Docket: T-662-16
Citation: 2019 FC 1047
Ottawa, Ontario, August 6, 2019
PRESENT: Mr. Justice Boswell
PROPOSED CLASS PROCEEDING
| BETWEEN:
|
| VOLTAGE PICTURES, LLC,
COBBLER NEVADA, LLC,
PTG NEVADA, LLC,
CLEAR SKIES NEVADA, LLC,
GLACIER ENTERTAINMENT S.A.R.L.
OF LUXEMBOURG,
GLACIER FILMS 1, LLC, and
FATHERS & DAUGHTERS NEVADA, LLC
|
| Applicants
|
| and
|
| ROBERT SALNA, JAMES ROSE and LORIDANA CERRELLI, PROPOSED REPRESENTATIVE RESPONDENTS ON BEHALF OF A CLASS OF RESPONDENTS
|
| Respondents
|
| and
|
| ROGERS COMMUNICATIONS INC.
|
| Non-Party Respondent
|
| and
|
| SAMUELSON-GLUSHKO CANADIAN INTERNET POLICY AND
PUBLIC INTEREST CLINIC
|
| Intervener
|
ORDER AND REASONS
[1]
This matter is a continuation of the Applicants’ motion for a Norwich order to compel Rogers Communications Inc. to disclose the contact and personal information of the Respondent Robert Salna. As case management judge of this proceeding, I issued an order on July 28, 2016 [the Norwich Order] compelling Rogers to disclose the contact and personal information of the Respondent Robert Salna, then identified as John Doe.
[2]
The motion has been returned to this Court by the Supreme Court of Canada to allow Rogers to prove its reasonable costs of compliance with the Norwich Order. In its reasons, the majority of the Supreme Court concluded that Rogers is entitled to its reasonable costs of compliance with the Norwich Order.
[3]
The Applicants [collectively, Voltage] contend that Rogers should not be entitled to any compensation for compliance with the Norwich Order because of the deficient nature of its evidence; or, alternatively, if Rogers’ evidence is relied upon by the Court, Voltage says this evidence shows that $3.50 to $5.00 is the reasonable cost of compliance.
[4]
Rogers claims it is entitled to be compensated for all of the steps it took to comply with the Norwich Order at a fee of $100 per hour. According to Rogers, the evidence shows it takes Rogers’ employees, on average, approximately 24 minutes (0.4 hours) to look up an internet protocol [IP] address at two time stamps (or 12 minutes per time stamp). The Norwich Order required Rogers to identify information at five time stamps and, consequently, Rogers says it should be paid $100, plus HST, for the work required to comply with the Norwich Order (i.e., 5 x 12 minutes = 60 minutes).
I.
The Notice and Notice Provisions in the Copyright Act
[5]
Sections 41.25 and 41.26 of the Copyright Act, RSC 1985, c C-42 [the Act], establish the so-called “notice and notice”
[N&N] regime. The N&N regime imposes two explicit obligations upon an internet service provider [ISP] such as Rogers.
[6]
First, after a copyright owner has sent a notice of a claimed infringement to an ISP in accordance with section 41.25 of the Act, the ISP must forward the notice electronically to the person to whom the IP address is assigned by virtue of paragraph 41.26(1)(a). The second obligation is contained in paragraph 41.26(1)(b). It requires an ISP to retain records allowing the identity of the person to whom the IP address is assigned to be determined, and to do so for six months beginning on the day on which the notice of claimed infringement was received by the alleged infringer. If the copyright owner commences proceedings relating to the claimed infringement and notifies the ISP before the end of those six months, the ISP must retain such records for one year after the day on which the alleged infringer received notice of the claimed infringement.
[7]
Subsection 41.26(2) of the Act addresses whether an ISP may charge a fee for complying with these obligations:
(2) The Minister may, by regulation, fix the maximum fee that a person may charge for performing his or her obligations under subsection (1). If no maximum is fixed by regulation, the person may not charge any amount under that subsection.
[8]
The Minister has not yet fixed a fee, so no fee may be charged by an ISP for complying with its obligations under subsection 41.26(1) of the Act.
II.
Judicial History
[9]
The Norwich Order was issued on July 28, 2016, following a motion by Voltage to compel Rogers to disclose the identity of any and all contact and personal information of a representative respondent named John Doe, with no fees or disbursements payable to Rogers pursuant to sections 41.25 and 41.26 of the Act (Voltage Pictures, LLC v John Doe, 2016 FC 881 [Voltage FC]). At the hearing of the motion, Rogers took no position on whether Voltage was entitled to a Norwich order. It maintained, however, that if the order was granted, it should be entitled to recover from Voltage its reasonable costs of compliance with the order (which Rogers calculated at a rate of $100 per hour, plus HST).
[10]
In response to the motion, Rogers filed an affidavit from Kristi Jackson, the Manager of Lawful Access Response [LAR] at Rogers Communications Canada Inc. (a subsidiary of Rogers). She stated in her affidavit that the LAR group does not have access to Rogers’ N&N platform, but even if it did, the LAR group’s practice is to verify that customer information is correct before disclosing it to law enforcement or to comply with a court order.
[11]
Ms. Jackson provided evidence that there are several steps required to respond to a request for a Norwich order. In her affidavit dated June 10, 2016 she outlined the following steps:
1. The request is logged by a security analyst. The analyst enters the date, time, information requested, affected services, due date, and information about the requester into a database.
2. In the case of an IP address lookup, when the log entry enters the work queue to be processed, the IP is checked against an internet resource by a second security analyst to verify that it is indeed a Rogers IP address.
3. The security analyst assigned to process the request searches the IP address against a dedicated Rogers’ database that records all the users of any given IP address within the past 12 months (approximately). The query is narrowed to specific date and time parameters in order to identify a specific modem.
4. The modem identification information is queried against a duplicate modem list, to determine whether the modem has been cloned.
5. The modem is searched in the Rogers customer database. Three separate verifications are then performed to ensure that the correct customer has been identified.
6. Screenshots are made of the information generated in steps 2 through 5 and saved to a file as backup documentation.
7. The security analyst creates a document with the requested results and logs the completion date.
8. An investigator in the LAR group then reviews the screenshots and results document. If the investigator is satisfied with the result, it will be forwarded to the requester. Investigators log their participation in the process and then close the file.
[12]
Ms. Jackson did not provide a breakdown of the time required to complete these steps, but she did state that it takes approximately 20 to 30 minutes to identify a customer’s IP address.
[13]
As for the rate of $100 per hour, plus HST, Ms. Jackson’s affidavit stated the following:
24. Rogers usually charges $ 100 per hour, plus HST, for the time its employees spend responding to these types of requests in civil matters.
25. The staff who work in the Lawful Access Response group are salaried employees. A fair approximation of the hourly cost to Rogers of these employees is in the range of $25 to $40. There are also more highly paid investigators and managers who are necessary to run the group and can also be directly involved in the process.
26. In addition, Rogers incurs operations and infrastructure costs for maintaining the specialized systems to perform this work. These include indirect costs for real estate and equipment (the LAR group works in a secure facility with specialized computer systems) as well as the advanced training in the use of the systems provided by senior members and managers of the LAR group. Together, Rogers estimates that the cost is approximately $100 per hour.
[14]
Following issuance of the Norwich Order, Voltage appealed to the Federal Court of Appeal. The Court of Appeal found that, while Rogers appeared to have satisfied its obligations under the N&N regime in response to Voltage’s request for disclosure, “it used a completely different system, one used for law enforcement requests ... in order to verify its earlier work and ensure accuracy … [and its $100 per hour fee was] based mainly on the cost of this additional work”
(Rogers Communications Inc. v Voltage Pictures, 2017 FCA 97 at para 67 [Rogers FCA]). The Court of Appeal set aside that portion of the Norwich Order which required Voltage to reimburse Rogers at a rate of $100 per hour, plus HST. The Court of Appeal found there was insufficient evidence on the record to determine Rogers’ actual, reasonable, and necessary costs of compliance, and concluded that Rogers was not entitled to any reimbursement.
[15]
Rogers appealed the Court of Appeal’s decision to the Supreme Court of Canada. The Supreme Court found that, although an ISP is not required to provide a name and physical address to meet its obligations under the Act, an ISP is not permitted to recover the cost of carrying out any of the obligations, express or implicit, under subsection 41.26(1) of the Act after being served with a Norwich order. The Supreme Court also found that an ISP is not entitled to be compensated for every cost it incurs in complying with a Norwich order; an ISP can only recover (1) reasonable costs that (2) arise from compliance with a Norwich order (Rogers Communications Inc. v Voltage Pictures, LLC, 2018 SCC 38, at paras 37 to 39 and 51 to 53 [Rogers SCC]).
III.
The Supreme Court’s Directions
[16]
The majority in the Supreme Court (per Justice Brown) directed this Court to consider the following:
[55] Given the statutory prohibition on the recovery of costs arising from the notice and notice regime, motion judges should carefully review an ISP’s evidence to determine whether an ISP’s proposed fee is “reasonable”, in light of its obligations under the notice and notice regime. The evidence here, for example, is that Rogers undertakes an eight step manual process when it is ordered by a court to disclose the identity of one of its subscribers. ...
[56] In my respectful view, the motion judge erred in law by failing to interpret the full scope of an ISP’s obligations under s. 41.26(1), and then by failing to consider whether any of these eight steps overlap with Rogers’ statutory obligations for which it was not entitled to reimbursement. The Federal Court of Appeal therefore correctly set aside the motion judge’s order. … In response to a Norwich order requiring it to furnish such information (or other supporting information), an ISP is therefore entitled to the reasonable costs of steps that are necessary to discern a person’s identity from the accurate records retained under s. 41.26(1)(b). While these costs, even when combined, may well be small, I would not assume that they will always be “negligible”, as the Federal Court of Appeal anticipates.
[57] I do, however, agree with the Federal Court of Appeal that, on this record, it is impossible to determine Rogers’ reasonable costs of compliance in this case. As indicated above, to the extent the motion judge assessed the fee charged by Rogers, that assessment was not undertaken with reference to s. 41.26, properly interpreted. In the circumstances, which include the difficult and novel questions of statutory interpretation presented by this appeal, I would return this matter to the motion judge to allow Rogers to prove its reasonable costs of compliance. And, given those same circumstances, Rogers should be entitled to adduce new evidence to prove its reasonable costs of compliance with the Norwich order.
[17]
In separate reasons, Justice Côté expressed her view that the entirety of Rogers’ process for responding to Norwich orders is not covered by the Act and Rogers was therefore entitled to its costs. She stated that:
[73] The problem here is that the motion judge does not appear to have made an independent finding as to the reasonableness of Rogers’ eight-step process. He did conclude that Rogers’ fee of $100 per hour was reasonable — a finding that counsel for Voltage conceded was “thoroughly canvassed” in the underlying decision, and therefore need not be addressed again. But whether Rogers may charge $100 per hour does not answer the question of what Rogers may charge $100 per hour to do.
[74] On my interpretation of the statute, of course, Rogers’ eight-step process is not subsumed within the notice and notice regime. And as I have mentioned, it remains open to the motion judge under Brown J.’s reasons to adopt this interpretation and to conclude that Rogers’ process is otherwise reasonable. But even on my reading of the statute, I would still remit the matter for a determination of whether the time that Rogers spends completing its eight-step process is reasonable. The motion judge should make a finding on this point in the first instance, separate and apart from his finding on the reasonableness of the hourly rate.
IV.
The Supreme Court’s Decision
[18]
Writing for the majority, Justice Brown found that an ISP has the following obligations under the N&N regime:
[36] … given that a Norwich order, if obtained, will require an ISP to disclose the name and physical address of the person who was sent notice under the regime, Voltage says that it only makes sense that these details first be identified at the time that notice is forwarded.
[37] Respectfully, I cannot agree. Section 41.26(1)(a) requires an ISP to determine to whom the IP address belonged only in order to “forward the notice electronically” to them. The requirement of electronic (as opposed to personal) delivery can be discharged in various ways that do not require an ISP to know the relevant person’s name and physical address. In this case, for example, Rogers says that it forwards notice electronically via e-mail. What s. 41.26(1)(a) requires of an ISP, therefore, is (1) determining who was assigned the IP address specified in the notice, so as to allow the notice to be forwarded electronically to that person, and (2) verifying the accuracy of that determination, so as to ensure that the person who receives notice is, in fact, the person to whom the IP address specified in the notice belongs. Again, to be clear, s. 41.26(1)(a) does not require an ISP to identify that person by name or physical address, but merely to determine that person as the person to whom the impugned IP address belonged.
[38] I note that the steps which an ISP must take to verify accuracy — that is, to verify that it has forwarded notice to the correct person — may depend upon the method by which an ISP forwards notice electronically under s. 41.26(1)(a). In this case, for example, Rogers says that one of the systems it uses to forward notice via e-mail is automated to correlate the impugned IP address contained in a copyright owner’s notice to the e-mail address belonging to the person who was assigned that IP address at the time of the alleged infringement. This system then forwards the copyright owner’s notice to that person via e-mail and confirms to the copyright owner that it has done so. Rogers says that there is no indication that its automated system is inaccurate. Rogers’ automated system is not, however, used in all circumstances. In some cases (including, it appears, the case before us), a Rogers employee must, upon receiving a copyright owner’s notice, manually look up the e-mail address belonging to the person who was assigned the impugned IP address. Given the differences between these two systems, Rogers may be required to undertake different verification steps where it is required to utilize its manual, as opposed to its automated, process.
…
[43] ... Section 41.26(1)(b) does not require an ISP to actually disclose the records to which the provision refers. In other words, s. 41.26(1)(b) does not contemplate that anyone other than the ISP will have access to or use of its records. At the very least, it does not follow from the statutory text that records (to which copyright owners and courts have no access) must be kept in a readable format that would permit copyright owners and courts to determine a person’s identity from them. …
…
[47] In brief, the three express obligations contained in ss. 41.26(1)(a) and 41.26(1)(b) carry with them several implicit obligations that an ISP must satisfy under the notice and notice regime. Specifically, s. 41.26(1)(a) requires an ISP to determine, for the purpose of forwarding notice electronically, the person to whom the IP address belonged. It also requires an ISP to take whatever steps that are necessary to verify that it has done so accurately lest it risk statutory liability for failing to actually forward notice to that person. It does not, however, require an ISP to determine the name and physical address of that person.
…
[51] … Absent a regulation fixing a maximum fee, s. 41.26(2) prohibits an ISP from charging a fee for performing any of its obligations arising under the notice and notice regime. I have found that these obligations implicitly include (1) determining, for the purposes of forwarding notice electronically, who was assigned the impugned IP address at the time of the alleged infringement; (2) taking all steps necessary to verify that the ISP has done so accurately; and (3) taking all steps necessary to verify the accuracy of records which would permit the ISP to identify the name and physical address of the person to whom notice was forwarded. Those obligations will have first arisen under s. 41.26(1) — that is, prior to the ISP’s obligations arising under a Norwich order. It follows that an ISP should not be permitted to recover the cost of carrying out any of the obligations, express or implicit, that will already have arisen under s. 41.26(1) when it takes them only after having been served with a Norwich order. …
[52] To be clear, there is a distinction between an ISP’s obligation under the notice and notice regime to ensure the accuracy of its records that allow the identity of the person to whom an IP address belonged to be determined, and an ISP’s obligation under a Norwich order to actually identify a person from its records. While the costs of the latter are recoverable, the costs of the former are not. Where, however, the steps that an ISP says it must take to verify the identity of a person in response to a Norwich order involve, in effect, verifying the accuracy of the very records which it was required by s. 41.26(1) to retain, the ISP cannot recover the resulting costs.
[53] Finally, it bears mentioning that an ISP is not entitled to be compensated for every cost that it incurs in complying with a Norwich order (Voltage Pictures (2015)). Recoverable costs must (1) be reasonable, and (2) arise from compliance with the Norwich order. Where costs should have been borne by an ISP in performing its statutory obligations under s. 41.26(1), these costs cannot be characterized as either reasonable or as arising from compliance with a Norwich order.
[19]
For Justice Côté:
[67] … even if some steps in Rogers’ Norwich process could be characterized as “verifying” pre-existing information or records, I respectfully reject Brown J.’s conclusion that Rogers should be precluded from seeking compensation on the basis of any purported implied obligation in s. 41.26(1).
[68] For one thing, customer information, including physical addresses, email addresses, and phone numbers, can change over time; and a Norwich order may be received well after the automated notice of infringement is first sent to the account holder. The accuracy of that information must still be verified at the time the account holder’s identity is requested by the copyright holder. After all, it is the account holder’s current identifying information that a claimant must obtain in order to initiate a legal proceeding for copyright infringement — not the identifying information as it may have existed when the automated infringement notice was sent. (Or, put more accurately, if and when an automated notice was sent.) Indeed, this is precisely the information that Voltage requested in its motion.
[69] But more importantly, it is of course possible that not all of the millions of infringement notices generated by Rogers’ automated platform are sent to the correct account holder in accordance with s. 41.26(1)(a). In some cases, this may be entirely outside of Rogers’ control — for example, where an account holder improperly enters an email address in his or her account profile, causing Rogers to send the notice to someone else. In other cases, there may be complicating factors that are identified only through Rogers’ manual process and not through the automated platform.
[70] For Brown J., the answer to this problem is that Rogers cannot seek compensation for verifying anything it has done through its automated platform. In effect, it must assume that the automated notice makes its way to the correct person each and every time, for every one of the millions of notice requests it receives. But if we accept the reality that the automated platform may sometimes result in errors, Rogers is left with only two options, according to Brown J.: either it must redesign its automated system around the identification needs that affect only a miniscule subset of those cases; or it must undertake manual verifications in response to a Norwich order for free.
V.
Framing the Issues
[20]
Rogers recognizes that the Court must adjudicate on a fairly small fee, but the issue of an appropriate fee for compliance with a Norwich order has, in its view, important precedential value. Companies related to Voltage have commenced multiple actions for copyright infringement in the Federal Court and they are bringing numerous Norwich motions against Rogers in the process of suing thousands of Canadians. Rogers notes it has been named as a non-party respondent to a number of Norwich motions filed in the Federal Court, including this one. According to Rogers, the result of this motion could provide important guidance in determining Rogers’ reasonable compensation for responding to future Norwich motions in those cases.
[21]
Voltage says the question faced by the Court is Rogers’ entitlement to its reasonable costs regarding this Norwich Order. As the Supreme Court stated, motion judges must carefully review an ISP’s evidence to determine whether its proposed fee is reasonable in light of its obligations under the N&N regime. In Voltage’s view, Rogers has tried to make this into a test case; whatever fee is set for this Norwich Order, it is unique to the facts and evidence before the Court.
[22]
In my view, the Court must address and assess the reasonableness of not only Rogers’ process for responding to Norwich orders, including in this application, but also whether its fee of $100 per hour, plus HST, is reasonable.
VI.
Evidentiary Issues
[23]
Rogers has filed an affidavit from an employee who works in the Lawful Access Response group, namely, Isabelle Freimuller, to explain the process it follows to respond to Norwich orders generally. Rogers says evidence of its practices in this regard can stand in place of what was actually done in Mr. Salna’s case, and that there is no evidence to show that what it did vis-a-vis Mr. Salna was different than what it generally does in responding to a Norwich order. If Ms. Freimuller’s evidence of practice is not accepted, Rogers claims it would be put to great expense to provide individual evidence for each application, and it would also be inefficient for the Court.
[24]
Rogers has also filed an affidavit from Andrew Yoo. He is involved in financial administration at Rogers and, in particular, in the financial reporting for the portion of Rogers’ business that includes the LAR group.
[25]
A third affidavit filed by Rogers is from Dianne Zimmerman. She is a law clerk employed at the law firm of Rogers’ legal counsel. This affidavit contains, among other things, eight affidavits from representatives of the internet service providers who obtained leave to intervene in Rogers SCC.
[26]
Voltage notes that Rogers has the burden to provide evidence as to what its reasonable costs were in complying with the Norwich Order. According to Voltage, Rogers has failed to adduce any facts or evidence as to the costs it incurred to comply with the Salna disclosure order, notably as to (i) the identity of the investigator who looked up Mr. Salna’s identity, (ii) how long it took, and (iii) the hourly rate of the investigator doing the work.
[27]
Voltage says the evidence the Supreme Court allowed Rogers to file in this motion is retrospective - what costs were actually incurred by Rogers when it complied with the Norwich Order in 2016. In Voltage’s view, none of Rogers’ evidence goes to the actual costs of compliance with the Norwich Order. Instead of filing relevant evidence, Voltage says Rogers has filed evidence of a general nature of how long it took in 2019 to look up 10 individuals’ identities at two different times in a separate and unrelated proceeding.
[28]
Voltage claims Rogers late-filed improper reply evidence (following the Applicants’ evidence being filed and cross-examinations on Rogers’ original evidence having taken place) to cooper-up its deficient original evidence. Voltage says the evidence regarding various costs from other lookups under other Norwich orders is hearsay, and that Rogers has failed to provide direct evidence about its N&N system.
[29]
In my view, Voltage’s complaints about Rogers’ affidavit evidence are ill-founded. Its reliance on Rosenstein v Atlantic Engraving Ltd., 2002 FCA 503, to show why Rogers’ additional evidence cannot be submitted, is misguided. The present matter is not an application, as was the case in Rosenstein; nor does Rule 312 of the Federal Court Rules apply to Rogers’ evidence.
[30] This is a motion. Rule 84(2) provides:
(2) A party who has cross-examined the deponent of an affidavit filed in a motion or application may not subsequently file an affidavit in that motion or application, except with the consent of all other parties or with leave of the Court.
[31] The relevant factors to be taken into account in deciding whether leave to file a further affidavit should be granted are: relevancy of the proposed affidavit; absence of prejudice to the opposing party; assistance to the Court; and the overall interest of justice (Pfzer Canada Inc. v Rhoxalpharma Inc., 2004 FC 1685 at paras 15 and 16).
[32] In this case, Voltage opted to cross-examine Ms. Freimuller in the face of a very clear warning that Rogers was putting in further affidavit evidence. Because of this notice, Voltage cannot come to this Court now and claim it was prejudiced by conducting the cross- examination and then having further evidence served upon it. There was no case splitting, as Voltage argues.
[33] Even though Rogers late-filed improper reply evidence, it is appropriate to grant leave to Rogers to file the additional affidavit evidence because it is relevant, there is an absence of prejudice to Voltage, it will assist the Court, and the overall interest of justice dictates that this evidence should be accepted.
VII.
Rogers’ Response to the Norwich Order
A.
The Freimuller Evidence
[34] Ms. Freimuller selected ten random IP addresses from a Norwich order (issued in POW Nevada, LLC v. Doe #1 et al, T-513-18) which required Rogers to conduct searches. She performed the entire workflow (in the steps stated below) to determine the identities and current addresses of the ten Rogers’ customers. Each IP address listed in the court order had two time stamps, meaning she had to confirm which Rogers’ customer the IP address belonged to at both times.
[35] According to Ms. Freimuller, the workflow Rogers uses to respond to a Norwich order involves six phases or steps as follows:
| Phase
|
Time requirement
|
| 1. Reviewing the court order and identifying the relevant Rogers IP addresses;
|
33 minutes
|
| 2. Logging the request to permit it to be tracked through the workflow process, and also to ensure that the screenshots and information generated and saved during the search can be found in the future if needed;
|
14 minutes
|
| 3. Searching IP address logs in the Dynamic Host Configuration Protocol [DHCP] database to find an alphanumeric identifier [MAC address] of the cable modem that was linked to that IP address at the relevant date and time;
|
31 minutes
|
| 4. Using the MAC address to search a separate Rogers database, Super System Graphic Interface [SGI], to find the customer associated with the cable modem at the relevant time;
|
97 minutes
|
| 5. Compiling all of the information into an Excel file; and
|
26 minutes
|
| 6. Having an investigator review the information collected by the security analysts as a quality assurance measure, check the information against a “duplicate modem list” , and finalize the Excel file containing the required information.
|
46 minutes
|
| Total time spent
|
247 minutes to look up ten IP address and associated customer information at two time stamps
|
[36] In Ms. Freimuller’s view, the first two steps of this process are self-explanatory. She says the third and the fourth steps are those by which the name and address of a Rogers’ customer is determined. The third step looks up the IP address. The fourth step links the IP address to the address and name of the customer.
[37] During oral argument, Rogers acknowledged that the third step potentially overlaps with information in its N&N system. The Freimuller affidavit states that there are two ways Rogers could access a link between the N&N information and a customer’s name and address. The first is by searching the DHCP database (the method Rogers uses). The DHCP method looks at the IP address and time stamp contained in a Norwich order to find an associated modem MAC address. The second is by using the “ticket information”
from Rogers’ N&N system known as Remedy.
[38] Ms. Freimuller says IP addresses can be permanently assigned to a specific device (a so-called “static IP address”
), or assigned to a device for a period of time before being reassigned to a different device (a “dynamic IP address”
). While a small number of Rogers’ customers have static IP addresses, the overwhelming majority have dynamic IP addresses. Depending on the time stamp, the same IP address can be associated with a different individual. As such, if the DHCP method is used, each time stamp must be checked individually to ensure that the IP address was associated to the same MAC address at all times.
[39] When Ms. Freimuller searched the ten IP addresses at two time stamps using the DHCP method, the total time was approximately 31 minutes, or 1.55 minutes per look up. Her affidavit also states that a cyber security specialist at Rogers undertook the work required to look up the ticket information in the Remedy system associated with the 10 IP addresses. That work, which would be done in place of the third step in the DHCP method, took 45 minutes to complete, or 2.25 minutes per IP address. This was 70 seconds longer than the time it took using DHCP database.
[40] The fourth step uses the MAC address to find a customer’s name and address. It looks up the MAC address in Rogers’ SGI database. This step provides the link between the cable modem and the customer name and current address on file in Rogers’ billing system. For the 10 IP addresses, this work took 97 minutes, or 4.85 minutes per look up.
[41] The fifth step involves transferring the information to an Excel spreadsheet. For each requested IP address, the analyst enters the corresponding Rogers’ file reference number, the customer name and address, and any relevant notes. The analyst also performs additional quality assurance at this step. This includes checking the screenshots to ensure the correct IP address was queried in the DHCP database and searching in the SGI database with the MAC address for the correct time range to identify the corresponding customer. For the 10 IP addresses, this work took 26 minutes, or 1.3 minutes per look up.
[42] The final step requires the investigator to perform additional quality assurance and also to check that the MAC address is not found in a duplicate modem list. Ms. Freimuller says modems may be duplicated for various reasons, such as by those who wish to mask their identities or potentially steal internet service from Rogers. If a modem MAC address appears on this list, the customer name will be disclosed with the caveat that the account is associated with a duplicate modem. According to Ms. Freimuller, in a duplicate modem scenario, the actual customer involved in the copyright infringement cannot be determined. For the 10 IP addresses, this final step took 46 minutes, or 2.3 minutes per look up.
B.
Rogers’ Fee
[43] Rogers stated during the hearing of this motion that the majority of disclosure orders it receives (including Norwich orders) are for matters where they are unable to collect any reimbursement, yet it uses the same process for all disclosure orders. Rogers says this demonstrates that it is not drawing out the process. According to Rogers, it has an incentive to look up its customers names efficiently, and this demonstrates the reasonableness of its process.
[44] In Rogers’ view, the evidence shows that, on average, it takes 24 minutes to look up a customer name and address information for each IP address in a Norwich order with two time stamps. At $100 per hour, Rogers says this amounts to $40 per IP address or $20 for each time stamp. For the five timestamps in the Norwich Order, Rogers claims that the evidence supports its requested compensation of $100 per hour, plus HST (i.e., 5 x $20).
[45] In response to the Court’s question during oral argument whether the DHCP system creates the same results as the Remedy system, Rogers stated it generates the same results, but there are occasional instances where the DHCP steps do not generate a result and, therefore, the Remedy system has to be relied upon. Rogers further stated that there is no evidence to show that the DHCP steps produce different information than the Remedy system. According to Rogers, it is equivalent information. The Remedy system contains a customer’s name, while the DHCP steps use a MAC address that is entered into another system to generate a name and address.
C.
Voltage’s View of Rogers’ Response
[46] Voltage contends that for Norwich orders connected to copyright, Rogers has its Remedy system in place and it is reasonable for Rogers to use easily accessible information from this system to respond to Norwich orders. In Voltage’s view, the majority of Ms. Freimuiler’s evidence simply verifies what the Remedy system already does; that is, identify an appropriate customer. According to Voltage, a customer’s name, email address, modem serial number, and account number are already stored in Remedy.
[47] Voltage notes that, although the Remedy ticket information does not contain a physical address for a customer, Ms. Freimuller acknowledged during her cross-examination that, instead of taking several minutes per IP address to look up the address through the DHCP database, a customer’s current address could be found through the account number (which is stored in Remedy) by using Roger’s SGI database. Voltage asserts that this process would take less than a minute to do.
[48] Voltage says that, without further evidence from the cyber security specialist at Rogers who undertook the work required to look up the ticket information in the Remedy system associated with the 10 IP addresses, six minutes (or 0.1 of an hour) would have been a reasonable time for Rogers to look up Mr. Salna’s information as ordered by the Norwich Order.
[49] In Voltage’s view, none of the steps the LAR group undertakes to comply with a disclosure order utilize the Remedy ticket information retained under its N&N regime. Voltage says Ms. Freimuller admitted during her cross-examination that the DHCP process and the Remedy system are independent paths that do not connect at any point. According to Voltage, Ms. Freimuller’s work starts from scratch when she uses the DHCP system; and that work (except for the address look up) has already been done by the Remedy system and stored in Rogers’ databases in accordance with the requirements of section 41.26 of the Act.
[50] Even if the Remedy system is not entirely accurate, Voltage says Rogers is re-doing the process to ensure the information is accurate and, therefore, is not entitled to these costs. Voltage further says an ISP must maintain accurate information, and if this checking was done to confirm the accuracy of the Remedy information the costs associated with this are not compensable (Rogers SCC at para 46).
D.
Analysis
[51] Voltage’s view - that Rogers is entitled to compensation only if the Remedy records are used to comply with a Norwich order - is flawed. The Supreme Court expressly rejected this analysis (Rogers SCC at paras 44 and 45).
[52] In my view, Voltage confuses an ISP’s obligations stemming from subsection 41.26(1) of the Act, which are: (1) determining, for the purposes of forwarding notice electronically, who was assigned the IP address at the time of the alleged infringement; (2) taking all steps necessary to verify the ISP has done so accurately; and (3) taking all steps necessary to verify the accuracy of records to permit the ISP to identify the name and physical address of the person to whom notice was forwarded.
[53] The N&N regime requires a copyright holder to identify the IP address allegedly connected to infringement of their copyright and the time at which the infringement occurred. The ISP has to electronically forward the notice to the account holder of the IP address. If the account holder provides an incorrect email - whether it was incorrect from the beginning or changed, or if the email is found through an automated or manual system - this affects the account holder’s ability to receive the notice but it does not affect a Norwich order. Taking the steps necessary to verify the accuracy of records to permit an ISP to identify the name and physical address of the person to whom a notice was forwarded could be met in various ways, including the use of information stored outside an N&N system (in this case, Rogers’ Remedy system).
[54] Paragraph 41.26(l)(b) of the Act does not require an ISP to retain records in a specific form useable by copyright holders (Rogers SCC at paras 42 and 43). From the information stored in its N&N system an ISP must be able to use this information, or use the information to link to other systems, to find a customer’s name and address. The link does not have to be found in one step, but the steps required must be reasonable.
[55] Rogers’ evidence shows that when a notice is sent through Remedy, it is processed and a ticket is created in its tracking system. These tickets act as a record that the notice was sent and can be queried using the IP address and a time stamp. The Remedy ticket stores, among other things, the customer’s name, email address, modem serial number, and account number. The Remedy system does not store a customer’s address information. Rogers has chosen to design its automated N&N system this way to store this information; another ISP may decide otherwise.
(1)
Is there Overlap?
[56]
I turn now to address the extent to which Rogers’ obligations as an ISP under subsection 41.26(1) of the Act overlap with the steps it took under the Norwich Order.
[57] The first two steps of Rogers’ process to respond to a Norwich order are compensable. They are directly related to the Norwich Order. They also are reasonable because, if Rogers is ordered to disclose a customer’s contact information, it can find the supporting documentation.
[58] The third step of Rogers’ process to ascertain a customer’s information involves searching IP address logs in the DHCP database to find the MAC address of the cable modem that was linked to the IP address at the relevant date and time. This takes 1.55 minutes per time stamp under the DHCP method. It takes 2.25 minutes per time stamp in the Remedy system.
[59]
The third step overlaps with Rogers’ obligations as an ISP under subsection 41.26(1) of the Act. The time Rogers takes to complete this step is not compensable because it is a procedure mandated by subsection 41.26(1). Rogers’ obligations under this subsection include: (1) determining, for the purpose of forwarding notice electronically, who was assigned the impugned IP address at the time of the alleged infringement; (2) taking all steps necessary to verify that the ISP has done so accurately; and (3) taking all steps necessary to verify the accuracy of records to permit the ISP to identify the name and physical address of the person to whom notice was forwarded. These obligations arise prior to Roger’s obligations arising under a Norwich order and it should not be permitted to recover the cost of carrying out these obligations (Rogers SCC at para 51).
[60]
For the fourth step, Rogers uses the MAC address to search the SGI database to find the customer associated with the cable modem at the relevant time. This step provides the link between the cable modem and the customer’s name and current address on file in Rogers’ billing system. It takes a Rogers’ analyst 4.85 minutes per time stamp to complete this step using the DHCP method and 0.5 minutes under the Remedy system. The difference between these two systems is approximately 4.35 minutes per look up. The question becomes: is this additional time reasonable or compensable?
[59] Rogers is not in the business of replying to Norwich orders. It has established a system which applies equally to law enforcement requests for disclosure as well as Norwich orders. The time saved for the holder of a Norwich order when Rogers uses the Remedy system does not make up for the inconvenience of Rogers having to process Norwich orders differently. As noted above, Norwich orders comprise a minority of requests for disclosure. It is not, in my view, unreasonable for Rogers to use the DHCP look up method over the Remedy look up method to complete this step; the difference in time between the two methods is not substantial.
[60]
In any event, the time associated with completing the fourth step is compensable. This step does not overlap with Rogers’ obligations as an ISP under subsection 41.26(1) of the Act. The time Rogers takes to fulfill its obligation under a Norwich order to actually identify a person from its records is compensable.
[61] The fifth step of compiling all of the information into an Excel file takes 2.6 minutes per IP address with two time stamps (or 1.3 minutes per time stamp). This is not part of the Remedy look up method and, therefore, is compensable. The amount of time to complete this step is not unreasonable.
[62] The final step involves additional quality checks and a search of the duplicate modem lists. The Remedy system should have identified a customer, or stated that a customer could not be identified. Voltage claims that, while an ISP must maintain accurate information, if checking this information is done to confirm the accuracy of a Remedy look up, it is not compensable.
[63]
An ISP is in the best position to understand who is accessing an IP address. This falls squarely in what the Supreme Court identified as an ISP’s obligations to determine, for the purposes of forwarding a notice electronically, who was assigned the impugned IP address at the time of the alleged infringement, and to take all steps necessary to verify that it has done so accurately (Rogers at para 37). These obligations arise by virtue of paragraph 41.26(1)(a) of the Act, and the time Rogers takes to fulfill them should not be included in the amount of time for which Rogers should be compensated. The final step Rogers says it must take to verify the identity of a person in response to a Norwich order involves, in effect, verifying the accuracy of the very records it was required to retain under subsection 41.26(1) and is not compensable (Rogers SCC at para 52).
[64]
To summarize, Rogers recoverable costs for complying with the Norwich Order are the value of the time associated with:
reviewing the order and identifying the relevant Rogers IP addresses; this step takes 1.65 minutes per time stamp;
logging the request to permit it to be tracked through the workflow process, and also to ensure that the screenshots and information generated and saved during the search can be found in the future if needed; this step takes 0.7 minutes per time stamp;
linking between the cable modem and the customer name and current address on file in Rogers’ billing system; this takes 19.4 minutes per time stamp; and
compiling all of the information into an Excel file; this step takes 1.3 minutes per time stamp.
[65]
The time it takes Rogers to complete these tasks totals 23.05 minutes per time stamp. For the five time stamps in the Norwich Order, it would have taken Rogers a total of 115.25 minutes to identify the customer information associated with the five IP addresses. In my view, the time Rogers spent in responding to the Norwich Order was reasonable.
VIII.
Calculating an Hourly Fee
[66]
I agree with Rogers’ submission that the $100 per hour fee was not rejected by the Supreme Court of Canada. Rogers maintains that the amount of the fee is not at issue as this was found to be reasonable in the first instance (Voltage FC at para 19) and this fee was not overturned by the Supreme Court of Canada. According to Rogers, a redetermination of the $100 per hour is barred because of issue estoppel or abuse of process. Rogers says it was only at the Federal Court of Appeal that the reasonableness of the hourly fee was at issue.
[67]
Although the Federal Court of Appeal found that the reasonableness of the $100 per hour fee should have been assessed (Rogers FCA at para 72), the Supreme Court did not explicitly assess the reasonableness of Rogers’ hourly fee to comply with the Norwich Order. The Supreme Court focused upon the overlap with the N&N provisions in the Act and the reasonableness of Rogers’ steps to comply with the Norwich Order.
[68]
I disagree with Rogers that a redetermination of the $100 per hour fee is barred because of issue estoppel or abuse of process. In my view, it is necessary to revisit and assess the reasonableness of Rogers’ hourly fee in view of the Court of Appeal’s decision and the Supreme Court’s silence on this issue.
[69]
Rogers relies upon Mr. Yoo’s affidavit to substantiate its hourly fee. Even though Rogers seeks to be paid a fee of $100 per hour, Mr. Yoo’s evidence is that the LAR group’s costs (including overhead) are $71.10 per hour per employee. It is unclear from his affidavit how the additional $29.10 was calculated.
[70]
Rogers says it costs $71.10 per hour per employee to run the LAR group on a daily basis, and that this amount does not include the costs of employees in the legal group who are also involved in responding to a Norwich order. The difference in the amounts of $71.10 and $100 comes from what Rogers claims are the additional costs attributable to its legal group employees.
[71]
According to Mr. Yoo, the amount of $71.10 was determined by taking the total number of working hours in a year for the LAR group, and subtracting statutory and floating holidays (11 days), vacation days (20 days), sick time (5 days), and administrative time (30 days) spent by employees on non-productive tasks such as training, attending staff meetings, and human resource matters. Mr. Yoo says this calculation produces a cost of $52.10 per hour in wage and benefit costs for a LAR group employee. Out of this amount, Mr. Yoo conceded during his cross-examination that only $34.76 per hour pertains to the wages paid to a LAR group employee, while the rest is benefits.
[72]
Mr. Yoo then added other costs to the amount of $52.10 per hour to arrive at an hourly fee of $71.10. Specifically, he added costs for leasing, heating, electricity, maintenance, and property taxes as well as operating expenses for facilities and capital expenses for the systems and buildings used by employees in the LAR group.
[73]
Voltage says the $52.10 per hour should be lower because 30 administrative days should not be included in the calculation. According to Voltage, if the administrative days are removed, the hourly rate would be $45.14 rather than $52.10 per hour for wages and benefits (or $34.76 per hour for only wages).
[74]
Voltage also says none of Rogers’ costs for overhead or benefits are incurred by compliance with the Norwich Order, and therefore only the direct labour costs are compensable. In Voltage’s view, it is unreasonable to include administrative time and overhead costs in the calculation of an appropriate hourly fee. Voltage says Rogers’ fee needs to be connected to complying with the Norwich Order and compensation is not at a full indemnity rate.
[75]
Voltage further says the information used by Mr. Yoo does not pertain to the year of the Norwich Order. Voltage notes that the estimated hourly fee provided by Kristi Jackson in 2016 was $33 per hour, and that this is close to the $34.76 per hour for wages calculated when the 30 administrative days and benefits are removed. Voltage concedes for the sake of simplicity and for this motion that a reasonable hourly fee would be $35 per hour.
[76]
Voltage says Rogers’ costs are constrained to looking up information from the accurate records retained under section 41.26 of the Act and not from any other process it utilizes to identify customers. According to Voltage, this stems from the Supreme Court’s conclusion that: “In response to a Norwich order requiring it to furnish … information …, an ISP is … entitled to the reasonable costs of steps that are necessary to discern a person’s identity from the accurate records retained under s. 41.26(1)(b)”
(Rogers SCC at para 56).
A.
What Is a Reasonable Hourly Fee?
[77]
I begin my analysis of what constitutes a reasonable hourly fee for Rogers to comply with the Norwich Order by noting the fees charged by ISPs other that Rogers.
[78]
The record shows that ISPs other than Rogers levy the following fees:
| ISP
|
Time Spent per IP address
|
Amount Charged
|
| Bell
|
20-45 minutes
|
$50 per IP address
|
| Cogeco Inc.
|
One hour
|
Not Described
|
| Quebecor/Videotron
|
Not Described
|
$200 per IP (1-5 addresses). Decreasing to $100 per IP (more than 20 addresses)
|
| SaskTel
|
Two hours
|
$50 per hour
|
| TekSavvy
|
One to Two hours
|
Not described, but seeks recovery of reasonable legal costs, Administrative costs, and disbursements.
|
| TELUS
|
30 minutes
|
$100 per hour
|
| X Plornet
|
Between 15 minutes and 24 hours
|
Not Described
|
| Shaw
|
Between 30 minutes and several hours
|
$250 per hour
|
[79]
The foregoing shows that the amount charged and the time spent for ISPs to respond to a Norwich order is not uniform. However, this information does inform an assessment of whether Rogers’ fee and time spent is reasonable.
[80]
The Yoo affidavit is not specific to the Norwich Order. It speaks only in general terms. During oral argument, Rogers said it keeps meticulous records about how disclosure requests are completed, and this being so, it should have submitted the Excel information for the Salna disclosure.
[81]
There are several problems with the Yoo affidavit. First, Mr. Yoo’s calculations were performed with reference to data from 2017 to 2019 and not from 2016 when Mr. Salna was identified by Rogers. Second, it is difficult (if not impossible) to determine the source of the numbers utilized by Mr. Yoo; for example, instead of providing the hourly wage of an employee in the LAR group, Mr. Yoo used the total wages and benefits budgeted to the group and divided that total by the total available working hours per employee. Third, even using this obtuse calculation, the total available hours is fundamental to Mr. Yoo’s calculations; the lower that number, the higher the equivalent hourly rate would be.
[82]
I agree with Voltage that it was inappropriate for administrative time to be included in Mr. Yoo’s calculation of an hourly fee of $71.10 per LAR group employee. Excluding the days attributable to administrative time reduces the hourly rate to $45.14 versus $52.10 per hour for wages and benefits (or $34.76 per hour for just the wages). The administrative time associated with training is not compensable (Southworks Outlet Mall Inc. v Bradley, 97 OR (3d) 796 at para 26 (ii)).
[83]
The remainder of Mr. Yoo’s calculation of the amount of $71.10 per hour used various overhead costs associated with running the LAR group. Mr. Yoo allocated the LAR group its share of these costs to arrive at $19.00 per hour; which, when added to the $52.10 per hour for wages and benefits, equals $71.10 per hour. Mr. Yoo admitted during his cross-examination that none of these overhead costs arise from compliance with the Norwich Order or any other disclosure order and, in my view, these costs are not compensable and only Rogers’ direct labour costs are recoverable.
[84]
I agree with Voltage that none of Rogers’ costs for overhead or employee benefits were incurred by compliance with the Norwich Order and, therefore, only the direct labour costs are compensable. Generally speaking, standard office overhead costs are not compensable as disbursements (Mark M. Orkin, The Law of Costs, 2nd ed, (Toronto: Canada Law Book) (loose-leaf updated April 2018), section 219.6).
[85]
An ISP’s fee for disclosure pursuant to a Norwich order is not meant to fund real estate costs or computer infrastructure. Reasonable compensation must be directly tied to complying with a disclosure order (Glaxo Wellcome PLC v Minister of National Revenue, [1998] FCJ No 874 at para 68 and Voltage Pictures LLC v John Doe, 2015 FC 1364 at paras 36 to 38).
IX.
Conclusion
[86]
In view of the foregoing, and the concession of Mr. Yoo during his cross-examination that only $34.76 per hour pertains to the wages paid to an employee of the LAR group, as well as Voltage’s concession that a reasonable hourly rate would be $35 per hour, I conclude that a reasonable hourly fee for Rogers’ compliance with the Norwich Order is $35.00.
[87]
The evidence shows that, on average, it takes 24 minutes for Rogers to look up the customer name and address information for an IP address with two timestamps (or 12 minutes per time stamp). However, in view of my finding above that it would have taken Rogers a total of 115.25 minutes to identify the customer information associated with the five IP addresses in the Norwich Order, Rogers is entitled to compensation of $67.23, plus HST, for searching and disclosing the customer name and address information associated with the five time stamps in the Norwich Order (i.e., $35.00 x 115.25 minutes/ 60 minutes = $67.23). Voltage shall pay Rogers the amount of $67.23, plus HST, within 30 days of the date of this order.
[88]
Voltage requests its costs of this motion at an elevated scale due to the allegedly abusive nature of Rogers’ late-filing of evidence and its disregard of the Supreme Court’s directions as to what evidence it could file. Rogers does not seek its costs of this motion and requests an order directing Voltage to pay its reasonable costs of compliance with the Norwich Order in the amount of $100 plus HST.
[89]
In view of the circumstances by which this motion was returned to the Court, I decline to exercise my jurisdiction to award costs. Therefore, there shall be no order as to the costs of this motion.
Email this Content