Kazakhstan vs. Mega Limited

In what surely is among the more unexpected news (or is it?) the Republic of Kazakhstan has taken Dotcom’s Mega Limited to the High Court in Auckland this month after documents were allegedly stolen from the Republic’s servers.

Kazakhstan originally filed a civil action in the United States District Court for the Southern District of New York against the unknown hackers. This naturally hit some rocky ground because neither Kazakhstan, nor the court, knew who the hackers were. The defended was listed as “Doe”, as in “John Doe”.

As you could guess, John Doe didn’t turn up and Kazakhstan’s representatives were the only ones at the hearing.

However the US Judge did find:

There is good cause to find that the Mega website contains at least 27 files that collectively contain or once contained 27 articles containing screen shots of excerpts of the Stolen Documents. Mega now hosts these Stolen Documents. The [Kazakhstan] Republic does not know who uploaded these files to the Mega website. Mega should have information (the identifying information) which will help identify who uploaded these files. The identifying information includes the IP addresses, email addresses, contact information, account information and payment information for the accounts that were used to upload the articles containing screen shots or excerpts of the Stolen Documents onto the Mega website.

Enter the New Zealand High Court.

Judge Ramos of the SDNY wrote to the New Zealand High Court and thus began Republic of Kazakhstan v Mega Limited [2016] in Auckland, New Zealand.

It goes without saying that Mega put up a stiff defense, claiming their service was based on trust and holding the privacy of their users was of great importance. Their representative also scrambled to pick at holes in Kazakhstan’s application on legal grounds. Their defense and other notes can be found here.

In the end though the High Court ruled against Mega Limited and directed:

(a) The issuing of the subpoena requiring an authorised representative of Mega to attend at the High Court for examination before the Registrar and to produce documents in Mega’s possession, custody and/or control sufficient to identify the:
(i) IP addresses;
(ii) email addresses;
(iii) contact information;
(iv) account information; and
(v) payment information,
connected to the accounts of certain users of [Mega’s] website.

This will be very interesting to keep an eye on. Let this be a warning to hackers and their backers that they can’t hide behind anonymous services in far off jurisdictions.

It is good that the New Zealand High Court came to the party and made this decision.

More importantly it shows that the claims made by Mega in the past about anonymity were somewhat misleading.


THANK YOU for being a subscriber. Because of you Whaleoil is going from strength to strength. It is a little known fact that Whaleoil subscribers are better in bed, good looking and highly intelligent. Sometimes all at once! Please Click Here Now to subscribe to an ad-free Whaleoil.

  • one for the road

    Btw, when is that german sausage going to be extradited?

  • Korau

    My understanding of the Mega service is Mega has no way of accessing the contents of any file. The key for this is held by the depositor. I know this because I lost my key, but luckily there was nothing of importance in the vault.

    Kazakhstan must have some way of identifying these people, most likely IP addresses or email addresses of known hackers. Otherwise it’s just a fishing trip, and this is not suggested by the court ruling.

    If the baddies were careful how they accesses Mega, or salted the documents to change the size (which may also be part of Mega’s operation) it will make it very difficult to locate the file/s by file size.

    If the files are located (a big “if”) the contents are beyond reach of the authorities without the the requisite key. Therefore it’s a pyrrhic victory at best.

    • Teletubby

      From the stories I have read on this my understanding is the documents were made available to others through Mega and from this the Kazak government are requesting information relating to specific Mega user names

    • Kevin

      “My understanding of the Mega service is Mega has no way of accessing the contents of any file. The key for this is held by the depositor. ”

      If that’s the case then Mega could be operating illegally just by doing this. As I understand the law, a company must hand over encryption keys or give full access to files if required by the government, at least in the US.

      • Korau

        This is the basis of the recent US court case between the FBI and Apple. Apple resisted furiously, supported by other tech companies. Thisall hearks back to the Edouard Snowden leaks which have cost the tech companies (when I last heard a figure) at least sixteen billion dollars in sales because they were seen by non US users as giving backdoor access to the US alphabet soup of three letter law agencies.

        The tech companies are developing tech so that they are unable to access encrypted data, and data will be encrypted before going to the tech servers.

        This is the Mega system. Mega, being a New Zealand domiciled business, is not subject to the vagaries of the US court system (unless there are treaties in place, or that nice Mr Key is giiving our sovereignty away under TPP!!).

  • Nebman

    Is it precedent setting by any chance? I’m far from an expert but this judgement indicates that as long as someone can prove that stolen information is hosted on a particular site then the cookie trail can be followed?

    Or is it too simplistic?

  • Dave

    “claims made by Mega in the past about anonymity were somewhat misleading” Since they have lost the case, and unless they appeal, then they will need to alter their claims, as now it is misleading and deceptive.

  • H. Upmann

    Get Borat on the job — sorted.

  • shykiwibloke

    All roads led to Rome once. All dodgy govt document hacking in this end of the world seems to somehow be connected with the same few.

  • zotaccore

    but but but… when will this end up having the fat german sausage extradicted to either the US or a cool chilly thin mattressed cell in Kazakhstan?