AWS, GoDaddy Named in Ashley Madison Lawsuit

A lawsuit has been filed against Amazon Web Services (AWS) and GoDaddy by three anonymous plaintiffs for hosting websites that reproduced the user data stolen from Ashley Madison. The suit seeks $3 million in damages, and also names 20 other defendants, three of whom operated sites which sold the leaked user data.

The suit was filed in an Arizona federal court, and can be read via The Register (PDF). It acknowledges separate legal action directly against Ashley Madison, but alleges those named in the suit have been involved in the possession and distribution of stolen property.

“(T)his action deals with a different injury inflicted upon Ashley Madison users by persons and entities who have obtained the stolen data, repurposed it such that it is more readily accessible and searchable by the media and curious Internet users, and actively distributed it for their own gain,” the lawsuit said.

It also cites a ruling by an Ontario court that issued a restraining order against sharing the leaked data, referring to it as stolen property. The identities of the 3 site operator defendants are unknown by the plaintiffs, but AWS and GoDaddy were identified as hosts of the three sites through WHOIS records.

“John Doe” anonymous defendants 4-20 are unnamed persons or entities, leaving room for the plaintiffs and their legal representative Internet law firm Kronenberger Rosenfeld to add more hosts or website operators in the future.

The legal question from a hosting perspective is the accuracy and applicability of the phrase “are in willful, knowing possession of the Stolen Data.” This is the accusation brought against all defendants, and while the site operators will not be able to claim that their possession was not “willful” and “knowing,” AWS and GoDaddy will defend the companies’ role as, if anything, one of unwilling and unwitting use by the real criminals.

The good news for GoDaddy and AWS is that there is likely precedent that they are not responsible for policing the content of the sites they host, such as GoDaddy’s 2014 court of appeals victory related to hosting “revenge porn” site Texxxan.com.

A Russian court decision last year that a web host was responsible for pirated content on its servers is generally considered part of a draconian approach to Internet governance. Meanwhile, it is not clear that web hosts even have the legal right to erase customer content, given the ongoing struggle Carpathia is having with legacy Megaupload servers.

This first ran at http://www.thewhir.com/web-hosting-news/aws-godaddy-named-in-ashley-madison-lawsuit