FEDERAL COURT OF AUSTRALIA

Upaid Systems Ltd v Telstra Corporation Limited (No 4) [2016] FCA 1514

ORDERS

THE COURT ORDERS THAT:

1.    By 4.00 pm on 30 January 2017, the parties bring in agreed orders giving effect to these reasons or, failing agreement, the orders that each contends will give effect to these reasons, published as Upaid Systems Ltd v Telstra Corporation Limited (No 4) [2016] FCA 1514.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

YATES J:

Introduction

1    The respondent, Telstra Corporation Limited (Telstra), seeks an order pursuant to s 37AF(1) of the Federal Court of Australia Act 1976 (Cth) (the Act) that access to certain documents or parts of certain documents be suppressed and not be disclosed for a period of 10 years, other than to certain persons (solicitors and counsel, and their instructors and independent experts who have given certain confidentiality undertakings). The order is sought on the ground that it is necessary to prevent prejudice to the proper administration of justice.

2    Telstra’s application is opposed by the applicant in the proceeding, Upaid Systems Ltd (Upaid), other than in respect of certain exhibits.

3    The present application, filed on 1 September 2015, arises in the context of Upaid’s claim that Telstra has infringed various claims of Patent No 2008203853 entitled “Convergent communications platform and method for mobile and electronic commerce in a heterogeneous network environment” and Patent No 770646 entitled “Communication services”.

4    On 29 October 2014, Telstra filed an interlocutory application seeking orders that Upaid’s further amended statement of claim and consolidated particulars of infringement be struck out. Telstra also moved pursuant to s 31A of the Act, or alternatively r 26.01 of the Federal Court Rules 2011, that judgment be given in its favour (the strike out/summary dismissal application).

5    On 18 December 2014, after a contested hearing on 8 December 2014, I made orders that Telstra give discovery and answer certain interrogatories. These and other orders were made on that day for the purpose of bringing the strike out/summary dismissal application into readiness for hearing.

6    On 11 and 12 March 2015, I heard the strike out/summary dismissal application. Telstra read a number of affidavits which described its systems relevant to Upaid’s allegations of Telstra’s infringement of claim 1 of each patent. These affidavits included a description of the process of purchasing a premium MOG subscription. MOG is a subscription music service offered by Telstra that enables customers to stream music on certain devices. Upaid particularised the purchase of a MOG subscription as one type of infringement. As part of its submissions in the strike out/summary dismissal application, Telstra provided an outline of the evidence given in the affidavits (the outline). It also produced a flowchart describing the process of purchasing a premium MOG subscription using an internet browser on a Telstra mobile device (the flowchart). The flowchart was referenced to the outline.

7    The suppression order now sought by Telstra covers, in broad terms, the flowchart; parts of the outline; parts of the affidavits read in support of the strike out/summary dismissal application; parts of the written submissions filed and used by the parties in the strike out/summary dismissal application; certain documents or parts of documents that were tendered at the hearing of the strike out/summary dismissal application (identified as Exhibits 1, 2, 3 and 5); parts of the transcript of the hearing on 8 December 2014; parts of the transcript of the hearing on 11 and 12 March 2015; and parts of a notice to answer interrogatories annexed to the orders made on 18 December 2014. I should record that Upaid raises no objection to an order being made in respect of Exhibits 1, 2 and 5.

Background

8    There are a number of difficulties confronting the present application, not the least of which is the fact that aspects of the material now sought to be supressed were deployed in open court at the hearings on 8 December 2014 and on 11 and 12 March 2015. It is true that the contents of the affidavits were not actually read in open court. In accordance with usual practice, the affidavits were taken as having been read. Nonetheless, counsel for both parties quoted freely from, or disclosed the substance of, a number of paragraphs and other parts of the affidavits in the course of addressing the Court. The suppression order that is now sought covers not only the affidavits taken as having been read, but parts of the transcript of the hearings at which the contents of the affidavits were freely disclosed and discussed.

9    For the purpose of the present application, the outline cannot be treated any differently from the affidavits on which it is based. So, too, the flowchart, which is referenced to the outline. On a number of occasions during the hearing on 11 and 12 March 2015, I was taken to the flowchart. Explicit disclosure was made of aspects of the flow of information recorded in it, including reference to the names of system components and their functions. None of this was done in any way that would suggest that the information disclosed in open court—in the affidavits, the outline or the flowchart—was in any way confidential or should be restricted from public disclosure for any other reason.

10    Further, when I made the orders on 18 December 2014, there was no suggestion that any part of the notice to answer interrogatories, which was annexed to the orders, was confidential or should not be disclosed for other reasons. I note, here, that the form of the orders was prepared and agreed by the parties, following the giving of judgment on 16 December 2014: Upaid Systems Ltd v Telstra Corporation Ltd (No 2) [2014] FCA 1377. The orders were subsequently published on the Commonwealth Courts Portal (the portal).

11    At one stage, Telstra also sought to argue that my reasons for judgment published on 16 December 2014, or at least some parts of them, also contained confidential information or information that should not be disclosed, even though no such claim was made either prior to, or in the months following, the publication of those reasons.

12    I understand that, at some time prior to the hearing on 8 December 2014, the parties entered into their own non-disclosure regime. So far as I am aware, that regime, or one similar to it, is still in place, notwithstanding the public disclosures to which I have referred. Following the hearing on 11 and 12 March 2015, Telstra’s solicitors wrote to Upaid’s solicitors on 20 March 2015 to advise that Telstra confirmed that, save for some matters, it did not intend to assert any ongoing confidentiality restrictions in relation to the affidavits, the outline or the flowchart. Telstra’s solicitors said that, accordingly, Telstra no longer considered this material to be subject to the confidentiality regime between the parties. Further, Telstra’s solicitors said that Telstra did not intend to assert any ongoing confidentiality restrictions in respect of Telstra’s written submissions dated 4 March 2015 and 10 March 2015. Once again, Telstra’s solicitors said that Telstra no longer considered this material to be subject to the confidentiality regime between the parties. Telstra nevertheless maintained a claim to confidentiality of some limited parts of three affidavits as well as some parts of Upaid’s written submissions. So far as I am aware, these specific claims were not brought to my attention prior to the present application. I was certainly not informed that parts of Upaid’s submissions were considered to be confidential and should not be disclosed.

13    Despite Telstra’s solicitors’ communications in March 2015, the evidence shows that, from about 9 April 2015, Telstra’s attitude to confidentiality changed. On 1 May 2015, Telstra’s solicitors invited Upaid’s solicitors to consider a form of suppression order that covered an extensive amount of material. Subsequent correspondence shows that there was further refinement of and/or addition to the documents comprising that material. On 8 July 2015, Upaid’s solicitors wrote to Telstra’s solicitors advising that Upaid would not consent to the order that Telstra had proposed. Upaid’s solicitors said that much of the information was already in the public domain or not confidential in nature.

14    At this juncture, it is convenient to record that Telstra’s disclosure of the information regarding its systems at the hearings on 8 December 2014 (I include the proffering of the agreed form of orders made on 18 December 2014) and on 11 and 12 March 2015, and its tolerance of Upaid’s disclosure of such information at those hearings, was a decision deliberately taken. There is evidence that Ms Harrop, who held the position of Legal Counsel, Dispute Resolution Group, Telstra Legal Services, consulted Telstra’s Chief Technology Officer, and then Telstra’s Director of Technology, Mr Crosby, on the affidavits and other documents to be used in support of Telstra’s strike out/summary dismissal application. The evidence indicates that this was done before the hearing on 11 and 12 March 2015. It is not clear whether this consultation took place before the hearing on 8 December 2014, but I find it hard to think that Telstra was not conscious of potential confidentiality concerns at the time that it filed its first round of affidavits and prepared the first version of the outline, which was well before 8 December 2014 in any event. As matters transpired, Mr Crosby advised Ms Harrop that the process of purchasing a premium MOG subscription using an internet browser on a Telstra mobile device as disclosed in the flowchart, the affidavit material he reviewed, and the outline, were “not confidential to Telstra”.

15    In an affidavit made on 1 August 2015, Ms Delaney, who is a solicitor employed by Telstra in the position of Legal Counsel, Intellectual Property, Telstra Legal Services, said that, as a result of Ms Harrop’s discussions with Mr Crosby, “Telstra did not seek a closed Court room for the hearing on 11 and 12 March 2015”. I take this to mean that Telstra deliberately refrained from claiming any confidentiality in the material that it advanced in support of its strike out/summary dismissal application at the hearing on 11 and 12 March 2015, other than for, possibly, some personal information relating to its customers that had not been disclosed in open court. I make this qualification because, at the conclusion of the hearing on 12 March 2015, senior counsel for Telstra said:

... I mentioned yesterday the question of a confidentiality order. We’re still in the process of trying to identify exactly what it is we should seek to have protected. It’s fair to say that the basis for protection is essentially likely to be the need to protect the security of information of users of accounts as opposed to anything proprietary about the system which is used. …

16    This statement was completely consistent with the way in which the parties conducted the hearing on 11 and 12 March 2015. In other words, there was no suggestion that the disclosure of Telstra’s systems or the way in which they operated in the purchase of a premium MOG subscription using an internet browser on a Telstra mobile device was in any way confidential or should not be disclosed for any other reason. Any suggestion to the contrary would have been a matter of surprise for any member of the public present at the hearing on those days or, indeed, at the interlocutory hearing on 8 December 2014.

Telstra’s present position

17    Ms Delaney gave evidence that, following the hearing on 11 and 12 March 2015, she “became aware” of Telstra’s Information Security team, from whom she sought instructions regarding the confidentiality of information relating to Telstra’s strike out/summary dismissal application. Expressed in this way, Ms Delaney’s evidence suggests that, prior to that time, she and other personnel employed in Telstra Legal Services were unaware that Telstra had an Information Security team. It would seem, for example, that Ms Harrop was unaware of such a team. Further, it can be taken that Mr Crosby, if aware of such a team, did not think that the material he was asked to consider raised any security concerns that did not already exist in light of then public knowledge concerning Telstra’s systems. If the position had been otherwise, one would have expected that Ms Harrop’s original inquiry would have been referred to Telstra’s Information Security team for advice.

18    Ms Delaney said that when she consulted Telstra’s Information Security team, she was informed of concerns about “the contextual disclosure of Telstra system names, the role and function, architecture or configuration of the Telstra systems, particularly for security reasons”. I pause here to note that Telstra now accepts that disclosure of its system names does not raise security concerns. This concession was properly made in light of the evidence adduced by Upaid in the present application: see [27] below.

19    These concerns were expanded upon in an affidavit made on 23 October 2015 by Mr Burgess, Telstra’s Chief Information Security Officer. I will not seek to summarise the various concerns raised in this affidavit. It is sufficient for me to record that Mr Burgess considered that the material, whose disclosure is now sought to be supressed, was of a kind that could be misused by miscreants for the purposes of damaging Telstra or third parties. Mr Burgess stressed that he did not wish to suggest that disclosure of this material would certainly lead to a cyber threat. He said, however, that the security of Telstra’s systems would be “enhanced” if the material were suppressed.

20    In his affidavit, Mr Burgess spoke of various grades of information which required protection. This theme was picked up in Telstra’s submissions. Telstra explained that the “grade” of the material depended on “how much of the overall sequence of processes they disclose”. Telstra said that the flowchart and outline represented the highest grade because they “depict the entire picture”. Telstra said that the affidavits and the material referred to in the submissions and transcripts, taken individually, represented a lower grade of material because each refers only to “a piece of the picture”. However, in aggregate, this material is equivalent to the flowchart and the outline. Telstra said that the annexure to the orders made on 18 December 2014 was of still lower grade because it contained only fragmentary references to the affidavit material. Apart from making these distinctions, Telstra did not seek to distinguish between individual pieces of information in the material whose disclosure it seeks to suppress. It simply dealt with the material in a global fashion, attributing equal importance to each piece of information.

21    Telstra’s position is that the administration of justice will be hampered if a proceeding may cause a party to suffer damage by reason of the disclosure of information the subject of the proceeding. It says that the disclosure it seeks to suppress concerns information that could be used to facilitate a cyber-attack on its systems in the ways explained by Mr Burgess.

22    Telstra contended that a suppression order can be made in respect of information that has already been disclosed in open court: Commissioner of Police New South Wales v Nationwide News Pty Ltd (2008) 70 NSWLR 643; [2007] NSWCA 366 at [43]-[44]; Baptist Union of Queensland – Carinity v Roberts (2015) 241 FCR 135; [2015] FCA 1068 at [55]-[58].

23    Further, Telstra adduced evidence to show that, as at the hearing of the present application, no public access has been sought in respect of the filed affidavits or the transcript of the hearings on 8 December 2014 and 11 and 12 March 2015. Telstra also argued that, although notionally read in court, the entire contents of the affidavits were not actually read in court.

24    With regard to the orders made on 18 December 2014, Telstra adduced expert evidence to the effect that:

    it is reasonable to assume that access to the orders on the portal is confined to persons who have consciously sought to visit the relevant page and that automatic dissemination of the orders is inhibited by the access controls and underlying technology of the portal;

    where a person has accessed or downloaded a copy of the orders, any subsequent public dissemination will be as a direct result of that person’s deliberate efforts to make them public;

    a search by mainstream search engines indicates that the orders are yet to be distributed to or accessible from any Internet source other than the portal;

    the presence of or access to a copy of the orders in a web cache, cloud storage or system backup will be confined to the specific user and that person’s devices;

    whilst the orders remain publicly available on the portal, inquiries to date indicate that they are not otherwise available on the Internet; and

    if the orders were to be taken down from the portal, they would not otherwise be available on the Internet.

25    This last-mentioned evidence was in response to expert evidence adduced by Upaid to the effect that:

    the orders, if accessed, would be subject to caching;

    the taking down of the orders after a period of at least nine months of public accessibility would not stop members of the public continuing to have access to them;

    persons who had previously accessed the orders would continue to have access to them even if the orders were removed from the portal; and

    such removal would not be effective in preventing further exchange of the material already in the possession of members of the public.

26    The purpose of Telstra’s evidence was to demonstrate that, notwithstanding the disclosures to which I have referred, the amount of information actually disclosed has been limited and that the likelihood of the dissemination of this information to date appears to be slight. Telstra submitted that, in these circumstances, the making of a suppression order would not be futile.

Upaid’s position

27    Apart from the expert evidence to which I have referred, Upaid adduced evidence of searches undertaken relying on the information that was publicly disclosed at the hearings. Much of this evidence was directed to the names of components used in Telstra’s systems or expressions disclosed in the flowchart, outline and affidavits. This evidence shows that the names of components used in Telstra’s systems have been disclosed to the public at large in newspaper articles and other published, written material, as well as in profiles (available on the Internet) of Telstra’s employees, suppliers, contractors and consultant who have advertised their proficiency, experience and expertise with respect to components of Telstra’s systems. A number of these components are sourced from third parties and are used in other telecommunications systems by other providers. The evidence discloses, at a general level, that the basic functionality of these components is publicly known. Upaid argued that Telstra adduced no evidence to suggest that these known components had any different function in Telstra’s systems.

28    Upaid also relied on some of the affidavits read at the hearing on 11 and 12 March 2015 to show how members of the public, as users, interact with Telstra’s systems when purchasing a MOG subscription.

29    Upaid advanced the following submissions in opposition to the order that is sought. Some of these submissions involve repeated themes.

30    First, Upaid submitted that Telstra has not identified, with precision, the information that is sought to be suppressed. Upaid submitted that Telstra has only described the information in global terms through Mr Burgess’ affidavit, which uses language that is “vague, dense and incomprehensible” or is of such generality that it describes the information only by the alleged harm it would cause if its disclosure is not suppressed.

31    Secondly, Upaid submitted that Telstra has not established that the information in question is, in any event, confidential.

32    Thirdly, Upaid submitted that the Court should give little weight to (what it described as) Mr Burgess’ speculation as to the alleged cyber security threat that would exist if a suppression order is not made. In this connection, Upaid pointed to the fact that Telstra had adduced no evidence that showed a clear causative link between the general concern expressed by Mr Burgess and the information in question. Upaid also pointed to Mr Burgess’ statement that a suppression order would merely “enhance” the security of Telstra’s systems. Upaid submitted that there is no evidence of any security breaches having occurred as at the date of hearing the present application as a result of the disclosures that have been made. Upaid submitted, in short, that Telstra has not established that the suppression order it seeks is “necessary” within the meaning of s 37AG(1)(a) of the Act.

33    Fourthly, Upaid pointed to the fact that it was Telstra who deployed the relevant material for the purposes of the strike out/summary dismissal application without claiming any confidentiality, with the consequence that any confidentiality that might have attached to the material has been lost. Further, Upaid argued that its evidence shows that a number of matters sought to be covered by the suppression order, such as the identity of system components and their functionality, is public information in any event, despite Telstra’s initial position that such information was confidential. In answer to Telstra’s submission that information of this kind in the public domain is not of the same “quality” as the information sought to be supressed, Upaid argued that this simply underscores Telstra’s failure to identify with specificity the information that is truly confidential. In this context, Upaid, once again, stressed the requirement of “necessity” as a pre-condition to making the order that is sought.

34    Fifthly, Upaid pointed to what it described as Telstra’s inconsistent conduct. In this connection, Upaid referred to a number of the background facts I have summarised at [8]-[16] above. Upaid emphasised the deliberateness of Telstra’s conduct at the hearings on 8 December 2014 and 11 and 12 March 2015, its failure to seek a suppression order any earlier than the filing of the present application on 1 September 2015, and the inconsistency of attitudes within Telstra, as evidenced by the different views taken by Telstra’s Director of Technology, Mr Crosby, on the one hand, and Mr Burgess, as Telstra’s Chief Information Security Officer, on the other. Continuing its earlier submission at [33] above, Upaid argued that Telstra made a calculated and considered decision to place the material now sought to be supressed before the Court in order to enhance its prospects on the strike out/summary dismissal application. It argued that the price of that forensic decision has been the public disclosure of information, which Telstra must now accept.

35    Sixthly, based on the evidence of its independent expert (see [25] above), Upaid argued that information now in the public domain (because of Telstra’s own conduct in this proceeding) will remain in that domain and is capable of being further disseminated. Based on the other evidence it has adduced (see [27] above), Upaid again pointed to the fact that much of the information now sought to be supressed was already in the public domain before Telstra’s own disclosures in this proceeding. Thus, Upaid argued, to make a suppression order now would be futile and, once again, not “necessary”.

36    Upaid advanced other submissions but, on analysis, these appear to be further variations on the matters I have summarised above.

Consideration

37    I do not accept Upaid’s submission that the information sought to be suppressed has not been identified with sufficient precision. This information is identified by the redactions that are sought to be made to the various documents which make up Confidential Exhibit MPB-3 to Mr Burgess’ affidavit. It is to be borne in mind that the effect of the suppression order, if made, would only prevent disclosure of the various documents in unredacted form. The redacted form, which could be disclosed, is illustrated by Confidential Exhibit MPB-3. Therefore, I do not think that the order, as sought, would lead to any difficulty in identifying the form of the information that would be suppressed.

38    I accept Telstra’s submission that the actual or literal disclosures made of the contents of the affidavits, the outline and the flowchart to the public in this proceeding are relatively limited and that, on the available evidence, the risk of dissemination of those particular disclosures, and the disclosures made by the orders on 18 December 2014, appears to be slight. I would accept, correspondingly, that where the public has gained access to the information, as disclosed, there is nothing that would prevent the retention and use of that information or, indeed, its wider dissemination in the form in which it was acquired. Nonetheless, I am not persuaded that the suppression order that is now sought would lack utility because of the past disclosures in this proceeding.

39    The obstacle to making the suppression order which, on reflection, seems to me to be determinative is the fact that Telstra has not demonstrated that the information it seeks to supress is confidential and treated as such by its employees, suppliers, contractors and consultants. Telstra now accepts (although it did not initially accept) that the names of its system components are not confidential. Further, the basic functionality of those components is not confidential. Upaid’s evidence establishes that much. I accept Telstra’s submission that the quality of the disclosures shown in Upaid’s evidence is not equivalent to the narrative provided in, say, the outline or the flowchart, or the combination of Telstra’s affidavits on which the outline and the flowchart are based. Nevertheless, there is no evidence that Telstra’s employees, suppliers, contractors and consultants, involved with the systems in question, are or have been under any obligation whatsoever not to disclose the actual information that happens to be contained in the outline, flowchart and affidavits.

40    Upaid’s evidence (see [27] above) goes some way to establishing this fact. But what is far more demonstrative is the advice conveyed to Ms Harrop by Telstra’s own Director of Technology, Mr Crosby whom, it might be thought, was well-placed to identify, and express an expert view on, what technological information with respect to Telstra’s systems is confidential, and what information is in the public domain. After all, this is why he was consulted by Ms Harrop in the first place.

41    I can safely conclude that if Mr Crosby did not think this information was confidential to Telstra then he did not consider himself to be under any obligation of confidence or non-disclosure with respect to that information. Similarly, I can safely conclude that other Telstra employees were and are of the same view and consider themselves to be in no different position.

42    A noticeable gap in Telstra’s evidence is its failure to explain why Mr Crosby’s views, as communicated to Ms Harrop, were in any way erroneous. This gap was not filled by Mr Burgess’ evidence. The use which might be made of such information, as explained by Mr Burgess, says nothing about the fact that such information is already in the public domain. Moreover, Mr Burgess’ evidence is conspicuously silent (as is Telstra’s evidence in general) on the existence of any prior or extant arrangement that would bind Telstra’s employees, suppliers, contractors and consultants, who are familiar with Telstra’s systems, from disclosing the very information whose disclosure is now sought to be suppressed. This proposition is not gainsaid by Telstra’s submission that Mr Crosby is not an “information security officer”.

43    When one stands back from the various arguments that Telstra has advanced to support the making of a suppression order, a clear picture emerges that, despite Mr Burgess’ concerns, there is, apparently, no system or arrangement in place within Telstra itself that prevents the disclosure of the actual information contained in the flowchart, outline and affidavits, by Telstra’s employees, suppliers, contractors or consultants. This is, no doubt, one reason why Mr Crosby expressed the views that he did when he was consulted on this very question. If there is no evidence that Telstra itself has a system or arrangement in place to protect the alleged confidentiality of the information in question, why should the Court be prevailed upon to put such a system in place or make such an arrangement for the purposes of this proceeding? Why is a suppression order necessary when Telstra itself does not appear to recognise, through its own procedures, the same necessity? The security concerns it has advanced in this application appear to be security concerns it tolerates and manages in its own commercial activities.

44    For these reasons, I am not satisfied that the suppression order that is now sought is necessary to prevent prejudice to the proper administration of justice, other than in respect of Exhibits 1, 2 and 5 tendered at the hearing of the strike out/summary dismissal application. As the High Court emphasised in Hogan v Australian Crime Commission (2010) 240 CLR 651; [2010] HCA 21 at [31], it is insufficient that the making or continuation of such an order might be convenient, reasonable or sensible or be seen to serve some notion of the public interest. The question is whether such an order is “necessary” and, as the High Court emphasised, “necessary”, in this context, is a “strong word”. If the Court is of the view that such an order is “necessary”, the order should be made. Otherwise, the order should not be made. If an order has been made and the circumstances show that it is not, or is no longer, “necessary” then that order should be discharged.

Disposition

45    For these reasons, a suppression order should be made in respect of Exhibits 1, 2 and 5 tendered at the hearing of the strike out/summary dismissal application. Save to this extent, Telstra’s amended interlocutory application dated 26 October 2015 should be dismissed. As Upaid has not contested the need to make an appropriate order in respect of Exhibits 1, 2 and 5, and as it has been successful in its opposition to any wider order being made, an order for costs should be made in its favour.

46    At the conclusion of the hearing of the present application, I made an interim order under s 37AI(1) of the Act to preserve Telstra’s claims and to provide me with the opportunity to consider and reflect upon the detailed evidence and submissions of the parties. Having now reached the view that a suppression order, as sought, should not be made other than in respect of Exhibits 1, 2 and 5, the interim order should be discharged.

47    Various other confidentiality orders have been made in this proceeding whose continuation may be affected by the conclusion I have expressed in these reasons. The parties should now give consideration as to what other orders should now be varied or discharged.

48    I will order that, by 4.00 pm on 30 January 2017, the parties are to bring in agreed orders giving effect to these reasons or, failing agreement, the orders that each contends will give effect to these reasons. These should include ancillary orders such as those suggested at [47] above. I will then be in a position to make orders that will determine the present application.

Associate:

Dated:    16 December 2016