. | . SK 14 Dated: March 23, 2026 15 Honorable Valerie E. Torres 16 United States Magistrate Judge 17 18 19 20 21 22 23 24 25 26 27 28