Case 4:25-mc-80147-YGR Document 16 Filed 11/13/25 Page 1 of 5 November 13, 2025 Hon. Yvonne Gonzalez Rogers, United States District Judge 1301 Clay St. Courtroom 1 – 4th Floor Oakland, CA 94612 VIA ECF RE: In Re. 17 U.S.C. §512(h) Subpoena to Cloudflare, Inc. (Shueisha Inc.), Case No. 4:25-mc-80147-YGR Joint Discovery Letter re: Protective Order Dear Hon. Judge Gonzalez Rogers: Pursuant to D.E. 14, Non-Party John Doe and Petitioner Shueisha Inc. jointly submit this discovery letter regarding a proposed protective order. Counsel for the parties met and conferred via telephone and video conference on October 23, 2025 and November 4, 2025. The parties were unable to reach agreement on a single protective order. Each party sets forth their respective position below. Additionally, filed concurrently herewith the parties submit their own proposed protective orders for the Court’s review and determination. Sincerely, KRONENBERGER ROSENFELD, LLP GAMMA LAW, P.C. s/ Leah Rosa Vulić s/ Marco Martemucci Leah Rosa Vulić (SBN 343520) Marco Martemucci (SBN 255054) 548 Market St. #85399 One Sansome Street, Suite 1400 San Francisco, CA 94104 San Francisco, California 94104 Telephone: (415) 955-1155 Tel.: 415.901.0510 Facsimile: (415) 955-1158 Fax: 415.901.0512 leah@kr.law MMartemucci@gammalaw.com Attorneys for Non-Party John Doe Attorneys for Shueisha Inc. Case Gonzalez Hon. Yvonne 4:25-mc-80147-YGR Rogers Document 16 Filed 11/13/25 Page 2 of 5 November 13, 2025 Page 1 John Doe’s Position John Doe respectfully submits that the terms set forth in his version of the Proposed Protective Order are necessary and appropriate for a pre-suit DMCA §512(h) identification proceeding, as required by Fed. R. Civ. P. 26(c), to address unique privacy and due process concerns here. The Court expressly ordered the parties to submit a proposed protective order, prohibiting the disclosure and use of John Doe’s identity for any purpose unrelated to the purpose of the subpoena. (D.E. 14, 4:13-16.) The only purpose of the subpoena is to obtain Doe’s identity for use in protecting Shueisha’s copyrights under U.S. copyright law. 17 U.S.C. §512(h)(2)(C); see Braun v. Primary Distrib. Doe No. 1, 2012 WL 6087179, at *8 (N.D. Cal. Dec. 6, 2012). Any further use of Doe’s identity, such as for actions outside the U.S. necessarily outside the scope of U.S. copyright laws, must be prohibited. See Signature Mgmt. Team, LLC v. Automattic, Inc., 941 F. Supp. 2d 1145, 1159 (N.D. Cal. 2013). Shueisha refuses this limitation. However, §512(h) expressly limits use of disclosed information to prosecuting claims of copyright infringement under U.S. law. 17 U.S.C. The DMCA does not contemplate use of subpoenaed information in foreign proceedings or for other purposes—or to notify completely absent third parties of an alleged infringer’s identity. Shueisha’s stated intentions blatantly exceed the scope. Shueisha claims that there is no good cause for a protective order. But Shueisha’s position and proposed order make clear its intent to expose Doe publicly for purposes unrelated to its own rights. And, courts allow protective orders, including with AEO provisions, in DMCA subpoena cases. See In re DMCA Subpoena To Reddit, Inc., 383 F. Supp. 3d 900, 916 (N.D. Cal. 2019) (court ordered protective order keeping a Doe’s identity under seal, AEO, including in any later-filed infringement lawsuit; Article III judge later quashed subpoena entirely) (R&R rejected on other grounds, 441 F. Supp. 3d 875 (N.D. Cal. 2020)). Shueisha’s own submission shows a protective order is necessary. Shueisha outright admits it wants to use Doe’s identity to “notify others whose works were infringed”— a purpose outside of a DMCA subpoena. Shueisha thus admits that its goals exceed identifying Doe, including to expose him to others for alleged infringement that isn’t substantiated at all.1 This is precisely why a robust protective order is necessary: to prevent the improper use of Doe’s identity. Notably, the protective order only applies to John Doe and not any other alleged infringer; Shueisha is free to do whatever it wants with other identifying data disclosed by Cloudflare, unrelated to Doe. Further, to the extent Shueisha complains that it may not be able to definitively identify Doe from information provided by Cloudflare, based on the limited time frame when allegedly infringing material was posted, Shueisha may have issued its DMCA takedown to the actual host of the websites, not a pass-through provider such as Cloudflare. 1. Attorneys’-Eyes-Only (“AEO”) Designation (§§1.2, 5.1, 6.1, 7.1) John Doe’s identity information should be designated “HIGHLY CONFIDENTIAL – ATTORNEYS’ EYES ONLY.” Disclosure of identity beyond outside counsel creates real risk of harassment, reputational harm, and loss of anonymity, especially given Shueisha’s admitted stated intent of sharing Doe’s identity with others. Once such information is disclosed outside the most essential persons on a need-to-know basis, there is risk of irreversible harm if information is misused, publicly disseminated, or transmitted cross-border. See Art of Living Found. v. Does 1- 10, 2011 WL 5444622, at *9 (N.D. Cal. Nov. 9, 2011) (the disclosure of one’s identity is itself irreparable harm). No subsequent court order can undo that exposure, especially across borders where this Court’s supervisory power is limited. The AEO limitation is narrowly confined to identity information (§2.1), grants full outside counsel access, and does not prejudice litigation — while serving as the least-restrictive means to 1 Shueisha’s characterization of Doe’s website as a “massive piracy website” is unfounded, subjective, and irrelevant. Case Gonzalez Hon. Yvonne 4:25-mc-80147-YGR Rogers Document 16 Filed 11/13/25 Page 3 of 5 November 13, 2025 Page 2 avoid foreseeable harassment and reputational damage, including online spillover risks. AEO protection does not impede rights to file and serve U.S. litigation, and is essential given the absence of pending U.S. action and uncertainties about intended use. In the alternative, Doe requests that the Court order that Shueisha’s U.S. counsel plus up to two Shueisha management personnel, may review Cloudflare’s production, after signing the Acknowledgment and Agreement to be bound. 2. Scope of Information (§2.1), Time Frame (§3.4), & Doe-Linked URLs (§§2.3, 3.3) Doe does not object to production of name and postal address, but notes that phone numbers and similar information should be excluded unless specifically ordered by the Court pursuant to a particularized showing. In addition, the time period of the disclosure must be limited to the dates the specific images were available at the identified URLs; and the URLs must be limited to only the URLs identified in Shueisha’s Subpoena linked to Doe (lines 1 and 2). In particular, requests for billing and payment information, hosting providers, IP logs, others hosting content or contracting parties, and access log information are vastly overbroad and not limited to identifying John Doe. Indeed, such information could lead to identifying any private individual who ever accessed the images, without any notice to these individuals. 3. Additional Subpoenas (§1.2(f), 8.1) Additional subpoenas should be governed by Court order, not by right. Doe’s Proposed Protective Order prohibits chained, open-ended subpoenas and specifies that any additional requests must be explicitly approved—under seal, limited to minimal identifiers, non-content only, and subject to an objection window. The addition of safeguards addresses concerns about fishing expeditions, proportionality, and compliance with the narrow aims of §512(h) and Rule 26(c). 4. Limiting Use to U.S. Proceedings and the 180-Day Period (§§1.2(a), 13.5) Doe’s Proposed Protective Order restricts use of identity information to U.S.-based litigation/service, solely in connection with the URLs in Ex. A and only within 180 days of disclosure, unless further extended upon a showing of good cause. Braun v. Primary Distrib. Doe No. 1, 2012 WL 6087179 at *8 (limiting service of lawsuit to 120 days after discovery of identity). This tracks the DMCA §512(h) oath (providing only for use in protecting rights under Title 17), ensures that compelled disclosure is not used for unrelated or foreign matters, and respects the principle that any foreign discovery should proceed with judicial oversight. The limitations provide clarity, accountability, and due process protection, while allowing extensions if justified. Notably, Shueisha has filed numerous requests for §512(h) subpoenas, which do not appear to have resulted in subsequent copyright infringement cases in the U.S. A search of Pacer shows only one U.S. copyright infringement case actually brought by Petitioner Shueisha, and it was against John Does, seeking identifying information, and was not prosecuted against a named defendant (No. 1:19-cv-08227-LJL-SN, S.D.N.Y.). This supports a reasonable inference that compelled identity information is not exclusively used to bring U.S. copyright cases, reinforcing the need for strict use, audience, geography, and time limited in the protective order. 5. U.S.-Only Storage, No Disclosure to Client Personnel/Abroad (§§1.3, 7.2) The restriction against access, storage, transfer, or disclosure of protected information outside the U.S. (and beyond outside U.S.-admitted counsel) ensures effective Court supervision and protection against misuse, especially given data protection and privacy implications across different jurisdictions. A reading room or audit-logged secure U.S. data repository could best balance practical needs against legitimate privacy and cross-border risks, keeping supervision within reach of this Court. For these reasons, Doe urges the Court to adopt Doe’s Proposed Protective Order. Shueisha Inc.’s Position Case Gonzalez Hon. Yvonne 4:25-mc-80147-YGR Rogers Document 16 Filed 11/13/25 Page 4 of 5 November 13, 2025 Page 3 Shueisha seeks to identify non-party John Doe for the sole purpose of pursuing its copyright enforcement options against Doe. This is entirely in line with the purpose of 17 U.S.C. § 512(h), aptly titled “[s]ubpoena to identify infringer.” Doe now seeks to effectively invalidate both this Court’s denial of Doe’s motion to quash the subpoena and undercut the DMCA’s clear purpose of publicly identifying copyright pirates. Doe’s proposed protective order is impossible to adopt without going against the purpose of 17 U.S.C. § 512(h) and copyright enforcement policy. 1. There Is No Good Cause for a Rule 26(c) Protective Order Protective orders are exceptional measures justified only by concrete harm that the requesting party has the burden to establish. See In re Violation of Rule 28(D), 635 F.3d 1352, 1358 (Fed. Cir. 2011). Even when potential specific harm is found, the court must balance “the public and private interests to decide whether a protective order is necessary.” In re Roman Cath. Archbishop of Portland in Oregon, 661 F.3d 417, 424 (9th Cir. 2011) (citing Glenmede Tr. Co. v. Thompson, 56 F.3d 476, 483 (3d Cir. 1995) (“Broad allegations of harm, unsubstantiated by specific examples, do not satisfy Rule 26(c).” and listing factors to balance). Here, Doe has not articulated a plausible, particularized harm. Doe is simply attempting to avoid legal consequences that should result their operation of a massive piracy website.2 Does has not articulated a single harm it faces other its desire to avoid copyright enforcement. Doe baselessly speculates that the relative lack of Shueisha copyright complaints filed in U.S. courts suggests some other, inappropriate use of the subpoenaed information. However, Doe ignores that Shueisha can use infringer identity information to issue cease-and-desist letters, negotiate licensing arrangements, obtain pre-litigation settlement, and assess and drop matters deemed not cost-effective for litigation. These are some of the valuable enforcement options that should remain available to Shueisha; none of which would have been found on court dockets. Courts have found the interest of copyright holders to seek limited discovery from a third party to establish a potential infringer’s identity outweighs any privacy interest infringers may have in protecting their identities. See Strike 3 Holdings, LLC v. Doe, 2019 WL 935390, at *4-*5 (E.D. Cal. Feb. 26, 2019) (denying infringer’s motion to quash in order to allow plaintiff to determine whether it can obtain the identity of the proper defendant, and noting defendant could raise any factual innocence claim in a motion to dismiss); Strike 3 Holdings, LLC v. Doe, No. EDCV182496TJHSPX, 2019 WL 12446430, at *4 (C.D. Cal. Mar. 29, 2019)(finding infringer’s privacy interest in personally identifiable information to be minimal). There is no good cause for a protective order, least of all for Doe’s restrictive version. 2. A Broad Protective Order Frustrates Enforcement and Rewards Concealment Granting an infringer’s request for sweeping protective order restrictions inverts the logic of Rule 26(c) and the purpose of the DMCA subpoena process. Protective orders are meant to shield sensitive personal information, trade secrets, or competitive data, not to insulate willful infringers from accountability. The DMCA subpoena process is intended to unmask infringers to allow enforcement against them. Doe will have the opportunity to defend on the merits in litigation. Doe’s proposal would obstruct further lawful investigation and litigation. Shueisha must be free to use identifying information to pursue claims wherever appropriate, coordinate with law enforcement, seek additional subpoenas if the identifying information in the production is insufficient, or notify others whose works were infringed. Doe’s proposed order would prevent such uses and would improperly convert the subpoena into a one-time, sealed transaction, contrary 2 Under Fed. R. Evid. 201 the Court may take judicial notice of the publicly reported scale of Doe’s infringement operation. See, e.g., https://www.cbr.com/mangajikan-manga-piracy-site-shut-down-185-million-monthly-users/ (reporting Doe’s website had 185 million monthly users prior to Shueisha’s enforcement efforts). Case Gonzalez Hon. Yvonne 4:25-mc-80147-YGR Rogers Document 16 Filed 11/13/25 Page 5 of 5 November 13, 2025 Page 4 to Rule 26 and the DMCA’s enforcement goals. Specifically, Doe’s request for a 180-day limit on the use of the data conflicts with the statute of limitations for copyright actions. Doe’s request to limit enforcement to the United States ignores that Doe may be located abroad beyond the reach of U.S. Courts. Doe’s proposal would also restrict Shueisha from using the subpoenaed data to identify and pursue potential other infringers identifiable. None of these outcomes are acceptable. In addition, Doe’s proposal would impose unnecessary administrative burdens on the Court. Doe’s overly complex proposal will undoubtedly spawn disputes over compliance, access, and inadvertent disclosure. Applying an automatic Attorney’s Eyes-Only designation to all produced documents and restricting Shueisha’s ability to request additional subpoenas or serve process on Doe without prior court approval are just two examples of just how far Doe is reaching. Moreover, forcing Shueisha to unnecessarily pursue additional subpoenas in support of foreign litigation, if necessary, under 28 U.S.C. 1782, to obtain the exact same information sought in the pending subpoena would be a waste of judicial resources. These issues are entirely avoidable by forgoing a protective order or, if the Court deems it necessary, by utilizing Shueisha’s more narrowly tailored proposed order. 3. Public Interest Strongly Favors Transparency and Accountability Federal courts recognize a presumption of openness in judicial proceedings. See Nixon v. Warner Commc’ns, Inc., 435 U.S. 589, 597 (1978). This presumption carries special force where, as here, the underlying conduct affects the integrity of the copyright system and the economic viability of creative industries. The public has a legitimate interest in knowing who operates large- scale piracy sites and how the DMCA process vindicates statutory rights. Sealing or concealing those identities under an expansive and restrictive protective order would erode public confidence in both the DMCA and the Court’s enforcement role. 4. Limited, Targeted Protections Adequately Address Any Legitimate Concern If the Court finds any basis for a protective order at all, it should confine the order’s restrictions to the minimum necessary to prevent misuse of personal data, as proposed in Shueisha’s proposed protective order, which includes the following components: • Permitting use of the information solely for purposes of investigating and prosecuting infringement, while allowing public disclosure as necessary for filings or enforcement; • Allowing redaction of sensitive contact information from publicly filed documents; • Prohibiting use of information for purposes unrelated to copyright enforcement. These narrow provisions would satisfy Rule 26(c)’s requirement of proportionality without granting the infringer the de facto anonymity that Congress expressly refused to guarantee in § 512(h). Anything broader would improperly allow infringers like Doe to use protective orders as a mechanism of continued immunity from enforcement. Conclusion Because the anonymous infringer, Doe, has no specific, good-cause basis for extensive confidentiality protections or limitations on Shueisha’s ability to pursue its copyrights, and because broad restrictions would contradict both Rule 26(c)’s limited purpose and the DMCA’s enforcement design, the Court should not issue a protective order. If the court finds that good cause and specific non-enforcement-related harms to Doe exist, the Court should grant only the narrowly tailored protections limited to redacting personal identifiers or genuinely sensitive information prior to the onset of litigation reflected in Shueisha’s proposed protective order. Doe’s request for sweeping protections for their infringing activities should be denied.