See Also: Moving from Vulnerability Management to Effective Vulnerability Response

If a federal district judge determines the case could proceed to the discovery phase, that could require the defendants to be deposed and hand over documents, potentially revealing previously unknown facts about the hack of Democratic National Committee computers by the Russians in the run up to the 2016 U.S. presidential election. “Emails, texts and other communications from the Trump campaign would be fair game for discovery,” privacy and cybersecurity lawyer Christopher Pierson, who is not involved in the case, tells me.

“Ultimately, these particular plaintiffs may or may not care whether they get a check in the end. They care about finding out what happened.” 

The plaintiffs could declare a moral victory even if they don’t eventually prevail. “Ultimately, these particular plaintiffs may or may not care whether they get a check in the end,” says cybersecurity lawyer and author Mark Rasch. “They care about finding out what happened, publicizing it. That’s not uncommon, particularly in a highly charged political environment.”

The plaintiffs include two Democratic Party donors – Roy Cockrum, a former Episcopal monk, and Eric Schoenberg, a businessman who served in the Foreign Service during the Reagan administration – as well as Scott Comer, a mid-level staffer at the DNC. Representing the plaintiffs is Project Democracy, a watchdog group founded by former Obama administration lawyers.

The lawsuit, filed July 12 in the U.S. District Court for the District of Columbia, contends the plaintiffs’ private information – Social Security numbers, medical information and details of their private lives – was published as a calculated political strategy in which the Trump administration and Stone played a central role.

The lawsuit comes as the Justice Department special counsel, former FBI Director Robert Mueller, investigates the Russians for interfering in the 2016 presidential election and whether the Trump campaign was involved. Rasch says if Mueller feels the plaintiffs’ lawsuit would interfere with his probe, he could ask the court to stay the discovery. But he says that usually only occurs when the government is a party to the legal action, which is not the case with this lawsuit. “Private litigants have a right to litigate private matters on their own,” Rasch says.

Looming Deadline

The plaintiffs acted as a one-year statute of limitation deadline for filing privacy invasion lawsuits loomed. WikiLeaks first published stolen DNC emails last July 22.

“These plaintiffs are using the law and the American civil justice system the way it was intended: to vindicate important rights and values, such as the right to privacy and the right to participate in the political process; and to deter others who might consider colluding with a foreign government for political gain,” Project Democracy Executive Director Ian Bassin, a former associate counsel in the Obama White House, says in a statement. “Each of these victims expressed a sense of duty at various times to seek justice, even after a tumultuous year resulting from their private information being published for the world to see, and even knowing that stepping forward could bring new attacks.”

A spokesman for President Trump’s outside legal team did not respond to a request for comment, according to The New York Times. But Stone – who has said he had communications with WikiLeaks founder Julian Assange and a “completely innocuous” Twitter exchange with the DNC hacker known as Guccifer 2.0 – issued a statement, published by the online news outlet LawNewz.com, characterizing the lawsuit as baseless and completely without merit. “Essentially someone has pasted together a series of questionable media claims for which there is no evidence whatsoever,” he said.

Building a Circumstantial Case

Indeed, in making a circumstantial case of conspiracy against the defendants, the suit lists details about the Russian hacking and interference in the election that can be found in news reports, congressional testimony and government documents. One example: the email string released this past week by the president’s son, Donald Trump Jr., of the meeting he, senior presidential adviser Jared Kushner and then-Trump campaign chairman Paul Manafort held with Russian lawyer Natalia Veselnitskaya on June 9, 2016, with the purported intent of receiving political dirt on Democratic Party presidential nominee Hillary Clinton.

To be successful, the plaintiffs will have to prove they were harmed by the leaks and that the Trump campaign and/or Stone were responsible. The lawsuit furnishes a lengthy list of harms it contends befell the defendants, including the outing of one of the defendants to his grandparents who did not know he was gay and emotional distress he experienced by harassing phone calls he received. Often, to succeed in such a lawsuit, the plaintiffs must show financial harm caused by defendants’ actions.

To prove a conspiracy, the plaintiffs needn’t show [that] the defendants colluded with WikiLeaks. What they must prove is that the Trump campaign and Stone plotted with the Russians who were behind the hack and that the Russians colluded with WikiLeaks to publish the stolen emails and documents. “The biggest challenge here will be proving the defendants a part of this conspiracy through a proximate cause analysis,” Pierson says. Proximate cause is an event sufficiently related to a legally recognizable injury to be held as the cause of that injury. “Was it foreseeable that the alleged actions of trying to get Russian operatives to hack and leak sensitive information to WikiLeaks .. would cause the harm that is alleged?” he asks.

Russia, WikiLeaks Not Among Defendants

The lawsuit neither names Russia nor WikiLeaks as defendants, which could suggest a political motive for the legal action. “If the suit were intended as a real effort to mitigate a harm, it would name all of the people who caused the harm,” says Paul Rosenzweig, a cybersecurity lawyer and consultant who teaches a course in cybersecurity law and policy at George Washington University. “Perhaps not Russia, which is likely immune, but certainly WikiLeaks.”

But the process of the lawsuit – seeking the truth about who should be held liable for the DNC hack and the leaking of personal information – could be as important as the final verdict. As Rasch warns: “A lawyer with subpoena power is a dangerous thing.”